stunnel-users

stunnel-users@stunnel.org

5 participants
3293 discussions

Re: new Cygwin maintainer for stunnel
by Michal Trojnara 20 Feb '07

20 Feb '07

On Tuesday 20 February 2007 20:59, Andrew Schulman wrote: > Please add Cygwin to the list of "known good" OSes at > http://stunnel.mirt.net/, and add me to the list of maintainers in the > PORTS file. Done. Thank you. Mike

1 0

help
by RICH 16 Feb '07

16 Feb '07

Hi to all i need help i have install stunnel rpm in mandriva but can not find the config file

1 0

stunnel on Qnx 6.3
by Rajashekhar Durgadmath 15 Feb '07

15 Feb '07

Hello All, I am facing problems running stunnel for Qnx 6.3 cross compiled on solaris. I want to provide a https front end to thtttpd (www.acme.com). stunnel starts but fails. Logs are like this: 1980.01.01 15:01:46 LOG5[1069085:1]: stunnel 4.20 on sparc-sun-solaris2.9 with OpenSSL 0.9.8 05 Jul 2005 1980.01.01 15:01:46 LOG5[1069085:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 1980.01.01 15:01:46 LOG6[1069085:1]: file ulimit = 1000 (can be changed with 'ulimit -n') 1980.01.01 15:01:46 LOG6[1069085:1]: poll() used - no FD_SETSIZE limit for file descriptors 1980.01.01 15:01:46 LOG5[1069085:1]: 488 clients allowed 1980.01.01 15:01:46 LOG7[1069085:1]: FD 4 in non-blocking mode 1980.01.01 15:01:46 LOG7[1069085:1]: FD 5 in non-blocking mode 1980.01.01 15:01:46 LOG7[1069085:1]: FD 6 in non-blocking mode 1980.01.01 15:01:46 LOG7[1069085:1]: SO_REUSEADDR option set on accept socket 1980.01.01 15:01:46 LOG7[1069085:1]: stunnel bound to xxx.xx.xxx.xxx:443 1980.01.01 15:01:46 LOG7[1073200:1]: Created pid file /stunnel.pid <Browser connects> 1980.01.01 15:05:12 LOG7[1073200:1]: stunnel accepted FD=7 from yyy.yy.yyy.yyy:64822 1980.01.01 15:05:12 LOG7[1073200:2]: stunnel started 1980.01.01 15:05:12 LOG7[1073200:2]: FD 7 in non-blocking mode 1980.01.01 15:05:12 LOG7[1073200:2]: TCP_NODELAY option set on local socket 1980.01.01 15:05:12 LOG5[1073200:2]: stunnel accepted connection from qqq.qqq.qqq.qqq:64822 1980.01.01 15:05:12 LOG5[1073200:2]: Server mode 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): before/accept initialization 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 read client hello A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 write server hello A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 write certificate A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 write server done A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 flush data 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 read client key exchange A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 read finished A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 write change cipher spec A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 write finished A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 flush data 1980.01.01 15:05:13 LOG7[1073200:2]: 1 items in the session cache 1980.01.01 15:05:13 LOG7[1073200:2]: 0 client connects (SSL_connect()) 1980.01.01 15:05:13 LOG7[1073200:2]: 0 client connects that finished 1980.01.01 15:05:13 LOG7[1073200:2]: 0 client renegotiations requested 1980.01.01 15:05:13 LOG7[1073200:2]: 1 server connects (SSL_accept()) 1980.01.01 15:05:13 LOG7[1073200:2]: 1 server connects that finished 1980.01.01 15:05:13 LOG7[1073200:2]: 0 server renegotiations requested 1980.01.01 15:05:13 LOG7[1073200:2]: 0 session cache hits 1980.01.01 15:05:13 LOG7[1073200:2]: 1 session cache misses 1980.01.01 15:05:13 LOG7[1073200:2]: 0 session cache timeouts 1980.01.01 15:05:13 LOG6[1073200:2]: SSL accepted: new session negotiated 1980.01.01 15:05:13 LOG6[1073200:2]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 < SSL Negotiation done > 1980.01.01 15:08:49 LOG3[1073200:2]: remote socket: Address family not supported by protocol family (247) <<<<<< 1980.01.01 15:08:49 LOG5[1073200:2]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 1980.01.01 15:08:49 LOG7[1073200:2]: stunnel finished (0 left) I checked the address family; it is AF_INET :) socket syscall in client.c:989 is failing. I know the error "Address family not supported by protocol family (247)" says it all, but there are other applications running on the box which do the same thing and it works for them. Versions: OpenSSL 0.9.8 and stunnel 4.20. stunnel.conf ## stunnel.conf starts cert = /etc/localhost_cert.pem key = /etc/localhost_key.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /some_dir setuid = root setgid = root ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /some_dir/stunnel.log [https] accept = <Qnx box IP>:443 connect = <Qnx box IP>:80 ## stunnel.conf end # uname -a QNX localhost 6.3.0 2006/04/27-13:08:16EST armbe It was configured thus: ./configure --prefix=/vob/nmi/3rd_party/stunnel --enable-dependency-tracking --with-ssl=/vob/nmi/3rd_party/openssl/ --build=armbe-qnx --host=sparc-sun-solaris2.9 --with-threads=pthread --disable-libwrap Removing the --disable-libwrap does not help. stunnel is started like this: stunnel /etc/stunnel.conf -d http -r localhost:http -p /etc This also did not help: stunnel /etc/stunnel.conf -d https -r localhost:http -p /etc stunnel /etc/stunnel.conf # stunnel -version stunnel 4.20 on sparc-sun-solaris2.9 with OpenSSL 0.9.8 05 Jul 2005 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /some_path/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /some_path/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /some_path/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Please reply, All comments appreciated. Cheers, Raj --------------------------------- New Yahoo! Mail is the ultimate force in competitive emailing. Find out more at the Yahoo! Mail Championships. Plus: play games and win prizes.

