- stunnel-users - stunnel.org

need help with verify 1 option
by Olivier twist 13 Jan '06

13 Jan '06

2 2

Some newbie question for stunnel
by Thomas Stein 13 Jan '06

13 Jan '06

Hello, After reading some doc pages about stunnel I have still some questions: 1.) I read that the client part of a pop3 connection (e.g. for GoogleMail) is like stunnel -c -d pop3 -r bar:pop3s However I did not found any explations of the flags -d, -d and -r When I type stunnel -help none of these flags are explained. 2.) Can I replace pop3 and pop3s in the command above by real port numbers? 3.) Is stunnel compatible with SSH servers ? In other words: can stunnel on the local machine communicate with a SSH server on the remote computer and vice versa? 4.) Is there a timeout function? Read: When I start stunnel I would like to exit the service after lets say 5 minutes automatically. Is there such a feature/option? 5.) Has someone experiences with googlemail pop3 retrieval of emails? Is the following stunnel command recommendable for googlemail.com? stunnel -c -d pop3 -r pop.googlemail.com:pop3 Thank you in advance for the answer Thomas -- ___________________________________________________ Play 100s of games for FREE! http://games.mail.com/

2 1

Sniffing the network --how to disable SSL?
by david-e.hansen＠ubs.com 12 Jan '06

12 Jan '06

Hi, I know this sort of defeats the whole purpose of stunnel, but I have an LDAP server which listens for non-SSL on one port, and SSL on another. We decided to use stunnel and the SSL port on our LDAP server for security purposes. However, now we need to see the communication between clients and the LDAP server, in order to debug a production problem. Sniffing won't be terribly useful unless we can turn off the SSL encryption of the communication. I can't just re-point the application to the non-SSL port because this is stored in a central database and would affect everyone (it's a 3rd pty app), so I just want to change the stunnel.conf file on my PC so that it does port-forwarding but no encryption. Is this possible to do? Regards, David E. Hansen Stunnel version 4, LDAP version 3 Visit our website at http://www.ubs.com This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes and should not be construed as a solicitation or offer to buy or sell any securities or related financial instruments.

2 1

running on one machine stunnel server AND client
by Dan Beldiman 11 Jan '06

11 Jan '06

Hi, I am using stunnel4 (stunnel 4.09 on i386-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004) on debian linux. I want to run on one machine an stunnel server and an stunnel client, so it can recive a connection and also open a new connection to a different server (in the ascii graphic below server b) SERVER A SERVER B SERVER C | | | | ------>------ ----->---- The configuration file only allows me to specify client=yes or no, but I can not specify this for each connection. How can I set up a client and server on the same machine? Thanks Dan

2 3

Stunnel 4.14 & 4.15 don't compile on Tru64 (5.1A)!
by Alberto D'Ambrosio 11 Jan '06

11 Jan '06

Hi! I'd like to upgrade Stunnel from 4.04 to 4.14/4.15 on my Tru64 box, but it no longer compiles: ========================================= cc: Error: client.c, line 173: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t addrlen; ----^ cc: Error: client.c, line 893: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t addrlen; ----^ cc: Error: client.c, line 1003: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t optlen; ----^ cc: Error: client.c, line 175: In this statement, "addrlen" is not declared. (undeclared) addrlen=sizeof(SOCKADDR_UNION); ----^ cc: Warning: client.c, line 259: In this statement, the referenced type of the pointer value "sid_ctx" is "unsigned char", which is not compatible with "const char" because they differ by signed/unsigned attribute. (ptrmismatch1) SSL_set_session_id_context(c->ssl, sid_ctx, strlen(sid_ctx)); -------------------------------------------------------^ cc: Error: client.c, line 904: In this statement, "addrlen" is not declared. (undeclared) addrlen=sizeof(SOCKADDR_UNION); ----^ cc: Error: client.c, line 1019: In this statement, "optlen" is not declared. (undeclared) optlen=sizeof(error); ------------^ *** Exit 1 Stop. *** Exit 1 Stop. ========================================= For your information: - Version 4.04 compiles and works fine. - Version 4.06 compiles but doesn't work: Jan 11 10:36:14 scilla stunnel[701061]: daemon_loop: s_poll_wait: Invalid argument (22) Jan 11 10:38:37 scilla last message repeated 77888 times Jan 11 10:36:44 scilla last message repeated 24118 times - any version >= 4.07 no longer compiles. - OpenSSL 0.9.8a compiles and works fine. Any help is appreciated. Ciao, Alberto

