- stunnel-users - stunnel.org

Re: [stunnel-users] stunnel-users Digest, Vol 48, Issue 8
by Pietro Di Primo 10 Jul '08

10 Jul '08

Thank you for reply. I tryied it but it doesn't work because my client run some separated subprocesses and are them that contact the server so, if an extern process try to connect to 127.0.0.1:<the_found_port> while one of that subprocess has finished and the next is not yet started, it will be able to do it and also my subprocess will be pending (i tryed it). Hope i was able to explain the situation. Any suggestion? Thanks in advace > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 9 Jul 2008 13:26:03 +0200 (CEST) > From: "Pietro Di Primo" <pietro.diprimo(a)ct.infn.it> > Subject: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: > <2553.193.206.208.201.1215602763.squirrel(a)imapfis.ct.infn.it> > Content-Type: text/plain;charset=utf-8 > > Hi, I have a client server application, and want to tunnel it in this way: > a script select a free port in a random way, write the stunnel.conf file. > with "accept=<the_found_port>" and "connect=<my_server>" and run my client > application passing to 127.0.0.1:<the_found_port> as server address. > The problem is that i need to be sure that no other client or user can > access <the_found_port> while the application is running. > I guess that it should be possible to do it, but i wasn't able to. > > Can anybody help me? > > Thanks > > > -- > --- > > Ing. Pietro Di Primo > INFN - Istituto Nazionale di Fisica Nucleare > Grid Computing Research Area > Via S. Sofia 78 95123 CATANIA (Italy) > Voice : +39 095 378-5446/5517 > Fax. : +39 095 378 5518 > Mobile : +39 320 8591527 > E-mail : pietro.diprimo(a)ct.infn.it > Skype : pietrodiprimo > > > > ------------------------------ > > Message: 2 > Date: Wed, 9 Jul 2008 14:08:23 +0200 > From: Micha? Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: Re: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: <6ba9f1b703149916bb1a61fb68a1e377(a)mirt.net> > Content-Type: text/plain; charset="UTF-8" > > > Pietro Di Primo wrote: >> Hi, I have a client server application, and want to tunnel it in this > way: >> a script select a free port in a random way, write the stunnel.conf >> file. >> with "accept=<the_found_port>" and "connect=<my_server>" and run my > client >> application passing to 127.0.0.1:<the_found_port> as server address. >> The problem is that i need to be sure that no other client or user can >> access <the_found_port> while the application is running. >> I guess that it should be possible to do it, but i wasn't able to. > > Simply bind the specific network interface with: > accept=127.0.0.1:<the_found_port> > > Best regards, > Mike > > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 48, Issue 8 > ******************************************** > -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

client-server tunnelling
by Pietro Di Primo 09 Jul '08

09 Jul '08

Hi, I have a client server application, and want to tunnel it in this way: a script select a free port in a random way, write the stunnel.conf file. with "accept=<the_found_port>" and "connect=<my_server>" and run my client application passing to 127.0.0.1:<the_found_port> as server address. The problem is that i need to be sure that no other client or user can access <the_found_port> while the application is running. I guess that it should be possible to do it, but i wasn't able to. Can anybody help me? Thanks -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

