- stunnel-users - stunnel.org

limit connections per certificate
by Eric H. Jung 14 Aug '06

14 Aug '06

Hi, I'd like to limit the number of connections to stunnel (in server mode) by client certificate. In other words, I want all clients to only have 1 open socket connection to the server at a time. Is this possible with stunnel out-of-the-box, or must I write a patch to handle it? Thank you, grimholtz

1 0

stunnel through xinetd: process not terminating after use
by Alex Forrow 07 Aug '06

07 Aug '06

Hi, Im using stunnel through xinetd to forward some local unencrypted ldap connections to our ssl ldap server. Seems to work ok but after each use the stunnel process does not terminate, so I end up with losts of processes not doing anything. After a few days, these processes reach a limit and connections fail. As you can see, the connection has finished, but the process still exists: [root@lynx stunnel]# ps -e | grep stunnel 2396 ? 00:00:00 stunnel 2517 ? 00:00:00 stunnel 2575 ? 00:00:00 stunnel 2576 ? 00:00:00 stunnel [root@lynx stunnel]# netstat -p | grep stunnel tcp 0 0 lynx.seekit.co.uk:ldaplo lynx.seekit.co.uk:60390 CLOSE_WAIT 2396/stunnel unix 2 [ ] DGRAM 3204569 2576/stunnel unix 2 [ ] DGRAM 3204562 2575/stunnel unix 2 [ ] DGRAM 3203127 2517/stunnel unix 2 [ ] DGRAM 3202108 2396/stunnel Heres the xinetd configuration for stunnel (/etc/xinetd.d/ldaplo): # default: on # description: Stunnel to connect to LDAP for an insecure local session service ldaplo { disable = no #flags = REUSE port = 390 socket_type = stream wait = no user = nobody server = /usr/sbin/stunnel server_args = /etc/stunnel/ldap.conf # log_on_failure += USERID } Heres the stunnel configuration file (/etc/stunnel/ldap.conf): client = yes connect = 636 Cheers, Alex Forrow

1 0

Stunnel without certificates
by Shane 04 Aug '06

04 Aug '06

Hi, I am new to this group and also to Stunnel utility. I would like to use Stunnel to secure my http connections. Here is a twist. I just want to encrypt the link and don't bother much about the authentication. 1. Can I use Stunnel without certificates? 2. If certificate is mandatory, can I use only the file which contains "keys" but not use other authentication credentials? 3. Can I use anonymous DH Ciphers so that authentication phase is assumed done and both client and servers generate the keys? Any help and guidance will useful. Thanks, -Ravi Joshi __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

TIMEOUTbusy
by Martin Beauchamp 02 Aug '06

02 Aug '06

Hi List, I'm running Stunnel 4.15 under win32 in client mode. Can someone give me a better idea about what TIMEOUTbusy does? The docs state that it is "time to wait for expected data." But what does Stunnel do after this period? Does it disconnect from the remote server? Does it attempt another SSL session after some interval? Thanks for any addition information! Martin -- Martín Beauchamp Systems Engineer Park Slope Food Coop, Inc. (718) 783-2187 (718) 622-5685 Fax

