stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

RE: question about stunnel setup
by Anthony Cicalla 15 Feb '06

15 Feb '06

Encrypting traffic to a remote syslog-ng server including SSL peer authentication 1. Install stunnel and syslog-ng on all machines. 2. Create certificates for all machines. On RedHat 9 and similar machines, you can do the following as root: # cd /etc/pki/tls/certs # make syslog-ng-server.pem # make syslog-ng-client.pem 3. Place copies of syslog-ng-server.pem on all machines in /etc/stunnel with one important alteration. The clients only need the certificate section of syslog-ng-server.pem. In other words, remove the private key section from syslog-ng-server.pem on all clients. Place every client's syslog-ng-client.pem in /etc/stunnel. For server, create a special syslog-ng-client.pem containing the certificate sections for all clients and place in /etc/stunnel. In other words, remove the private key sections from all syslog-ng-client.pem files and concatenate what is left to create server's special syslog-ng-client.pem. Ok my question is from above it says to create one syslog-ng-client.pem file per client. 1)Do the names for each of these need to remain syslog-ng-client.pem or can they have names that reflect the host that they are on? 2) if they all need to keep that name do just move the client file to one client/host and then delete it from the server then move on to create the next?

2 1

stunnel and syslog
by Bart Somers 10 Feb '06

10 Feb '06

Hi to all, We recently ran in to a problem using stunnel on our AIX 5.2 machines. This is our situation: we are running stunnel as a client to protect http (and a proprietary protocol) traffic between our company and a customer. We are using client-athentication to grant access to the server and on our client-side we validate the server-certificates. This all works fine. Due to new security-restrictions, we are moving all our private-key material into HSM-boxes, in our case these are nCipher nShield HSM's. According to the documantion on there website ( http://active.ncipher.com ) we builded openssl nCipher-enabled. Based on this openssl-version, we builded stunnel. All the build-options are shown below in this message. The compiler used is the IBM C compiler. According to the manuals from stunnel we needed to put in an extra line to the config-file which shows "engine = chil" (chil is the Cryptographic Hardware Interface Library, the way the nCipher HSM's are known to openssl) After all this, we created key's in the hsm, using the nCipher tools and loaded them into stunnel (using this method you get a "pseudo-pem-file", which is actually a reference to the hardware-key). Fire-up stunnel using the commands from nCipher to preload the key's and we are all good to go! When this all seems to work very stable after a few months, with thousands of connections and ditto megabytes transfered, we wanted to have all the logging to our syslogserver (it runs syslog-ng) and this is the place where my problem hits in: When commenting-out the option "output = /home/bart/stl/var/stunnel.log" and restarting stunnel, stunnel dies after the first or second connection, leaving no logging, corefiles or whatever behind. Using plain key's (so no HSM, but with the same build which is aware of the HSM), syslog is no problem. Using HSM-key's with plaintext logfiles (no syslog) works also excellent. As i don't have any ideas anymore where to search, i want to ask you if somebody ever have seen this behaviour or knows where it could be caused by. (And maybe how to solve it....) Thanks in advance! Best regards, Bart Somers. ############################# # Build- and config-options # ############################# bart@server1:./stunnel -version stunnel 4.11 on powerpc-ibm-aix5.2.0.0 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.8 05 Jul 2005 Global options cert = home/bart/stl/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /home/bart/stl/etc/stunnel/stunnel.pem pid = /home/bart/stl/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds bart@server1:./openssl version OpenSSL 0.9.8 05 Jul 2005 compile-options: Openssl: $ export LDFLAGS="-L/opt/nfast/toolkits/hwcrhk" $ ./config --prefix=/home/bart/stl –DNFast –ldl make and make install Stunnel: $ export CPPFLAGS="-I/home/bart/stl/include" $ export LDFLAGS="-L/opt/nfast/toolkits/hwcrhk" $ ./configure –-prefix=/home/bart/stl –-with-ssl=/home/bart/stl -–disable-libwrap make and make install Config-file: Include engine = chil Start-up: $ with-nfast –f /home/bart/stl/tmp/ff /home/bart/stl/sbin/stunnel /home/bart/stl/etc/stunnel/stunnel.conf Relevant information from the config-file: engine = chil cert = /home/bart/stl/etc/stunnel/my-key.pem key = /home/bart/stl/etc/stunnel/my-key-hsm.pem ;(no chroot options used) pid = /prj/stl_004/tmp/test/stunnel-client.pid debug = 7 ; output = /home/bart/stl/var/stunnel.log # when in comment, problems! client = yes [test] accept = 9400 connect = 10.10.10.10:443 All other values are the default from the example.

