stunnel-users

stunnel-users@stunnel.org

5 participants
3293 discussions

Re: [stunnel-users] Problem with mysql
by lmarcilly＠aressi.fr 20 Jul '05

20 Jul '05

I try to analyse traffic with tcpdump and when i use stunnel, there is no packets with my linux box ip so i think stunnel doesn't work properly... Here is the stunnel.log : 2005.07.20 12:58:23 LOG5[14714:1]: stunnel 4.11 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.07.20 12:58:23 LOG7[14714:1]: Snagged 64 random bytes from /root/.rnd 2005.07.20 12:58:23 LOG7[14714:1]: Wrote 1024 new random bytes to /root/.rnd 2005.07.20 12:58:23 LOG7[14714:1]: RAND_status claims sufficient entropy for the PRNG 2005.07.20 12:58:23 LOG6[14714:1]: PRNG seeded successfully 2005.07.20 12:58:23 LOG7[14714:1]: Certificate: /usr/etc/stunnel/stunnel.pem 2005.07.20 12:58:23 LOG7[14714:1]: Key file: /usr/etc/stunnel/stunnel.pem 2005.07.20 12:58:23 LOG6[14714:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.07.20 12:58:23 LOG6[14714:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.07.20 12:58:23 LOG5[14714:1]: 500 clients allowed 2005.07.20 12:58:23 LOG7[14714:1]: FD 4 in non-blocking mode 2005.07.20 12:58:23 LOG7[14714:1]: FD 5 in non-blocking mode 2005.07.20 12:58:23 LOG7[14714:1]: FD 6 in non-blocking mode 2005.07.20 12:58:23 LOG7[14714:1]: SO_REUSEADDR option set on accept socket 2005.07.20 12:58:23 LOG7[14714:1]: mysql bound to 0.0.0.0:3306 2005.07.20 12:58:23 LOG7[14715:1]: Created pid file /stunnel.pid 2005.07.20 14:07:13 LOG5[14715:0]: Received signal 15; terminating 2005.07.20 14:07:13 LOG7[14715:0]: removing pid file /stunnel.pid When i look at stunnel.pid, there is 231 in the file and it is the stunnel pid... In my stunnel.conf, i have put client=yes and [mysql] accept = 3306 connect = 192.198.10.120:3307 and on my stunnel server : [mysql] accept = 3307 connect = localhost:3306 It works with my mysql client on windows (v4.1.12a) but not with my mysql client on linux (v4.1.8a). Perhaps the difference of version is the problem but i think not... Which options are applied when windows binaries of stunnel are compiled? Perhaps i have to change option when i compile on my linux box... Thanks in advance! lm. -------- Original Message -------- Subject: [stunnel-users] Problem with mysql (20-juil.-2005 11:41) From: lmarcilly(a)aressi.fr To: lmarcilly(a)aressi.fr > Hi all, > > i try to encrypt mysql connections... > > I saw this : http://www.stunnel.org/examples/mysql.html > > but i use stunnel4.x. > > I configure it on my windows box and it work well! (mysql server is on a > linux box, i have configure stunnel as a server on this box) > > when i try mysql -u user --password=xyz it works > > but i have to made it work on a linux box. > I use the same config file for stunnel, but when i try > > mysql -u user --password=xyz i have : > Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld. > sock' > > This socket doesn't exist since there is no MySQL server on the box. > > I try with --protocol=TCP but it won't work, i have : > > Can't connect to MySQL server on 'localhost' > > Do you have an idea? Do you want more details on my config file for stunnel? > > > Thanks in advance and sorry for my english! > > lm > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users To: lmarcilly(a)aressi.fr stunnel-users(a)mirt.net

