stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

Re: [stunnel-users] Handshake failure
by RUTSCHLE Yves 27 Apr '07

27 Apr '07

RUTSCHLE Yves wrote: > Argh. After removing all my debugging printf's, it turns out it doesn't seem > to work after all. Which, if it has to do with signals and timing, is only > partly surprising. Ok, nothing to do with any of that. Deep inside OpenSSL, there is a call to gmtime_r. Deep somewhere in hell (I hope), someone decided that LynxOS' gmtime_r functions would have its arguments *reversed*. REVERSED. I guess they were going for SIXPO complience. So that call would write rubbish in the stack, hence no returning from the call and segfault instead. So, nothing to do with stunnel after all. Thanks for the support anyway! :) Y. - TGIFriday

1 0

[PATCH?] Senting a list of accepted CAs to the client
by Miloslav Trmac 27 Apr '07

27 Apr '07

Hello, stunnel currently does not send a list of accepted CAs, see e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=327001#c20 . Sending the list was #if 0-ed out sometime between stunnel 3.22 and 4.00, with no change log entry AFAICS. Does anyone remember know why was it disabled, and whether it is safe to reenable (e. g. using the attached patch)? Thanks, Mirek

1 0

Vista not connecting to port 139
by Neil Aggarwal 26 Apr '07

26 Apr '07

Hello: I am trying to map a network drive over an stunnel connection. The server is Linux and the client machine is Windows Vista (Ugh!). I have stunnel installed and working. I have the following in my stunnel.conf: client = yes delay = yes [netDrives] accept = 222.222.222.222:139 connect = www.jammconsulting.com:2139 When I go to map the network drive on vista, I use this command: net use x: \\222.222.222.222\MyShare mypass /user:myuser It eventually gives me an error message about network path not found. Looking at the stunnel window, there are no messages about any connections to the stunnel. If I do: telnet 222.222.222.222 139 the telnet session connects and I see messages about a connection in the stunnel window. Any ideas why Vista is not using port 139? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

1 0

Stunnel on Vista
by Neil Aggarwal 26 Apr '07

26 Apr '07

Hello: Has anyone used stunnel on Vista? For some stupid reason, it tells me I can't save the stunnel.conf file. Thanks, Neil -- Neil Aggarwal, (214)986-3533, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

2 2

Re: [stunnel-users] Handshake failure
by RUTSCHLE Yves 26 Apr '07

26 Apr '07

Michal Trojnara wrote: >Some systems require to reset signal handler each time a signal was >received, while for others the handler is executed recursively destroying >CPU stack of running stunnel process. Ah. That'd explain it. Thanks for the tip and the explanations! Y.