2 4

transparent mode in linux
by Jesse Small 10 Feb '06

10 Feb '06

Hello, I am having trouble with the 'transparent = yes' option in my configuration file. Basically the goal is to see the IP address of the client connecting to our server, but I am getting this error in the log file: bind transparent: Cannot assign requested address (99) Failed to initialize remote connection After searching through the stunnel archives, I saw that this option (-T back then) was supported only up to the Linux 2.2 kernel, but didn't work on the 2.4 kernel. All the messages I read through were a few years old. I am using Fedora Core 4 with a 2.6 kernel, and wanted to see if there were any updates and if it was now possible to see the client's IP address. Otherwise all incoming connections appear as if from localhost. We are using stunnel v4.14. Thanks for your help, Jesse

2 1

stunnel closing connections with RST ?
by sergei 09 Feb '06

09 Feb '06

I'm setting up load-balanced service requiring stunnel with SSL on its front end. There are two hosts behind load balancer running stunnel . Service behind stunnel does not speak SSL. Every few minutes load balancer checks if those stunnels are still alive by opening tcp connection to stunnel listening port. Now problem is that stunnel closes those test connections with RST and load balancer takes it as that host is dead. This is without "client = yes" option because service does not speak SSL load-balancer -> stunnel-host TCP D=1234 S=33007 Syn stunnel-host -> load-balancer TCP D=33007 S=1234 Syn Ack load-balancer -> stunnel-host TCP D=1234 S=33007 Ack load-balancer -> stunnel-host TCP D=1234 S=33007 Fin Ack stunnel-host -> load-balancer TCP D=33007 S=1234 Ack stunnel-host -> load-balancer TCP D=33007 S=1234 Rst On the other hand with client=yes everything works fine load-balancer -> stunnel-host TCP D=123 S=33010 Syn stunnel-host -> load-balancer TCP D=33010 S=123 Syn Ack load-balancer -> stunnel-host TCP D=123 S=33010 Ack load-balancer -> stunnel-host TCP D=123 S=33010 Fin Ack stunnel-host -> load-balancer TCP D=33010 S=123 Fin Ack load-balancer -> stunnel-host TCP D=123 S=33010 Ack Is there any way to make stunnel without "client = yes" close connection "normal way" with FIN instead of RST ? stunnel is last version, load balancer is some older F5 BigIP thanks sergei

3 7

certificate root chain
by Olivier twist 09 Feb '06

09 Feb '06

Hello, I've already sent a message for my problem but no answer. I have a server certificate signed by GlobalSign. I don't want to use client certificate. But if I don't put the certification chain on the CAFILE of stunnel and don't set verify at 1, stunnel doesn't check the server certification chain and the server certificate appears broken on client side !!! I've post this problem on the stunnel mailing list but you tell me that if I don't use client certificate I don't have to set verify at 1. But it doesn't work, and why GlobalSign and others explain how to install server certificatation chain on servers like apache mod ssl?(see http://support.globalsign.net/en/serversign/apachemodssl.cfm) when I read this help file I suppose that the ssl protocol on server side makes a check of server certificate, and that's the reason why the certificate chain appears broken or not on client side. My current ugly solution is to set verify at 1, in this case, on client side, the certificate appears good and not broken but... a dialog box appears and ask for client certificate and some plugin like flash doesn't support that. i use stunnel 4.14 stunnel.conf: cert = c:\certif\inTest.crt key = c:\certif\inTest.key socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 1 CAfile = c:\certif\ca.pem ;client = yes [https] accept = 443 connect = 127.0.0.1:901 TIMEOUTclose = 0 [rtmps] accept = 80 connect = 127.0.0.1:900 TIMEOUTclose = 0 Could anybody gives me a support? Thx Oliver

