stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

stunnel question when using two BCM5820 SSL accelerator card
by q p 30 Jan '09

30 Jan '09

Hello,stunnel-users I have two BCM5820 SSL accelerator card in one Freebsd 7.1 host. But when I plug in two ssl accel card and make stress test by Web Application Stress Tool , I get same banchmark ,about 70reqs/s , 50% cpu usage, as one ssl accel card in box. On another word, it seems only one accle card is working another one is idle. Is there someone has simialer problem as me? How to make the another card work? #pciconf -lv ubsec0@pci0:2:3:0: class=0x0b4000 card=0x001014e4 chip=0x582014e4 rev=0x10 hdr=0x00 vendor = 'Broadcom Corporation' device = 'BCM 5820 Crypto Accelerator' class = processor ubsec1@pci0:2:4:0: class=0x0b4000 card=0x001014e4 chip=0x582014e4 rev=0x10 hdr=0x00 vendor = 'Broadcom Corporation' device = 'BCM 5820 Crypto Accelerator' class = processor Stunnel Version 4.26 # make -D WITH_STUNNEL_SSL_ENGINE install clean Openssl Version 0.9.8e CPU P4 1.6A MEM 512M [root@proxy /usr/ports/security/stunnel]# stunnel -version stunnel 4.26 on i386-portbld-freebsd7.1 with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/tmp/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:CAMELLIA:ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none [root@proxy /usr/ports/security/]# openssl version OpenSSL 0.9.8e 23 Feb 2007 BTW:MY SITE IS ALSO BOMBED BY MANY SPAM MAIL EVERYDAY, BUT NOT ALL MAILS FROM CHINESE IS SPAM, ACTUALLY USA IS THE SECOND SPAM SOURCE COUNTURY. ALL OF US HATE SPAM.

1 0

Feature request: set environment variable for inetd-type program
by Michael Renner 27 Jan '09

27 Jan '09

Moin, I am not a programmer, I am a writer and user, so I have to ask kindly for a additional stunnel feature I need the ability to push some information from the stunnel client side to the server side. To be more concrete: a self written script that is called by stunnels 'exec' statement need some settings, e.g. username and password. My idea is to configure this in the client side stunnel.conf and pass this as a environment variable to this script. There is no chance to pack these stings in a client certificate, because everybody who is able to handle snoop/tcpdump will be able to read this. I imagine a configuration like this: client stunnel.conf [foo] accept = 127.0.0.1:1234 connect = 192.0.20.0:443 env = "SUSER=renner" env = "SPASS=geheim" server stunnel.conf [foo] accept = 192.0.20.0:443 exec = /opt/foo/script.sh env = yes My question to the developers: do you think this is a helpful feature, also for others? Greetings -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