FW: how to start ??
by dominique 07 Jul '08

07 Jul '08

Hello, First time I am using stunnel. 1. The issue I had is with Altiris and Exchange. All our Exchange Servers are SSL now and Altiris is not-SSL. Altiris is reading an exchange mailbox and gives back an error : "Error receiving data from socket". So the infrastructure is composed of two servers one Altiris Server not-SSL which is attempting to communicate to an Exchange Server with SSL. The Altiris Server is trying to read the email in one mailbox hosted by an Exchange SSL Server 2. Stunnel 4.25 x86-pc-mingw32-gnu with openssl 0.9.8h 28 May 2008 3. Windows 2003 Server environment 4. stunnel -d -r 5. 2008.07.07 13:34:41 LOG7[4748:1676]: RAND_status claims sufficient entropy for the PRNG 2008.07.07 13:34:41 LOG7[4748:1676]: PRNG seeded successfully 2008.07.07 13:34:41 LOG7[4748:1676]: Certificate: stunnel.pem 2008.07.07 13:34:41 LOG7[4748:1676]: Certificate loaded 2008.07.07 13:34:41 LOG7[4748:1676]: Key file: stunnel.pem 2008.07.07 13:34:41 LOG7[4748:1676]: Private key loaded 2008.07.07 13:34:41 LOG7[4748:1676]: SSL context initialized for service pop3 2008.07.07 13:34:41 LOG5[4748:1676]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.07 13:34:41 LOG5[4748:1676]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.07.07 13:34:41 LOG5[4748:3596]: No limit detected for the number of clients 2008.07.07 13:34:41 LOG7[4748:3596]: FD 284 in non-blocking mode 2008.07.07 13:34:41 LOG7[4748:3596]: SO_REUSEADDR option set on accept socket 2008.07.07 13:34:41 LOG3[4748:3596]: Error binding pop3 to 149.142.194.230:995 2008.07.07 13:34:41 LOG3[4748:3596]: bind: Can't assign requested address (WSAEADDRNOTAVAIL) (10049) 2008.07.07 13:34:41 LOG3[4748:3596]: Server is down 6. no file gcc. Thanks, Dominique Dominique_duchemin(a)hotmail.com

1 0

Using externally signed certificate with stunnel 4
by Tim Skirvin 07 Jul '08

07 Jul '08

I've got a comodo signed SSL certificate that I'm trying to use with stunnel4 to allow secure NNTP connections from a wide variety of clients. The certificate at least partially works; if I leave 'verify' off in the stunnel.conf file, then the service runs and users can connect, albeit while still having to verify the cert. But if I turn 'verify' on, then it doesn't work on *either* side. I've tried playing with CAfile and CApath without much luck. I'll attach my configuration files, the relevant pems, and some debugging information; is there something else I'm missing? I've already contacted comodo, and after several rounds of conversation they suggest I contact the list. Errors from the client side (note that I'm using a debug port here): + openssl s_client -connect news:565 -verify -debug verify depth is 0 CONNECTED(00000003) depth=2 /C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority verify error:num=19:self signed certificate in certificate chain verify return:0 6976:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:951: ...and on the server, I get this: 2008.06.30 14:08:38 LOG7[10039:47679267941088]: nntps accepted FD=7 from 171.64.19.111:56122 2008.06.30 14:08:38 LOG7[10039:1073809760]: nntps started 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 7 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 8 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 9 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:47679267941088]: Cleaning up the signal pipe 2008.06.30 14:08:38 LOG6[10039:47679267941088]: Child process 10247 finished with code 0 2008.06.30 14:08:38 LOG7[10039:1073809760]: Connection from 171.64.19.111:56122 permitted by libwrap 2008.06.30 14:08:38 LOG5[10039:1073809760]: nntps connected from 171.64.19.111:56122 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): before/accept initialization 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 read client hello A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write server hello A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write certificate A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write certificate request A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 flush data 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL alert (read): fatal: unknown CA 2008.06.30 14:08:38 LOG3[10039:1073809760]: SSL_accept: 14094418: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca 2008.06.30 14:08:38 LOG5[10039:1073809760]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.06.30 14:08:38 LOG7[10039:1073809760]: nntps finished (0 left) Basic Requested Information that wasn't supplied above: * stunnel 4.18-2 on Debian etch (2.6.18-6-686 #1 SMP) * Running standalone with '/usr/bin/stunnel4 /etc/news/stunnel.conf' * libc6, no gcc, OpenSSL 0.9.8c-4etch3 * The log on startup: 2008.06.30 14:00:15 LOG7[26276:3083523776]: Snagged 64 random bytes from /root/.rnd 2008.06.30 14:00:15 LOG7[26276:3083523776]: Wrote 1024 new random bytes to /root/.rnd 2008.06.30 14:00:15 LOG7[26276:3083523776]: RAND_status claims sufficient entropy for the PRNG 2008.06.30 14:00:15 LOG7[26276:3083523776]: PRNG seeded successfully 2008.06.30 14:00:15 LOG7[26276:3083523776]: Configuration SSL options: 0x01000000 2008.06.30 14:00:15 LOG7[26276:3083523776]: SSL options set: 0x01000000 2008.06.30 14:00:15 LOG7[26276:3083523776]: Certificate: /etc/ssl/certs/news-stunnel.pem 2008.06.30 14:00:15 LOG7[26276:3083523776]: Certificate loaded 2008.06.30 14:00:15 LOG7[26276:3083523776]: Key file: /etc/ssl/private/news-stunnel.key 2008.06.30 14:00:15 LOG7[26276:3083523776]: Private key loaded 2008.06.30 14:00:15 LOG7[26276:3083523776]: Loaded verify certificates from /etc/ssl/certs/comodo.cert 2008.06.30 14:00:15 LOG7[26276:3083523776]: SSL context initialized for service nntps - Tim Skirvin (tskirvin(a)stanford.edu) -- Information Technology Services http://www.stanford.edu/~tskirvin/ System Software Developer, Unix Team Stanford University

