- stunnel-users - stunnel.org

certificate authentications
by John A. Wallace 21 Jan '12

21 Jan '12

I have two questions, which I think may be related, regarding how to use the information from stunnel log. I use stunnel to connect to an SMTP server on the internet from my home network, and in particular from my Windows laptop. My stunnel version is this: stunnel 4.50 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8r-fips 8 Feb 2011 It works well for my purposes, and I can see, by using a program for monitoring process and network connections, that the connections are now secured as expected. However, I believe it can be made more secure if I can utilize the certificate that is offered by the server, but I am not sure how to make that happen. In my stunnel log for the connection, I get this message: Client-mode smtp protocol negotiations started Client-mode smtp protocol negotiations succeeded No peer certificate received SSL connected: new session negotiated Negotiated ciphers: ADH-AES256-SHA SSLv3 Kx=DH Au=None Enc=AES(256) Mac=SHA1 My first question is, how should I go about getting that "No peer certificate received" issue corrected and how do I install it? Secondly, when I issue this command at the cmd shell prompt: openssl s_client -starttls smtp -connect host.server:port The output is lengthy and it includes, among other things, clearly what is identified as a certificate. I have been told that this is a good certificate, and one that I should utilize for an authenticated connection. So, my question is, is this the same certificate that I saw referenced in the log as the "peer certificate", and how do I go about putting this certificate where it belongs in my directory? I know how to copy it and save it as a file, but where do I put it and should it have a special name? If someone wants to direct me to the correct instruction for doing this, that would be fine too. I am just looking for some pointers for assistance. Thanks.

3 5

Re: [stunnel-users] ver 4.5 VS 4.2: running single process now, how to close when all client apps closed?
by Jose Alf. 21 Jan '12

21 Jan '12

All right. I just recompiled against the latest OpenSSL 0.9.8t. Still not enought to tempt you? :) Regards, Jose ________________________________ From: Larisa <larisaka(a)yahoo.com> To: Jose Alf. <josealf(a)rocketmail.com> Sent: Friday, January 20, 2012 5:20 PM Subject: Re: [stunnel-users] ver 4.5 VS 4.2: running single process now, how to close when all client apps closed? Jose, I am thinking to stay with the old version for a little bit longer, though hoping to get newer one 4.5_ soon. Thank you for the offer. Larisa --- On Thu, 1/19/12, Jose Alf. <josealf(a)rocketmail.com> wrote: >From: Jose Alf. <josealf(a)rocketmail.com> >Subject: Re: [stunnel-users] ver 4.5 VS 4.2: running single process now, how to close when all client apps closed? >To: "Stunnel Users Mailing List" <stunnel-users(a)mirt.net>, "larisa_y" <larisaka(a)yahoo.com> >Date: Thursday, January 19, 2012, 8:01 AM > > >Larisa, >I compiled stunnel-4.39 against OpenSSL 0.9.8s. Let me know if you are interested in the binaries. > >Regards >Jose > >________________________________ >From: Michal Trojnara <Michal.Trojnara(a)mirt.net> >To: Stunnel Users Mailing List <stunnel-users(a)mirt.net> >Sent: Tuesday, January 17, 2012 5:08 PM >Subject: Re: [stunnel-users] ver 4.5 VS 4.2: running single process now, how to close when all client apps closed? >larisa_y wrote:> Could you tell me starting which version the new behaviour was implemented?> (single process architecture) I tried the changelog but could not really> identify the item.The implementation of this change started with stunnel 4.40 with new "stunnel -exit" option. The last version fully supporting multiple processes is 4.39.Please be aware of security risks related to using obsolete versions of OpenSSL. Some Win32 GUI features are also unstable until version 4.50.Mike_______________________________________________stunnel-users mailing liststunnel-users@stunnel.orghttp://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] STARTTLS
by James Devine 20 Jan '12

20 Jan '12

http and smtp are two different birds, https runs on a different port, whereas an smtp connection running on port 25 can be upgraded to secure with starttls On Fri, Jan 20, 2012 at 12:29 AM, Michal Trojnara <Michal.Trojnara(a)mirt.net>wrote: > James Devine <fxmulder(a)gmail.com> wrote: > > >I've setup stunnel to tunnel port 25 to a few backend smtp servers, it > >appears that it only works with starttls, is there a way to make it > >work if > >no starttls is issued also? > >_______________________________________________ > >stunnel-users mailing list > >stunnel-users(a)stunnel.org > >http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > Do you also have problems with https on port 80? > > Mike >

1 0

STARTTLS
by James Devine 19 Jan '12

19 Jan '12

I've setup stunnel to tunnel port 25 to a few backend smtp servers, it appears that it only works with starttls, is there a way to make it work if no starttls is issued also?

1 0

ver 4.5 VS 4.2: running single process now, how to close when all client apps closed?
by larisa_y 19 Jan '12

19 Jan '12

I have several client applications running on win machine, connecting to the same server, or sometimes to different servers. ver. 4.2 allowed me to do the following: modify .conf file to [my_section] accept=5566 connect 123.22.33.44:5005; then run stunnel.exe; modify .conf file to [my_section] accept=5567 connect 456.22.33.44:5006; then run stunnel.exe. That would start 2 stunnel.exe processes, each one handling its own connection; which were easy to close when each respective client app closed - each one would close the one it started. Now with 4.5 version: the single stunnel.exe process runs and is able to handle all communications perfectly, provided I prepare .conf file for all possible connections in advance, before starting stunnel. The problem I cannot solve easily is how not to leave stunnel running after client logged out of all the applications. Without building something to keep track of "stunnels users" count, how could I do it? Is there some way to switch to multiple instances mode? Please advise. Larisa -- View this message in context: http://old.nabble.com/ver-4.5-VS-4.2%3A-running-single-process-now%2C-how-t… Sent from the Stunnel - Users mailing list archive at Nabble.com.

3 7

Windows Live Mail issue ?
by Victor 19 Jan '12

19 Jan '12

I'm new with stunnel and I'm experiencing a issue. Windows Live Mail is closing the connection with the SSL tunnel without send the close down packet, resulting in connection reset by peer. Follow the output debug of stunnel: 2012.01.18 17:13:25 LOG7[16954:34377572800]: Socket closed on read 2012.01.18 17:13:25 LOG7[16954:34377572800]: Sending SSL write shutdown 2012.01.18 17:13:25 LOG7[16954:34377572800]: SSL alert (write): warning: close notify 2012.01.18 17:13:25 LOG6[16954:34377572800]: SSL_shutdown successfully sent close_notify 2012.01.18 17:13:25 LOG3[16954:34377572800]: SSL_read: Connection reset by peer (54) 2012.01.18 17:13:25 LOG5[16954:34377572800]: Connection reset: 293 bytes sent to SSL, 1293 bytes sent to socket 2012.01.18 17:13:25 LOG7[16954:34377572800]: Service stunnel finished (0 left) 2012.01.18 17:13:25 LOG7[16954:34377572800]: str_stats: 28 block(s), 988 byte(s) The e-mail message is sent successfully but Im very intrigued with the line "Connection reset: 293 bytes sent to SSL, 1293 bytes sent to socket", that make me think that some data was lost in the middle of the connection. I need to fix something or this is a normal behavior ? qmail 1.03 with SPAMCONTROL stunnel 4.43 running on FreeBSD 8.0-RELEASE Config file: ; SMTP SSL (SMTP-AUTH) debug = 7 foreground = yes syslog = no cert = /usr/local/etc/stunnel/stunnel.pem exec = /var/qmail/bin/qmail-smtpd execargs = qmail-smtpd /mailhome/bin/vchkpw /bin/true Thanks in advance !

2 1

client side SNI
by yyy 14 Jan '12

14 Jan '12

It looks like server name for client side SNI is defined as name to connect to in connect option. According to RFC, this name must be FQDN. It is the only place where it is defined and server name for SNI cannot be defined outside connect option. Is that right? Server side SNI has some good examples. Searching for "client side SNI" did not yield anything useful. I am trying to run multiple independent services over the same port there is no DNS infrastructure in place, so those server names would be random strings not refering to anything. Both ends would be stunnel. If it is as it seems, it will not work, because defined server name (at client) must be working DNS name (FQDN).

2 7

Verify = 3 and Giganews
by Thomas Eifert 13 Jan '12

13 Jan '12

Hello, I've tried to use verify = 3 with Giganews on several occasions now, but it always fails. It works fine with other servers, however. Here is the debug output for the Giganews scenario: 2012.01.12 14:05:01 LOG4[292:3840]: CERT: Verification error: unable to get local issuer certificate 2012.01.12 14:05:01 LOG4[292:3840]: Certificate check failed: depth=1, /C=US/O=GeoTrust Inc./OU=Domain Validated SSL/CN=GeoTrust DV SSL CA 2012.01.12 14:05:01 LOG3[292:3840]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed And the following is from my stunnel.conf: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ debug = 6 delay = yes [nntps.3] client = yes sslVersion = TLSv1 ciphers = AES256-SHA cafile = peer-nntps.3.pem verify = 3 accept = 127.0.0.1:119 connect = news.giganews.com:443 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ As I have with other connections, I am saving peer-nntps3.pem from the log window menu. Can anyone tell me why this is failing on this server only? Regards; Thomas

2 2

stunnel 4.52 released
by Michal Trojnara 12 Jan '12

12 Jan '12

Dear Users, I have released version 4.52 of stunnel. This is a bugfix release. Upgrade is highly recommended. The ChangeLog entry: Version 4.52, 2012.01.12, urgency: MEDIUM: * Bugfixes - Fixed write closure notification for non-socket file descriptors. - Removed a line logged to stderr in inetd mode. - Fixed "Socket operation on non-socket" error in inetd mode on Mac OS X platform. - Removed direct access to the fields of the X509_STORE_CTX data structure. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.52.tar.gz: 7c78c178074e9b96331518a9c309d2e95ca9ad6e0338a96d5ab8ad47fde4347c Best regards, Mike

1 0

fips=no and slow performance problem
by Owen Ching 12 Jan '12

12 Jan '12

I have a production system that uses stunnel and it's been working pretty well. Mike, thanks for all your hard work. But there has been a weird issue that I ran into a while ago and now it's happening again. we're using a rackspace cloud machine to run stunnel and haproxy. we're using the x-forwarded-for stunnel patch for now with plans to upgrade to send-proxy method once haproxy 1.5 is considered the stable branch. So I built one machine and ran into the "FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match" error message. So I changed the config to fips=no and stunnel started up but the https seems really slow (multiple browsers). We run with significant https volume. So the fips=no option didn't work for us. I kept trying different things but nothing worked. I decided to start clean and built a new machine. This time stunnel didn't throw the FIPS error and everything performed great. So used the new machine instead. Now after some time (over a year), we had some performance problems. we rebooted the machine and now we have the FIPS error again. I've tried multiple versions of stunnel (whatever I could find working patches for) and also tried a clean 4.51 with no patches. all of them throw the FIPS error now on this machine. I'm in the process of building a new machine to see if it magically works again. Any help or insight would be greatly appreciated. Thanks, Owen

2 2

I am having problems with the 4.5x-series also: Pan connects, nothing else happens.
by SciFi 12 Jan '12

12 Jan '12

Hi, I am also having no luck using the stunnel-4.5* series. The last/latest working for me is 4.49. $ uname -a Darwin SciFi.homeip.net 10.8.0 Darwin Kernel Version 10.8.0: Tue Jun 7 16:33:36 PDT 2011; root:xnu-1504.15.3~1/RELEASE_I386 i386 i386 iMac6,1 Darwin (altho this is a C2D machine, running most tasks in 64-bit mode, Apple has left the EFI/BIOS/kernels at 32-bit… yes I can boot+run 10.7/Lion, but that is a total separate topic altogether [don't get me started]…) I mainly use stunnel with Pan, to connect to Giganews, Astraweb, and Gmane (which is what I'm using now to post this message). I use the simple 127.0.0.1:port mechanism. (I've been working with one of Pan's new developers, to try their new GnuTLS support; but until that works, stunnel is my known supposedly-functioning fallback.) I've tested every 4.5x release, including today's 4.52b1 & b2 -- all act the same, in that Pan tries to connect to stunnel, and that's all I see, nothing further happens. Also, the 4.5-series produces much-less log-listing, as you'll see in my attachments below. I am fine while relegated to using stunnel-4.49, but we have a further issue, in that the "verify=<number>" option seems to reject the certs & what-not coming from these servers, for any <number> higher than 0 (yes I saw the maillist discussion about what 4 means there, and tried it also). I've been mildly joking with the Pan developer on how to be sure we are /really/ in secure mode. ;) Now, the details. I manually start stunnel on a login-root terminal window, this way: # stunnel /usr/local/etc/stunnel/stunnel.conf -sockets With these sample log-lists (below), I'm trying to get one single short post in a newsgroup. I made sure Pan did not save this post in its cache, such that it does try to fetch the post from the NNTP server. (Currently, Pan is set to use Astraweb as my primary feed.) Here's what 4.49 will show on the terminal (this works: I can see the modem blinking, and can see/read the post): ---start--- 2012.01.11 10:24:51 LOG7[3782:2697274688]: Clients allowed=500 2012.01.11 10:24:51 LOG7[3782:2697274688]: signal_pipe: FD=3 allocated (non-blocking mode) 2012.01.11 10:24:51 LOG7[3782:2697274688]: signal_pipe: FD=4 allocated (non-blocking mode) 2012.01.11 10:24:51 LOG5[3782:2697274688]: stunnel 4.49 on i386-apple-darwin10.8.0 platform 2012.01.11 10:24:51 LOG5[3782:2697274688]: Compiled/running with OpenSSL 1.1.0-dev xx XXX xxxx 2012.01.11 10:24:51 LOG5[3782:2697274688]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:SELECT,IPv6 2012.01.11 10:24:51 LOG5[3782:2697274688]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2012.01.11 10:24:51 LOG6[3782:2697274688]: Compression enabled using zlib method 2012.01.11 10:24:51 LOG7[3782:2697274688]: PRNG seeded successfully 2012.01.11 10:24:52 LOG6[3782:2697274688]: Initializing SSL context for service nntp_gn 2012.01.11 10:24:52 LOG7[3782:2697274688]: Verify directory set to /certs 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /certs revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /crls revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: SSL options set: 0x00000004 2012.01.11 10:24:52 LOG6[3782:2697274688]: SSL context initialized 2012.01.11 10:24:52 LOG6[3782:2697274688]: Initializing SSL context for service nntp_aw 2012.01.11 10:24:52 LOG7[3782:2697274688]: Verify directory set to /certs 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /certs revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /crls revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: SSL options set: 0x00000004 2012.01.11 10:24:52 LOG6[3782:2697274688]: SSL context initialized 2012.01.11 10:24:52 LOG6[3782:2697274688]: Initializing SSL context for service nntp_gm 2012.01.11 10:24:52 LOG7[3782:2697274688]: Verify directory set to /certs 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /certs revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /crls revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: SSL options set: 0x00000004 2012.01.11 10:24:52 LOG6[3782:2697274688]: SSL context initialized 2012.01.11 10:24:52 LOG5[3782:2697274688]: Configuration successful 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=5 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=6 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=6 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=8 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=8 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=9 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=9 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=10 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=10 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=11 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: accept socket: FD=11 allocated (non-blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: Option SO_REUSEADDR set on accept socket 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_gn bound to 0.0.0.0:12000 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_gn opened FD=11 2012.01.11 10:24:52 LOG7[3782:2697274688]: accept socket: FD=12 allocated (non-blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: Option SO_REUSEADDR set on accept socket 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_aw bound to 0.0.0.0:12001 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_aw opened FD=12 2012.01.11 10:24:52 LOG7[3782:2697274688]: accept socket: FD=13 allocated (non-blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: Option SO_REUSEADDR set on accept socket 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_gm bound to 0.0.0.0:12002 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_gm opened FD=13 2012.01.11 10:24:52 LOG7[3782:2697274688]: Created pid file /stunnel.pid 2012.01.11 10:25:53 LOG7[3782:2697274688]: local socket: FD=14 allocated (non-blocking mode) 2012.01.11 10:25:53 LOG7[3782:2697274688]: Service nntp_aw accepted FD=14 from 127.0.0.1:52241 2012.01.11 10:25:53 LOG7[3782:2952859648]: Service nntp_aw started 2012.01.11 10:25:53 LOG7[3782:2952859648]: Option TCP_NODELAY set on local socket 2012.01.11 10:25:53 LOG7[3782:2952859648]: Waiting for a libwrap process 2012.01.11 10:25:53 LOG7[3782:2952859648]: Acquired libwrap process #0 2012.01.11 10:25:53 LOG7[3782:2952859648]: Releasing libwrap process #0 2012.01.11 10:25:53 LOG7[3782:2952859648]: Released libwrap process #0 2012.01.11 10:25:53 LOG7[3782:2952859648]: Service nntp_aw permitted by libwrap from 127.0.0.1:52241 2012.01.11 10:25:53 LOG5[3782:2952859648]: Service nntp_aw accepted connection from 127.0.0.1:52241 2012.01.11 10:25:53 LOG7[3782:2952859648]: remote socket: FD=15 allocated (non-blocking mode) 2012.01.11 10:25:53 LOG6[3782:2952859648]: connect_blocking: connecting 216.151.153.83:563 2012.01.11 10:25:53 LOG7[3782:2952859648]: connect_blocking: s_poll_wait 216.151.153.83:563: waiting 10 seconds 2012.01.11 10:25:54 LOG5[3782:2952859648]: connect_blocking: connected 216.151.153.83:563 2012.01.11 10:25:54 LOG5[3782:2952859648]: Service nntp_aw connected remote server from 192.168.1.65:52242 2012.01.11 10:25:54 LOG7[3782:2952859648]: Remote FD=15 initialized 2012.01.11 10:25:54 LOG7[3782:2952859648]: Option TCP_NODELAY set on remote socket 2012.01.11 10:25:54 LOG7[3782:2952859648]: SNI: host name: ssl.astraweb.com 2012.01.11 10:25:54 LOG7[3782:2952859648]: Starting certificate verification: depth=3, /L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com 2012.01.11 10:25:54 LOG6[3782:2952859648]: CERT: Verification not enabled 2012.01.11 10:25:54 LOG5[3782:2952859648]: Certificate accepted: depth=3, /L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com 2012.01.11 10:25:54 LOG7[3782:2952859648]: Starting certificate verification: depth=2, /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2012.01.11 10:25:54 LOG6[3782:2952859648]: CERT: Verification not enabled 2012.01.11 10:25:54 LOG5[3782:2952859648]: Certificate accepted: depth=2, /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2012.01.11 10:25:54 LOG7[3782:2952859648]: Starting certificate verification: depth=1, /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 2012.01.11 10:25:54 LOG6[3782:2952859648]: CERT: Verification not enabled 2012.01.11 10:25:54 LOG5[3782:2952859648]: Certificate accepted: depth=1, /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 2012.01.11 10:25:54 LOG7[3782:2952859648]: Starting certificate verification: depth=0, /O=*.astraweb.com/OU=Domain Control Validated/CN=*.astraweb.com 2012.01.11 10:25:54 LOG6[3782:2952859648]: CERT: Verification not enabled 2012.01.11 10:25:54 LOG5[3782:2952859648]: Certificate accepted: depth=0, /O=*.astraweb.com/OU=Domain Control Validated/CN=*.astraweb.com 2012.01.11 10:25:54 LOG6[3782:2952859648]: SSL connected: new session negotiated 2012.01.11 10:25:54 LOG6[3782:2952859648]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2012.01.11 10:26:06 LOG7[3782:2952859648]: Socket closed on read 2012.01.11 10:26:06 LOG7[3782:2952859648]: Sending SSL write shutdown 2012.01.11 10:26:06 LOG6[3782:2952859648]: SSL_shutdown successfully sent close_notify 2012.01.11 10:26:06 LOG3[3782:2952859648]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2012.01.11 10:26:06 LOG5[3782:2952859648]: Connection closed: 147 bytes sent to SSL, 1446 bytes sent to socket 2012.01.11 10:26:06 LOG7[3782:2952859648]: Service nntp_aw finished (0 left) 2012.01.11 10:26:06 LOG7[3782:2952859648]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) ^C2012.01.11 10:26:11 LOG7[3782:2697274688]: Dispatching signals from the signal pipe 2012.01.11 10:26:11 LOG3[3782:2697274688]: Received signal 2; terminating 2012.01.11 10:26:11 LOG7[3782:2697274688]: Service nntp_gn closed FD=11 2012.01.11 10:26:11 LOG7[3782:2697274688]: Service nntp_aw closed FD=12 2012.01.11 10:26:11 LOG7[3782:2697274688]: Service nntp_gm closed FD=13 2012.01.11 10:26:11 LOG7[3782:2697274688]: str_stats: 76 block(s), 4835 data byte(s), 2584 control byte(s) 2012.01.11 10:26:11 LOG7[3782:2697274688]: removing pid file /stunnel.pid # _ ---end--- Here's what 4.52b2 shows, much like other 4.5x versions (note it shows much-less than 4.49) -- Pan tried to connect starting at 10:21:27, timing-out twice at least, before I made it go off-line etc.: ---start--- 2012.01.11 10:20:22 LOG7[3549:3146608]: Clients allowed=500 2012.01.11 10:20:22 LOG5[3549:3146608]: stunnel 4.52 on x86_64-apple-darwin10.8.0 platform 2012.01.11 10:20:22 LOG5[3549:3146608]: Compiled/running with OpenSSL 1.1.0-dev xx XXX xxxx 2012.01.11 10:20:22 LOG5[3549:3146608]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:SELECT,IPv6 2012.01.11 10:20:22 LOG5[3549:3146608]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2012.01.11 10:20:22 LOG6[3549:3146608]: Compression enabled: 2 algorithm(s) 2012.01.11 10:20:22 LOG7[3549:3146608]: PRNG seeded successfully 2012.01.11 10:20:23 LOG6[3549:3146608]: Initializing SSL context for service nntp_gn 2012.01.11 10:20:23 LOG7[3549:3146608]: Verify directory set to /certs 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /certs revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /crls revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: SSL options set: 0x00000004 2012.01.11 10:20:23 LOG6[3549:3146608]: SSL context initialized 2012.01.11 10:20:23 LOG6[3549:3146608]: Initializing SSL context for service nntp_aw 2012.01.11 10:20:23 LOG7[3549:3146608]: Verify directory set to /certs 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /certs revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /crls revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: SSL options set: 0x00000004 2012.01.11 10:20:23 LOG6[3549:3146608]: SSL context initialized 2012.01.11 10:20:23 LOG6[3549:3146608]: Initializing SSL context for service nntp_gm 2012.01.11 10:20:23 LOG7[3549:3146608]: Verify directory set to /certs 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /certs revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /crls revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: SSL options set: 0x00000004 2012.01.11 10:20:23 LOG6[3549:3146608]: SSL context initialized 2012.01.11 10:20:23 LOG5[3549:3146608]: Configuration successful 2012.01.11 10:20:23 LOG7[3549:3146608]: Service nntp_gn bound FD=13 to 0.0.0.0:12000 2012.01.11 10:20:23 LOG7[3549:3146608]: Service nntp_aw bound FD=14 to 0.0.0.0:12001 2012.01.11 10:20:23 LOG7[3549:3146608]: Service nntp_gm bound FD=15 to 0.0.0.0:12002 2012.01.11 10:20:23 LOG7[3549:3146608]: Created pid file /stunnel.pid 2012.01.11 10:21:27 LOG7[3549:3146608]: Service nntp_aw accepted FD=16 from 127.0.0.1:52237 2012.01.11 10:22:01 LOG7[3549:3146608]: Service nntp_aw accepted FD=17 from 127.0.0.1:52238 ^C2012.01.11 10:22:32 LOG7[3549:3146608]: Dispatching signals from the signal pipe 2012.01.11 10:22:32 LOG3[3549:3146608]: Received signal 2; terminating 2012.01.11 10:22:32 LOG7[3549:3146608]: Service nntp_gn closed FD=13 2012.01.11 10:22:32 LOG7[3549:3146608]: Service nntp_aw closed FD=14 2012.01.11 10:22:32 LOG7[3549:3146608]: Service nntp_gm closed FD=15 2012.01.11 10:22:32 LOG7[3549:3146608]: str_stats: 55 block(s), 4163 data byte(s), 1870 control byte(s) 2012.01.11 10:22:32 LOG7[3549:3146608]: removing pid file /stunnel.pid # _ ---end--- Here's my stunnel.conf with superfluous comments removed: ---/usr/local/etc/stunnel/stunnel.conf--- foreground = yes key = /usr/local/etc/stunnel/stunnel.pem sslVersion = all ciphers = ALL chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid compression = zlib verify = 0 CApath = /certs CRLpath = /crls debug = 7 client = yes TIMEOUTclose = 0 ; service-level configuration [nntp_gn] accept = 12000 connect = news.giganews.com:563 [nntp_aw] accept = 12001 connect = ssl.astraweb.com:563 [nntp_gm] accept = 12002 connect = 80.91.229.10:563 ; vim:ft=dosini ---end--- To generate the aforementioned stunnel.pem, I followed the steps shown here: <https://baltazaar.wordpress.com/2008/03/03/configuring-pan-newsreader-with-…> Here is my build-log for 4.52b2, similar to my other builds: ---start--- $ cat ./dothis.sh # ./configure \ --enable-dependency-tracking \ --enable-static \ --enable-shared \ --enable-ipv6 \ --with-ssl=/usr/local/ssl \ # $ ./dothis.sh configure: **************************************** initialization checking for a BSD-compatible install... /usr/local/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /usr/local/bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking build system type... x86_64-apple-darwin10.8.0 checking host system type... x86_64-apple-darwin10.8.0 checking for gcc... gcc-4.2 checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc-4.2 accepts -g... yes checking for gcc-4.2 option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc-4.2... gcc3 checking whether gcc-4.2 and cc understand -c and -o together... yes checking whether make sets $(MAKE)... (cached) yes configure: **************************************** compiler/linker flags checking whether gcc-4.2 accepts -pthread... yes checking whether gcc-4.2 accepts -fstack-protector... yes checking whether gcc-4.2 accepts -Wall... yes checking whether gcc-4.2 accepts -Wextra... yes checking whether gcc-4.2 accepts -Wno-long-long... yes checking whether gcc-4.2 accepts -pedantic... yes configure: **************************************** libtool checking for a sed that does not truncate output... /usr/local/bin/sed checking for grep that handles long lines and -e... /usr/local/bin/grep checking for egrep... /usr/local/bin/grep -E checking for fgrep... /usr/local/bin/grep -F checking for ld used by gcc-4.2... /usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld checking if the linker (/usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld) is GNU ld... no checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm checking the name lister (/usr/bin/nm) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 196608 checking whether the shell understands some XSI constructs... yes checking whether the shell understands "+="... yes checking for /usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld option to reload object files... -r checking for objdump... no checking how to recognize dependent libraries... pass_all checking for ar... ar checking for strip... strip checking for ranlib... ranlib checking command to parse /usr/bin/nm output from gcc-4.2 object... ok checking for dsymutil... dsymutil checking for nmedit... nmedit checking for lipo... lipo checking for otool... otool checking for otool64... no checking for -single_module linker flag... yes checking for -exported_symbols_list linker flag... yes checking how to run the C preprocessor... cpp-4.2 checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... yes checking for objdir... .libs checking if gcc-4.2 supports -fno-rtti -fno-exceptions... no checking for gcc-4.2 option to produce PIC... -fno-common -DPIC checking if gcc-4.2 PIC flag -fno-common -DPIC works... yes checking if gcc-4.2 static flag -static works... no checking if gcc-4.2 supports -c -o file.o... yes checking if gcc-4.2 supports -c -o file.o... (cached) yes checking whether the gcc-4.2 linker (/usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld) supports shared libraries... yes checking dynamic linker characteristics... darwin10.8.0 dyld checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes configure: **************************************** types checking size of unsigned char... 1 checking size of unsigned short... 2 checking size of unsigned int... 4 checking size of unsigned long... 4 checking for socklen_t... yes checking for struct sockaddr_un... yes checking for struct addrinfo... yes configure: **************************************** PTY device files checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no configure: **************************************** entropy sources checking for "/dev/urandom"... yes configure: **************************************** default group checking for default group... nogroup configure: **************************************** header files checking ucontext.h usability... no checking ucontext.h presence... no checking for ucontext.h... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking poll.h usability... yes checking poll.h presence... yes checking for poll.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking stropts.h usability... no checking stropts.h presence... no checking for stropts.h... no checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking util.h usability... yes checking util.h presence... yes checking for util.h... yes checking libutil.h usability... no checking libutil.h presence... no checking for libutil.h... no checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking sys/poll.h usability... yes checking sys/poll.h presence... yes checking for sys/poll.h... yes checking sys/socket.h usability... yes checking sys/socket.h presence... yes checking for sys/socket.h... yes checking sys/un.h usability... yes checking sys/un.h presence... yes checking for sys/un.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking sys/filio.h usability... yes checking sys/filio.h presence... yes checking for sys/filio.h... yes checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for struct msghdr.msg_control... yes checking for linux/netfilter_ipv4.h... no configure: **************************************** libraries checking for library containing gethostbyname... none required checking for library containing yp_get_default_domain... none required checking for library containing socket... none required checking for library containing openpty... none required checking for library containing dlopen... none required checking for library containing shl_load... no checking for library containing inflateEnd... -lz configure: **************************************** thread model checking for pthread_create in -lc_r... no checking for pthread_create in -lc... yes checking for pthread_create in -lpthread... yes configure: PTHREAD thread model detected configure: **************************************** library functions checking for snprintf... yes checking for vsnprintf... yes checking for openpty... yes checking for _getpty... no checking for daemon... yes checking for waitpid... yes checking for wait4... yes checking for setsid... yes checking for setgroups... yes checking for chroot... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for localtime_r... yes checking for getcontext... yes checking for __makecontext_v2... no checking for poll... yes checking for gethostbyname2... yes checking for endhostent... yes checking for getnameinfo... yes checking for getaddrinfo... yes checking for broken poll() implementation... yes (poll() disabled) checking for pipe2... no checking for accept4... no configure: **************************************** optional features checking whether to enable IPv6 support... yes checking whether to disable TCP wrappers library support... autodetecting checking for hosts_access in -lwrap... yes checking whether to enable FIPS mode support... autodetecting configure: **************************************** SSL checking for SSL directory... /usr/local/ssl checking /usr/local/ssl/include/openssl/engine.h usability... yes checking /usr/local/ssl/include/openssl/engine.h presence... yes checking for /usr/local/ssl/include/openssl/engine.h... yes checking /usr/local/ssl/include/openssl/ocsp.h usability... yes checking /usr/local/ssl/include/openssl/ocsp.h presence... yes checking for /usr/local/ssl/include/openssl/ocsp.h... yes checking for FIPS_mode_set... no configure: **************************************** write the results configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/stunnel3 config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tools/stunnel.conf-sample config.status: creating tools/stunnel.init config.status: creating tools/stunnel.service config.status: creating src/config.h config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success $ make -w make: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' Making all in src make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' make all-am make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' /bin/sh ../libtool --tag=CC --mode=compile gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c -o env.lo env.c libtool: compile: gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -fno-common -DPIC -o .libs/env.o libtool: compile: gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -o env.o >/dev/null 2>&1 mv -f .deps/env.Tpo .deps/env.Plo /bin/sh ../libtool --tag=CC --mode=link gcc-4.2 -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -avoid-version -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -o libstunnel.la -rpath /usr/local/lib/stunnel env.lo -lz -L/usr/local/ssl/lib -L/usr/local/lib/libquicktime -L/usr/local/lib -L/usr/X11/lib -L/usr/lib -lpthread -lwrap libtool: link: gcc-4.2 -dynamiclib -Wl,-undefined -Wl,dynamic_lookup -o .libs/libstunnel.dylib .libs/env.o -lz -L/usr/local/ssl/lib -L/usr/local/lib/libquicktime -L/usr/local/lib -L/usr/X11/lib -L/usr/lib /usr/local/lib/libpthread.dylib -lwrap -mtune=core2 -march=core2 -arch i386 -mtune=core2 -march=core2 -arch i386 -install_name /usr/local/lib/stunnel/libstunnel.dylib -Wl,-single_module libtool: link: dsymutil .libs/libstunnel.dylib || : warning: no debug symbols in executable (-arch i386) libtool: link: ar cru .libs/libstunnel.a env.o libtool: link: ranlib .libs/libstunnel.a libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c mv -f .deps/stunnel-str.Tpo .deps/stunnel-str.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-file.o -MD -MP -MF .deps/stunnel-file.Tpo -c -o stunnel-file.o `test -f 'file.c' || echo './'`file.c mv -f .deps/stunnel-file.Tpo .deps/stunnel-file.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-client.o -MD -MP -MF .deps/stunnel-client.Tpo -c -o stunnel-client.o `test -f 'client.c' || echo './'`client.c mv -f .deps/stunnel-client.Tpo .deps/stunnel-client.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-log.o -MD -MP -MF .deps/stunnel-log.Tpo -c -o stunnel-log.o `test -f 'log.c' || echo './'`log.c mv -f .deps/stunnel-log.Tpo .deps/stunnel-log.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-options.o -MD -MP -MF .deps/stunnel-options.Tpo -c -o stunnel-options.o `test -f 'options.c' || echo './'`options.c mv -f .deps/stunnel-options.Tpo .deps/stunnel-options.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-protocol.o -MD -MP -MF .deps/stunnel-protocol.Tpo -c -o stunnel-protocol.o `test -f 'protocol.c' || echo './'`protocol.c mv -f .deps/stunnel-protocol.Tpo .deps/stunnel-protocol.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-network.o -MD -MP -MF .deps/stunnel-network.Tpo -c -o stunnel-network.o `test -f 'network.c' || echo './'`network.c mv -f .deps/stunnel-network.Tpo .deps/stunnel-network.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-resolver.o -MD -MP -MF .deps/stunnel-resolver.Tpo -c -o stunnel-resolver.o `test -f 'resolver.c' || echo './'`resolver.c mv -f .deps/stunnel-resolver.Tpo .deps/stunnel-resolver.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ssl.o -MD -MP -MF .deps/stunnel-ssl.Tpo -c -o stunnel-ssl.o `test -f 'ssl.c' || echo './'`ssl.c mv -f .deps/stunnel-ssl.Tpo .deps/stunnel-ssl.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ctx.o -MD -MP -MF .deps/stunnel-ctx.Tpo -c -o stunnel-ctx.o `test -f 'ctx.c' || echo './'`ctx.c mv -f .deps/stunnel-ctx.Tpo .deps/stunnel-ctx.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-verify.o -MD -MP -MF .deps/stunnel-verify.Tpo -c -o stunnel-verify.o `test -f 'verify.c' || echo './'`verify.c mv -f .deps/stunnel-verify.Tpo .deps/stunnel-verify.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c mv -f .deps/stunnel-sthreads.Tpo .deps/stunnel-sthreads.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c stunnel.c: In function ‘daemonize’: stunnel.c:459: warning: ‘daemon’ is deprecated (declared at /usr/include/stdlib.h:289) mv -f .deps/stunnel-stunnel.Tpo .deps/stunnel-stunnel.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-pty.o -MD -MP -MF .deps/stunnel-pty.Tpo -c -o stunnel-pty.o `test -f 'pty.c' || echo './'`pty.c mv -f .deps/stunnel-pty.Tpo .deps/stunnel-pty.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-libwrap.o -MD -MP -MF .deps/stunnel-libwrap.Tpo -c -o stunnel-libwrap.o `test -f 'libwrap.c' || echo './'`libwrap.c mv -f .deps/stunnel-libwrap.Tpo .deps/stunnel-libwrap.Po /bin/sh ../libtool --tag=CC --mode=link gcc-4.2 -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -lz -L/usr/local/ssl/lib -L/usr/local/lib/libquicktime -L/usr/local/lib -L/usr/X11/lib -L/usr/lib -lpthread -lwrap libtool: link: gcc-4.2 -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -lz -L/usr/local/lib/libquicktime -L/usr/local/lib -L/usr/X11/lib -L/usr/lib /usr/local/lib/libpthread.dylib -lwrap -pthread ld: warning: directory not found for option '-L/usr/local/ssl/lib64' make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' Making all in doc make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' Making all in tools make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' make[1]: Nothing to be done for `all-am'. make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' make: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' $ sudo make -w install Password: make: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' Making install in src make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' test -z "/usr/local/bin" || /usr/local/bin/mkdir -p "/usr/local/bin" /bin/sh ../libtool --mode=install /usr/local/bin/install -c stunnel '/usr/local/bin' libtool: install: /usr/local/bin/install -c stunnel /usr/local/bin/stunnel test -z "/usr/local/bin" || /usr/local/bin/mkdir -p "/usr/local/bin" /usr/local/bin/install -c stunnel3 '/usr/local/bin' test -z "/usr/local/lib/stunnel" || /usr/local/bin/mkdir -p "/usr/local/lib/stunnel" /bin/sh ../libtool --mode=install /usr/local/bin/install -c libstunnel.la '/usr/local/lib/stunnel' libtool: install: /usr/local/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib libtool: install: /usr/local/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/libstunnel.la libtool: install: /usr/local/bin/install -c .libs/libstunnel.a /usr/local/lib/stunnel/libstunnel.a libtool: install: chmod 644 /usr/local/lib/stunnel/libstunnel.a libtool: install: ranlib /usr/local/lib/stunnel/libstunnel.a ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib/stunnel If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable during execution See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' Making install in doc make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' make[2]: Nothing to be done for `install-exec-am'. test -z "/usr/local/share/doc/stunnel" || /usr/local/bin/mkdir -p "/usr/local/share/doc/stunnel" /usr/local/bin/install -c -m 644 stunnel.html stunnel.pl.html stunnel.fr.html '/usr/local/share/doc/stunnel' test -z "/usr/local/share/man/man8" || /usr/local/bin/mkdir -p "/usr/local/share/man/man8" /usr/local/bin/install -c -m 644 stunnel.8 stunnel.pl.8 stunnel.fr.8 '/usr/local/share/man/man8' make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' Making install in tools make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[2]: Nothing to be done for `install-exec-am'. test -z "/usr/local/etc/stunnel" || /usr/local/bin/mkdir -p "/usr/local/etc/stunnel" /usr/local/bin/install -c -m 644 stunnel.conf-sample '/usr/local/etc/stunnel' if test ! -r /usr/local/etc/stunnel/stunnel.pem; then \ if test -r "/dev/urandom"; then \ dd if="/dev/urandom" of=stunnel.rnd bs=256 count=1; \ RND="-rand stunnel.rnd"; \ else \ RND=""; \ fi; \ /usr/local/ssl/bin/openssl req -new -x509 -days 365 $RND \ -config ./stunnel.cnf \ -out stunnel.pem -keyout stunnel.pem; \ /usr/local/ssl/bin/openssl gendh $RND 1024 >> stunnel.pem; \ /usr/local/ssl/bin/openssl x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ /usr/local/bin/install -c -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem; \ rm stunnel.pem; \ fi /usr/local/bin/install -c -d -m 1770 /usr/local/var/lib/stunnel chgrp nogroup /usr/local/var/lib/stunnel if uname | grep SunOS; then \ /usr/local/bin/install -c -d -m 755 /usr/local/var/lib/stunnel/dev; \ mknod /usr/local/var/lib/stunnel/dev/zero c 13 12; \ chmod 666 /usr/local/var/lib/stunnel/dev/zero; \ fi test -z "/usr/local/share/doc/stunnel/examples" || /usr/local/bin/mkdir -p "/usr/local/share/doc/stunnel/examples" /usr/local/bin/install -c -m 644 ca.html ca.pl importCA.html importCA.sh script.sh stunnel.spec stunnel.init stunnel.service '/usr/local/share/doc/stunnel/examples' make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' make[2]: Nothing to be done for `install-exec-am'. test -z "/usr/local/share/doc/stunnel" || /usr/local/bin/mkdir -p "/usr/local/share/doc/stunnel" /usr/local/bin/install -c -m 644 INSTALL README TODO COPYING AUTHORS ChangeLog PORTS BUGS COPYRIGHT.GPL CREDITS INSTALL.W32 INSTALL.WCE INSTALL.FIPS '/usr/local/share/doc/stunnel' make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' make: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' $ _ ---end--- If it matters, I have a local checkout of the openssl-cvs repo here, and use it instead-of Apple's. [BTW I have a personal project to "jump off this fruity ship" ASAP. I've written about this in earlier posts (several months ago) to the Pan maillist, if anyone is interested.] Thanks for any help at all. --

2 3

Re: [stunnel-users] Stunnel 4.33 last one to work with VM & IMAP
by Michal Trojnara 11 Jan '12

11 Jan '12

Mark Wogahn wrote: > No joy here. The thing that bugs me the most about this problem is > why do stunnel versions after 4.33 work on linux and bsd but not Mac > OS? It looks like Apple has put some serious effort to make its TCP/IP stack incompatible with other operating systems. Here is the the version I successfully tested against Mac OS X 10.5.8 (PowerPC): ftp://ftp.stunnel.org/stunnel/beta/stunnel-4.52b2.tar.gz Mike

1 0

Stunnel 4.33 last one to work with VM & IMAP
by Drew McDermott 11 Jan '12

11 Jan '12

I am running VM 8.1, the Emacs mail reader, connecting via imap to gmail. It can be made to work with stunnel 4.33 providing the encryption, but any version after that causes VM to choke when fetching messages, generating the following error message: vm-imap-protocol-error: IMAP protocol error: "unexpected char (10)" Not being an expert in any of the programs that are chained together to make my e-mail setup work, I was able to trace this no deeper than the point where VM reads the buffer Emacs uses for interprocess communication. Sure enough, there is a linefeed in a place where it isn't expected, but it also happens to be the first character in the sequence: " Process IMAP over SSL finished " which may be there because of problems deeper than the representation of "newline." At the end of this message I give my attempt to represent the complete contents of the buffer with name "trace of IMAP over SSL session to imap.gmail.com." The ^M's were inserted by hand because cutting and pasting didn't seem to reproduce them. I realize that I am providing quite a bit of information from VM, and none from stunnel, which is frustrating in an stunnel forum, but I am a complete newbie regarding stunnel. I would be glad to run further experiments with guidance on how to get stunnel itself to generate more useful information. The only reason I suspect it is that installing version 4.33 fixes the problem; but I realize it may be that VM or some other component is violating the rules somehow. When I say "any version after" 4.33, I mean that I have tried 4.35, the version installed by MacPorts; and 4.49, the latest stable version, recompiled by hand. They behave identically. -- Drew McDermott Professor of Computer Science Yale Computer Science Department The interprocess-communication buffer (everything between the dashes, including the newline after "finished," but not including the newline before "starting"): --------------- starting IMAP over SSL session Tue Nov 29 14:20:01 2011 connecting to imap.gmail.com:993 connected * OK Gimap ready for requests from 128.36.148.241 s17if7011003qao.19 VM CAPABILITY Process IMAP over SSL finished ---------------

2 3

Problem with startup of stunnel
by Villiboy＠web.de 10 Jan '12

10 Jan '12

2 1

stunnel 4.51 released
by Michal Trojnara 09 Jan '12

09 Jan '12

Dear Users, I have released version 4.51 of stunnel. The ChangeLog entry: Version 4.51, 2012.01.09, urgency: MEDIUM: * New features - Updated Win32 binary distribution OpenSSL DLLs to version 0.9.8s-fips. - Updated Android binary OpenSSL to version 1.0.0f. - Zlib support added to Win32 and Android binary builds. - New "compression = deflate" global option to enable RFC 2246 compresion. For compatibility with previous versions "compression = zlib" and "compression = rle" also enable the deflate (RFC 2246) compression. - Separate default ciphers and sslVersion for "fips = yes" and "fips = no". - UAC support for editing configuration file with Windows GUI. * Bugfixes - Fixed exec+connect sections. - Added a workaround for broken Android getaddrinfo(): http://stackoverflow.com/questions/7818246/segmentation-fault-in-getaddrinfo Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.51.tar.gz: dc52b22de48a2d71ab6170adb628dbe05dd406d6c9103fc43fbdbda776c3e90b Best regards, Mike

1 0

Basic initialization failed at gui.cpp, line 842
by K Rasmussen 09 Jan '12

09 Jan '12

Hi I have downloaded and installed: stunnel-4.50-installer.exe stunnel crash with message: Basic initialization failed at gui.cpp, line 842 Adding debug flag in .conf file does not generate any log file. Any suggestions on how to proceed is welcome. Best Regards K Rasmussn

2 1

Stunnel is not working on one computer
by Reuven Sabi 01 Jan '12

01 Jan '12

Hello to all! I have a problem i have installed on my laptop in order to work with one service , i have to say it works like a charm , but it doesn't work on my PC both computers have Windows 7 No firewall in windows No firewall in router I can not understand what is missing , why is it working on what computer and on other is not This is my sunnel.conf client= yes debug= 7 output= stunnel.log [Rates] accept = 127.0.0.1:11009 connect = XXXXXXXXX.com:14009 [Deals] accept = 127.0.0.1:12009 connect = XXXXXXXXX.com:15009 Thanks in advance i appreciate any help.