4 4

Stunnel 4.26 - AIX 5.3
by Spence, Thomas Civ 844 CS/SCBX 26 Jan '09

26 Jan '09

Dear Users, * I'm running Stunnel 4.26 as a service, but it dies on logoff... * Could you tell me which one should I put comment "/* ... */" at stunnel.c or protocol.c so I want stunnel's daemon won't stop running. * I am using stunnel.conf, like this: ------- pid = cert = /usr/local/ssl/private/stunnel.pem output = stunnel.log [tssl] accept = 992 exec = /usr/sbin/telnetd ------- *stunnel.log ------- [/usr/local/etc/stunnel]# cat *.log 2009.01.21 16:42:54 LOG7[462906:1]: Snagged 64 random bytes from //.rnd 2009.01.21 16:42:54 LOG7[462906:1]: Wrote 1024 new random bytes to //.rnd 2009.01.21 16:42:54 LOG7[462906:1]: RAND_status claims sufficient entropy for the PRNG 2009.01.21 16:42:54 LOG7[462906:1]: PRNG seeded successfully 2009.01.21 16:42:55 LOG7[462906:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2009.01.21 16:42:55 LOG7[462906:1]: Certificate loaded 2009.01.21 16:42:55 LOG7[462906:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2009.01.21 16:42:55 LOG7[462906:1]: Private key loaded 2009.01.21 16:42:55 LOG7[462906:1]: SSL context initialized for service tssl 2009.01.21 16:42:55 LOG5[462906:1]: stunnel 4.26 on powerpc-ibm-aix5.3.0.0 with OpenSSL 0.9.8j 07 Jan 2009 2009.01.21 16:42:55 LOG5[462906:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2009.01.21 16:42:55 LOG6[462906:1]: file ulimit = 65534 (can be changed with 'ulimit -n') 2009.01.21 16:42:55 LOG6[462906:1]: poll() used - no FD_SETSIZE limit for file descriptors 2009.01.21 16:42:55 LOG5[462906:1]: 31999 clients allowed 2009.01.21 16:42:55 LOG7[462906:1]: FD 10 in non-blocking mode 2009.01.21 16:42:55 LOG7[462906:1]: FD 11 in non-blocking mode 2009.01.21 16:42:55 LOG7[462906:1]: FD 12 in non-blocking mode 2009.01.21 16:42:55 LOG7[462906:1]: SO_REUSEADDR option set on accept socket 2009.01.21 16:42:55 LOG7[462906:1]: tssl bound to 0.0.0.0:992 2009.01.21 16:42:55 LOG7[540758:1]: No pid file being created 2009.01.21 16:43:17 LOG7[540758:1]: tssl accepted FD=0 from x.x.x.x:3532 2009.01.21 16:43:17 LOG7[540758:258]: tssl started 2009.01.21 16:43:17 LOG7[540758:258]: FD 0 in non-blocking mode 2009.01.21 16:43:17 LOG7[540758:258]: Waiting for a libwrap process 2009.01.21 16:43:17 LOG7[540758:258]: Acquired libwrap process #0 2009.01.21 16:43:17 LOG7[540758:258]: Releasing libwrap process #0 2009.01.21 16:43:17 LOG7[540758:258]: Released libwrap process #0 2009.01.21 16:43:17 LOG7[540758:258]: tssl permitted by libwrap from x.x.x.x:3532 2009.01.21 16:43:17 LOG5[540758:258]: tssl accepted connection from x.x.x.x:3532 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): before/accept initialization 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 read client hello A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write server hello A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write certificate A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write server done A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 flush data 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 read client key exchange A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 read finished A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write change cipher spec A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write finished A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 flush data 2009.01.21 16:43:17 LOG7[540758:258]: 1 items in the session cache 2009.01.21 16:43:17 LOG7[540758:258]: 0 client connects (SSL_connect()) 2009.01.21 16:43:17 LOG7[540758:258]: 0 client connects that finished 2009.01.21 16:43:17 LOG7[540758:258]: 0 client renegotiations requested 2009.01.21 16:43:17 LOG7[540758:258]: 1 server connects (SSL_accept()) 2009.01.21 16:43:17 LOG7[540758:258]: 1 server connects that finished 2009.01.21 16:43:17 LOG7[540758:258]: 0 server renegotiations requested 2009.01.21 16:43:17 LOG7[540758:258]: 0 session cache hits 2009.01.21 16:43:17 LOG7[540758:258]: 0 session cache misses 2009.01.21 16:43:17 LOG7[540758:258]: 0 session cache timeouts 2009.01.21 16:43:17 LOG6[540758:258]: SSL accepted: new session negotiated 2009.01.21 16:43:17 LOG6[540758:258]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2009.01.21 16:43:17 LOG7[540758:258]: bind#1: Invalid argument (22) 2009.01.21 16:43:17 LOG7[540758:258]: bind#2: Invalid argument (22) 2009.01.21 16:43:17 LOG6[540758:258]: Local mode child started (PID=639170) 2009.01.21 16:43:17 LOG7[540758:258]: Remote FD=13 initialized 2009.01.21 16:43:34 LOG7[540758:258]: Socket closed on read 2009.01.21 16:43:34 LOG7[540758:258]: SSL write shutdown 2009.01.21 16:43:34 LOG7[540758:258]: SSL alert (write): warning: close notify 2009.01.21 16:43:34 LOG6[540758:258]: SSL socket closed on SSL_shutdown 2009.01.21 16:43:34 LOG7[540758:258]: Socket write shutdown 2009.01.21 16:43:34 LOG5[540758:258]: Connection closed: 8360 bytes sent to SSL, 101 bytes sent to socket 2009.01.21 16:43:34 LOG7[540758:258]: tssl finished (0 left) ------- Your help will be appreciate... Thank you. ________________________________ Tom Spence AIX Sys Adm ABIDES System Support 844th CS/SCBX Pentagon - MD822