2 1

Re-2: [stunnel-users] Problem with mysql
by lmarcilly＠aressi.fr 20 Jul '05

20 Jul '05

I have just remember that tcp_wrapper is not installed on my box... When compiling stunnel, i use : ./configure --prefix=/usr --disable-libwrap make make install I think libwrap is not necessary but perhaps i am wrong... Tcp wrapper is used in order to filter traffic? Could you explain me? Thanks a lot! -------- Original Message -------- Subject: Re: [stunnel-users] Problem with mysql (20-juil.-2005 14:47) From: lmarcilly(a)aressi.fr To: lmarcilly(a)aressi.fr > I try to analyse traffic with tcpdump and when i use stunnel, there is no > packets with my linux box ip so i think stunnel doesn't work properly... > Here is the stunnel.log : > > 2005.07.20 12:58:23 LOG5[14714:1]: stunnel 4.11 on i686-pc-linux-gnu > UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 > 2005.07.20 12:58:23 LOG7[14714:1]: Snagged 64 random bytes from /root/.rnd > 2005.07.20 12:58:23 LOG7[14714:1]: Wrote 1024 new random bytes to /root/. > rnd > 2005.07.20 12:58:23 LOG7[14714:1]: RAND_status claims sufficient entropy > for the PRNG > 2005.07.20 12:58:23 LOG6[14714:1]: PRNG seeded successfully > 2005.07.20 12:58:23 LOG7[14714:1]: Certificate: /usr/etc/stunnel/stunnel. > pem > 2005.07.20 12:58:23 LOG7[14714:1]: Key file: /usr/etc/stunnel/stunnel.pem > 2005.07.20 12:58:23 LOG6[14714:1]: file ulimit = 1024 (can be changed with ' > ulimit -n') > 2005.07.20 12:58:23 LOG6[14714:1]: poll() used - no FD_SETSIZE limit for > file descriptors > 2005.07.20 12:58:23 LOG5[14714:1]: 500 clients allowed > 2005.07.20 12:58:23 LOG7[14714:1]: FD 4 in non-blocking mode > 2005.07.20 12:58:23 LOG7[14714:1]: FD 5 in non-blocking mode > 2005.07.20 12:58:23 LOG7[14714:1]: FD 6 in non-blocking mode > 2005.07.20 12:58:23 LOG7[14714:1]: SO_REUSEADDR option set on accept socket > 2005.07.20 12:58:23 LOG7[14714:1]: mysql bound to 0.0.0.0:3306 > 2005.07.20 12:58:23 LOG7[14715:1]: Created pid file /stunnel.pid > 2005.07.20 14:07:13 LOG5[14715:0]: Received signal 15; terminating > 2005.07.20 14:07:13 LOG7[14715:0]: removing pid file /stunnel.pid > > When i look at stunnel.pid, there is 231 in the file and it is the stunnel > pid... > > In my stunnel.conf, i have put client=yes and > > [mysql] > accept = 3306 > connect = 192.198.10.120:3307 > > and on my stunnel server : > > [mysql] > accept = 3307 > connect = localhost:3306 > > It works with my mysql client on windows (v4.1.12a) but not with my mysql > client on linux (v4.1.8a). Perhaps the difference of version is the problem > but i think not... > > Which options are applied when windows binaries of stunnel are compiled? > Perhaps i have to change option when i compile on my linux box... > > Thanks in advance! > > lm. > > -------- Original Message -------- > Subject: [stunnel-users] Problem with mysql (20-juil.-2005 11:41) > From: lmarcilly(a)aressi.fr > To: lmarcilly(a)aressi.fr > > > Hi all, > > > > i try to encrypt mysql connections... > > > > I saw this : http://www.stunnel.org/examples/mysql.html > > > > but i use stunnel4.x. > > > > I configure it on my windows box and it work well! (mysql server is on a > > linux box, i have configure stunnel as a server on this box) > > > > when i try mysql -u user --password=xyz it works > > > > but i have to made it work on a linux box. > > I use the same config file for stunnel, but when i try > > > > mysql -u user --password=xyz i have : > > Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld. > > sock' > > > > This socket doesn't exist since there is no MySQL server on the box. > > > > I try with --protocol=TCP but it won't work, i have : > > > > Can't connect to MySQL server on 'localhost' > > > > Do you have an idea? Do you want more details on my config file for stunnel? > > > > > > > > Thanks in advance and sorry for my english! > > > > lm > > > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > To: lmarcilly(a)aressi.fr > stunnel-users(a)mirt.net To: lmarcilly(a)aressi.fr stunnel-users(a)mirt.net