3 3

Re: [stunnel-users] certificate root chain
by Hans Werner Strube 09 Feb '06

09 Feb '06

Olivier twist wrote: > I have a server certificate signed by GlobalSign. I don't want to use client > certificate. > But if I don't put the certification chain on the CAFILE of stunnel and > don't set verify at 1, stunnel doesn't check the server certification chain > and the server certificate appears broken on client side !!! ... > cert = c:\certif\inTest.crt > key = c:\certif\inTest.key ... > CAfile = c:\certif\ca.pem AFAIK the whole certificate chain from your server certificate up to the CA certificate should be in inTest.crt (simply concatenate the PEM files). The CAfile would be needed for client verification only.

1 0

RE: [stunnel-users] stunnel help
by Anthony Cicalla 07 Feb '06

07 Feb '06

I sent an email last week for help with a stunnel setup. I am attempting to send syslog messages via a snare agent through stunnel to a fedora core 4 box with syslog-ng installed. I have been able to get one machine to successfully log to the fedora box out of 4. I set these boxes up the same way and I am confused as to why one is working and the others aren't . This is my stunnel.conf file for the clients cert = C:\bin\stunnel\syslog-ng-server.pem CAfile = c:\bin\stunnel\syslog-ng-client.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 192.168.185.60:5140 This is my stunnel.conf file for the server cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5140] accept = 192.168.185.60:5140 connect = 127.0.0.1:514 This is my syslog-ng.conf file on the server options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; The snare agents are configured to send logs to 127.0.0.1 514. Any thoughts or idea's would be great. sincerely, Anthony -----Original Message----- From: Michal Trojnara [mailto:Michal.Trojnara@mobi-com.net] Sent: Tuesday, February 07, 2006 1:03 AM To: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] stunnel closing connections with RST ? sergei wrote: > Is there any way to make stunnel without "client = yes" > close connection "normal way" with FIN instead of RST ? Stunnel resets connections for a reason. Probably it was reset by the other peer. Check your stunnel log files for details. Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Multiple Instances of Same Application, Different Ports
by Steve Ricketts 06 Feb '06