1 0

stunnel crashing on connect
by Kevin King 24 Jul '06

24 Jul '06

Hi, I am attempting to run stunnel on Windows XP Pro but it is crashing as soon as anything connects to it. I am using it to create a secure TLS tunnel in front of an SMTP mail server and from what I read I should be able to do this and stunnel will handle the STARTLS commands. I downloaded the following windows binary: 562589 Mar 11 13:02:35 2006 stunnel-4.15-installer.exe I made minimal changes to stunnel.conf: 1) added the line "protocol = smtp" 2) uncommented the debug lines (still crashes if I leave these lines alone) I then start stunnel, either as a service or from cmd line - same thing happens >From a command prompt I then "telnet localhost 465" and send "EHLO mydomain.com hi" Stunnel responds with "250-EHLO mydomain.com hi Welcome". I am also running hMailServer on the same machine listening on port 25. It looks like stunnel is forwarded the initial EHLO to hMailServer, then hMailServer responds correctly and stunnel forwards that response back to me. Then stunnel crashes immediatly. Following is the log: 2006.07.20 10:28:41 LOG7[112:1656]: RAND_status claims sufficient entropy for the PRNG 2006.07.20 10:28:41 LOG6[112:1656]: PRNG seeded successfully 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service pop3s 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service imaps 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service ssmtp 2006.07.20 10:28:41 LOG5[112:1656]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.07.20 10:28:41 LOG5[112:1656]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.07.20 10:28:41 LOG5[112:2564]: No limit detected for the number of clients 2006.07.20 10:28:41 LOG7[112:2564]: FD 1884 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: pop3s bound to 0.0.0.0:995 2006.07.20 10:28:41 LOG7[112:2564]: FD 1872 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: imaps bound to 0.0.0.0:993 2006.07.20 10:28:41 LOG7[112:2564]: FD 1864 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: ssmtp bound to 0.0.0.0:465 2006.07.20 10:28:59 LOG7[112:2564]: ssmtp accepted FD=1840 from 127.0.0.1:1543 2006.07.20 10:28:59 LOG7[112:2564]: Creating a new thread 2006.07.20 10:28:59 LOG7[112:2564]: New thread created 2006.07.20 10:28:59 LOG7[112:2936]: ssmtp started 2006.07.20 10:28:59 LOG7[112:2936]: FD 1840 in non-blocking mode 2006.07.20 10:28:59 LOG7[112:2936]: TCP_NODELAY option set on local socket 2006.07.20 10:28:59 LOG5[112:2936]: ssmtp connected from 127.0.0.1:1543 2006.07.20 10:28:59 LOG7[112:2936]: FD 1812 in non-blocking mode 2006.07.20 10:28:59 LOG7[112:2936]: ssmtp connecting 127.0.0.1:25 2006.07.20 10:28:59 LOG7[112:2936]: connect_wait: waiting 10 seconds 2006.07.20 10:28:59 LOG7[112:2936]: connect_wait: connected 2006.07.20 10:28:59 LOG7[112:2936]: Remote FD=1812 initialized 2006.07.20 10:28:59 LOG7[112:2936]: TCP_NODELAY option set on remote socket 2006.07.20 10:28:59 LOG5[112:2936]: Negotiations for smtp (server side) started 2006.07.20 10:28:59 LOG7[112:2936]: RFC 2487 detected 2006.07.20 10:28:59 LOG7[112:2936]: <- 220 hmailserver ESMTP 2006.07.20 10:28:59 LOG7[112:2936]: -> 220220 hmailserver ESMTP + stunnel 2006.07.20 10:29:09 LOG7[112:2936]: <- EHLO mydomain.com hi 2006.07.20 10:29:09 LOG7[112:2936]: -> 250-EHLO mydomain.com hi Welcome Here is the output of stunnel -version: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Global options debug = 5 RNDbytes = 64 RNDoverwrite = yes service = stunnel taskbar = yes Service-level options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none 2006.07.20 10:25:04 LOG3[3256:3456]: Server is down I tried building the source and debugging it but I only found some batch files refering to the MS embedded compiler. Why would I want to compile this for an embedded or mobile device? That is what that compiler is for. What makefile or compiler should I be using on windows if I wish to build stunnel on windows? Which I would rather not have to do, I would like to just use the binary but it is crashing before I ever get a chance to test it. Any help would greatly be appreciated. thanks, -Kevin

1 0

stunnel version issue?
by NobbyNoMates 22 Jul '06

22 Jul '06

Dear all - I am trying to set up an stunnel connection on an Ubuntu Dapper box. This system seems to give me (stunnel -V) : stunnel 3.26 on i486-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 and no matter where I look. I cannot seem to find an option to specify a config file when starting stunnel. Unfortunately, the instructions which I have received for setting up my (Direct Connect) client, contain such a config file which is supposed to be needed. It contains the following: client = yes delay = yes output = stunnel.log debug = notice pid = stunnel.pid [DC Server] connect = server.address.org:AAAAA accept = 127.0.0.1:BBBBB where of course the AAAA and BBBB are port numbers. Now I wonder if there is any way to make my stunnel version function in the specified way without the config file? Or is there some alternative way to specify this kind of config? Any suggestion would be much appreciated! Best regards, Erik

2 2

Clearer and Detailed version of the mail Stunnel for HTTP encription
by LoopBack Inc 20 Jul '06

