- stunnel-users - stunnel.org

libwrap support
by Happy Manocha 24 May '06

24 May '06

Hello All, Can someone throw some light on libwrap support feature of stunnel? What it is and how it can be used? Thanks in advance. Regds Happy Manocha

1 0

Using a signed *.domain.com with ssl - Getting "unable to get local issuer certificate"
by Pritesh Mehta 24 May '06

24 May '06

Hello all, I have had a good hunt around and am having trouble finding a solution. I am using stunnel to provide encrypted pop3 access to our mail server, and we have recently purchased a signed *.XXX.com certificate from godaddy. This has been great since I can use the same cert on all our servers, and this has worked cleanly with the webservices. However, I am having some issues with the stunnel and pop3 service. I am not entirely certain whether it is caused by the *.XXX.com certificate (although I think it unlikely) but was hoping someone more knowledgeable could enlighten me? I currently have stunnel configured thusly: stunnel -f \ -A /etc/stunnel/certs/sf_issuing.pem \ -p /etc/stunnel/certs/wildcard.XXX.com.stunnel.pem \ -r 127.0.0.1:110 Unfortunately my users are getting warnings, and using the openssl client I get: $ openssl s_client -connect mail.XXX.com:995 CONNECTED(00000003) depth=1 /C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://www.starfieldtech.com/repository/CN=Starfield Secure Certification Authority/emailAddress=practices(a)starfieldtech.com verify error:num=20:unable to get local issuer certificate verify return:0 --- Certificate chain 0 s:/O=*.XXX.com/OU=Domain Control Validated/CN=*.XXX.com i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://www.starfieldtech.com/repository/CN=Starfield Secure Certification Authority/emailAddress=practices(a)starfieldtech.com 1 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://www.starfieldtech.com/repository/CN=Starfield Secure Certification Authority/emailAddress=practices(a)starfieldtech.com i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com --- Server certificate -----BEGIN CERTIFICATE----- [snip] -----END CERTIFICATE----- subject=/O=*.XXX.com/OU=Domain Control Validated/CN=*.XXX.com issuer=/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://www.starfieldtech.com/repository/CN=Starfield Secure Certification Authority/emailAddress=practices(a)starfieldtech.com --- No client certificate CA names sent --- SSL handshake has read 2381 bytes and written 340 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: 4E550C07BDA9661C4B532A28110E5616549CB9FA72D37E5C979E3C6579F8FB99 Session-ID-ctx: Master-Key: 2E588101AA098463FA40C0353009F5842FA19B1C3D48D9A0000EB2E241EFB70BB10D52FE9BC444344D49653B9FEB25F4 Key-Arg : None Start Time: 1148463445 Timeout : 300 (sec) Verify return code: 20 (unable to get local issuer certificate) --- I am positive this must have been covered before somewhere, but I haven't been able to find anything conclusive. Apologies if I'm covering well trodden ground :) TIA, -- Pritesh Mehta <pmehta(a)gnr.com> Global Name Registry _____________________________________________________ Information contained herein is Global Name Registry Proprietary Information and/or Registry Sensitive Information and is made available to you because of your interest in or affiliation with our company. This information is submitted in confidence and its disclosure to you is not intended to constitute public disclosure or authorization for disclosure to other parties. Should you have received this email and are not an intended recipient, please delete this email in its entirety. Global Name Registry is registered with the Office of the UK Information Commissioner.

1 0

<Stunnel> multiple connection
by aliquippa1 23 May '06

23 May '06

Hello I have problem with stunnel. I want to use feature which I'm not sure if is available. I want to accept connection from a host and then connect to a few hosts. I want to have something like this: accept = xxx.xxx.xxx.xxx:xxxx connect = yyy.yyy.yyy.yyy:yyyy connect = zzz.zzz.zzz.zzz:zzzz connect = vvv.vvv.vvv.vvv:vvv Now I want to get such situation: 1.accept connection from xxx. 2.try to connect to yyy. 3 if it doesn't work try to connect to zzz. 4 if it doesn't work try to connect to vvv. I wonder if it's possible, because if I use stunnel and connect from xxx it connects me only to the first host and when I connect from xxx again it connects me to the second host and after the third trial from xxx it connects me to vvv. Thanx Agnes

1 0

SSL23_GET_CLIENT_HELLO:unknown protocol
by Srilalitha Muralidhara(HCL Capital Market Services) 22 May '06