2 1

Private key storage on usb token or CD
by Siddhartha Jain 10 Jan '06

10 Jan '06

Hi, What would I need to do to store private keys generated on a Windows client on a USB Token or a CD? Thanks, - Siddhartha

2 1

Re: Connection reset by peer on same local network?
by Gabe Martin-Dempesy 04 Jan '06

04 Jan '06

On Jan 4, 2006, at 5:00 AM, stunnel-users-request(a)mirt.net wrote: > Please try the latest stunnel and OpenSSL first. > Also send detailed logs (debug=7). Same behavior occurs after upgrade. on debug 7: Server log: 2006.01.04 09:01:35 LOG7[14085:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=7, (OUT)->(ERRHUP) 2006.01.04 09:01:35 LOG7[14085:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=7, (OUT)->(ERRHUP) 2006.01.04 09:01:35 LOG3[14085:2]: transfer() loop executes not transferring any data 2006.01.04 09:01:35 LOG3[14085:2]: please report the problem to Michal.Trojnara(a)mirt.net 2006.01.04 09:01:35 LOG3[14085:2]: socket open: rd=yes wr=yes, ssl open: rd=yes wr=yes 2006.01.04 09:01:35 LOG3[14085:2]: socket ready: rd=no wr=no, ssl ready: rd=yes wr=no 2006.01.04 09:01:35 LOG3[14085:2]: ssl want: rd=no wr=no 2006.01.04 09:01:35 LOG3[14085:2]: socket input buffer: 16384 byte (s), ssl input buffer: 16384 byte(s) 2006.01.04 09:01:35 LOG3[14085:2]: check_SSL_pending=0, ssl_closing=0 2006.01.04 09:01:35 LOG5[14085:2]: Connection reset: 1345269015 bytes sent to SSL, 213024 bytes sent to socket 2006.01.04 09:01:35 LOG7[14085:2]: 973 finished (0 left) 2006.01.04 09:01:35 LOG5[14085:2]: stack_info: size=65536, current=4620 (7%), maximum=4620 (7%) 2006.01.04 09:01:35 LOG7[14085:2]: Context 2 closed 2006.01.04 09:01:35 LOG7[14085:0]: Waiting -1 second(s) for 2 file descriptor(s) Client log: 2006.01.04 09:00:39 LOG7[9605:0]: Waiting 43200 second(s) for 5 file descriptor(s) 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=7, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=9, (OUT)->(OUT) 2006.01.04 09:00:39 LOG7[9605:2]: SSL_write returned WANT_WRITE: retrying 2006.01.04 09:00:39 LOG3[9605:2]: SSL socket closed with 16384 byte (s) in buffer 2006.01.04 09:00:39 LOG5[9605:2]: Connection reset: 348124 bytes sent to SSL, 1345102011 bytes sent to socket 2006.01.04 09:00:39 LOG7[9605:2]: 8001 finished (0 left) 2006.01.04 09:00:39 LOG7[9605:2]: Context 2 closed 2006.01.04 09:00:39 LOG7[9605:0]: Waiting -1 second(s) for 3 file descriptor(s) This part of the logs: 2006.01.04 09:00:39 LOG7[9605:0]: Waiting 43200 second(s) for 5 file descriptor(s) 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=7, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=9, (OUT)->(OUT) loops continuously in both server and client lots the entire time, repeating several times each second. One rsync session over stunnel generates stunnel logs over 50MB. I have no idea if this is typical LOG7 behavior or not, but I'm mentioning it just in case.

