- stunnel-users - stunnel.org

Preferred way to start stunnel @boot time
by Van 26 Jun '07

26 Jun '07

So I've got stunnel running perfectly on my linux server to forward ssl requests to my pop and imap ports. I need to make sure this happens automatically if the machine is rebooted. On the stunnel site it talks about running stunnel either as a daemon or running stunnel out of xinetd. I was just wondering, which way do people using it out there think is preferable? And why? Neither seems as direct or simple as putting @reboot root /sbin/start_stunnel into my crontab, which is what I did (start_stunnel being a shell script with the proper command and some comments). Just another uneventful way to do the same thing? -Van

2 1

Java Applet Client for STUNNEL-fronted server
by Richard's Hotmail 21 Jun '07

21 Jun '07

Hi, I'm new to the list and apologize if this question is inappropriate, or quite basic, but I really hope someone can help. I currently have an intranet-resident JAVA Applet that connects back to the Application Server via standard TCP/IP sockets using the java.net.Socket class, and everything is peachy. What I'm looking at doing now is making it Internet friendly by providing host authentication (don't care about client authentication at the mo) and strong cryptography between client and server. OpenSSL and Stunnel (I don't want to have to make the Application Server SSL compatible if I don't have to) are available on the server box therefore I would dearly love an example of a JAVA client that can talk javax.net.SSL (or something else) to a Stunnel-fronted server. (Less is definitely more here - The least number of client keys and or certificate-generations the better!) Can anyone please help me with this? Obviously example-code would be ideal, as would first-hand accounts of the trials and tribulations, but I'll certainly settle for web-references to the appropriate docs or other relevant material! Are all the JSSE libraries/code reqd bundled with the JDK and runtime JVM ready? Is there a better way? (Sadly IPsec is not an option here) Maybe there's an alternate solution that can preserve the client's true IP address and present it to the Application Server's "Listen"? Cheers Richard Maher

1 0

Re: [stunnel-users] Trying to get stunnel to work for forwarding pop3sto ipop3 port
by Van 21 Jun '07

21 Jun '07

Getting closer. I now get- [van@mailserver ]$ sudo stunnel /usr/local/etc/stunnel/stunnel.conf localhost:ipop3 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem But that doesn't make sense to me. mail.pem permissions are the same as my cert's and it works fine. [van@mailserver change_passwd]$ ls -al /usr/local/etc/stunnel/mail.pem -rw-r--r-- 1 root root 2942 Jun 20 18:21 /usr/local/etc/stunnel/ mail.pem [van@mailserver change_passwd]$ ls -al /etc/httpd/certs/www.crt -rw-r--r-- 1 root root 1074 Jun 1 12:30 /etc/httpd/certs/www.crt Is the error misleading? Or what should the mail.pem perms be? Van On Jun 20, 2007, at 9:33 PM, Kevin Cook wrote: > > If you are using a stunnel.conf file, I would replace the '-d pop3s > -r' > with the absolute path to the .conf file: > > sudo /usr/local/sbin/stunnel /usr/local/etc/stunnel/stunnel.conf > > I believe command line options were typically used more in older > versions, but now all configuration is done in the configuration file. > > > Kevin > > -----Original Message----- > From: Van [mailto:vanyel@medusa.bioc.aecom.yu.edu] > Sent: Wednesday, June 20, 2007 6:03 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Trying to get stunnel to work for forwarding > pop3sto ipop3 port > > Hello, > > This is my introduction to stunnel. I've inherited control of a > pop3 and > imap server running Red Hat Linux 4 that I want to access via pop3s > and > imaps. I'm starting out with securing the pop3 since most users are > using it. > > I downloaded stunnel 4.20 and compiled it according to the > instructions > on stunnel.org. > > I read the certificates section of the site and made a new .pem file > that I named mail.pem and have in the /usr/local/etc/stunnel/ > directory > that /usr/local/etc/stunnel/stunnel.conf asks for. But when I try to > run stunnel like in the Examples section I get : > > [van@mailserver ~]$ sudo /usr/local/sbin/stunnel -d pop3s -r > localhost:ipop3 > 2007.06.20 17:59:54 LOG3[25516:3086419648]: -d: No such file or > directory (2) > Syntax: > stunnel [<filename>] ] -fd <n> | -help | -version | -sockets > <filename> - use specified config file instead of /usr/local/ > etc/stunnel/stunnel.conf > -fd <n> - read the config file from a file descriptor > -help - get config file help > -version - display version and defaults > -sockets - display default socket options > > I'm a little lost here. Never dealt with a .pem file before stunnel. > I have a self-signed cert I'm successfully using for https webmail on > the server and guessing stunnel couldn't see that, I appended my file > 'mailserver.crt' into my mail.pem file and edited stunnel.conf so it > has > > ;CAfile = /usr/local/etc/stunnel/certs.pem CAfile = > /usr/local/etc/stunnel/mail.pem > > but no dice. Same result. > > Trying to debug, I find 'stunnel -V' also gives the same result. > > Can someone point out what's going wrong? > > > -Van > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