3 3

Missing bytes?
by Arthur Murray 01 Jan '12

01 Jan '12

Hello, When I telnet to my pop3 server and "QUIT" this is what I see: Escape character is '^]'. +OK InterMail POP3 server ready. QUIT +OK ? InterMail POP3 server signing off. Connection closed by foreign host. When I setup an stunnel 4.5 to the same pop3 server: [pop3s] accept = 995 connect = server:110 and connect with "openssl s_client -connect localhost:995" this is what I see: +OK InterMail POP3 server ready. QUIT DONE And the stunnel log reports: Connection closed: 34 bytes sent to SSL, 0 bytes sent to socket What happened to the last line "+OK ? InterMail POP3 server signing off." and why aren't the counters counting the 5 bytes I sent ("QUIT\n") and the last line of 41 sent over the SSL? Example 2 through stunnel: +OK InterMail POP3 server ready. USER -ERR a user name MUST be entered QUIT DONE Connection closed: 68 bytes sent to SSL, 5 bytes sent to socket (still missing the last bytes)

2 4

Segfault with stunnel
by yassine ayachi 23 Dec '11

23 Dec '11

Hi all, I'am trying to encrypt a connection between two hosts using stunnel. ----- here is my config file ---- cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = debug output = stunnel.log --- [rdps] accept = 1957 connect = remote_machine:3389 Avery think was working fine until I tried to telnet to the port 1957 on the machine running stunnel, the process stunnel was killed alone leaving this in /var/log/messages : Dec 20 16:58:01 alpha kernel: [4930384.164316] stunnel[14540]: segfault at 8 ip b7629b61 sp b758d16c error 6 in libc-2.7.so[b75bd000+138000] Does anybody have an idea about this problem, thanks in advance, Yassine

3 6

Re: [stunnel-users] Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 22 Dec '11

22 Dec '11

Hi Guys, Thanks for your replies. I tried following commands on verisign c certificate, for both of these do not work. There is error 'unable to load certificate'. openssl x509 -inform DER -in stunnel.pem -noout -text or openssl x509 -inform PEM -in stunnel.pem -noout -text however if I run same command (openssl x509 -inform PEM -in stunnel.pem -noout -text) on VeriSign root & Intermediate certificate it works. It shows format should be 'pem'. But somehow certificate is not valid. I am using following commands to create csr and private key. Are these correct ? openssl genrsa -des3 -out server.key 2048 openssl req -new -key server.key -out server.csr Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 9:27 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 21 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: Configuring VeriSign certificate with STunnel (Michal Trojnara) 2. stunnel segfault, please advise (Mehdi Bennani) 3. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) 4. Segfault with stunnel (yassine ayachi) 5. Re: Segfault with stunnel (Scott Damron) 6. unsubscribe (Brian McGinity) 7. Re: Missing bytes? (Arthur Murray) 8. Re: Segfault with stunnel (yassine ayachi) ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Dec 2011 13:30:45 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Configuring VeriSign certificate with STunnel Message-ID: <f039775ca5efe5be73a2858b88f0ebc2(a)mirt.net> Content-Type: text/plain; charset=UTF-8; format=flowed Zubair Ali Mansoor wrote: > 2011.12.21 13:31:30 LOG3[5144:2256]: > SSL_CTX_use_certificate_chain_file: > D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag I don't think this problem is specific to stunnel: https://encrypted.google.com/search?q=%22ASN1_CHECK_TLEN%3Awrong+tag%22+veri sign Mike ------------------------------ Message: 2 Date: Wed, 21 Dec 2011 07:34:19 -0500 From: Mehdi Bennani <mehdibennani(a)hotmail.com> To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] stunnel segfault, please advise Message-ID: <SNT134-W33BCBEA69CFD9694C37B7EC3A50(a)phx.gbl> Content-Type: text/plain; charset="iso-8859-1" Hi you guys, I proposed stunnel as a potential solution to our product about 4-5 months ago and I am in the process of testing a prototype I have built around that proposition. I am using stunnel v. 4.41. I am relatively new to stunnel myself. The env. is as follows: We are trying to secure an rdp connection from a java applet running in a web browser into a windows 2008 server machine behind our firewall. Presently, the java applet opens up an RDP connection into a machine (I will call it the SSL machine) where Stunnel is presently installed. Stunnel then forwards properly the incoming traffic (from portA) into its final destination (i.e: the windows Server 2008 machine) on port B. Further, I have configured Stunnel to use an SSL certificate. (Although, I have not been able to test that yet to make sure it works) Anyhow, it is all working as expected and I am pretty happy about the proof of concept. However, while testing it a bit, I noticed that it was relatively easy to bring stunnel down. The way I went about it, was to simply run a "telnet IP_of_MySSLMachine portA" from any DOS command window from any machine with internet access. From the Stunnel logs, I can tell that I get a response from Stunnel and on the DOS window side, I have a cursor waiting for input.... Writing any gibberish into that DOS windows and waiting a little bit makes stunnel stop and die in the SSL machine. I found nothing in the stunnel log, but grepping in the /var/log/, I found the segfault sslmahine:/var/log/# grep stunnel messages kernel: [1996904.624042] stunnel [19696]: segfault at 8 ip b768d361 sp b7601210 error 4 in libc-2.7.so[b7621000+138000] After another telnet execution, few days later: sslmahine:/var/log/# grep stunnel messages kernel: [4930384.164316] stunnel [14540]: segfault at 8 ip b7629b61 error 6 in libc-2.7.so[b75bd000+138000] Basically, if I don't issue that telnet command, stunnel works properly. As soon as I issue that command and start typing few things in that DOS console, stunnel dies. I have to manually restart it. Question: I was wondering if you guys could shed some light into this behavior. Is it a known behavior/bug? Is there a way to solve it by maybe upgrading into a later version of stunnel? Also, I was thinking to block telnet altogether at the firewall level, but then I am not sure what other protocols could people use to hack into the system...so should I block all of them? And, finally is there a more secure way to setup stunnel? Thank you in advance Mehdi/

2 1

building browser like client application based on OpenSSL
by Zubair Ali Mansoor 22 Dec '11

22 Dec '11

Hi, Can I develop an application based on OpenSSL such that it can communicate with all trusted sites ? Like browser can communicates? Actually I have desktop application that uses SSL. Now this application may communicate with any trusted server application. How can I achieve this ? Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 9:27 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 21 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: Configuring VeriSign certificate with STunnel (Michal Trojnara) 2. stunnel segfault, please advise (Mehdi Bennani) 3. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) 4. Segfault with stunnel (yassine ayachi) 5. Re: Segfault with stunnel (Scott Damron) 6. unsubscribe (Brian McGinity) 7. Re: Missing bytes? (Arthur Murray) 8. Re: Segfault with stunnel (yassine ayachi) ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Dec 2011 13:30:45 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Configuring VeriSign certificate with STunnel Message-ID: <f039775ca5efe5be73a2858b88f0ebc2(a)mirt.net> Content-Type: text/plain; charset=UTF-8; format=flowed Zubair Ali Mansoor wrote: > 2011.12.21 13:31:30 LOG3[5144:2256]: > SSL_CTX_use_certificate_chain_file: > D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag I don't think this problem is specific to stunnel: https://encrypted.google.com/search?q=%22ASN1_CHECK_TLEN%3Awrong+tag%22+veri sign Mike ------------------------------ Message: 2 Date: Wed, 21 Dec 2011 07:34:19 -0500 From: Mehdi Bennani <mehdibennani(a)hotmail.com> To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] stunnel segfault, please advise Message-ID: <SNT134-W33BCBEA69CFD9694C37B7EC3A50(a)phx.gbl> Content-Type: text/plain; charset="iso-8859-1" Hi you guys, I proposed stunnel as a potential solution to our product about 4-5 months ago and I am in the process of testing a prototype I have built around that proposition. I am using stunnel v. 4.41. I am relatively new to stunnel myself. The env. is as follows: We are trying to secure an rdp connection from a java applet running in a web browser into a windows 2008 server machine behind our firewall. Presently, the java applet opens up an RDP connection into a machine (I will call it the SSL machine) where Stunnel is presently installed. Stunnel then forwards properly the incoming traffic (from portA) into its final destination (i.e: the windows Server 2008 machine) on port B. Further, I have configured Stunnel to use an SSL certificate. (Although, I have not been able to test that yet to make sure it works) Anyhow, it is all working as expected and I am pretty happy about the proof of concept. However, while testing it a bit, I noticed that it was relatively easy to bring stunnel down. The way I went about it, was to simply run a "telnet IP_of_MySSLMachine portA" from any DOS command window from any machine with internet access. From the Stunnel logs, I can tell that I get a response from Stunnel and on the DOS window side, I have a cursor waiting for input.... Writing any gibberish into that DOS windows and waiting a little bit makes stunnel stop and die in the SSL machine. I found nothing in the stunnel log, but grepping in the /var/log/, I found the segfault sslmahine:/var/log/# grep stunnel messages kernel: [1996904.624042] stunnel [19696]: segfault at 8 ip b768d361 sp b7601210 error 4 in libc-2.7.so[b7621000+138000] After another telnet execution, few days later: sslmahine:/var/log/# grep stunnel messages kernel: [4930384.164316] stunnel [14540]: segfault at 8 ip b7629b61 error 6 in libc-2.7.so[b75bd000+138000] Basically, if I don't issue that telnet command, stunnel works properly. As soon as I issue that command and start typing few things in that DOS console, stunnel dies. I have to manually restart it. Question: I was wondering if you guys could shed some light into this behavior. Is it a known behavior/bug? Is there a way to solve it by maybe upgrading into a later version of stunnel? Also, I was thinking to block telnet altogether at the firewall level, but then I am not sure what other protocols could people use to hack into the system...so should I block all of them? And, finally is there a more secure way to setup stunnel? Thank you in advance Mehdi/

2 2

unsubscribe
by Brian McGinity 21 Dec '11

21 Dec '11

Unsubscribe

1 0

Re: [stunnel-users] Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 21 Dec '11

21 Dec '11

Hi, Thanks for your response. Here is log file. 2011.12.21 13:31:30 LOG7[5144:2256]: Snagged 64 random bytes from C:/.rnd 2011.12.21 13:31:30 LOG7[5144:2256]: Wrote 1024 new random bytes to C:/.rnd 2011.12.21 13:31:30 LOG7[5144:2256]: RAND_status claims sufficient entropy for the PRNG 2011.12.21 13:31:30 LOG7[5144:2256]: PRNG seeded successfully 2011.12.21 13:31:30 LOG7[5144:2256]: Certificate: zos.pem 2011.12.21 13:31:30 LOG3[5144:2256]: Error reading certificate file: zos.pem 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error 2011.12.21 13:31:30 LOG3[5144:2256]: SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag 2011.12.21 13:31:30 LOG3[5144:2256]: Server is down Please let me know if you need further information. Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 12:56 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 18 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Unable to make Stunnel on Solaris 10 (ted.pritchard(a)steria.co.uk) 2. Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (ayanamist) 3. Configuring VeriSign certificate with STunnel (Zubair Ali Mansoor) 4. Re: Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (Ludovic LEVET) 5. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) ---------------------------------------------------------------------- Message: 1 Date: Tue, 20 Dec 2011 16:04:08 +0000 From: ted.pritchard(a)steria.co.uk To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Unable to make Stunnel on Solaris 10 Message-ID: <OFBAF4145D.79BD6AD7-ON8025796C.0056E111-8025796C.005844D7(a)xansa.com> Content-Type: text/plain; charset="us-ascii" Hi, I'm trying to compile and install Stunnel 4.47 on a Solaris 10 container. My GCC version is 3.4.3. The problem is that I get the following error during make make gcc:unrecognized option: '-pthread' Should I be able to compile Stunnel using this configuration or is there some option I can use to make it work? For interest, In the past using Stunnel 3.34 I've not had this problem so something in the build process must have changed. Many Thanks Ted This email originates from Steria*. It, and any attachments, may contain confidential information and may be subject to copyright or other intellectual property rights. It is only for the use of the addressee(s). You may not copy, forward, disclose, save or otherwise use it in any way if you are not the addressee(s) or responsible for delivery. If you receive this email by mistake, please advise the sender and cancel it immediately. Steria may monitor the content of emails within its network to ensure compliance with its policies and procedures. Any email is susceptible to alteration and its integrity cannot be assured. Steria shall not be liable if the message is altered, modified, falsified, or edited. _____________________________________________________ * Steria Limited, number 4077975; Steria Recruitment Limited, number 1437998. Registered in England and Wales; registered office Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire HP2 7AH

3 2

stunnel segfault, please advise
by Mehdi Bennani 21 Dec '11

21 Dec '11

Hi you guys, I proposed stunnel as a potential solution to our product about 4-5 months ago and I am in the process of testing a prototype I have built around that proposition. I am using stunnel v. 4.41. I am relatively new to stunnel myself. The env. is as follows: We are trying to secure an rdp connection from a java applet running in a web browser into a windows 2008 server machine behind our firewall. Presently, the java applet opens up an RDP connection into a machine (I will call it the SSL machine) where Stunnel is presently installed. Stunnel then forwards properly the incoming traffic (from portA) into its final destination (i.e: the windows Server 2008 machine) on port B. Further, I have configured Stunnel to use an SSL certificate. (Although, I have not been able to test that yet to make sure it works) Anyhow, it is all working as expected and I am pretty happy about the proof of concept. However, while testing it a bit, I noticed that it was relatively easy to bring stunnel down. The way I went about it, was to simply run a "telnet IP_of_MySSLMachine portA" from any DOS command window from any machine with internet access. From the Stunnel logs, I can tell that I get a response from Stunnel and on the DOS window side, I have a cursor waiting for input.... Writing any gibberish into that DOS windows and waiting a little bit makes stunnel stop and die in the SSL machine. I found nothing in the stunnel log, but grepping in the /var/log/, I found the segfault sslmahine:/var/log/# grep stunnel messages kernel: [1996904.624042] stunnel [19696]: segfault at 8 ip b768d361 sp b7601210 error 4 in libc-2.7.so[b7621000+138000] After another telnet execution, few days later: sslmahine:/var/log/# grep stunnel messages kernel: [4930384.164316] stunnel [14540]: segfault at 8 ip b7629b61 error 6 in libc-2.7.so[b75bd000+138000] Basically, if I don't issue that telnet command, stunnel works properly. As soon as I issue that command and start typing few things in that DOS console, stunnel dies. I have to manually restart it. Question: I was wondering if you guys could shed some light into this behavior. Is it a known behavior/bug? Is there a way to solve it by maybe upgrading into a later version of stunnel? Also, I was thinking to block telnet altogether at the firewall level, but then I am not sure what other protocols could people use to hack into the system...so should I block all of them? And, finally is there a more secure way to setup stunnel? Thank you in advance Mehdi/

1 0

Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction.
by ayanamist 21 Dec '11

21 Dec '11

I generated a pair of key and certificates with openssl 1.0.0d, and use them in stunnel 4.36. Today i upgrade it to stunnel 4.50 and it doesnot work. All configurations remain unmodified. Then i tested many versions and found, stunnel with openssl 1.00 works fine while with openssl 0.98 does not work. I use stunnel with linux server and windows client, stunnel 4.50 windows version is using openssl 0.98, so cause this problem. 4.47 is using 1.00e which i think is newer than 0.98 bundled with 4.50. So why stunnel keep changing openssl version?

3 4

Re: [stunnel-users] Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 21 Dec '11

21 Dec '11

Hi, Here are steps how I created certificate request and private key. Generate private key openssl genrsa -des3 -out server.key 2048 Generate certificate request openssl req -new -key server.key -out server.csr I submitted server.csr contents to VeriSign to get test certificate and they provided me three certificates. VeriSign signed certificated Root certificate Intermediate certificate I copied VeriSign signed certificate in stunnel.pem and other two certificates in ca.pem file. As per my observation STunnel is unable to load stunnel.pem file. If you need VeriSign test certificate I can provide you that as well. Please let me know if you need further information. Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 12:56 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 18 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Unable to make Stunnel on Solaris 10 (ted.pritchard(a)steria.co.uk) 2. Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (ayanamist) 3. Configuring VeriSign certificate with STunnel (Zubair Ali Mansoor) 4. Re: Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (Ludovic LEVET) 5. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) ---------------------------------------------------------------------- Message: 1 Date: Tue, 20 Dec 2011 16:04:08 +0000 From: ted.pritchard(a)steria.co.uk To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Unable to make Stunnel on Solaris 10 Message-ID: <OFBAF4145D.79BD6AD7-ON8025796C.0056E111-8025796C.005844D7(a)xansa.com> Content-Type: text/plain; charset="us-ascii" Hi, I'm trying to compile and install Stunnel 4.47 on a Solaris 10 container. My GCC version is 3.4.3. The problem is that I get the following error during make make gcc:unrecognized option: '-pthread' Should I be able to compile Stunnel using this configuration or is there some option I can use to make it work? For interest, In the past using Stunnel 3.34 I've not had this problem so something in the build process must have changed. Many Thanks Ted This email originates from Steria*. It, and any attachments, may contain confidential information and may be subject to copyright or other intellectual property rights. It is only for the use of the addressee(s). You may not copy, forward, disclose, save or otherwise use it in any way if you are not the addressee(s) or responsible for delivery. If you receive this email by mistake, please advise the sender and cancel it immediately. Steria may monitor the content of emails within its network to ensure compliance with its policies and procedures. Any email is susceptible to alteration and its integrity cannot be assured. Steria shall not be liable if the message is altered, modified, falsified, or edited. _____________________________________________________ * Steria Limited, number 4077975; Steria Recruitment Limited, number 1437998. Registered in England and Wales; registered office Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire HP2 7AH

1 0

Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 21 Dec '11

21 Dec '11

Hi, I got VeriSign Test SSL certificate. I have been trying to configure it with STunnel. But there are errors in STunnel. I have placed private key and CA signed certificate in a separate file named 'stunnel.pem'. Root and Intermediate certificates have been placed in following order in a file named 'ca.pem' stunnel.pem -----BEGIN RSA PRIVATE KEY----- encrypted key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- VeriSign signed certificate -----END CERTIFICATE----- ca.pem -----BEGIN CERTIFICATE----- VeriSign Intermediate CA Certificate -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- VeriSign Root CA Certificate -----END CERTIFICATE----- Here is stunnel.conf file. ;key = server.key cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile CAfile = ca.pem ;CAfile=zosIntermediate.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = no I have also tried to change order of certificates but nothing is working. Anyone have idea how it can work. Your cooperation will be highly appreciated. Thanks, Zubair

2 1

Unable to make Stunnel on Solaris 10
by ted.pritchard＠steria.co.uk 20 Dec '11

20 Dec '11

Hi, I'm trying to compile and install Stunnel 4.47 on a Solaris 10 container. My GCC version is 3.4.3. The problem is that I get the following error during make make gcc:unrecognized option: '-pthread' Should I be able to compile Stunnel using this configuration or is there some option I can use to make it work? For interest, In the past using Stunnel 3.34 I've not had this problem so something in the build process must have changed. Many Thanks Ted This email originates from Steria*. It, and any attachments, may contain confidential information and may be subject to copyright or other intellectual property rights. It is only for the use of the addressee(s). You may not copy, forward, disclose, save or otherwise use it in any way if you are not the addressee(s) or responsible for delivery. If you receive this email by mistake, please advise the sender and cancel it immediately. Steria may monitor the content of emails within its network to ensure compliance with its policies and procedures. Any email is susceptible to alteration and its integrity cannot be assured. Steria shall not be liable if the message is altered, modified, falsified, or edited. _____________________________________________________ * Steria Limited, number 4077975; Steria Recruitment Limited, number 1437998. Registered in England and Wales; registered office Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire HP2 7AH

1 0

unsubscribe
by Brian McGinity 16 Dec '11

16 Dec '11

Unsubscribe

1 0

Re: [stunnel-users] Problem with sslv2 clients
by Ludovic LEVET 16 Dec '11

16 Dec '11

Hi, Normal, SSLv2 is disable by default since version 4.40. (http://www.stunnel.org/?page=sdf_ChangeLog) To re-enable it add in your config file : ciphers = ALL:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (or other) and sslVersion = all Ludovic. > > > > Le 09/12/2011 15:37, Markus Borst a écrit : >> Hi, >> >> we have a strange problem with newer stunnel versions (4.50 on >> windows), compared to older ones (known to work is version 4.35). The >> problem seems to be, that if a client sends a SSLv2 Helo message, the >> stunnel server simply resets the TCP connection, without trying to >> negotioate anything. >> >> Setup: Stunnel is used top provide ssl/tls for imap, Hobbit is used >> to monitor service availability. The Hobbit module to monitor imaps >> seems to try SSLv2 first, but also supports newer versions (SSLv3 and >> TLSv1). The ssl connection never gets established, stunnel sends a >> tcp RST, hobbit never retries. We can force some hobbit modules to >> use TLSv1 exclusively, but not all of them. We fear that some older >> mailclients will also have problems initiating a connection, so we >> keep stunnel 4.35 running for now. >> >> stunnel.conf: >> >> fips = no >> debug = 7 >> output = stunnel.log >> >> [imaps] >> accept = 130.83.174.1:993 >> connect = 127.0.0.1:143 >> cert = imap.xxx.company.yy.pem >> >> >> stunnel.log: >> >> 2011.12.09 14:55:12 LOG5[6820:2144]: Service imaps accepted >> connection from xxx.yyy.zzz.105:45294 >> 2011.12.09 14:55:12 LOG3[6820:2144]: SSL_accept: 1408F10B: >> error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number >> 2011.12.09 14:55:12 LOG5[6820:2144]: Connection reset: 0 bytes sent >> to SSL, 0 bytes sent to socket >> 2011.12.09 14:55:12 LOG7[6820:2144]: Service imaps finished (0 left) >> 2011.12.09 14:55:12 LOG7[6820:2144]: str_stats: 0 block(s), 0 data >> byte(s), 0 control byte(s) >> >> >> >> Wireshark Packet Trace (see attached image). >> >> >> What's wrong here? Shouldn't client and server negotiate the methods >> used? The client seems to offer TLS ("Version: TLS 1.0 ..."), but >> instead of negotiating, the server simply closes the connection. >> >> >> Greetings >> Markus Borst >> >

4 6

Multiple Domains for https
by Brian McGinity 15 Dec '11

15 Dec '11

Will Stunnel work with multiple domains? For example if abc.com and xyz.com both resolve to the same ip address where the web server is running locally on port 4080. Going when to https://abc.com or https://xyz.com stunnel will encrypt the traffic and forward to the local 4080 port in the clear. What if 10 or 20 domains needed to be served by the same web server?

2 3

Reload/change CRL?
by John Abloyer 15 Dec '11

15 Dec '11

Hi, Is there a way to reload CRL, or actually change to a newer, *without* restarting stunnel?

2 1

Is Stunnel Right Tool for....?
by Brian McGinity 14 Dec '11

14 Dec '11

Is Stunnel the right tool for this situation? I am using an Intel disk monitoring tool which has the ability to send out email alerts. In the Email Setup it asks for Host, From and To, there is not a username or pw. Could Stunnel be configured to add the username and pw and send the message to gmail's smtp?

2 1

stunnel-4.50 on Nexus S android
by Jason Haar 14 Dec '11

14 Dec '11

Hi there I'm trying out the stunnel android binary from 4.50 on a rooted 2.3.6 Android, mapping localhost port 80 to a remote client-cert protected ActiveSync server. It crashes after a client makes a connection. Here's the "debug = 7" logs 2011.12.14 07:44:55 LOG7[8738:2949960768]: Private key loaded 2011.12.14 07:44:55 LOG7[8738:2949960768]: SSL options set: 0x00000004 2011.12.14 07:44:55 LOG6[8738:2949960768]: SSL context initialized 2011.12.14 07:44:55 LOG5[8738:2949960768]: Configuration successful 2011.12.14 07:44:55 LOG7[8738:2949960768]: Option SO_REUSEADDR set on accept socket 2011.12.14 07:44:55 LOG7[8738:2949960768]: Service ActiveSync bound to 0.0.0.0:80 2011.12.14 07:44:55 LOG7[8738:2949960768]: Service ActiveSync opened FD=5 2011.12.14 07:44:55 LOG7[8738:2949960768]: Created pid file /data/local/etc/stunnel/pid 2011.12.14 07:44:59 LOG7[8738:2949960768]: Service ActiveSync accepted FD=6 from 127.0.0.1:58088 2011.12.14 07:44:59 LOG7[8738:1525312]: Service ActiveSync started 2011.12.14 07:44:59 LOG7[8738:1525312]: Option TCP_NODELAY set on local socket ...[I do "telnet 127.0.0.1 80" ] 2011.12.14 07:44:59 LOG5[8738:1525312]: Service ActiveSync accepted connection from 127.0.0.1:58088 Segmentation fault Any ideas how to debug this? I basically grabbed a working config off my Linux laptop and moved it over (different paths of course), so I assume the binary is missing something? -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 1

unsubscribe
by Brian McGinity 14 Dec '11

14 Dec '11

Unsubscribe

1 0

SSL alert (write): fatal: protocol version
by René Legault 14 Dec '11

14 Dec '11

Hi, I have an issue when using Stunnel. Can somebody help me? I have a module on my network that sends non-SSL e-mail but my ISP (Sympatico.ca) is accepting only SSL communication. This is my stunnel.conf file: cert = stunnel.pem protocol = smtp ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [smtp] accept=192.168.1.17:25 connect = smtphm.sympatico.ca:25 And this is my log: 2011.12.13 19:55:06 LOG7[2468:1644]: Service smtp accepted FD=316 from 192.168.1.200:12149 2011.12.13 19:55:06 LOG7[2468:1644]: Creating a new thread 2011.12.13 19:55:06 LOG7[2468:1644]: New thread created 2011.12.13 19:55:06 LOG7[2468:2684]: Service smtp started 2011.12.13 19:55:06 LOG5[2468:2684]: Service smtp accepted connection from 192.168.1.200:12149 2011.12.13 19:55:06 LOG6[2468:2684]: connect_blocking: connecting 65.55.172.251:25 2011.12.13 19:55:06 LOG7[2468:2684]: connect_blocking: s_poll_wait 65.55.172.251:25: waiting 10 seconds 2011.12.13 19:55:06 LOG5[2468:2684]: connect_blocking: connected 65.55.172.251:25 2011.12.13 19:55:06 LOG5[2468:2684]: Service smtp connected remote server from 192.168.1.17:3013 2011.12.13 19:55:06 LOG7[2468:2684]: Remote FD=392 initialized 2011.12.13 19:55:06 LOG6[2468:2684]: Client-mode smtp protocol negotiations started 2011.12.13 19:55:06 LOG7[2468:2684]: <- 220 BLU0-SMTP6.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Tue, 13 Dec 2011 16:55:06 -0800 2011.12.13 19:55:06 LOG7[2468:2684]: -> 220 BLU0-SMTP6.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Tue, 13 Dec 2011 16:55:06 -0800 2011.12.13 19:55:06 LOG7[2468:2684]: -> EHLO localhost 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-BLU0-SMTP6.phx.gbl Hello [65.94.163.170] 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-TURN 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-SIZE 41943040 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-ETRN 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-PIPELINING 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-DSN 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-ENHANCEDSTATUSCODES 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-8bitmime 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-BINARYMIME 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-CHUNKING 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-VRFY 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-TLS 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-STARTTLS 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250 OK 2011.12.13 19:55:06 LOG7[2468:2684]: -> STARTTLS 2011.12.13 19:55:06 LOG7[2468:2684]: <- 220 2.0.0 SMTP server ready 2011.12.13 19:55:06 LOG6[2468:2684]: Client-mode smtp protocol negotiations succeeded 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): before/connect initialization 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write client hello A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 read server hello A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 read server certificate A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 read server done A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write client key exchange A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write change cipher spec A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write finished A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 flush data 2011.12.13 19:55:07 LOG7[2468:2684]: SSL state (connect): SSLv3 read finished A 2011.12.13 19:55:07 LOG7[2468:2684]: 1 items in the session cache 2011.12.13 19:55:07 LOG7[2468:2684]: 86477 client connects (SSL_connect()) 2011.12.13 19:55:07 LOG7[2468:2684]: 86477 client connects that finished 2011.12.13 19:55:07 LOG7[2468:2684]: 0 client renegotiations requested 2011.12.13 19:55:07 LOG7[2468:2684]: 0 server connects (SSL_accept()) 2011.12.13 19:55:07 LOG7[2468:2684]: 0 server connects that finished 2011.12.13 19:55:07 LOG7[2468:2684]: 0 server renegotiations requested 2011.12.13 19:55:07 LOG7[2468:2684]: 0 session cache hits 2011.12.13 19:55:07 LOG7[2468:2684]: 0 external session cache hits 2011.12.13 19:55:07 LOG7[2468:2684]: 0 session cache misses 2011.12.13 19:55:07 LOG7[2468:2684]: 0 session cache timeouts 2011.12.13 19:55:07 LOG6[2468:2684]: SSL connected: new session negotiated 2011.12.13 19:55:07 LOG6[2468:2684]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2011.12.13 19:55:07 LOG6[2468:2684]: Compression: null, expansion: null 2011.12.13 19:55:07 LOG7[2468:2684]: SSL alert (write): fatal: protocol version 2011.12.13 19:55:07 LOG3[2468:2684]: SSL_read: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.12.13 19:55:07 LOG5[2468:2684]: Connection reset: 19 bytes sent to SSL, 219 bytes sent to socket 2011.12.13 19:55:07 LOG7[2468:2684]: Service smtp finished (0 left) 2011.12.13 19:55:07 LOG7[2468:2684]: str_stats: 16 block(s), 353 data byte(s), 544 control byte(s) What am I doing wrong? Thanks Rene

1 0

Problems with Stunnel 4.5*
by Sebastian Rose-Indorf 12 Dec '11

12 Dec '11

Hello Mike, many thanks for your work. However, I have problems with the current Stunnel versions. (I work with Windows 64bit.) Stunnel 4.47 works without problems. Stunnel 4.51b1 however - starts only if "fips = no" is set; - not accepts my certificate and my private key (SHA384 or RMD160, AES128 or IDEA) any more: error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib error queue: 2306A075: error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error error queue: 23077073: error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error SSL_CTX_use_PrivateKey_file: 6074079: error:06074079:digital envelope routines:EVP_PBE_CipherInit:unknown pbe algorithm Yours sincerely Sebastian

3 10

stunnel 4.50 released
by Michal Trojnara 12 Dec '11

12 Dec '11

Dear Users, I have released version 4.50 of stunnel. The ChangeLog entry: Version 4.50, 2011.12.03, urgency: MEDIUM: * New features - Added Android port. - Updated INSTALL.FIPS. * Bugfixes - Fixed internal memory allocation problem in inetd mode. - Fixed FIPS mode on Microsoft Vista, Server 2008, and Windows 7. This fix required to compile OpenSSL FIPS-compliant DLLs with MSVC 9.0, instead of MSVC 10.0. msvcr100.dll was replaced with msvcr90.dll. GPL compatibility issues are explained in the GPL FAQ: http://www.gnu.org/licenses/gpl-faq.html#WindowsRuntimeAndGPL - POP3 server-side protocol negotiation updated to report STLS capability (thx to Anthony Morgan). Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.50.tar.gz: 933467009529bae4f338bb20e758e0ea20b0759130e7695ea2193c4f270e5eaf Best regards, Mike

4 18

Problem with sslv2 clients
by Markus Borst 09 Dec '11

09 Dec '11

Hi, we have a strange problem with newer stunnel versions (4.50 on windows), compared to older ones (known to work is version 4.35). The problem seems to be, that if a client sends a SSLv2 Helo message, the stunnel server simply resets the TCP connection, without trying to negotioate anything. Setup: Stunnel is used top provide ssl/tls for imap, Hobbit is used to monitor service availability. The Hobbit module to monitor imaps seems to try SSLv2 first, but also supports newer versions (SSLv3 and TLSv1). The ssl connection never gets established, stunnel sends a tcp RST, hobbit never retries. We can force some hobbit modules to use TLSv1 exclusively, but not all of them. We fear that some older mailclients will also have problems initiating a connection, so we keep stunnel 4.35 running for now. stunnel.conf: fips = no debug = 7 output = stunnel.log [imaps] accept = 130.83.174.1:993 connect = 127.0.0.1:143 cert = imap.xxx.company.yy.pem stunnel.log: 2011.12.09 14:55:12 LOG5[6820:2144]: Service imaps accepted connection from xxx.yyy.zzz.105:45294 2011.12.09 14:55:12 LOG3[6820:2144]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.12.09 14:55:12 LOG5[6820:2144]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.12.09 14:55:12 LOG7[6820:2144]: Service imaps finished (0 left) 2011.12.09 14:55:12 LOG7[6820:2144]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) Wireshark Packet Trace (see attached image). What's wrong here? Shouldn't client and server negotiate the methods used? The client seems to offer TLS ("Version: TLS 1.0 ..."), but instead of negotiating, the server simply closes the connection. Greetings Markus Borst

1 0

NFS over sTunnel
by Elodie BOSSIER 08 Dec '11

08 Dec '11

Greetings again, I have a problem to mount a NFS share via my sTunnel. If i don't use the stunnel it's work : #mount -t nfs 188.165.214.229:/home /mnt/nfs/ #df -h [...] 188.165.214.229:/home 7.2T 12G 6.9T 1% /mnt/nfs #umount /mnt/nfs but if i use the stunnel client it's don't work : #mount -t nfs 127.0.0.1:/home /mnt/nfs/ (.......sleep....... and i need to ctrl+C to stop my command) The log into the serveur is : 2011.12.08 00:55:54 LOG7[12438:140256813074176]: nfs accepted FD=18 from 178.33.214.192:8671 2011.12.08 00:55:54 LOG7[12438:140256812631808]: nfs started 2011.12.08 00:55:54 LOG7[12438:140256812631808]: FD 18 in non-blocking mode 2011.12.08 00:55:54 LOG7[12438:140256812631808]: TCP_NODELAY option set on local socket 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Waiting for a libwrap process 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Acquired libwrap process #0 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Releasing libwrap process #0 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Released libwrap process #0 2011.12.08 00:55:54 LOG7[12438:140256812631808]: nfs permitted by libwrap from 178.33.214.192:8671 2011.12.08 00:55:54 LOG5[12438:140256812631808]: nfs accepted connection from 178.33.214.192:8671 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): before/accept initialization 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 read client hello A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 write server hello A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 write change cipher spec A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 write finished A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 flush data 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 read finished A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 1 items in the session cache 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 client connects (SSL_connect()) 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 client connects that finished 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 client renegotiations requested 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 12 server connects (SSL_accept()) 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 12 server connects that finished 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 server renegotiations requested 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 9 session cache hits 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 external session cache hits 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 session cache misses 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 1 session cache timeouts 2011.12.08 00:55:54 LOG6[12438:140256812631808]: SSL accepted: previous session reused 2011.12.08 00:55:54 LOG7[12438:140256812631808]: FD 19 in non-blocking mode 2011.12.08 00:55:54 LOG6[12438:140256812631808]: connect_blocking: connecting 127.0.0.1:2049 2011.12.08 00:55:54 LOG7[12438:140256812631808]: connect_blocking: s_poll_wait 127.0.0.1:2049: waiting 10 seconds 2011.12.08 00:55:54 LOG5[12438:140256812631808]: connect_blocking: connected 127.0.0.1:2049 2011.12.08 00:55:54 LOG5[12438:140256812631808]: nfs connected remote server from 127.0.0.1:51193 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Remote FD=19 initialized 2011.12.08 00:55:54 LOG7[12438:140256812631808]: TCP_NODELAY option set on remote socket ( my ctrl+C is here ) 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL alert (read): warning: close notify 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL closed on SSL_read 2011.12.08 00:56:58 LOG7[12438:140256812631808]: Socket write shutdown 2011.12.08 00:56:58 LOG7[12438:140256812631808]: Socket closed on read 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL write shutdown 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL alert (write): warning: close notify 2011.12.08 00:56:58 LOG6[12438:140256812631808]: SSL_shutdown successfully sent close_notify 2011.12.08 00:56:58 LOG5[12438:140256812631808]: Connection closed: 76 bytes sent to SSL, 164 bytes sent to socket 2011.12.08 00:56:58 LOG7[12438:140256812631808]: nfs finished (0 left) (End of the log server) My config client : [rquotad] accept = 1040 connect = 188.165.214.229:1041 [mountd] accept = 1048 connect = 188.165.214.229:1049 [nfs] accept = 2049 connect = 188.165.214.229:2050 [status] accept = 1039 connect = 188.165.214.229:1038 [portmapper] accept = 111 connect = 188.165.214.229:112 [nlockmgr] accept = 1047 connect = 188.165.214.229:1046 My config server : [rquotad] accept = 1041 connect = 1040 [mountd] accept = 1049 connect = 1048 [nfs] accept = 2050 connect = 2049 [status] accept = 1038 connect = 1039 [portmapper] accept = 112 connect = 111 [nlockmgr] accept = 1046 connect = 1047 Do you have an idea please ?