1 0

Problem with mysql
by lmarcilly＠aressi.fr 20 Jul '05

20 Jul '05

Hi all, i try to encrypt mysql connections... I saw this : http://www.stunnel.org/examples/mysql.html but i use stunnel4.x. I configure it on my windows box and it work well! (mysql server is on a linux box, i have configure stunnel as a server on this box) when i try mysql -u user --password=xyz it works but i have to made it work on a linux box. I use the same config file for stunnel, but when i try mysql -u user --password=xyz i have : Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' This socket doesn't exist since there is no MySQL server on the box. I try with --protocol=TCP but it won't work, i have : Can't connect to MySQL server on 'localhost' Do you have an idea? Do you want more details on my config file for stunnel? Thanks in advance and sorry for my english! lm

1 0

SSL Session Cache and HTTPS performance
by Daniel Hamburg 19 Jul '05

19 Jul '05

Hello everybody, I hope I didn't muss an existing thread about this question, but I wasn't able to find one. At least none where I found an answer, although my question is quite simple. I would like to test the performance difference between enabled and disabled SSLCaching. I use a configuration file for Stunnel 4.11 (daemon mode) where I tell it to accept incoming connections on port 444 and direct them to a local web-server on port 80. Because STunnel uses Caching by default, I tried to tell STunnel to disable SSL Caching by setting session = 0 in the configuration file, which resulted in an error when starting the program. I looked at the code and found that there is a check so that the session parameter can not be equal to 0. I disabled the check and started stunnel again which seemed to work. But taking a look at the packets exchanged via a browser and the server resulted in the conclusion that caching is still enabled. My simple question is, how I can disable the Caching. Another question is if anyone of you has made any performance tests regarding STunnel in combination with an Apache HTTP server on the same machine. I'm specially interested in modes to get this combination run faster. And now please do not tell me to use mod_ssl. :) Thanks in advance. Daniel -- ====================================================================== Dipl.-Ing. Daniel Hamburg Tel.: 0234/32-28034 Ruhr-Universität Bochum Fax.: 0234/32-08034 Arbeitsgruppe Integrierte Informationssysteme IC 4/47 Universitätsstraße 150 Web: www.iis.ruhr-uni-bochum.de D-44780 Bochum eMail: daniel.hamburg(a)iis.rub.de ======================================================================

3 5

smtps problem on Fedora Core 4
by Anders Gjerløv 19 Jul '05

19 Jul '05

Hi, I am trying to get the smtps solution described on http://www.linuxquestions.org/questions/answers.php?action=viewarticle&arti… working on my server. Basically I want my users on Windows XP boxes to get their mail from 127.0.0.1:100 and send their mail to 127.0.0.1:25 I have gotten as far as having the users able to get mails. That is I have stunnel on a windows box, with a configuration file like this: client = yes debug = debug cert = pemfile.pem [pop3s] accept = localhost:110 connect = my.domain.com:995 [smtps] accept = localhost:25 connect = my.domain.com:465 And a telnet to port 110 on the lookback interface gives me access to the pop server. Så I am guessing that the certificates etc. are working correctly. As for the smtps I am using xinetd, and have tried with various configurations. Here is one of the one's that didn't work: service smtps { disable = no socket_type = stream wait = no user = root server = /usr/sbin/stunnel server_args = -v3 -rlocalhost:25 log_on_success += HOST DURATION log_on_failure += HOST ATTEMPT } Any ideas as to how to setup my xinetd file (or is there a better solution?) # stunnel -version stunnel 4.08 on i386-redhat-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7f 22 Mar 2005 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Kind regards, Anders

