stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

stunnel 'options' section of config file
by Justin Miller 21 Dec '04

21 Dec '04

Is it just me, or does stunnel not seem to obey the ssl 'options' setting in the config file? I have the lines: options = TLS_ROLLBACK_BUG options = NO_TLSv1 options = NO_SSLv3 And when I start stunnel, the output is: 2004.12.20 07:47:46 LOG7[9981:1024]: Configuration SSL options: 0x06800000 2004.12.20 07:47:46 LOG7[9981:1024]: SSL options set: 0x06800000 So all looks well ang good... But then when it sends the client hello message, one would expect an ssl2 message, but we get the following output: 2004.12.20 07:47:51 LOG7[9984:1026]: SSL state (connect): SSLv3 write client hello A 2004.12.20 07:47:51 LOG7[9984:1026]: waitforsocket: FD=10, DIR=read 2004.12.20 07:47:51 LOG7[9984:1026]: waitforsocket: ok 2004.12.20 07:47:51 LOG7[9984:1026]: SSL alert (write): fatal: handshake failure 2004.12.20 07:47:51 LOG3[9984:1026]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number That first line seems to indicate that it's still sending a v3 message. Is this actually what's happening?

2 1

Re: [stunnel-users] UDP applications
by Colin McKinnon 21 Dec '04

21 Dec '04

On Tuesday 21 December 2004 03:58, you wrote: > > This encapsulation of udp packets was what i was referring to... Could > you plz give me some pointers where this is "well" documented. > Google suggested: http://www.stunnel.org/examples/pppvpn.html http://www.buildinglinuxvpns.net/sourcecode/r/4/vpn-server.html http://mia.ece.uic.edu/~papers/bin/ppp_over_ssl_vpn_client http://irb.cs.tu-berlin.de/dienste/dialup/inhouse/irbvpnclient (although note that a cursory glance trhough suggests sme of these use stunnel v3 config syntax) C.

1 0

stunnel 4.06 and compression
by saruman 20 Dec '04

20 Dec '04

Hello. Is there any way to get the beta version of stunnel 4.06 (I've seen in this list that it must support compression)? Or if I can't get new version - can I somehow enable compression in stunnel 4.05? Oleg Ivanov

1 0

Problem with huge stunnel.conf
by CIM Massy 20 Dec '04

20 Dec '04

Hi everyone ! I have 900 (W2K) machines that I have to securely log onto. I chose to use both of Ultr@VNC and RealVNC 4.0 (running on ports 5900 & 5901). And I chose to use STunnel 4.05 on W2K to secure the sockets. On my admin PC, Stunnel.conf looks like /*******************************/ #cert stuff [ultravnc0101] accept = 127.0.1.1:5900 connect = PC0101:5700 [realvnc0101] accept = 127.0.1.1:5901 connect = PC0101:5701 ... [ultravnc1000] accept = 127.0.10.0:5900 connect = PC1000:5700 [realvnc1000] accept = 127.0.10.0:5901 connect = PC1000:5701 /*******************************/ And it does only work for the first 31 pairs of "services". (No Authentification issues.) When I move the "PC0101" services to the end of the file it will not work anymore, whereas it does when it's first in the .conf file. I guess having 1800 services is not necessarily the way Stunnel is meant to work... Is it a known issue ? I haven't been able to find any infos on it in newsgroups or with Google. It does not seem to be a W2K problem since it works with the 64 first services. If anyone knows a workaround... Thanks for your help, Reagrds Philippe HAMEAU

3 3

UDP applications
by Paul 20 Dec '04

20 Dec '04

Hi all, Is there any roadmap for Stunnel to support UDP applications? Cant a simple UDP forwarder (with proper buffering to ensure a tcp-like stream of data) do the job? May be this topic is discussed and brainstormed before. I couldnot find any relevant details about this in the archives. Thanks and Regards, Paul

2 1

Need help: verification of client and server certificates
by Mike_Stunnel 20 Dec '04