1 0

slow transfer of smtp
by jason kawaja 15 Feb '07

15 Feb '07

greetings. clients connects normally when not using ssl (stunnel). when using ssl the connection on the client end appears to take about a minute but does eventually work (mail is sent through encrypted). shown below is the log with debug=7 and a space between the area where a "pause" seems to be, ideas on what could be occurring during this time to induce the "pause"? client = machine making connection. server = machine running stunnel accepting the connection. 2007.02.14 12:24:06 LOG7[69377:134631424]: imaps accepted FD=9 from client:62847 2007.02.14 12:24:06 LOG7[69377:134633984]: imaps started 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 9 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: TCP_NODELAY option set on local socket 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 10 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 11 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: Connection from client: 62847 permitted by libwrap 2007.02.14 12:24:06 LOG5[69377:134633984]: imaps connected from client:62847 2007.02.14 12:24:06 LOG7[69377:134631424]: Cleaning up the signal pipe 2007.02.14 12:24:06 LOG6[69377:134631424]: Child process 69387 finished with code 0 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): before/ accept initialization 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 read client hello A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write server hello A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write certificate A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write server done A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 read client key exchange A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 read finished A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write change cipher spec A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write finished A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:06 LOG7[69377:134633984]: 1 items in the session cache 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 client connects (SSL_connect()) 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 client connects that finished 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 client renegotiatations requested 2007.02.14 12:24:06 LOG7[69377:134633984]: 1 server connects (SSL_accept()) 2007.02.14 12:24:06 LOG7[69377:134633984]: 1 server connects that finished 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 server renegotiatiations requested 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 session cache hits 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 session cache misses 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 session cache timeouts 2007.02.14 12:24:06 LOG6[69377:134633984]: SSL accepted: new session negotiated 2007.02.14 12:24:06 LOG6[69377:134633984]: Negotiated ciphers: AES128- SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 10 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: imaps connecting server:143 2007.02.14 12:24:06 LOG7[69377:134633984]: connect_wait: waiting 10 seconds 2007.02.14 12:24:06 LOG7[69377:134633984]: connect_wait: connected 2007.02.14 12:24:06 LOG7[69377:134633984]: Remote FD=10 initialized 2007.02.14 12:24:06 LOG7[69377:134633984]: TCP_NODELAY option set on remote socket 2007.02.14 12:24:08 LOG7[69377:134631424]: ssmtp accepted FD=11 from client:62848 2007.02.14 12:24:08 LOG7[69377:134881280]: ssmtp started 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 11 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: TCP_NODELAY option set on local socket 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 12 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 13 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: Connection from client: 62848 permitted by libwrap 2007.02.14 12:24:08 LOG5[69377:134881280]: ssmtp connected from client:62848 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): before/ accept initialization 2007.02.14 12:24:08 LOG7[69377:134631424]: Cleaning up the signal pipe 2007.02.14 12:24:08 LOG6[69377:134631424]: Child process 69391 finished with code 0 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 read client hello A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write server hello A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write certificate A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write server done A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 read client key exchange A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 read finished A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write change cipher spec