- stunnel-users - stunnel.org

stunnel 4.21 released
by Michal Trojnara 27 Oct '07

27 Oct '07

Dear Users, The new version is available for download on: ftp://stunnel.mirt.net/stunnel/ Version 4.21, 2007.10.27, urgency: LOW/EXPERIMENTAL: * New features sponsored by Open-Source Software Institute - Initial FIPS 140-2 support (see INSTALL.FIPS for details). Win32 platform is not currently supported. * New features - Experimental fast support for non-MT-safe libwrap is provided with pre-spawned processes. - Stunnel binary moved from /usr/local/sbin to /usr/local/bin in order to meet FHS and LSB requirements. Please delete the /usr/local/sbin/stunnel when upgrading. - Added code to disallow compiling stunnel with pthreads when OpenSSL is compiled without threads support. - Win32 DLLs for OpenSSL 0.9.8g. - Minor manual update. - TODO file updated. * Bugfixes - Dynamic locking callbacks added (needed by some engines to work). - AC_ARG_ENABLE fixed in configure.am to accept yes/no arguments. - On some systems libwrap requires yp_get_default_domain from libnsl, additional checking was added. - Sending a list of trusted CAs for the client to choose the right certificate restored. - Some compatibility issues with NTLM authentication fixed. - Taskbar icon (unless there is a config file parsing error) and "Save As" disabled in the service mode for local Win32 security (it's much like Yeti -- some people claim they have seen it). sha1 hash for stunnel-4.21.tar.gz file: 7785c45167d902aa728b839adee02a8cc056d86a Best regards, Mike

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 39, Issue 16
by Frank Garber 24 Oct '07

24 Oct '07

I tested with my firewall with both PCs at home. I can make it work with the port open and when I close the port it fails. it's only when I try to connect from behind the corporate firewall that it fails. I've tried several other port numbers and always get the same results. Can you send me your entire client and server config files so I can see the settings? Thanks, Frank ----- Original Message ---- From: "stunnel-users-request(a)mirt.net" <stunnel-users-request(a)mirt.net> To: stunnel-users(a)mirt.net Sent: Tuesday, October 23, 2007 6:00:06 AM Subject: stunnel-users Digest, Vol 39, Issue 16 Send stunnel-users mailing list submissions to stunnel-users(a)mirt.net To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)mirt.net You can reach the person managing the list at stunnel-users-owner(a)mirt.net When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. [RE] Using stunnel for RDP / Proxy / Firewall (Algol Tradent) Hello, I think your problem might be related to your configuration firewall/router. Have you enabled port-forwarding for the connection? >From your configuration files I can see you are using port 1494. Check that you are forwarding that port. Also make sure you configure any firewall software running on the machine you want to connect to, in order to allow connections. Best Regards __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

[RE] Using stunnel for RDP / Proxy / Firewall
by Algol Tradent 22 Oct '07

22 Oct '07

Hello, I think your problem might be related to your configuration firewall/router. Have you enabled port-forwarding for the connection? >From your configuration files I can see you are using port 1494. Check that you are forwarding that port. Also make sure you configure any firewall software running on the machine you want to connect to, in order to allow connections. Best Regards __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Using stunnel for RDP / Proxy / Firewall
by garberfc 20 Oct '07

20 Oct '07

Hi All I'm a relative newbie to Stunnel, and am trying to set up a tunnel so I can Remote Desktop from work to my PC/server at home. I'm using versions 4.20 of the Windows binaries. I've tested the configuration and it works from home using a laptop that is going through my firewall when I enter my domain home (so my firewall is set up correctly). I tried a variety of common ports and got the same response every time. I had to use the 127.0.0.2 on the client because Remote Desktop didn't want me connecting to myself... When I try if from work I get a dialog box: The client could not establish a connection to the remote computer. The most likely causes for this error are: 1) Remote connections might not be enabled at the remote computer. 2)The maximum number of connections was exceeded at the remote computer. 3) A network error occurred while establishing the connection. My config is as follows: #Client ;cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [https-RDT] accept = 127.0.0.2:3389 connect = xx.xx.xx.xx:1494 #Server ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = no ; Service-level configuration [https-RDT] accept = 1494 connect = localhost:3389 Is there something I need to do to traverse this proxy? Any help would be greatly appreciated! -- View this message in context: http://www.nabble.com/Using-stunnel-for-RDP---Proxy---Firewall-tf4654985.ht… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

