stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

stunnel 4.26 MS SQL connetion - works on Vista, not on XP
by zervakos 25 Mar '09

25 Mar '09

Greetings, I was wondering if anyone's come across anything like this. I want to encrypt connections for MS SQL Server 2008 Express from a Windows XP client to a Windows 2003 Server. Following these instructions: http://www.securityfocus.com/infocus/1677 I was able to configure encrypted connections by pointing SQL Server Management Studio to 127.0.0.1 on _either_ XP or Vista and then that gets tunneled over to the Windows 2003 Server running SQL Server 2008 Express. I can browse the database tables, etc. Now the problem. I have users that make use of a thin client that connects directly to the SQL Server. It has one config file that I've pointed to 127.0.0.1. When I run this thin client on Vista, it works great, however, when running it on XP, stunnel tries to connect, but then gives up after several attempts. Here's what I see in the server log before connecting: 2009.03.23 12:26:59 LOG7[284564:274684]: RAND_status claims sufficient entropy for the PRNG 2009.03.23 12:26:59 LOG7[284564:274684]: PRNG seeded successfully 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service vnc 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service mssql 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service rdp 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service http 2009.03.23 12:26:59 LOG5[284564:274684]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.03.23 12:26:59 LOG5[284564:274684]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.03.23 12:26:59 LOG5[284564:289192]: No limit detected for the number of clients 2009.03.23 12:27:00 LOG7[284564:289192]: FD 268 in non-blocking mode 2009.03.23 12:27:00 LOG7[284564:289192]: SO_REUSEADDR option set on accept socket 2009.03.23 12:27:00 LOG7[284564:289192]: mssql bound to WINDOWS_SQL_SERVER:14333 2009.03.23 12:27:00 LOG7[284564:289192]: FD 292 in non-blocking mode 2009.03.23 12:27:00 LOG7[284564:289192]: SO_REUSEADDR option set on accept socket And here's what I see after trying to connect from XP (this appears 16 more times in stunnel.log until stunnel gives up): 2009.03.23 12:29:48 LOG7[284564:289192]: mssql accepted FD=308 from Windows_XP_Client:1252 2009.03.23 12:29:48 LOG7[284564:289192]: Creating a new thread 2009.03.23 12:29:48 LOG7[284564:289192]: New thread created 2009.03.23 12:29:48 LOG7[284564:348604]: mssql started 2009.03.23 12:29:48 LOG7[284564:348604]: FD 308 in non-blocking mode 2009.03.23 12:29:48 LOG5[284564:348604]: mssql accepted connection from Windows_XP_Client:1252 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): before/accept initialization 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client hello A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write server hello A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write certificate A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write certificate request A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 flush data 2009.03.23 12:29:48 LOG5[284564:348604]: CRL: verification passed 2009.03.23 12:29:48 LOG5[284564:348604]: VERIFY OK: depth=1, /C=PL/ST=Warsaw/L=Warsaw/O=Secure/OU=Secure Labs/CN=CA/emailAddress=user(a)abc.com 2009.03.23 12:29:48 LOG5[284564:348604]: CRL: verification passed 2009.03.23 12:29:48 LOG5[284564:348604]: VERIFY OK: depth=0, /C=PL/ST=Warsaw/L=Warsaw/O=Secure/OU=Secure Labs/CN=VNC Client/emailAddress=user(a)abc.com 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client certificate A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client key exchange A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read certificate verify A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read finished A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write change cipher spec A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write finished A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 flush data 2009.03.23 12:29:48 LOG7[284564:348604]: 1 items in the session cache 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client connects (SSL_connect()) 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client connects that finished 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client renegotiations requested 2009.03.23 12:29:48 LOG7[284564:348604]: 1 server connects (SSL_accept()) 2009.03.23 12:29:48 LOG7[284564:348604]: 1 server connects that finished 2009.03.23 12:29:48 LOG7[284564:348604]: 0 server renegotiations requested 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache hits 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache misses 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache timeouts 2009.03.23 12:29:48 LOG6[284564:348604]: SSL accepted: new session negotiated 2009.03.23 12:29:48 LOG6[284564:348604]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.03.23 12:29:48 LOG7[284564:348604]: FD 332 in non-blocking mode 2009.03.23 12:29:48 LOG7[284564:348604]: mssql connecting 127.0.0.1:1433 2009.03.23 12:29:48 LOG7[284564:348604]: connect_wait: waiting 10 seconds 2009.03.23 12:29:48 LOG7[284564:348604]: connect_wait: connected 2009.03.23 12:29:48 LOG5[284564:348604]: mssql connected remote server from 127.0.0.1:2001 2009.03.23 12:29:48 LOG7[284564:348604]: Remote FD=332 initialized 2009.03.23 12:29:48 LOG7[284564:348604]: SSL alert (read): warning: close notify 2009.03.23 12:29:48 LOG7[284564:348604]: SSL closed on SSL_read 2009.03.23 12:29:48 LOG7[284564:348604]: Socket write shutdown 2009.03.23 12:29:48 LOG7[284564:348604]: SSL write shutdown 2009.03.23 12:29:48 LOG7[284564:348604]: SSL alert (write): warning: close notify 2009.03.23 12:29:48 LOG6[284564:348604]: SSL_shutdown successfully sent close_notify 2009.03.23 12:29:48 LOG5[284564:348604]: Connection closed: 37 bytes sent to SSL, 52 bytes sent to socket 2009.03.23 12:29:48 LOG7[284564:348604]: mssql finished (0 left) The server's stunnel.conf: CAfile = CAcert.pem CApath = certificates cert = server.pem client = no verify = 3 debug = 7 output = stunnel.log [mssql] accept = WINDOWS_SQL_SERVER:14333 connect = 127.0.0.1:1433 The client's stunnel.conf: CAfile = CAcert.pem CApath = certificates cert = client.pem client = yes verify = 3 debug = 7 output = stunnel.log [mssql] accept = 127.0.0.1:1433 connect = WINDOWS_SQL_SERVER:14333 Things I've tried: - changed the compatibility settings of the thin client to work under ealier versions of Windows, this didn't help - regenerated certificates, no good - tried connecting without certificates, still no good I still haven't tried earlier versions of stunnel, but I figured I'd just check and see if may anyone's run across something like this before. From what I can tell, the combination of XP, the thin client and stunnel does not work. The thin client does work on XP when I do not use stunnel, but I need to have the connection encrypted. Any help greatly appreciated, thanks -- View this message in context: http://www.nabble.com/stunnel-4.26-MS-SQL-connetion---works-on-Vista%2C-not… Sent from the Stunnel - Users mailing list archive at Nabble.com.

