stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

stunnel and connection alerts for Windows
by John A. Wallace 31 Jan '12

31 Jan '12

Hello. It would be helpful to me to see a little popup window notification of connections or data transfers made through Stunnel, a small and unobtrusive alert of such kind as not requiring me to open another Window, etc.. One thought I have along these lines is to have the stunnel Log Window to serve this purpose by having a configuration option for it to open in a small window by the system alert toolbar on the bottom right, providing a one-liner or abbreviated rendition of its current logging text. I do not know of a way to make this happen within stunnel itself, but if there is functionality of this sort already available, please advise. Another program that comes to mind with this sort of purpose would be Growl, which allows developers to make plugins to create this effect. http://www.growlforwindows.com/gfw/apps.aspx. Is there anyone else here who would find this useful or who is aware of work along these lines? Thanks. John

2 1

stunnel and local proxies
by John A. Wallace 30 Jan '12

30 Jan '12

Hello. At times I would like to have Stunnel (in Windows OS) running through a proxy on localhost, say, a socks proxy. Based on what I have seen and read here and in the list archives about that, although admittedly I have not yet read every single thread, I am inclined to say that it is not designed to do so easily if at all. Someone even suggested to me that these settings alone would allow running it over a socks proxy on my machine: ; these settings relate to using stunnel through a proxy ;protocol=connect ;protocolHost=127.0.0.1:portXYZ I tested this on my system but it failed to work. On the other hand I have had success using a program like socat for this purpose. Am I correct in thinking that the above settings alone are not going to do it or do I need additional settings with them for this purpose, or is it not going to work with Stunnel alone? Thanks.

1 0

Stunnel configuration to forward IP address
by Rajat Garg 29 Jan '12

29 Jan '12

Folks, I have done a setup where I am using Stunnel to forward incoming HTTPS requests to HaProxy. But, I am unable to get IP address at HaProxy level (determined by looking at logs) - Here is the configuration file for Stunnel - cert = /etc/stunnel/ssl.crt key = /etc/apache2/ssl.key/socialappshq.com.key sslVersion = all chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 CAfile = /etc/apache2/ssl.key/ca.pem output = /var/log/stunnel4/stunnel.log [proxy] accept = 443 connect = 81 TIMEOUTclose = 0 Here is the config file for HaProxy - global log 127.0.0.1 local0 log 127.0.0.1 local1 notice maxconn 4096 user haproxy group haproxy defaults log global option httplog option dontlognull mode http stats enable retries 3 option redispatch maxconn 2000 timeout client 40s # Client and server timeout must match the longest timeout server 40s # time we may wait for a response from the server. timeout queue 40s # Don't queue requests too long if saturated. timeout connect 20s # There's no reason to change this one. timeout http-request 30s # A complete request may never take that long. frontend webfarm_ssl *:81 accept-proxy option httpclose option forwardfor acl is_social hdr_dom(host) -i socialappshq.com use_backend socialappshq_ssl if is_social backend socialappshq_ssl balance roundrobin cookie JSESSIONID prefix option httpchk GET /check.txt HTTP/1.0 server web2 ec2-XX.us-west-1.compute.amazonaws.com:8080 cookie B check inter 2000 rise 2 fall 3 What else should I do so that IP address passes from Stunnel to Haproxy? Your help will be extremely appreciated. Thx Rajat Garg https://www.socialappshq.com

3 3

patch for using stunnel as client with pkcs11-engine and opensc smartcard
by Märt Laak 29 Jan '12

29 Jan '12

Dear stunnel managers, I would like to inform you that there exist some incompatibility with stunnel and openssl pkcs11-engine with external PIN entry device (like RSA smartcard using opensc) in Linux. We use this config to load openssl engine stunnel.conf: --- engine=dynamic engineCtrl=SO_PATH:/usr/lib/engines/engine_pkcs11.so engineCtrl=ID:pkcs11 engineCtrl=LIST_ADD:1 engineCtrl=LOAD engineCtrl=MODULE_PATH:/usr/lib/opensc-pkcs11.so engineCtrl=INIT --- Problem is, with this setup stunnel does not allow user to enter PIN for the secret key. Instead it tries to get secret key without PIN, 3 times (and then therefore usually blocks card PIN) and retires: ---- Initializing engine 1 Engine 1 initialized PRNG seeded successfully Certificate: mart.pem Certificate loaded Key file: id_01 error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect Wrong PIN: retrying error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect Wrong PIN: retrying error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key ENGINE_load_private_key: 800050A0: error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect ---- I discovered workaround that is valid form version 4.26 till current 4.34, as follows, NULL-ing the ui_data.method property in ctx.c: --- diff -cr stunnel-4.34/src/ctx.c stunnel-4.34-patched/src/ctx.c *** stunnel-4.34/src/ctx.c 2010-09-14 18:08:43.000000000 +0300 --- stunnel-4.34-patched/src/ctx.c 2010-09-28 21:56:36.219081931 +0300 *************** *** 304,309 **** --- 304,310 ---- UI_method_set_reader(ui_method, pin_cb); #else /* USE_WIN32 */ ui_method=UI_OpenSSL(); + ui_data.section = NULL; #endif /* USE_WIN32 */ if(section->engine) for(i=1; i<=3; i++) { --- After that patch private key loads correctly: --- Initializing engine 1 Engine 1 initialized PRNG seeded successfully Certificate: mart.pem Certificate loaded Key file: id_01 private key loaded --- It would be nice if: * somebody investigates more precisely why the OpenSSL PIN entry is not showing with unpached stunnel * include my or better patch for this situation Thank you very much for excellent piece of software! With best regards, Märt Laak