scaling stunnel
by Ben Hartshorne 19 Oct '07

19 Oct '07

Hi, I am trying to set up syslog + stunnel in a large environment. I am curious about the experience of members of this mailing list regarding how stunnel + syslog-ng scale. I set up a test environment using stunnel 3.26 (because that's what is in my debian installation)[*]. I configured stunnel to run as a daemon (starting on boot), and syslog passes off messages and receives messages from localhost:514. In the stunnel log, it tells me that there is a limit of 500 clients, and it seems that with stunnel 3.x, it must be recompiled to increase this limit. I found some posts on this list that say that while stunnel 3.x uses select(), stunnel 4.x uses poll(), which is much more efficient. So I figure that if I will have to roll my own package, I may as well upgrade to 4.x at the same time. Agree? If so, which version? It's my understanding that this configuration will create a persistent connection between the client and server, holding it open until such time as syslog needs to send a message across it. How many clients have you experienced being able to connect to the log aggregator? My logs are rather sparse, so I expect I will hit a limit based on processor / filehandle / memory usage before I start overloading the local disk. Eventually, I realize that I will have to build a tree structure with intermediate nodes aggregating logs and passing them on to the central host, but I would like to know where people have hit that limit. I would love to have ~5000 clients connected to each aggregating server. Is this within the realm of experience? Does anybody have tuning suggestions for such high numbers of connections? I saw one person mention on the mailing list that compiling without libwrap allowed him to pass ~2500 connections (though he didn't give a new ceiling). Thanks, -ben [*] I was actually impressed at how easy this was. Aside from having to write my own /etc/init.d/ scripts to start the client and server, I could bring down either end of the stunnel connection, and things would just pick up where they left off when the tunnel was reconnected. Add monit into the picture and you've got a nice resilient secure logging system. Slick! -- Ben Hartshorne email: ben(a)hartshorne.net http://ben.hartshorne.net

2 5

SSL Accelerator card and Stunnel
by domstra＠alice.it 16 Oct '07

16 Oct '07

Hi all, We are using STunnel v.3.x and STunnel v.4.x on different systems (Application Servers and DB Servers, on HP and Sun mainframe hardware). We have noticed that the STunnel load is quite heavy for the CPUs of each Server. So, we are beginning to study and analyze a solution that allows we to use STunnel without generate overhead on the CPUs. A good solution could be using a SSL Accelerator card as "SSL engine", in order to offloading the calls to the card CPU. We have also read the following topic in your mailing-list regarding a solutions similar to ours: List: stunnel-users Subject: SSL Accelerator supporto for Stunnel Can you suggest us a list of "SSL Accelerator card" model (and vendor) to install and configure with STunnel? Anyway, do you suggest us to upgrade the STunnel version to the last stable on each Server? Thanks in advance for the support. Awaiting for your kind feedback and suggestions. Best Regards. Dom *********** Scopri la nuova Alice Mail! <http://registra.rossoalice.alice.it/registra/basic/entratabasic.do?entryPoi…> 1 GB di spazio con antivirus, antispam e fino a 2 GB di allegati. <http://registra.rossoalice.alice.it/registra/basic/entratabasic.do?entryPoi…> Registrati GRATIS <http://registra.rossoalice.alice.it/registra/basic/entratabasic.do?entryPoi…>