20 Dec '04

For my Stunnel server, I'm using Windows ME, OpenSSL 0.9.7e and Stunnel 4.05. I've create my own Certificate Authority on my server and created and signed a server and multiple client certificates for Stunnel. I plan to use Stunnel to secure my VNC connections to my PC - to encrypt the traffic and to validate the clients. On the server side: ------------------- I want to limit connections to my Stunnel server to only those Stunnel clients that present a client certificate that I already have a copy of on my server. And I want Stunnel server to only recognize my own Certificate Authority as a valid CA for the clients' certificates. Is this possible? What options do I need to specify in the Stunnel server configuration file to make this work? The documentation is confusing to me - for example, do I use CAfile or CApath to point Stunnel to the the CA certificate? Will Stunnel recognize other CAs as trusted, if their certificates have been loaded by other programs like a browsers or mail reader? Etcetera .. On the client side: ------------------- As with the server, I want my Stunnel client to only recognize my own CA as trusted. And I want it to validate the server certificate as thoroughly as possible. Is that verify level 3? I need the CA certificate on my client, but do I use CAfile or CAcert in the config file to point to it? Do I need a copy of the server certificate on my client so that the client can verify the server's certificate? I'm so confused! I've read the FAQ and Related links on stunnel.org and also the past 4 months' mailing list digests but I'm still not clear on the certificate verification process. or all the options in the configuration file.

1 0

Socks Support
by Paul 15 Dec '04

15 Dec '04

I have been working/using stunnel for quite sometime... I am using it along with SOcks. So was wondering is there anyone who is already working on providing socks (v4 or v5) support to existing stunnel? Also is there any1 else who is also requires socks functionality in stunnel? Thanks and Regards, Paul.

2 1

Stunnel Keeps Closing Connections with an Error
by Jerry Baker 09 Dec '04

09 Dec '04

I am using Stunnel 4.05 on Windows 98/XP to connect VNC clients to a Windows XP server. I am continually getting disconnected by Stunnel with the following error: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac I have tried using the OpenSSL 0.9.7d binaries from stunnel.org AND compiling OpenSSL 0.9.7e myself. Either way, the same result. Thanks in advance.

1 0

SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate
by Ron Kindermann 09 Dec '04

09 Dec '04

Hello, I use stunnel on WinXP to connect to my ISP's pops server and get the following error message in my log: 2004.12.09 12:47:09 LOG5[4888:6096]: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7e 25 Oct 2004 2004.12.09 12:47:11 LOG5[4888:4612]: WIN32 platform: 30000 clients allowed 2004.12.09 12:47:46 LOG5[4888:5432]: pops.xs4all.nl:995 connected from 127.0.0.1:61950 2004.12.09 12:47:46 LOG5[4888:5432]: VERIFY IGNORE: depth=0, /C=NL/ST=Noord Holland/L=Diemen/O=XS4ALL Internet B.V./CN=pops.xs4all.nl 2004.12.09 12:47:46 LOG5[4888:5432]: VERIFY IGNORE: depth=0, /C=NL/ST=Noord Holland/L=Diemen/O=XS4ALL Internet B.V./CN=pops.xs4all.nl 2004.12.09 12:47:46 LOG5[4888:5432]: VERIFY IGNORE: depth=0, /C=NL/ST=Noord Holland/L=Diemen/O=XS4ALL Internet B.V./CN=pops.xs4all.nl 2004.12.09 12:47:46 LOG3[4888:5432]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate This is my config: CAfile = xxxxx cert = xxxxx CRLpath = xxxxx client = yes # debug = 4 key = xxxxx options = DONT_INSERT_EMPTY_FRAGMENTS output = stunnel.log RNDbytes = 64 RNDfile = .rnd RNDoverwrite = yes service = Stunnel client session = 300 taskbar = no verify = 0 [pops.xs4all.nl:995] accept = 127.0.0.1:5000 connect = pops.xs4all.nl:995 delay = yes [pop.gmail.com:995] accept = 127.0.0.1:5003 connect = pop.gmail.com:995 delay = yes The "xxxxx" are good filepaths because I can connect to pop.gmail.com:465 just fine. Anyone got a clue where to look? Thanks, Ron