06 Feb '06

1 0

stunnel not connecting to port 139 on server
by Neil Aggarwal 05 Feb '06

05 Feb '06

Hello: I have two windows machines. I am trying to connect to a shared drive on the server over an stunnel connection following the instructions on this page: http://research.lumeta.com/ches/cheap/stunnelsolution.html The connection from the client seems to connect to the server, but the server-side stunnel seems to be getting a timeout when it attempts to connect to port 139. I am able to map the network drive locally, so I am surprised it is not able to connect. Here is the log from stunnel on the server: 2006.02.04 18:22:17 LOG5[2116:3068]: stunnel 4.14 on x86-pc-mingw32-gnu WIN32+SELECT+IPv6 with OpenSSL 0.9.7i 14 Oct 2005 2006.02.04 18:22:17 LOG7[2116:3968]: RAND_status claims sufficient entropy for the PRNG 2006.02.04 18:22:17 LOG6[2116:3968]: PRNG seeded successfully 2006.02.04 18:22:17 LOG7[2116:3968]: Certificate: stunnel.pem 2006.02.04 18:22:17 LOG7[2116:3968]: Key file: stunnel.pem 2006.02.04 18:22:17 LOG5[2116:3968]: No limit detected for the number of clients 2006.02.04 18:22:17 LOG7[2116:3968]: FD 168 in non-blocking mode 2006.02.04 18:22:17 LOG7[2116:3968]: SO_REUSEADDR option set on accept socket 2006.02.04 18:22:17 LOG7[2116:3968]: netDrives bound to 0.0.0.0:2139 2006.02.04 18:24:49 LOG7[2116:3968]: netDrives accepted FD=188 from 192.168.1.247:1334 2006.02.04 18:24:49 LOG7[2116:3968]: Creating a new thread 2006.02.04 18:24:49 LOG7[2116:3968]: New thread created 2006.02.04 18:24:49 LOG7[2116:2224]: netDrives started 2006.02.04 18:24:49 LOG7[2116:2224]: FD 188 in non-blocking mode 2006.02.04 18:24:49 LOG7[2116:2224]: TCP_NODELAY option set on local socket 2006.02.04 18:24:49 LOG5[2116:2224]: netDrives connected from 192.168.1.247:1334 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): before/accept initialization 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read client hello A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write server hello A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write certificate A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write server done A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 flush data 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read client key exchange A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read finished A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write change cipher spec A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write finished A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 flush data 2006.02.04 18:24:49 LOG7[2116:2224]: 1 items in the session cache 2006.02.04 18:24:49 LOG7[2116:2224]: 0 client connects (SSL_connect()) 2006.02.04 18:24:49 LOG7[2116:2224]: 0 client connects that finished 2006.02.04 18:24:49 LOG7[2116:2224]: 0 client renegotiatations requested 2006.02.04 18:24:49 LOG7[2116:2224]: 1 server connects (SSL_accept()) 2006.02.04 18:24:49 LOG7[2116:2224]: 1 server connects that finished 2006.02.04 18:24:49 LOG7[2116:2224]: 0 server renegotiatiations requested 2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache hits 2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache misses 2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache timeouts 2006.02.04 18:24:49 LOG6[2116:2224]: SSL accepted: new session negotiated 2006.02.04 18:24:49 LOG6[2116:2224]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.02.04 18:24:49 LOG7[2116:2224]: FD 216 in non-blocking mode 2006.02.04 18:24:49 LOG7[2116:2224]: netDrives connecting 127.0.0.1:139 2006.02.04 18:24:49 LOG7[2116:2224]: connect_wait: waiting 10 seconds 2006.02.04 18:24:59 LOG7[2116:3968]: netDrives accepted FD=236 from 192.168.1.247:1336 2006.02.04 18:24:59 LOG7[2116:3968]: Creating a new thread 2006.02.04 18:24:59 LOG7[2116:3968]: New thread created 2006.02.04 18:24:59 LOG7[2116:3544]: netDrives started 2006.02.04 18:24:59 LOG7[2116:3544]: FD 236 in non-blocking mode 2006.02.04 18:24:59 LOG7[2116:3544]: TCP_NODELAY option set on local socket 2006.02.04 18:24:59 LOG5[2116:3544]: netDrives connected from 192.168.1.247:1336 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): before/accept initialization 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 read client hello A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write