1 0

Handshake failure
by RUTSCHLE Yves 26 Apr '07

26 Apr '07

Hello, I am trying to set up a stunnel between two machines running LynxOS, which is a POSIX derivative. I've compiled OpenSSL 0.9.8e, and stunnel 4.20: stunnel 4.20 on i386-unknown-lynxos with OpenSSL 0.9.8e 23 Feb 2007 Threading:FORK SSL:ENGINE Sockets:POLL,IPv4 [...] I use the following config files: ////// server side debug=7 foreground=yes pid= CAfile=valid_certs key=privkey.pem cert=cert.pem verify=1 [SSLTunnel] accept=1235 connect=1234 ////// end server side ////// client side debug=7 foreground=yes pid= CAfile=valid_certs key=privkey.pem cert=cert.pem verify=1 client=yes [SSLTunnel] accept=4234 connect=173.16.1.10:1235 ////// end client side (It's run from different directories so the PEM files are different) After running both stunnels, I connect to the client side and see a beginning of handshake; however, it then breaks down: from afar, it looks like the client doesn't take the server certificate: ///// server trace 2007.04.25 15:33:22 LOG7[58:0]: Snagged 64 random bytes from /home/st07815/.rnd 2007.04.25 15:33:22 LOG7[58:0]: Wrote 1024 new random bytes to /home/st07815/.rnd 2007.04.25 15:33:22 LOG7[58:0]: RAND_status claims sufficient entropy for the PRNG 2007.04.25 15:33:22 LOG7[58:0]: PRNG seeded successfully 2007.04.25 15:33:22 LOG7[58:0]: Certificate: cert.pem 2007.04.25 15:33:22 LOG7[58:0]: Certificate loaded 2007.04.25 15:33:22 LOG7[58:0]: Key file: privkey.pem 2007.04.25 15:33:22 LOG7[58:0]: Private key loaded 2007.04.25 15:33:22 LOG7[58:0]: Loaded verify certificates from valid_certs 2007.04.25 15:33:22 LOG7[58:0]: Loaded valid_certs revocation lookup file 2007.04.25 15:33:22 LOG7[58:0]: SSL context initialized for service SSLTunnel 2007.04.25 15:33:22 LOG5[58:0]: stunnel 4.20 on i386-unknown-lynxos with OpenSSL 0.9.8e 23 Feb 2007 2007.04.25 15:33:22 LOG5[58:0]: Threading:FORK SSL:ENGINE Sockets:POLL,IPv4 2007.04.25 15:33:22 LOG6[58:0]: file ulimit = 64 (can be changed with 'ulimit -n') 2007.04.25 15:33:22 LOG6[58:0]: poll() used - no FD_SETSIZE limit for file descriptors 2007.04.25 15:33:22 LOG5[58:0]: 29 clients allowed 2007.04.25 15:33:22 LOG7[58:0]: FD 3 in non-blocking mode 2007.04.25 15:33:22 LOG7[58:0]: FD 4 in non-blocking mode 2007.04.25 15:33:22 LOG7[58:0]: FD 5 in non-blocking mode 2007.04.25 15:33:22 LOG7[58:0]: SO_REUSEADDR option set on accept socket 2007.04.25 15:33:22 LOG7[58:0]: SSLTunnel bound to 0.0.0.0:1235 2007.04.25 15:33:22 LOG7[58:0]: No pid file being created (end of init, waiting for connection) 2007.04.25 15:34:17 LOG7[58:0]: SSLTunnel accepted FD=6 from 173.16.1.7:1092 2007.04.25 15:34:17 LOG7[68:0]: SSLTunnel started 2007.04.25 15:34:17 LOG7[68:0]: FD 6 in non-blocking mode 2007.04.25 15:34:17 LOG5[68:0]: SSLTunnel accepted connection from 173.16.1.7:1092 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): before/accept initialization 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 read client hello A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 write server hello A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 write certificate A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 write certificate request A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 flush data 2007.04.25 15:34:19 LOG3[68:0]: SSL_accept: Peer suddenly disconnected 2007.04.25 15:34:19 LOG5[68:0]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.04.25 15:34:19 LOG7[58:0]: Cleaning up the signal pipe 2007.04.25 15:34:19 LOG7[58:0]: Process 68 finished with code 0 (0 left) ///// end server trace ///// client trace 2007.04.25 15:33:59 LOG7[12:0]: Snagged 64 random bytes from /home/st07815/.rnd 2007.04.25 15:33:59 LOG7[12:0]: Wrote 1024 new random bytes to /home/st07815/.rnd 2007.04.25 15:33:59 LOG7[12:0]: RAND_status claims sufficient entropy for the PRNG 2007.04.25 15:33:59 LOG7[12:0]: PRNG seeded successfully 2007.04.25 15:33:59 LOG7[12:0]: Certificate: cert.pem 2007.04.25 15:33:59 LOG7[12:0]: Certificate loaded 2007.04.25 15:33:59 LOG7[12:0]: Key file: privkey.pem 2007.04.25 15:33:59 LOG7[12:0]: Private key loaded 2007.04.25 15:33:59 LOG7[12:0]: Loaded verify certificates from valid_certs 2007.04.25 15:33:59 LOG7[12:0]: Loaded valid_certs revocation lookup file 2007.04.25 15:33:59 LOG7[12:0]: SSL context initialized for service SSLTunnel 2007.04.25 15:33:59 LOG5[12:0]: stunnel 4.20 on i386-unknown-lynxos with OpenSSL 0.9.8e 23 Feb 2007 2007.04.25 15:33:59 LOG5[12:0]: Threading:FORK SSL:ENGINE Sockets:POLL,IPv4 2007.04.25 15:33:59 LOG6[12:0]: file ulimit = 64 (can be changed with 'ulimit -n') 2007.04.25 15:33:59 LOG6[12:0]: poll() used - no FD_SETSIZE limit for file descriptors 2007.04.25 15:33:59 LOG5[12:0]: 29 clients allowed 2007.04.25 15:33:59 LOG7[12:0]: FD 3 in non-blocking mode 2007.04.25 15:33:59 LOG7[12:0]: FD 4 in non-blocking mode 2007.04.25 15:33:59 LOG7[12:0]: FD 5 in non-blocking mode 2007.04.25 15:33:59 LOG7[12:0]: SO_REUSEADDR option set on accept socket 2007.04.25 15:33:59 LOG7[12:0]: SSLTunnel bound to 0.0.0.0:4234 2007.04.25 15:33:59 LOG7[12:0]: No pid file being created (end of init, waiting for connection) 2007.04.25 15:34:27 LOG7[12:0]: SSLTunnel accepted FD=6 from 152.14.101.54:64752 2007.04.25 15:34:27 LOG7[27:0]: SSLTunnel started 2007.04.25 15:34:27 LOG7[27:0]: FD 6 in non-blocking mode 2007.04.25 15:34:27 LOG5[27:0]: SSLTunnel accepted connection from 152.14.101.54:64752 2007.04.25 15:34:27 LOG7[27:0]: FD 5 in non-blocking mode 2007.04.25 15:34:27 LOG7[27:0]: SSLTunnel connecting 173.16.1.10:1235 2007.04.25 15:34:27 LOG7[27:0]: connect_wait: waiting 10 seconds 2007.04.25 15:34:27 LOG7[27:0]: connect_wait: connected 2007.04.25 15:34:27 LOG5[27:0]: SSLTunnel connected remote server from 173.16.1.7:1092 2007.04.25 15:34:27 LOG7[27:0]: Remote FD=5 initialized 2007.04.25 15:34:27 LOG7[27:0]: SSL state (connect): before/connect initialization 2007.04.25 15:34:27 LOG7[27:0]: SSL state (connect): SSLv3 write client hello A 2007.04.25 15:34:27 LOG7[27:0]: SSL state (connect): SSLv3 read server hello A 2007.04.25 15:34:28 LOG7[12:0]: Cleaning up the signal pipe 2007.04.25 15:34:28 LOG7[12:0]: Process 27 terminated on signal 11 (0 left) ///// end client trace Now the strange thing is that this very same setup works on Solaris, so I have something wrong with the port of either OpenSSL or stunnel on LynxOS. If someone could give me a hint as to where to start poking, I'd greatly appreciate it. TIA, Y.