3 10

Use stunnel through firewall for home Web server?
by Bill Eldridge 25 Jan '09

25 Jan '09

I was interested in whether there's a simple way to have stunnel redirect traffic from a public Web browser/port to my home Web browser behind my DSL firewall (no ports opened/forwarded for incoming connections on the router, only outgoing-initiated) I scanned old posts but didn't find anything that quite fit - references are usually for people who want to get out from behind a firewall, not publish sites publicly from behind (i.e. externally initiated clicks)

4 12

Compilation problem
by fredzy padzy 21 Jan '09

21 Jan '09

Hi everyone I try to compile stunnel, but it fails. Actually, it tells me about a parse error inside signal.h, and i think it's a falsePositive. The configure works great and nothing look strange inside the configure.log. I also tried to googled those errors, but didn't find any clues. My server is a sunOS 10 and the src were taken from http://www.stunnel.org/download/stunnel/src/stunnel-4.26.tar.gz My version of openssl : OpenSSL 0.9.7.d Here are the errors, after the make command : /stunnel-4.26 root# make Making all in src make[1]: Entering directory `/root/syslogNG/stunnel-4.26/src' if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.26\" -DPACKAGE_STRING=\"stunnel\ 4.26\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.26\" -DHOST=\"i386-pc-solaris2.10\" -DCPU_I386=1 -DVENDOR_PC=1 -DOS_SOLARIS2_10=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_SYS_FILIO_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_LIBSOCKET=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr/local/ssl\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/var/run/stunnel/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -MT file.o -MD -MP -MF ".deps/file.Tpo" -c -o file.o file.c; \ then mv -f ".deps/file.Tpo" ".deps/file.Po"; else rm -f ".deps/file.Tpo"; exit 1; fi *In file included from /usr/include/sys/signal.h:34,* from /usr/include/signal.h:26, from common.h:250, from file.c:38: /usr/include/sys/siginfo.h:259: error: parse error before "ctid_t" /usr/include/sys/siginfo.h:292: error: parse error before '}' token /usr/include/sys/siginfo.h:294: error: parse error before '}' token /usr/include/sys/siginfo.h:390: error: parse error before "ctid_t" /usr/include/sys/siginfo.h:392: error: conflicting types for `__proc' /usr/include/sys/siginfo.h:261: error: previous declaration of `__proc' /usr/include/sys/siginfo.h:398: error: conflicting types for `__fault' /usr/include/sys/siginfo.h:267: error: previous declaration of `__fault' /usr/include/sys/siginfo.h:404: error: conflicting types for `__file' /usr/include/sys/siginfo.h:273: error: previous declaration of `__file' /usr/include/sys/siginfo.h:420: error: conflicting types for `__prof' /usr/include/sys/siginfo.h:287: error: previous declaration of `__prof' /usr/include/sys/siginfo.h:424: error: conflicting types for `__rctl' /usr/include/sys/siginfo.h:291: error: previous declaration of `__rctl' /usr/include/sys/siginfo.h:426: error: parse error before '}' token /usr/include/sys/siginfo.h:428: error: parse error before '}' token /usr/include/sys/siginfo.h:432: error: parse error before "k_siginfo_t" /usr/include/sys/siginfo.h:437: error: parse error before '}' token In file included from /usr/include/signal.h:26, from common.h:250, from file.c:38: /usr/include/sys/signal.h:85: error: parse error before "siginfo_t" In file included from common.h:250, from file.c:38: /usr/include/signal.h:111: error: parse error before "siginfo_t" /usr/include/signal.h:113: error: parse error before "siginfo_t" In file included from common.h:251, from file.c:38: /usr/include/sys/wait.h:86: error: parse error before "siginfo_t" make[1]: *** [file.o] Error 1 make[1]: Leaving directory `/root/syslogNG/stunnel-4.26/src' make: *** [all-recursive] Error 1 Is that normal that i've 2 signal.h files ?

1 0

Re: [stunnel-users] ftp to sftp
by Michael Renner 18 Jan '09

18 Jan '09

On Friday 16 January 2009, aaa aaa wrote: > Hello, Moin, > I am using last edition of stunnel. I would like to use my favourite ftp > client and connect to sftp. But my ftp clinet don't allow this so I would > like to use stunnel if possible. How should I configure stunnel to do this > (ports etc.)? I am a newbie with stunnel but I am using it for sending > email for several weeks and everything works well. So I hope it is possible > to use it for sftp too. there are 2 'save' ftp enhancement: sftp and ftps. While 'sftp' means 'ftp over ssh' stand 'ftps' for 'ftp over ssl'. So stunnel is the wrong tool if you have to use ftps. Please check http://www.stunnel.org/examples/ftp.html for more information about stunnel and ftp. CU -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