1 1

Windows setup
by Koenraad Lelong 04 Jul '08

04 Jul '08

Hello, I would like to know if it is possible to run a silent setup of the Windows-setup of stunnel. I'm including it in my own setup of my own application so I would like to avoid the interaction of the stunnel-setup. Second question is if it is bad to "install" stunnel more than once on a computer. Until now I had a setup for new installations and an update for updates of my application. This seems not to work because some users use the setup to update an existing installation and with this they run the install of stunnel for the second time. If it is bad, how do I detect the existance of stunnel, and what version it is, so I could update stunnel if it's outdated. Regards, Koenraad Lelong. P.S. If this is the wrong list for such questions I apologize. I would like to know the right list.

1 0

Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization
by Fat Wallet 03 Jul '08

03 Jul '08

Hi, If anyone have a clue on what I should do to fix this issue, I would really appreciated: One of the stunnel process is running at 99% and in R state and the time just keep incrementing. [root@root]# ps auxw|grep stunnel root 781 0.0 0.0 6520 2684 ? T 11:01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 2853 0.0 0.0 3940 604 ttyp2 S+ 11:37 0:00 grep stunnel root 16554 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16555 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16556 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16557 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16558 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16561 0.0 0.0 6520 2684 ? Ts Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16656 0.0 0.0 6520 2684 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 23954 0.0 0.0 6520 2684 ? S 08:00 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 23955 99.0 0.0 6520 2684 ? R 08:00 189:52 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 31521 0.0 0.0 6520 2684 ? S 10:30 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf Thanks, Mike ----- Original Message ---- From: Aron Griffis <agriffis(a)n01se.net> To: Fat Wallet <fat8wallet(a)yahoo.com> Cc: stunnel-users(a)mirt.net Sent: Monday, June 30, 2008 11:04:44 AM Subject: Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization Fat Wallet wrote: [Mon Jun 30 2008, 01:28:11PM EDT] > Can someone please help with this issue? This 100% cpu > utilization issue happens randomly on multiprocess cpu. strace, ltrace, build stunnel with debugging symbols and attach gdb to the spinning process, etc. Is your name really Fat Wallet?

2 1

protect the private key, while running stunnel in server mode as a windows service
by sandeep siroya 03 Jul '08

03 Jul '08

Hi, I have stunnel in server mode running as a windows service on a Win2003 Server system. I need to give this system to a different company for testing their client against our server. How do I protect my private key on stunnel, while letting the 3rd company being able to login as administrator on stunnel's win2003 system and start/stop stunnel service? I know one can protect the private key with a passphrase in stunnel, but that does not serve my purpose as stunnel in this case should be able to start/stop without any user-intervention and I cannot store the passphrase in cleartext. thanks , ss