2 2

STunnel on Windows (2008R2 Server)
by Skinner, Robert 28 Jan '12

28 Jan '12

I am attempting to use stunnel to encrypt traffic between our backup client (Window2008R2) and our NetApp filer, but I'm not having any luck We would like to use the stunnel to redirect the port 80 calls to the filer (ubfs2.buffalo.edu) to port 443. Be design, the backup client (IBM Tivoli/TSM V6.2.4) makes a call to the Netapp over http.admin interface to tell it to create a snapshot. The filer listens on https.admin (not http.admin), and we don't want to turn on http.admin for security reasons. I've included the stunnel.config file, hosts file, and the output below. If anyone could give us a hand here it would be much appreciated. We tested this config on a Mac laptop and it works just fine, so I would assume that it has something to do with Windows2008R2 Stunnel.config debug = 7 client = yes [snapdiff] accept = localhost:80 connect = 128.205.5.55:443 sslVersion = all hosts 127.0.0.1 localhost ubfs2.buffalo.edu output 7[1596:4336]: No limit detected for the number of clients 2012.01.27 15:16:30 LOG5[1596:4336]: stunnel 4.52 on x86-pc-mingw32-gnu platform 2012.01.27 15:16:30 LOG5[1596:4336]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.01.27 15:16:30 LOG5[1596:4336]: Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 2012.01.27 15:16:30 LOG5[1596:4336]: Reading configuration from file stunnel.conf 2012.01.27 15:16:30 LOG5[1596:4336]: FIPS mode is enabled 2012.01.27 15:16:30 LOG7[1596:4336]: Compression not enabled 2012.01.27 15:16:30 LOG7[1596:4336]: Snagged 64 random bytes from C:/.rnd 2012.01.27 15:16:30 LOG7[1596:4336]: Wrote 1024 new random bytes to C:/.rnd 2012.01.27 15:16:30 LOG7[1596:4336]: PRNG seeded successfully 2012.01.27 15:16:31 LOG6[1596:4336]: Initializing SSL context for service snapdiff 2012.01.27 15:16:31 LOG7[1596:4336]: SSL options set: 0x00000004 2012.01.27 15:16:31 LOG6[1596:4336]: SSL context initialized 2012.01.27 15:16:31 LOG5[1596:4336]: Configuration successful 2012.01.27 15:16:31 LOG7[1596:4336]: Service snapdiff bound FD=396 to 127.0.0.1:80 2012.01.27 15:16:40 LOG7[1596:4336]: Service snapdiff accepted FD=452 from 127.0.0.1:51366 2012.01.27 15:16:40 LOG7[1596:4336]: Creating a new thread 2012.01.27 15:16:40 LOG7[1596:4336]: New thread created 2012.01.27 15:16:40 LOG7[1596:4336]: Service snapdiff accepted FD=460 from 127.0.0.1:51367 2012.01.27 15:16:40 LOG7[1596:4336]: Creating a new thread 2012.01.27 15:16:40 LOG7[1596:4336]: New thread created 2012.01.27 15:16:40 LOG7[1596:5080]: Service snapdiff started 2012.01.27 15:16:40 LOG5[1596:5080]: Service snapdiff accepted connection from 127.0.0.1:51366 2012.01.27 15:16:40 LOG6[1596:5080]: connect_blocking: connecting 128.205.5.55:443 2012.01.27 15:16:40 LOG7[1596:5080]: connect_blocking: s_poll_wait 128.205.5.55:443: waiting 10 seconds 2012.01.27 15:16:40 LOG7[1596:4720]: Service snapdiff started 2012.01.27 15:16:40 LOG5[1596:4720]: Service snapdiff accepted connection from 127.0.0.1:51367 2012.01.27 15:16:40 LOG6[1596:4720]: connect_blocking: connecting 128.205.5.55:443 2012.01.27 15:16:40 LOG7[1596:4720]: connect_blocking: s_poll_wait 128.205.5.55:443: waiting 10 seconds 2012.01.27 15:16:40 LOG5[1596:4720]: connect_blocking: connected 128.205.5.55:443 2012.01.27 15:16:40 LOG5[1596:4720]: Service snapdiff connected remote server from 128.205.4.234:51369 2012.01.27 15:16:40 LOG7[1596:4720]: Remote FD=508 initialized 2012.01.27 15:16:40 LOG3[1596:4720]: SSL_connect: 14077410: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure 2012.01.27 15:16:40 LOG5[1596:4720]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.01.27 15:16:40 LOG7[1596:4720]: Service snapdiff finished (1 left) 2012.01.27 15:16:43 LOG5[1596:5080]: connect_blocking: connected 128.205.5.55:443 2012.01.27 15:16:43 LOG5[1596:5080]: Service snapdiff connected remote server from 128.205.4.234:51368 2012.01.27 15:16:43 LOG7[1596:5080]: Remote FD=480 initialized 2012.01.27 15:16:43 LOG3[1596:5080]: SSL_connect: 14077410: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure 2012.01.27 15:16:43 LOG5[1596:5080]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.01.27 15:16:43 LOG7[1596:5080]: Service snapdiff finished (0 left)