2 2

Re: [stunnel-users] ftp to sftp
by Justin Greene 16 Jan '09

16 Jan '09

I do not think that this can work. SFTP is not just encrypted FTP traffic, but an entirely different protocol. Justin ________________________________ From: aaa aaa [mailto:miamia@inMail.sk] Sent: Friday, January 16, 2009 7:58 AM To: stunnel-users(a)mirt.net Subject: ftp to sftp Hello, I am using last edition of stunnel. I would like to use my favourite ftp client and connect to sftp. But my ftp clinet don't allow this so I would like to use stunnel if possible. How should I configure stunnel to do this (ports etc.)? I am a newbie with stunnel but I am using it for sending email for several weeks and everything works well. So I hope it is possible to use it for sftp too. Any help much appreciated. thanks in advance. ----------

1 0

0x09 bytes in stunnel-4.26/src/Makefile.am
by Andrew Schulman 14 Jan '09

14 Jan '09

For some strange reason, there are five hex 09 bytes in stunnel-4.26/src/Makefile.am. This broke my Cygwin build: I remove the Windows-only stuff from this file for Cygwin, and diff captured the 0x09 characters that got removed, but then when I later tried to apply the patch, patch choked on them. It seems that each of these bytes should really be 0x0A. Strange. Andrew.

2 2

Re: [stunnel-users] How do I do a one-time client connection?
by D. Richard Hipp 13 Jan '09

13 Jan '09

On Jan 13, 2009, at 11:07 AM, Karl J. Runge wrote: > On Tue, 13 Jan 2009, "D. Richard Hipp" <drh(a)hwaci.com> wrote: >> >> I'm sure I could get something like that to work on Unix. >> Unfortunately, I need a cross-platform solution:; unix & windows. >> And >> (as usual) the windows side is harder to work around. >> >> What I really need to do is send a known amount of binary data in a >> file over an SSL connection to a remote machine, then get back the >> reply of unknown length into a separate file: >> >> stunnel test.conf <test.in >test.out >> >> I'm open to any suggestions on how to do this, (such that it will >> work >> on unix and windows). > > So it is not an https URL like in your example? If it were, perhaps > wget or curl for windows would be a better path than stunnel. I'm using a simple web-page fetch for debugging. In actual use, the situation is more complicated and wget and curl won't work. Thx for the suggestion, though. > > > socat might be ported to windows, I'm not sure. If writing a small C > wrapper program for Windows is not acceptable, I'm not sure what you > can do. socat appears to be linux-mostly. (They have a MacOS-X port, which suggests that it is not even "unix" neutral.) So I'm guessing that windows is out of the question there. Looks like I'm just going to have to bite the bullet and link against OpenSSL directly..... > > > > BTW, I have made a one-time connection patch to stunnel that I use > with > my VNC tool SSVNC: > > http://libvncserver.cvs.sourceforge.net/viewvc/libvncserver/libvncserver/x1… > > It is a hack, but useful. My VNC tool works OK with stock stunnel > (everything else equal I prefer using), but I also distribute a > patched > stunnel for more reliable behavior in this one-time client connect > mode. > > Karl > D. Richard Hipp drh(a)hwaci.com

2 1

Re: [stunnel-users] How do I do a one-time client connection?
by stunnel-hm＠karlrunge.com 13 Jan '09

13 Jan '09

On Tue, 13 Jan 2009, "D. Richard Hipp" <drh(a)hwaci.com> wrote: > > Apparently stunnel will work as a pipe if I create a config file like > this: > > client=yes > connect=remosthost:port > > Then run stunnel and talk over standard input and standard output. One problem I have found in doing this is that if socketpair(2) is used to create the file descriptor that will be connected to stunnel's stdio, then stunnel's libwrap checking is activated because it detects it to be a socket. Using socketpair is a nice way to turn a TCP client into one that connects via a two-way pipe with stunnel (because the client app doesn't have to special case the two file descriptors for stunnel's stdin and stdout when reading and writing.) Since a user (i.e. not a sysadmin) has no control over the libwrap settings in /etc, stunnel's libwrap check will always fail when used this way. In my opinion, stunnel should allow disabling of libwrap (and syslog too) via the config file (i.e. not just compile time options). This makes the "one connection" client usage you describe work better. Karl

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users