server hello A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write change cipher spec A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write finished A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 flush data 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 read finished A 2006.02.04 18:24:59 LOG7[2116:3544]: 1 items in the session cache 2006.02.04 18:24:59 LOG7[2116:3544]: 0 client connects (SSL_connect()) 2006.02.04 18:24:59 LOG7[2116:3544]: 0 client connects that finished 2006.02.04 18:24:59 LOG7[2116:3544]: 0 client renegotiatations requested 2006.02.04 18:24:59 LOG7[2116:3544]: 2 server connects (SSL_accept()) 2006.02.04 18:24:59 LOG7[2116:3544]: 2 server connects that finished 2006.02.04 18:24:59 LOG7[2116:3544]: 0 server renegotiatiations requested 2006.02.04 18:24:59 LOG7[2116:3544]: 1 session cache hits 2006.02.04 18:24:59 LOG7[2116:3544]: 0 session cache misses 2006.02.04 18:24:59 LOG7[2116:3544]: 0 session cache timeouts 2006.02.04 18:24:59 LOG6[2116:2224]: connect_wait: s_poll_wait timeout 2006.02.04 18:24:59 LOG6[2116:3544]: SSL accepted: previous session reused 2006.02.04 18:24:59 LOG3[2116:2224]: Failed to initialize remote connection 2006.02.04 18:24:59 LOG7[2116:3544]: FD 216 in non-blocking mode 2006.02.04 18:24:59 LOG7[2116:2224]: netDrives finished (1 left) 2006.02.04 18:24:59 LOG7[2116:3544]: netDrives connecting 127.0.0.1:139 2006.02.04 18:24:59 LOG7[2116:3544]: connect_wait: waiting 10 seconds 2006.02.04 18:25:09 LOG6[2116:3544]: connect_wait: s_poll_wait timeout 2006.02.04 18:25:09 LOG3[2116:3544]: Failed to initialize remote connection 2006.02.04 18:25:09 LOG7[2116:3544]: netDrives finished (0 left) Here is the stunnel.conf file from the server: ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [netDrives] accept = 2139 connect = 139 In case you need it, here is the stunnel log from the client: 2006.02.04 18:23:43 LOG5[3236:2376]: stunnel 4.14 on x86-pc-mingw32-gnu WIN32+SELECT+IPv6 with OpenSSL 0.9.7i 14 Oct 2005 2006.02.04 18:23:43 LOG7[3236:324]: RAND_status claims sufficient entropy for the PRNG 2006.02.04 18:23:43 LOG6[3236:324]: PRNG seeded successfully 2006.02.04 18:23:43 LOG7[3236:324]: Certificate: stunnel.pem 2006.02.04 18:23:43 LOG7[3236:324]: Key file: stunnel.pem 2006.02.04 18:23:43 LOG5[3236:324]: No limit detected for the number of clients 2006.02.04 18:23:43 LOG7[3236:324]: FD 200 in non-blocking mode 2006.02.04 18:23:43 LOG7[3236:324]: SO_REUSEADDR option set on accept socket 2006.02.04 18:23:43 LOG7[3236:324]: netDrives bound to 222.222.222.222:139 2006.02.04 18:24:42 LOG7[3236:324]: netDrives accepted FD=220 from 192.168.1.247:1333 2006.02.04 18:24:42 LOG7[3236:324]: Creating a new thread 2006.02.04 18:24:42 LOG7[3236:324]: New thread created 2006.02.04 18:24:42 LOG7[3236:572]: netDrives started 2006.02.04 18:24:42 LOG7[3236:572]: FD 220 in non-blocking mode 2006.02.04 18:24:42 LOG7[3236:572]: TCP_NODELAY option set on local socket 2006.02.04 18:24:42 LOG5[3236:572]: netDrives connected from 192.168.1.247:1333 2006.02.04 18:24:42 LOG7[3236:572]: FD 252 in non-blocking mode 2006.02.04 18:24:42 LOG7[3236:572]: netDrives connecting 192.168.1.10:2139 2006.02.04 18:24:42 LOG7[3236:572]: connect_wait: waiting 10 seconds 2006.02.04 18:24:42 LOG7[3236:572]: connect_wait: connected 2006.02.04 18:24:42 LOG7[3236:572]: Remote FD=252 initialized 2006.02.04 18:24:42 LOG7[3236:572]: TCP_NODELAY option set on remote socket 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): before/connect initialization 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write client hello A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server hello A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server certificate A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server done A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write client key exchange A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write change cipher spec A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write finished A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 flush data 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read finished A 2006.02.04 18:24:42 LOG7[3236:572]: 1 items in the session cache 2006.02.04 18:24:42 LOG7[3236:572]: 1 client