1 1

stunnel in client and server mode in same time
by Elodie BOSSIER 07 Dec '11

07 Dec '11

Greetings, I would like use stunnel in client & server mode but i don't find the way to do it, it's don't work My stunnel is a client of a remote MySQL server and a server of a NFS in local Do you have an idea please ?

4 3

FIPS_mode_set error
by Stefano Lodi 02 Dec '11

02 Dec '11

The problem referred to by Koenraad affects Windows 7 32 bit as well. Anyway fips=no fixes it.

2 1

FIPS on Win7
by james.poole＠rsa.com 01 Dec '11

01 Dec '11

It looks like there is a known issue with FIPS running on Windows 7 from the mail archives. Is there something I could do to help get this fixed? I was planning on using stunnel to allow a FIPS compliant transmission of data over the wire. Win7 - 32bit Output - From the console window: stunnel 4.49 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8r-fips 8 Feb 2011 Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match Old Thread: http://www.stunnel.org/pipermail/stunnel-users/2011-November/003374.html Thanks for any help, James

2 1

Key and Certificate file issue!
by Hamid.Shahid＠sungard.com 30 Nov '11

30 Nov '11

Hi, I am trying to establish a SSL connection with a remote server on a random port 10170. I have got a public key from the server side. And I have sent my public key to the server. And I am trying to use my certificate file and the public key of the server like this. cert = sunPrimary.pem key = sunStunnel.pem But the problem is both the public key from server and my own certificate file starts with "-----BEGIN CERTIFICATE-----" by default. So now, if I don't change the "-----BEGIN CERTIFICATE-----" header of the my certificate to "-----BEGIN PRIVATE KEY-----" I get errors and if I change it to private key and make the public key of the server as certificate then I still get errors. Please let me know, how can I use the key and certificate together. Thanks. Kind Regards, Hamid Shahid

2 3

Pop3, CAPA before STLS (allow stunnel to work with android devices using proto pop3 option).
by Anthony Morgan 30 Nov '11

30 Nov '11

Hi, I'm running a pop3 server on a non-standard port and having stunnel listen on both 110 and 995 like so: [pop3_ssl] accept = 995 connect = ... [pop3_tls] accept = 110 connect = ... protocol = pop3 When connecting from an android device (2.3 on Nexus S at least), it confirms the server supports STLS using CAPA (and seemingly will not configure otherwise), so I modified protocol.c to announce support: < fdputline(c, c->local_wfd.fd, "+OK Stunnel capability list follows"); < fdputline(c, c->local_wfd.fd, "STLS"); < fdputline(c, c->local_wfd.fd, "."); --- > fdputline(c, c->local_wfd.fd, "-ERR Stunnel does not support capabilities"); It seems to me that there is no harm in this, because the RFC states that the client MUST recheck the servers capabilities with another CAPA command after starting TLS. It may be better to check the servers actual capabilities, add STLS to them and return that, but this does work. Any thoughts or comments? Tony Morgan --- Sent from Post.fm

1 0

FIPS_mode_set error
by Koenraad Lelong 29 Nov '11

29 Nov '11

Hi, I have an application which uses stunnel. Using stunnel 4.25 everything works fine. If I replace this with stunnel 4.49, I get an error, see the log : No limit detected for the number of clients make_sockets: s_socket#1: FD=228 allocated (blocking mode) make_sockets: s_socket#2: FD=232 allocated (blocking mode) make_sockets: s_accept: FD=236 allocated (non-blocking mode) stunnel 4.49 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8r-fips 8 Feb 2011 Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match Server is down My stunnel.conf : cert = my.keycrt socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = certs CAfile = cacert.pem debug = 7 ; output = c:\Program Files\stunnel\stunnel.log client = yes [Server] accept = 6051 connect = server.example.com:8051 What am I doing wrong ? I'm trying this on Win7-64bit. On WinXP-32bit it works fine. Thanks for any clarification, Regards, Koenraad Lelong.

2 2

stunnel 4.49 released
by Michal Trojnara 28 Nov '11

28 Nov '11

Dear Users, I have released version 4.49 of stunnel. The ChangeLog entry: Version 4.49, 2011.11.28, urgency: MEDIUM: * Bugfixes - Missing Microsoft Visual C++ Redistributable (msvcr100.dll) required by FIPS-compliant OpenSSL library was added to the Windows installer. - A bug was fixed causing crashes on MacOS X and some other platforms. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.49.tar.gz: dcb0e1f21e9fcf56f4d67bc7a5a4ef8720845b61063a749953417db2616cb20d Best regards, Mike

1 0

Stunnel compilation issue on Mac OS X 10.5 powerpc
by Cedric Lor 28 Nov '11

28 Nov '11

Hi, I've been trying to compile stunner (4.47) on a power pc Mac OS X Leopard (OS X 10.5) platform after a manual update to openssl v.1.0.0.e ggc is version 4.0.1. I run into an error according to which there would be undefined symbols in stunnel-ctx.o (see make output below). I can't figure out to which feature stunner-ctx.o is related, whether I need this feature and how to disable it in ./configure if I don't need it. Please note that I managed to install stunner 4.46 via fink on the same machine (such fink install of stunnel required installing a specific instance of openssl (v.1.0.0.0.e) within fink). Would anyone be able to identify from the make output below whether the issue comes from stunnel or from my openssl manual install? Many thanks. Cedric Making all in src make all-am /bin/sh ../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c -o env.lo env.c libtool: compile: gcc -DHAVE_CONFIG_H -I. -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -fno-common -DPIC -o .libs/env.o mv -f .deps/env.Tpo .deps/env.Plo /bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wextra -Wno-long-long -pedantic -avoid-version -o libstunnel.la -rpath /usr/local/lib/stunnel env.lo -lz -ldl -lutil -lpthread -lwrap libtool: link: gcc -dynamiclib -Wl,-undefined -Wl,dynamic_lookup -o .libs/libstunnel.dylib .libs/env.o -lz -ldl -lutil -lpthread -lwrap -install_name /usr/local/lib/stunnel/libstunnel.dylib -Wl,-single_module libtool: link: dsymutil .libs/libstunnel.dylib || : libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c mv -f .deps/stunnel-str.Tpo .deps/stunnel-str.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-file.o -MD -MP -MF .deps/stunnel-file.Tpo -c -o stunnel-file.o `test -f 'file.c' || echo './'`file.c mv -f .deps/stunnel-file.Tpo .deps/stunnel-file.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-client.o -MD -MP -MF .deps/stunnel-client.Tpo -c -o stunnel-client.o `test -f 'client.c' || echo './'`client.c mv -f .deps/stunnel-client.Tpo .deps/stunnel-client.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-log.o -MD -MP -MF .deps/stunnel-log.Tpo -c -o stunnel-log.o `test -f 'log.c' || echo './'`log.c mv -f .deps/stunnel-log.Tpo .deps/stunnel-log.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-options.o -MD -MP -MF .deps/stunnel-options.Tpo -c -o stunnel-options.o `test -f 'options.c' || echo './'`options.c mv -f .deps/stunnel-options.Tpo .deps/stunnel-options.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-protocol.o -MD -MP -MF .deps/stunnel-protocol.Tpo -c -o stunnel-protocol.o `test -f 'protocol.c' || echo './'`protocol.c mv -f .deps/stunnel-protocol.Tpo .deps/stunnel-protocol.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-network.o -MD -MP -MF .deps/stunnel-network.Tpo -c -o stunnel-network.o `test -f 'network.c' || echo './'`network.c mv -f .deps/stunnel-network.Tpo .deps/stunnel-network.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-resolver.o -MD -MP -MF .deps/stunnel-resolver.Tpo -c -o stunnel-resolver.o `test -f 'resolver.c' || echo './'`resolver.c mv -f .deps/stunnel-resolver.Tpo .deps/stunnel-resolver.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ssl.o -MD -MP -MF .deps/stunnel-ssl.Tpo -c -o stunnel-ssl.o `test -f 'ssl.c' || echo './'`ssl.c mv -f .deps/stunnel-ssl.Tpo .deps/stunnel-ssl.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ctx.o -MD -MP -MF .deps/stunnel-ctx.Tpo -c -o stunnel-ctx.o `test -f 'ctx.c' || echo './'`ctx.c mv -f .deps/stunnel-ctx.Tpo .deps/stunnel-ctx.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-verify.o -MD -MP -MF .deps/stunnel-verify.Tpo -c -o stunnel-verify.o `test -f 'verify.c' || echo './'`verify.c mv -f .deps/stunnel-verify.Tpo .deps/stunnel-verify.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c mv -f .deps/stunnel-sthreads.Tpo .deps/stunnel-sthreads.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c stunnel.c: In function 'daemonize': stunnel.c:447: warning: 'daemon' is deprecated (declared at /usr/include/stdlib.h:283) stunnel.c: At top level: stunnel.c:70: warning: 'signal_pipe_redirect' declared 'static' but never defined mv -f .deps/stunnel-stunnel.Tpo .deps/stunnel-stunnel.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-pty.o -MD -MP -MF .deps/stunnel-pty.Tpo -c -o stunnel-pty.o `test -f 'pty.c' || echo './'`pty.c mv -f .deps/stunnel-pty.Tpo .deps/stunnel-pty.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-libwrap.o -MD -MP -MF .deps/stunnel-libwrap.Tpo -c -o stunnel-libwrap.o `test -f 'libwrap.c' || echo './'`libwrap.c mv -f .deps/stunnel-libwrap.Tpo .deps/stunnel-libwrap.Po /bin/sh ../libtool --tag=CC --mode=link gcc -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -lz -ldl -lutil -lpthread -lwrap libtool: link: gcc -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -lz -ldl -lutil -lpthread -lwrap -pthread Undefined symbols: "_EC_KEY_new_by_curve_name", referenced from: _context_init in stunnel-ctx.o "_SSL_get_servername", referenced from: _servername_cb in stunnel-ctx.o "_SSL_CTX_sess_set_get_cb", referenced from: _context_init in stunnel-ctx.o "_SSL_CTX_set_info_callback", referenced from: _context_init in stunnel-ctx.o "_BIO_set_flags", referenced from: _base64 in stunnel-protocol.o "_SSL_set_SSL_CTX", referenced from: _servername_cb in stunnel-ctx.o "_SSL_CTX_sess_set_new_cb", referenced from: _context_init in stunnel-ctx.o "_SSL_CTX_sess_set_remove_cb", referenced from: _context_init in stunnel-ctx.o "_EC_KEY_free", referenced from: _context_init in stunnel-ctx.o ld: symbol(s) not found collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[1]: *** [all] Error 2 make: *** [all-recursive] Error 1

2 3

Server is down
by Hamid.Shahid＠sungard.com 28 Nov '11

28 Nov '11

Hi, I am trying to connect to a remote SSL enabled server via stunnel. I am using a single file for key and certificate "sunStunnel.pem", just like the default "stunnel.pem" and I am getting following errors. Please let me know, what they mean and what should be done to resolve these? Note: I was able to telnet the machine, so server seems to be working. Thanks. ======= Config ======= debug = 7 output = stunnel.log cert = sunStunnel.pem [GPC-HOST] client = yes [syslog] accept = 127.0.0.1:2525 connect = <ip>:<port> ======= Log ======= No limit detected for the number of clients make_sockets: s_socket#1: FD=652 allocated (blocking mode) make_sockets: s_socket#2: FD=648 allocated (blocking mode) make_sockets: s_accept: FD=604 allocated (non-blocking mode) stunnel 4.47 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf Snagged 64 random bytes from C:/.rnd Wrote 1024 new random bytes to C:/.rnd PRNG seeded successfully Initializing SSL context for service GPC-HOST Certificate: sunStunnel.pem Certificate loaded Key file: sunStunnel.pem error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib error queue: D08303A: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error error queue: D06C03A: error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error SSL_CTX_use_PrivateKey_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag Server is down Kind Regards, Hamid Shahid

2 1

error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
by Hamid.Shahid＠sungard.com 28 Nov '11

28 Nov '11

Hi, I am trying to connect to a remote SSL enabled server via stunnel. I am using a single file for key and certificate "sunStunnel.pem", just like the default "stunnel.pem" and I am getting following errors. Please let me know, what they mean and what should be done to resolve these? Note: I was able to telnet the machine, so server seems to be working. Thanks. ======= Config ======= debug = 7 output = stunnel.log cert = sunStunnel.pem [GPC-HOST] client = yes [syslog] accept = 127.0.0.1:2525 connect = <ip>:<port> ======= Log ======= No limit detected for the number of clients make_sockets: s_socket#1: FD=652 allocated (blocking mode) make_sockets: s_socket#2: FD=648 allocated (blocking mode) make_sockets: s_accept: FD=604 allocated (non-blocking mode) stunnel 4.47 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf Snagged 64 random bytes from C:/.rnd Wrote 1024 new random bytes to C:/.rnd PRNG seeded successfully Initializing SSL context for service GPC-HOST Certificate: sunStunnel.pem Certificate loaded Key file: sunStunnel.pem error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib error queue: D08303A: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error error queue: D06C03A: error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error SSL_CTX_use_PrivateKey_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag Server is down Kind Regards, Hamid Shahid [cid:image001.gif@01CC6F01.EF535C90]<http://www.sungard.com/ten> Hamid Shahid * Integration Developer * Front Arena * Capital Markets * SunGard * Kungsbron 2, PO Box 70351, SE-107 24 Stockholm, Sweden * Tel +46 (0) 8 454 0167 * Direct +46 (0) 8 454 0167 * Mobile +46 (0) 76 869 2167 * hamid.shahid(a)sungard.com<mailto:ronny.andersson@sungard.com> * www.sungard.com<http://www.sungard.com/> Join SunGard's customers, partners and industry experts at www.sungard.com/ten<http://www.sungard.com/ten> to discuss how the need for more Transparency, Efficiency and Networks is changing our industry and to register for a city day event near you. VIENNA HOUSTON FRANKFURT BEIJING HONG KONG NEW YORK LONDON SEOUL ZURICH MUMBAI JOHANNESBURG DUBAI SAO PAULO CONFIDENTIALITY: This e-mail (including any attachments) may contain confidential, proprietary and privileged information, and unauthorized disclosure or use is prohibited. If you receive this e-mail in error, please notify the sender and delete this e-mail from your system.Thank you. P Please consider the environment before printing this e-mail.

1 0

stunnel 4.48 released
by Michal Trojnara 26 Nov '11

26 Nov '11

Dear Users, I have released version 4.48 of stunnel. The ChangeLog entry: Version 4.48, 2011.11.26, urgency: MEDIUM: * New features - FIPS support on Win32 platform added. OpenSSL 0.9.8r DLLs based on FIPS 1.2.3 canister are included with this version of stunnel. FIPS mode can be disabled with "fips = no" configuration file option. * Bugfixes - Fixed canary initialization problem on Win32 platform. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.48.tar.gz: 9fa723595726806cbf6547a2c453e695e33bf635f2d4771e80d110a06f27ea37 Best regards, Mike

1 0

stunnel & HAProxy : patch still required ?
by Thomas Manson 24 Nov '11

24 Nov '11

Hi, I'm willing to use this kind of configuration : https client -->stunnel --> haproxy --> 2 web servers in http (or more) I've understand that haproxy can't handle the ssl part, that's why stunnel is needed. I've read that a Patch is required for stunnel to work with haproxy in this kind of confirmation "I run stunnel 4.32 with patch from http://haproxy.1wt.eu/download/patches/ on port 443 and forward it to port 81 on the same machine which is bound to haproxy." Can anyone tell me if this patch is now included in stunnel, in particular, does Ubuntu 11.10 include it ? I really would rather stay with package provided by ubuntu in order to have easy upgrade/security fix. I've experiences the work overload of manually compiling everything in Apache for instance ;) Any advices on this kind of setup ? documentation pointers? best practices ? Regards, Thomas. here is the current package version on ubuntu 11.10 thomas@daisybox:~/Documents$ aptitude show stunnel4 Package: stunnel4 New: yes State: not installed Version: 3:4.35-2build1 Priority: optional Section: universe/net Maintainer: Ubuntu Developers <ubuntu-devel-discuss(a)lists.ubuntu.com> Uncompressed Size: 541 k Depends: libc6 (>= 2.11), libssl1.0.0 (>= 1.0.0), libwrap0 (>= 7.6-4~), openssl, netbase, perl-modules PreDepends: adduser Suggests: logcheck-database Conflicts: stunnel4 Breaks: stunnel (< 3:4.20-3), stunnel (< 3:4.20-3) Replaces: stunnel, stunnel Provides: stunnel Description: Universal SSL tunnel for network daemons The stunnel program is designed to work as SSL encryption wrapper between remote client and local (inetd-startable) or remote server. The concept is that having non-SSL aware daemons running on your system you can easily setup them to communicate with clients over secure SSL channel. stunnel can be used to add SSL functionality to commonly used inetd daemons like POP-2, POP-3 and IMAP servers without any changes in the programs' code. This package contains a wrapper script for compatibility with stunnel 3.x Homepage: http://www.stunnel.org/ thomas@daisybox:~/Documents$ aptitude show stunnel No current or candidate version found for stunnel Package: stunnel State: not a real package Provided by: stunnel4

2 1

Patch: Include source IP in connection failure log lines
by Alex Gottschalk 23 Nov '11

23 Nov '11

I'm setting up an internet-facing server that will be running a service wrapped with stunnel. Given that, it made sense to me to use fail2ban to block repeat connection attempts from clients who don't have the right certificate (the system is using client-certificate authentication). Unfortunately, stunnel4 doesn't put the client source IP in connection failure log lines, so I made this quick patch to enable that. ---cut here---- --- src/client.c.orig 2011-10-05 16:47:48.000000000 -0700 +++ src/client.c 2011-10-05 16:50:37.000000000 -0700 @@ -358,10 +358,13 @@ continue; } } - if(c->opt->option.client) + if(c->opt->option.client) { sslerror("SSL_connect"); - else - sslerror("SSL_accept"); + } else { + char buf[255]; + sprintf(buf, "SSL_accept from %s ", c->accepted_address); + sslerror(buf); + } longjmp(c->err, 1); } if(SSL_session_reused(c->ssl)) { ----cut here----

1 0

Getting Stunnel to work
by Brian Miller 21 Nov '11

21 Nov '11

Hello, I recently moved my Homeseer software from web server 08 to server 08. I had stunnel working on there properly to send out e mails using a hotmail account. I downloaded the new verison of Stunnel and tried to use the same config but Stunnel was crashing. Both versions web server 08 and server 08 are 64bit. Below is the original stunnel config file that I used on web server 08, this is cashing stunnel to crash when I run it. Using the default settings works, but I need to edit the config. I'm not to smart in the whole stunnel / Homeseer side of things. I was told by the Homeseer community that I need this to use my hotmail e mail to send e mails. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 110 connect = pop3.live.com:995 [imaps] accept = 993 connect = 143 [ssmtp] accept = 25 connect = smtp.live.com:587 protocol = smtp ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

1 0

stunnel 4.47 released
by Michal Trojnara 20 Nov '11

20 Nov '11

Dear Users, I have released version 4.47 of stunnel. This version includes a number of important bugfixes. The ChangeLog entry: Version 4.47, 2011.11.21, urgency: MEDIUM: * Internal improvements - CVE-2010-3864 workaround improved to check runtime version of OpenSSL rather than compiled version, and to allow OpenSSL 0.x.x >= 0.9.8p. - Encoding of man page sources changed to UTF-8. * Bugfixes - Handling of socket/SSL close in transfer() function was fixed. - Logging was modified to save and restore system error codes. - Option "service" was restricted to Unix, as since stunnel 4.42 it wasn't doing anything useful on Windows platform. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.47.tar.gz: 0b70f8bad8b6963e6154606571a83a3f0e0dea88d7dbd7e3b83cde5a07dd95ae Best regards, Mike

1 0

Re: [stunnel-users] expired certificate problem
by Rolf Ruediger 18 Nov '11

18 Nov '11

Yeah, great idea...now the log looks a little different: CRL: verification passed 2011.11.18 14:33:22 LOG5[2517:3077962608]: VERIFY OK: depth=2, /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only [...and so on...] But at the end, same as usual: 2011.11.18 14:33:22 LOG3[2517:3077962608]: SSL_connect: 14094415: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired 2011.11.18 14:33:22 LOG5[2517:3077962608]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Maybe there is another reason, why I cant connect? Maybe the lines 2011.11.18 14:33:22 LOG5[2517:3077962608]: connect_blocking: connected example.com:443 2011.11.18 14:33:22 LOG5[2517:3077962608]: https connected remote server from my_outsid_ip:38491 are messing something? -Rolf ________________________________ From: "josealf(a)rocketmail.com" <josealf(a)rocketmail.com> To: Rolf Ruediger <stunnel(a)ymail.com> Sent: Friday, November 18, 2011 2:18 PM Subject: Re: [stunnel-users] expired certificate problem Rolf, Try verify = 0 Regards -----Original Message----- From: Rolf Ruediger <stunnel(a)ymail.com> Sender: stunnel-users-bounces(a)stunnel.org Date: Fri, 18 Nov 2011 05:15:33 To: stunnel-users(a)stunnel.org<stunnel-users(a)stunnel.org> Reply-To: Rolf Ruediger <stunnel(a)ymail.com> Subject: Re: [stunnel-users] expired certificate problem _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

expired certificate problem
by Rolf Ruediger 18 Nov '11

18 Nov '11

Hello there! Some time ago I used stunnel to send the output of a homebrew logging script to a remote server. For a few weeks now, the sever has an expired certificate, so I get an error while connecting to it. The stunnel.log looks like that: 2011.11.18 12:23:36 LOG5[753:3078719168]: stunnel 4.29 on i486-pc-linux-gnu with OpenSSL 0.9.8o 01 Jun 2010 2011.11.18 12:23:36 LOG5[753:3078719168]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.11.18 12:23:36 LOG5[753:3078719168]: 500 clients allowed 2011.11.18 12:24:00 LOG5[759:3078716272]: https accepted connection from 127.0.0.1:40691 2011.11.18 12:24:00 LOG5[759:3078716272]: connect_blocking: connected example.com:443 2011.11.18 12:24:00 LOG5[759:3078716272]: https connected remote server from my_outside_ip:38486 2011.11.18 12:24:00 LOG3[759:3078716272]: SSL_connect: 14094415: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired 2011.11.18 12:24:00 LOG5[759:3078716272]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket This happens, when connecting manually with "nc -v 127.0.0.1 1234" to make a http-get request. To also provide the config file of my linux client: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/https.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration [https] accept = 127.0.0.1:1234 connect = example.com:443 TIMEOUTclose = 0 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 465 connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini So, the server is not under my control, where I am logging to. Is there a problem I don't see? I thought, that when I connect to localhost, the data should be forwarded to the https-server. Thanks in advance. -Rolf

2 2

[patch] x-forwarded-for patch for the new stunnel 4.46
by Michel Belleau 18 Nov '11

18 Nov '11

Hi. I use HAProxy and STunnel and I had to do a new installation lately. I took time to check the latest versions available of each product as this is a good time to test it out before production roll-out. I figured out that enough things have changed from STunnel version 4.44 to 4.46 making the X-Forwarded-For patch (that is usually used when STunnel sits in front of HAProxy) reject some parts of the latest 4.44 patch I found on the internet. Here is the patch, applying with no problems on 4.46, for anyone else interested: http://labs.malaiwah.com/stunnel-4.46-xforwarded-for.diff PS: I didn't try it yet for IPv6 connections yet. Michel Belleau

3 2

Re: [stunnel-users] FW: I can't get stunnel working : SSL3_GET_RECORD:wrong version number
by Michal Trojnara 17 Nov '11

17 Nov '11

The Guru wrote: > When I try to connect, > stunnel reports an error "wrong version number". [cut] > read from 0x4b5f98 [0x4cc0a0] (7 bytes => 7 (0x7)) > 0000 - 16 03 00 0d 01 02 ...... Your server reply protocol version is 3.0. You may wish to enable TLS on your server, or to specify: sslVersion = SSLv3 in your stunnel.conf. Best regards, Michal Trojnara

1 0

Multiple Windows Services
by John W 14 Nov '11

14 Nov '11

I upgraded from stunnel 4.34 to 4.46 (Windows) today, which took much more time than expected. First, I was surprised to see that my specified service name (via "service =" was ignored), until I eventually found the note in the 4.42 changelog about "Removed support for changing Windows Service name with "service"". This isn't the end of the world (I changed the display name using sc) but it would be very helpful -- and time saving -- if the man page was updated to reflect this change. A bigger issue I ran into is that because the service can't be renamed, I can have only one stunnel service installed. The only mention of this I found was a reply to a list question saying "Running more than one stunnel service has been obsoleted." What was the motivation behind this change? Though I can specify multiple [service] sections in stunnel.conf, I see no way to control them individually. It has been useful to have separate stunnel (Windows) services installed, which can be stopped and started independently. Thanks.

2 2

[PATCH]: Debugging output
by Andrew Watts 08 Nov '11

08 Nov '11

Hi. According to the manpage for the output=<file> configuration directive, if this is set then it should replace syslog facility logging. However, stunnel 4.45 (and ealier version) on linux send debugging information to both syslog and a logfile when output is specified. The following patch makes stunnel behave according to the manpage "append log messages to a file instead of using syslog": ==================================== --- a/src/log.c +++ b/src/log.c @@ -163,7 +163,7 @@ static void log_raw(const int level, con line=str_printf("%s %s: %s", stamp, id, text); if(level<=global_options.debug_level) { #if !defined(USE_WIN32) && !defined(__vms) - if(global_options.option.syslog) + if(global_options.option.syslog && !global_options.output_file) syslog(level, "%s: %s", id, text); #endif /* USE_WIN32, __vms */ if(outfile) ==================================== ~ Andy

2 2

Error detected on socket (read) file descriptor: Broken pipe (32)
by Alex Magee 08 Nov '11

08 Nov '11

Hello, I'm trying to use stunnel to workaround a wine bug which prevents an old Windows mail client from accessing my mail server through a pop3s 995 port. I'm not an expert on linux, stunnel, sockets or ssl. The process seems to start off well, establishes a connection to the correct remote mail server, and negotiates an ssl connection, but then terminates with: Error detected on socket (read) file descriptor: Broken pipe (32) I've played with various settings in the stunnel.conf file, but with no success. A Google search turned up one other example of this problem back in Nov 2010, but no solution was forthcoming. Does anyone have any suggestions of what might be the problem? The level 7 debug stunnel.log file follows at the end, with TCP addresses masked. The system is SUSE Linux 11.4. Using the latest versions of ssl and stunnel. Thanks, Alex stunnel.log -------------- local socket: FD=0 allocated (non-blocking mode) Service pmail-pop3 accepted FD=0 from 127.0.0.1:48828 Service pmail-pop3 started Option TCP_NODELAY set on local socket Service pmail-pop3 accepted connection from 127.0.0.1:48828 remote socket: FD=1 allocated (non-blocking mode) connect_blocking: connecting xxx.xxx.xxx.xxx:995 connect_blocking: s_poll_wait xxx.xxx.xxx.xxx:995: waiting 10 seconds connect_blocking: connected xxx.xxx.xxx.xxx:995 Service pmail-pop3 connected remote server from 192.168.1.47:46187 Remote FD=1 initialized Option TCP_NODELAY set on remote socket SNI: host name: yyy.yyy.yyy..com SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A SSL state (connect): SSLv3 read server certificate A SSL state (connect): SSLv3 read server done A SSL state (connect): SSLv3 write client key exchange A SSL state (connect): SSLv3 write change cipher spec A SSL state (connect): SSLv3 write finished A SSL state (connect): SSLv3 flush data SSL state (connect): SSLv3 read finished A 1 items in the session cache 1 client connects (SSL_connect()) 1 client connects that finished 0 client renegotiations requested 0 server connects (SSL_accept()) 0 server connects that finished 0 server renegotiations requested 0 session cache hits 0 external session cache hits 0 session cache misses 0 session cache timeouts SSL connected: new session negotiated Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 Socket closed on read Sending SSL write shutdown Error detected on socket (read) file descriptor: Broken pipe (32) Connection reset: 79 bytes sent to SSL, 64 bytes sent to socket Service pmail-pop3 finished (0 left) str_stats: 0 block(s), 0 byte(s)

2 2

stunnel 4.46 released
by Michal Trojnara 07 Nov '11

07 Nov '11

Dear Users, I have released version 4.46 of stunnel. The ChangeLog entry: Version 4.46, 2011.11.04, urgency: LOW: * New features - Added Unix socket support (e.g. "connect = /var/run/stunnel/ socket"). - Added "verify = 4" mode to ignore CA chain and only verify peer certificate. - Removed the limit of 16 IP addresses for a single 'connect' option. - Removed the limit of 256 stunnel.conf sections in PTHREAD threading model. It is still not possible have more than 63 sections on WIN32 platform. http://msdn.microsoft.com/en-us/library/windows/desktop/ms740141(v=vs.85).a… * Optimizations - Reduced per-connection memory usage. - Performed a major refactoring of internal data structures. Extensive internal testing was performed, but some regression bugs are expected. * Bugfixes - Fixed WIN32 compilation with Mingw32. - Fixed non-blocking API emulation layer in UCONTEXT threading model. - Fixed signal handling in UCONTEXT threading model. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.46.tar.gz: 8ea8943bdfcd74a2e66dc00d4ed17b402bbd39d040a125901534f6f4308da99d Best regards, Mike

2 1

Stunnel & Haproxy
by Christophe Rahier 03 Nov '11

03 Nov '11

Hi, I'd like to user Stunnel with Haproxy on a Debian Squeeze server. I downloaded these files: wget ftp://ftp.stunnel.org/stunnel/obsolete/4.x/stunnel-4.44.tar.gz wget http://haproxy.1wt.eu/download/patches/stunnel-4.44-xforwarded-for.diff I patch the file with patch -p1 < ../stunnel-4.44-xforwarded-for.dif After this, I try to "make". I've a lot of errors and I don't understand, I'm not a Linux guru! :-( Errors : Making all in src make[1]: Entering directory `/tmp/stunnel-4.44/src' make all-am make[2]: Entering directory `/tmp/stunnel-4.44/src' gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c In file included from str.c:38: common.h:383:19: error: lhash.h: No such file or directory common.h:384:17: error: ssl.h: No such file or directory common.h:386:20: error: crypto.h: No such file or directory common.h:387:17: error: md4.h: No such file or directory common.h:388:17: error: des.h: No such file or directory In file included from str.c:39: prototypes.h:117: error: expected specifier-qualifier-list before 'SSL_CTX' prototypes.h:368: error: expected specifier-qualifier-list before 'SSL' prototypes.h:391: warning: struct has no members prototypes.h:469: error: 'PEM_BUFSIZE' undeclared here (not in a function) str.c: In function 'str_canary': str.c:210: warning: implicit declaration of function 'RAND_bytes' str.c: In function 'str_stats': str.c:239: warning: format '%d' expects type 'int', but argument 3 has type 'size_t' str.c:239: warning: format '%d' expects type 'int', but argument 4 has type 'size_t' str.c:239: warning: format '%d' expects type 'int', but argument 5 has type 'long unsigned int' make[2]: *** [stunnel-str.o] Error 1 make[2]: Leaving directory `/tmp/stunnel-4.44/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/tmp/stunnel-4.44/src' make: *** [all-recursive] Error 1 Could you help me? Thanks for your help. Regards, Christophe

4 6

Why does verify=3 require the entire cert chain to be present in cafile?
by al_9x＠yahoo.com 03 Nov '11

03 Nov '11

If the leaf (server) cert is declared trusted (added to the cafile), there is no point in walking the trust chain.

5 15

[PATCH] Unix socket tunnelling
by Antoine Catton 02 Nov '11

02 Nov '11

Hi, I was looking for solution for tunneling a MySQL socket through encrypted IPv6. And I found this bunch of patches for stunnel <http://www.exceliance.fr/download/free/patches/stunnel/unix-sockets/>. Unfortunately, there's no patch for stunnel 4.44. So I rebased it in order to make it work (I attached it to this email). FYI, I’m not the author of this patch, I just adapted it for stunnel 4.44. The author seems to be this french company <http://www.exceliance.fr/en>. I just glanced over it, I didn't review it. Anyway, I think it would be a great thing to integrate it into stunnel in order to avoid rebasing the patch for every stunnel new version. Besides, it is a very useful feature. Integrating this patch would imply updating the documentation of stunnel configuration. As far as I know it add another general option “unix-sockets-dir” which is “/var/run/” by default. All the socket path must start by a slash, and this path will be appended to “unix-sockets-dir” option. Thank you. Regards, -- Antoine Catton Nexedi Intern

2 1

FD_MAX question
by Eckert, Doug 27 Oct '11

27 Oct '11

Greetings, We're using stunnel-4.15-2.el5.1 as provided on the RHEL 5 update 7 distro. Is there any way to override the FD_MAX setting (64 IIRC), perhaps as a stunnel.conf option? Doug Eckert Technical Architect Global Business & Technology Services Dow Jones | A News Corporation Company P.O. Box 300 | Princeton NJ 08543-0300 (W) 609.520.4993 (C) 732.666.3681 Email: doug.eckert(a)dowjones.com<mailto:alias@dowjones.com> [cid:image001.png@01CC93D6.2E9FF0E0]

3 4

Re: [stunnel-users] Why does verify=3 require the entire cert chain to be present in cafile?
by Jochen Bern 26 Oct '11

26 Oct '11

On 10/25/2011 09:54 PM, al_9x(a)yahoo.com wrote: > verify=3 means checking is done against local certs. My point is that > if the actual server cert is stored locally (i.e. trusted) that should > be enough. When I put just the server cert in cafile validation (and > connection) fails, but when I put the whole chain, it succeeds. Why > isn't the server cert sufficient? Mostly guessing here, but: 1. stunnel uses the OpenSSL libraries. The verify(1) manpage says: "The verify program uses the same functions as the internal SSL and S/MIME verification, therefore this description applies to these verify operations too. [...] The verify operation consists of a number of separate steps. Firstly a certificate chain is built up starting from the supplied certificate and ending in the root CA. It is an error if the whole chain cannot be built up. The chain is built up by looking up the issuers certificate of the current certificate. If a certificate is found which is its own issuer it is assumed to be the root CA." -- http://www.openssl.org/docs/apps/verify.html#VERIFY_OPERATION So I'd guess that the algorithm you're at odds with is part of OpenSSL, rather than something stunnel can change. 2. Certificates are to be considered invalid once they have been revoked, and in order to check the CRL, you have to determine the issuing CA. Whose certificate has to be checked against its parent CA, etc. all the way to the Root CA. A "verification" mechanism which does not check for explicit revocation would have to be considered faulty for *most*, if not all, application cases - the fact that automated CRL checking is still pretty much absent in mechanisms which do not *mandate* a working Internet connection notwithstanding. 3. Since you're apparently trying to set up a point-to-point SSL connection with preconfigured direct trust, my guess would be that you'd be better off if the server would use a self-signed cert (either altogether, or in addition to the current one - say, on an additional port). However, since you never mentioned what kind of software you're trying to get to talk to each other, I'm at a loss suggesting *how* you might do that. Regards, J. Bern -- Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

2 2

Re: [stunnel-users] Why does verify=3 require the entire cert chain to be present in cafile?
by Jean-Yves F. Barbier 26 Oct '11

26 Oct '11

On Tue, 25 Oct 2011 15:54:26 -0400 al_9x(a)yahoo.com wrote: ... > verify=3 means checking is done against local certs. My point is that > if the actual server cert is stored locally (i.e. trusted) that should > be enough. When I put just the server cert in cafile validation (and > connection) fails, but when I put the whole chain, it succeeds. Why > isn't the server cert sufficient? Because the SVR cert is used to signed your own cert, this ensure liability between svr & cli; and if it was only the SVR cert, how could you revoke client by client? You would be obliged to revoke all clients at once - which doesn't look like a very good strategy if you've got 1000's of clients... -- You will be dead within a year.