1 1

cannot connect to gmail (STARTTLS trouble ?)
by Sebastien WILLEMIJNS 05 Dec '04

05 Dec '04

hello, i'm trying to test gmail SMTP server with postie (a commandline poster) and stunnel.... POP access to port 995 is OK SMTP access with gmail is bad (authentification failed) SMTP access with gmx.net and vfemail.net is OK In eudora software , it speak about 3 methods to use SSL, how to try in stunnel these method ? ********************* STUNNEL.CNF client = yes [X]>> stunnel.cnf accept = 1664 connect = smtp.gmail.com:465 ******************** WIN32 COMMANDLINE IS "stunne~1.exe stunnel.cnf" ********************* EUDORA DOC The Generic Properties tab is used to set the SSL options for sending mail (SMTP). The available options are: * Never -- tells Eudora not to use SSL * If Available, STARTTLS -- tells Eudora to use SSL if it is available * Required, Alternate Port -- tells Eudora that the use of SSL is required, on the alternate port (more on this in a minute) * Required, STARTTLS -- tells Eudora that the use of SSL is required *********************** MY GMAIL LOG here's the log i have +OK Gpop ready. USER willemijns(a)gmail.com +OK send PASS PASS xxxxxxxx +OK Welcome. STAT +OK 0 0 There are 0 messages waiting (0 bytes) QUIT +OK Farewell. %%%%%%%%%%% 220 smtp.gmail.com ESMTP 79sm7704rna EHLO 80-125-222-144.dti.cegetel.net 250-smtp.gmail.com at your service 250-SIZE 20971520 250-8BITMIME 250-AUTH PLAIN LOGIN 250 ENHANCEDSTATUSCODES AUTH PLAIN 334 = AHXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX2 235 2.7.0 Accepted EHLO 80-125-222-144.dti.cegetel.net 250-smtp.gmail.com at your service 250-SIZE 20971520 250-8BITMIME 250-AUTH PLAIN LOGIN 250 ENHANCEDSTATUSCODES Connected to 'smtp.gmail.com:465' MAIL FROM:<willemijns(a)gmail.com> 530 5.7.0 Authentication Required Could not send: error= -1 Status: 530 5.7.0 Authentication Required **********i've noticied when it works well (with GMX.NET), i can see "250 STARTTLS" as: Query for (NS) 'runbox.com' [127.0.0.1] MX/A server (0) = '' 220 {mp009} GMX Mailservices ESMTP EHLO localhost 250-{mp009} GMX Mailservices 250-8BITMIME 250-ENHANCEDSTATUSCODES 250-AUTH=LOGIN CRAM-MD5 PLAIN 250-AUTH CRAM-MD5 LOGIN PLAIN 250 STARTTLS AUTH PLAIN 334 Go on AHXXXXXXXXXXXXXXXXXXXXXXXXXXX== 235 2.7.0 {mp009} Go ahead EHLO localhost 250-{mp009} GMX Mailservices 250-8BITMIME 250-ENHANCEDSTATUSCODES 250-AUTH=LOGIN CRAM-MD5 PLAIN 250-AUTH CRAM-MD5 LOGIN PLAIN 250 STARTTLS Connected to '127.0.0.1:1664' MAIL FROM:<willemijns(a)gmx.net> 250 2.1.0 {mp009} ok RCPT TO:<vivil(a)runbox.com> 250 2.1.5 {mp009} ok DATA 354 {mp009} Go ahead To: vivil(a)runbox.com (...) thanks of your help :-) ----- End Forwarded Message ----- ----- End Forwarded Message -----

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users