1 0

Peer suddenly disconnected
by victor.harutyunyan＠arca.am 02 Jul '08

02 Jul '08

Hello there, I have installed stunnel server on FreeBSD. I configure it like this cert=server_cert.pem key=private\server_key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 verify=2 CAfile=test_cert.pem [ssl_host_proxy] accept=172.24.150.15:1234 connect=192.168.1.1:10500 TIMEOUTidle=120 Client side is not a computer it's small device. I generate client certificates in this manor: echo off del test_ck.pem /q # delete previous test.ck.pem file echo Starting New test_ck file Generation C:\OpenSSL\bin\openssl.exe req -new -x509 -newkey rsa:2048 -sha1 -out test_cert.pem -keyout test_key.pem -nodes -config sample_ck.cnf -days 1825 -batch C:\OpenSSL\bin\openssl.exe pkcs8 -in test_key.pem -topk8 -out test_pk8.pem -passout pass:"TestPassword0001" -noiter -v1 PBE-SHA1-3DES del test_key.pem /q copy test_cert.pem+test_pk8.pem test_ck.pem /y del test_pk8.pem /q Echo New test_ck.pem file has the following sections: findstr "BEGIN END" test_ck.pem pause test_cert.pem is on a stunnel server as CAfile and test_ck.pem is on my small device which is capable to connect via stunnel. And I generate other self-signed CA, and generate one certificate request and sign it via this CA, and install that key and certificate on server. cert=server_cert.pem key=private\server_key.pem All is working fine, but after one year my server certificate has expired, when I regenerate new server certificate and try to connect, I see in server log this: Child process 6094 finished with code 0 SSL state (accept): before accept initialization SSL state (accept): SSLv3 read client hello A SSL state (accept): SSLv3 write server hello A SSL state (accept): SSLv3 write certificate A SSL state (accept): SSLv3 write server done A SSL state (accept): SSLv3 flush data SSL_accept: Peer suddenly disconnected And my device can't connect to the server, I haven't any client side logs and error messages, only NOT DELIVERED in my device. :( Can you please help me to solve this problem, I am trying many many times, I was very angry.. Thank you very much. Victor Harutyunyan. P.S. Sorry for my bad english.

1 0

Peer suddenly disconnected
by victor.harutyunyan＠arca.am 02 Jul '08

02 Jul '08

Hello there, I have installed stunnel server on FreeBSD. I configure it like this cert=server_cert.pem key=private\server_key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 verify=2 CAfile=test_cert.pem [ssl_host_proxy] accept=172.24.150.15:1234 connect=192.168.1.1:10500 TIMEOUTidle=120 Client side is not a computer it's small device. I generate client certificates in this manor: echo off del test_ck.pem /q # delete previous test.ck.pem file echo Starting New test_ck file Generation C:\OpenSSL\bin\openssl.exe req -new -x509 -newkey rsa:2048 -sha1 -out test_cert.pem -keyout test_key.pem -nodes -config sample_ck.cnf -days 1825 -batch C:\OpenSSL\bin\openssl.exe pkcs8 -in test_key.pem -topk8 -out test_pk8.pem -passout pass:"TestPassword0001" -noiter -v1 PBE-SHA1-3DES del test_key.pem /q copy test_cert.pem+test_pk8.pem test_ck.pem /y del test_pk8.pem /q Echo New test_ck.pem file has the following sections: findstr "BEGIN END" test_ck.pem pause test_cert.pem is on a stunnel server as CAfile and test_ck.pem is on my small device which is capable to connect via stunnel. And I generate other self-signed CA, and generate one certificate request and sign it via this CA, and install that key and certificate on server. cert=server_cert.pem key=private\server_key.pem All is working fine, but after one year my server certificate has expired, when I regenerate new server certificate and try to connect, I see in server log this: Child process 6094 finished with code 0 SSL state (accept): before accept initialization SSL state (accept): SSLv3 read client hello A SSL state (accept): SSLv3 write server hello A SSL state (accept): SSLv3 write certificate A SSL state (accept): SSLv3 write server done A SSL state (accept): SSLv3 flush data SSL_accept: Peer suddenly disconnected And my device can't connect to the server, I haven't any client side logs and error messages, only NOT DELIVERED in my device. :( Can you please help me to solve this problem, I am trying many many times, I was very angry.. Thank you very much. Victor Harutyunyan. P.S. Sorry for my bad english.

1 0

socket not getting closed
by Manjunath S Karikatti 02 Jul '08

02 Jul '08

Hello, We are using stunnel to wrap the tcp connetion between the our client session used by users and the server process. Due to some reason when client session terminates abruptly (either due to user's PC crash or network outage) the stunnel process does not terminate. We see that the socket on client PC is closed but stunnel process is still alive with socket for that PC in established state. This is on AIX platform. Do not know this is issue with stunnel process or something on AIX needs to be tuned (like the tcp_keepidle value). Thanks for any info and help. Thanks and Regards, Manjunath

1 0