2 2

Stunnel with Goldmine 6.70.61214
by Raymond Randall 26 Apr '07

26 Apr '07

Greetings! Use Goldmine with Gmail domain services. Have set up according to Mike Casteel's instructions. However, Goldmine will not download email from the Gmail (the GMail address: rayrandall(a)ethosadvisory.com). Here is the stunnel.conf file: client=yes [pop3] accept=9995 connect=pop.gmail.com:995 [smtp] accept=465 connect=smtp.gmail.com:465 POP and SMTP set to: 127.0.0.1 Here is the stunnel report: 2007.04.26 06:32:20 LOG3[1972:1996]: Error resolving 'pop.gmail.com': Neither nodename nor servname known (EAI_NONAME) Cannot resolve 'pop.gmail.com:995' - delaying DNS lookup 2007.04.26 06:32:20 LOG3[1972:1996]: Error resolving 'smtp.gmail.com': Neither nodename nor servname known (EAI_NONAME) Cannot resolve 'smtp.gmail.com:465' - delaying DNS lookup 2007.04.26 06:32:20 LOG5[1972:1996]: stunnel 4.16 on x86-pc-mingw32-gnu with OpenSSL 0.9.7e 25 Oct 2004 2007.04.26 06:32:20 LOG5[1972:1996]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.04.26 06:32:24 LOG5[1972:424]: No limit detected for the number of clients 2007.04.26 07:11:56 LOG5[1972:1204]: pop3 connected from 127.0.0.1:1600 2007.04.26 07:14:01 LOG5[1972:1204]: Connection closed: 2795 bytes sent to SSL, 662451 bytes sent to socket Perhaps this is a Goldmine configuration error. Not sure, and appreciate suggestions. Ray Randall -- Ethos Advisory Services Ray Randall 617-275-5565 Fax: 877-895-3756 http://www.ethosadvisory.com Information provided by Ethos is based on sources we believe reliable. Ethos does not offer legal or accounting services. Information contained in this email message is confidential and may contain privileged information. Any review or use of the information contained in this email message by persons other than the intended recipient(s) is prohibited. Content of this email is illustrative and educational; it is not a recommendation to purchase or sell. The examples presented do not take into consideration commissions, tax implications or other transaction costs, which may significantly affect the economic consequences of a given strategy. Mutual fund investing involves risk, including the possible loss of principal. Index performance returns do not reflect any management fees, transaction costs, or expenses. Past performance does not guarantee future results.

