- stunnel-users - stunnel.org

Stunnel 4.19 released
by Michal Trojnara 15 Nov '06

15 Nov '06

Dear Users, A new version of stunnel has just been released. Version 4.19, 2006.11.11, urgency: LOW/EXPERIMENTAL: * Release notes - There are a lot of new features in this version. I recommend to test it well before upgrading your mission-critical systems. * New features - New service-level option to specify OCSP server flag: OCSPflag = <flag> - "protocolCredentials" option changed to "protocolUsername" and "protocolPassword" - NTLM support to be enabled with the new service-level option: protocolAuthentication = NTLM - imap protocol negotiation support added. - Passphrase cache was added so the user does not need to reenter the same passphrase for each defined service any more. - New service-level option to retry connect+exec section: retry = yes|no - Local IP and port is logged for each established connection. - Win32 DLLs for OpenSSL 0.9.8d. * Bugfixes - Serious problem with SSL_WANT_* retries fixed. The new code requires extensive testing! Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1sum for stunnel-4.19.tar.gz: d58da8117278d71598279c77935585de81b74394 Best regards, Mike

2 1

Error when I try adding compression to stunnel.conf
by Rami Michael 15 Nov '06

15 Nov '06

So it seems i found the answer to my own question... compression was added in stunnel 4.06. I am using 4.05 :)

1 0

Does stunnel supports IPv6
by Ravi Gowda 14 Nov '06

14 Nov '06

Hi All, Can we use ipv6 addresses in stunnel? The problem that I am facing is I want to have secure ldap sessions using two IPv6 systems but none of them speak SSL... How to go about it??? Thanks in Advance Ravi Gowda

2 1

Error when I try adding compression to stunnel.conf
by Rami Michael 14 Nov '06

14 Nov '06

Hey everyone, I was going through the stunnel FAQ when I noticed you could add compression. I was very excited and wanted to give it a try but when I tried to add compression = zlib to my stunnel.cong I got this error when starting stunnel... Starting stunnel: file /etc/stunnel/stunnel.conf line 10: Specified option name is not valid here Line 10 is the exact place where i stuck this name value pair. I don't know where else i could put it, i tried putting it everywhere! All requested info for posts to the group are found below Here is my stunnel.conf verify = 3 CAfile = /etc/stunnel/certs.pem cert = /etc/stunnel/stunnel.pem setuid = nobody setgid = nobody pid = /tmp/stunnel.pid debug = 7 output = /var/log/stunnel.log client = no compression = zlib [mysqls] accept = 3309 connect = 3306 I am using centOS and installed stunnel and openssl via the available rpms, using yum. zlib is installed as well, but i don't think this is a zlib issue, it seems like it just doesn't like "compression". Was compression added in a version later than 4.05? Am i missing something incredinbly simple? Some output from the stunnel.log at high debug level 2006.11.13 23:03:10 LOG5[32244:3086689984]: stunnel 4.05 on i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.11.13 23:03:10 LOG7[32244:3086689984]: Snagged 64 random bytes from /dev/urandom 2006.11.13 23:03:10 LOG7[32244:3086689984]: RAND_status claims sufficient entropy for the PRNG 2006.11.13 23:03:10 LOG6[32244:3086689984]: PRNG seeded successfully 2006.11.13 23:03:10 LOG7[32244:3086689984]: Certificate: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Key file: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Loaded verify certificates from /etc/stunnel/certs.pem 2006.11.13 23:03:10 LOG5[32244:3086689984]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 4 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: SO_REUSEADDR option set on accept socket 2006.11.13 23:03:10 LOG7[32244:3086689984]: mysqls bound to 0.0.0.0:3309 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 5 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 6 in non-blocking mode 2006.11.13 23:03:10 LOG7[32245:3086689984]: Created pid file /tmp/stunnel.pid stunnel -V 2006.11.13 23:03:14 LOG3[32248:3086505664]: -V: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options uname -a Linux ramison 2.6.9-42.0.3.EL #1 Fri Oct 6 05:59:54 CDT 2006 i686 i686 i386 GNU/Linux gcc -v Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.6/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux Thread model: posix gcc version 3.4.6 20060404 (Red Hat 3.4.6-3) openssl version OpenSSL 0.9.7a Feb 19 2003