22 May '06

Hi I am getting SSL23_GET_CLIENT_HELLO:unknown protocol error stunnel. Any guesses about the cause of the problem? Here is the complete log 2006.05.22 07:01:55 LOG5[734:1]: stunnel 4.15 on sparc-sun-solaris2.6 with OpenSSL 0.9.8b 04 May 2006 2006.05.22 07:01:55 LOG5[734:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2006.05.22 07:01:55 LOG6[734:1]: file ulimit = 64 (can be changed with 'ulimit -n') 2006.05.22 07:01:55 LOG6[734:1]: poll() used - no FD_SETSIZE limit for file descriptors 2006.05.22 07:01:55 LOG5[734:1]: 29 clients allowed 2006.05.22 07:01:55 LOG7[734:1]: FD 5 in non-blocking mode 2006.05.22 07:01:55 LOG7[734:1]: FD 6 in non-blocking mode 2006.05.22 07:01:55 LOG7[734:1]: FD 7 in non-blocking mode 2006.05.22 07:01:55 LOG7[734:1]: SO_REUSEADDR option set on accept socket 2006.05.22 07:01:55 LOG7[734:1]: rssvr bound to 10.140.42.11:25433 2006.05.22 07:01:55 LOG7[735:1]: Created pid file /home/sri/stunnel/var/lib/stunnel/stunnel.pid 2006.05.22 07:04:09 LOG7[735:1]: rssvr accepted FD=0 from 10.140.42.11:44360 2006.05.22 07:04:09 LOG7[735:4]: rssvr started 2006.05.22 07:04:09 LOG7[735:4]: FD 0 in non-blocking mode 2006.05.22 07:04:09 LOG7[735:4]: TCP_NODELAY option set on local socket 2006.05.22 07:04:09 LOG7[735:4]: FD 1 in non-blocking mode 2006.05.22 07:04:09 LOG7[735:4]: FD 2 in non-blocking mode 2006.05.22 07:04:09 LOG7[735:4]: Connection from 10.140.42.11:44360 permitted by libwrap 2006.05.22 07:04:09 LOG5[735:4]: rssvr connected from 10.140.42.11:44360 2006.05.22 07:04:09 LOG7[735:1]: Cleaning up the signal pipe 2006.05.22 07:04:09 LOG6[735:1]: Child process 938 finished with code 0 2006.05.22 07:04:09 LOG7[735:4]: SSL state (accept): before/accept initialization 2006.05.22 07:04:09 LOG3[735:4]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2006.05.22 07:04:09 LOG5[735:4]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.22 07:04:09 LOG7[735:4]: rssvr finished (0 left) Thanks, Sri Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

1 0

stunnel-4.15 segfaulting and looping under FreeBSD-CURRENT
by Michael Weiser 17 May '06

17 May '06

Hi, I've run into the problem mentioned in: > Scott Tuc Ellentuch at T-B-O-H ml at t-b-o-h.net > Fri Apr 21 23:45:11 CEST 2006 > Hi, > I just did a portupgrade in FreeBSD from 4.14 to 4.15, and now it > seems to be looping the command that I asked it, instead of just doing > it once. Has there been an option added I need to tell it to just do > once? > Thanks, Tuc I'm running stunnel in client mode. It execs uucico which receives and sends uucp jobs via stdin/stdout. The first call to uucico actually succeeds. It seems like stunnel is segfaulting and then re-exec-ing when it would normally quit. A core file is created in the current directory. But stunnel never quits and indefinitely continues to re-exec itself. Has there been any progress in solving this problem? -- Thanks, Michael

2 3

FW: [stunnel-users] Re: Re:Need a help in installation (Craig)
by Craig 17 May '06

17 May '06

Oops, mailed it directly to Peng :-0, Sorry for that ;-) Re:Need a help in installation (Craig) >Thanks a lot! Craig. I use your method: > ./configure --prefix=/stunnel2 No Problem ;-) >It seems that installation is successful. It successfully generate a >directory ./stunnel2, in which there are six subdirectories: etc lib man >sbin share var That looks right >But when I run stunnel command in the teminal window. It does not take it as >a command. Is it supposed to run stunnel command after the installation or >not? Is there anything missing in the Mac machine before it can run stunnel? If you go to the directory " /stunnel2/sbin " without quotes, do you see 2 files named stunnel and stunnel3? If you see these files, you can execute the stunnel file with something like ./stunnel --help To display the options available to you for the daemon to run. Let me know if there is something else you require ;) Regards, Craig >Thanks >Peng > From: <stunnel-users-request(a)mirt.net> > Reply-To: <stunnel-users(a)mirt.net> > Date: Mon, 15 May 2006 12:00:06 +0200 (CEST) > To: <stunnel-users(a)mirt.net> > Subject: stunnel-users Digest, Vol 22, Issue 12 > > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. RE: Need a help in installation (Craig) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 15 May 2006 08:15:36 +0200 > From: "Craig" <stunnel(a)rsw.co.za> > Subject: RE: [stunnel-users] Need a help in installation > To: <stunnel-users(a)mirt.net> > Message-ID: > <!&!AAAAAAAAAAAYAAAAAAAAADayToAwUd9AsHeKl2eRVAnCgAAAEAAAALWLI73av7VKpv9V31ec nQ > wBAAAAAA==(a)rsw.co.za> > > Content-Type: text/plain; charset="us-ascii" > > Don't know Mac, but can't u pass a prefix like in Linux to specify another > directory, for example your home directory? > > > > ./configure --prefix=/your/destination/directory > > > > Hope this helps > > > > Craig > > > > _____ > > From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users-bounces@mirt.net] > On Behalf Of Peng He > Sent: 12 May 2006 11:45 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Need a help in installation > > > > Hi, > > I want to install Stunnel 4.15 into MAC OS X machine. Somehow I do not have > the right to make any directory in /usr so I can not install Stunnel in > /usr/local. How do I install Stunnel into different directory? > > Thanks > Peng > >

