stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

stunnel not seeing ca bundle files
by sf.techguy＠gmail.com 12 Mar '08

12 Mar '08

I'm running stunnel 4.14 on Darwin 7.0.0 (Mac OS X Server 10.4.11), with OpenSSL 0.9.71. I purchased a security certificate from comodo, and was able to get it installed and working (mostly) with stunnel, but when I browse to the website, I get an error that the the browser can't verify the identity of the site, due to a problem w/the security cert. I called comodo, and they the error is caused by stunnel not seeing the intermediate certificate files that they told me need to be installed in order for their certificate to work. These files were: ComodoUTNServerCA.crt UTNAddTrustServerCA.crt AddTrustExternalCARoot.crt EssentialSSLCA.crt my_server_net.crt I modified stunnel.conf, and included this line: CApath = ca-certs/ (<- dir path, relative to chroot, containing above files) But the error persists. Can anyone tell me if what comodo support is telling me is even correct? I've verified that my .key and .crt files match by running: $ openssl x509 -noout -modulus -in server.crt | openssl md5 $ openssl rsa -noout -modulus -in server.key | openssl md5 And the output of both matches. Not sure what to try next. Any help much appreciated! Thanks in advance...

3 2

(no subject)
by Eddie Castelli 11 Mar '08

11 Mar '08

Dear all, Some years ago I have installed Apache, PHP and mySQL. Now I need to update. Unfortunately I can't remember if I installed a package or individual program elements. Could please someone help me and guide me trough as I need urgently the update. Many thanks in advance. -- best regards Eddie

3 3

behaviour on remote disconnection
by Marek Jarycki 11 Mar '08

11 Mar '08

Hi. I'm using 3.26 version of stunnel. How to disallow creating local sockets (on client side) when remote (server) is not available? My application detects socket creation errors and it works without stunnel, but in stunnel the socket is always opening correctly so I have to wait for timeouts to discover network disconnection. Regards, deimoss

2 1

Re: [stunnel-users] unknown protocol error (140770FC) with xinetd
by Ian Pilcher 10 Mar '08

10 Mar '08

Ian Pilcher wrote: > ... and the (non-working) server-side stunnel configuration: > > cert = /etc/stunnel/rsyncs_cert.pem > key = /etc/stunnel/private/rsyncs_key.pem > client = no > pid = /var/run/stunnel.pid > RNDfile = /var/run/stunnel/random_seed > foreground = yes > debug = debug > output = /var/run/stunnel/stunnel.log > > exec = /usr/bin/rsync > execargs = rsync --daemon Amazing how sending off the question gets the old brain cells working (or maybe it was the second cup of coffee). The problem was "foreground = yes". Since xinet.d redirects stderr back over the network connection, the stunnel startup messages were going back to the client. For some reason, the client didn't think that was a proper SSL handshake. ;-) -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