20 Jul '06

Hello. I rewrote some parts of the question, and illustrated it by a small ASCII picture to clearifiy the whole situation. I don't know why I haven't got a single answer, because over 350 people are subscribed to the list, so I hope that I'll get some help now. It would be grateful. I use SocksCap to forward the iexplore cnnections to another port, a port on which stunnel listens. On PC1, the client, stunnel is listening on port 500. So when I start iexplore.exe with SocksCap every connection goes to 127.0.0.1:500. PC1 connects to PC2, with connect = 192.168.0.2:123 On PC2, the server, stunnel listens on port 500. then is connects to the internet with connect = 127.0.0.1:80. Here is the problem, stunnel doesn't connect to the internet over 127.0.0.1:80. I don't know why, but it doesnt. ---Stunnel.conf SERVER--- .. [inet] accept = 127.0.0.1:123 connect = 127.0.0.1:80 ---Stunnel.conf CLIENT--- .. [inet] accept = 127.0.0.1:500 connect = 192.168.0.2:123 LOGs from the SERVER: 2006.07.18 16:56:07 LOG7[2332:2720]: inet accepted FD=208 from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:2720]: Creating a new thread 2006.07.18 16:56:07 LOG7[2332:2720]: New thread created 2006.07.18 16:56:07 LOG7[2332:1880]: inet started 2006.07.18 16:56:07 LOG7[2332:1880]: FD 208 in non-blocking mode 2006.07.18 16:56:07 LOG5[2332:1880]: inet connected from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): before/accept initialization 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read client hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write server hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write change cipher spec A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write finished A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 flush data 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read finished A 2006.07.18 16:56:07 LOG7[2332:1880]: 1 items in the session cache 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects (SSL_connect()) 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects (SSL_accept()) 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 server renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 5 session cache hits 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache misses 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache timeouts 2006.07.18 16:56:07 LOG6[2332:1880]: SSL accepted: previous session reused 2006.07.18 16:56:07 LOG7[2332:1880]: FD 244 in non-blocking mode 2006.07.18 16:56:07 LOG7[2332:1880]: inet connecting 127.0.0.1:80 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: waiting 10 seconds 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: connected 2006.07.18 16:56:07 LOG7[2332:1880]: Remote FD=244 initialized After nothing happend for 52 seconds I aborted in the iexplore.exe to open the page. 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (read): warning: close notify 2006.07.18 16:56:59 LOG7[2332:1880]: SSL closed on SSL_read 2006.07.18 16:56:59 LOG7[2332:1880]: Socket write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (write): warning: close notify 2006.07.18 16:56:59 LOG6[2332:1880]: SSL_shutdown successfully sent close_notify 2006.07.18 16:56:59 LOG5[2332:1880]: Connection closed: 0 bytes sent to SSL, 3 bytes sent to socket 2006.07.18 16:56:59 LOG7[2332:1880]: inet finished (0 left) LOGs from the CLIENT: 2006.07.18 17:10:11 LOG7[1756:4756]: inet accepted FD=444 from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:4756]: Creating a new thread 2006.07.18 17:10:11 LOG7[1756:4756]: New thread created 2006.07.18 17:10:11 LOG7[1756:2840]: inet started 2006.07.18 17:10:11 LOG7[1756:2840]: FD 444 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on local socket 2006.07.18 17:10:11 LOG5[1756:2840]: inet connected from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:2840]: FD 348 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: inet connecting 192.168.0.2:123 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: waiting 10 seconds 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: connected 2006.07.18 17:10:11 LOG7[1756:2840]: Remote FD=348 initialized 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on remote socket 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): before/connect initialization 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write client hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read server hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write change cipher spec A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 flush data 2006.07.18 17:10:11 LOG7[1756:2840]: 17 items in the session cache 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects (SSL_connect()) 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 client renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects (SSL_accept()) 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 48 session cache hits 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache misses 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache timeouts 2006.07.18 17:10:11 LOG6[1756:2840]: SSL connected: previous session reused Nothing happendend, I aborted iexplore.exe 2006.07.18 17:10:25 LOG7[1756:2840]: Socket closed on read 2006.07.18 17:10:25 LOG7[1756:2840]: SSL write shutdown 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (write): warning: close notify 2006.07.18 17:10:25 LOG7[1756:2840]: SSL_shutdown retrying 2006.07.18 17:10:25 LOG7[1756:2840]: SSL doesn't need to read or write 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (read): warning: close notify 2006.07.18 17:10:26 LOG7[1756:2840]: SSL closed on SSL_read 2006.07.18 17:10:26 LOG7[1756:2840]: Socket write shutdown 2006.07.18 17:10:26 LOG5[1756:2840]: Connection closed: 3 bytes sent to SSL, 0 bytes sent to socket 2006.07.18 17:10:26 LOG7[1756:2840]: inet finished (0 left) So the problem is that stunnel doesn't connect to the internet on PC2. I think i have to use something different than connect = 127.0.0.1:80 on PC2, but not sure. The version of stunnel is 4.15 I'm using Windows. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