2 2

Trying to get stunnel to work for forwarding pop3s to ipop3 port
by Van 20 Jun '07

20 Jun '07

Hello, This is my introduction to stunnel. I've inherited control of a pop3 and imap server running Red Hat Linux 4 that I want to access via pop3s and imaps. I'm starting out with securing the pop3 since most users are using it. I downloaded stunnel 4.20 and compiled it according to the instructions on stunnel.org. I read the certificates section of the site and made a new .pem file that I named mail.pem and have in the /usr/local/etc/stunnel/ directory that /usr/local/etc/stunnel/stunnel.conf asks for. But when I try to run stunnel like in the Examples section I get : [van@mailserver ~]$ sudo /usr/local/sbin/stunnel -d pop3s -r localhost:ipop3 2007.06.20 17:59:54 LOG3[25516:3086419648]: -d: No such file or directory (2) Syntax: stunnel [<filename>] ] -fd <n> | -help | -version | -sockets <filename> - use specified config file instead of /usr/local/ etc/stunnel/stunnel.conf -fd <n> - read the config file from a file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options I'm a little lost here. Never dealt with a .pem file before stunnel. I have a self-signed cert I'm successfully using for https webmail on the server and guessing stunnel couldn't see that, I appended my file 'mailserver.crt' into my mail.pem file and edited stunnel.conf so it has ;CAfile = /usr/local/etc/stunnel/certs.pem CAfile = /usr/local/etc/stunnel/mail.pem but no dice. Same result. Trying to debug, I find 'stunnel -V' also gives the same result. Can someone point out what's going wrong? -Van

1 0

stunnel client mode and CA chains
by Domenico Andreoli 13 Jun '07

13 Jun '07

Hi, I have always successfully used openssl/stunnel but now I am facing a new problem, a variation of the usual client-side authentication documentented everywhere. I have a root CA and child CA which is signed by the root one. I have also a client certificate that is signed only by the child CA. In order to verify the certificate signature using openssl I need to specify both the CA certificates, this works as expected. What I would like to achieve is to authenticate the clients using a stunnel server having only the root CA certificate. Is there some stunnel client configuration switch that allows to push the child CA certificate? One looking interesting is (from the manpage): cert = pemfile certificate chain PEM file name A PEM is always needed in server mode. Specifying this flag in client mode will use this certificate chain as a client side certificate chain. Using client side certs is optional. The certificates must be in PEM format and must be sorted starting with the certificate to the highest level (root CA). in particular "The certificates must be in PEM format and must be sorted starting with the certificate to the highest level (root CA)" lets me hope but I am not able to understand how it works. I made many tries but on server side I always get a "VERIFY ERROR: depth=1, error=invalid CA certificate:" referring to the child CA certificate and then a "SSL3_GET_CLIENT_CERTIFICATE:no certificate returned" followed by connection shutdown. Supposing the client private key is in a separate file, if I put the certificates in the order specified by the manpage I get a key mismatching error upon stunnel startup. If instead I put the client certificate as first, then server do not authenticate it. Where am I wrong? I cannot change the server configuration, it must work as it is. I have hundreds of them and I can update them only using the SSL connection. Thanks for any help. Regards, Domenico -----[ Domenico Andreoli, aka cavok --[ http://www.dandreoli.com/gpgkey.asc ---[ 3A0F 2F80 F79C 678A 8936 4FEE 0677 9033 A20E BC50

1 0

Issue with Stunnel / TCP Wrappers
by Kevin Cook 11 Jun '07

11 Jun '07

I have been a user of Stunnel for several years, but as of recent need to be able to deny TCP/IP requests dynamically on an IP address basis. I am attempting to use TCP wrappers, but not getting it to work with Stunnel. The Solaris 9 implementation I am using currently runs in a chroot'ed environment, so I am placing the hosts.deny file in this path (/chrootpath/etc/hosts.deny), as well as /usr/etc per everything I have read. This is not working. I am using a non-standard port not defined in /etc/services (29444). Any ideas?