connects (SSL_connect()) 2006.02.04 18:24:42 LOG7[3236:572]: 1 client connects that finished 2006.02.04 18:24:42 LOG7[3236:572]: 0 client renegotiatations requested 2006.02.04 18:24:42 LOG7[3236:572]: 0 server connects (SSL_accept()) 2006.02.04 18:24:42 LOG7[3236:572]: 0 server connects that finished 2006.02.04 18:24:42 LOG7[3236:572]: 0 server renegotiatiations requested 2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache hits 2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache misses 2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache timeouts 2006.02.04 18:24:42 LOG6[3236:572]: SSL connected: new session negotiated 2006.02.04 18:24:42 LOG6[3236:572]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.02.04 18:24:52 LOG3[3236:572]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2006.02.04 18:24:52 LOG7[3236:324]: netDrives accepted FD=276 from 192.168.1.247:1335 2006.02.04 18:24:52 LOG5[3236:572]: Connection reset: 72 bytes sent to SSL, 0 bytes sent to socket 2006.02.04 18:24:52 LOG7[3236:324]: Creating a new thread 2006.02.04 18:24:52 LOG7[3236:572]: netDrives finished (0 left) 2006.02.04 18:24:52 LOG7[3236:324]: New thread created 2006.02.04 18:24:52 LOG7[3236:1336]: netDrives started 2006.02.04 18:24:52 LOG7[3236:1336]: FD 276 in non-blocking mode 2006.02.04 18:24:52 LOG7[3236:1336]: TCP_NODELAY option set on local socket 2006.02.04 18:24:52 LOG5[3236:1336]: netDrives connected from 192.168.1.247:1335 2006.02.04 18:24:52 LOG7[3236:1336]: FD 248 in non-blocking mode 2006.02.04 18:24:52 LOG7[3236:1336]: netDrives connecting 192.168.1.10:2139 2006.02.04 18:24:52 LOG7[3236:1336]: connect_wait: waiting 10 seconds 2006.02.04 18:24:52 LOG7[3236:1336]: connect_wait: connected 2006.02.04 18:24:52 LOG7[3236:1336]: Remote FD=248 initialized 2006.02.04 18:24:52 LOG7[3236:1336]: TCP_NODELAY option set on remote socket 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): before/connect initialization 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write client hello A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 read server hello A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 read finished A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write change cipher spec A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write finished A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 flush data 2006.02.04 18:24:52 LOG7[3236:1336]: 1 items in the session cache 2006.02.04 18:24:52 LOG7[3236:1336]: 2 client connects (SSL_connect()) 2006.02.04 18:24:52 LOG7[3236:1336]: 2 client connects that finished 2006.02.04 18:24:52 LOG7[3236:1336]: 0 client renegotiatations requested 2006.02.04 18:24:52 LOG7[3236:1336]: 0 server connects (SSL_accept()) 2006.02.04 18:24:52 LOG7[3236:1336]: 0 server connects that finished 2006.02.04 18:24:52 LOG7[3236:1336]: 0 server renegotiatiations requested 2006.02.04 18:24:52 LOG7[3236:1336]: 1 session cache hits 2006.02.04 18:24:52 LOG7[3236:1336]: 0 session cache misses 2006.02.04 18:24:52 LOG7[3236:1336]: 0 session cache timeouts 2006.02.04 18:24:52 LOG6[3236:1336]: SSL connected: previous session reused 2006.02.04 18:25:02 LOG3[3236:1336]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2006.02.04 18:25:02 LOG5[3236:1336]: Connection reset: 72 bytes sent to SSL, 0 bytes sent to socket 2006.02.04 18:25:02 LOG7[3236:1336]: netDrives finished (0 left) Here is the stunnel.conf file from the client: ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [netDrives] accept = 222.222.222.222:139 connect = tcServer.crcBusinessServices.com:2139 Any ideas what could be wrong? Thanks, Neil -- Neil Aggarwal, JAMM Consulting, (214) 986-3533, www.JAMMConsulting.com FREE! Valuable info on how your business can reduce operating costs by 17% or more in 6 months or less! http://newsletter.JAMMConsulting.com

1 0

tappipe 1.01 released
by Michal Trojnara 04 Feb '06

04 Feb '06

Here is the ChangeLog entry: * version 1.01 2006.02.04, status: functional, not proven to be stable - TUN changed to TAP (project renamed from tunpipe to tappipe) - TCP-over-TCP meltdown problem fixed http://sites.inka.de/sites/bigred/devel/tcp-tcp.html - important bugfixes Download site: ftp://stunnel.mirt.net/tappipe/ Best regards, Mike

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users