1 0

unknown protocol error (140770FC) with xinetd
by Ian Pilcher 10 Mar '08

10 Mar '08

I am trying to set up rsync over SSL with stunnel. I've got things working when I run stunnel standalone on both systems, but I have been unable to get things working when I run stunnel via xinetd on the server (haven't tried using xinet on the client yet). Here is the (standalone) server configuration that works: cert = /etc/stunnel/rsyncs_cert.pem key = /etc/stunnel/private/rsyncs_key.pem client = no pid = /var/run/stunnel.pid RNDfile = /var/run/stunnel/random_seed foreground = yes debug = debug ;output = /var/run/stunnel/stunnel.log [rsyncs] accept = 2873 exec = /usr/bin/rsync execargs = rsync --daemon Here is the (non-working) server-side xinetd configuration: # default: off # description: rsync tunneled over SSL (stunnel) service rsyncs { disable = no flags = IPv4 socket_type = stream wait = no user = root server = /usr/sbin/stunnel } ... and the (non-working) server-side stunnel configuration: cert = /etc/stunnel/rsyncs_cert.pem key = /etc/stunnel/private/rsyncs_key.pem client = no pid = /var/run/stunnel.pid RNDfile = /var/run/stunnel/random_seed foreground = yes debug = debug output = /var/run/stunnel/stunnel.log exec = /usr/bin/rsync execargs = rsync --daemon Trying to connect to the non-working configuration with openssl s_client, I get: CONNECTED(00000003) write to 0x9b9e938 [0x9b9f068] (133 bytes => 133 (0x85)) 0000 - 80 83 01 03 01 00 5a 00-00 00 20 00 00 39 00 00 ......Z... ..9.. 0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............ 0020 - 00 00 33 00 00 32 00 00-2f 03 00 80 00 00 66 00 ..3..2../.....f. 0030 - 00 05 00 00 04 01 00 80-00 00 63 00 00 62 00 00 ..........c..b.. 0040 - 15 00 00 12 00 00 09 06-00 40 00 00 65 00 00 64 .........@..e..d 0050 - 00 00 14 00 00 11 00 00-08 00 00 06 04 00 80 00 ................ 0060 - 00 03 02 00 80 3e b4 89-34 c1 e6 93 97 2d 8d ca .....>..4....-.. 0070 - 90 e1 4c 51 e1 71 c7 54-ed 52 0c 6e 2e 47 90 9b ..LQ.q.T.R.n.G.. 0080 - 8e c6 73 3d d8 ..s=. read from 0x9b9e938 [0x9ba45c8] (7 bytes => 7 (0x7)) 0000 - 32 30 30 38 2e 30 33 2008.03 18523:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:567: The server log shows: 2008.03.10 11:32:23 LOG5[18563:3086215456]: stunnel 4.20 on i386-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2008.03.10 11:32:23 LOG5[18563:3086215456]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.03.10 11:32:23 LOG7[18563:3086215456]: stunnel started 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 0 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 1 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 4 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 5 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: Connection from 127.0.0.1:38481 permitted by libwrap 2008.03.10 11:32:23 LOG5[18563:3086215456]: stunnel accepted connection from 127.0.0.1:38481 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): before/accept initialization 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 read client hello A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write server hello A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write certificate A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write server done A 2008.03.10 11:32:23 LOG3[18563:3086215456]: SSL_accept: Peer suddenly disconnected 2008.03.10 11:32:23 LOG5[18563:3086215456]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.03.10 11:32:23 LOG7[18563:3086215456]: stunnel finished (0 left) Anyone have any ideas? Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

1 0

Windows FIPS compile
by Joe Kemp 10 Mar '08

10 Mar '08

I am trying to get stunnel to compile against a fips openssl. I read in install.fips that it is not yet supported. Is anyone currently working on this? If so I would love to join forces or any info on the specific issues would help get me started. Thanks. -Joe

2 2

help
by Paque Alexandre 10 Mar '08

10 Mar '08

Hi, I am writing you because I haven’t found solution on the web. In order to secure a connection between servers (1 client and 1 server stunnel), I chose the stunnel tool. However, I have an issue when I unplugged the network cable. If I unplug the network cable on the remote side, Stunnel will detect the cutting only on the local side. In fact, I would like to configure stunnel client in order to detect the unplugged network cable on server side. I tried many configurations but without success: socket = l:TCP_NODELAY=1 socket = l:SO_LINGER=1:1 socket = l:SO_KEEPALIVE=1 socket = l:SO_REUSEADDR=1 socket = r:TCP_NODELAY=1 socket = r:SO_LINGER=1:1 socket = r:SO_KEEPALIVE=1 socket = r:SO_REUSEADDR=1 Could you help me? Thanks you in advance, Alex _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