1 0

stunnel 4.14 and zlib compression problem
by David Cheung 04 Jan '06

04 Jan '06

I'm hoping that someone can shed some light on the following problem: when I run stunnel: [root@test stunnel]# stunnel /etc/stunnel/stunnel.conf 2006.01.03 10:49:27 LOG5[4619:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7h 11 Oct 2005 2006.01.03 10:49:27 LOG3[4619:1]: Failed to initialize zlib compression method content of stunnel.conf: foreground = yes debug = 7 cert = /etc/stunnel/stunnel.pem output = /dev/stdout chroot = /var/run/stunnel/ setuid = nobody setgid = nobody pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 compression = zlib [demo] accept = 1443 connect = www:80 TIMEOUTclose = 0 It also appears that the libraries are properly linked in: [root@test tmp]# ldd /usr/sbin/stunnel linux-gate.so.1 => (0xffffe000) libz.so.1 => /usr/lib/libz.so.1 (0xb7fc9000) libdl.so.2 => /lib/libdl.so.2 (0xb7fc5000) libutil.so.1 => /lib/libutil.so.1 (0xb7fc1000) libnsl.so.1 => /lib/libnsl.so.1 (0xb7fab000) libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0xb7f78000) libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0xb7e66000) libwrap.so.0 => /usr/lib/libwrap.so.0 (0xb7e5f000) libc.so.6 => /lib/tls/libc.so.6 (0xb7d40000) /lib/ld-linux.so.2 (0xb7fdf000) I'm running this on Arch Linux with a stock 2.6.15 kernel. Any help would be appreciated.

2 1

Connection reset by peer on same local network?
by Gabe Martin-Dempesy 04 Jan '06

04 Jan '06

I'm attempting to setup an encrypted rsync to pull backups off of a file server onto a safe backup machine. To do this I'm using a combination of stunnel and rsyncd (It needs to pull root-owned files, so -e ssh wouldn't work unless I want to have a backup script remotely logging in as root!!) For now the machines are both on the same local network, 10.10.10.0/24, but I'm have weird problems with stunnel getting a 'connection reset by peer' after a couple minutes of the rsync, halting the transfer prematurely. Here's what I see in the logs: Client: Dec 29 10:19:21 backup stunnel[2568]: 8001 connected from 127.0.0.1:39215 Dec 29 10:21:09 backup stunnel[2568]: SSL_write: Connection reset by peer (104) Dec 29 10:21:09 backup stunnel[2568]: Connection reset: 192532 bytes sent to SSL, 5920666 bytes sent to socket Server: Dec 29 10:20:00 proto stunnel[30434]: 973 connected from 10.10.10.20:54054 Dec 29 10:20:00 proto rsyncd[1776]: rsync on xserve from localhost (127.0.0.1) Dec 29 10:21:49 proto stunnel[30434]: SSL socket closed with 16384 byte(s) in buffer Dec 29 10:21:49 proto stunnel[30434]: Connection reset: 5953434 bytes sent to SSL, 98416 bytes sent to socket Dec 29 16:21:49 proto rsyncd[1776]: rsync: writefd_unbuffered failed to write 4096 bytes: phase "unknown": Connection reset by peer Dec 29 16:21:49 proto rsyncd[1776]: rsync error: error in rsync protocol data stream (code 12) at io.c(666) Note that the client gets the 'connection reset by peer' a good 40 seconds before the server notices the disconnect. Here are the associated stunnel.conf's, which are pretty basic Client: cert = /etc/stunnel/backup.crt key = /etc/stunnel/backup.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [8001] accept = 8001 connect = 10.10.10.15:973 Server: cert = /etc/stunnel/proto.crt key = /etc/stunnel/proto.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [973] accept = 973 connect = 127.0.0.1:rsync Both are using: stunnel 4.09 on i686-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/lib/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Both of these machines are Gentoo 2005.1, updated to current, using the hardened 2.6 profile. Neither of them use non-standard make flags. Does anyone have some insight? There shouldn't be any "peer" (besides themselves) in the way between these two boxes to disconnect them.