2 1

stunnel+memoq error | urgent feedback needed
by Bob Makovei 27 Jan '12

27 Jan '12

Hello there! I am a new stunnel user, working as a translator. Please, find attached a log report about a connection error. I've tried everything I could to make stunnel work for memoq. What's wrong? I would much appreciate your quck input... Kind regards, Bob Bob Makovei Economist, Certified Translator, Investment Consultant | <http://www.makovei.me/> www.makovei.me | <mailto:bob@makovei.me> bob(a)makovei.me Exim Pro Ltd., 25 Draga Street, Bekes H-5630, Hungary | +36.70.324.7424 (t) | +36.70.908.7704 (f) US: +1.512.682.0817 (vm) | +1.781.723.5861 (f) | UK: +44.871.526.2661 (f) | mr19740809 (skype)

1 0

stunnel and socat
by John A. Wallace 26 Jan '12

26 Jan '12

Hello. I use socat to connect stunnel to a socks proxy on my client workstation running windows. the socks proxy then connects to a news server on the internet. The initial connection works just fine and it appears to stay connected while I am transferring data and for a while afterwards; but after a period of idle connection say five or ten minutes, I get a message from my network adaptor popup saying that the connection stunnel had to my localhost has failed. Any ideas on how I can make the connection between stunnel and localhost persist longer during periods of inactivity? I would like it to stay connected until I purposely stop it. Below is the relevant section of "stunnel.conf". [newsreader_to_newsserver] accept = 127.0.0.1:120 connect = 127.0.0.1:5630 CAfile = peer-news_certificate.pem verify = 3

1 0

stunnel+memoq error
by Bob Makovei 26 Jan '12

26 Jan '12

Hello there! I am a new stunnel user, working as a translator. Please, find attached a log report about a connection error. I've tried everything I could to make stunnel work for memoq. What's wrong? Kind regards, Bob Bob Makovei Economist, Certified Translator, Investment Consultant | <http://www.makovei.me/> www.makovei.me | <mailto:bob@makovei.me> bob(a)makovei.me Exim Pro Ltd., 25 Draga Street, Bekes H-5630, Hungary | +36.70.324.7424 (t) | +36.70.908.7704 (f) US: +1.512.682.0817 (vm) | +1.781.723.5861 (f) | UK: +44.871.526.2661 (f) | mr19740809 (skype)