1 0

Re: Re:Need a help in installation (Craig)
by Peng He 16 May '06

16 May '06

Thanks a lot! Craig. I use your method: ./configure --prefix=/stunnel2 It seems that installation is successful. It successfully generate a directory ./stunnel2, in which there are six subdirectories: etc lib man sbin share var But when I run stunnel command in the teminal window. It does not take it as a command. Is it supposed to run stunnel command after the installation or not? Is there anything missing in the Mac machine before it can run stunnel? Thanks Peng > From: <stunnel-users-request(a)mirt.net> > Reply-To: <stunnel-users(a)mirt.net> > Date: Mon, 15 May 2006 12:00:06 +0200 (CEST) > To: <stunnel-users(a)mirt.net> > Subject: stunnel-users Digest, Vol 22, Issue 12 > > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. RE: Need a help in installation (Craig) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 15 May 2006 08:15:36 +0200 > From: "Craig" <stunnel(a)rsw.co.za> > Subject: RE: [stunnel-users] Need a help in installation > To: <stunnel-users(a)mirt.net> > Message-ID: > <!&!AAAAAAAAAAAYAAAAAAAAADayToAwUd9AsHeKl2eRVAnCgAAAEAAAALWLI73av7VKpv9V31ecnQ > wBAAAAAA==(a)rsw.co.za> > > Content-Type: text/plain; charset="us-ascii" > > Don't know Mac, but can't u pass a prefix like in Linux to specify another > directory, for example your home directory? > > > > ./configure --prefix=/your/destination/directory > > > > Hope this helps > > > > Craig > > > > _____ > > From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users-bounces@mirt.net] > On Behalf Of Peng He > Sent: 12 May 2006 11:45 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Need a help in installation > > > > Hi, > > I want to install Stunnel 4.15 into MAC OS X machine. Somehow I do not have > the right to make any directory in /usr so I can not install Stunnel in > /usr/local. How do I install Stunnel into different directory? > > Thanks > Peng > >

1 0

Need a help in installation
by Peng He 15 May '06

15 May '06

Hi, I want to install Stunnel 4.15 into MAC OS X machine. Somehow I do not have the right to make any directory in /usr so I can not install Stunnel in /usr/local. How do I install Stunnel into different directory? Thanks Peng

2 1

SSL2Proxy
by Steve Cohen 12 May '06

12 May '06

Hello all, I'm tyring to get around content based(notHostBased) int*rn*t cen$0ring. (don't want this page to be indexed with that keyword, so please don't wite it in your response). This is what I need to do: Set Browser on client machine to use <proxyX:port>, but I want content to be encrypted. The proxy is trusted(ownedByMe), everything else in between is not, after the proxy everything is trusted. So this would be the setup: SetupA: ClientBroswer <> STunnelOnRemoteServer <> LocalProxyServerOnSameServer(Squid) <> RestOfTheInternet And NOT this: SetupB: Browser<>LocalSTunnel<>RemoteSTunnel<>Proxy<>RestOfTheInternet Because I don't want any special kind of configuration on the client's local machine except for setting the proxy.(I am currently doing this via ssh tunneling) -I have squid running on remote server listening on 3128 and it works -I have stunnel running on remote server listening on 8686 and forwarding to localhost:3128, -I have Firefox set to use <myServer:8686> as proxy But when trying to use it, Firefox says connection reset.... Please tell me why this is happening and what I need to do. Feel free to make any suggestions you want, I won't be annoyed if you tell me something I already know. Thanks.

2 1

certificate unknown - error:14094416
by Ludovic DUFLOT 12 May '06

12 May '06

Hi, I tried to use stunnel to connect in SSL to a LDAP server. But I can't and I've got this error message: certificate unknown The certificate is self-signed. If I use stunnel for establishing connexion with IMAPS server with a self-signed certificate too, all is right but not for LDAP connexion. I searched on the list's archives and with google but I can't find any solution... Help !!! Ludo ps: these are the stunnel.conf and the log: *************************** cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ldaps] accept = 389 connect = 10.0.0.1:636 verify = 0 [imaps] accept = 143 connect = 10.0.0.2:993 *************************** 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps connecting 10.0.0.1:636 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: waiting 10 seconds 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: connected 2006.05.03 07:52:50 LOG7[4436:5780]: Remote FD=244 initialized 2006.05.03 07:52:50 LOG7[4436:5780]: TCP_NODELAY option set on remote socket 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): before/connect initialization 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client hello A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server hello A 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=0, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=ldap-bourget.univ-savoie.fr 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate request A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server done A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client key exchange A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write certificate verify A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write change cipher spec A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write finished A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 flush data 2006.05.03 07:52:50 LOG7[4436:5780]: SSL alert (read): fatal: certificate unknown 2006.05.03 07:52:50 LOG3[4436:5780]: SSL_connect: 14094416: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown 2006.05.03 07:52:50 LOG5[4436:5780]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps finished (0 left)

1 0