3 2

stunnel 4.45 released
by Michal Trojnara 24 Oct '11

24 Oct '11

Dear Users, I have released version 4.45 of stunnel. The ChangeLog entry: Version 4.45, 2011.10.24, urgency: LOW: * New features - "protocol = proxy" support to send original client IP address to haproxy: http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt This requires accept-proxy bind option of haproxy 1.5-dev3 or later. - Added Win32 configuration reload without a valid configuration loaded. - Added compatibility with LTS OpenSSL versions 0.9.6 and 0.9.7. Some features are only available in OpenSSL 1.0.0 and later. * Performance optimizations - Use SSL_MODE_RELEASE_BUFFERS if supported by the OpenSSL library. - Libwrap helper processes are no longer started if libwrap is disabled in all sections of the configuration file. * Internal improvements - Protocol negotiation framework was rewritten to support additional code to be executed after SSL_accept()/SSL_connect(). - Handling of memory allocation errors was rewritten to gracefully terminate the process (thx to regenrecht for the idea). * Bugfixes - Fixed -l option handling in stunnel3 script (thx to Kai Gülzau). - Script to build default stunnel.pem was fixed (thx to Sebastian Kayser). - MinGW compilation script (mingw.mak) was fixed (thx to Jose Alf). - MSVC compilation script (vc.mak) was fixed. - A number of problems in WINSOCK error handling were fixed. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.45.tar.gz: cbce8279c1ba7a07bfefeb2e477f682bfd326519f8a7ed296e35210599898a2d Best regards, Mike

1 0

Check IP or Name of Client Or Server by Common Name
by Tigran Petrosyan 21 Oct '11

21 Oct '11

Hi all, I have made patch for stunnel-4.43. It helps you to switch on in the file of stunnell.conf new features, the option name is verify_peer. you can read more about it after patching, compiling and running the command "stunnel --help". The goal of this option to verify clients or servers "ip addreses or names of ip-addreses" with "Common name" of certificate. This option is very flexible and usable. It's possible to switch it of or use it as in field of global options and in service-level options. verify_peer = client_name | client_ip | remote_name | remote_ip -- Tigran Petrosyan

1 0

Attempting to debug slow stunnel connections
by Lamont Lucas 21 Oct '11

21 Oct '11

Hello stunnel-users, I've recently setup stunnel in front of haproxy to handle SSL connections. While it worked fine in testing, my simplistic benchmarks showed it unable to do more than 9 req/s, and as we turned some production traffic on, it appears that threads and connections quickly pile up and eventually timing out. I assume I've made some error in configuration, or there is something odd with my setup, as it appears stunnel has been benchmarked and performs well beyond what we're attempting here. I've read the FAQ and as much from the mailing list archives as I thought applicable, and I was unable to see any red flags or errors similar to what I'm seeing. If you don't mind, I'd like some help debugging the issue or pointers as to what else I could do to debug the issue. I've included details about my compile and configuration as well as the edited startup section from the debug (7) log. I compiled stunnel 4.44 with ./configure --disable-ipv6 --disable-libwrap --disable-fips. It's running on a different box than where it was compiled, but both machines should be identical. openssl version -a OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 built on: Thu Sep 3 14:22:06 EDT 2009 platform: linux-x86_64 options: bn(64,64) md2(int) rc4(ptr,int) des(idx,cisc,16,int) blowfish(ptr2) compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -I/usr/kerberos/include -DL_ENDIAN -DTERMIO -WallM OPENSSLDIR: "/etc/pki/tls" engines: dynamic stunnel.4.44 -version stunnel 4.44 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL,IPv4 Global options: debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 session = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Here's my configuration file: sslVersion = all ciphers = RC4-MD5:HIGH:!aNULL:!SSLv2 options = NO_SSLv2 setuid = root setgid = haproxy pid = /var/run/stunnel.pid #socket = l:TCP_NODELAY=1 #socket = r:TCP_NODELAY=1 output = /var/log/stunnel.log debug = 7 [XXX] CAfile = /etc/stunnel/ca_chain.crt cert = /etc/stunnel/XXX.crt key = /etc/stunnel/XXX.key accept = 443 connect = 127.0.0.1:81 #xforwardedfor = yes #TIMEOUTclose = 5 #TIMEOUTbusy = 2 #TIMEOUTconnect = 2 #TIMEOUTidle = 2 (I was previously running 4.32 with the xforwardedfor patch, but to eliminate potential issues I've upgraded to the latest version, running stock without the patch, hence the commented out xforwardedfor option) here's the startup: 2011.10.01 12:18:38 LOG7[21868:47602610340864]: No limit detected for the number of clients 2011.10.01 12:18:38 LOG7[21868:47602610340864]: signal_pipe: FD=3 allocated (non-blocking mode) 2011.10.01 12:18:38 LOG7[21868:47602610340864]: signal_pipe: FD=4 allocated (non-blocking mode) 2011.10.01 12:18:38 LOG5[21868:47602610340864]: stunnel 4.44 on x86_64-unknown-linux-gnu platform 2011.10.01 12:18:38 LOG5[21868:47602610340864]: Compiled/running with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 2011.10.01 12:18:38 LOG5[21868:47602610340864]: Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL,IPv4 2011.10.01 12:18:38 LOG5[21868:47602610340864]: Reading configuration from file /etc/stunnel/stunnel.conf 2011.10.01 12:18:38 LOG7[21868:47602610340864]: PRNG seeded successfully 2011.10.01 12:18:38 LOG6[21868:47602610340864]: Initializing SSL context for service XXX 2011.10.01 12:18:38 LOG4[21868:47602610340864]: Insecure file permissions on /etc/stunnel/XXX.key 2011.10.01 12:18:38 LOG7[21868:47602610340864]: Certificate: /etc/stunnel/XXX.crt 2011.10.01 12:18:38 LOG7[21868:47602610340864]: Certificate loaded 2011.10.01 12:18:38 LOG7[21868:47602610340864]: Key file: /etc/stunnel/XXX.key 2011.10.01 12:18:38 LOG7[21868:47602610340864]: Private key loaded 2011.10.01 12:18:38 LOG7[21868:47602610340864]: Could not load DH parameters from /etc/stunnel/XXX.crt 2011.10.01 12:18:38 LOG7[21868:47602610340864]: Using hardcoded DH parameters 2011.10.01 12:18:38 LOG7[21868:47602610340864]: DH initialized with 2048-bit key 2011.10.01 12:18:38 LOG7[21868:47602610340864]: SSL options set: 0x01000000 2011.10.01 12:18:38 LOG6[21868:47602610340864]: SSL context initialized 2011.10.01 12:18:38 LOG5[21868:47602610340864]: Configuration successful Later, I see logs more or less like this: 2011.10.01 12:41:44 LOG7[29902:1108293952]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) 2011.10.01 12:41:43 LOG7[29902:1116580160]: Service XXX started 2011.10.01 12:41:44 LOG7[29902:1116580160]: Option TCP_NODELAY set on local socket 2011.10.01 12:41:44 LOG5[29902:1116580160]: Service XXX accepted connection from YYY1:50059 2011.10.01 12:41:44 LOG7[29902:1108363584]: SSL state (accept): SSLv3 write server done A 2011.10.01 12:41:43 LOG7[29902:47056920704000]: local socket: FD=184 allocated (non-blocking mode) 2011.10.01 12:41:44 LOG7[29902:1108363584]: SSL state (accept): SSLv3 flush data 2011.10.01 12:41:44 LOG7[29902:47056920704000]: Service XXX accepted FD=184 from YYY2:58131 2011.10.01 12:41:44 LOG3[29902:1108363584]: SSL_accept: Peer suddenly disconnected 2011.10.01 12:41:44 LOG7[29902:1108433216]: SSL state (accept): before/accept initialization 2011.10.01 12:41:44 LOG7[29902:47056920704000]: local socket: FD=11 allocated (non-blocking mode) 2011.10.01 12:41:44 LOG7[29902:47056920704000]: Service XXX accepted FD=11 from YYY3:49309 2011.10.01 12:41:44 LOG5[29902:1108363584]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.10.01 12:41:44 LOG7[29902:1108363584]: Service XXX finished (173 left) I see the thread count steadily increase: # ps -eLf |grep stun |wc -l 513 later: # ps -eLf |grep stun |wc -l 1020 (the FD ulimit for this proces is only 1024 currently, but that does not appear to be the limiting factor yet) It's almost like stunnel is only processing one connection at a time to the local destination port, which causes stunnel to build up a pile of waiting connections and eventually they start timing out. I've verified with nc and some local tests that the 127.0.0.1:81 port is picking up connections even under load, so I don't believe the issue is on the haproxy side. The firewall is set to allow all localhost connections and the 443 ports are configured the same as the port 80 ports which do hundreds of reqs a second, further ruling out firewall issues. Is there any setting I'm missing that would or wouldn't allow stunnel to process connect calls in parallel? Is there any additional debug information I can provide? Thank you for your time.

2 1

"connect_blocking"
by Maroon Brinks 21 Oct '11

21 Oct '11

Hi Everyone, I was hoping you could help. I cannot for the life of me get my program to connect through stunnel to this ip address. It appears to connect to stunnel just fine, however I constantly recieve: "connect_blocking" and I've found it very very hard to find information on the internet about this error. Here is the log output below followed by my configuration file: ####LOG#### 2011.10.19 09:49:56 LOG7[28234:139956427736816]: local socket: FD=8 allocated (non-blocking mode) 2011.10.19 09:49:56 LOG7[28234:139956427736816]: Service bgcssl accepted FD=8 from 127.0.0.1:58178 2011.10.19 09:49:56 LOG7[28234:139956427839760]: Service bgcssl started 2011.10.19 09:49:56 LOG7[28234:139956427839760]: Option TCP_NODELAY set on local socket 2011.10.19 09:49:56 LOG5[28234:139956427839760]: Service bgcssl accepted connection from 127.0.0.1:58178 2011.10.19 09:49:56 LOG7[28234:139956427839760]: remote socket: FD=9 allocated (non-blocking mode) 2011.10.19 09:49:56 LOG6[28234:139956427839760]: connect_blocking: connecting 148.106.128.90:7631 2011.10.19 09:49:56 LOG7[28234:139956427839760]: connect_blocking: s_poll_wait 148.106.128.90:7631: waiting 10 seconds 2011.10.19 09:50:06 LOG3[28234:139956427839760]: connect_blocking: s_poll_wait 148.106.128.90:7631: TIMEOUTconnect exceeded 2011.10.19 09:50:06 LOG5[28234:139956427839760]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.10.19 09:50:06 LOG7[28234:139956427839760]: Service bgcssl finished (0 left) 2011.10.19 09:50:06 LOG7[28234:139956427839760]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) ####CONFIG FILE#### ; stunnel.conf pid = /home/stunnel/bin/stunnel.pid ;setuid = nobody ;setgid = nobody foreground = yes sslVersion = TLSv1 service = stunnel client = yes debug = 7 output = stunnel.log [bgcssl] client = yes accept = 127.0.0.1:12347 connect = 148.106.128.90:7631 Any help would be greatly appreciated. Regards, Mark

2 1

Indirect CRL Support
by Sligar, Benjamin 21 Oct '11

21 Oct '11

I have been working, over the past few weeks, with one of my developers, attempting to support Indirect CRL's through OpenSSL/Stunnel. My initial attempts were to support direct CRL, which seems to work fine with the compile options I've listed below for both OpenSSL and Stunnel. ./config --prefix=/u/publish/dev/openssl/openssl-1.0.0d no-idea no-mdc2 no-rc5 no-md2 no-sse2 ./configure --prefix=/usr/local/stunnel-4.44/ --with-ssl=/usr/local/openssl-1.0.0d/ Reading through the FAQ and general documentation, I'm not finding much useful information on how to enable iCRL support. It may be a simple compile option I'm missing, or perhaps I just didn't find the correct page on the site/documentation, yet. If anyone has any useful information, or can point me in the right direction, the help would be greatly appreciated. I can provide configuration files and logs if it's of any use in this. Thank you in advance for any help you may be able to provide! My search continues.... ************************* Benjamin Sligar Manager, Development Support P: 703.453.8324 US_DEV_Support(a)tnsi.com ************************* This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

NETBIOS over stunnel
by Ronald RiemVis 18 Oct '11

18 Oct '11

Dear all, Stunnel work with all kind of other connections on both side but can't get working the NETBIOS negotiation with the net use command. send like: net use q: \\10.0.0.1\name password /user:username does not work when use net use q: \\10.0.0.1\name /user:username I get the question about password.At the end also will fail Because an ISP blocked all traffic over port 139 and my friend want to attach my external LAN drive (my book live) I need to redirect ports including the netbios protocol. I want: from a local loopback network adapter with IP address 10.0.0.1 port 139 to an external adddres port 1000 This is the configuration on the site where the my book live is connected: client = yes [MyBook] accept = 10.56.10.100:1000 (is my local address) connect = 10.56.10.10:139 (address of the my book live device) On the other side is the coinfiguration: client = yes [MyBook] accept = 10.0.0.1:139 (loopback addapter address) connect = remote address:1000 (external address) What can I do more to let it work? Greetings, Ronald

2 1

default ciphers in stunnel 4.43 vs. stunnel 4.33
by Brian Peterson 14 Oct '11

14 Oct '11

Hello, I recently upgraded stunnel from 4.33 to 4.43 and immediately noticed problems with a particular client trying to connect to my servers. It appears that the client only supports SSLv2 (about which I will be talking to the client developers). In reviewing the stunnel release notes, I find that "!SSLv2" was first added to the default ciphers value in 4.37 and was retained in the default ciphers value in 4.40. What I am trying to find out at this point is what the default cipher list would have been under 4.33. I have grep'd the sources and found STUNNEL_CIPHER_LIST in options.c for 4.43, but there is no corresponding default ciphers config in 4.33. It *appears* that 4.33 is inheriting its default ciphers from whatever the installed OpenSSL uses by default. Is that correct? If I set ciphers to "ALL" under 4.43 would the running stunnel be using the same cipher list as the 4.33 build we were running previously? Thanks, Brian P.S. - No need to discuss the wisdom of our cipher list at the moment... I just want to get this client functioning and then worry about The Right Thing To Do.

1 0

Why 6 processes for single client-mode service configuration?
by Grant Edwards 12 Oct '11

12 Oct '11

I'm configuring stunnel to encrypt a single client-mode connection: client = yes foreground = yes syslog = yes pid = [stunnel-localhost] accept = localhost:4608 connect = localhost:4606 Why does that result in _six_ stunnel processes? [one parent and 5 children]? It's going to look a ridiculous if I have four instances like that configured and end up with _24_ stunnel processes. I can see two processes (one for data flowing in each direction) but six seems way overboard. -- Grant Edwards grant.b.edwards Yow! I feel like a wet at parking meter on Darvon! gmail.com

3 7

Stunnel 4.44 sendproxy patch
by Mark Janssen 11 Oct '11

11 Oct '11

Hi, I've updated the sendproxy patch from (http://haproxy.1wt.eu/ and http://haproxy.1wt.eu/download/patches/stunnel-4.33-exceliance-aloha-sendpr…) to stunnel 4.44 I'd appreciate it if this patch would be included in stunnel proper. -- Mark Janssen -- maniac(at)maniac.nl Unix / Linux Open-Source and Internet Consultant Maniac.nl Sig-IO.nl Vps.Stoned-IT.com

1 0

stunnel 4.35 hangs on slackware64 13.37
by crocket 11 Oct '11

11 Oct '11

If I rotate stunnel logs with logrotate and have logrotate send SIGUSR1 signal to stunnel, stunnel doesn't close and reopen a new log and hangs. If I rotate stunnel logs and have logrotate send SIGHUP to stunnel, stunnel writes two lines to a new log but hangs after then. It could be a CPU problem because my D525 ATOM CPU had a problematic history with other programs. But I'm not sure of this. Can anybody else reproduce the problem?

1 1

problem with configure
by JOSE 05 Oct '11

05 Oct '11

I am trying to compile /stunnel-4.04 and I am having this problem with the configure exiting because opf something it can not set bash-3.2# export LD_LIBRARY_PATH=/lib/:/usr/lib/:/usr/local/lib/:/usr/local/lib/hpux32/:/usr/local/include/:/opt/gtk2.6/lib/:/opt/openssl/0.9.8/lib/ bash-3.2# ./configure checking for a BSD-compatible install... auto/install-sh -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking build system type... ia64-hp-hpux11.31 checking host system type... ia64-hp-hpux11.31 checking for gcc... no checking for cc... cc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... no checking whether cc accepts -g... yes checking for a BSD-compatible install... auto/install-sh -c checking whether make sets ${MAKE}... (cached) yes checking for non-GNU ld... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... no checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -p checking whether ln -s works... yes checking how to recognise dependant libraries... file_magic (s[0-9][0-9][0-9]|PA-RISC[0-9].[0-9]) shared library checking command to parse /usr/bin/nm -p output... ok checking how to run the C preprocessor... cc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... ranlib checking for strip... strip checking for objdir... .libs checking for cc option to produce PIC... +Z checking if cc PIC flag +Z works... yes checking if cc static flag -Wl,-a -Wl,archive works... no checking if cc supports -c -o file.o... no checking if we can lock with hard links... yes checking whether the linker (/usr/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... relink checking whether stripping libraries is possible... no checking dynamic linker characteristics... hpux11.31 dld.sl checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no creating libtool checking for SSL directory... /usr checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... no checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... no checking whether to use the libwrap (TCP wrappers) library... (default) checking for hosts_access in -lwrap... yes checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... no checking for _getpty... no checking for daemon... no checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for unsigned char... yes checking size of unsigned char... configure: error: cannot compute sizeof (unsigned char), 77 I've been reading around and this seems to be a problem with libiconv, but I have it installed, I have attached the configure.log for review bash-3.2# swlist -l product|grep -i lib Libiconv 1.6.1.16 Libiconv - Character set conversion library libiconv 1.12 libiconv I dont wkat else is missing, I am running this on HP-UX 11.31, I would appreciate in advance any help or hints, thanks folks Jose

1 0

Windows 7 64-bit
by Tracy Drake (QI-C) 02 Oct '11

02 Oct '11

Quick inquiry from a Stunnel dummie [?] Can you point me to any doc on compatibility of Stunnel with Windows 7 64-bit? Any particular version required? Any/all feedback is appreciated. -- Tracy Drake BI Senior Consultant GSA-FAS FAME Contractor URSA Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

1 0

stunnel.exe stops connecting
by Mike Brazil 27 Sep '11

27 Sep '11

I'm running stunnel 4.44 for both POP3 and SMTP with my email client, Outlook Express, and my Spam filter, Cactus Spam. The OS is Win XP SP3. I have added the following to stunnel.conf: client = yes debug = debug [pop3s] accept = 127.0.0.1:11010 connect = camel.arvixe.com:995 [ssmtp] accept = 25 connect = camel.arvixe.com:465 Other than adding those lines, I've not changed anything in the rest of stunnel.conf as it comes with the program. When I boot the computer, Outlook Express, Cactus Spam, and stunnel all start and function correctly. However, after a period of time (a few hours -- I haven't yet pinned down whether there is a specific length to the time period), something goes wrong with stunnel, in that it stops communicating with Outlook Express, and it's CPU usage goes up to 25% (quad-core Intel CPU) and stays at that level indefinitely until I terminate the process. It is only the stunnel.exe process that is affected -- the service continues to run without error. I then restart stunnel.exe, and it works normally once again for a few hours. I usually become aware that stunnel has stopped connecting with Outlook Express when I come back to the computer after a few hours away from it, so I have so far been unable to see whether anything observable occurs when it gets into trouble or whether the length of time it ran properly varies or is constant. -- Mike Brazil mike(a)milibra.net

1 0

stunnel 4.44 - tools/Makefile $(ssldir) vs $(SSLDIR)
by Sebastian Kayser 27 Sep '11

27 Sep '11

Hi, I am building a recent stunnel version for Solaris via opencsw.org and with 4.44 it seems as if --with-ssl is used to AC_SUBST([SSLDIR]), yet tools/Makefile uses lowercase $(ssldir). Lead to an empty expansion and failed calls to openssl in my case. $ grep -i ssldir Makefile tools/Makefile Makefile:SSLDIR = /opt/csw tools/Makefile:SSLDIR = /opt/csw tools/Makefile:openssl = $(ssldir)/bin/openssl Sebastian

1 0

Certificates
by Cary Corse 17 Sep '11

17 Sep '11

I'm trying to use stunnel to connect to a secure server for syslogging. I have a certificate from the central logging server. How do I load this into stunnel so that I can connect? Cheers and thanks Cary

4 4

stunnel 4.44 released
by Michal Trojnara 17 Sep '11

17 Sep '11

Dear Users, I have released version 4.44 of stunnel. The ChangeLog entry: Version 4.44, 2011.09.17, urgency: MEDIUM: * New features - Major automake/autoconf cleanup. - Heap buffer overflow protection with canaries. - Stack buffer overflow protection with -fstack-protector. * Bugfixes - Fixed garbled error messages on errors with setuid/setgid options. - SNI fixes (thx to Alexey Drozdov). - Use after free in fdprintf() (thx to Alexey Drozdov). This issue might cause GPF with "protocol" or "ident" options. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.44.tar.gz: fa0dfc33f323abfbc94aa993d90d37481cd2f652ee93ec2f8c333ac7a496c7b9 Best regards, Mike

1 0

Goldmine 6.7 behind a Server
by Blake Miller 16 Sep '11

16 Sep '11

We are planning to transition our email service to Google Apps with our Goldmine 6.7 Corporate Edition so need to use Stunnel. We have Goldmine setup and run from a central Server and a shared/networked drive F: Each client machine runs Goldmine, BUT via the server path noted earlier. When logged in locally to the server and running Goldmine locally, everything works great. Stunnel is connected, we're able to send/receive email, etc. However from a remote machine, it doesn't work. Have tried installing stunnel on the local machine. Have tried accessing the said ports via the Server's IP address from within the network. And have hacked around different config setups without luck. Being a NOOB with Stunnel, we're at a loss with further configuration without literally 'hacking around' in the dark any further. Our config file is just below Thanks in advance. Blake ; **************************************************************************** * ; * Global Options * ; **************************************************************************** * ; Debugging stuff (may useful for troubleshooting) debug = 7 output = stunnel.log ; **************************************************************************** * ; * Service Defaults (may also be specified in individual service sections) * ; **************************************************************************** * ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; The following options provide additional security at some performance penalty ; Default ECDH/DH parameters are strong/conservative, so it is quite safe to ; comment out these lines in order to get a performance boost options = SINGLE_ECDH_USE options = SINGLE_DH_USE ; **************************************************************************** * ; * Service Definitions (at least one service has to be defined) * ; **************************************************************************** * ; Example SSL server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ; Example SSL client mode services [gmail-pop3] client = yes accept = 127.0.0.1:9995 connect = pop.gmail.com:995 [gmail-smtp] client = yes accept = 127.0.0.1:4465 connect = smtp.gmail.com:465 ;[gmail-imap] ;client = yes ;accept = 127.0.0.1:143 ;connect = imap.gmail.com:993 ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem

3 4

stunnel claims it needs certificate
by JOSE 14 Sep '11

14 Sep '11

Hi I am trying to get stunnel stunnel 4.36 on ia64-hp-hpux11.23 with OpenSSL 0.9.8o 01 Jun 2010 working on this server and so far I have generated a new pem file as per the instructions, but it is the time to make to run, it keeps looking for a certificate for one of the services: bash-3.2# /opt/iexpress/stunnel/bin/stunnel /opt/iexpress/stunnel/etc/stunnel/stunnel.conf Reading configuration from file /opt/iexpress/stunnel/etc/stunnel/stunnel.conf Snagged 64 random bytes from /opt/iexpress/stunnel/etc/stunnel/stunnel.rnd Wrote 1024 new random bytes to /opt/iexpress/stunnel/etc/stunnel/stunnel.rnd PRNG seeded successfully Line 37: End of section revnet_preprod_sunquest: SSL server needs a certificate my conf file is as follows: bash-3.2# more /opt/iexpress/stunnel/etc/stunnel/stunnel.conf # Sample stunnel configuration file #RNDfile=/opt/hpws/apache/stunnel/.stunnel.rnd RNDfile=/opt/iexpress/stunnel/etc/stunnel/stunnel.rnd # Chroot #chroot = /var/chroot/stunnel/ # PID is created inside chroot jail #pid = /opt/hpws/apache/logs/stunnel.pid pid = /opt/iexpress/stunnel/etc/stunnel/stunnel.pid # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Client Authentication #verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: #CAfile = /opt/hpws/apache/conf/certs.pem # Some debugging stuff debug = 7 output = /opt/hpws/apache/logs/stunnel.log # Use in client mode client = no # Run in the background foreground = no # Service-level configuration [revnet_preprod_sunquest] accept = 10.99.10.37:8011 connect = 127.0.0.1:18011 #connect = 18011 [revnet_preprod_funsun] accept = 10.99.10.37:8017 connect = 127.0.0.1:18017 #connect = 18017 any help or tips would be welcome Thanks Jose

2 2

netword.c & fdprintf access access violation fix
by Alexey Drozdov 12 Sep '11

12 Sep '11

Hi, all One more bug was found out at work stunnel through a proxy. There is a reference to already released memory in fdprintf function. Here a small fix of this situation: *** network.c 2011-09-07 20:46:19.000000000 +0400 --- network.c_patch 2011-09-12 23:52:46.015618574 +0400 *************** *** 766,771 **** --- 766,772 ---- int fdprintf(CLI *c, int fd, const char *format, ...) { va_list ap; char *line; + int outsize; va_start(ap, format); line=str_vprintf(format, ap); *************** *** 775,782 **** longjmp(c->err, 1); } fdputline(c, fd, line); str_free(line); ! return strlen(line)+2; } #define INET_SOCKET_PAIR --- 776,784 ---- longjmp(c->err, 1); } fdputline(c, fd, line); + outsize = strlen(line)+2; str_free(line); ! return outsize; } #define INET_SOCKET_PAIR / Alexey Drozdov

1 0

SNI and some troubles solving
by Alexey Drozdov 10 Sep '11

10 Sep '11

Hi All, At first I would like to thank Marzena Trojnara for the useful program! Occurrence of support SNI has especially interest. I have decided to use the given possibility, but have detect pair of bugs which has independently successfully solved. To begin with I dump part of my config: [virtual_server] accept = 443 connect = localhost:1081 cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key ; need peer verification for default access verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt ; use restricted access form some target services [socks5] sni = virtual_server:localhost sni = virtual_server:89.250.5.185 sni = virtual_server:127.0.0.1 sni = virtual_server:server cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt connect = localhost:1081 ; public service [dreamhub_ru] sni = virtual_server:dreamhub.ru sni = virtual_server:pad.dreamhub.ru cert = /usr/local/etc/stunnel/dreamhub.cer key = /usr/local/etc/stunnel/dreamhub.pem connect = localhost:80 I want to use stunnel on 443rd port for ssl-socks5 service with peer certificates verification and use public https web-service (https://dreamhub.ru). And so it has appeared that value for "verify" are always used from global section (in my case [virtual_server]), and values of "verify" parameters from virtual services sections aren't used. Problem it has appeared that in the SNI check callback static int servername_cb(SSL *ssl, int *ad, void *arg) ... for(list=section->servername_list_head; list; list=list->next) if(!strcasecmp(servername, list->servername)) { c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); SSL_set_SSL_CTX(ssl, c->opt->ctx); does not copy ctx->verify_mode (SSL*)s->verify_mode=ctx->verify_mode; It has been solved by explicit calling SSL_set_verify *** ctx.c 2011-09-07 14:43:50.000000000 +0400 --- ctx.c_patched 2011-09-10 01:12:48.000000000 +0400 *************** *** 156,161 **** --- 156,162 ---- c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); + SSL_set_verify(ssl, SSL_CTX_get_verify_mode(c->opt->ctx), +NULL); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); #ifdef USE_LIBWRAP The second moment concerns uses stunnel as client through HTTPS a proxy (protocol=connect). All works perfectly, only it has appeared that value for SNI used from "connect" parameter instead of value of "protocolHost". On a code all is quite obvious: if(c->opt->host_name) { s_log(LOG_DEBUG, "SNI: host name: %s", c->opt->host_name); if(!SSL_set_tlsext_host_name(c->ssl, c->opt->host_name)) { sslerror("SSL_set_tlsext_host_name"); longjmp(c->err, 1); } } I solved it such: *** options.c 2011-09-07 20:38:56.000000000 +0400 --- options.c_patch 2011-09-10 16:34:56.882619049 +0400 *************** *** 695,700 **** --- 695,705 ---- s_log(LOG_INFO, "Cannot resolve '%s' - delaying DNS lookup", arg); section->option.delayed_lookup=1; } + + /* check - is host_name already filled */ + if (section->host_name != NULL) + return NULL; /* OK */ + tmpstr=strrchr(arg, ':'); if(tmpstr) { *tmpstr='\0'; *************** *** 1077,1082 **** --- 1082,1095 ---- if(strcasecmp(opt, "protocolHost")) break; section->protocol_host=str_dup_err(arg); + + /* Overwrite section->host_nam because of + protocolHost should be used for client SNI */ + tmpstr=strrchr(arg, ':'); + if(tmpstr) { + *tmpstr='\0'; + section->host_name=str_dup_err(arg); + } return NULL; /* OK */ case CMD_DEFAULT: break; I think that the given changes can be useful for other :) / Alexey Drozdov

2 1

SNI and some troubles solving
by Alexey Drozdov 10 Sep '11

10 Sep '11

Hi All, At first I would like to thank Marzena Trojnara for the useful program! Occurrence of support SNI has especially interest. I have decided to use the given possibility, but have detect pair of bugs which has independently successfully solved. To begin with I dump part of my config: [virtual_server] accept = 443 connect = localhost:1081 cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key ; need peer verification for default access verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt ; use restricted access form some target services [socks5] sni = virtual_server:localhost sni = virtual_server:89.250.5.185 sni = virtual_server:127.0.0.1 sni = virtual_server:server cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt connect = localhost:1081 ; public service [dreamhub_ru] sni = virtual_server:dreamhub.ru sni = virtual_server:pad.dreamhub.ru cert = /usr/local/etc/stunnel/dreamhub.cer key = /usr/local/etc/stunnel/dreamhub.pem connect = localhost:80 I want to use stunnel on 443rd port for ssl-socks5 service with peer certificates verification and use public https web-service (https://dreamhub.ru). And so it has appeared that value for "verify" are always used from global section (in my case [virtual_server]), and values of "verify" parameters from virtual services sections aren't used. Problem it has appeared that in the SNI check callback static int servername_cb(SSL *ssl, int *ad, void *arg) ... for(list=section->servername_list_head; list; list=list->next) if(!strcasecmp(servername, list->servername)) { c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); SSL_set_SSL_CTX(ssl, c->opt->ctx); does not copy ctx->verify_mode (SSL*)s->verify_mode=ctx->verify_mode; It has been solved by explicit calling SSL_set_verify *** ctx.c 2011-09-07 14:43:50.000000000 +0400 --- ctx.c_patched 2011-09-10 01:12:48.000000000 +0400 *************** *** 156,161 **** --- 156,162 ---- c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); + SSL_set_verify(ssl, SSL_CTX_get_verify_mode(c->opt->ctx), +NULL); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); #ifdef USE_LIBWRAP The second moment concerns uses stunnel as client through HTTPS a proxy (protocol=connect). All works perfectly, only it has appeared that value for SNI used from "connect" parameter instead of value of "protocolHost". On a code all is quite obvious: if(c->opt->host_name) { s_log(LOG_DEBUG, "SNI: host name: %s", c->opt->host_name); if(!SSL_set_tlsext_host_name(c->ssl, c->opt->host_name)) { sslerror("SSL_set_tlsext_host_name"); longjmp(c->err, 1); } } I solved it such: *** options.c 2011-09-07 20:38:56.000000000 +0400 --- options.c_patch 2011-09-10 16:34:56.882619049 +0400 *************** *** 695,700 **** --- 695,705 ---- s_log(LOG_INFO, "Cannot resolve '%s' - delaying DNS lookup", arg); section->option.delayed_lookup=1; } + + /* check - is host_name already filled */ + if (section->host_name != NULL) + return NULL; /* OK */ + tmpstr=strrchr(arg, ':'); if(tmpstr) { *tmpstr='\0'; *************** *** 1077,1082 **** --- 1082,1095 ---- if(strcasecmp(opt, "protocolHost")) break; section->protocol_host=str_dup_err(arg); + + /* Overwrite section->host_nam because of + protocolHost should be used for client SNI */ + tmpstr=strrchr(arg, ':'); + if(tmpstr) { + *tmpstr='\0'; + section->host_name=str_dup_err(arg); + } return NULL; /* OK */ case CMD_DEFAULT: break; I think that the given changes can be useful for other :) / Alexey Drozdov

1 0

stunnel 4.43 released
by Michal Trojnara 08 Sep '11

08 Sep '11

Dear Users, I have released version 4.43 of stunnel. The ChangeLog entry: Version 4.43, 2011.09.07, urgency: MEDIUM: * New features - Updated Win32 DLLs for OpenSSL 1.0.0e. - Major optimization of the logging subsystem. Benchmarks indicate up to 15% performance improvement. * Bugfixes - Fixed WIN32 configuration file reload. - Fixed FORK and UCONTEXT threading models. - Corrected INSTALL.W32 file. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.43.tar.gz: 93a002d9e1652d7684756af75b44b00f99aa93574e8a5a2e69f88656221d5ce2 Best regards, Mike

2 1

SSL3_READ_BYTES:tlsv1 alert internal error
by Andrew Heuneman 07 Sep '11

07 Sep '11

Hello, We recently implemented Stunnel on Centos 5.6 for ssl offloading for our java application. The application has applets to communicate java objects over https to a tomcat server on the server side. We have it setup in front of our Alteon/Radware load balancer. This hardware load balancer is capable of ssl load balancing, but has produced a very specific packet reset that only presents itself in ssl processing. We decided to implement Stunnel in front of this load balancer to fix this problem. Ssl offloading was working great with Stunnel until we ran into Java 7. if I run any version of our applets on java 6 they work. If i run java 7 they do not work. I have tried googling and looking for this error but I have only found some references to SNI... is this correct? Is there anything I can do. Please forgive me if i have omitted any details I will be more than happy to include a packet capture or other details if needed. I compiled stunnel with the following options ./configure --disable-libwrap --bindir=/usr/sbin --sbindir=/usr/sbin --sysconfdir=/etc --with-ssl=/usr/local/ssl also i compiled OpenSSL 1.0.0d with the following ./Configure threads shared linux-generic64 stunnel -version No limit detected for the number of clients signal_pipe: FD=3 allocated (non-blocking mode) signal_pipe: FD=4 allocated (non-blocking mode) stunnel 4.42 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL,IPv6 stunnel 4.42 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL,IPv6 Global option defaults debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level option defaults ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 session = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none str_stats: 112 block(s), 4046 byte(s) stunnel.conf cert=/etc/stunnel/stunnel.pem debug=7 output=/var/log/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=0.0.0.0:443 connect=172.16.18.100:80 session = 300 TIMEOUTbusy = 300 TIMEOUTconnect = 10 TIMEOUTidle = 43200 client = no stunnel.log 2011.08.22 16:58:49 LOG7[438154:47689394220768]: Service https accepted FD=2 from 10.0.11.27:46830 2011.08.22 16:58:49 LOG7[438154:1104877888]: Service https started 2011.08.22 16:58:49 LOG7[438154:1104877888]: Option TCP_NODELAY set on local socket 2011.08.22 16:58:49 LOG5[438154:1104877888]: Service https accepted connection from 10.0.11.27:46830 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): before/accept initialization 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 read client hello A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 write server hello A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 write certificate A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 write key exchange A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 write certificate request A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 flush data 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL alert (read): fatal: internal error 2011.08.22 16:58:49 LOG3[438154:1104877888]: SSL_accept: 14094438: error:14094438:SSL routines:SSL3_READ_BYTES:tlsv1 alert internal error 2011.08.22 16:58:49 LOG5[438154:1104877888]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.08.22 16:58:49 LOG7[438154:1104877888]: Service https finished (1 left) 2011.08.22 16:58:49 LOG7[438154:1104877888]: str_stats: 0 block(s), 0 byte(s) 2011.08.22 16:59:01 LOG7[438154:1104947520]: Socket closed on read 2011.08.22 16:59:01 LOG7[438154:1104947520]: Sending SSL write shutdown 2011.08.22 16:59:01 LOG7[438154:1104947520]: SSL alert (write): warning: close notify 2011.08.22 16:59:01 LOG6[438154:1104947520]: SSL_shutdown successfully sent close_notify 2011.08.22 16:59:01 LOG7[438154:1104947520]: SSL alert (read): warning: close notify 2011.08.22 16:59:01 LOG7[438154:1104947520]: SSL closed on SSL_read 2011.08.22 16:59:01 LOG7[438154:1104947520]: Sending socket write shutdown 2011.08.22 16:59:01 LOG5[438154:1104947520]: Connection closed: 49445 bytes sent to SSL, 8175 bytes sent to socket -- Thank You, Andrew Heuneman Senior Systems Administrator Reading Plus®/Taylor Associates Helping students become proficient silent readers. <http://twitter.com/readingplus> <http://www.facebook.com/pages/Reading-Plus/165970877038>

2 1

Internal error after reload modified server mode section
by Javier 07 Sep '11

07 Sep '11

Hi, I didn't found this question, so I hope isn't duplicate. I'm using the latest stable 4.42 version and I'm running Windows 2000 and I want to ask is this is a normal behavior. What is happening is that, after change the server section in the config file (the rest are all client mode), if it has been any connection to that server (and only if it has been a connection), when I reload the modified conf, it gives...: INTERNAL ERROR: get_alloc_list_ptr: Bad magic str_stats: 380 block(s), 96684 byte(s) This happens after no errors in the load (except for DH being hardcoded), SSL context initialized Configuration successful after open every service (clients and server) and then, after the error, closes every service. Trying to reload the conf, doesn't nothing, just stunnel hangs (is not responding to reloads). The only way to restart all is to close stunnel and reopen. Then, the configuration is accepted without problems and works perfectly. This happens, as I said, after modify the conf file and if it was a connection. The section is related to a local test server, where I modify the IP and/or ports where to accept and where to connect. As general options I have: debug = debug delay = yes And the server section: [mySSL] client = no cert = mytestpem.pem accept = 127.0.0.1:443 connect = 127.0.0.1:80 What I'm doing wrong? Is the normal behavior? Is it a new bug? Regards, Javier.