3 2

Re: [stunnel-users] Using stunnel in a box having http client and http server.
by Joe Lau 23 Mar '09

23 Mar '09

So, my understanding is that I will need one stunnel for each remote web server that my http client is going to connnect to. For example if my http client want to connect to 3 remote web servers. I will need to setup the folllowing stunnels: Remote https Web Server #1 <------------- Stunnel #1 <---------- http client (http://localhost:81) (port 81) Remote https Web Server #1 <------------- Stunnel #2 <---------- http client (http://localhost:82) (port 82) Remote https Web Server #1 <------------- Stunnel #3 <---------- http client (http://localhost:83) (port 83) But I will need only one stunnel for my http server as follow: Remote https client #1 ------------+-----> Stunnel --------------- http server | (port 443) (port 80) Remote https client #2 ------------+ | ..... | | Remote https client #N-------------+ Is the following config file correct for my http server stunnel? client=no accept=443 connect=localhost:80 Thank you! -Joe -----Original Message----- From: Christophe Nanteuil [mailto:christophe.nanteuil@gmail.com] Sent: Monday, March 23, 2009 3:19 AM To: Joe Lau Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Using stunnel in a box having http client and http server. 2009/3/20 Joe Lau <Jlau(a)extremenetworks.com>: > > Hello, Hello, > I am new to this list. > > I am planning to use stunnel on my box which has a http client and http server running on it. > I will need two stunnel instances, one for the http client and one for the http server respectively. It seems good. > > For my http client, my stunnel config file looks like this: > > client=yes > accept=80 > connect=remote_web_server:443 > > For my http server, my stunnel config file looks like this: > > client=no > accept=443 > > The problem I am facing is now I have two programs (i.e. 1) stunnel for http client and 2) http server) listening to the same port 80. > How do I resolve this conflict? Who is going to connect to your http "client" ? if it is your local browser (which seems the goal of the configuration), then you can configure the client with "accept=81" and then type in your browser's address bar "https://localhost:/81" -- Christophe Nanteuil DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

2 1

Re: [stunnel-users] Using stunnel in a box having http client and http server.
by Joe Lau 20 Mar '09

20 Mar '09

Hello, I am new to this list. I am planning to use stunnel on my box which has a http client and http server running on it. I will need two stunnel instances, one for the http client and one for the http server respectively. For my http client, my stunnel config file looks like this: client=yes accept=80 connect=remote_web_server:443 For my http server, my stunnel config file looks like this: client=no accept=443 The problem I am facing is now I have two programs (i.e. 1) stunnel for http client and 2) http server) listening to the same port 80. How do I resolve this conflict? Thank you very much for the help. Regards, -Joe DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