1 0

setting up HTTPS service?
by joe＠strout.net 14 Nov '06

14 Nov '06

Complete newbie here, so please bear with me. I want to set up HTTPS service on a Mac OS X (10.4.7) machine running a custom web server. I imagine that Stunnel could be made to listen on the standard HTTPS port (443), do the encryption/decryption, and pass the resulting data to/from the HTTP port (80, or a custom port I specify). This is probably very easy, but none of the documentation or examples I found covered this. Has anyone done this? Or if not, can you sketch out how I would go about it? Any gotchas or caveats I should be aware of? Many thanks, - Joe

3 3

resending FD_SETSIZE and file ulimit
by Arunkumar Arumugam 10 Nov '06

10 Nov '06

Hi Guys - I have a stunnel setup in a linux box kernel 2.4 Advanced sever release 2.1AS (pensacola) . I am trying to increase the number of file descriptors with which stunnel could handle. So I did a ulimit -n 4096 for root and restarted the stunnel process. Now in the stunnel logs i see, ..... FD_SETSIZE=1024, file ulimit=4096- > 500 clients allowed. I dont completely understand the relation between FD_SETSIZE and file ulimit. I also read that a single stunnel connection might use around 2 or 3 file descriptors. So what is the cap on the number of file descriptors used by stunnel. To make it use , around 4096 file descriptors should i recompile the stunnel again with FD_SETSIZE set to 4096.? -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

1 0

stunnel on Windows with pkcs11
by Neil M. 10 Nov '06

10 Nov '06

Can anyone provide more details in how to get this setup working? I've setup stunnel in client mode just fine for normal SSL operations, but now I need to load a client certificate from a token. I've looked at the example in the documentation and changed the paths accordingly, but that doesn't seem to work, stunnel errors out complaining about a DSO. Neil

1 0

FD_SETSIZE and file ulimit
by Arunkumar Arumugam 10 Nov '06

10 Nov '06

Hi Guys - I have a stunnel setup in a linux box kernel 2.4 Advanced sever release 2.1AS (pensacola) . I am trying to increase the number of file descriptors with which stunnel could handle. So I did a ulimit -n 4096 for root and restarted the stunnel process. Now in the stunnel logs i see, ..... FD_SETSIZE=1024, file ulimit=4096- > 500 clients allowed. I dont completely understand the relation between FD_SETSIZE and file ulimit. I also read that a single stunnel connection might use around 2 or 3 file descriptors. So what is the cap on the number of file descriptors used by stunnel. To make it use , around 4096 file descriptors should i recompile the stunnel again with FD_SETSIZE set to 4096.? -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

2 1

stunnel 4.16 wrapped around an ldap server causing very slow binds
by Mark McCoy 05 Nov '06

05 Nov '06

Hey all, I have an instance of stunnel 4.16 on Solaris 10 that I am trying to use to wrap Sun Directory Server LDAP traffic in SSL. LDAP 'binds' take over 2 minutes to complete using stunnel, but only a split second (as they should) when using an SSH tunnel. I have disabled tcpwrappers per the stunnel FAQ with no results, and tried settting delay = "yes" and "no", with no differences in the results. An interesting thing is that if I try to bind using the wrong password, the "Invalid Credentials" error returns immediately. Using the correct password, the bind hangs for over 2 minutes. Any ideas on what to look for? ------------- Output of stunnel -version: stunnel 4.16 on sparc-sun-solaris2.10 with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/stunnel/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/stunnel/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -------------- -- Mark McCoy -- Professional Unix geek Here in America we are descended in blood and in spirit from revolutionists and rebels - men and women who dared to dissent from accepted doctrine. As their heirs, may we never confuse honest dissent with disloyal subversion. -- Dwight D. Eisenhower

2 1

newbie sendmail + smtp question
by Fred nietzsche 03 Nov '06

03 Nov '06

My ISP requires all my mail to go to mail.myISP.net via SSL to port 465. I have sendmail compiled with STARTTLS, configured authinfo and I've set up sendmail's smarthost to send everything to mail.myISP.net I run stunnel like this. stunnel /etc/stunnel/stunnel.conf -c -d 25 -r mail.myISP.net:465 There are no errors in the log. I can see stunnel listening on 25 with netstat. When I try to send mail I get: bash-3.00# sendmail -v sc00b123(a)yahoo.com <test sc00b123(a)yahoo.com... Connecting to [127.0.0.1] via relay... Which just hangs for ever. My stunnel.conf looks like: cert = /etc/stunnel/mail.pem chroot = /var/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log [smtp] accept = 25 connect = 465 Thanks for any help, hints, etc.. --------------------------------- Low, Low, Low Rates! Check out Yahoo! Messenger's cheap PC-to-Phone call rates.

1 0