4 3

Re: [stunnel-users] Clearer and Detailed version of the mail Stunnelfor HTTP enc
by Ian 20 Jul '06

20 Jul '06

On 20 Jul 2006 at 14:50, LoopBack Inc wrote: > Hello Ian, > > > Yes thats excatly what I want to do. > > In fact, if possible, this I haven't described yes, I would like to encript > every program I want through PC2, used as a proxy, like you said. > But if it would work with the http it wouldn't be bad. > > Thank you for your reply. Hi, Ok, this has clarified things for me. Another question, do you have a copy of the proxy program (SocksCap ?) running on PC2? If not then this is the problem. I believe that stunnel does not itself act as a proxy. It simply acts as a tunnel. >From your description of your config I suspect that you should have a second copy of SocksCap listenening on PC2 which will forward data onto the internet. A quick example: PC1: SocksCap listening on port 8080 ( for example) forwards to 127.0.0.1:500 stunnel listening on port 500, forwarded any data to PC2 port 500 PC2: stunnel listening on port 500 forwards data to 127.0.0.1:8080 SocksCap listening on port 8080 forwards data out to the internet. This will encrypt data between PC1 & PC2 but after that it will be back in plain. In order to test this I would break it down into its individual components and test each stage. I recommend downloading netcat (http://netcat.sourceforge.net/ or google for it) and learn how to use it. Sorry I can't help you with this bit, its better if you learn it yourself - and once you have you will wonder how you ever managed without it ;) Regards Ian --