A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write finished A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:08 LOG7[69377:134881280]: 2 items in the session cache 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 client connects (SSL_connect()) 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 client connects that finished 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 client renegotiatations requested 2007.02.14 12:24:08 LOG7[69377:134881280]: 2 server connects (SSL_accept()) 2007.02.14 12:24:08 LOG7[69377:134881280]: 2 server connects that finished 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 server renegotiatiations requested 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 session cache hits 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 session cache misses 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 session cache timeouts 2007.02.14 12:24:08 LOG6[69377:134881280]: SSL accepted: new session negotiated 2007.02.14 12:24:08 LOG6[69377:134881280]: Negotiated ciphers: AES128- SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 12 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: ssmtp connecting server:25 2007.02.14 12:24:08 LOG7[69377:134881280]: connect_wait: waiting 10 seconds 2007.02.14 12:24:08 LOG7[69377:134881280]: connect_wait: connected 2007.02.14 12:24:08 LOG7[69377:134881280]: Remote FD=12 initialized 2007.02.14 12:24:08 LOG7[69377:134881280]: TCP_NODELAY option set on remote socket 2007.02.14 12:25:06 LOG7[69377:134631424]: imaps accepted FD=13 from client:62850 2007.02.14 12:25:06 LOG7[69377:134882816]: imaps started 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 13 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: TCP_NODELAY option set on local socket 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 14 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 15 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: Connection from client: 62850 permitted by libwrap 2007.02.14 12:25:06 LOG5[69377:134882816]: imaps connected from client:62850 2007.02.14 12:25:06 LOG7[69377:134631424]: Cleaning up the signal pipe 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): before/ accept initialization 2007.02.14 12:25:06 LOG6[69377:134631424]: Child process 69478 finished with code 0 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 read client hello A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 write server hello A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 write change cipher spec A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 write finished A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 flush data 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 read finished A 2007.02.14 12:25:06 LOG7[69377:134882816]: 2 items in the session cache 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 client connects (SSL_connect()) 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 client connects that finished 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 client renegotiatations requested 2007.02.14 12:25:06 LOG7[69377:134882816]: 3 server connects (SSL_accept()) 2007.02.14 12:25:06 LOG7[69377:134882816]: 3 server connects that finished 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 server renegotiatiations requested 2007.02.14 12:25:06 LOG7[69377:134882816]: 1 session cache hits 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 session cache misses 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 session cache timeouts 2007.02.14 12:25:06 LOG6[69377:134882816]: SSL accepted: previous session reused 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 14 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: imaps connecting server:143 2007.02.14 12:25:06 LOG7[69377:134882816]: connect_wait: waiting 10 seconds 2007.02.14 12:25:06 LOG7[69377:134882816]: connect_wait: connected 2007.02.14 12:25:06 LOG7[69377:134882816]: Remote FD=14 initialized 2007.02.14 12:25:06 LOG7[69377:134882816]: TCP_NODELAY option set on remote socket -- Jason Kawaja, 2-4568 IT Expert, UF Dept of ECE

1 1

configure/compile issue on AIX&In-Reply-To=
by Trevor Maistry 09 Feb '07

09 Feb '07

Hi, Does anyone have a version of Stunnel which runs on AIX 5.3? Also, what is the idle timeout set to and how do I change it? Many thanks. Regards, Trevor Maistry Principal Systems Consultant ============================================= Information and Communication Technology Division University of KwaZulu-Natal King George v Avenue, Durban, 4041 Tel : +2731-2602475 Fax: +2731-2602125 Cell: +2782-787-5583 Email : maistryt(a)ukzn.ac.za =============================================: Please find our Email Disclaimer here: http://www.ukzn.ac.za/disclaimer/