3 5

Compiling Stunnel For Windows
by Albert 05 Sep '11

05 Sep '11

Hi, I want to compile stunnel for windows, to include the XMPP patch (that I managed to apply cleanly to the current stunnel code) that I saw on the mailing list earlier as I need to get it to connect to a SSL only server in client mode. I followed the instructions in the Install.w32 file 1) apt-get install gcc-mingw32 - Worked fine with no issues 2) Download the recent zlib from http://www.zlib.net/ , Update the following definitions in win32/Makefile.gcc file: etc *snip* Worked fine as far as I can tell 3) Download the recent OpenSSL in unpack it to /usr/src/ directory., cd /usr/src && tar zvxf ~/openssl-(version).tar.gz I got OpenSSL 1.0.0d 4) Build OpenSSL with cross_mingw32.sh script. I ran instead ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared zlib-dynamic && make it seems to have worked fine 5) Download and unpack stunnel-(version).tar.gz. -got stunnel 4.42 6) Configure stunnel. cd stunnel-(version) && ./configure --with-ssl=/path/to/openssl-(version) This step worked fine 7) Build windows executable. cd src && make stunnel.exe The first few compile steps work fine, but I get stuck on: ...i586-mingw32msvc/bin/ld: cannot find -lcrypto.dll I did a few hours of troubleshooting and trying to move a few files around but couldn't find crypto.dll anywhere I'm running a fresh install of Ubuntu 11.04 in a VM if that makes any difference. Help would be greatly appreciated :) Thanks, Albert

2 1

Changing the secure tunnel 'encryption' method ....
by VANDOOREN, Pascal 02 Sep '11

02 Sep '11

Hello Everyone, I have a question, Why use you a certificate and not a hash AES, or other crypting algorithm to make a secure tunnel ? Because i use not a validate cert and i can only generate a cert valid for maximum 1year ... In the config file you can let the choice to use the cert or hash .. It's only a idea Kind regards Pascal -- This e-mail is confidential. If you are not the addressee or an authorized recipient of this message, any distribution, copying, publication or use of this information for any purpose is prohibited. Please notify the sender immediately by e-mail and then delete this message. Ce message est confidentiel. Si vous n'etes pas le destinataire designe de ce message ou une personne autorisee a l'utiliser, toute distribution, copie, publication ou usage a quelques fins que ce soit des informations contenues dans ce message sont interdits. Merci d'informer immediatement l'expediteur par messagerie electronique et d'ensuite detruire ce message. --

1 0

Windows version not starting when Run
by Dayo Akande 31 Aug '11

31 Aug '11

The main thing that I'm seeing as the error is: "Could not load DH parameters from stunnel.pem" Below is the entire log file, I am so stumped here. I appreciate any help. No limit detected for the number of clients make_sockets: s_socket#1: FD=272 allocated (blocking mode) make_sockets: s_socket#2: FD=276 allocated (blocking mode) make_sockets: s_accept: FD=292 allocated (non-blocking mode) stunnel 4.42 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf Snagged 64 random bytes from C:/.rnd Wrote 1024 new random bytes to C:/.rnd PRNG seeded successfully Initializing SSL context for service pop3s Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded Could not load DH parameters from stunnel.pem Using hardcoded DH parameters DH initialized with 2048-bit key ECDH initialized with curve prime256v1 SSL options set: 0x01180004 SSL context initialized Initializing SSL context for service imaps Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded Could not load DH parameters from stunnel.pem Using hardcoded DH parameters DH initialized with 2048-bit key ECDH initialized with curve prime256v1 SSL options set: 0x01180004 SSL context initialized Line 91: "socket = l:TCP_NODELAY=1 ": Specified option name is not valid here str_stats: 152 block(s), 11942 byte(s) Server is down

2 2

Re: [stunnel-users] CRL
by Uldis Biks 31 Aug '11

31 Aug '11

1 0

CRL
by Uldis Biks 31 Aug '11

31 Aug '11

2 2

stunnel : binding in ipv6+ipv4 : problem
by Guylhem Aznar 27 Aug '11

27 Aug '11

Hello I have a problem with stunnel : I just don't know how to specify 2 different port forwarding, one for all ipv4 connections to port 443, the other for all ipv6 connections. Either one seem to work, but I can't have both at the same time. In my /etc/hosts : 127.0.0.1 localhost ::1 localhost6 0.0.0.0 listenall4 :: listenall6 In my stunnel.conf: [sslh] accept = listenall4:443 connect = 127.0.0.1:444 TIMEOUTclose = 0 [ssl6] accept = listenall6:443 connect = 6.guylhem.org:80 TIMEOUTclose = 0 I have read that linux can block ipv6 sockets if the ipv4 socket is created first, but here the order doesn't change anything. I though that stunnel was ipv6 capable, but apparently it doesn't play well with ipv4 on the same port. So I tried to remove one of the listenall : the listenall4 is important, but listenall6 is not. Yet giving a AAAA only host like 6.guylhem.org does not help - even if it goes before the listenall4. So I'm stuck. Has anyone patched stunnel for such a situation? Guylhem

1 0

FW: Mysql doesnt run with stunnel
by Freeh Sophia 26 Aug '11

26 Aug '11

Craig Retief <stunnel <at> rsw.co.za> writes: > > I see that on your server you have specified your config for mysqls like > this: > Hi Craig, That fixed it for me. Thanks! Freeh Sophia Marketing GmbH Emanuelstr. 3, 10317 Berlin Deutschland Telefon: +49 (33) 5310967 Email: freehsophia(a)gmail.com Site: http://flug.airego.de/

1 0

stunnel4 tcp_nodelay
by Madhu R 21 Aug '11

21 Aug '11

Hi, We are using stunnel in order to tunnel http proxy traffic. Is it better in this case to turn on Nagle's algo? I have tried to set socket=l:TCP_NODELAY=0 and socket=r:TCP_NODELAY=0 in the global config, but when I look at debug log it keeps saying option tcp_nodelay is set on local and remote socket. Is this a bug, or is there a different way of turning off tcp_nodelay (since I understand this is on by default now) Regds

1 0

Security issue in 4.4X effect older version?
by Richard L. Houston 19 Aug '11

19 Aug '11

Hi All, Sorry if this has been asked and answered. Saw the security warning about Stunnel 4.40 and 4.41 at http://www.securityfocus.com/bid/49254/info Are older version vulnerable as well or just those two specific versions? Specificity in the 4.2X series? Thanks for your help. +------------------------------------+ Best regards, -Richard Houston -R.L.H. Consulting -E-Mail rhouston(a)rlhc.net -WWW http://www.rlhc.net -Blog http://www.rlhc.net/blog/ -Twitter http://www.twitter.com/rlhc/

1 0

centos 6 - stunnel 4.42 unusable (libssl trap divide error) in FIPS mode (default)
by draeath 19 Aug '11

19 Aug '11

I just finished building and configuring stunnel 4.42 on my x86_64 CentOS6 box. It appears to run, but not long into the SSL connection stunnel dies. Log info below. This only happens if I do NOT specify --disable-fips during ./configure (as it enables FIPS by default). I assume this is because FIPS compliancy requires a key to have a passphrase, which my key does not have? [root@host stunnel]# tail -f /var/log/stunnel.log /var/log/messages ==> /var/log/stunnel.log <== 2011.08.19 16:27:36 LOG7[31681:139656510936832]: Option TCP_NODELAY set on local socket 2011.08.19 16:27:36 LOG5[31681:139656510936832]: Service ntop accepted connection from 12.117.176.190:13258 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): before/accept initialization 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 read client hello A 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 write server hello A 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 write certificate A 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 write key exchange A 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 write server done A 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 flush data 2011.08.19 16:27:37 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 read client key exchange A ==> /var/log/messages <== Aug 19 16:27:24 host stunnel: LOG5[31680:139656510941120]: FIPS mode enabled Aug 19 16:27:24 host stunnel: LOG6[31680:139656510941120]: Initializing SSL context for service ntop Aug 19 16:27:24 host stunnel: LOG4[31680:139656510941120]: Insecure file permissions on /usr/local/etc/stunnel/stunnel.pem Aug 19 16:27:24 host stunnel: LOG6[31680:139656510941120]: SSL context initialized Aug 19 16:27:24 host stunnel: LOG5[31680:139656510941120]: Configuration successful Aug 19 16:27:36 host stunnel: LOG5[31681:139656510936832]: Service ntop accepted connection from 12.117.176.190:13257 Aug 19 16:27:36 host stunnel: LOG3[31681:139656510936832]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Aug 19 16:27:36 host stunnel: LOG5[31681:139656510936832]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Aug 19 16:27:36 host stunnel: LOG5[31681:139656510936832]: Service ntop accepted connection from 12.117.176.190:13258 Aug 19 16:27:37 host kernel: stunnel[31724] trap divide error ip:7f044fd0d3d1 sp:7f0450b98a40 error:0 in libssl.so.1.0.0[7f044fce2000+53000]

1 0

Tr:SIP encryption with stunnel
by margot.basa 19 Aug '11

19 Aug '11

Hello all, Can someone give me information about SIP encryption with stunnel please ? Is it possible to transform a SIP message on TCP into a SIP TLS message with stunnel ? Thank you very much for your help, Regards > Message du 16/08/11 11:38 > De : "margot.basa" > A : stunnel-users(a)stunnel.org > Copie à : > Objet : SIP encryption with stunnel > > Hello all, I would like to know if stunnel is able to encrypt a SIP message (UDP or TCP => TLS...) For example: Terminal A can send/receive SIP messages on transport layer UDP or TCP but not TLS. Server B can send/receive SIP messages only in TLS. If terminal A sends a SIP REGISTER message to Server B, does stunnel is able to intercept the message and transform it ? port 5060 => port 5061 TCP => TLS sip uri => sips uri Do you think it's possible with stunnel ? Thank you very much for your input. Regards > > Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

When X-FORWARDED-FOR for Stunnel ?
by Elodie BOSSIER 19 Aug '11

19 Aug '11

Greetings, Why you don't implement X-FORWARDED-FOR into stunnel ? I have found this patch : http://haproxy.1wt.eu/download/patches/stunnel-4.32-xforwarded-for.diff but this on is to much old, i'm with stunnel 4.41 and i can't go to 4.32 because i need SNI, implemented since 4.38 I have attempt to modify the patch to match with the current version, in begining it's ok but not after, all line code have changed and i'm not developer. X-FORWARDED-FOR is very important and exist on mostly all the frontend web and usuable by all the web server. Someone told me to switch to Nginx because X-FORWARDED-FOR don't exist in Stunnel ... I would like stay on Stunnel because it's only a light tunnel. The patch have only 219 lines, could you help me please to addapt it to the version 4.41 and/or add this feature into Stunnel please ? This is the "manual" to apply the patch : http://www.buro9.com/blog/2009/12/07/installing-haproxy-load-balance-http-a… Just need to add "xforwardedfor=yes" into your config file and should be OK. With this feature, I won't have need to "play" with this (censured) of transparent = source, iptables rules, tcpdump and root exec ... Thanks so much ... Elodie.

3 5

stunnel 4.42 released
by Michal Trojnara 18 Aug '11

18 Aug '11

Dear Users, I have released version 4.42 of stunnel. This is a security bugfix release. Upgrade is highly recommended! The ChangeLog entry: Version 4.42, 2011.08.18, urgency: HIGH: * New features - New verify level 0 to request and ignore peer certificate. This feature is useful with the new Windows GUI menu to save cached peer certificate chains, as SSL client certificates are not sent by default. - Manual page has been updated. - Removed support for changing Windows Service name with "service" option. * Bugfixes - Fixed a heap corruption vulnerability in versions 4.40 and 4.41. It may possibly be leveraged to perform DoS or remote code execution attacks. - The -quiet commandline option was applied to *all* message boxes. - Silent install (/S option) no longer attempts to create stunnel.pem. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.42.tar.gz: d33c407bfc4f58070e818081bd082c38f91cab7691ccbb794da63143c535de3b Best regards, Mike

1 0

stunnel transparent mode
by Julian D. Seifert 18 Aug '11

18 Aug '11

Hi List, I have a little issue trying to get stunnel running for encapsulating an existing service with SSL. We are running a really old legacy ircd service and would like to provide SSL for the users without having to actually hack that into the really old code base. (Yes we could just use another more modern software but let's just say there are "political" reasons as to why this is not an option) For an ircd we need transparency as in "the ircd should think the connection is not coming from localhost") ANYWAY... so I am working with stunnel 4.39 right now. First a question if I understand it correctly how stunnel will work. I have the ircd running on IP1:6667. I created a service section like this. [ircd] accept = 7000 connect = 6667 transparent = source (And applied the iptables/routing related stuff mentioned in the documentation) Should this already work? Will stunnel "manipulate" packets so that the IRCD "sees" connections from the Peers IP's? And will the Answers the ircd sends to the peers get "intercepted" by stunnel so it can "remanipulate" the answers into the SSL connection? If I try it like I get "local_bind (original port): Cannot assign requested address (99) stunnel" and clients get connection abort. Or is this what "transparent = both" is for? With 4.39 I had an issue trying to use "transparent = both". Stunnel always displayed an error message saying "Each service must define two endpoints" (more or less). I got it to compile by commenting out the one line in options.c causing the error... #### snip #### } else { /* standalone mode checks */ if((unsigned int)section->option.accept + (unsigned int)section->option.program + (unsigned int)section->option.remote + (unsigned int)section->option.sni #ifndef USE_WIN32 + (unsigned int)section->option.transparent_dst #endif /* USE_WIN32 */ !=2) { section_error(last_line, section->servname, "Each service must define two endpoints"); return 0; } ### snap ### Commented out the line within the ifndef. Anyway... I hope somebody can clarify for me how stunnel works and what transparent mode is the one I need. (I want to transparently provide the ircd service with connections so it seems they are directly from the peers and not from stunnel(localhost)) regards, Julian Seifert -- I hate mondays...

2 7

[Sebastian.Leske@sleske.name: Bug#637932: stunnel4: segfault if certificate file cannot be read during verification]
by Rodrigo Gallardo 17 Aug '11

17 Aug '11

----- Forwarded message from Sebastian Leske <Sebastian.Leske(a)sleske.name> ----- Date: Mon, 15 Aug 2011 21:21:05 +0200 Package: stunnel4 Version: 3:4.40-1 Severity: normal I use certificate verification with stunnel4 (verify=2 in stunnel.conf). I accidentally changed the access rights of a PEM file required for verification to be unreadable. As a consequence, stunnel4 incorrectly reports "Verification error: self signed certificateVerification error: self signed certificate" (the cert in question is not self-signed), then segfaults. With stunnel4 version 4.29-1_i386, this does not occur: stunnel4 correctly reports that it cannot access the PEM file. Log and backtrace (generated with setting foreground=yes in stunnel.conf): Starting program: /usr/bin/stunnel4 /etc/stunnel/stunnel.conf [Thread debugging using libthread_db enabled] 2011.08.15 21:16:54 LOG5[9584:3082946768]: stunnel 4.40 on i486-pc-linux-gnu platform 2011.08.15 21:16:54 LOG5[9584:3082946768]: Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 2011.08.15 21:16:54 LOG5[9584:3082946768]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 2011.08.15 21:16:54 LOG5[9584:3082946768]: Reading configuration from file /etc/stunnel/stunnel.conf 2011.08.15 21:16:54 LOG6[9584:3082946768]: Compression enabled using zlib method 2011.08.15 21:16:54 LOG6[9584:3082946768]: Initializing SSL context for service pop3sl 2011.08.15 21:16:54 LOG6[9584:3082946768]: SSL context initialized 2011.08.15 21:16:54 LOG6[9584:3082946768]: Initializing SSL context for service https 2011.08.15 21:16:54 LOG6[9584:3082946768]: SSL context initialized 2011.08.15 21:16:54 LOG6[9584:3082946768]: Initializing SSL context for service ssmtp 2011.08.15 21:16:54 LOG6[9584:3082946768]: SSL context initialized 2011.08.15 21:16:54 LOG5[9584:3082946768]: Configuration successful [New Thread 0xb7fdfb70 (LWP 9593)] 2011.08.15 21:16:57 LOG5[9584:3086875504]: Service pop3sl accepted connection from 127.0.0.1:60903 2011.08.15 21:16:57 LOG6[9584:3086875504]: connect_blocking: connecting 213.187.93.221:995 2011.08.15 21:16:57 LOG5[9584:3086875504]: connect_blocking: connected 213.187.93.221:995 2011.08.15 21:16:57 LOG5[9584:3086875504]: Service pop3sl connected remote server from 192.168.1.101:39914 2011.08.15 21:16:57 LOG4[9584:3086875504]: CERT: Verification error: self signed certificate in certificate chain 2011.08.15 21:16:57 LOG4[9584:3086875504]: Certificate check failed: depth=2, /C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA 2011.08.15 21:16:57 LOG3[9584:3086875504]: error queue: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb7fdfb70 (LWP 9593)] 0xb7ca2119 in ?? () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 (gdb) bt #0 0xb7ca2119 in ?? () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 #1 0xb7ca3c1b in calloc () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 #2 0x0804cd20 in ?? () #3 0x080574bf in ?? () #4 0x08057529 in ?? () #5 0x08058129 in ?? () #6 0x0804d945 in ?? () #7 0x0804e79b in ?? () #8 0x0804fafe in ?? () #9 0xb7f98c39 in start_thread () from /lib/i386-linux-gnu/i686/cmov/libpthread.so.0 #10 0xb7d0196e in clone () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 (gdb) -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (500, 'testing'), (500, 'stable') Architecture: i386 (i686) Kernel: Linux 3.0.0-1-686-pae (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages stunnel4 depends on: ii adduser 3.110 add and remove users and groups ii libc6 2.13-10 Embedded GNU C Library: Shared lib ii libssl1.0.0 1.0.0d-3 SSL shared libraries ii libwrap0 7.6.q-16 Wietse Venema's TCP wrappers libra ii netbase 4.34 Basic TCP/IP networking system ii openssl 1.0.0d-3 Secure Socket Layer (SSL) binary a ii perl-modules 5.12.4-2 Core Perl modules stunnel4 recommends no packages. Versions of packages stunnel4 suggests: pn logcheck-database <none> (no description available) -- no debconf information ----- End forwarded message ----- -- Rodrigo Gallardo

2 1

Sending "LOGOUT" when using StartTLS offloading?
by Markus Borst 17 Aug '11

17 Aug '11

I have to cope with a very unusual imap server behavior, but maybe stunnel can help me: Can stunnel send an imap command ("XX LOGOUT"), just before closing the tcp session? Setup: I use stunnel for SSL/TLS offloading, both via extra port (993) and StartTLS emulation (143). Our imap server (Mercury) has a very peculiar feature: If a tcp connection is closed without properly closing the imap session first (LOGOUT), the server discards certain attributes, specifically, it "forgets" all deletions since last logout. Since many imap clients just tear down the connection in certain cases (for example Thunderbird going into offline mode, many webmailers or stunnel reaching it's "TIMEOUTidle"), this causes mails to be undeleted. We currently use an older version of the mailserver, since only the newest is broken. Needless to say, this does not go well with our users. A fixed version of the imap server may never come, so, until we can switch all users to a new mail system: Is it possible to use stunnel to send an additional imap command before closing the tcp connection (something like "999 LOGOUT")? The command should be sent no matter why the connection is closed, either because the client closed it, a timeout is reached or stunnel is unloaded. If the connection is already cleanly logged out, this doesn't matter, in all other situations it would help. Would it be possible to send such a command, or could this be added as a new feature? Greetings Markus Borst -- ==== Achtung! Umzug: neuer Raum: ==== TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst S4/14/2.4.06 Adresse: Mornewegstr. 30 64293 Darmstadt Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

2 1

SIP encryption with stunnel
by margot.basa 16 Aug '11

16 Aug '11

Hello all, I would like to know if stunnel is able to encrypt a SIP message (UDP or TCP => TLS...) For example: Terminal A can send/receive SIP messages on transport layer UDP or TCP but not TLS. Server B can send/receive SIP messages only in TLS. If terminal A sends a SIP REGISTER message to Server B, does stunnel is able to intercept the message and transform it ? port 5060 => port 5061 TCP => TLS sip uri => sips uri Do you think it's possible with stunnel ? Thank you very much for your input. Regards Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

Stunnel and CryptoAPI
by ratmahat＠hush.ai 15 Aug '11

15 Aug '11

Hello everyone! I have an interesting question, which i didn't find any answer to after several searches. 1. What if I want to enable client verification with client certificate provided by smart card? Is it possible? 2. Does stunnel has the capability to access Windows certificate store in order to verificate the client certificate with the CA in the store? If anyone ever dealt with this, I'd really appreciate this. Thanks, Rat.

1 0

Odd stunnel problem
by Tristan Schmelcher 09 Aug '11

09 Aug '11

My company uses stunnel on a telecom product and we have run into a strange problem. One of our customers sees an issue every couple weeks where the stunnel process becomes busted. Attempts to establish a connection through stunnel to any host hang indefinitely. Interface stats indicate that stunnel sends and receives a flurry of packets--as if a TLS connection was successfully established--but the local plaintext socket connection to stunnel never passes data. For example, if attempting to run telnet over stunnel, the telnet client just sits there and doesn't write anything to the terminal. During this time the network is otherwise functioning fine. Unfortunately nothing is logged by stunnel when this happens and we haven't been able to reproduce the problem in a controlled environment. Does anyone have any ideas what might be happening? We currently use stunnel 4.35 with debug = warning, sslVersion = TLSv1, and verify = 2.

2 2

stunnel for android
by dddfr 09 Aug '11

09 Aug '11

Hi, I want to use stunnel server in Android Phone ,I don't know how to use it,can you tell me? Thanks! 2011-08-10 dddfr

1 0

doubts with stunnel.conf
by Gabriel Monnerat 09 Aug '11

09 Aug '11

Hello, I am noob in stunnel and I trying configure my environment but I have one problem. My stunnel.conf is: foreground = yes output = /srv/slapgrid/slappart1/var/log/stunnel.log pid = /srv/slapgrid/slappart1/var/run/stunnel.pid syslog = no debug = 7 foreground = yes delay = yes client = yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 key = /srv/slapgrid/slappart1/srv/ca/private/mykey.key cert = /srv/slapgrid/slappart1/srv/ca/certs/mycert.crt [varnish_SOFTINST-51] accept = 10.0.235.44:26012 connect = [2a01:e34:ec03:*:*:*:*:*]:15000 In the stunnel compilation the option "--enable-ipv6" was used. And ipv6 address is one zope server to connect using https I have this traceback: 2011.08.09 00:19:51 LOG7[12724:140272018274048]: local socket: FD=7 allocated (non-blocking mode) 2011.08.09 00:19:51 LOG7[12724:140272018274048]: Service varnish_SOFTINST-51 accepted FD=7 from 10.0.235.44:39673 2011.08.09 00:19:51 LOG7[12724:140272018409232]: Service varnish_SOFTINST-51 started 2011.08.09 00:19:51 LOG7[12724:140272018409232]: Option TCP_NODELAY set on local socket 2011.08.09 00:19:51 LOG5[12724:140272018409232]: Service varnish_SOFTINST-51 accepted connection from 10.0.235.44:39673 2011.08.09 00:19:59 LOG3[12724:140272018409232]: Error resolving '[2a01:e34:ec03:*:*:*:*:*]': Neither nodename nor servname known (EAI_NONAME) 2011.08.09 00:19:59 LOG3[12724:140272018409232]: No host resolved 2011.08.09 00:19:59 LOG5[12724:140272018409232]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.08.09 00:19:59 LOG7[12724:140272018409232]: Service varnish_SOFTINST-51 finished (0 left) 2011.08.09 00:19:59 LOG7[12724:140272018409232]: str_stats: 0 block(s), 0 byte(s) 2011.08.09 00:20:09 LOG7[12724:140272018274048]: local socket: FD=7 allocated (non-blocking mode) 2011.08.09 00:20:09 LOG7[12724:140272018274048]: Service varnish_SOFTINST-51 accepted FD=7 from 10.0.235.44:39675 2011.08.09 00:20:09 LOG7[12724:140272018409232]: Service varnish_SOFTINST-51 started 2011.08.09 00:20:09 LOG7[12724:140272018409232]: Option TCP_NODELAY set on local socket 2011.08.09 00:20:09 LOG5[12724:140272018409232]: Service varnish_SOFTINST-51 accepted connection from 10.0.235.44:39675 2011.08.09 00:20:14 LOG7[12724:140272018274048]: Dispatching signals from the signal pipe 2011.08.09 00:20:14 LOG5[12724:140272018274048]: Received signal 15; terminating 2011.08.09 00:20:14 LOG7[12724:140272018274048]: str_stats: 0 block(s), 0 byte(s) 2011.08.09 00:20:14 LOG7[12724:140272018274048]: removing pid file /srv/slapgrid/slappart1/var/run/stunnel.pid Please, someone can help me? maybe I am doing stupid things.. thanks in advance -- Gabriel M. Monnerat

2 3

Stunnel 4.41 dies after a while
by René Plattner 08 Aug '11

08 Aug '11

Hi, I have compiled version 4.41 with xforwarded-for patch successfully for our webmail system (Stunnel <-> Haproxy <-> Horde Webmail). After a while the stunnel daemon dies and following message appears in log: Aug 8 12:05:06 vlb2 [local3.err] stunnel: LOG3[3231:3085343632]: SSL_accept: 140760FC: error:140760FC:SSL routines: SSL23_GET_CLIENT_HELLO:unknown protocol Any ideas/suggestions? OS: Centos 5.5 openssl: 0.9.8e-12.el5_5.7 Configuration: ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Disable SSLv2 options = NO_SSLv2 ; List of allowed Ciphers ciphers = ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH ; Disable FIPS fips = no ; Some security enhancements for UNIX systems - comment them out on Win32 setuid = nobody setgid = nobody chroot = /usr/local/var/lib/stunnel/ ; PID is created inside chroot jail pid = /stunnel-webmail.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Option for Dummy MSIE TIMEOUTclose=0 ; Option for errorness SSL implementation options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = local3.4 ; Run as Daemon foreground = no ; Service-level configuration [https] cert = z1.pem accept = ip1:443 connect = p1 xforwardedfor = yes [https] cert = z2.pem accept = ip2:443 connect = p2 xforwardedfor = yes [wmt] cert = z3.pem accept = ip3:443 connect = p3 xforwardedfor = yes regards René Plattner

1 0

Tray icon options
by Sebastian Rose-Indorf 08 Aug '11

08 Aug '11

Hello, many thanks for the new Stunnel versions! I have installed 4.42b3 manually (Vista SP2 64 bit). The tray icon options "Edit stunnel.conf" and "Reload stunnel.conf" do not find the conf file, and the option "Manual" has no effect. At program start Stunnel finds the Conf file without problems (start link: "drive1/path1/stunnel.exe drive2/path2/stunnel.conf"). Greetings seb

1 0

Re: [stunnel-users] webmail compose page get expire and logout
by jayesh.shinde 08 Aug '11

08 Aug '11

Hi Ludolf , Sorry for my previous typing mistake , There is *no* firewall rules between any of my 3 servers My problem is when I open webmail with https:// and compose any email and click on send button then page is getting expire and I am getting logout. Kindly note that my other webmail pages with https:// are working properly. Where as with http:// the compose email and send works properly without any problem. That is if I open the webmail vai stunnel https config then only problem comes. So I am searching solution and config option with the same. Let me know if any config info require from my end. I am checking out with the option which you have suggested and will reply you shortly. Regards Jayesh Shinde On 08/08/2011 01:02 PM, Ludolf Holzheid wrote: > On Mon, 2011-08-08 12:30:03 +0530, jayesh.shinde wrote: >> > >> > [..] >> > >> > I checked by defining the TIMEOUTs but I am not able to figure out why >> > the page is getting expire and I am getting logout ? >> > There is firewall rule between any servers. > I didn't fully understand your problem, but if your secured tunnel > crosses a stateful firewall (e.g. a NAT router), you might try to > switch on TCP keepalive: > > socket = l:SO_KEEPALIVE=1 > > You might also play with the TCP_KEEP* socket options. > > HTH, > > Ludolf > > -- --------------------------------------------------------------- > Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 > 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 > Mannheim, Germany > ---------------------------------------------------------------

1 1

webmail compose page get expire and logout
by jayesh.shinde 08 Aug '11

08 Aug '11

Dear All , I am trying to setup a load balancing under webmail on my test servers. Here is my setup details :-- Total server are 3 servers. i.e ( 2 backend webmail server and 1 front server ) On one server I have installed haproxy-1.4.15.tar.gz + stunnel-4.41.tar.gz with http:// and https:// Another two servers are installed with squirrelmail . my problem:-- ========== 1) When I access the webmail by https://webmail.domain.com and compose any email and click on send button , the page is getting expire and I am getting log out from webmail. In Firefox there is no error on browser , where as in internet explorer I am getting below error with popup window :-- *Error Popup* :-- ============ "do you want to view only the webpage content that was deliver securely. This webpage contain the content that will not be delivered using the secure HTTPS connection, which could compromise the security of entire webpage." Where as if I check with http://webmail.domain.com , then the mail compose and send work properly. Here is the stunnel.conf :-- =================== [root@jayesh ~]# cat /etc/stunnel/stunnel.conf cert=/opt/ssl/ssl.key/mail_domain_com.crt key=/opt/ssl/ssl.key/domain.key setuid=stunnel setgid=stunnel pid=/var/run/stunnel/stunnel.pid output = /var/log/stunnel.log debug = 7 socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=192.168.30.200:443 connect=192.168.30.200:81 TIMEOUTclose = 0 session = 600 TIMEOUTbusy = 600 TIMEOUTclose = 300 TIMEOUTconnect = 600 I checked by defining the TIMEOUTs but I am not able to figure out why the page is getting expire and I am getting logout ? There is firewall rule between any servers. Please suggest me and guide on this issue. I am stuck here. Regards Jayesh Shinde

1 0

anyone got a port for android?
by Jason Haar 05 Aug '11

05 Aug '11

Hi there Exchange email doesn't work on Android for us because we have a requirement for using client certs to protect the ActiveSync over HTTPS transactions. If I had stunnel, I could sync with localhost and stunnel could do the client cert-foo.... So does anyone know of a working stunnel implementation for Android (or even something else that does the same job?) Thanks -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

3 2

FreeBSD upgrading to 4.41 (Dispatching signals from the signal pipe)
by Nicolas de Bari Embriz Garcia Rojas 04 Aug '11

04 Aug '11

Hi, I just upgrade stunner on a FreeBSD server from 4.35 to 4.41 using the ports, I restarted the server and notice that stunnel was not listen to any port, I had to manually restart it so it could work again. I increased the debug to 7 and got this when booting: 2011.08.04 17:44:58 LOG7[1123:675287360]: Dispatching signals from the signal pipe 2011.08.04 17:44:58 LOG5[1123:675287360]: Received signal 15; terminating 2011.08.04 17:44:58 LOG7[1123:675287360]: str_stats: 0 block(s), 0 byte(s) 2011.08.04 17:44:58 LOG7[1123:675287360]: removing pid file /stunnel.pid 2011.08.04 17:45:29 LOG7[682:675287360]: No limit detected for the number of clients 2011.08.04 17:45:29 LOG7[682:675287360]: signal_pipe: FD=3 allocated (non-blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: signal_pipe: FD=4 allocated (non-blocking mode) 2011.08.04 17:45:29 LOG5[682:675287360]: stunnel 4.41 on i386-portbld-freebsd8.2 platform 2011.08.04 17:45:29 LOG5[682:675287360]: Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 2011.08.04 17:45:29 LOG5[682:675287360]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv4 2011.08.04 17:45:29 LOG5[682:675287360]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2011.08.04 17:45:29 LOG7[682:675287360]: PRNG seeded successfully 2011.08.04 17:45:29 LOG6[682:675287360]: Initializing SSL context for service ssmtp 2011.08.04 17:45:29 LOG7[682:675287360]: Certificate: /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Certificate loaded 2011.08.04 17:45:29 LOG7[682:675287360]: Key file: /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Private key loaded 2011.08.04 17:45:29 LOG7[682:675287360]: Could not load DH parameters from /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Using hardcoded DH parameters 2011.08.04 17:45:29 LOG7[682:675287360]: DH initialized with 2048-bit key 2011.08.04 17:45:29 LOG7[682:675287360]: ECDH initialized with curve prime256v1 2011.08.04 17:45:29 LOG7[682:675287360]: SSL options set: 0x00000004 2011.08.04 17:45:29 LOG6[682:675287360]: SSL context initialized 2011.08.04 17:45:29 LOG6[682:675287360]: Initializing SSL context for service ssmtp2 2011.08.04 17:45:29 LOG7[682:675287360]: Certificate: /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Certificate loaded 2011.08.04 17:45:29 LOG7[682:675287360]: Key file: /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Private key loaded 2011.08.04 17:45:29 LOG7[682:675287360]: Could not load DH parameters from /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Using hardcoded DH parameters 2011.08.04 17:45:29 LOG7[682:675287360]: DH initialized with 2048-bit key 2011.08.04 17:45:29 LOG7[682:675287360]: ECDH initialized with curve prime256v1 2011.08.04 17:45:29 LOG7[682:675287360]: SSL options set: 0x00000004 2011.08.04 17:45:29 LOG6[682:675287360]: SSL context initialized 2011.08.04 17:45:29 LOG5[682:675287360]: Configuration successful 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=5 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=6 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=6 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=7 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=7 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=8 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=8 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=9 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=9 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=10 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: accept socket: FD=11 allocated (non-blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: Option SO_REUSEADDR set on accept socket 2011.08.04 17:45:29 LOG7[682:675287360]: Service ssmtp bound to 0.0.0.0:465 2011.08.04 17:45:29 LOG7[682:675287360]: Service ssmtp opened FD=11 2011.08.04 17:45:29 LOG7[682:675287360]: accept socket: FD=12 allocated (non-blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: Option SO_REUSEADDR set on accept socket 2011.08.04 17:45:29 LOG7[682:675287360]: Service ssmtp2 bound to 0.0.0.0:587 2011.08.04 17:45:29 LOG7[682:675287360]: Service ssmtp2 opened FD=12 2011.08.04 17:45:29 LOG7[688:675287360]: Created pid file /stunnel.pid 2011.08.04 17:45:42 LOG7[688:675287360]: Dispatching signals from the signal pipe 2011.08.04 17:45:42 LOG7[688:675287360]: Service ssmtp closed FD=11 2011.08.04 17:45:42 LOG7[688:675287360]: Service ssmtp2 closed FD=12 This is my conf: cert = /usr/local/etc/stunnel/smtp.inbox.pem chroot = /usr/local/var/stunnel setuid = stunnel setgid = stunnel pid = /stunnel.pid debug = 7 output = /stunnel.log client = no foreground = no ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [ssmtp] accept = 465 connect = 25 [ssmtp2] accept = 587 connect = 25 Any ideas of what could it be wrong? the last 2 lines of the boot log tell me that the ports i specify are been closed but why? 2011.08.04 17:45:42 LOG7[688:675287360]: Dispatching signals from the signal pipe 2011.08.04 17:45:42 LOG7[688:675287360]: Service ssmtp closed FD=11 2011.08.04 17:45:42 LOG7[688:675287360]: Service ssmtp2 closed FD=12 thanks in advance. regards

2 1

(no subject)
by Nicolas de Bari Embriz Garcia Rojas 04 Aug '11

04 Aug '11

1 0

STunnel NTLM Proxy problem
by Subhash Sharma 04 Aug '11

04 Aug '11

Has anyone use Stunnel to works with NTLM proxy? I am using Stunnel 4.35 on window It works fine straught and basic proxy but fails to use NTLM proxy. My config for NTLM is like this ---------------- configuration --------------------- [https] accept = someport connect = proxy:proxy_port protocol = connect protocolAuthentication = NTLM protocolHost = dest:dest_port protocolUsername = domain\username protocolPassword = password ----------------------------------------------------- I checked the traffic using the win shark -----------------win shark for stunnel ----------------- CONNECT dest:destport HTTP/1.1 , NTLMSSP_AUTH, User: \domain\username Proxy-Authorization: NTLM some long string NTLM Secure Service Provider NTLMSSP identifier: NTLMSSP NTLM Message Type: NTLMSSP_AUTH (0x00000003) Lan Manager Response: Empty NTLM Response: 951842e95a3e1a0001d8ac6fb2980a004b82ffa75232795d … Domain name: NULL User name: domain\username … ------------------------------------------------------ STunnel is not sending the domain and sends the user name consisting of domain and username. When IE is configured to use NLM proxy, traffic is as -------------- win shark for IE ----------------------------- CONNECT dest:destport HTTP/1.1 , NTLMSSP_AUTH, User: domain\username Proxy-Authorization: NTLM some long string NTLM Secure Service Provider NTLMSSP identifier: NTLMSSP NTLM Message Type: NTLMSSP_AUTH (0x00000003) Lan Manager Response: 10f2d8147a2651de00000000000000000000000000000000 … NTLM Response: 951842e95a3e1a0001d8ac6fb2980a004b82ffa75232795d … Domain name: domain … User name: username .. Host name: host -------------------------------------------------------------- ---- stunnel log --------------- 2011.08.04 10:11:16 LOG7[2384:5480]: Service https started 2011.08.04 10:11:16 LOG7[2384:5480]: Option TCP_NODELAY set on local socket 2011.08.04 10:11:16 LOG5[2384:5480]: Service https accepted connection from 127.0.0.1:9913 2011.08.04 10:11:16 LOG7[2384:5480]: remote socket: FD=1456 allocated (non-blocking mode) 2011.08.04 10:11:16 LOG6[2384:5480]: connect_blocking: connecting 172.23.11.161:8080 2011.08.04 10:11:16 LOG7[2384:5480]: connect_blocking: s_poll_wait 172.23.11.161:8080: waiting 10 seconds 2011.08.04 10:11:16 LOG5[2384:5480]: connect_blocking: connected 172.23.11.161:8080 2011.08.04 10:11:16 LOG5[2384:5480]: Service https connected remote server from 172.23.11.45:9914 2011.08.04 10:11:16 LOG7[2384:5480]: Remote FD=1456 initialized 2011.08.04 10:11:16 LOG7[2384:5480]: Option TCP_NODELAY set on remote socket 2011.08.04 10:11:16 LOG5[2384:5480]: Negotiations for connect (client side) started 2011.08.04 10:11:16 LOG7[2384:5480]: -> CONNECT 172.23.11.35:443 HTTP/1.1 2011.08.04 10:11:16 LOG7[2384:5480]: -> Host: 172.23.11.35:443 2011.08.04 10:11:16 LOG7[2384:5480]: -> Proxy-Connection: keep-alive 2011.08.04 10:11:16 LOG7[2384:5480]: -> Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAA== 2011.08.04 10:11:16 LOG7[2384:5480]: -> 2011.08.04 10:11:16 LOG7[2384:5480]: <- HTTP/1.1 407 Proxy Authentication Required 2011.08.04 10:11:16 LOG7[2384:5480]: <- Server: FreeProxy/4.50 2011.08.04 10:11:16 LOG7[2384:5480]: <- Date: Thu, 04 Aug 2011 17:11:16 GMT 2011.08.04 10:11:16 LOG7[2384:5480]: <- Content-Type: text/html 2011.08.04 10:11:16 LOG7[2384:5480]: <- Transfer-Encoding: Chunked 2011.08.04 10:11:16 LOG7[2384:5480]: <- Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAAAAADgAAAACAgACATR6TVahgFIAAAAAAAAAAAAAAAA4AAAABQLODgAAAA8= 2011.08.04 10:11:16 LOG7[2384:5480]: <- Proxy-Connection: Keep-Alive 2011.08.04 10:11:16 LOG7[2384:5480]: <- 2011.08.04 10:11:16 LOG7[2384:5480]: -> CONNECT 172.23.11.35:443 HTTP/1.1 2011.08.04 10:11:16 LOG7[2384:5480]: -> Host: 172.23.11.35:443 2011.08.04 10:11:16 LOG7[2384:5480]: -> Proxy-Authorization: NTLM TlRMTVNTUAADAAAAAAAAAGwAAAAYABgAQAAAAAAAAABsAAAAFAAUAFgAA......1jDUOrcoBBus0aPbH44onfcpGZvdW5kc3RvbmVccHN5cy1udGxt 2011.08.04 10:11:16 LOG7[2384:5480]: -> 2011.08.04 10:11:16 LOG7[2384:5480]: <- 7E5 2011.08.04 10:11:16 LOG3[2384:5480]: CONNECT request rejected 2011.08.04 10:11:16 LOG7[2384:5480]: <- <html> 2011.08.04 10:11:16 LOG7[2384:5480]: <- 2011.08.04 10:11:16 LOG5[2384:5480]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.08.04 10:11:16 LOG7[2384:5480]: Service https finished (0 left) 2011.08.04 10:11:16 LOG7[2384:5480]: str_stats: 0 block(s), 0 byte(s) -------------------------------- Please help!!! Subhash Sharma

1 0

silent install of windows stunnel
by Laurent Licour 04 Aug '11

04 Aug '11

stunnel use NSIS as installer and it is possible to use /S switch to run silent install However, even in this mode, openssl configuration tools is executed and prompt for certificate informations. I think that executign this tools should be skip in silent mode -- Laurent LICOUR

2 2

stunnel OK without "transparent = source", with = timeout problem
by Elodie BOSSIER 03 Aug '11

03 Aug '11

Greetings again, Thanks so much to have updated the manual about SNI, my stunel works correctly. But i have a tiny problem, when i visit my webserver, the SERVER['REMOTE_ADDR'] with PHP isn't the ip adress of the visitor but the IP of the stunnel. I have read the manual about this transparent proxy and i don't sucess with the configuration. This is my config file : pid = /stunnel.pid options = NO_SSLv2 transparent = source [virtual] accept = 443 cert = /usr/local/openssl/etc/CERTIFICATES/www.franceserv.fr_cert.cert key = /usr/local/openssl/etc/PRIVATE_KEYS/www.franceserv.fr_key.pem connect = www.franceserv.fr:80 [sni1] sni = virtual:elodie.franceserv.com cert = /etc/ssl-fsh/cert-elodie.franceserv.com.pem key = /etc/ssl-fsh/key-franceserv.key connect = elodie.franceserv.com:80 [sni2] sni = virtual:befun.franceserv.com cert = /etc/ssl-fsh/cert-befun.franceserv.com.pem key = /etc/ssl-fsh/key-franceserv.key connect = befun.franceserv.com:80 It's don't work, i have a timeout with my browser. With iptables, i have set this : iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter echo 1 > /proc/sys/net/ipv4/ip_forward My stunnel is on the server 192.168.0.20 and the webserver on 192.168.0.2 I try to follow the help of http://www.stunnel.org/static/stunnel.html#service_level_options with : transparent = none | source | destination | both (Unix only) Could you tell me what i make wrong please ?

2 4

Failed to run 2 instances of windows service (error 1053)
by Laurent Licour 03 Aug '11

03 Aug '11

I have to run at the same time on the same windows host, 2 instances of stunnel : a client instance and a server instance I have 2 config files : stunnel-client.conf , stunnel-server.conf Each configuration works, but not at the same time. I can install 2 services (with differents service name), but i can't start both services at the same time. I have to stop the first one to start the second one stunnel.exe -install stunnel-client.conf stunnel.exe -install stunnel-server.conf stunnel.exe -start stunnel-client.conf stunnel.exe -start stunnel-server.conf --> error 1053 stunnel.exe -stop stunnel-client.conf stunnel.exe -start stunnel-server.conf stunnel.exe -start stunnel-client.conf --> error 1053 It is also not possible to start the both configurations directly (no service mode). test run with stunnel 4.42b2 on windows XPe and Win2008R2 -- Laurent LICOUR

2 1

Failed to run 2 instances of windows service (error 1053)
by Laurent Licour 01 Aug '11

01 Aug '11

I have to run at the same time on the same windows host, 2 instances of stunnel : a client instance and a server instance I have 2 config files : stunnel-client.conf , stunnel-server.conf Each configuration works, but not at the same time. I can install 2 services (with differents service name), but i can't start both services at the same time. I have to stop the first one to start the second one stunnel.exe -install stunnel-client.conf stunnel.exe -install stunnel-server.conf stunnel.exe -start stunnel-client.conf stunnel.exe -start stunnel-server.conf --> error 1053 stunnel.exe -stop stunnel-client.conf stunnel.exe -start stunnel-server.conf stunnel.exe -start stunnel-client.conf --> error 1053 It is also not possible to start the both configurations directly (no service mode). test run with stunnel 4.42b2 on windows XPe and Win2008R2 -- Laurent LICOUR

1 0

Re: [stunnel-users] Stunnel on the same machine
by subrata＠indiatimes.com 01 Aug '11

01 Aug '11

The configuration files are : pid = /var/stunnel.pid ;chroot = /var/lib/stunnel setuid = nobody setgid = nobody foreground =yes ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept = 3307 connect = 192.168.1.6:3307 On 192.168.1.6 ---------------------- pid = /var/stunnel.pid setuid =nobody setgid = nobody foreground = yes client = no ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept =3307 connect =3306 connecting like /usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307 Enter password: On entring password the following lines appear : ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 Subrata ----- Original Message ----- From: Brian Hatch <bri(a)stunnel.org> To: subrata(a)indiatimes.com Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST) Subject: Re: [stunnel-users] Stunnel on the same machine Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted: > After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there. What do your stunnel configuration files look like? Other problem: mysql client may decide to use a local domain socket when connecting to localhost, thwarting your attempts to go via Stunnel. You might want to 'strace mysql ...' and look for the connect() lines. -- Brian Hatch Time flies like an Systems and arrow. Fruit flies Security Engineer like a banana. http://www.ifokr.org/bri/ Every message PGP signed -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

DH parameters
by yyy 30 Jul '11

30 Jul '11

Hello! How to specify custom DH parameters? There is an option for specifying ECDH curve (curve option), but not for ordinary DH. Searching man page for "DH" did not yield anything. Searching this list archive for "DH paramaeters" found only some default error messages.

