Hey all,
I have an instance of stunnel 4.16 on Solaris 10 that I am trying to use to wrap Sun Directory Server LDAP traffic in SSL. LDAP 'binds' take over 2 minutes to complete using stunnel, but only a split second (as they should) when using an SSH tunnel.
I have disabled tcpwrappers per the stunnel FAQ with no results, and tried settting delay = "yes" and "no", with no differences in the results.
An interesting thing is that if I try to bind using the wrong password, the "Invalid Credentials" error returns immediately. Using the correct password, the bind hangs for over 2 minutes.
Any ideas on what to look for?
------------- Output of stunnel -version: stunnel 4.16 on sparc-sun-solaris2.10 with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4
Global options debug = 5 pid = /usr/local/stunnel/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes
Service-level options cert = /usr/local/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/stunnel/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none --------------
Hi Mark,
On Sat, 4 Nov 2006, Mark McCoy wrote:
I have an instance of stunnel 4.16 on Solaris 10 that I am trying to use to wrap Sun Directory Server LDAP traffic in SSL. LDAP 'binds' take over 2 minutes to complete using stunnel, but only a split second (as they should) when using an SSH tunnel.
I have disabled tcpwrappers per the stunnel FAQ with no results, and tried settting delay = "yes" and "no", with no differences in the results.
An interesting thing is that if I try to bind using the wrong password, the "Invalid Credentials" error returns immediately. Using the correct password, the bind hangs for over 2 minutes.
Any ideas on what to look for?
Unfortunately not but, a maybe silly advice towards problems solving: have you captured and analyzed the traffic at the stunnel host's side? Can be quite revealing.