2 1

Re: [stunnel-users] HTTPS Proxy support?
by Sean Covel 17 Jul '05

17 Jul '05

Yeah, good for you. Don't we all. I'll just go shove off then. Sean Michal Trojnara wrote: > Sean, > >> $25. > > > It's not enough to allocate my time. 8-) > I usually work for $75/hour. > > Anyway I'm going to support this feature some day. > > Best regards, > Mike > > Sean Covel wrote: > Mike, > > $25. > > I have a paypal link on my development site. Rarely see a payment, but > I have seen some. Doesn't cost anything to have the link or the paypal > account. > > Sean > > Michal Trojnara wrote: > >>Sean, >> >> >>>Do you have a PayPal link somewhere? >> >> >>So far I didn't use PayPal. >>How much money would you like to spend to sponsor stunnel development? >> >>Best regards, >> Mike >> > >

1 0

Stunnel on openwrt
by Markus Mauch 15 Jul '05

15 Jul '05

Hello, I'm using stunnel on a asus router with a openwrt like linux on it. The Idea is to secure traffic from and to a thttpd web server which is running on that box as well. Problem is that stunnel only seems to be able to handle one connection at a time. Whenever it has to cope with more than one it crashes. Unfortunatelly this happens all the time because usually a web browser opens several tcp connections in order to speed things up. So whenever I browse to a web page on the router through stunnel I get only the text. The rest (e.g. the images) which is loaded via different tcp connections does not appear and stunnel won't respond to any further requests until it is restarted. My explanation to this is that the very first request is processed normally but as soon as one other connection causes stunnel to create a second process the whole thing goes to the dogs. ps reveals that there are always two instances of stunnel running after such an experiment, both hanging, of course. So my question is what could I do to keep stunnel from creating new processes when a client tries to communicate over more than one tcp connection or - better - what chould I do in the first place to prevent stunnel from hanging in such a case? Any help would be very apreciated...

1 0

Re: [stunnel-users] HTTPS Proxy support?
by seanecovel＠comcast.net 15 Jul '05

15 Jul '05

Mike, GREAT! I did see a patch out on the web that seems to add this feature. Any chance that patch will be included in MAIN? I don't want to have to patch stunnel on multiple OS especially when you are going to implement the feature yourself. What can I do to "encourage" you to add that support sooner than later? Sean -------------- Original message -------------- > "Sean E. Covel" wrote: > > Does stunnel support HTTPS Proxies with authentication? > > Currently not. > > > Could it? > > Yes, CONNECT protocol support (RFC 2817 section 5.2) is on my TODO list: > http://stunnel.mirt.net/todo_sdf.html > > Best regards, > Mike > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

3 2

HTTPS Proxy support?
by Sean E. Covel 14 Jul '05

14 Jul '05

I am trying to use stunnel to tunnel VNC through a firewall using port 443. When I test on 2 machines on the LAN everything works fine. Nice tool! When I try to connect through the firewall I suspect the HTTPS Proxy is getting in the way. It requires authentication. Does stunnel support HTTPS Proxies with authentication? Could it? Thanks, Sean

2 1

Q: controlled access to service?
by Nardmann, Heiko 14 Jul '05

14 Jul '05

Hi, I want to control access to a through stunnel reachable service. Only those clients shall be allowed to use the service which provide a known certificate. I have found the option "CApath"; can this directory be used to collect all client certificates? Or is it absolutely necessary to have CA certs there? Another thing in this environment: I do not know or own every CA certificate used by the clients - I only get the client certificates itself. So I want to do only a one-level client cert verification. Which verify level do I need for this? 2 or 3? What about removing certificates from the CApath directory? Do I have to restart stunnel to make this change be effective? Another thing: since the client certificates are not revoked by us I am not able to use CRLs for controlling access to our service. -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de), Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users