4 8

stunnel and pan newsreader configuration
by Kernel Panic 13 Oct '07

13 Oct '07

I am attempting to use stunnel to connect securely to a snntp server using pan 0.132. The stunnel install was successful, but when attempting to connect to the server using pan, I either receive a "connection refused" or "connection reset by peer" in the pan error log. Here is the stunnel.log: 2007.10.13 11:16:43 LOG5[5843:3082667712]: stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8e 23 Feb 2007 2007.10.13 11:16:43 LOG5[5843:3082667712]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2007.10.13 11:16:43 LOG6[5843:3082667712]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.10.13 11:16:43 LOG6[5843:3082667712]: poll() used - no FD_SETSIZE limit for file descriptors 2007.10.13 11:16:43 LOG5[5843:3082667712]: 500 clients allowed 2007.10.13 11:16:43 LOG7[5843:3082667712]: FD 4 in non-blocking mode 2007.10.13 11:16:43 LOG7[5843:3082667712]: FD 5 in non-blocking mode 2007.10.13 11:16:43 LOG7[5843:3082667712]: FD 6 in non-blocking mode 2007.10.13 11:16:43 LOG7[5843:3082667712]: SO_REUSEADDR option set on accept socket 2007.10.13 11:16:43 LOG7[5843:3082667712]: NNTP bound to 127.0.0.1:23 2007.10.13 11:16:43 LOG7[5843:3082667712]: Created pid file /home/kpanic/download/stunnel//var/run/stunnel/stunnel.pid 2007.10.13 11:17:00 LOG7[5843:3082667712]: NNTP accepted FD=7 from 127.0.0.1:1085 2007.10.13 11:17:00 LOG7[5843:3085958032]: NNTP started 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 7 in non-blocking mode 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 9 in non-blocking mode 2007.10.13 11:17:00 LOG7[5843:3082667712]: Cleaning up the signal pipe 2007.10.13 11:17:00 LOG6[5843:3082667712]: Child process 5855 finished with code 0 2007.10.13 11:17:00 LOG7[5843:3085958032]: Connection from 127.0.0.1:1085 permitted by libwrap 2007.10.13 11:17:00 LOG5[5843:3085958032]: NNTP accepted connection from 127.0.0.1:1085 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:00 LOG3[5843:3085958032]: bind transparent: Address already in use (98) 2007.10.13 11:17:00 LOG5[5843:3085958032]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.10.13 11:17:00 LOG7[5843:3085958032]: NNTP finished (0 left) 2007.10.13 11:17:00 LOG7[5843:3082667712]: NNTP accepted FD=7 from 127.0.0.1:1086 2007.10.13 11:17:00 LOG7[5843:3085958032]: NNTP started 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 7 in non-blocking mode 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 9 in non-blocking mode 2007.10.13 11:17:00 LOG7[5843:3082667712]: Cleaning up the signal pipe 2007.10.13 11:17:00 LOG7[5843:3085958032]: Connection from 127.0.0.1:1086 permitted by libwrap 2007.10.13 11:17:00 LOG5[5843:3085958032]: NNTP accepted connection from 127.0.0.1:1086 2007.10.13 11:17:00 LOG6[5843:3082667712]: Child process 5857 finished with code 0 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:00 LOG3[5843:3085958032]: bind transparent: Address already in use (98) 2007.10.13 11:17:00 LOG5[5843:3085958032]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.10.13 11:17:00 LOG7[5843:3085958032]: NNTP finished (0 left) 2007.10.13 11:17:05 LOG7[5843:3082667712]: NNTP accepted FD=7 from 127.0.0.1:1087 2007.10.13 11:17:05 LOG7[5843:3085958032]: NNTP started 2007.10.13 11:17:05 LOG7[5843:3085958032]: FD 7 in non-blocking mode 2007.10.13 11:17:05 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:05 LOG7[5843:3085958032]: FD 9 in non-blocking mode 2007.10.13 11:17:05 LOG7[5843:3082667712]: Cleaning up the signal pipe 2007.10.13 11:17:05 LOG7[5843:3085958032]: Connection from 127.0.0.1:1087 permitted by libwrap 2007.10.13 11:17:05 LOG5[5843:3085958032]: NNTP accepted connection from 127.0.0.1:1087 2007.10.13 11:17:05 LOG6[5843:3082667712]: Child process 5860 finished with code 0 2007.10.13 11:17:05 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:05 LOG3[5843:3085958032]: bind transparent: Address already in use (98) 2007.10.13 11:17:05 LOG5[5843:3085958032]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.10.13 11:17:05 LOG7[5843:3085958032]: NNTP finished (0 left) 2007.10.13 11:17:10 LOG7[5843:3082667712]: NNTP accepted FD=7 from 127.0.0.1:1088 2007.10.13 11:17:10 LOG7[5843:3085958032]: NNTP started 2007.10.13 11:17:10 LOG7[5843:3085958032]: FD 7 in non-blocking mode 2007.10.13 11:17:10 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:10 LOG7[5843:3085958032]: FD 9 in non-blocking mode 2007.10.13 11:17:10 LOG7[5843:3082667712]: Cleaning up the signal pipe 2007.10.13 11:17:10 LOG7[5843:3085958032]: Connection from 127.0.0.1:1088 permitted by libwrap 2007.10.13 11:17:10 LOG5[5843:3085958032]: NNTP accepted connection from 127.0.0.1:1088 2007.10.13 11:17:10 LOG6[5843:3082667712]: Child process 5863 finished with code 0 2007.10.13 11:17:10 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:10 LOG3[5843:3085958032]: bind transparent: Address already in use (98) 2007.10.13 11:17:10 LOG5[5843:3085958032]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.10.13 11:17:10 LOG7[5843:3085958032]: NNTP finished (0 left) 2007.10.13 11:17:15 LOG7[5843:3082667712]: NNTP accepted FD=7 from 127.0.0.1:1089 2007.10.13 11:17:15 LOG7[5843:3085958032]: NNTP started 2007.10.13 11:17:15 LOG7[5843:3085958032]: FD 7 in non-blocking mode 2007.10.13 11:17:15 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:15 LOG7[5843:3085958032]: FD 9 in non-blocking mode 2007.10.13 11:17:15 LOG7[5843:3082667712]: Cleaning up the signal pipe 2007.10.13 11:17:15 LOG7[5843:3085958032]: Connection from 127.0.0.1:1089 permitted by libwrap 2007.10.13 11:17:15 LOG5[5843:3085958032]: NNTP accepted connection from 127.0.0.1:1089 2007.10.13 11:17:15 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:15 LOG6[5843:3082667712]: Child process 5866 finished with code 0 2007.10.13 11:17:15 LOG3[5843:3085958032]: bind transparent: Address already in use (98) 2007.10.13 11:17:15 LOG5[5843:3085958032]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.10.13 11:17:15 LOG7[5843:3085958032]: NNTP finished (0 left) Here is the snnt.conf file: # Debug debug = 7 output = /home/kpanic/download/stunnel/stunnel.log # Use it for client mode client = yes foreground = yes [NNTP] protocol = nntp protocolusername = username protocolpassword = password transparent = yes accept = localhost:23 connect = secure.server.com:563 Here is the pan error log: Sat Oct 13 10:46:50 2007 - Error reading from localhost: Connection reset by peer Sat Oct 13 10:46:55 2007 - Error reading from localhost: Connection reset by peer Sat Oct 13 10:47:00 2007 - Error reading from localhost: Connection reset by peer Sat Oct 13 10:47:05 2007 - Error reading from localhost: Connection reset by peer Sat Oct 13 10:47:10 2007 - Error reading from localhost: Connection reset by peer Changing the server setup in pan to look at 127.0.0.1 Sat Oct 13 10:45:40 2007 - Pan 0.132 started Sat Oct 13 10:45:40 2007 - Loaded data backend in 0.0 seconds Sat Oct 13 10:45:47 2007 - Error reading from 127.0.0.1: Connection reset by peer Sat Oct 13 10:45:50 2007 - Error reading from 127.0.0.1: Connection reset by peer Sat Oct 13 10:45:55 2007 - Error reading from 127.0.0.1: Connection reset by peer Sat Oct 13 10:46:00 2007 - Error reading from 127.0.0.1: Connection reset by peer Pan configuration: Address: localhost Port: 23 Username: username Password: password uname -r 2.6.22.9-0.4-bigsmp suse 10.3 Any assistance would be greatly appreciated. Thanks - Tim --------------------------------- Moody friends. Drama queens. Your life? Nope! - their life, your story. Play Sims Stories at Yahoo! Games.