1 0

Connecting via rtmps to Red5 server
by David Schulberg 25 Apr '07

25 Apr '07

Hi, I have been led to stunnel as the way to get a Flash application to communicate securely with Red5 server. Red5 doesn't directly support ssl connectivity but using rtmps protocol (rtmp tunnelled via https) clients should be able to connect to Red5 if stunnel handles the encrypted traffic on port 443 and passes unencrypted communications back and forth to the Red5 on a port it expects to receive rtmp communication.. (refer http://www.adobe.com/devnet/flashcom/articles/firewalls_proxy04.html) The log file I get when I attempt to talk rtmps is shown below 2007.04.25 18:19:04 LOG7[3932:3384]: New thread created 2007.04.25 18:19:04 LOG7[3932:3664]: https started 2007.04.25 18:19:04 LOG7[3932:3664]: FD 224 in non-blocking mode 2007.04.25 18:19:04 LOG7[3932:3664]: TCP_NODELAY option set on local socket 2007.04.25 18:19:04 LOG5[3932:3664]: https accepted connection from 127.0.0.1:1249 2007.04.25 18:19:04 LOG7[3932:3664]: FD 248 in non-blocking mode 2007.04.25 18:19:04 LOG7[3932:3664]: https connecting 127.0.0.1:1935 2007.04.25 18:19:04 LOG7[3932:3664]: connect_wait: waiting 10 seconds 2007.04.25 18:19:04 LOG7[3932:3664]: connect_wait: connected 2007.04.25 18:19:04 LOG5[3932:3664]: https connected remote server from 127.0.0.1:1250 2007.04.25 18:19:04 LOG7[3932:3664]: Remote FD=248 initialized 2007.04.25 18:19:04 LOG7[3932:3664]: TCP_NODELAY option set on remote socket 2007.04.25 18:19:04 LOG7[3932:3664]: SSL state (connect): before/connect initialization 2007.04.25 18:19:04 LOG7[3932:3664]: SSL state (connect): SSLv3 write client hello A 2007.04.25 18:24:04 LOG6[3932:3664]: init_ssl: s_poll_wait timeout 2007.04.25 18:24:04 LOG5[3932:3664]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.04.25 18:24:04 LOG7[3932:3664]: https finished (0 left) The stunnel.conf file has the following settings that pertain specifically to this situation client = yes [https] accept = 443 connect = 1935 What I seem to see (according to the logfile) is that an ssl connection is successfully established but no subsequent communication takes place after the connection has been made. At this point my Flash application doesn't send any messages via the ssl connection which seems to implicate my client as being the source of my problem. I would appreciate any advice on how I can best investigate this whole situation to resolve the issue. Regards, David Schulberg email: davids(a)evertech.com.au

2 2

firewall very restricted!!
by Pitoniso Rikito Rikin 17 Apr '07

17 Apr '07

Ok guys look this... my only contact with the world is trought the WEB port 80 how i can establish a ssh connection trought this port, the only method avaible is the GET or POST.... well how i do this... help --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

2 1

Using Client Authentication
by Ravi Gowda 16 Apr '07

16 Apr '07

Hi All, I am trying to have a setup where stunnel acts as a client to a server which requires client-Authentication. This is the snapshot of my stunnel.conf # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 setuid = nobody setgid = nobody output = /etc/stunnel/out cert = /etc/stunnel/rtca-client.pem key = /etc/stunnel/rtca-client.ky # Authentication stuff verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: CAfile = /etc/stunnel/rtca.pem ciphers = DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:IDEA-CBC-SHA:IDEA-CBC-MD5:RC2-CBC-MD5:DHE-DSS-RC4-SHA:RC4-SHA:RC4-MD5:RC4-MD5:RC4-64-MD5:EXP1024-DHE-DSS-DES-CBC-SHA:EXP1024-DES-CBC-SHA:EXP1024-RC2-CBC-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5:EXP1024-DHE-DSS-RC4-SHA:EXP1024-RC4-SHA:EXP1024-RC4-MD5:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC4-MD5 # Some debugging stuff debug = 7 output = /etc/stunnel/stunnel.log # Use it for client mode client = yes when I try to connect to the server, I am seeing that Stunnel is sending an empty certificate..which is making my server to reject connections. Can someone please help me out?? Thanks in Advance Ravi Gowda

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users