- stunnel-users - stunnel.org

Re: [stunnel-users] Wrapping a mail client - multiple servers
by Ludolf Holzheid 21 May '08

21 May '08

On Wed, 2008-05-21 14:39:42 +0100, Daniel James wrote: > [..] > > Can I, for example, put multiple [SSMTP] sections and multiple [POP3S] > sections in one stunnel.conf? I don't know. But if you can, you don't want to. The section headers don't specify a protocol. They simply give the section a name (for log output, e.g.). There is no problem in naming sections [first-POP3S] and [second-POP3S]. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Wrapping a mail client - multiple servers
by Daniel James 21 May '08

21 May '08

I use a mail client that does not directly support SSL. I can use stunnel to provide the security layer when I connect to a SSMTP and/or POP3S server (under windows). This works fine, whether I run stunnel as a background application or as a Windows service. I'd like, however, to be able to connect to multiple mail servers over SSL. I'm not sure how I might achieve this? What would be nice would be get stunnel to forward POP3/SMTP communication on different local ports to POP3S/SSMTP on different remote servers. Can I do this? It appears to be possible to run multiple copies of stunnel as applications, and to get each copy to take its configuration from a different stunnel.conf file, so that different copies of stunnel could listen on different local ports and each could proxy the traffic it receives to a different remote server (I haven't tried this -- and it's not an ideal solution -- but it looks as though it should work). It does not appear to be possible, however, to create two instances of the stunnel service running with different configuration files. Is it possible to set up multiple listening ports proxying to different remote servers in a single configuration file? If so, what's the syntax for that? Cheers, Daniel.

1 0

Stunnel 4 Multiple Processes on Ubuntu 8.04
by Armen Ayvazian 19 May '08

19 May '08

Greetings. I'm running the stock stunnel 4.21 on Ubuntu 8.04 (version and configs listed below) as a stand-alone daemon to pass connections between ssl-enabled SMTP, POP3, and IMAP clients and their respective servers, which run on the same machine as stunnel. In previous instances of Stunnel (v4.15) I've managed to successfully get the daemon to switch to a non-root user and use only a single process. I now find, however, that I get 6 processes and 5 continue to run as root with only one (albeit the one listening on the specified sockets) switching down to the specified user. Does anyone have any idea why I both can't set uid/gid and why I've now got so many processes? # ps aux | grep stunnel root 22702 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf root 22703 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf root 22704 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf root 22705 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf root 22706 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf stunnel4 22707 0.0 0.2 3720 932 ? Ss 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf # lsof -i | grep stunnel stunnel4 22707 stunnel4 11u IPv4 55934 TCP emily:pop3s (LISTEN) stunnel4 22707 stunnel4 12u IPv4 55935 TCP emily:imaps (LISTEN) stunnel4 22707 stunnel4 13u IPv4 55936 TCP emily:ssmtp (LISTEN) I'm invoking stunnel simply as /usr/sbin/stunnel4 /etc/stunnel4/stunnel.conf: cert = /etc/stunnel/stunnel.pem sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [pop3s] accept = 64.5.53.172:995 connect = 64.5.53.172:110 [imaps] accept = 64.5.53.172:993 connect = 64.5.53.172:143 [ssmtp] accept = 64.5.53.172:465 connect = 64.5.53.172:25 Version Info: stunnel 4.21 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