1 0

configuration help
by Tom Allison 12 Oct '07

12 Oct '07

I posted an email a couple days ago and noticed that there isn't any traffic on this mailing list. Is this active/current?

1 0

Stunnel Return Codes - How do I see them in a batch file?
by Robert Lambrecht 10 Oct '07

10 Oct '07

I have Stunnel working successfully in a batch file. I would like to write the error codes in case there is an issue. How do you do this? In Windows, I could do something like: "C:\Program Files\stunnel\stunnel.exe" -start -quiet stunnel.conf goto %errorlevel% :0 :: Normal Return - Complete Batch Process goto :EOF :1 :: Errors - Log them Would this work or how do I get the stunnel return codes? Bob

1 0

Wildcard usage
by Knight Tiger 08 Oct '07

08 Oct '07

Hi, I am new to STUNNEL and I find it very useful for what I am doing right now. I would like to know if STUNNEL does support the functionality I require. I shall describe the situation below. I run a SIP messaging server (SIP is a VoIP protocol used to establish voice calls over the Internet). STUNNEL is running on the same machine as the SIP server. The SIP server listens on a specific port say 8000 so I have in the config file [sip-new] accept = 10000 connect = localhost:8000 and it works beautifully as the client sends the message through a SSL connection to port 10000 on the machine. So far so good. Now I need the server to send a message to the client. SIP server -----> STUNNEL ------> client . Here STUNNEL acts as a SSL client and the client acts as the SSL server. (Both the client and STUNNEL support this functionality), so in the config file I have [sip-client] accept = 11000 connect = ?:8000 How can I code in the client IP address (I know the port number where the client's SSL server is listening on) when I dont know the client IP address before hand ? (The client is typically assigned IP address by a DHCP server) and I will have more than one client which would be acting as a server. The SIP server will know the client's IP address when the client sends a request. (SIP server can determine the IP address from the SIP message and not from the IP header) . So now the message from the SIP server will have the client's IP address but STUNNEL does not have a config for that IP address (since it is dynamic and I need to support many clients) and hence STUNNEL will not create a SSL tunnel to the client. Can I have wildcard for the IP address ? something like [sip-client] accept = 11000 connect = *:8000 and have STUNNEL get the destination IP from the message ? I thank you all in advance, Warm Regards Knight

1 0