1 0

Is this possible? Stunnel FIPS mode with rdesktop to secured Microsoft terminal server
by David W Blaine 16 Mar '09

16 Mar '09

Hi list, I was wondering if this solution is possible? Linux Linux Windows Server 2003 rdesktop ----> Stunnel client ------> Terminal Server no enc FIPS mode FIPS mode I know there is doco's about how to setup a Stunnel using client and server setups on either side but Windows admins here are unlikely to install Stunnel on their side. They have enabled FIPS mode on their Windows servers and disconnected all the Linux/UNIX admins from their Terminal Server. So I was wondering if I could get away with a client only solution? Dave

1 1

persistent SSL connection
by Dorai Ashok 16 Mar '09

16 Mar '09

Hi all, I was able to setup stunnel between two hosts successfully but the only problem I am facing is that, the SSL connection between the two hosts is not persistent. For every connection I make to the stunnel client, a new SSL connection is established by the stunnel client to the stunnel server. Is there a configuration variable in stunnel which can make the SSL connection between stunnel client and server persistent ? Thanks, -Dorai.

3 3

Re: [stunnel-users] persistent SSL connection
by Peter Pentchev 16 Mar '09

16 Mar '09

On Mon, Mar 16, 2009 at 12:59:16PM +0100, delaage.pierre(a)free.fr wrote: > Quoting Peter Pentchev <roam(a)ringlet.net>: You might want to fix your mailer's idea of quoting, since I did not write what you yourself wrote :) You wrote: > For persistent connexion, use ssh tunneling instead of stunnel. Unless, of course, you are trying to communicate with a third-party product that speaks SSL - if either the client or the server is not under your control, there's no way to make them use multiplexed SSH connections instead of SSL :) But if it's just stunnel on both sides, then yes, SSH tunneling may be a better choice for multiplexing, although it has its own problems - most often related to connection keepalive, especially if there is some kind of firewalling gateway on the path. G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)space.bg roam(a)FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 Hey, out there - is it *you* reading me, or is it someone else?

1 0

Re: [stunnel-users] Configuring stunnel to use p12 and p7b in client mode
by Eduard Witteveen 14 Mar '09