stunnel and OCSP verification: strange behaviour
by Andreas Ntaflos 19 May '08

19 May '08

Hi list, [My apologies, I accidentally tried to send this message to stunnel-announce earlier.] I have a quick question regarding the use of stunnel with verification against an OCSP responder. I am using stunnel 4.20 and (for testing) 4.23 but I don't see any difference in the behaviour of both. The main problem is that stunnel accepts and establishes connections from clients even if those clients had their certificates revoked and the OCSP responder correctly informs stunnel about it. Consider the following configuration: foreground = yes CAfile = /path/to/cacert.pem cert = /path/to/stunnel_cert.pem key = /path/to/stunnel_key.pem debug = 7 [clientauth] accept = localhost:43434 connect = localhost:43433 verify = 2 OCSP = http://localhost:43435 The OCSP responder runs on localhost:43435 as you can see. Client verification is enabled. Using openssl to manually check against the responder works fine: openssl ocsp -issuer cacert.pem -CAfile cacert.pem -url \ http://localhost:43435 -cert revoked_cert.pem Response verify OK /path/to/revoked_cert.pem: revoked This Update: May 15 15:38:46 2008 GMT Next Update: May 15 17:04:32 2008 GMT Revocation Time: May 15 15:38:26 2008 GMT The relevant portion of stunnel's debug output looks like this: [...] Starting OCSP verification FD 8 in non-blocking mode connect_wait: waiting 10 seconds connect_wait: connected OCSP server connected FD 8 in blocking mode FD 8 in non-blocking mode OCSP response received OCSP verification passed: status=0, reason=-1208427072 VERIFY OK: depth=1, /CN=The CA/C=AT/ST=SomeState/L=SomeCity/O=The \ Organisation/emailAddress=camaster(a)the-organisation.invalid Starting OCSP verification FD 8 in non-blocking mode connect_wait: waiting 10 seconds connect_wait: connected OCSP server connected FD 8 in blocking mode FD 8 in non-blocking mode OCSP response received OCSP verification passed: status=1, reason=-1 VERIFY OK: depth=0, /C=AT/ST=SomeState/O=The Organisation/CN=this is a \ revoked cert SSL state (accept): SSLv3 read client certificate A [...] As far as I can see the OCSP verification works fine here, too, and at depth 0 stunnel finds the certificate to have been revoked (status=1 indicates that, I believe). The connection, however, is not rejected. Is there any way to have stunnel reject the connection when the client certificate has been revoked? Where would I configure this? The only way I have found yet was to patch src/verify.c but surely there must be a more convenient approach to this? On a related matter: if stunnel cannot and will not reject the connection upon a negative response from the OCSP, what would be the best way to script stunnel so that it rejects such a connection? I am asking because I am in the process of writing a few Python scripts that incorporate stunnel to aid in testing of some SSL-speaking components. Such a client component without a valid, non-revoked certificate must not be able to connect. I mean what good is OCSP verification if the result of the process, i.e. the responders answer "the certificate is valid" or "the certificate is no longer valid" doesn't matter to stunnel? Am I missing the point somewhere? I'd appreciate any insights on this. Kind regards, Andreas -- Andreas "daff" Ntaflos Vienna, Austria GPG Fingerprint: 6234 2E8E 5C81 C6CB E5EC 7E65 397C E2A8 090C A9B4

2 2

Reg:IPV6 support on stunnel
by Sandhya 15 May '08

15 May '08

> Stunnel version: > stunnel 4.09 on armv5tejl-unknown-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with > OpenSSL 0.9.7e 25 Oct 2004 > > My conf file Information: > cert = /usr/local/www/certs/server.pem > key = /usr/local/www/certs/privkey-server.pem > pid = /var/run/stunnel_kvm.pid > client = no > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > socket = a:TCP_NODELAY=1 > [ms] > accept = 1234 > connect = 1236 > > Please find the Config.log file attached. > > Please let me know if any other information is needed or you want me try > some commands on stunnel. > > Thanks for the help > > Sandhya R > > ----- Original Message ----- > From: "Michal Trojnara" <Michal.Trojnara(a)mobi-com.net> > To: <stunnel-users(a)mirt.net> > Sent: Wednesday, May 14, 2008 7:06 PM > Subject: Re: [stunnel-users] Reg:IPV6 support on stunnel > > >> >> Sandhya wrote: >> >>> I have enabled IPV6 ip When my client tries to connect to my ipv6 ip and >>> the port(stunnel listens) where my it is listening...Its failed to >>> connect. >> >> Please send us: >> - the output of "stunnel -version", >> - your stunnel.conf file, >> - your debug level logs. >> >> Best regards, >> Mike >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)mirt.net >> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >> >