1 0

"The most recent stable Stunnel version?"
by Roger Fulton 04 Feb '07

04 Feb '07

Hi, I've checked the support pages. I've browsed the mailing list archives. I've perused the ChangeLog file. I can't find an answer to this question: At http://www.stunnel.org/download/binaries.html is stated "The most recent stable Stunnel version is flagged with a red asterisk (*)." I've used two different browsers, and I'll be danged if I see *any* version marked with *any* asterisk, red or otherwise. Would someone kindly direct this Stunnel newbie to the "most recent stable Stunnel version?" TIA.

2 1

Oracle JDBC Failover not working
by Dario Mariani 02 Feb '07

02 Feb '07

Hi all. We have a problem here with this configuration. before stunnel: BEA Weblogic, 2 JDBC, server1:1521 and server2:1521 Two SunCluster nodes with Oracle OPS/RAC (active-active conf), with NO shared address. So "server1" and "server2" are the phisical address. after stunnel: the JDBC config is 127.0.0.1:10001 and 127.0.0.1:10002 stunnel client is 10001->server1:11521 and 10002->server2:11521 stunnel server is 11521->localhost:1521 When we shut down the server1 (so oracle, listener and stunnel server is not responding), BEA cannot failover. A quick analisys shows that: 1. the JDBC connects to stunnel client, that accept the connection 2. stunnel client fails to connect to stunnel server 3. stunnel client close the connection with the JDBC 4. the JDBC cannot deal with the situation and doesn't failover. It seems like JDBC doesn't failover when he can open a connection but oracle doesn't reply. What i need is: is possible for Stunnel client to FIRST try to connect to the server, and then eventually accept the connection from the jdbc? Bye, dario.

2 1

Intermediate Cert validation problem
by Eric McCombs 31 Jan '07

31 Jan '07

I'm experiencing a problem validating intermediate cert on our Stunnel configuration. We are using Stunnel to forward IMAP, POP and SMTP SSL ports from our vpn server to our internal mail server. We originally used a self-signed cert on the vpn server. When clients connect via Outlook, Outlook Express, Thunderbird and various cell phone mail programs they received a warning message (Unable to verify identity of xxx) about the self-signed cert. To resolve this issue we purchased a SSL cert from Verisign to install on the vpn server. We generated the key and CSR and received the new cert from Verisign, which also requires an intermediate cert for verification. We have tried various methods to have the certs validated, combining the key, intermediate cert and server cert in one file, pointing to the CA_file, etc. but continue to see the Unable to verify identity message. Has anybody else encountered this problem and found a way to resolve the problem? Thanks in advance. Eric McCombs

1 1

(no subject)
by Hemesath, Dean CTR USTRANSCOM J6 25 Jan '07

25 Jan '07

To all, Can Stunnel communicate bi-directionally over a single port? Or does it listen on one and communicate on a different one? Thanks Dean

1 0

dude using stunnel
by aza zel 24 Jan '07

24 Jan '07

hi, is my first message in this list and i send to all of members a great greeting i want to now if this stage is posible (i look the example in your web site that inspired me) NET +---------+ | | +--------+ | non-SSL | -ST---- | | --- | LDAP | | enabled | | | | WITH | | client | | | | SSL | +---------+ | | +--------+ winXP CLIENT | | LDAP SERVER | | +---------+ | | | | ------- | | | | | | | client | +---------+ linux CLIENT In client side i have: - linux clients autenticate via pam and using tls (here i not have problems) :) - win xp (sp2) clients auntenticate via pgina without ssl or tls (i cant make work ssl in pgina (its posible the problem was the server certificate)) :( in server side i have a solaris when run a sun ldap server using a self signed certificate and accepting ssl/tls or not ssl/tls connections :) so, ¿with stunnel only in win side can i have this stage using the self signed cetificate provided by server? Salu2 :D

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users