14 Mar '09

Pierre and List, Thanks for the answer. Maybe i wasn't clear enough in my question: 1 - I have a p12 and p7b file, which work in firefox and iexplore. 2 - I want to setup a tunnel, so the encryption is done by stunnel and not by the browser(so i can 'talk' normal http for soap) Removing the password sounds like a good idea, so i started with this. However, somehow my openssl doesnt know the command pkey. (as mentioned: http://www.openssl.org/docs/apps/pkey.html) > $ openssl pkey > openssl:Error: 'pkey' is an invalid command. > openssl version > OpenSSL 0.9.8g 19 Oct 2007 And > openssl.exe pkey > openssl:Error: 'pkey' is an invalid command. > openssl version > OpenSSL 0.9.8i 15 Sept 2008 I searched the net for the error message, but i couldnt find a solution (i did find more questions regarding this on mailinglists) On Thu, 2009-03-12 at 08:21 +0100, delaage.pierre(a)free.fr wrote: > Selon Eduard Witteveen <eduard(a)nergens.org>: > Hello, > In such case a definitive solution is to remove password protection of the > private key, although it is not good for your security, so be careful. > See info at openssl.org : > http://www.openssl.org/docs/apps/pkey.html#EXAMPLES > > "... > To remove the pass phrase on an RSA private key: > > openssl pkey -in key.pem -out keyout.pem > ..." > > and then regenerate a p12 file for your browsers. > > I do not know ways to specify the password in stunnel, but I think this should > not be a good idea. > Anyway ie and firefox should be able to cache your password at least for a > session, so... > > Yours sincerely, > Pierre Delaage > > > Hello, > > > > I'm trying to get stunnel running on my local system, so it will connect > > to the remote a host, which requires authentication with this p12 > > file(with password). I also have the chain of trust which is in the p7b > > file. > > > > The reason why i want to do this, is that the remote host exposes a soap > > interface by https, and i think it would be a good idea to tunnel the > > communications with stunnel, so a transparant configuration can be used. > > Also, this would mean there is no configuration needed for the browser > > anymore, since it can connect to the localhost instead of to the > > remoteserver. > > > > I've tested the p12(certificate PKCS12?) and (trust chain PKCS7?) files > > with internet explorer and firefox. They work(i can browse the > > remotehost), but i still have to enter the password. > > > > I've converted the p12 and p7b files into dem files with the following > > commands: > > > > > openssl pkcs12 -in certificate.p12 -out certificate.pem > > > Enter Import Password: > > > MAC verified OKK > > > Enter PEM pass phrase: > > > Verifying - Enter PEM pass phrase > > > > firefox: store as PEM with chain > > chain.p7b --> chain.pem > > > > Config: > > > key=certificate.pem > > > CAfile=chain.pem > > > client=yes > > > debug=7 > > > output=stunnel.log > > > verify=1 > > > [http] > > > accept=80 > > > connect=www.remoteserver.com:443 > > > TIMEOUTclose=0 > > > > Command: > > > sudo /usr/bin/stunnel4 stunnel.conf > > > > Error: > > > 009.03.11 00:58:10 LOG5[30424:3082909360]: Threading:PTHREAD > > > SSL:ENGINE > > > Sockets:POLL,IPv6 Auth:LIBWRAP > > > 2009.03.11 00:58:10 LOG6[30424:3082909360]: file ulimit = 1024 (can be > > > changed with 'ulimit -n') > > > 2009.03.11 00:58:10 LOG6[30424:3082909360]: poll() used - no > > > FD_SETSIZE > > > limit for file descriptors > > > 2009.03.11 00:58:10 LOG5[30424:3082909360]: 500 clients allowed > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 10 in non-blocking mode > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 11 in non-blocking mode > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 12 in non-blocking mode > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: SO_REUSEADDR option set on > > > accept socket > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: http bound to 0.0.0.0:80 > > > 2009.03.11 00:58:10 LOG7[30430:3082909360]: Created pid file > > > /var/run/stunnel4.pid > > > > > > 2009.03.11 00:58:20 LOG7[30430:3082909360]: http accepted FD=13 from > > > 127.0.0.1:59793 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http started > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 13 in non-blocking mode > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Waiting for a libwrap > > > process > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Acquired libwrap process > > > #0 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Releasing libwrap process > > > #0 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Released libwrap process > > > #0 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http permitted by libwrap > > > from > > > 127.0.0.1:59793 > > > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http accepted connection > > > from > > > 127.0.0.1:59793 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 14 in non-blocking mode > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http connecting > > > ${REMOTESERVER_IP}:443 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: waiting 10 > > > seconds > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: connected > > > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http connected remote > > > server > > > from 10.0.2.15:38710 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Remote FD=14 initialized > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): > > > before/connect initialization > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > > > write > > > client hello A > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > > > read > > > server hello A > > > 2009.03.11 00:58:20 LOG4[30430:3082738576]: VERIFY ERROR: depth=0, > > > error=unable to get local issuer certificate: ${UNIQUE NAME} > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL alert (write): fatal: > > > bad > > > certificate > > > 2009.03.11 00:58:20 LOG3[30430:3082738576]: SSL_connect: 14090086: > > > error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate > > > verify > > > failed > > > 2009.03.11 00:58:20 LOG5[30430:3082738576]: Connection reset: 0 bytes > > > sent > > > to SSL, 0 bytes sent to socket > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http finished (0 left) > > (${UNIQUE NAME} / ${REMOTESERVER_IP} were replaced) > > > > Tested by connecting the browser to http://127.0.0.1:80/ > > > > How can i get stunnel to redirect http://127.0.0.1:80/ to > > http://remoteserver:443/ and use the certificate and chain to validate > > the connection? Any pointers would also be welcome, since i searched in > > google but i cannot find the correct information, while one would expect > > that this is not the first time that this is being tried. > > > > Thanks, > > > > Eduard Witteveen > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Can stunnel do this?
by Miguel Beccari 13 Mar '09

13 Mar '09

I tried this configuration: client = yes debug = debug cert =/Users/etc/stunnel/stunnel.pem [imaps] accept = localhost:143 delay = yes connect = remote:993 and it worked! But if I change "accept = localhost:143" to "accept = localhost:993" it does not work. I need a imaps proxy. Logs does not say anything interesting (SSL accepted: new session negotiated) Thank you all, Miguel

1 0

Newbie Question - Moving stunnel to another machine
by Dave Nasralla 13 Mar '09

13 Mar '09

Hi, I'm pretty new to the unix command line and stunnel. I am running Mac OS 10.5 with the latest version of stunnel. I was able to get stunnel up and running on my computer and it is working fine ( - I installed X-Cold, used Darwinports, got it compiled and configured, and launching at bootup). My question is: If I have an identical Machine (same hardware and OS), is there an easy way to move stunnel over to it? I copied the stunnel executable and the configuration file over to the new machine. I ran it from the terminal command line. % /Applications/stunnel /Applications/stunnel.conf The original location on my machine was (/opt/local/bin/stunnel /opt/ local/etc/stunnel/stunnel.conf) No errors (got the prompt back). But no services start on the configured ports. Am I missing support files? Or am I being dumb to think you can simply copy the program over. I was hoping to not have to jump through the same hoops to get it up and running. Any direction would be appreciated. Thanks, dave naz PS It is a simple configuration to help non SSL Mail clients connect to GMail - no certs involved.