1 0

Stunnel for HTTP encription
by LoopBack Inc 18 Jul '06

18 Jul '06

Hello! I'm tring to encript HTTP. I use two PCs, PC1 and PC2. PC1 is a client PC2 is a server. IP of PC1:192.168.0.1 IP of PC2:192.168.0.2 I use SocksCap to forward the iexplore cnnections to another port, a port on which stunnel listens. On PC1, the client, stunnel is listening on port 500. So when I start iexplore.exe with SocksCap every connection goes to 127.0.0.1:500. PC1 connects to PC2, with connect = 192.168.0.2:123 On PC2, the server, stunnel listens on port 500. then is connects to the internet with connect = 127.0.0.1:80. Here is the problem, stunnel doesn't connect to the internet over 127.0.0.1:80. I don't know why, but it doesnt. LOGs from the SERVER: 2006.07.18 16:56:07 LOG7[2332:2720]: inet accepted FD=208 from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:2720]: Creating a new thread 2006.07.18 16:56:07 LOG7[2332:2720]: New thread created 2006.07.18 16:56:07 LOG7[2332:1880]: inet started 2006.07.18 16:56:07 LOG7[2332:1880]: FD 208 in non-blocking mode 2006.07.18 16:56:07 LOG5[2332:1880]: inet connected from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): before/accept initialization 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read client hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write server hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write change cipher spec A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write finished A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 flush data 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read finished A 2006.07.18 16:56:07 LOG7[2332:1880]: 1 items in the session cache 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects (SSL_connect()) 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects (SSL_accept()) 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 server renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 5 session cache hits 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache misses 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache timeouts 2006.07.18 16:56:07 LOG6[2332:1880]: SSL accepted: previous session reused 2006.07.18 16:56:07 LOG7[2332:1880]: FD 244 in non-blocking mode 2006.07.18 16:56:07 LOG7[2332:1880]: inet connecting 127.0.0.1:80 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: waiting 10 seconds 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: connected 2006.07.18 16:56:07 LOG7[2332:1880]: Remote FD=244 initialized After nothing happend for 52 seconds I aborted in the iexplore.exe to open the page. 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (read): warning: close notify 2006.07.18 16:56:59 LOG7[2332:1880]: SSL closed on SSL_read 2006.07.18 16:56:59 LOG7[2332:1880]: Socket write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (write): warning: close notify 2006.07.18 16:56:59 LOG6[2332:1880]: SSL_shutdown successfully sent close_notify 2006.07.18 16:56:59 LOG5[2332:1880]: Connection closed: 0 bytes sent to SSL, 3 bytes sent to socket 2006.07.18 16:56:59 LOG7[2332:1880]: inet finished (0 left) LOGs from the CLIENT: 2006.07.18 17:10:11 LOG7[1756:4756]: inet accepted FD=444 from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:4756]: Creating a new thread 2006.07.18 17:10:11 LOG7[1756:4756]: New thread created 2006.07.18 17:10:11 LOG7[1756:2840]: inet started 2006.07.18 17:10:11 LOG7[1756:2840]: FD 444 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on local socket 2006.07.18 17:10:11 LOG5[1756:2840]: inet connected from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:2840]: FD 348 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: inet connecting 192.168.0.2:123 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: waiting 10 seconds 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: connected 2006.07.18 17:10:11 LOG7[1756:2840]: Remote FD=348 initialized 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on remote socket 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): before/connect initialization 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write client hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read server hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write change cipher spec A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 flush data 2006.07.18 17:10:11 LOG7[1756:2840]: 17 items in the session cache 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects (SSL_connect()) 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 client renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects (SSL_accept()) 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 48 session cache hits 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache misses 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache timeouts 2006.07.18 17:10:11 LOG6[1756:2840]: SSL connected: previous session reused Nothing happendend, I aborted iexplore.exe 2006.07.18 17:10:25 LOG7[1756:2840]: Socket closed on read 2006.07.18 17:10:25 LOG7[1756:2840]: SSL write shutdown 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (write): warning: close notify 2006.07.18 17:10:25 LOG7[1756:2840]: SSL_shutdown retrying 2006.07.18 17:10:25 LOG7[1756:2840]: SSL doesn't need to read or write 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (read): warning: close notify 2006.07.18 17:10:26 LOG7[1756:2840]: SSL closed on SSL_read 2006.07.18 17:10:26 LOG7[1756:2840]: Socket write shutdown 2006.07.18 17:10:26 LOG5[1756:2840]: Connection closed: 3 bytes sent to SSL, 0 bytes sent to socket 2006.07.18 17:10:26 LOG7[1756:2840]: inet finished (0 left) So the problem is that stunnel doesn't connect to the internet on PC2. I think i have to use something different than connect = 127.0.0.1:80 on PC2, but not sure. I'm using Windwos. Thanks for helping. _________________________________________________________________ On the road to retirement? Check out MSN Life Events for advice on how to get there! http://lifeevents.msn.com/category.aspx?cid=Retirement

1 0

exclusively TLS
by Richard Kotal 17 Jul '06

17 Jul '06

Hey, I had the same problem. I solved this problem. You must download my patch: http://www.aolserver.cz/, or http://www.aolserver.cz/download/stunnel-4.15_patch.tgz Richard Kotal info(a)waplikace.cz www.aolserver.cz prepis.waplikace.cz www.nvp.cz /> I need to talk to a server that is requiring pure TLS. It seems that > STUNNEL always starts with SSL. How do I get STUNNEL to start the client //> //side conversation with TLS? //> / /> // //> //John Moehrke //> //Enterprise Security Architect //> //GE Healthcare //> //T 262 293 1667 //> //W126 N7449 Flint Road, Suite 200, Menomonee Falls, WI 53051 //> / <http://stunnel.mirt.net/mailman/listinfo/stunnel-users>/John.Moehrke at med.ge.com <http://stunnel.mirt.net/mailman/listinfo/stunnel-users> <mailto:John.Moehrke at med.ge.com <http://stunnel.mirt.net/mailman/listinfo/stunnel-users>> //> //www.gehealthcare.com <http://www.gehealthcare.com/> //> //What I may see or hear in the course of the treatment or even outside of //> //the treatment in regard to the life of men, which on no account one must //> //spread abroad, I will keep to myself, holding such things shameful to be //> //spoken about. (One Portion of the Hippocratic Oath - Hippocrates, circa //> //400 B.C.) /

1 0