1 1

Fw: Reg:IPV6 support on stunnel
by Sandhya 14 May '08

14 May '08

----- Original Message ----- From: Sandhya To: stunnel-users(a)mirt.net Sent: Wednesday, May 14, 2008 6:43 PM Subject: [stunnel-users] Reg:IPV6 support on stunnel Hi, I am newbie to stunnel.As mentioned in some of your posts i just gone through ..how to enable ipv6 support. While configuring i did the same by giving the following command. ./configure --enable-ipv6 make make install and i ran stunnel which listens at some port and i have my own server which listens for stunnel. I have enabled IPV6 ip When my client tries to connect to my ipv6 ip and the port(stunnel listens) where my it is listening...Its failed to connect. Could you please throw some light on how to enable IPV6 support for stunnel apart from what i tried. Thanks in advance Sandhya -------------------------------------------------------------------------------- _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Reg:IPV6 support on stunnel
by Sandhya 14 May '08

14 May '08

Hi, I am newbie to stunnel.As mentioned in some of your posts i just gone through ..how to enable ipv6 support. While configuring i did the same by giving the following command. ./configure --enable-ipv6 make make install and i ran stunnel which listens at some port and i have my own server which listens for stunnel. I have enabled IPV6 ip When my client tries to connect to my ipv6 ip and the port(stunnel listens) where my it is listening...Its failed to connect. Could you please throw some light on how to enable IPV6 support for stunnel apart from what i tried. Thanks in advance Sandhya

1 0

Reg:IPV6 support on stunnel
by Sandhya 13 May '08

13 May '08

Hi, I am newbie to stunnel.As mentioned in some of your posts i just gone through ..how to enable ipv6 support. While configuring i did the same by giving the following command. ./configure --enable-ipv6 make make install and i ran stunnel which listens at some port and i have my own server which listens for stunnel. I have enabled IPV6 ip When my client tries to connect to my ipv6 ip and the port(stunnel listens) where my it is listening...Its failed to connect. Could you please throw some light on how to enable IPV6 support for stunnel apart from what i tried. Thanks in advance Sandhya

1 0

Re: [stunnel-users] HTTPS connections aborted
by Matthias Kellermann 09 May '08

09 May '08

Hi Aleksandar, Aleksandar Lazic wrote: > The timing events at 6st position. > > http://haproxy.1wt.eu/download/1.3/doc/haproxy-en.txt > > > --- > 4.2.3) Timing events > -------------------- > . > . > . > > Other cases ('xx' means any value to be ignored) : > -1/xx/xx/xx/Tt: the client was not able to send its complete request > in time, > or that it aborted it too early. > Tq/-1/xx/xx/Tt: it was not possible to process the request, maybe because > servers were out of order. > Tq/Tw/-1/xx/Tt: the connection could not establish on the server. > Either it > refused it or it timed out after Tt-(Tq+Tw) ms. > Tq/Tw/Tc/-1/Tt: the server has accepted the connection but did not > return a > complete response in time, or it closed its connexion > unexpectedly, after Tt-(Tq+Tw+Tc) ms. thanks, I'll have a look at it. -Matthias

1 0

Feature request - verify fall-back
by Sudhaker Raj 09 May '08

09 May '08

Hi Team, I wish to use stunnel for following use-case (to create a highly-protected website which can be accessed only using a valid client-cert). gateway.example.com:443 -> public.example.com:80 (when client-cert verification fails) gateway.example.com:443 -> intranet.example.com:80 (when client-cert verification ok - normally hidden from public) As of now stunnel simply drops the connection when service is configured to verify the client certificate and verification fails. Is it possible to add a fall-back connect when verification fails. [protected-web] verify=3 accept=443 connect=intranet.example.com:80 noverify=public.example.com:80 I guess it will be a nice addition to stunnel's feature list. Thanks, Sudhaker

3 3