1 0

Configuring stunnel to use p12 and p7b in client mode
by Eduard Witteveen 11 Mar '09

11 Mar '09

Hello, I'm trying to get stunnel running on my local system, so it will connect to the remote a host, which requires authentication with this p12 file(with password). I also have the chain of trust which is in the p7b file. The reason why i want to do this, is that the remote host exposes a soap interface by https, and i think it would be a good idea to tunnel the communications with stunnel, so a transparant configuration can be used. Also, this would mean there is no configuration needed for the browser anymore, since it can connect to the localhost instead of to the remoteserver. I've tested the p12(certificate PKCS12?) and (trust chain PKCS7?) files with internet explorer and firefox. They work(i can browse the remotehost), but i still have to enter the password. I've converted the p12 and p7b files into dem files with the following commands: > openssl pkcs12 -in certificate.p12 -out certificate.pem > Enter Import Password: > MAC verified OKK > Enter PEM pass phrase: > Verifying - Enter PEM pass phrase firefox: store as PEM with chain chain.p7b --> chain.pem Config: > key=certificate.pem > CAfile=chain.pem > client=yes > debug=7 > output=stunnel.log > verify=1 > [http] > accept=80 > connect=www.remoteserver.com:443 > TIMEOUTclose=0 Command: > sudo /usr/bin/stunnel4 stunnel.conf Error: > 009.03.11 00:58:10 LOG5[30424:3082909360]: Threading:PTHREAD > SSL:ENGINE > Sockets:POLL,IPv6 Auth:LIBWRAP > 2009.03.11 00:58:10 LOG6[30424:3082909360]: file ulimit = 1024 (can be > changed with 'ulimit -n') > 2009.03.11 00:58:10 LOG6[30424:3082909360]: poll() used - no > FD_SETSIZE > limit for file descriptors > 2009.03.11 00:58:10 LOG5[30424:3082909360]: 500 clients allowed > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 10 in non-blocking mode > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 11 in non-blocking mode > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 12 in non-blocking mode > 2009.03.11 00:58:10 LOG7[30424:3082909360]: SO_REUSEADDR option set on > accept socket > 2009.03.11 00:58:10 LOG7[30424:3082909360]: http bound to 0.0.0.0:80 > 2009.03.11 00:58:10 LOG7[30430:3082909360]: Created pid file > /var/run/stunnel4.pid > > 2009.03.11 00:58:20 LOG7[30430:3082909360]: http accepted FD=13 from > 127.0.0.1:59793 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http started > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 13 in non-blocking mode > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Waiting for a libwrap > process > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Acquired libwrap process > #0 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Releasing libwrap process > #0 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Released libwrap process > #0 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http permitted by libwrap > from > 127.0.0.1:59793 > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http accepted connection > from > 127.0.0.1:59793 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 14 in non-blocking mode > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http connecting > ${REMOTESERVER_IP}:443 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: waiting 10 > seconds > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: connected > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http connected remote > server > from 10.0.2.15:38710 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Remote FD=14 initialized > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): > before/connect initialization > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > write > client hello A > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > read > server hello A > 2009.03.11 00:58:20 LOG4[30430:3082738576]: VERIFY ERROR: depth=0, > error=unable to get local issuer certificate: ${UNIQUE NAME} > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL alert (write): fatal: > bad > certificate > 2009.03.11 00:58:20 LOG3[30430:3082738576]: SSL_connect: 14090086: > error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate > verify > failed > 2009.03.11 00:58:20 LOG5[30430:3082738576]: Connection reset: 0 bytes > sent > to SSL, 0 bytes sent to socket > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http finished (0 left) (${UNIQUE NAME} / ${REMOTESERVER_IP} were replaced) Tested by connecting the browser to http://127.0.0.1:80/ How can i get stunnel to redirect http://127.0.0.1:80/ to http://remoteserver:443/ and use the certificate and chain to validate the connection? Any pointers would also be welcome, since i searched in google but i cannot find the correct information, while one would expect that this is not the first time that this is being tried. Thanks, Eduard Witteveen

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users