2 1

RE: [stunnel-users] Connection reset by peer on same local networ k?
by Jeremy Simons 04 Jan '06

04 Jan '06

The problem is not with stunnel, but with rsyncd. I assume you are running rsyncd on the source machine in conjunction with the /etc/rsyncd.conf file. The cool thing about running rsyncd through stunnel is the rsync client appears to the rsyncd as a local machine (obviously) so permissions are a problem. The best way I could recommend since you need to access root owned files would be to setup your rsyncd entry something like: ## Example of full access to /home directory [home] uid = root gid = root path = /home comment = home directory. hosts allow = 127.0.0.1 read only = no ignore nonreadable = no refuse options = checksum dont compress = * If you notice the "hosts allow" directive only allows access from localhost(127.0.0.1). The problem is *anyone* can connect to your stunnel server unless you require security I would recommend using your firewall to allow access to your stunnel instance and also to use non-standard ports (I.E. 50000-50010). Using a firewall in lieu of authentication is obviously NOT secure or even recommended for a production environment but is simply added security that certainly doesn't hurt. The workaround would be to secure stunnel and leave rsyncd wide-open to localhost. As for the "connection reset" errors I was getting the same thing until I upgraded to the latest version of stunnel. I read a post on stunnel.mirt.net about it. Are you sure you're using the latest version of stunnel? Jeremy -----Original Message----- From: Gabe Martin-Dempesy [mailto:gabe@mudbugmedia.com] Sent: Tuesday, January 03, 2006 1:49 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Connection reset by peer on same local network? I'm attempting to setup an encrypted rsync to pull backups off of a file server onto a safe backup machine. To do this I'm using a combination of stunnel and rsyncd (It needs to pull root-owned files, so -e ssh wouldn't work unless I want to have a backup script remotely logging in as root!!) For now the machines are both on the same local network, 10.10.10.0/24, but I'm have weird problems with stunnel getting a 'connection reset by peer' after a couple minutes of the rsync, halting the transfer prematurely. Here's what I see in the logs: Client: Dec 29 10:19:21 backup stunnel[2568]: 8001 connected from 127.0.0.1:39215 Dec 29 10:21:09 backup stunnel[2568]: SSL_write: Connection reset by peer (104) Dec 29 10:21:09 backup stunnel[2568]: Connection reset: 192532 bytes sent to SSL, 5920666 bytes sent to socket Server: Dec 29 10:20:00 proto stunnel[30434]: 973 connected from 10.10.10.20:54054 Dec 29 10:20:00 proto rsyncd[1776]: rsync on xserve from localhost (127.0.0.1) Dec 29 10:21:49 proto stunnel[30434]: SSL socket closed with 16384 byte(s) in buffer Dec 29 10:21:49 proto stunnel[30434]: Connection reset: 5953434 bytes sent to SSL, 98416 bytes sent to socket Dec 29 16:21:49 proto rsyncd[1776]: rsync: writefd_unbuffered failed to write 4096 bytes: phase "unknown": Connection reset by peer Dec 29 16:21:49 proto rsyncd[1776]: rsync error: error in rsync protocol data stream (code 12) at io.c(666) Note that the client gets the 'connection reset by peer' a good 40 seconds before the server notices the disconnect. Here are the associated stunnel.conf's, which are pretty basic Client: cert = /etc/stunnel/backup.crt key = /etc/stunnel/backup.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [8001] accept = 8001 connect = 10.10.10.15:973 Server: cert = /etc/stunnel/proto.crt key = /etc/stunnel/proto.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [973] accept = 973 connect = 127.0.0.1:rsync Both are using: stunnel 4.09 on i686-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/lib/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Both of these machines are Gentoo 2005.1, updated to current, using the hardened 2.6 profile. Neither of them use non-standard make flags. Does anyone have some insight? There shouldn't be any "peer" (besides themselves) in the way between these two boxes to disconnect them. _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0