2 1

Re: [stunnel-users] Problem with SNI "Specified option name is not valid here"
by Michal Trojnara 26 Jul '11

26 Jul '11

I wrote: > AFAIR SNI is supported in OpenSSL 1.0.0 and later. I will confirm it > and I will update the manual page if needed. I updated the manual: http://www.stunnel.org/static/stunnel.html Mike

1 0

stunnel 4.41 released
by Michal Trojnara 25 Jul '11

25 Jul '11

Dear Users, I have released version 4.41 of stunnel. This is a bugfix release. I highly recommend Windows users to upgrade. The ChangeLog entry: Version 4.41, 2011.07.25, urgency: MEDIUM: * Bugfixes - Fixed Windows service crash of stunnel 4.40. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.41.tar.gz: 08e0e7df42bfb8b8551eb6c4b5b50eae6051aaf75077101d729e67c7a3a00c72 Best regards, Mike

1 0

Issue with -quiet option (Windows 2000 Server SP4)
by rtr purchase 25 Jul '11

25 Jul '11

Hello, Thank you for STunnel. I've been using BLAT command line mailer for years at a client's site to send system status messages to me. Recently the client switched to ATT's SSL protected email. Blat does not support SSL. STunnel to the rescue. I started with ver. 4.39. I wanted to start and stop the STUNNEL service via script commands but found that the -quiet switch did not suppress the OK message box consistently. This naturally stopped the script from continuing. This was true of both the -start and -stop functions but was more of an issue with the -stop function. While looking through the documentation to see what I might be doing wrong, I saw that 4.40 was released (the day after I downloaded 4.39). 4.40 has the same issue with the -quiet switch but the addition of the -exit switch allowed me to start and stop STUNNEL without running it as a service. Great timing! I had tested my scripts using a Windows 7 machine where they functioned as expected. It was only when I moved them to the client's Windows 2000 Server (SP4) that this issue appeared.

1 0

Problem with SNI "Specified option name is not valid here"
by Elodie BOSSIER 25 Jul '11

25 Jul '11

Greetings, I try to use SNI with stunnel with following this help : http://answerpot.com/showthread.php?2708344-Server-side+SNI+support but i have this erreor : Line 90: "sni = virtual:elodie.franceserv.com": Specified option name is not valid here My config : stunnel 4.40 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 0.9.8o 01 Jun 2010 A part of my config file : [virtual] accept = 443 cert = /etc/ssl-fsh/cert-www.franceserv.com.pem key = /etc/ssl-fsh/key-franceserv.key connect = www.franceserv.fr:80 [sni1] ; notice that "sni" option is used instead of "accept" sni = virtual:elodie.franceserv.com cert = /etc/ssl-fsh/cert-elodie.franceserv.com.pem key = /etc/ssl-fsh/key-franceserv.key connect = elodie.franceserv.com:80 [sni2] ; notice that "sni" option is used instead of "accept" sni = virtual:befun.franceserv.com cert = /etc/ssl-fsh/cert-befun.franceserv.com.pem key = /etc/ssl-fsh/key-franceserv.key connect = befun.franceserv.com:80 Thanks so much.

1 0

stunnel 4.40 released
by Michal Trojnara 23 Jul '11

23 Jul '11

Dear Users, I have released version 4.40 of stunnel. The ChangeLog entry: Version 4.40, 2011.07.23, urgency: LOW: * New Win32 features - Added a GUI menu to save cached peer certificate chains. - Added "-exit" option to stop stunnel *not* running as a service. This option may be useful for scripts. - Added file version information to stunnel.exe. - A number of other GUI improvements. * Other new features - Hardcoded 2048-bit DH parameters are used as a fallback if DH parameters are not provided in stunnel.pem. - Default "ciphers" value updated to prefer ECDH: "ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH". - Default ECDH curve updated to "prime256v1". - Removed support for temporary RSA keys (used in obsolete export ciphers). Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.40.tar.gz: 91f32c7654dde0e1cf37ed0d8517e0d0b5985cd30443a9d64cd33d232b5fe9ce Best regards, Mike

1 0

Re: [stunnel-users] 4.39 RPM
by Jack Liu 21 Jul '11

21 Jul '11

Thank you so much for making RPMs for me~=D Mr. Jack Date: Mon, 18 Jul 2011 20:20:04 -0700 From: josealf(a)rocketmail.com Subject: Re: [stunnel-users] 4.39 RPM To: jackliu92(a)hotmail.com; stunnel-users(a)stunnel.org Jack, Take a look at my RPMs for CentOS 5. These follow the same conventions as the official RPMS:- By default log to authpriv instead of daemon facility- sample config file adjusted.- I also set the /etc/init.d/stunnel init script executable Binaries were compiled with gcc 4.4. Should work on similar systems (RHEL 5, Scientific Linux 5, Oracle Linux 5 or later). You should be able to build your own binaries starting from the source rpm. My apologies if posting attachments on this list is not encouraged. Regards,Jose From: Jack Liu <jackliu92(a)hotmail.com> To: stunnel-users(a)stunnel.org Sent: Wednesday, July 13, 2011 3:14 AM Subject: [stunnel-users] 4.39 RPM Does anyone have version 4.39 RPM inst package or knows where to download it? Thank you! _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

misconfiguration of transparent proxy
by Marco Strullato 19 Jul '11

19 Jul '11

Hi all, is there any way to use stunnel to proxy a connection without using encryption? I have an application that is listening on 0.0.0.0:port but which refuses connection if not coming from localhost:port and that application is reachable only with telnet, with no encryption. I have found a possible configuration that is the following: chroot = /var/run/stunnel/ setuid = nobody setgid = nobody pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log transparent=yes [AppSrv01] accept = 5776 connect = 4776 [AppSrv02] accept = 5777 connect = 4777 but it seems not working: that is the log. 2011.07.06 11:08:20 LOG5[30375:47349987463360]: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 2011.07.06 11:08:20 LOG5[30375:47349987463360]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.07.06 11:08:20 LOG6[30375:47349987463360]: file ulimit = 1024 (can be changed with 'ulimit -n') 2011.07.06 11:08:20 LOG6[30375:47349987463360]: poll() used - no FD_SETSIZE limit for file descriptors 2011.07.06 11:08:20 LOG5[30375:47349987463360]: 500 clients allowed 2011.07.06 11:08:20 LOG7[30375:47349987463360]: FD 4 in non-blocking mode 2011.07.06 11:08:20 LOG7[30375:47349987463360]: FD 5 in non-blocking mode 2011.07.06 11:08:20 LOG7[30375:47349987463360]: FD 6 in non-blocking mode 2011.07.06 11:08:20 LOG7[30375:47349987463360]: SO_REUSEADDR option set on accept socket 2011.07.06 11:08:20 LOG7[30375:47349987463360]: AppSrv01 bound to 0.0.0.0:5776 2011.07.06 11:08:20 LOG7[30375:47349987463360]: FD 7 in non-blocking mode 2011.07.06 11:08:20 LOG7[30375:47349987463360]: SO_REUSEADDR option set on accept socket 2011.07.06 11:08:20 LOG7[30375:47349987463360]: AppSrv02 bound to 0.0.0.0:5777 2011.07.06 11:08:20 LOG7[30376:47349987463360]: Created pid file /stunnel.pid 2011.07.06 11:08:30 LOG7[30376:47349987463360]: AppSrv01 accepted FD=8 from 10.0.1.11:41922 2011.07.06 11:08:30 LOG7[30376:1094314304]: AppSrv01 started 2011.07.06 11:08:30 LOG7[30376:1094314304]: FD 8 in non-blocking mode 2011.07.06 11:08:30 LOG7[30376:1094314304]: TCP_NODELAY option set on local socket 2011.07.06 11:08:30 LOG7[30376:1094314304]: FD 9 in non-blocking mode 2011.07.06 11:08:30 LOG7[30376:1094314304]: FD 10 in non-blocking mode 2011.07.06 11:08:30 LOG7[30376:47349987463360]: Cleaning up the signal pipe 2011.07.06 11:08:30 LOG6[30376:47349987463360]: Child process 30384 finished with code 0 2011.07.06 11:08:30 LOG7[30376:1094314304]: Connection from 10.0.1.11:41922 permitted by libwrap 2011.07.06 11:08:30 LOG5[30376:1094314304]: AppSrv01 connected from 10.0.1.11:41922 2011.07.06 11:08:30 LOG7[30376:1094314304]: SSL state (accept): before/accept initialization 2011.07.06 11:08:43 LOG3[30376:1094314304]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2011.07.06 11:08:43 LOG5[30376:1094314304]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.07.06 11:08:43 LOG7[30376:1094314304]: AppSrv01 finished (0 left) and from the standard out I get: 2011.07.06 11:08:20 LOG7[30375:47349987463360]: Snagged 64 random bytes from /home/user/.rnd 2011.07.06 11:08:20 LOG7[30375:47349987463360]: Wrote 1024 new random bytes to /home/user/.rnd 2011.07.06 11:08:20 LOG7[30375:47349987463360]: RAND_status claims sufficient entropy for the PRNG 2011.07.06 11:08:20 LOG6[30375:47349987463360]: PRNG seeded successfully 2011.07.06 11:08:20 LOG7[30375:47349987463360]: Certificate: /etc/stunnel/stunnel.pem 2011.07.06 11:08:20 LOG7[30375:47349987463360]: Key file: /etc/stunnel/stunnel.pem 2011.07.06 11:08:20 LOG7[30375:47349987463360]: SSL context initialized for service AppSrv01 2011.07.06 11:08:20 LOG7[30375:47349987463360]: Certificate: /etc/stunnel/stunnel.pem 2011.07.06 11:08:20 LOG7[30375:47349987463360]: Key file: /etc/stunnel/stunnel.pem 2011.07.06 11:08:20 LOG7[30375:47349987463360]: SSL context initialized for service AppSrv02 What happens connecting with telnet is: Trying 10.0.2.140... Connected to server. Escape character is '^]'. It seems the connection is successful but with tcpdump I see nothing and moreover I see nothing also in the application log. If I type something nothing happens. It seems that the flow is not passed to the destination port. Do you have any hint? Thanks! -- Marco

5 5

stunnel 4.40b1
by Michal Trojnara 17 Jul '11

17 Jul '11

Dear Users, I have just added a new Windows GUI menu to save peer certificate chains. Please to give it a try and let me know if there are any issues, so I can fix them in the final stunnel 4.40: ftp://ftp.stunnel.org/stunnel/stunnel-4.40b1-installer.exe Another useful function would probably be a replacement for Unix c_rehash script. 8-) I also appreciate your comments are suggestions related to the new functionality. Best regards, Mike

1 0

Windows 7 connection to HTTPS server
by Daniel Pierce 10 Jul '11

10 Jul '11

stunnel user group, Thanks Yucong Sun or your help. I have changed the configuration file values to the values that you recommended. I didn't read the documentation careful enough. [https] accept = 3600 connect = partnerlogin.advancedmd.com <https://partnerlogin.advancedmd.com/practicemanager/xmlrpc/processrequest.a sp> :443 (stopped and started the windows service to get the new configuration) HOWEVER I'm still not getting stunnel to provide the interface to the https web server. I have a http client software which I have tried both GET and POST calls to https://localhost:3600/practicemanager/xmlrpc/processrequest.asp <blocked::https://localhost:3600/practicemanager/xmlrpc/processrequest.asp> Every time the interface comes back with the error "The Connection to the Server was Reset while the Page was Loading" So I decided to try the page using a standard web browser (Firefox and IE) thinking that my client software may have a problem. I opened the browser and entered the address https://localhost:3600/practicemanager/xmlrpc/processrequest.asp <blocked::https://localhost:3600/practicemanager/xmlrpc/processrequest.asp> Got the same results. So I changed the configuration to go to the same web site as gmail with the following configuration. [https] accept = 3600 connect = mail.google.com:443 When I try to open the page with the browser to address https://localhost:3600/mail/?hl=en <blocked::https://localhost:3600/mail/?hl=en&shva=1#inbox> &shva=1#inbox, I get the same error message. NEXT I started WIRESHARK on the network and filtered for packets coming from/to my host computer. When I enter https://localhost:3600/mail/?hl=en <blocked::https://localhost:3600/mail/?hl=en&shva=1#inbox> &shva=1#inbox on the browser. The following details were captured by WIRESHARK. Source Destination Protocol Lenth Info 74.125.225.53 192.168.1.70 TLSV1 107 Application Data Protocol: http 192.168.1.70 74.125.255.53 TCP 54 https [ACK] Seq=1 Ack=54 win=16181 Len=0 74.125.225.53 192.168.1.70 TLSV1 112 Application Data Protocol: http 192.168.1.70 74.125.255.53 TLSV1 81 Encrypted Alert 192.168.1.70 74.125.255.53 TCP 54 60089 > https [FIN, ACK] Seq=28 Ack=112 win=16167 Len=0 192.168.1.70 74.125.255.54 TCP 1484 [TCP segment of a reassembled PDU] 192.168.1.70 74.125.255.53 TLSv1 316 Application Data 74.125.225.53 192.168.1.70 TCP 60 https > 60089 [FIN, ACK] Seq=112 Ack=29 win=196 len=0 192.168.1.70 74.125.255.53 TCP 54 60089 > https [ACK] Seq=29 Ack=113 win=16167 Len=0 74.125.225.54 192.168.1.70 TCP 60 https > 60113 [ACK] Seq=1 Ack=1693 win=285 len=0 74.125.225.54 192.168.1.70 TLSV1 457 Application Data Protocol: http 192.168.1.70 74.125.255.54 TCP 54 60113 > https [ACK] Seq=1693 Ack=404 win=16445 Len=0 SO the packets are being sent and returned, but the protocol is erroring out for GOOGLE MAIL. NEXT When I configure the service for the other https web server. https://localhost:3600/practicemanager/xmlrpc/processrequest.asp <blocked::https://localhost:3600/practicemanager/xmlrpc/processrequest.asp> I get a simular exchange, but more reference to change cipher Spec. and http RST for different ip address Source Destination Protocol Lenth Info 192.168.1.70 74.125.255.54 TCP 66 60840 > https [SYN] 74.125.225.54 192.168.1.70 TCP 66 https > 60840 [SYN, ACK] 192.168.1.70 74.125.255.54 TCP 54 60840 > https [ACK] 192.168.1.70 74.125.255.54 TLSv1 451 client Hello 74.125.225.54 192.168.1.70 TCP 60 https > 60840 [ACK] 74.125.225.54 192.168.1.70 TLSv1 97 change cipher Spec, Encrypted Handshake Message 192.168.1.70 74.125.255.54 TLSv1 162 Application Data 74.125.225.54 192.168.1.70 TCP 60 https > 60840 [ACK] 192.168.1.70 98.137.80.34 TCP 54 60819 > http [RST, ACK] STUNNEL LOG for partnerlogin.advancedmd.com:443 NO OBVIOUS ERRORS 2011.07.08 21:31:21 LOG7[4960:4568]: No limit detected for the number of clients 2011.07.08 21:31:21 LOG7[4960:4568]: make_sockets: s_socket#1: FD=144 allocated (blocking mode) 2011.07.08 21:31:21 LOG7[4960:4568]: make_sockets: s_socket#2: FD=148 allocated (blocking mode) 2011.07.08 21:31:21 LOG7[4960:4568]: make_sockets: s_accept: FD=152 allocated (non-blocking mode) 2011.07.08 21:31:21 LOG5[4960:4568]: stunnel 4.39 on x86-pc-mingw32-gnu platform 2011.07.08 21:31:21 LOG5[4960:4568]: Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 2011.07.08 21:31:21 LOG5[4960:4568]: Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6 2011.07.08 21:31:21 LOG5[4960:4568]: Reading configuration from file stunnel.conf 2011.07.08 21:31:21 LOG7[4960:4568]: Snagged 64 random bytes from C:/.rnd 2011.07.08 21:31:22 LOG7[4960:4568]: Wrote 1024 new random bytes to C:/.rnd 2011.07.08 21:31:22 LOG7[4960:4568]: PRNG seeded successfully 2011.07.08 21:31:22 LOG7[4960:4568]: Configuration SSL options: 0x01000000 2011.07.08 21:31:22 LOG7[4960:4568]: SSL options set: 0x01000004 2011.07.08 21:31:22 LOG7[4960:4568]: Certificate: stunnel.pem 2011.07.08 21:31:22 LOG7[4960:4568]: Certificate loaded 2011.07.08 21:31:22 LOG7[4960:4568]: Key file: stunnel.pem 2011.07.08 21:31:22 LOG7[4960:4568]: Private key loaded 2011.07.08 21:31:22 LOG7[4960:4568]: SSL context initialized for service http 2011.07.08 21:31:22 LOG5[4960:4568]: Configuration successful 2011.07.08 21:31:22 LOG7[4960:4568]: accept socket: FD=144 allocated (non-blocking mode) 2011.07.08 21:31:22 LOG7[4960:4568]: Option SO_REUSEADDR set on accept socket 2011.07.08 21:31:22 LOG7[4960:4568]: Service http bound to 0.0.0.0:3600 2011.07.08 21:31:22 LOG7[4960:4568]: Service http opened FD=144 Do I need to have the Public Key Certificate for the remote serve installed in stunnel for it to access the page? I'm trying to find a simple configuration to prove out that the basic stunnel application is working. Any suggestions? Is there something basic that I'm missing? If I send a GET request, I should get a response from the https server that CONNECT is configurred for. Is there a compatibility issue between OpenSSL and https web server? Thanks in advance for the help. Dan

2 3

problem running on Mac OS X
by athir＠nuaimi.com 07 Jul '11

07 Jul '11

Hi there. I've built stunnel on the Mac (including the patch for str.c) and have problem when I run it. Whenever it gets a request on one side (from a browser), I see the following in the log. The weird thing is that when I run stunnel in gdb it works?? 2011.07.05 17:51:00 LOG7[6300:4297842688]: Service https started 2011.07.05 17:51:00 LOG7[6300:4297842688]: Option TCP_NODELAY set on local socket 2011.07.05 17:51:00 LOG7[6300:4297842688]: Waiting for a libwrap process 2011.07.05 17:51:00 LOG7[6300:4297842688]: Acquired libwrap process #0 2011.07.05 17:51:00 LOG3[6300:4297842688]: Unexpected socket close (read_blocking) 2011.07.05 17:51:00 LOG5[6300:4297842688]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Any advice would be appreciated. thanks Athir Nuaimi

3 2

Windows 7 connection to HTTPS server
by Daniel Pierce 06 Jul '11

06 Jul '11

stunnel user group, I'm trying to use stunnel to connect to a secure web server to do an XML interface, but I'm having no luck. What am I missing? Environment OS = Windows 7 Ultimate stunnel version = 4.39 (latest release) stunnel installed as service and is running. Windows Firewall = OFF, but have added stunnel to the application list Anti-Virus = ESET, have disabled Web Access Protection Configuration File cert = stunnel.pem options = NO_SSLv2 debug = 7 output = c:\Program files\stunnel\stunnel.log client = yes [https] accept = 3600 connect = <https://partnerlogin.advancedmd.com/practicemanager/xmlrpc/processrequest.a sp> https://partnerlogin.advancedmd.com/practicemanager/xmlrpc/processrequest.as p ;TIMEOUTclose = 0 Log File 2011.07.06 16:00:07 LOG7[5880:6040]: No limit detected for the number of clients 2011.07.06 16:00:07 LOG7[5880:6040]: make_sockets: s_socket#1: FD=136 allocated (blocking mode) 2011.07.06 16:00:07 LOG7[5880:6040]: make_sockets: s_socket#2: FD=140 allocated (blocking mode) 2011.07.06 16:00:07 LOG7[5880:6040]: make_sockets: s_accept: FD=144 allocated (non-blocking mode) 2011.07.06 16:00:07 LOG5[5880:6040]: stunnel 4.39 on x86-pc-mingw32-gnu platform 2011.07.06 16:00:07 LOG5[5880:6040]: Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 2011.07.06 16:00:07 LOG5[5880:6040]: Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6 2011.07.06 16:00:07 LOG5[5880:6040]: Reading configuration from file stunnel.conf 2011.07.06 16:00:07 LOG7[5880:6040]: Snagged 64 random bytes from C:/.rnd 2011.07.06 16:00:07 LOG7[5880:6040]: Wrote 1024 new random bytes to C:/.rnd 2011.07.06 16:00:07 LOG7[5880:6040]: PRNG seeded successfully 2011.07.06 16:00:07 LOG3[5880:6040]: Unknown TCP service '//partnerlogin.advancedmd.com/practicemanager/xmlrpc/processrequest.asp' 2011.07.06 16:00:07 LOG6[5880:6040]: Cannot resolve 'https://partnerlogin.advancedmd.com/practicemanager/xmlrpc/processrequest.a sp' - delaying DNS lookup 2011.07.06 16:00:07 LOG7[5880:6040]: Configuration SSL options: 0x01000000 2011.07.06 16:00:07 LOG7[5880:6040]: SSL options set: 0x01000004 2011.07.06 16:00:07 LOG7[5880:6040]: Certificate: stunnel.pem 2011.07.06 16:00:07 LOG7[5880:6040]: Certificate loaded 2011.07.06 16:00:07 LOG7[5880:6040]: Key file: stunnel.pem 2011.07.06 16:00:07 LOG7[5880:6040]: Private key loaded 2011.07.06 16:00:07 LOG7[5880:6040]: SSL context initialized for service https 2011.07.06 16:00:07 LOG5[5880:6040]: Configuration successful 2011.07.06 16:00:07 LOG7[5880:6040]: accept socket: FD=136 allocated (non-blocking mode) 2011.07.06 16:00:07 LOG7[5880:6040]: Option SO_REUSEADDR set on accept socket 2011.07.06 16:00:07 LOG7[5880:6040]: Service https bound to 0.0.0.0:3600 2011.07.06 16:00:07 LOG7[5880:6040]: Service https opened FD=136 I can open a Firefox browser and the designated URL address resolves, but stunnel cannot resolve it. Do I have the configuration wrong or is Windows 7 blocking the connection? I'm able to send an XML message from by application to 127.0.0.1:3600 and stunnel responds with a successful but EMPTY RESPONSE. Thanks in advance for your help. Dan Pierce Xpert Assist Corp.

2 1

stunnel 4.39 released
by Michal Trojnara 06 Jul '11

06 Jul '11

Dear Users, I have just released version 4.39 of stunnel. This version includes major improvements of the Windows GUI and installer. The ChangeLog entry: Version 4.39, 2011.07.06, urgency: LOW: * New features - New Win32 installer module to build self-signed stunnel.pem. - Added configuration file editing with Windows GUI. - Added log file reopening file editing with Windows GUI. It might be useful to also implement log file rotation. - Improved configuration file reload with Windows GUI. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.39.tar.gz: 972e4c150e3012ba8777f149c858e1e290aeb7ad7976e1551ac1752bc04fb0ed Best regards, Mike

1 0

stunnel 4.38 released
by Michal Trojnara 29 Jun '11

29 Jun '11

Dear Users, I have just released version 4.38 of stunnel. The ChangeLog entry: Version 4.38, 2011.06.28, urgency: MEDIUM: * New features - Server-side SNI implemented (RFC 3546 section 3.1) with a new service-level option "nsi". - "socket" option also accepts "yes" and "no" for flags. - Nagle's algorithm is now disabled by default for improved interactivity. * Bugfixes - A compilation fix was added for OpenSSL version < 1.0.0. - Signal pipe set to non-blocking mode. This bug caused hangs of stunnel features based on signals, e.g. local mode, FORK threading, or configuration file reload on Unix. Win32 platform was not affected. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.38.tar.gz: aa49012195fde4dc3e4bed2bb25283cb40a6e0ad8295a47e730652f611e2268c Best regards, Mike

2 1

STunnel on 443 (ip1) and iis (443) on ip2?
by R. van der Gugten 27 Jun '11

27 Jun '11

Hi, Is it possible to run STunnel on my server to lisen to IP1 on port 443 And to have IIS listen to IP2 on port 443? Should I make changes in the config file? Thanks, Reinier Current server stunnel file: cert = stunnel.pem key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Authentication stuff verify = 2 CAfile = certs.pem ; Use it for client mode client = no ; Service-level configuration [SQLServer] accept = <<IP1:xxx.xxx.xxx.xxx>>:443 connect = 127.0.0.1:31433

2 1

Stuunnel Help
by Chris Pershin 24 Jun '11

24 Jun '11

Hello All, I am new to stunnel and am trying to solve a problem. When I try to start stunnel I get the following log file Reading configuration from file stunnel.conf PRNG seeded successfully Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded SSL context initialized for service pop3s Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded SSL context initialized for service imaps Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded SSL context initialized for service ssmtp Configuration successful No limit detected for the number of clients accept socket: FD=164 allocated (non-blocking mode) Option SO_REUSEADDR set on accept socket Service pop3s bound to 0.0.0.0:110 Service pop3s opened FD=164 accept socket: FD=188 allocated (non-blocking mode) Option SO_REUSEADDR set on accept socket Service imaps bound to 0.0.0.0:143 Service imaps opened FD=188 accept socket: FD=196 allocated (non-blocking mode) Option SO_REUSEADDR set on accept socket Error binding ssmtp to 0.0.0.0:25 bind: No error (0) Server is down My Config file is: cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [pop3s] accept = 110 connect = pop.gmail.com:995 [imaps] accept = 143 connect = imap.gmail.com:993 [ssmtp] accept = 25 connect = smtp.gmail.com:465 Can someone please help me? Thanks Chris

2 1

Server-side SNI support
by Michal Trojnara 18 Jun '11

18 Jun '11

Dear Users, I'd like the next version of stunnel to support server-side Server Name Indication: https://secure.wikimedia.org/wikipedia/en/wiki/Server_Name_Indication The new service-level stunnel.conf option would be: sni = <master service>:<sni host> For example: [virtual] accept = 443 ; settings for clients that didn't send an SNI extension cert = default.pem connect = default.internal.mydomain.com:80 [sni1] ; notice that "sni" option is used instead of "accept" sni = virtual:server1.mydomain.com cert = server1.pem connect = server1.internal.mydomain.com:80 [sni2] sni = virtual:server2.mydomain.com cert = server2.pem connect = server2.internal.mydomain.com:80 ; other service-level options may be specified here verify = 3 CAfile = server2-allowed-clients.pem [sni3] sni = virtual:server3.mydomain.com cert = server3.pem connect = server3.internal.mydomain.com:80 I would appreciate your comments on the user interface I designed for this functionality. Best regards, Michal Trojnara

2 3

stunnel 4.37 released
by Michal Trojnara 17 Jun '11

17 Jun '11

Dear Users, I have just released version 4.37 of stunnel. This release is mainly intended to fix bugs and portability issues introduced in versions 4.35 and 4.36. This version also provides new security defaults, updated to better match current best practices in cryptographic applications. The ChangeLog entry: Version 4.37, 2011.06.17, urgency: MEDIUM: * New features - Client-side SNI implemented (RFC 3546 section 3.1). - Default "ciphers" changed from the OpenSSL default to a more secure and faster "RC4-MD5:HIGH:!aNULL:!SSLv2". A paranoid (and usually slower) setting would be "HIGH:!aNULL:! SSLv2". - Recommended "options = NO_SSLv2" added to the sample stunnel.conf file. - Default client method upgraded from SSLv3 to TLSv1. To connect servers without TLS support use "sslVersion = SSLv3" option. - Improved --enable-fips and --disable-fips ./configure option handling. - On startup stunnel now compares the compiled version of OpenSSL against the running version of OpenSSL. A warning is logged on mismatch. * Bugfixes - Non-blocking socket handling in local mode fixed (Debian bug #626856). - UCONTEXT threading mode fixed. - Removed the use of gcc Thread-Local Storage for improved portability. - va_copy macro defined for platforms that do not have it. - Fixed "local" option parsing on IPv4 systems. - Solaris compilation fix (redefinition of "STR"). Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.37.tar.gz: 02ca30609ccb26f6e52ff7eb79a6778ea452a04432eaef7d959d19933f6fe109 Best regards, Mike

1 0

stunnel-4.36 issues ("Operation now in progress")
by Schmidt, Bernhard 16 Jun '11

16 Jun '11

Hi, today our blessed Enterprise-class distribution SLES11.1 made a major upgrade from stunnel 4.27 to stunnel 4.36, which somewhat broke our monitoring agent. Config: ------ client = no pid = /var/run/stunnel.pid debug = 4 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = /etc/stunnel/stunnel.pem [uptimeagent] accept = 9998 exec = /opt/uptime-agent/bin/uptimeagent ------ We get the following output when connecting: 2011.06.16 15:13:37 LOG7[4597:140226692765440]: local socket: FD=12 allocated (non-blocking mode) 2011.06.16 15:13:37 LOG7[4597:140226692765440]: Service uptimeagent accepted FD=12 from 10.156.10.160:55926 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Service uptimeagent started 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Option TCP_NODELAY set on local socket 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Waiting for a libwrap process 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Acquired libwrap process #0 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Releasing libwrap process #0 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Released libwrap process #0 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Service uptimeagent permitted by libwrap from 10.156.10.160:55926 2011.06.16 15:13:37 LOG5[4597:140226692757264]: Service uptimeagent accepted connection from 10.156.10.160:55926 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): before/accept initialization 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 read client hello A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 write server hello A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 write certificate A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 write server done A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 flush data 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 read client key exchange A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 read finished A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 write change cipher spec A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 write finished A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 flush data 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 1 items in the session cache 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 client connects (SSL_connect()) 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 client connects that finished 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 client renegotiations requested 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 1 server connects (SSL_accept()) 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 1 server connects that finished 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 server renegotiations requested 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 session cache hits 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 external session cache hits 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 session cache misses 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 session cache timeouts 2011.06.16 15:13:37 LOG6[4597:140226692757264]: SSL accepted: new session negotiated 2011.06.16 15:13:37 LOG6[4597:140226692757264]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2011.06.16 15:13:37 LOG7[4597:140226692757264]: socket#1: FD=13 allocated (non-blocking mode) 2011.06.16 15:13:37 LOG7[4597:140226692757264]: socket#2: FD=14 allocated (non-blocking mode) 2011.06.16 15:13:37 LOG3[4597:140226692757264]: connect: Operation now in progress (115) 2011.06.16 15:13:37 LOG5[4597:140226692757264]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Service uptimeagent finished (0 left) 2011.06.16 15:13:37 LOG7[4597:140226692757264]: str_stats: 0 blocks, 0 bytes We did not see this in 4.27, 4.33 and 4.34, but we see it in a 3rd party 4.35 RPM. This suspiciously sounds like http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626856, and according to the changelog there is already a fix in the unreleased 4.37 version for this. - Could this in fact be the same bug? - Is the patch available somewhere? I could not find a source repository - Is there a workaround? Thanks, Bernhard

1 0

Login log-level when verify=3
by Philippe Hameau 15 Jun '11

15 Jun '11

Hi everyone, I'm happily using stunnel for almost 8 years now :) I recently began to use verify=3 and i'm quite disappointed that a succesful access does not appear in the logs unless they are set to quite verbose. To be precise, i think it makes sense, for paranoid setups to keep track of successful accesses to. I'd suggest logging remote end's DN for log level =3 or 4. As there were some improvements lately in verify=3, i hope you could integrate this too. Thanks

2 1

STUNNEL 4.36 Windows - https - 404 Error
by Narasimhan Rangaswamy 13 Jun '11

13 Jun '11

Whenever I connect to "http://localhost:20010" I get the proper https repsonse from server "https://sslwebsite.xxxx.com". But the moment I add, "https://localhost:20010/someprogrampath", I get "404 File Not found error". But if I access, " https://sslwebsite.xxxx.com/someprogrampath" directly it WORKS. Any ideas? I use the following configuration. =================================== ; Authentication stuff verify = 2 ; Don't forget to c_rehash CApath ;CApath = c:\certs ; It's often easier to use CAfile CAfile = c:\certs\MetavanteTest_client.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = c:\stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [https] cert = c:\certs\xxxx_client.pem accept = 20010 connect = sswebsite.xxxx.com:443 ;TIMEOUTclose = 0 ; vim:ft=dosini sslVersion = all =========================================

2 1

Re: [stunnel-users] How to make stunnel autorun on startup?
by Jack Liu 11 Jun '11

11 Jun '11

You got it! Thank you so much! Mr. Jack Subject: Re: [stunnel-users] How to make stunnel autorun on startup? To: jackliu92(a)hotmail.com From: josealf(a)rocketmail.com Date: Sat, 11 Jun 2011 04:17:05 +0000 Most likely it is in /usr/bin Update the script From: Jack Liu <jackliu92(a)hotmail.com> Date: Fri, 10 Jun 2011 21:24:22 -0600 To: <josealf(a)rocketmail.com>; <stunnel-users(a)stunnel.org> Subject: RE: [stunnel-users] How to make stunnel autorun on startup? Sorry, I just hit reply and forgot to add stunnel-users(a)stunnel.org I have the script, however, my system is centos and the following error occur when start stunnel service # service stunnel start Starting stunnel: /etc/init.d/stunnel: line 77: /usr/sbin/stunnel: No such file or directory Line 77 is: #Path to executable SEXE=/usr/sbin/stunnel I have no idea where my stunnel executable is. Thank you! Mr. Jack > Subject: Re: [stunnel-users] How to make stunnel autorun on startup? > To: jackliu92(a)hotmail.com; stunnel-users-bounces(a)stunnel.org; stunnel-users(a)stunnel.org > From: josealf(a)rocketmail.com > Date: Sat, 11 Jun 2011 02:38:26 +0000 > > Jack, > > On which platform? > On Red Hat and derived distributions, You copy the stunnel startup script to the /etc/init.d directory and set it to run at startup with the chkconfig command. > > Assuming your stunnel startup script is stunnel, you do > > /sbin/chkconfig stunnel on > > You can find an init script in the stunnel source package. > > Regards, > > Jose > > -----Original Message----- > From: Jack Liu <jackliu92(a)hotmail.com> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Fri, 10 Jun 2011 20:06:48 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] How to make stunnel autorun on startup? > >_______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

How to make stunnel autorun on startup?
by Jack Liu 11 Jun '11

11 Jun '11

How do you make stunnel autorun on startup? Mr. Jack

2 2

Cant get Stunnel to work (SEARCHED GOOGLE FOR HOURS)
by Matt Labrasseur 09 Jun '11

09 Jun '11

root@ubuntu:/usr/local/etc/stunnel# /usr/local/sbin/stunnel 2011.06.08 23:54:48 LOG7[23242:3077367488]: Snagged 64 random bytes from /root/.rnd 2011.06.08 23:54:48 LOG7[23242:3077367488]: Wrote 1024 new random bytes to /root/.rnd 2011.06.08 23:54:48 LOG7[23242:3077367488]: RAND_status claims sufficient entropy for the PRNG 2011.06.08 23:54:48 LOG6[23242:3077367488]: PRNG seeded successfully Illegal instruction i cannot get it to start i tried to make a new stunnel.pem file root@ubuntu:/usr/local/etc/stunnel# openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem Generating a 1024 bit RSA private key ....++++++ ....................++++++ writing new private key to 'stunnel.pem' Illegal instruction helpppp Matthew Leb*****, A+ Linux + Network+ MCP MCITP MCTS Unified Messaging Architect TheServerGroup.com Toll Free 1-877-777-6514<https://mail.theservergroup.com/owa/?ae=PreFormAction&a=Reply&t=IPM.Note&id…> Ext 106

2 1

stunnel via xinetd and rsync problem
by campbellmc 06 Jun '11

06 Jun '11

Hi, I am having problems getting stunnel to tunnel rsync connections when stunnel is called from xinetd. I can get it to work fine when stunnel is run as a daemon, but when I try rsyncing from the client via xinetd, rsync complains: [root@lambeth ~]# rsync -av --port 2873 192.168.10.130::sanbackup . rsync: server sent "2011.06.06 06:13:56 LOG7[18335:3086816976]: Snagged 64 random bytes from /dev/urandom" rather than greeting rsync error: error starting client-server protocol (code 5) at main.c(1296) [receiver=2.6.8] [root@lambeth ~]# It appears that rsync on the client is getting the output of /dev/urandom, and the connection is abandoned. Any suggestions on how to avoid this? stunnel.conf (client): client = yes pid = /var/run/stunnel.pid connect = 192.168.10.240:2873 debug = 7 output = /var/log/stunnel.log accept = 2873 cert = /etc/stunnel/lambeth.pem xinetd config on client for rsync [ssync] service ssync { disable = no port = 2873 socket_type = stream wait = no user = root server = /usr/sbin/stunnel server_args = /etc/stunnel/stunnel-rsync-client.conf log_on_success += USERID log_on_failure += USERID } Any help welcomed! Regards, -Cam

1 0

Help with stunnel.config
by Quad Tran Inc quadtran 01 Jun '11

01 Jun '11

Hello, I am currently using your older product, SSLPROXY 1.1.2, and it is working fine, but I was looking to move to your STUNNEL 4.36. I cannot get the product to work, but that is probably because I have got the 'stunnel.conf' set up improperly. Is it at all possible to send me what the config file should look like if I supplied you with the parameters that I am using successfully with your older product. Current parameters on first session: sslproxy -L192.168.1.1 -l1024 -R192.168.1.2 -r24 -s -c quadCert.pem Current parameters on second session: sslproxy -L192.168.1.1 -l1024 -R192.168.0.2 -r23 -s -c quadCert.pem I would appreciate any help you can give me, and thank you for your time in this matter. Regards, Joe Lisi Quad-Tran of Michigan, Inc.