ssl mutual authentication
by Simon Santoro 09 Mar '08

09 Mar '08

Hello all. I am sure I am missing something really obvious here, but I can't get this to work. HTTP client (localhost) -> stunnel (localhost) -> HTTPS server (remote host) I'd like to user stunnel as proxy for my HTTP requests that go to a HTTPS server (apache if that makes any difference) on a remote host (fresh) that uses a cert to authenticate the request. I wrote this little ruby script[2] to test the request, and it works, so i am sure that on the server/client/cert end there is no problem. Now I'd like to use a simple wget or w3m to get the file from the remote server trough stunnel, but I keep getting SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed The only difference between the ruby script and the stunnel setup is that in the ruby script i have two different files for the crt and the key, and with stunnel I joined those files together with cat s2(a)magnesium.key s2(a)magnesium.crt >s2(a)magnesium.pam on localhost i run: $ stunnel -r fresh:443 -d localhost:11443 -c -f -D 7 -c -S 0 -p certs/s2(a)magnesium.pem -a certs/ -A certs/freshCA.crt -v 3 -P none 2008.03.09 21:21:38 LOG5[9026:3082811056]: Using 'fresh.443' as tcpwrapper service name 2008.03.09 21:21:38 LOG7[9026:3082811056]: RAND_status claims sufficient entropy for the PRNG 2008.03.09 21:21:38 LOG6[9026:3082811056]: PRNG seeded successfully 2008.03.09 21:21:38 LOG7[9026:3082811056]: Certificate: certs/s2(a)magnesium.pem Enter PEM pass phrase: 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_defaults is 0 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_dir is certs/ 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_file is certs/freshCA.crt 2008.03.09 21:21:40 LOG7[9026:3082811056]: Loaded verify certificates from certs/freshCA.crt 2008.03.09 21:21:40 LOG7[9026:3082811056]: Set verify directory to certs/ 2008.03.09 21:21:40 LOG5[9026:3082811056]: Peer certificate location certs/ 2008.03.09 21:21:40 LOG5[9026:3082811056]: stunnel 3.26 on i486-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.8e 23 Feb 2007 2008.03.09 21:21:40 LOG7[9026:3082811056]: No pid file being created 2008.03.09 21:21:40 LOG5[9026:3082811056]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2008.03.09 21:21:40 LOG7[9026:3082811056]: SO_REUSEADDR option set on accept socket 2008.03.09 21:21:40 LOG7[9026:3082811056]: fresh.443 bound to 127.0.0.1:11443 then, I try to connect to localhost:11443 with w3m, in the hope that my HTTP request is encrypted and send to fresh:443, and stunnel should check if the PEER certificate is correct, but all I get is: 2008.03.09 21:26:44 LOG7[9214:3082585776]: fresh.443 accepted FD=6 from 127.0.0.1:43888 2008.03.09 21:26:44 LOG7[9214:3082423184]: fresh.443 started 2008.03.09 21:26:44 LOG5[9214:3082423184]: fresh.443 connected from 127.0.0.1:43888 2008.03.09 21:26:44 LOG7[9214:3082423184]: fresh.443 connecting 192.168.0.2:443 2008.03.09 21:26:44 LOG7[9214:3082423184]: Remote FD=7 initialized 2008.03.09 21:26:44 LOG7[9214:3082423184]: Relying on OpenSSL RSA Blinding. 2008.03.09 21:26:44 LOG7[9214:3082423184]: SSL state (connect): before/connect initialization 2008.03.09 21:26:44 LOG7[9214:3082423184]: SSL state (connect): SSLv3 write client hello A 2008.03.09 21:26:45 LOG7[9214:3082423184]: SSL state (connect): SSLv3 read server hello A 2008.03.09 21:26:45 LOG5[9214:3082423184]: VERIFY OK: depth=1, /C=IT/O=S2 corp./CN=S2/emailAddress=s2@fresh 2008.03.09 21:26:45 LOG4[9214:3082423184]: VERIFY ERROR ONLY MY: no cert for /C=IT/O=S2 corp./CN=fresh 2008.03.09 21:26:45 LOG7[9214:3082423184]: SSL alert (write): fatal: certificate unknown 2008.03.09 21:26:45 LOG3[9214:3082423184]: SSL_connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2008.03.09 21:26:45 LOG7[9214:3082423184]: fresh.443 finished (0 left) Did I something wrong? What am I missing? Please help me, it would save me really a lot of work on the client side if I could get this going. Thanks! Simon [1] ---------------------------------------------------- #!/usr/bin/ruby SERVER_CERT_FILE = "certs/freshCA.crt" CERT_FILE = "certs/s2(a)magnesium.crt" CERT_FILE_KEY = "certs/s2(a)magnesium.key" require 'net/https' https = Net::HTTP.new('fresh', 443) https.use_ssl = true #client certificates https.cert = OpenSSL::X509::Certificate.new( File.read(CERT_FILE) ) https.key = OpenSSL::PKey::RSA.new( File.read(CERT_FILE_KEY), 'panza') #server certificate https.ca_file = SERVER_CERT_FILE https.verify_mode = OpenSSL::SSL::VERIFY_PEER #VERIFY_NONE https.read_timeout = 120 https.start do |https| request = Net::HTTP::Get.new('/notes/test_auth') # request.basic_auth 's', 'x' response = https.request(request) response.value puts response.body end ----------------------------------------------------

1 1

Connection Problem on Vista
by Earl Stenlund 08 Mar '08

08 Mar '08

I setup stunnel this afternoon to work with Newshosting. It was working fine but now I cannot connect using my desktop running Vista. I receive this message: SSL_connect: 14094406: error:14094406:SSL routines:SSL3_READ_BYTES:sslv3 alert decompression failure Stunnel connects fine on my laptop which is also running Vista. Help, Earl Stenlund

1 0

Username authentication
by Joe Kemp 07 Mar '08

07 Mar '08

I want to try to use stunnel as a "simple" client vpn. It solves all of my encryption issues but I would like to verify a username/password before it lets the traffic through. I didn't see any patches or hacks out there that did this. Has this been attempted before or am I on my own. I would also be interested in other solutions based on openssl that are not network device level VPNs clients. Already using client side certificates and I know that is the normal SSL authentication mechanism.... Thanks. -Joe

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users