1 0

Strange Log
by Hamid.Shahid＠sungard.com 26 Jan '12

26 Jan '12

Hi Jose, I am getting the following log, when I am trying connect my program with Stunnel, which is connected to a remote server using SSL. Can you please have a look and help me understand what is happening and what can be the reason? Many thanks! 2012.01.25 18:50:12 LOG5[8384:2416]: Reading configuration from file stunnel.conf 2012.01.25 18:50:12 LOG7[8384:2416]: Snagged 64 random bytes from C:/.rnd 2012.01.25 18:50:12 LOG7[8384:2416]: Wrote 1024 new random bytes to C:/.rnd 2012.01.25 18:50:12 LOG7[8384:2416]: PRNG seeded successfully 2012.01.25 18:50:12 LOG6[8384:2416]: Initializing SSL context for service SSLHOST 2012.01.25 18:50:12 LOG7[8384:2416]: Certificate: ABC_Cert.pem 2012.01.25 18:50:12 LOG7[8384:2416]: Certificate loaded 2012.01.25 18:50:12 LOG7[8384:2416]: Key file: ABC_Cert_key.pem 2012.01.25 18:50:30 LOG7[8384:2416]: Private key loaded 2012.01.25 18:50:30 LOG7[8384:2416]: SSL options set: 0x00180004 2012.01.25 18:50:30 LOG6[8384:2416]: SSL context initialized 2012.01.25 18:50:30 LOG5[8384:2416]: Configuration successful 2012.01.25 18:50:30 LOG7[8384:2416]: accept socket: FD=652 allocated (non-blocking mode) 2012.01.25 18:50:30 LOG7[8384:2416]: Option SO_REUSEADDR set on accept socket 2012.01.25 18:50:30 LOG7[8384:2416]: Service SSLHOST bound to 127.0.0.1:2525 2012.01.25 18:50:30 LOG7[8384:2416]: Service SSLHOST opened FD=652 2012.01.25 18:50:46 LOG7[8384:2416]: local socket: FD=752 allocated (non-blocking mode) 2012.01.25 18:50:46 LOG7[8384:2416]: Service SSLHOST accepted FD=752 from 127.0.0.1:52075 2012.01.25 18:50:46 LOG7[8384:2416]: Creating a new thread 2012.01.25 18:50:46 LOG7[8384:2416]: New thread created 2012.01.25 18:50:46 LOG7[8384:12664]: Service SSLHOST started 2012.01.25 18:50:46 LOG7[8384:12664]: Option TCP_NODELAY set on local socket 2012.01.25 18:50:46 LOG5[8384:12664]: Service SSLHOST accepted connection from 127.0.0.1:52075 2012.01.25 18:50:46 LOG7[8384:12664]: remote socket: FD=768 allocated (non-blocking mode) 2012.01.25 18:50:46 LOG6[8384:12664]: connect_blocking: connecting <server_ip : port> 2012.01.25 18:50:46 LOG7[8384:12664]: connect_blocking: s_poll_wait <server_ip : port>: waiting 10 seconds 2012.01.25 18:50:46 LOG5[8384:12664]: connect_blocking: connected <server_ip : port> 2012.01.25 18:50:46 LOG5[8384:12664]: Service SSLHOST connected remote server from <server_ip : port> 2012.01.25 18:50:46 LOG7[8384:12664]: Remote FD=768 initialized 2012.01.25 18:50:46 LOG7[8384:12664]: Option TCP_NODELAY set on remote socket 2012.01.25 18:50:46 LOG7[8384:12664]: SNI: host name: <ip> 2012.01.25 18:50:46 LOG7[8384:12664]: Peer certificate was cached (1976 bytes) 2012.01.25 18:50:46 LOG6[8384:12664]: SSL connected: new session negotiated 2012.01.25 18:50:46 LOG6[8384:12664]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2012.01.25 18:50:46 LOG7[8384:12664]: SSL closed on SSL_read 2012.01.25 18:50:46 LOG7[8384:12664]: Sending socket write shutdown 2012.01.25 18:50:46 LOG7[8384:12664]: Socket closed on read 2012.01.25 18:50:46 LOG7[8384:12664]: Sending SSL write shutdown 2012.01.25 18:50:46 LOG6[8384:12664]: SSL_shutdown successfully sent close_notify 2012.01.25 18:50:46 LOG5[8384:12664]: Connection closed: 133 bytes sent to SSL, 8 bytes sent to socket 2012.01.25 18:50:46 LOG7[8384:12664]: Service SSLHOST finished (0 left) Kind Regards, Hamid Shahid

2 1

Stunnel without certificate
by VANDOOREN, Pascal 25 Jan '12

25 Jan '12

Hello, I have a question, is it possible to use Stunnel without a certification but with a passphrase ? because a use a generated certificate that expired after one year and it's not possible to generate a certificate more than one year .... Kind regards Pascal -- This e-mail is confidential. If you are not the addressee or an authorized recipient of this message, any distribution, copying, publication or use of this information for any purpose is prohibited. Please notify the sender immediately by e-mail and then delete this message. Ce message est confidentiel. Si vous n'etes pas le destinataire designe de ce message ou une personne autorisee a l'utiliser, toute distribution, copie, publication ou usage a quelques fins que ce soit des informations contenues dans ce message sont interdits. Merci d'informer immediatement l'expediteur par messagerie electronique et d'ensuite detruire ce message. --

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users