1 0

Slow connection to remote stunnel
by Thorsten Kampe 31 May '11

31 May '11

Hi, I'm using stunnel 4.36 on Linux to secure Samba SWAT. When I connect directly to the remot stunnel port with my browser on Windows 7 (https://swat-server:stunnel-port), I get a long delay after entering my credentials (about 60 seconds or so). This seems to be known issue (for instance see "You will be prompted for the Linux root user username and password. There will be a delay of about 60 to 75 seconds with each login."[1].) I did a Wireshark trace and it seems that the server simply does not respond during that time. But when I connect to the local stunnel client (http://localhost:stunnel-port), the SWAT page displays immediately. Is that "normal". How can I get the same speed without a stunnel client? Thorsten [1] <http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_: _Ch10_:_Windows,_Linux,_and_Samba#Test_The_Secure_SWAT_Login>

2 1

stunnel cannot exec SWAT
by Thorsten Kampe 28 May '11

28 May '11

Hi, I'm successfully securing Samba SWAT on Linux with stunnel 4.36. The connection goes like this: browser -> http://localhost:901 (stunnel) -> remote:50901 (xinetd) -> stunnel -> remote:901 (xinetd) -> SWAT. Now I want to remove the xinetd swat file and have stunnel directly call swat: browser -> http://localhost:901 (stunnel) -> remote:50901 (xinetd) -> stunnel -> SWAT I do this by commenting out "connect" and setting exec and execargs (as documented in stunnel's man page): #connect = 901 exec = /usr/sbin/swat execargs = swat Now I get a "Connection closed by remote server" in my browser. The log shows this: [xinetd] START: swat-ssl pid=1026 from=192.168.0.253 [stunnel] Reading configuration from file /etc/stunnel/swat.xconf [stunnel] Could not load DH parameters from /etc/stunnel/stunnel.pem [stunnel] Configuration successful [stunnel] No limit detected for the number of clients [stunnel] stunnel 4.36 on i686-pc-linux-gnu with OpenSSL 1.0.0d 8 Feb 2011 [stunnel] Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL, IPv6 [stunnel] Service stunnel accepted connection from 192.168.0.253:60418 [stunnel] SSL accepted: new session negotiated [stunnel] Negotiated ciphers: ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 [stunnel] connect: Operation now in progress (115) [stunnel] Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket [stunnel] pid=1026 duration=0(sec) [xinetd] EXIT: swat-ssl status=0 pid=1026 duration=0(sec) The successful connection (when xinetd calls swat) looks like this: [xinetd] START: swat-ssl pid=5076 from=192.168.0.253 [everything as above] [stunnel] connect_blocking: connecting 127.0.0.1:901 [xinetd] START: swat pid=5085 from=127.0.0.1 [stunnel] connect_blocking: connected 127.0.0.1:901 [stunnel] Service stunnel connected remote server from 127.0.0.1:47098 [stunnel] SSL_shutdown successfully sent close_notify [stunnel] Connection closed: 288 bytes sent to SSL, 512 bytes sent to socket [xinetd] EXIT: swat status=0 pid=5085 duration=0(sec) [xinetd] EXIT: swat-ssl status=0 pid=5076 duration=0(sec) The only difference I can see is the "connect" in the problem case versus the "connect_blocking" in the success case. Who can shed some light? Thorsten

1 0

stunnel doing client cert authentication?
by Johann Smith 24 May '11

24 May '11

Hi, I have stunnel running as an https server. Can stunnel handle/validate client certificates in this mode? How are authentication details forwarded to the http backend, by additional headers? Thank you! Johann

2 1

During make of stunnel-4.36 on OSX: "str.c:83: error: thread-local storage not supported for this target"
by SciFi 24 May '11

24 May '11

Hello, During make, I suddenly got this, from the stunnel-4.36 tarball: > str.c:83: error: thread-local storage not supported for this target while it was compiling src/str.c . I'm running MacOSX 10.6.7 with Xcode-3.2.6. I always compile for i386 32-bit mode. (The kernel must be in 32-bit mode for this model iMac, even though most tasks will run in 64-bit mode.) The stunnel-4.34 was built and is (still) running fine here. (I must've skipped -4.35 for some reason.) The src/str.c does seem to be a new module in 4.36, however. I configure stunnel this way: $ ./configure \ --enable-dependency-tracking \ --enable-static \ --enable-shared \ --with-ssl=/usr/local/ssl (same configure with 4.34 & 4.36) The configure step found most things, including libwrap etc. They're using the same compiler and other flags etc.: $ $CC --version i686-apple-darwin10-gcc-4.2.1 (GCC) 4.2.1 (Apple Inc. build 5666) (dot 3) […] (I never use a pkg-mgr such as Macports or Fink; besides, they are both now back-level with stunnel.) I'm skeptical in upgrading Xcode to their 4.x series, with Apple's insistence we use the LLVM family there. ;) I'm just a hobbyist, using stunnel to connect Pan to NNTP servers thru their SSL services (including sending this message via Gmane). I am happy with 4.34 in this regard. If it's not too much trouble, though, could someone help further with this problem in 4.36, please? Thank you.

2 4

stunnel4 with exec as service for securing pop3
by Jörg-Volker Peetz 23 May '11

23 May '11

I would like to run the stunnel4 daemon in order to provide a pop3s service by using a pop server (solid-pop3d). The following configuration file doesn't work (the pop3 server doesn't start, I think) and I would like to ask for any hints. --stunnel.conf>>> cert = /etc/stunnel/stunnel4.pem sslVersion = SSLv3 [pop3s] accept = 995 exec = /usr/sbin/solid-pop3d execargs = solid-pop3d <<<stunnel.conf-- I would expect stunnel4 to start up solid-pop3d every time someone connects to port 995 and communicate to solid-pop3d, just like inetd would do, if configured to serve solid-pop3d. By the way, I have opened the service "pop3s" in /etc/hosts.allow. Thanks in advance for any help. -- Best regards, Jörg-Volker.

4 8

Re: [stunnel-users] problem with stunnel 4.36 (server mode), error after the 1st connexion
by Jose Alf. 15 May '11

15 May '11

Hi Laurent, Does it works fine with a previous version? If so, What's the lates version that works? If you google for "bind#1: Invalid argument (22) aix stunnel" you will find a mail thread with a similar issue. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: stunnel-users(a)stunnel.org Sent: Fri, May 13, 2011 6:39:29 AM Subject: [stunnel-users] problem with stunnel 4.36 (server mode), error after the 1st connexion Hi everyone, i have installed the stunnel 4.36 today and now i have some errors... The 1st connexion is working fine : 011.05.13 13:23:44 LOG5[1802366:1]: Reading configuration from file /opt/freeware/etc/stunnel/stunnel_server_level1.conf 2011.05.13 13:23:44 LOG7[1802366:1]: Snagged 64 random bytes from //.rnd 2011.05.13 13:23:44 LOG7[1802366:1]: Wrote 1024 new random bytes to //.rnd 2011.05.13 13:23:44 LOG7[1802366:1]: PRNG seeded successfully 2011.05.13 13:23:44 LOG7[1802366:1]: Using DH parameters from /opt/freeware/etc/stunnel/ca_nopass.pem 2011.05.13 13:23:44 LOG6[1802366:1]: DH initialized with 512 bit key 2011.05.13 13:23:44 LOG7[1802366:1]: ECDH initialized 2011.05.13 13:23:44 LOG7[1802366:1]: Certificate: /opt/freeware/etc/stunnel/ca_nopass.pem 2011.05.13 13:23:44 LOG7[1802366:1]: Certificate loaded 2011.05.13 13:23:44 LOG7[1802366:1]: Key file: /opt/freeware/etc/stunnel/ca_nopass.pem 2011.05.13 13:23:44 LOG7[1802366:1]: Private key loaded 2011.05.13 13:23:44 LOG7[1802366:1]: Verify directory set to /opt/freeware/etc/stunnel/CA_files/ 2011.05.13 13:23:44 LOG7[1802366:1]: Added /opt/freeware/etc/stunnel/CA_files/ revocation lookup directory 2011.05.13 13:23:44 LOG7[1802366:1]: Added /opt/freeware/etc/stunnel/CRL_files/ revocation lookup directory 2011.05.13 13:23:44 LOG5[1802366:1]: Peer certificate location /opt/freeware/etc/stunnel/CA_files/ 2011.05.13 13:23:44 LOG7[1802366:1]: SSL context initialized for service pesitip 2011.05.13 13:23:44 LOG5[1802366:1]: Configuration successful 2011.05.13 13:23:44 LOG5[1802366:1]: No limit detected for the number of clients 2011.05.13 13:23:44 LOG7[1802366:1]: signal_pipe: FD=4 allocated (blocking mode) 2011.05.13 13:23:44 LOG7[1802366:1]: signal_pipe: FD=5 allocated (blocking mode) 2011.05.13 13:23:44 LOG7[1802366:1]: accept socket: FD=6 allocated (non-blocking mode) 2011.05.13 13:23:44 LOG7[1802366:1]: Option SO_REUSEADDR set on accept socket 2011.05.13 13:23:44 LOG7[1802366:1]: Service pesitip bound to 0.0.0.0:10443 2011.05.13 13:23:44 LOG7[1802366:1]: Service pesitip opened FD=6 2011.05.13 13:23:44 LOG7[1802366:1]: Created pid file /var/adm/stunnel_server_level1.pid 2011.05.13 13:23:44 LOG5[1802366:1]: stunnel 4.36 on powerpc-ibm-aix5.2.0.0 with OpenSSL 0.9.8k 25 Mar 2009 2011.05.13 13:23:44 LOG5[1802366:1]: Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL, IPv6 2011.05.13 13:28:36 LOG7[1802366:1]: local socket: FD=7 allocated (non-blocking mode) 2011.05.13 13:28:36 LOG7[1802366:1]: Service pesitip accepted FD=7 from 10.254.181.230:2991 2011.05.13 13:28:36 LOG7[1802366:258]: Service pesitip started 2011.05.13 13:28:36 LOG7[1802366:258]: Option TCP_NODELAY set on local socket 2011.05.13 13:28:36 LOG5[1802366:258]: Service pesitip accepted connection from 10.254.181.230:2991 2011.05.13 13:28:36 LOG7[1802366:258]: SSL state (accept): before/accept initialization 2011.05.13 13:28:36 LOG7[1802366:258]: SSL state (accept): SSLv3 read client hello A 2011.05.13 13:28:36 LOG7[1802366:258]: SSL state (accept): SSLv3 write server hello A 2011.05.13 13:28:36 LOG7[1802366:258]: SSL state (accept): SSLv3 write certificate A 2011.05.13 13:28:36 LOG7[1802366:258]: SSL state (accept): SSLv3 write certificate request A 2011.05.13 13:28:36 LOG7[1802366:258]: SSL state (accept): SSLv3 flush data 2011.05.13 13:28:37 LOG7[1802366:258]: Starting certificate verification: depth=1, /O=SWIFT 2011.05.13 13:28:37 LOG5[1802366:258]: Certificate accepted: depth=1, /O=SWIFT 2011.05.13 13:28:37 LOG7[1802366:258]: Starting certificate verification: depth=0, /C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts 2011.05.13 13:28:37 LOG5[1802366:258]: Certificate accepted: depth=0, /C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 read client certificate A 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 read client key exchange A 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 read certificate verify A 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 read finished A 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 write change cipher spec A 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 write finished A 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 flush data 2011.05.13 13:28:37 LOG7[1802366:258]: 1 items in the session cache 2011.05.13 13:28:37 LOG7[1802366:258]: 0 client connects (SSL_connect()) 2011.05.13 13:28:37 LOG7[1802366:258]: 0 client connects that finished 2011.05.13 13:28:37 LOG7[1802366:258]: 0 client renegotiations requested 2011.05.13 13:28:37 LOG7[1802366:258]: 1 server connects (SSL_accept()) 2011.05.13 13:28:37 LOG7[1802366:258]: 1 server connects that finished 2011.05.13 13:28:37 LOG7[1802366:258]: 0 server renegotiations requested 2011.05.13 13:28:37 LOG7[1802366:258]: 0 session cache hits 2011.05.13 13:28:37 LOG7[1802366:258]: 0 external session cache hits 2011.05.13 13:28:37 LOG7[1802366:258]: 0 session cache misses 2011.05.13 13:28:37 LOG7[1802366:258]: 0 session cache timeouts 2011.05.13 13:28:37 LOG6[1802366:258]: SSL accepted: new session negotiated 2011.05.13 13:28:37 LOG6[1802366:258]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2011.05.13 13:28:37 LOG7[1802366:258]: remote socket: FD=8 allocated (non-blocking mode) 2011.05.13 13:28:37 LOG6[1802366:258]: connect_blocking: connecting 159.50.5.165:10016 2011.05.13 13:28:37 LOG5[1802366:258]: connect_blocking: connected 159.50.5.165:10016 2011.05.13 13:28:37 LOG5[1802366:258]: Service pesitip connected remote server from 159.50.5.165:52585 2011.05.13 13:28:37 LOG7[1802366:258]: Remote FD=8 initialized 2011.05.13 13:28:37 LOG7[1802366:258]: Option TCP_NODELAY set on remote socket 2011.05.13 13:31:25 LOG7[1802366:258]: SSL alert (read): warning: close notify 2011.05.13 13:31:25 LOG7[1802366:258]: SSL closed on SSL_read 2011.05.13 13:31:25 LOG7[1802366:258]: Sending socket write shutdown 2011.05.13 13:31:25 LOG3[1802366:258]: readsocket: Connection reset by peer (73) 2011.05.13 13:31:25 LOG5[1802366:258]: Connection reset: 275 bytes sent to SSL, 17935 bytes sent to socket 2011.05.13 13:31:25 LOG7[1802366:258]: Service pesitip finished (0 left) 2011.05.13 13:31:25 LOG7[1802366:258]: str_stats: 36 blocks, 4350 bytes but when its the second i always have the error : 011.05.13 13:32:19 LOG7[1802366:1]: local socket: FD=7 allocated (non-blocking mode) 2011.05.13 13:32:19 LOG7[1802366:1]: Service pesitip accepted FD=7 from 10.254.181.230:3007 2011.05.13 13:32:19 LOG7[1802366:259]: Service pesitip started 2011.05.13 13:32:19 LOG7[1802366:259]: Option TCP_NODELAY set on local socket 2011.05.13 13:32:19 LOG5[1802366:259]: Service pesitip accepted connection from 10.254.181.230:3007 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): before/accept initialization 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 read client hello A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 write server hello A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 write certificate A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 write certificate request A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 flush data 2011.05.13 13:32:19 LOG7[1802366:259]: Starting certificate verification: depth=1, /O=SWIFT 2011.05.13 13:32:19 LOG6[1802366:259]: CERT: Verification not enabled 2011.05.13 13:32:19 LOG5[1802366:259]: Certificate accepted: depth=1, /O=SWIFT 2011.05.13 13:32:19 LOG7[1802366:259]: Starting certificate verification: depth=0, /C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts 2011.05.13 13:32:19 LOG6[1802366:259]: CERT: Verification not enabled 2011.05.13 13:32:19 LOG5[1802366:259]: Certificate accepted: depth=0, /C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 read client certificate A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 read client key exchange A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 read certificate verify A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 read finished A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 write change cipher spec A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 write finished A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 flush data 2011.05.13 13:32:19 LOG7[1802366:259]: 2 items in the session cache 2011.05.13 13:32:19 LOG7[1802366:259]: 0 client connects (SSL_connect()) 2011.05.13 13:32:19 LOG7[1802366:259]: 0 client connects that finished 2011.05.13 13:32:19 LOG7[1802366:259]: 0 client renegotiations requested 2011.05.13 13:32:19 LOG7[1802366:259]: 2 server connects (SSL_accept()) 2011.05.13 13:32:19 LOG7[1802366:259]: 2 server connects that finished 2011.05.13 13:32:19 LOG7[1802366:259]: 0 server renegotiations requested 2011.05.13 13:32:19 LOG7[1802366:259]: 0 session cache hits 2011.05.13 13:32:19 LOG7[1802366:259]: 0 external session cache hits 2011.05.13 13:32:19 LOG7[1802366:259]: 0 session cache misses 2011.05.13 13:32:19 LOG7[1802366:259]: 0 session cache timeouts 2011.05.13 13:32:19 LOG6[1802366:259]: SSL accepted: new session negotiated 2011.05.13 13:32:19 LOG6[1802366:259]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2011.05.13 13:32:19 LOG7[1802366:259]: socket#1: FD=8 allocated (non-blocking mode) 2011.05.13 13:32:19 LOG7[1802366:259]: socket#2: FD=9 allocated (non-blocking mode) 2011.05.13 13:32:19 LOG7[1802366:259]: bind#1: Invalid argument (22) 2011.05.13 13:32:19 LOG7[1802366:259]: bind#2: Invalid argument (22) 2011.05.13 13:32:19 LOG7[1802366:259]: accept: FD=10 allocated (non-blocking mode) 2011.05.13 13:32:19 LOG6[1802366:259]: Local mode child started (PID=614488) 2011.05.13 13:32:19 LOG7[1802366:259]: Remote FD=10 initialized 2011.05.13 13:32:19 LOG7[1802366:259]: Option TCP_NODELAY set on remote socket 2011.05.13 13:32:19 LOG3[1802366:259]: transfer: s_poll_wait: Invalid argument (22) 2011.05.13 13:32:19 LOG3[614488:259]: : No such file or directory (2) 2011.05.13 13:32:19 LOG5[1802366:259]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket my configuration file is : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv3 sslVersion = all ;ciphers = DES-CBC-SHA: ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail CRLpath = /opt/freeware/etc/stunnel/CRL_files/ ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXXXXXXXX:10016 Can you help me to find a solution for this problem please? Thanks you very much. Laurent UK This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

stunnel 4.36 compilation problems with Sun Studio compiler
by Ross Richardson 11 May '11

11 May '11

There are several minor problems using the Sun Studion 12 compiler (on Solaris 10 SPARC)... - in str.c, use of STR causes errors because /usr/include/sys/stropts.h contains: #define STR ('S'<<8) The this just requires replacing "STR" with something safer, such as "XSTR". - things fail horribly because SIZEOF_UNSIGNED_CHAR and friends get defined to 0. AFAICT, this happens because configure erroneously decides that cc suports -pendantic (which it appears to, but which causes linking to fail with the symbol "mcount" undefined). The following patch works around this: Index: configure --- configure.orig 2011-05-03 08:14:28.000000000 +1000 +++ configure 2011-05-04 13:51:53.785750000 +1000 @@ -4210,7 +4210,7 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ /* end confdefs.h. */ int main() {return 0;} _ACEOF -if ac_fn_c_try_compile "$LINENO"; then : +if ac_fn_c_try_link "$LINENO"; then : { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else - the compiler also gives warnings for the '\r' characters in version.h Hope this helps, rlr -- Ross L Richardson <URL:mailto:Ross.Richardson@utas.edu.au> Senior Systems Administrator Phone : +61 (0)3 6226 6233 Information Technology Resources Fax : +61 (0)3 6226 7171 University of Tasmania, AUSTRALIA

2 4

stunnel high load and lower network I/O yields
by jay＠experts-exchange.com 10 May '11

10 May '11

Folks, We are finding a bottleneck with stunnel for video intensive apps where it will run with weighted CPU near 120% and network interface will yield 30.3Mb, whereas without stunnel the rates will top off near 53.1Mb during the 10 second intervals as reported by iftop. The peaks are higher, but this is not sustained for either case. In order to improve stunnel's performance, is it possible to use a less intensive compute processing encryption, or fork the stunnel per connection? Thanks

2 1

Re: [stunnel-users] Temporary failure in name resolution, (Michal Trojnara)
by Phil Wieland 08 May '11

08 May '11

On 30/04/11 11:00, stunnel-users-request(a)stunnel.org wrote: > > Your stunnel.conf contains: > chroot = /var/lib/stunnel4/ > > Unfortunately this directory does not contain resolver configuration > files: [] >> > These are WITHOUT the suggested patch, I am not really equipped for >> > building on this server. > The patch should solve your problem by causing stunnel to wait until your > resolver is available before chroot(2) is executed. > > Workarounds: > 1. mkdir /var/lib/stunnel4/etc&& cp /etc/resolv.conf > /var/lib/stunnel4/etc/ > 2. Use IP address instead of host names in your stunnel.conf > 3. Add static IP address of your remote host to /etc/hosts > > Best regards, > Mike > > Many thanks for the analysis, Mike. I'll have to organise myself to build so I can apply the patch. Can I be really cheeky and ask one more question? Why does the problem not go away when my resolver is available - Shouldn't stunnel look again for this stuff after getting a temporary error? Thanks again, Phil

2 2

UTF-8 Compatibility
by RetailDecisions 06 May '11

06 May '11

Hi, Can someone tell me from what version of STUNNEL is fully UTF-8 compatible? -- View this message in context: http://old.nabble.com/UTF-8-Compatibility-tp31559422p31559422.html Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

UTF-8 Compatibility
by Greg Piazza 06 May '11

06 May '11

Morning All, Can someone tell me from what version(s) of STUNNEL fully support UTF-8? Thanks, Greg Gregory J. Piazza Director of Development Retail Decisions, Inc (ReD) Metropark 379 Thornall St, 7th floor Edison, NJ 08837 USA Direct - +1 732-452-2457 Fax - +1 732-549-0101 Email - gpiazza(a)red-usa.com<mailto:gpiazza@red-usa.com> Web - http://www.retaildecisions.com<http://www.retaildecisions.com/> Making Payments Simple and Secure

1 0

Patch for XMPP in client mode
by Philipp Hartwig 05 May '11

05 May '11

Hi, I've attached a small patch which adds support for the XMPP protocol in client mode. It does pretty much what Brian Hatch has outlined under [1]. I've tested it with several Jabber servers and it seems to work nicely. I'd be very happy about any comments. Regards, Philipp [1] http://stunnel.mirt.net/pipermail/stunnel-users/2009-February/002278.html

1 1

transparent = source, stunnel connect always times out
by Robert Hardy 05 May '11

05 May '11

I've been fighting with stunnel, trying to get its transparent proxy support to work. No matter what I do, as soon as transparent = source support is turned on, tests with my mail client just time out. If I turn transparent proxy support off it works but appears as if connections are from localhost, which is undesirable. My goal is to have stunnel listen on *:465 and provide SSL protected connectivity, which appear to arrive from the remote client IP, on my mail server's external IP address on port 25. My mail server and the firewall with the rules on it are the same physical machine. Can someone please make some suggestions as to what else I can try to get this working? I'm running Linux 2.6.38 on a current CentOS/rhel5 box and I've got modules built for most netfilter options, including: NF_CONNTRACK=m NETFILTER_TPROXY=m NETFILTER_XT_MATCH_SOCKET=m NETFILTER_XT_TARGET_TPROXY=m /proc/sys/net/ipv4/conf/all/rp_filter = 0 /proc/sys/net/ipv4/ip_forward = 1 This is my stunnel config: cert = /etc/stunnel/assps.crt key = /etc/stunnel/assps.key pid = /var/run/stunnel/stunnel_smtps.pid verify = 0 debug = 7 output = /var/log/stunnel_smtps.log TIMEOUTconnect = 60 [smtps] accept = 465 connect = MY_EXTERNAL_IP:25 transparent = source My stunnel seems happy with the DH Parameters in my cert file. My firewall relevant rules: iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 # stunnel -version stunnel 4.35 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 July 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH curve = sect163r2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- TCP_KEEPCNT -- -- -- 9 TCP_KEEPIDLE -- -- -- 7200 TCP_KEEPINTVL -- -- -- 75 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 Here is the log file with the connection timeout: 2011.03.20 15:26:43 LOG5[23214:3073877712]: Reading configuration from file /etc/stunnel/stunnel-assp_smtps.conf 2011.03.20 15:26:43 LOG7[23214:3073877712]: Snagged 64 random bytes from /root/.rnd 2011.03.20 15:26:43 LOG7[23214:3073877712]: Wrote 1024 new random bytes to /root/.rnd 2011.03.20 15:26:43 LOG7[23214:3073877712]: PRNG seeded successfully 2011.03.20 15:26:43 LOG7[23214:3073877712]: Using DH parameters from /etc/stunnel/assps.crt 2011.03.20 15:26:43 LOG6[23214:3073877712]: DH initialized with 512 bit key 2011.03.20 15:26:43 LOG7[23214:3073877712]: Certificate: /etc/stunnel/assps.crt 2011.03.20 15:26:43 LOG7[23214:3073877712]: Certificate loaded 2011.03.20 15:26:43 LOG7[23214:3073877712]: Key file: /etc/stunnel/assps.key 2011.03.20 15:26:43 LOG7[23214:3073877712]: Private key loaded 2011.03.20 15:26:43 LOG7[23214:3073877712]: SSL context initialized for service smtps 2011.03.20 15:26:43 LOG5[23214:3073877712]: Configuration successful 2011.03.20 15:26:43 LOG5[23214:3073877712]: No limit detected for the number of clients 2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=3 allocated (blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=5 allocated (blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=5 allocated (blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=6 allocated (blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=6 allocated (blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=7 allocated (blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=7 allocated (blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=8 allocated (blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: signal_pipe: FD=9 allocated (blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: signal_pipe: FD=10 allocated (blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: accept socket: FD=11 allocated (non-blocking mode) 2011.03.20 15:26:43 LOG7[23214:3073877712]: Option SO_REUSEADDR set on accept socket 2011.03.20 15:26:43 LOG7[23214:3073877712]: Service smtps bound to 0.0.0.0:465 2011.03.20 15:26:43 LOG7[23214:3073877712]: Service smtps opened FD=11 2011.03.20 15:26:44 LOG7[23220:3073877712]: Created pid file /var/run/stunnel/stunnel_smtps.pid 2011.03.20 15:26:44 LOG5[23220:3073877712]: stunnel 4.35 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 2011.03.20 15:26:44 LOG5[23220:3073877712]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.03.20 15:26:56 LOG7[23220:3073877712]: local socket: FD=0 allocated (non-blocking mode) 2011.03.20 15:26:56 LOG7[23220:3073877712]: Service smtps accepted FD=0 from MY_TESTING_CLIENT_IP:56765 2011.03.20 15:26:56 LOG7[23220:3073874832]: Service smtps started 2011.03.20 15:26:56 LOG7[23220:3073874832]: Option TCP_NODELAY set on local socket 2011.03.20 15:26:56 LOG7[23220:3073874832]: Waiting for a libwrap process 2011.03.20 15:26:56 LOG7[23220:3073874832]: Acquired libwrap process #0 2011.03.20 15:26:56 LOG7[23220:3073874832]: Releasing libwrap process #0 2011.03.20 15:26:56 LOG7[23220:3073874832]: Released libwrap process #0 2011.03.20 15:26:56 LOG7[23220:3073874832]: Service smtps permitted by libwrap from MY_TESTING_CLIENT_IP:56765 2011.03.20 15:26:56 LOG5[23220:3073874832]: Service smtps accepted connection from MY_TESTING_CLIENT_IP:56765 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): before/accept initialization 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 read client hello A 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 write server hello A 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 write certificate A 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 write certificate request A 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 flush data 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL alert (read): warning: no certificate 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 read client key exchange A 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 read finished A 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 write change cipher spec A 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 write finished A 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 flush data 2011.03.20 15:26:56 LOG7[23220:3073874832]: 1 items in the session cache 2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 client connects (SSL_connect()) 2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 client connects that finished 2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 client renegotiations requested 2011.03.20 15:26:56 LOG7[23220:3073874832]: 1 server connects (SSL_accept()) 2011.03.20 15:26:56 LOG7[23220:3073874832]: 1 server connects that finished 2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 server renegotiations requested 2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 session cache hits 2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 external session cache hits 2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 session cache misses 2011.03.20 15:26:57 LOG7[23220:3073874832]: 0 session cache timeouts 2011.03.20 15:26:57 LOG6[23220:3073874832]: SSL accepted: new session negotiated 2011.03.20 15:26:57 LOG6[23220:3073874832]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2011.03.20 15:26:57 LOG7[23220:3073874832]: remote socket: FD=1 allocated (non-blocking mode) 2011.03.20 15:26:57 LOG6[23220:3073874832]: local_bind succeeded on the original port 2011.03.20 15:26:57 LOG6[23220:3073874832]: connect_blocking: connecting MY_EXTERNAL_IP:25 2011.03.20 15:26:57 LOG7[23220:3073874832]: connect_blocking: s_poll_wait MY_EXTERNAL_IP:25: waiting 60 seconds 2011.03.20 15:27:57 LOG3[23220:3073874832]: connect_blocking: s_poll_wait MY_EXTERNAL_IP:25: TIMEOUTconnect exceeded 2011.03.20 15:27:57 LOG5[23220:3073874832]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.03.20 15:27:57 LOG7[23220:3073874832]: Service smtps finished (0 left) 2011.03.20 15:29:21 LOG7[23220:3073877712]: Dispatching signals from the signal pipe 2011.03.20 15:29:21 LOG5[23220:3073877712]: Received signal 15; terminating 2011.03.20 15:29:21 LOG7[23220:3073877712]: removing pid file /var/run/stunnel/stunnel_smtps.pid The only even slightly odd thing I see other than the timeouts is the " 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL alert (read): warning: no certificate" I'm not sure what that is about, but it doesn't seem critical...

2 3

Re: [stunnel-users] Réf. : Re: Réf. : Re: Réf. : Re: Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Leandro Avila 04 May '11

04 May '11

Hi Laurent, Good to see you figured out the issue. I also learned more things myself. Thanks Jose ! To my knowledge cipher suites that use SHA2 are part of the TLS 1.2 specification but I don't think OpenSSL has that implemented. Cheers ---------------- Leandro Avila ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wednesday, May 4, 2011 11:02 AM Subject: [stunnel-users] Réf. : Re: Réf. : Re: Réf. : Re: Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Hi everyone, It's ok now i have found the solution i add the root and intermediate certificate of verisign in my Capath and i use in s_client the option -CApath and now it's ok : New, TLSv1/SSLv3, Cipher is DES-CBC-SHA Server public key is 2048 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : DES-CBC-SHA Session-ID: XXXXXXXXXXX Session-ID-ctx: Master-Key: XXXXXXXXXXXXXXXXXXXX Key-Arg : None Start Time: 1304524805 Timeout : 7200 (sec) Verify return code: 0 (ok) but i have another question: How can i test the SHA-2? i search the cipher corresponding in SHA-2 but i didn't found it. Thanks for your help. Regards, Laurent UK Laurent UK Analyste PROTOCOLES RBIS - DBF PBMF2 DOMAINE PMF202 ELECTRONIC FILES 41, rue de Valmy - 93100 Montreuil - ACI CME04B1 Bureau 4226 Tel: 01.58.16.86.45 (68645) 04/05/2011 15:36 Pour josealf(a)rocketmail.com cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Réf. : Re: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHALien Jose, thanks you, i use my client certificate but have another error now : 1028202:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:162:filename(libz.so): Could not load module . System error: No such file or directory 1028202:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244: Enter pass phrase for /opt/freeware/etc/stunnel/keystore/crl-3skey.pem: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:SSLv3 read server hello A depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=27:certificate not trusted verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=21:unable to verify the first certificate verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write certificate verify A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3 1 s:/C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts i:/O=SWIFT --- Server certificate -----BEGIN CERTIFICATE----- XXXXXXXXXXXXXXXXXX -----END CERTIFICATE----- subject=/C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3 --- No client certificate CA names sent --- SSL handshake has read 2633 bytes and written 1732 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 2048 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : AES256-SHA Session-ID: XXXXXXXXXXXXXXXXXX Session-ID-ctx: Master-Key: XXXXXXXXXXXXXXXXXX Key-Arg : None Start Time: 1304515751 Timeout : 7200 (sec) Verify return code: 21 (unable to verify the first certificate) --- Do you know the reason of this error? Maybe i have to add the first certificate file to a specific folder ? Regards, Laurent UK Internet josealf(a)rocketmail.com 04/05/2011 15:09 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, We need to present a client certificate to the server. That's the important part missing. Do that by adding -cert your_cert_filename to the command, like: openssl s_client -ssl3 -state -cert your_client_cert_filename -connect your-stunnel-ip:10443 See http://www.openssl.org/docs/apps/s_client.html Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 6:55:19 AM Subject: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, thanks you for your response, i use the openssl s_client command but i have the following error : 1499296:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:162:filename(libz.so): Could not load module . System error: No such file or directory 1499296:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:SSLv3 read server hello A depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=27:certificate not trusted verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=21:unable to verify the first certificate verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL3 alert write:warning:no certificate SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL3 alert read:fatal:handshake failure SSL_connect:failed in SSLv3 read finished A 1499296:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1060:SSL alert number 40 1499296:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: is it normal? Thanks. Regards. Laurent UK Internet josealf(a)rocketmail.com 04/05/2011 13:38 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Ideally, you should terminate the SSL connection on your final server. But that's not the problem here. It should work as is. Mosty likely the problem is on the client SSL software you are using to connect to stunnel. The cipher you are trying to use DESC-CBC-SHA works with SSLv3 and TLSv1. Can you force your client to use those protocols? Maybe it is trying to negotiate SSLv2. Also are you sure it is speaking SSL instead of plain text? You can test your connection to stunnel server with openssl s_client command. Example openssl s_client -ssl3 -state -connect your-stunnel-ip:10443 openssl s_client -tls1 -state -connect your-stunnel-ip:10443 if this works, we found the culprit. Regards Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 2:05:07 AM Subject: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, I use 2 servers in my configuration: the first one who listenning on the port 10443 (where we receive encrypted traffic from software using ssl) and the second one who listenning the port 10016 (where we receive decrypted traffic). The first one receive the encrypted traffic, it decrypted it and send it to the second server that's why i only use the server mode on my fist server. Do you think that i also need to change this configuration? Cordialement, Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 19:18 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, I'm not sure you are connecting the dots right. I see an stunnel server configuration. In this case, your stunnel is a front-end to a service you run on host XXXX port 10016. What is that service? Is stunnel running on the same host? Note that If stunnel is not running on the same host with IP XXXX, then you may have some traffic in clear text in your network (from the device running stunnel to the device hosting the service on port 10016). You need a client to connect to the stunnel server. Unless your client support SSL natively, you also should have an stunnel running on your client device with entries like these: client=yes [pestip] accept = 10443 connect = Your-Stunnel-server-IP:10443 In this case your client apps connects locally to port 10443, traffic is encrypted and sent to your server listening on port 10443, where it is decripted and send to IP XXXX port 10016. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tue, May 3, 2011 10:48:11 AM Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Re: [stunnel-users] Réf. : Re: Réf. : Re: Réf. : Re: Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Jose Alf. 04 May '11

04 May '11

Laurent, Everything looks fine to me. Your were connected to the server using SSLv3 and AES256-SHA ciphers. The zlib error can be ignored. Message "Verify return code: 21 (unable to verify the first certificate)" indicates that openssl s_client was unable to verify the server certificate. You can get rid of this by giving the CAPath in the paremters and making sure the verisign root Ca cert is there. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 8:36:16 AM Subject: Réf. : Re: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, thanks you, i use my client certificate but have another error now : 1028202:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:162:filename(libz.so): Could not load module . System error: No such file or directory 1028202:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244: Enter pass phrase for /opt/freeware/etc/stunnel/keystore/crl-3skey.pem: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:SSLv3 read server hello A depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=27:certificate not trusted verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=21:unable to verify the first certificate verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write certificate verify A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3 1 s:/C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts i:/O=SWIFT --- Server certificate -----BEGIN CERTIFICATE----- XXXXXXXXXXXXXXXXXX -----END CERTIFICATE----- subject=/C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3 --- No client certificate CA names sent --- SSL handshake has read 2633 bytes and written 1732 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 2048 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : AES256-SHA Session-ID: XXXXXXXXXXXXXXXXXX Session-ID-ctx: Master-Key: XXXXXXXXXXXXXXXXXX Key-Arg : None Start Time: 1304515751 Timeout : 7200 (sec) Verify return code: 21 (unable to verify the first certificate) --- Do you know the reason of this error? Maybe i have to add the first certificate file to a specific folder ? Regards, Laurent UK Internet josealf(a)rocketmail.com 04/05/2011 15:09 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, We need to present a client certificate to the server. That's the important part missing. Do that by adding -cert your_cert_filename to the command, like: openssl s_client -ssl3 -state -cert your_client_cert_filename -connect your-stunnel-ip:10443 See http://www.openssl.org/docs/apps/s_client.html Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 6:55:19 AM Subject: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, thanks you for your response, i use the openssl s_client command but i have the following error : 1499296:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:162:filename(libz.so): Could not load module . System error: No such file or directory 1499296:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:SSLv3 read server hello A depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=27:certificate not trusted verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=21:unable to verify the first certificate verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL3 alert write:warning:no certificate SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL3 alert read:fatal:handshake failure SSL_connect:failed in SSLv3 read finished A 1499296:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1060:SSL alert number 40 1499296:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: is it normal? Thanks. Regards. Laurent UK Internet josealf(a)rocketmail.com 04/05/2011 13:38 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Ideally, you should terminate the SSL connection on your final server. But that's not the problem here. It should work as is. Mosty likely the problem is on the client SSL software you are using to connect to stunnel. The cipher you are trying to use DESC-CBC-SHA works with SSLv3 and TLSv1. Can you force your client to use those protocols? Maybe it is trying to negotiate SSLv2. Also are you sure it is speaking SSL instead of plain text? You can test your connection to stunnel server with openssl s_client command. Example openssl s_client -ssl3 -state -connect your-stunnel-ip:10443 openssl s_client -tls1 -state -connect your-stunnel-ip:10443 if this works, we found the culprit. Regards Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 2:05:07 AM Subject: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, I use 2 servers in my configuration: the first one who listenning on the port 10443 (where we receive encrypted traffic from software using ssl) and the second one who listenning the port 10016 (where we receive decrypted traffic). The first one receive the encrypted traffic, it decrypted it and send it to the second server that's why i only use the server mode on my fist server. Do you think that i also need to change this configuration? Cordialement, Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 19:18 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, I'm not sure you are connecting the dots right. I see an stunnel server configuration. In this case, your stunnel is a front-end to a service you run on host XXXX port 10016. What is that service? Is stunnel running on the same host? Note that If stunnel is not running on the same host with IP XXXX, then you may have some traffic in clear text in your network (from the device running stunnel to the device hosting the service on port 10016). You need a client to connect to the stunnel server. Unless your client support SSL natively, you also should have an stunnel running on your client device with entries like these: client=yes [pestip] accept = 10443 connect = Your-Stunnel-server-IP:10443 In this case your client apps connects locally to port 10443, traffic is encrypted and sent to your server listening on port 10443, where it is decripted and send to IP XXXX port 10016. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tue, May 3, 2011 10:48:11 AM Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

Re: [stunnel-users] Réf. : Re: Réf. : Re: Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Jose Alf. 04 May '11

04 May '11

Laurent, We need to present a client certificate to the server. That's the important part missing. Do that by adding -cert your_cert_filename to the command, like: openssl s_client -ssl3 -state -cert your_client_cert_filename -connect your-stunnel-ip:10443 See http://www.openssl.org/docs/apps/s_client.html Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 6:55:19 AM Subject: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, thanks you for your response, i use the openssl s_client command but i have the following error : 1499296:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:162:filename(libz.so): Could not load module . System error: No such file or directory 1499296:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:SSLv3 read server hello A depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=27:certificate not trusted verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=21:unable to verify the first certificate verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL3 alert write:warning:no certificate SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL3 alert read:fatal:handshake failure SSL_connect:failed in SSLv3 read finished A 1499296:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1060:SSL alert number 40 1499296:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: is it normal? Thanks. Regards. Laurent UK Internet josealf(a)rocketmail.com 04/05/2011 13:38 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Ideally, you should terminate the SSL connection on your final server. But that's not the problem here. It should work as is. Mosty likely the problem is on the client SSL software you are using to connect to stunnel. The cipher you are trying to use DESC-CBC-SHA works with SSLv3 and TLSv1. Can you force your client to use those protocols? Maybe it is trying to negotiate SSLv2. Also are you sure it is speaking SSL instead of plain text? You can test your connection to stunnel server with openssl s_client command. Example openssl s_client -ssl3 -state -connect your-stunnel-ip:10443 openssl s_client -tls1 -state -connect your-stunnel-ip:10443 if this works, we found the culprit. Regards Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 2:05:07 AM Subject: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, I use 2 servers in my configuration: the first one who listenning on the port 10443 (where we receive encrypted traffic from software using ssl) and the second one who listenning the port 10016 (where we receive decrypted traffic). The first one receive the encrypted traffic, it decrypted it and send it to the second server that's why i only use the server mode on my fist server. Do you think that i also need to change this configuration? Cordialement, Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 19:18 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, I'm not sure you are connecting the dots right. I see an stunnel server configuration. In this case, your stunnel is a front-end to a service you run on host XXXX port 10016. What is that service? Is stunnel running on the same host? Note that If stunnel is not running on the same host with IP XXXX, then you may have some traffic in clear text in your network (from the device running stunnel to the device hosting the service on port 10016). You need a client to connect to the stunnel server. Unless your client support SSL natively, you also should have an stunnel running on your client device with entries like these: client=yes [pestip] accept = 10443 connect = Your-Stunnel-server-IP:10443 In this case your client apps connects locally to port 10443, traffic is encrypted and sent to your server listening on port 10443, where it is decripted and send to IP XXXX port 10016. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tue, May 3, 2011 10:48:11 AM Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