1 0

stunnel autostart at boot
by Grant Kohler 11 Jun '07

11 Jun '07

Has anybody created a startup script to load stunnel when a machine boots? Thanks, -Grant

1 0

Re: [stunnel-users] [PATCH?] Senting a list of accepted CAs to the client
by Kevin Martin 07 Jun '07

07 Jun '07

Has anyone any information on this? It affects the ability of Thunderbird users (in this case) to use secure communications with IMAP mail servers using TLS/SSL. Please see the bugzillas below. Thanks. Kevin Martin https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237962 and list posting from 4/2007: Hello, stunnel currently does not send a list of accepted CAs, see e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=327001 Sending the list was #if 0-ed out sometime between stunnel 3.22 and 4.00, with no change log entry AFAICS. Does anyone remember know why was it disabled, and whether it is safe to reenable (e. g. using the attached patch)? Thanks, Mirek <patch snipped>...see the list posting from 4/2007 above for the attached patch.

1 0

regarding CRLpath
by piyush tewari 07 Jun '07

07 Jun '07

Hi, I m using crl but it is woking only in the case of using CRLfile. That is when I use the CRLfile , the client having the revoked certificate is now not able to connect to the server. But when I m providing the CRLpath in the stunnel config file , the client is still able to connect. That is CRL is working in the case of CRLfile entry and not working in the case of CRLpath. The entry that i have specified is CRLpath = C:\Stunnel\debug\revoked So where is the flaw. I know that in case of the CRLfile , it is necessary to restart the stunnel , whenever the CRL changes. But in case of CRLpath , whether it is necessary to restart the stunnel or not. regards piyush --------------------------------- You snooze, you lose. Get messages ASAP with AutoCheck in the all-new Yahoo! Mail Beta.

1 0

Problem with 'verify=3'
by Koenraad Lelong 05 Jun '07

05 Jun '07

Hi, I would like to have a secure access to a Firebird database server. When I configure verify = 2 on the server I can connect, but I would like to have verify = 3 and this does not work. This is my stunnel.conf : client = no foreground = yes setuid = stunnel setgid = nogroup pid = /var/run/stunnel.pid debug = 7 output = /var/log/stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = /etc/stunnel/certs/ CAfile = /etc/stunnel/cacert.pem cert = /etc/stunnel/server.pem [firebird] accept = 3052 connect = localhost:gds_db output of stunnel -version : stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds I'm running OpenSuse 10.1 on the server. This is the log when I can't connect (verify = 3) : 2007.06.05 13:18:55 LOG5[15150:3083052720]: stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2007.06.05 13:18:55 LOG7[15150:3083052720]: Snagged 64 random bytes from /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: Wrote 1024 new random bytes to /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: RAND_status claims sufficient entropy for the PRNG 2007.06.05 13:18:55 LOG6[15150:3083052720]: PRNG seeded successfully 2007.06.05 13:18:55 LOG7[15150:3083052720]: Certificate: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Key file: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Loaded verify certificates from /etc/stunnel/cacert.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Verify directory set to /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG5[15150:3083052720]: Peer certificate location /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG6[15150:3083052720]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.06.05 13:18:55 LOG6[15150:3083052720]: poll() used - no FD_SETSIZE limit for file descriptors 2007.06.05 13:18:55 LOG5[15150:3083052720]: 500 clients allowed 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 5 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 6 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 7 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: SO_REUSEADDR option set on accept socket 2007.06.05 13:18:55 LOG7[15150:3083052720]: firebird bound to 0.0.0.0:3052 2007.06.05 13:18:55 LOG7[15150:3083052720]: Created pid file /var/run/stunnel.pid 2007.06.05 13:19:02 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:02 LOG6[15150:3083052720]: Child process 15152 finished with code 0 2007.06.05 13:19:02 LOG7[15150:3083049888]: Connection from 192.168.0.13:25651 permitted by libwrap 2007.06.05 13:19:02 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:02 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:02 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:04 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:04 LOG6[15150:3083052720]: Child process 15154 finished with code 0 2007.06.05 13:19:04 LOG7[15150:3083049888]: Connection from 192.168.0.13:25653 permitted by libwrap 2007.06.05 13:19:04 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:04 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:04 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:09 LOG3[15150:3083052720]: Received signal 2; terminating 2007.06.05 13:19:09 LOG7[15150:3083052720]: removing pid file /var/run/stunnel.pid I put the client cert in /etc/stunnel/certs and I ran 'c_rehash /etc/stunnel/certs'. What am I missing ? Thanks for any input. Regards, Koenraad Lelong.

1 0