Re: [stunnel-users] Réf. : Re: Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Jose Alf. 04 May '11

04 May '11

Laurent, Ideally, you should terminate the SSL connection on your final server. But that's not the problem here. It should work as is. Mosty likely the problem is on the client SSL software you are using to connect to stunnel. The cipher you are trying to use DESC-CBC-SHA works with SSLv3 and TLSv1. Can you force your client to use those protocols? Maybe it is trying to negotiate SSLv2. Also are you sure it is speaking SSL instead of plain text? You can test your connection to stunnel server with openssl s_client command. Example openssl s_client -ssl3 -state -connect your-stunnel-ip:10443 openssl s_client -tls1 -state -connect your-stunnel-ip:10443 if this works, we found the culprit. Regards Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 2:05:07 AM Subject: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, I use 2 servers in my configuration: the first one who listenning on the port 10443 (where we receive encrypted traffic from software using ssl) and the second one who listenning the port 10016 (where we receive decrypted traffic). The first one receive the encrypted traffic, it decrypted it and send it to the second server that's why i only use the server mode on my fist server. Do you think that i also need to change this configuration? Cordialement, Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 19:18 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, I'm not sure you are connecting the dots right. I see an stunnel server configuration. In this case, your stunnel is a front-end to a service you run on host XXXX port 10016. What is that service? Is stunnel running on the same host? Note that If stunnel is not running on the same host with IP XXXX, then you may have some traffic in clear text in your network (from the device running stunnel to the device hosting the service on port 10016). You need a client to connect to the stunnel server. Unless your client support SSL natively, you also should have an stunnel running on your client device with entries like these: client=yes [pestip] accept = 10443 connect = Your-Stunnel-server-IP:10443 In this case your client apps connects locally to port 10443, traffic is encrypted and sent to your server listening on port 10443, where it is decripted and send to IP XXXX port 10016. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tue, May 3, 2011 10:48:11 AM Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

Re: [stunnel-users] Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Jose Alf. 03 May '11

03 May '11

Laurent, I'm not sure you are connecting the dots right. I see an stunnel server configuration. In this case, your stunnel is a front-end to a service you run on host XXXX port 10016. What is that service? Is stunnel running on the same host? Note that If stunnel is not running on the same host with IP XXXX, then you may have some traffic in clear text in your network (from the device running stunnel to the device hosting the service on port 10016). You need a client to connect to the stunnel server. Unless your client support SSL natively, you also should have an stunnel running on your client device with entries like these: client=yes [pestip] accept = 10443 connect = Your-Stunnel-server-IP:10443 In this case your client apps connects locally to port 10443, traffic is encrypted and sent to your server listening on port 10443, where it is decripted and send to IP XXXX port 10016. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tue, May 3, 2011 10:48:11 AM Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

Re: [stunnel-users] Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Leandro Avila 03 May '11

03 May '11

Hi, If you have control of both ends of the connection make sure your SSL version is consistent on both sides. I would not recomend using sslVersion = all Either set it to SSLv3 or TLSv1 DES-CBC-SHA is supported under those However, judging for the cipher you are choosing I assume you might be dealing with a legacy application and you might not have access to both ends of the connection. I would try setting only one version at the time and moving down from TLSv1, SSLv3 and SSLv2 sslVersion = ciphers = DES-CBC-SHA Cheers ----------------- Leandro Avila ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tuesday, May 3, 2011 10:48 AM Subject: [stunnel-users] Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

stunnel 4.36 released
by Michal Trojnara 03 May '11

03 May '11

Dear Users, Version 4.36 of stunnel was released. The ChangeLog entry: Version 4.36, 2011.05.03, urgency: LOW: * New features - Updated Win32 DLLs for OpenSSL 1.0.0d. - Dynamic memory management for strings manipulation: no more static STRLEN limit, lower stack footprint. - Strict public key comparison added for "verify = 3" certificate checking mode (thx to Philipp Hartwig). - Backlog parameter of listen(2) changed from 5 to SOMAXCONN: improved behavior on heavy load. - Example tools/stunnel.service file added for systemd service manager. * Bugfixes - Missing pthread_attr_destroy() added to fix memory leak (thx to Paul Allex and Peter Pentchev). - Fixed the incorrect way of setting FD_CLOEXEC flag. - Fixed --enable-libwrap option of ./configure script. - /opt/local added to OpenSSL search path for MacPorts compatibility. - Workaround implemented for signal handling on MacOS X. - A trivial bug fixed in the stunnel.init script. - Retry implemented on EAI_AGAIN error returned by resolver calls. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.36.tar.gz: 3483fc2011e8a9d2614a93a9dbf7eabf405044df3566f29144fe2d1dd37a35f5 Best regards, Mike

3 2

Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by josealf＠rocketmail.com 03 May '11

03 May '11

Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Temporary failure in name resolution (Michal Trojnara)
by Phil Wieland 29 Apr '11

29 Apr '11

I attach two strace reports, strace-good shows a successful use, strace-bad shows it failing after a reboot. In both cases I just telnet to localhost 55899, which gives the smtp server's banner in the good case. ltrace craps out with a [pid 1107] +++ killed by SIGTRAP +++ in both cases, and doesn't show anything useful. These are WITHOUT the suggested patch, I am not really equipped for building on this server. Phil

2 1

Re: [stunnel-users] Réf. : Re: Tr : Réf. : Re: Need some informations about stunnel(AC,?crl ?files)
by Ludolf Holzheid 29 Apr '11

29 Apr '11

On Fri, 2011-04-29 15:39:45 +0200, laurent.uk(a)bnpparibas.com wrote: > Dear Ludolf thank you for your response. > > I have another question. > > Is it possible to have 2 stunnel running on the same server? > > 1 stunnel with no client's certificate verification (verify = 0) with a > specific port > > and 1 stunnel with client's certificate verification (verify = 3) with > other specific port You may run as many instances of stunnel as you like, as long as they don't share listening ports (accept=...) or pid files (pid=...). Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Tr : Réf. : Re: Need some informations about stunnel (AC,?crl?files)
by Ludolf Holzheid 28 Apr '11

28 Apr '11

On Thu, 2011-04-28 17:06:28 +0200, laurent.uk(a)bnpparibas.com wrote: > Dear Ludolf i need some help with the verify option. > > I want to check the certificate client in my machine and also check if the > certificate's client is in the crl list. > > You said that " > If you are using verify=3, stunnel checks client certificates against > the set of certificates in CApath or CAfile, not against CAs and CRLs." > > Is it possible to check client certificates with certificates in CaPath > and also with CRls? Laurent, By installing a certificate (to CApath or CAfile), you express your trust in the certificate. For the client certificates, you could either o implicitly trust all certificates signed by an installed CA certificate and not yet revoked (verify=2), or o explicitly trust installed client certificates (verify=3). In both cases, all installed certificates are fully trusted. Cross-checking a trusted (client-) certificate against an other trusted (CA-) certificate does not raise security or trustworthiness. In order to revoke a client certificate in verify=3 mode, just uninstall it. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Delay before sending server hello
by Dan Price 28 Apr '11

28 Apr '11

I am using stunnel to accept TLS connections. I'm opening eight connections at virtually the same time, and occasionally see that for one of the connections, the handshake does not complete - stunnel does not send the server hello, and the client usually resets the connection. I did manage to capture one instance where stunnel sends the server hello, but it is delayed by over a minute. I upgraded to version 4.35, and I see the same behavior. I set debug=debug, and captured what I think are the relevant logs (through write server hello). I kept the logs for the successful connection (59924) that came in after the failed one (59923). Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: local socket: FD=15 allocated (non-blocking mode) Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: Service msrp accepted FD=15 from ::ffff:10.50.2.11:59923 Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: local socket: FD=16 allocated (non-blocking mode) Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: Service msrp accepted FD=16 from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG7[10357:1431989136]: Service msrp started Apr 27 13:21:22 cm stunnel: LOG7[10357:1431989136]: Waiting for a libwrap process Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Service msrp started Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Waiting for a libwrap process Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Acquired libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Releasing libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Released libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Service msrp permitted by libwrap from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG5[10357:1433471888]: Service msrp accepted connection from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): before/accept initialization Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): SSLv3 read client hello A Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): SSLv3 write server hello A Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Acquired libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Releasing libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Released libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Service msrp permitted by libwrap from ::ffff:10.50.2.11:59923 Apr 27 13:22:38 cm stunnel: LOG5[10357:1431989136]: Service msrp accepted connection from ::ffff:10.50.2.11:59923 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): before/accept initialization Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): SSLv3 read client hello A Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): SSLv3 write server hello A Thanks, Dan

1 0

Does stunnel support startTLS?
by Markus Borst 28 Apr '11

28 Apr '11

Stunnel supports encryption in the "old" ssl style extra port configuration (i.e. imaps on port 993) where the encryption is negotiated immediately upon start of the connection. Does stunnel also support the startTLS method? i.e. a clear text connection is established (imap on port 143) and one of the first imap commands is startTLS, which negotiates the encryption and protects the connection from that time onwards. I know that supporting startTLS is a lot harder, since it means sniffing commands in the higher level protocol, but we need it nevertheless. (In fact, our imap server does support startTLS, but it does _not_ support importing an external certificate, which is why I'm looking for an external solution.) From reading the documentation I'm not sure whether stunnel supports startTLS, there are a few option descriptions which might point to startTLS, but I'm not sure. Anybody knows the definite answer? Greetings Markus Borst -- TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst Adresse: Petersenstrasse 30, 64287 Darmstadt, Germany Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

2 3

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 28 Apr '11

28 Apr '11

Thx for continuing reply my msg, Yes, there is var/log/messages Inside there only has some iptables log, FTP, SMTP application log and nothing else. I am positive that this problem is not cause by iptables, becuase I tried with iptables off. Nothing else related to stunnel is found in that folder. Any other suggestions? Mr. Jack > From: sunyucong(a)gmail.com > Date: Mon, 25 Apr 2011 20:00:30 -0700 > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization > To: jackliu92(a)hotmail.com > CC: stunnel-users(a)stunnel.org > > I guess in centos that's /var/log/messages > but in general, you should probably check everything in /var/log to make sure. > > On Mon, Apr 25, 2011 at 5:38 PM, Jack Liu <jackliu92(a)hotmail.com> wrote: > > Thank you for helping, but both logs r not presented in my var/log/ dir. Any > > other suggestions? > > > > > > Mr. Jack > > > > > > > > > > > >> From: sunyucong(a)gmail.com > >> Date: Mon, 25 Apr 2011 16:25:20 -0700 > >> Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): > >> before/accept initialization > >> To: jackliu92(a)hotmail.com > >> CC: stunnel-users(a)stunnel.org > >> > >> Are you sure that's entire log? check /var/log/daemons.log and > >> syslog.log as well. > >> > >> On Sun, Apr 24, 2011 at 1:30 AM, Jack Liu <jackliu92(a)hotmail.com> wrote: > >> > It anyone knows how to fix Stunnel stuck at SSL state (accept): > >> > before/accept initialization??? > >> > > >> > Here is the log: > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from > >> > /root/.rnd > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes > >> > to > >> > /root/.rnd > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims > >> > sufficient > >> > entropy for the PRNG > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: > >> > /etc/stunnel/stunnel.pem > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: > >> > /etc/stunnel/stunnel.pem > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to > >> > /etc/stunnel/CA > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to > >> > /etc/stunnel/CRL > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for > >> > service 3proxy > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on > >> > i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE > >> > Sockets:POLL,IPv6 Auth:LIBWRAP > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be > >> > changed with 'ulimit -n') > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE > >> > limit for file descriptors > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on > >> > accept socket > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to > >> > 0.0.0.0:30001 > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file > >> > /var/run/stunnel.pid > >> > 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from > >> > xx.xxx.xxx.xx:41165 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe > >> > 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished > >> > with code 0 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from > >> > xx.xxx.xxx.xx:41165 permitted by libwrap > >> > 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from > >> > xx.xxx.xxx.xx:41165 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): > >> > before/accept initialization <-----------------------Stuck here > >> > forever!!! > >> > 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly > >> > disconnected > >> > 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes > >> > sent > >> > to SSL, 0 bytes sent to socket > >> > 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) > >> > 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; > >> > terminating > >> > 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file > >> > /var/run/stunnel.pid > >> > [root@vps1 ~]# > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > stunnel.conf: > >> > cert = /etc/stunnel/stunnel.pem > >> > key = /etc/stunnel/stunnel.pem > >> > CApath = /etc/stunnel/CA > >> > CRLpath = /etc/stunnel/CRL > >> > debug = 7 > >> > foreground = yes > >> > verify = 1 > >> > # > >> > [3proxy] > >> > accept = 30001 > >> > connect = 127.0.0.1:33135 > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > > >> > I am hosting with CentOS 5.5, and installed Stunnel via yum. > >> > Planning to use it with 3Proxy. However I experience the problem above, > >> > can > >> > someone please help with that? > >> > Thank you very much! > >> > > >> > > >> > > >> > Mr. Jack > >> > > >> > _______________________________________________ > >> > stunnel-users mailing list > >> > stunnel-users(a)stunnel.org > >> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >> > > >> > > >

3 6

Patch to enhance verify=3 with SHA-1 check
by Philipp Hartwig 27 Apr '11

27 Apr '11

As indicated in a previous mail to this list I was surprised by the following behavior: With "verify=3" stunnel doesn't compare the peer's certificate with the locally installed certificate for actual equality but it only checks whether they have the same subject. The recent Comodo incident[1] has shown that it is not impossible to get a certificate which matches the subject of the certificate of some interesting server and is signed by a trusted CA. That's why I was interested in a stricter form of verification (at least in client mode). I have attached a small patch, derived from code in the file "mutt_ssl.c" of the Mutt[2] mail client, which adds a check for equality of SHA-1 hashes to the "verify=3" certificate check. I mainly wrote it for personal use but maybe someone else will find it useful or has some comments. Regards, Philipp [1] http://blog.mozilla.com/security/2011/03/25/comodo-certificate-issue-follow… [2] http://www.mutt.org/

1 0

Re: [stunnel-users] Réf. : Re: Need some informations about stunnel (AC,?crl?files)
by Ludolf Holzheid 27 Apr '11

27 Apr '11

On Wed, 2011-04-27 13:06:43 +0200, laurent.uk(a)bnpparibas.com wrote: > Dear ludolf thanks you for your response. > > So if i use verify = 3, the crl files is useless. > > I went to the url http://crl.verisign.com , and there were a lot of files. > > what are the files corresponding of the crl list please? Those with the ".crl" extension, I suppose ;-) You'll need to look for the CRLs matching the certificates you want to use. Note, there may be CRLs for intermediate certificates too. At least (the randomly selected) Class3SoftwarePublishers.crl seems to be in DES format, you might have to convert it to PEM for use with stunnel. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Need some informations about stunnel (AC, crl files)
by Ludolf Holzheid 27 Apr '11

27 Apr '11

On Wed, 2011-04-27 10:47:42 +0200, laurent.uk(a)bnpparibas.com wrote: > Hi all, > > I need some informations about stunnel. > > First, when the client's software use a certificate signed by a CA like > veriSign. Did we need to add the certificates of this CA? or it is not > neccessary because it is a knowned CA. If you are using verify=3, stunnel checks client certificates against the set of certificates in CApath or CAfile, not against CAs and CRLs. In order to have stunnel check the certificate chain of client certificates, you'll have to use verify=2. For that, stunnel needs access to the CA's root certificate and the intermediate certificates (i.e. they have to be locally installed to CApath/CAfile). > Secondally, i need to download and update the crl files, and also (if it's > possible) the certificates of knowed CA. How can i do that in my AIX's > machine please? This depends on the way the CA publishes its certificates and CRLs. For VeriSign, my first idea is to use wget to download them from http://crl.verisign.com. There may be better ways, though. And I don't know AIX. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] need help for the error VERIFY ERROR ONLY MY: no cert fo (verify = 3)
by Ludolf Holzheid 26 Apr '11

26 Apr '11

On Tue, 2011-04-26 17:00:06 +0200, laurent.uk(a)bnpparibas.com wrote: > Hi, > > I tried to configure my STUNNEL server, with my client's software test but > i always have the the following error : > > 2011.04.26 14:23:09 LOG4[1683500:258]: VERIFY ERROR ONLY MY: no cert for > /C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts > > [..] > > I tried to extract the public certificate from the crl-3skey-ebics-ts and > add it in the keystore and in the folder /usr/local/ssl/certs/trusted/ > > [..] > > verify = 3 > ; Don't forget to c_rehash CApath > ; CApath is located inside chroot jail > ;CApath = /opt/freeware/etc/stunnel/ > ; It's often easier to use CAfile > CAfile = /opt/freeware/etc/stunnel/ca.pem > ; Don't forget to c_rehash CRLpath Laurent, If you specify a CAfile in 'verify=3' mode, you need to add the client's certificates to this file. You could also store the client's certificates in PEM format files (one file per certificate) in a directory stunnel can reach at connection time. You have to specify the name of this directory as CApath then (in contrast to CAfile), and you'll have to run c_rehash on this directory. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Temporary failure in name resolution
by Phil Wieland 26 Apr '11

26 Apr '11

I think I've done something stupid but I can't work out what. I'm running stunnel4 version 4.29 on an Ubuntu server box, using it to tunnel smtp connections to my ISP's mail server. Everything works perfectly until I reboot the server, when it stops working. In syslog, I get: Apr 24 15:56:11 friedbread stunnel: LOG5[1101:3074997104]: ssmtp accepted connection from 127.0.0.1:50681 Apr 24 15:56:11 friedbread stunnel: LOG3[1101:3074997104]: Error resolving 'smtp.blueyonder.co.uk': Temporary failure in name resolution (EAI_AGAIN) Apr 24 15:56:11 friedbread stunnel: LOG3[1101:3074997104]: No host resolved Apr 24 15:56:11 friedbread stunnel: LOG5[1101:3074997104]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket every time I attempt to send mail. I can ping smtp.blueyonder.co.uk no problem. The problem persists until I restart stunnel4, after which it works perfectly for weeks on end. Looking at syslog for boot time, it looks like stunnel tries to resolve smtp.blueyonder.co.uk as soon as it starts, but dhcp hasn't finished at this time so it fails. It seems to cache something from the failure and not try again? Even though the error is "Temporary". All advice gratefully received. Phil Wieland Liverpool, UK. ###@friedbread:~$ stunnel4 -version stunnel 4.29 on i486-pc-linux-gnu with OpenSSL 0.9.8k 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ###@friedbread:~$ cat /etc/stunnel/stunnel.conf ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 55899 connect = smtp.blueyonder.co.uk:465 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini ###@friedbread:~$

3 2

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 26 Apr '11

26 Apr '11

Thank you for helping, but both logs r not presented in my var/log/ dir. Any other suggestions? Mr. Jack > From: sunyucong(a)gmail.com > Date: Mon, 25 Apr 2011 16:25:20 -0700 > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization > To: jackliu92(a)hotmail.com > CC: stunnel-users(a)stunnel.org > > Are you sure that's entire log? check /var/log/daemons.log and > syslog.log as well. > > On Sun, Apr 24, 2011 at 1:30 AM, Jack Liu <jackliu92(a)hotmail.com> wrote: > > It anyone knows how to fix Stunnel stuck at SSL state (accept): > > before/accept initialization??? > > > > Here is the log: > > ----------------------------------------------------------------------------------------------------------- > > [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from > > /root/.rnd > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes to > > /root/.rnd > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims sufficient > > entropy for the PRNG > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: > > /etc/stunnel/stunnel.pem > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: > > /etc/stunnel/stunnel.pem > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to > > /etc/stunnel/CA > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to > > /etc/stunnel/CRL > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for > > service 3proxy > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on > > i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE > > Sockets:POLL,IPv6 Auth:LIBWRAP > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be > > changed with 'ulimit -n') > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE > > limit for file descriptors > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on > > accept socket > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to 0.0.0.0:30001 > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file > > /var/run/stunnel.pid > > 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from > > xx.xxx.xxx.xx:41165 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe > > 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished > > with code 0 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from > > xx.xxx.xxx.xx:41165 permitted by libwrap > > 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from > > xx.xxx.xxx.xx:41165 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): > > before/accept initialization <-----------------------Stuck here > > forever!!! > > 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly > > disconnected > > 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes sent > > to SSL, 0 bytes sent to socket > > 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) > > 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; terminating > > 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file > > /var/run/stunnel.pid > > [root@vps1 ~]# > > ----------------------------------------------------------------------------------------------------------- > > stunnel.conf: > > cert = /etc/stunnel/stunnel.pem > > key = /etc/stunnel/stunnel.pem > > CApath = /etc/stunnel/CA > > CRLpath = /etc/stunnel/CRL > > debug = 7 > > foreground = yes > > verify = 1 > > # > > [3proxy] > > accept = 30001 > > connect = 127.0.0.1:33135 > > ----------------------------------------------------------------------------------------------------------- > > > > I am hosting with CentOS 5.5, and installed Stunnel via yum. > > Planning to use it with 3Proxy. However I experience the problem above, can > > someone please help with that? > > Thank you very much! > > > > > > > > Mr. Jack > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization
by Jack Liu 25 Apr '11

25 Apr '11

I installed the 4.35 one into my CentOS, it seems like the same problem still exist. Is there anything I can do to fix it? Mr. Jack Date: Sun, 24 Apr 2011 19:09:35 -0700 From: josealf(a)rocketmail.com Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization To: jackliu92(a)hotmail.com Hi Mr Jack, RPMS attached. Let me know if you need further help. Regards, Jose From: Jack Liu <jackliu92(a)hotmail.com> To: josealf(a)rocketmail.com; stunnel-users(a)stunnel.org Sent: Sun, April 24, 2011 1:08:44 PM Subject: RE: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization Yes sure, please provide the binary. Thank you very much! One additional information, running socket5 on 3Proxy. Mr. Jack > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization > To: jackliu92(a)hotmail.com; stunnel-users(a)stunnel.org > From: josealf(a)rocketmail.com > Date: Sun, 24 Apr 2011 11:49:05 +0000 > > If you ruled out a configuration error, You should try with a more recent version of stunnel. You can recompile the SRPM (4.29) from redhat 6 (or scientific linux 6) and it works fine under CentOS 5. I can provide binaries if needed. > > -----Original Message----- > From: Jack Liu <jackliu92(a)hotmail.com> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Sun, 24 Apr 2011 02:30:24 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept > initialization > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization
by Jack Liu 25 Apr '11

25 Apr '11

Thank you! Mr. Jack Date: Sun, 24 Apr 2011 19:09:35 -0700 From: josealf(a)rocketmail.com Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization To: jackliu92(a)hotmail.com Hi Mr Jack, RPMS attached. Let me know if you need further help. Regards, Jose From: Jack Liu <jackliu92(a)hotmail.com> To: josealf(a)rocketmail.com; stunnel-users(a)stunnel.org Sent: Sun, April 24, 2011 1:08:44 PM Subject: RE: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization Yes sure, please provide the binary. Thank you very much! One additional information, running socket5 on 3Proxy. Mr. Jack > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization > To: jackliu92(a)hotmail.com; stunnel-users(a)stunnel.org > From: josealf(a)rocketmail.com > Date: Sun, 24 Apr 2011 11:49:05 +0000 > > If you ruled out a configuration error, You should try with a more recent version of stunnel. You can recompile the SRPM (4.29) from redhat 6 (or scientific linux 6) and it works fine under CentOS 5. I can provide binaries if needed. > > -----Original Message----- > From: Jack Liu <jackliu92(a)hotmail.com> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Sun, 24 Apr 2011 02:30:24 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept > initialization > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 25 Apr '11

25 Apr '11

It anyone knows how to fix Stunnel stuck at SSL state (accept): before/accept initialization??? Here is the log: ----------------------------------------------------------------------------------------------------------- [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from /root/.rnd 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes to /root/.rnd 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims sufficient entropy for the PRNG 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: /etc/stunnel/stunnel.pem 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: /etc/stunnel/stunnel.pem 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to /etc/stunnel/CA 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to /etc/stunnel/CRL 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for service 3proxy 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be changed with 'ulimit -n') 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE limit for file descriptors 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on accept socket 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to 0.0.0.0:30001 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file /var/run/stunnel.pid 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from xx.xxx.xxx.xx:41165 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished with code 0 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from xx.xxx.xxx.xx:41165 permitted by libwrap 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from xx.xxx.xxx.xx:41165 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): before/accept initialization <-----------------------Stuck here forever!!! 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly disconnected 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; terminating 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file /var/run/stunnel.pid [root@vps1 ~]# ----------------------------------------------------------------------------------------------------------- stunnel.conf: cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem CApath = /etc/stunnel/CA CRLpath = /etc/stunnel/CRL debug = 7 foreground = yes verify = 1 # [3proxy] accept = 30001 connect = 127.0.0.1:33135 ----------------------------------------------------------------------------------------------------------- I am hosting with CentOS 5.5, and installed Stunnel via yum. Planning to use it with 3Proxy. However I experience the problem above, can someone please help with that? Thank you very much! Mr. Jack

3 3

Stunnel 4.33 released
by Michal Trojnara 22 Apr '11

22 Apr '11

The ChangeLog entry: Version 4.33, 2010.04.05, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 1.0.0. This library requires to c_rehash CApath/CRLpath directories on upgrade. - Win32 DLLs for zlib 1.2.4. - Experimental support for local mode on WIN32 platform. Try "exec = c:\windows\system32\cmd.exe". * Bugfixes - Inetd mode fixed SHA-1 value for stunnel-4.33.tar.gz: 695c7ef834952cb8ddbc790e10b6e32798fc2767 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

4 6

Possible leak in client.c:init_ssl()
by Sven Ulland 16 Apr '11

16 Apr '11

Quick summary: Stunnel 4.35 configured with four services. As clients connect, the main stunnel process grows a lot in vsz/rss memory. With a lot of clients connecting, it quickly grows to several gigabytes rss. The use case is quite special: The multithreaded download accelerator 'axel' is used to download large files using 800 simultaneous threads. The downloads are from China, so the network performance is horrible, and connections are reset/broken all the time, so there is lots of new connections created constantly. Up to four axel instances run at the same time, so we're talking 3200 simultaneous connections. Over a short 2h timespan, nearly 30000 connections have been set up (ref attached stunnel.log). The memory use increases over time, often in very large steps. As connections finish and the transfers stop (i.e. no active connections at all), the memory is not released. A similar issue was reported in 2008 [1]. Attached are the following files: stunnel.conf: Four services, no special config. Debug level 5. massif.out.excerpt.txt: Valgrind Massif output. The Massif log indicates that most of the memory is allocated through client.c:init_ssl(), by libssl and zlib. I haven't looked too much at the code yet, but could this be related to the high rate of connection resets/timeouts, combined with connection/session reuse? sven [1]: possible stunnel memory leak Message-ID: <47E8E0AD.8010709(a)eu.citrix.com> http://www.stunnel.org/pipermail/stunnel-users/2008-March/001903.html

4 5

Re: [stunnel-users] Weird error when trying to use 512bit RSA key
by Leandro Avila 12 Apr '11

12 Apr '11

The problem seems to be the key size If you use a 512 key for stunnel it works However, when the key used by stunnel is 1024 and you try to use the EXP-RC4-MD5 cipher, a temporary 512 key is generated BUT that fails. So I tested: Stunnel 4.35 and OpenSSL 1.0.0d Using a 512 RSA key and EXP-RC4-MD5 works Using a 1025 RSA key and EXP-RC4-MD5 fails Looks more like an OpenSSL thing. I'm uncertain about how this situation is handled in the protocol spec. When the server has a 1024 key but the client wants to negotiate with a smaller key. Cheers ----------------- Leandro Avila ----- Original Message ----- From:Outofwall.com <root(a)outofwall.com> To:stunnel-users-bounces@stunnel.org; stunnel-users(a)stunnel.org Cc: Sent:Monday, April 11, 2011 10:39 PM Subject:Re: [stunnel-users] Weird error when trying to use 512bit RSA key In fact, I'm using TLSv1, just use the custom ciphers list. Here's what I have on the server side: ciphers EXP-RC4-MD5:ALL and test sunyc@www:~$ openssl s_client -tls1 -connect ssl.sgivpn.info:443 -cipher EXP-RC4-MD5 CONNECTED(00000003) depth=0 /C=US/ST=CA/O=XXX verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=CA/O=XXX verify return:1 32684:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1093:SSL alert number 40 32684:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: Error: Apr 11 18:57:35 localhost stunnel: LOG3[8319:139884220368640]: SSL_accept: 1409B11A: error:1409B11A:SSL routines:SSL3_SEND_SERVER_KEY_EXCHANGE:error generating tmp rsa key Both client and server is running ubuntu 10.04, with openssl 0.9.8k I think. Cheers. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Weird error when trying to use 512bit RSA key
by Outofwall.com 12 Apr '11

12 Apr '11

In fact, I'm using TLSv1, just use the custom ciphers list. Here's what I have on the server side: ciphers EXP-RC4-MD5:ALL and test sunyc@www:~$ openssl s_client -tls1 -connect ssl.sgivpn.info:443 -cipher EXP-RC4-MD5 CONNECTED(00000003) depth=0 /C=US/ST=CA/O=XXX verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=CA/O=XXX verify return:1 32684:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1093:SSL alert number 40 32684:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: Error: Apr 11 18:57:35 localhost stunnel: LOG3[8319:139884220368640]: SSL_accept: 1409B11A: error:1409B11A:SSL routines:SSL3_SEND_SERVER_KEY_EXCHANGE:error generating tmp rsa key Both client and server is running ubuntu 10.04, with openssl 0.9.8k I think. Cheers.

1 0

The verify=3 option in client mode
by Philipp Hartwig 09 Apr '11

09 Apr '11

Hello, I'm using stunnel in client mode to provide an SSL connection for offlineimap[1] which does not support verification of SSL certificates. As I've read stunnel does not compare the name of the server offering the certificate to the server name mentioned in the certificate (in the CN field for example). So if I used the following section in my stunnel.conf client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile = /usr/share/ca-certificates/mozilla/Equifax_Secure_CA.crt verify = 2 stunnel would happily accept any certificate signed by Equifax for an arbitrary website. Is this correct? So I've switched to using the verify=3 option and I just want to make sure I configured it correctly. I'm now using the following section client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile= /home/ph/.certs/imaps.pem verify = 3 imaps.pem is a file containing two certificates, namely the first and the last certificate in the certificate chain of imap.gmail.com, that is the Equifax CA certificate and the server certificate itself. I then use offlineimap to establish an unencrypted connection to 127.0.0.1:4322. My understanding is that stunnel will now exclusively accept the server certificate stored in the imaps.pem file rendering all MITM attacks impossible. I'd be grateful if someone could confirm that this setup makes sense. Is this the way the verify=3 option is supposed to use? First I thought that it should be enough to just provide the server certificate in the imaps.pem file, but then openssl would complain about a self-signed certificate, so I included the CA certificate as well. Regards, Philipp [1] https://github.com/jgoerzen/offlineimap/wiki/

2 3

Is local mode on WIN32 working?
by Joerg Behrend 09 Apr '11

09 Apr '11

The changelog of stunnel 4.33 states that "Experimental support for local mode on WIN32 platform" is working and that should be tried exec = c:\windows\system32\cmd.exe In practice, it is for me not working, a connection is accepted but always reset with the stunnel log message: readsocket: Connection reset by peer (WSAECONNRESET) (10054) It was tested using the 4.35 Windows installer. Are there other requirements or settings necessary? Is a recompilation with special options senseful? Thanks! Joerg

1 0

issue making stunnel 4.35 use an apache http proxy to go out?
by Matt Wise 08 Apr '11

08 Apr '11

I've got an Apache proxy on port 3128 that will allow our clients to get outbound with a 'CONNECT" to a few services.. I'm trying to make stunnel use this service, and it seems to be ignoring my configuration completely. Tcpdumps show NO packets going outbound on port 3128... any ideas what i'm doing wrong? This config allows an inbound connection to port 1234 to hit port 2345 (a local service), while also handling the setup of an inbound connection to localhost:514 to a remote host on port 1514... debug = 7 pid = /var/run/stunnel.pid service = stunnel syslog = yes foreground = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 fips = no # Localhost:1234 hits localhost:2345 [cseservices] client = no accept = 1234 connect = 127.0.0.1:2345 CAfile = /etc/stunnel/ssl/tunnel-CAs.cert.pem cert = /etc/stunnel/ssl/server.pub key = /etc/stunnel/ssl/server.key verify = 2 ## Localhost:514 hits remotehost:1514 [syslog] client = yes accept = 514 connect = xxx:1514 CAfile = /var/lib/puppet/ssl/certs/ca.pem key = /var/lib/puppet/ssl/private_keys/xxx.pem cert = /var/lib/puppet/ssl/certs/xxx.pem session = 5 TIMEOUTidle = 600 TIMEOUTbusy = 600 TIMEOUTclose = 300 TIMEOUTconnect = 10 verify = 2 protocol=connect protocolHost=proxy:3128 protocolAuthentication=basic —Matt

1 1

Re: [stunnel-users] stunnel through elb.. need packets sent semi-frequently
by Leandro Avila 08 Apr '11

08 Apr '11

Hi I'm not sure this will work, but have you checked the option TIMEOUTidle = <num_seconds> ? Sounds to me like the setting you might be looking for ----------------- Leandro Avila ----- Original Message ----- From:Matt Wise <mwise(a)netflix.com> To:"stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Cc: Sent:Thursday, April 7, 2011 6:04 PM Subject:Re: [stunnel-users] stunnel through elb.. need packets sent semi-frequently I'm using stunnel to pass some data through an Amazon ELB. Unfortunately, there are times when the session times out due to packets not passing for 60 seconds (an amazon ELB timeout). I'm wondering whether theres some way I can configure stunnel itself to pass some whitespaces or something back and forth every few seconds to make sure the session stays open and live? (and yes, I'm posing the same question to the app developer who's ap we're passing through.. but I'm looking at both avenues.. ) _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

3 2

stunnel through elb.. need packets sent semi-frequently
by Matt Wise 08 Apr '11

08 Apr '11

I'm using stunnel to pass some data through an Amazon ELB. Unfortunately, there are times when the session times out due to packets not passing for 60 seconds (an amazon ELB timeout). I'm wondering whether theres some way I can configure stunnel itself to pass some whitespaces or something back and forth every few seconds to make sure the session stays open and live? (and yes, I'm posing the same question to the app developer who's ap we're passing through.. but I'm looking at both avenues.. )

2 2

Re: [stunnel-users] STunnel server handshake fails
by Leandro Avila 08 Apr '11

08 Apr '11

Hello, I think you probably want to use the sslVersion = TLSv1 setting in your configuration. Instead of the options for OpenSSL Hope that helps ----------------- Leandro Avila ________________________________ From: John C. Kadyk <jckadyk(a)pacbell.net> To: stunnel-users(a)stunnel.org Sent: Thursday, April 7, 2011 7:06 PM Subject: Re: [stunnel-users] STunnel server handshake fails STunnel server handshake fails I'm trying to set up STunnel so our non-SSL network scanner can email scans through our email server, which requires TLS. A desktop email client with the same server/port settings can send email OK. I think I have STunnel configured correctly, but there's a handshake failure when it tries to connect to the server. STunnel seems to be attempting an SSLv3 connection even though I turned that option off in the config file. I want to force it to use TLS but not sure how to do that. Any suggestions greatly appreciated. Here's the config file: cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 1025 connect = mail022-1.exch022.serverdata.net:1025 <http://mail022-1.exch022.serverdata.net:1025> ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini and here's the log: 2011.04.07 16:41:04 LOG5[3744:516]: Reading configuration from file stunnel.conf 2011.04.07 16:41:04 LOG7[3744:516]: Snagged 64 random bytes from C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: Wrote 1024 new random bytes to C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: PRNG seeded successfully 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service pop3s 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service imaps 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service ssmtp 2011.04.07 16:41:04 LOG5[3744:516]: Configuration successful 2011.04.07 16:41:04 LOG5[3744:516]: No limit detected for the number of clients 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=136 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s bound to 0.0.0.0:995 <http://0.0.0.0:995> 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s opened FD=136 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=124 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps bound to 0.0.0.0:993 <http://0.0.0.0:993> 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps opened FD=124 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=148 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp bound to 0.0.0.0:1025 <http://0.0.0.0:1025> 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp opened FD=148 2011.04.07 16:41:04 LOG5[3744:516]: stunnel 4.35 on x86-pc-mingw32-gnu with OpenSSL 1.0.0c 2 Dec 2010 2011.04.07 16:41:04 LOG5[3744:516]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2011.04.07 16:41:17 LOG7[3744:2436]: local socket: FD=232 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG7[3744:2436]: Service ssmtp accepted FD=232 from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:2436]: Creating a new thread 2011.04.07 16:41:17 LOG7[3744:2436]: New thread created 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp started 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on local socket 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp accepted connection from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:4012]: remote socket: FD=268 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG6[3744:4012]: connect_blocking: connecting 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: connect_blocking: connected 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp connected remote server from 10.10.17.249:4081 <http://10.10.17.249:4081> 2011.04.07 16:41:17 LOG7[3744:4012]: Remote FD=268 initialized 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on remote socket 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): before/connect initialization 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): SSLv3 write client hello A 2011.04.07 16:41:17 LOG7[3744:4012]: SSL alert (write): fatal: handshake failure 2011.04.07 16:41:17 LOG3[3744:4012]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.04.07 16:41:17 LOG5[3744:4012]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp finished (0 left) Any suggestions greatly appreciated. Thanks! John _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

STunnel server handshake fails
by John C. Kadyk 08 Apr '11

08 Apr '11

I'm trying to set up STunnel so our non-SSL network scanner can email scans through our email server, which requires TLS. A desktop email client with the same server/port settings can send email OK. I think I have STunnel configured correctly, but there's a handshake failure when it tries to connect to the server. STunnel seems to be attempting an SSLv3 connection even though I turned that option off in the config file. I want to force it to use TLS but not sure how to do that. Any suggestions greatly appreciated. Here's the config file: cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 1025 connect = mail022-1.exch022.serverdata.net:1025 <http://mail022-1.exch022.serverdata.net:1025> ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini and here's the log: 2011.04.07 16:41:04 LOG5[3744:516]: Reading configuration from file stunnel.conf 2011.04.07 16:41:04 LOG7[3744:516]: Snagged 64 random bytes from C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: Wrote 1024 new random bytes to C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: PRNG seeded successfully 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service pop3s 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service imaps 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service ssmtp 2011.04.07 16:41:04 LOG5[3744:516]: Configuration successful 2011.04.07 16:41:04 LOG5[3744:516]: No limit detected for the number of clients 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=136 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s bound to 0.0.0.0:995 <http://0.0.0.0:995> 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s opened FD=136 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=124 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps bound to 0.0.0.0:993 <http://0.0.0.0:993> 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps opened FD=124 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=148 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp bound to 0.0.0.0:1025 <http://0.0.0.0:1025> 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp opened FD=148 2011.04.07 16:41:04 LOG5[3744:516]: stunnel 4.35 on x86-pc-mingw32-gnu with OpenSSL 1.0.0c 2 Dec 2010 2011.04.07 16:41:04 LOG5[3744:516]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2011.04.07 16:41:17 LOG7[3744:2436]: local socket: FD=232 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG7[3744:2436]: Service ssmtp accepted FD=232 from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:2436]: Creating a new thread 2011.04.07 16:41:17 LOG7[3744:2436]: New thread created 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp started 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on local socket 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp accepted connection from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:4012]: remote socket: FD=268 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG6[3744:4012]: connect_blocking: connecting 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: connect_blocking: connected 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp connected remote server from 10.10.17.249:4081 <http://10.10.17.249:4081> 2011.04.07 16:41:17 LOG7[3744:4012]: Remote FD=268 initialized 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on remote socket 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): before/connect initialization 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): SSLv3 write client hello A 2011.04.07 16:41:17 LOG7[3744:4012]: SSL alert (write): fatal: handshake failure 2011.04.07 16:41:17 LOG3[3744:4012]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.04.07 16:41:17 LOG5[3744:4012]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp finished (0 left) Any suggestions greatly appreciated. Thanks! John

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users