[stunnel-users] Stunnel for pop3 on solaris 2.6 ( Even more info)

[Douglas Phillipson]

If I set "client = no" in stunnels config file I get the following from:


openssl s_client -connect 172.20.12.59:995

CONNECTED(00000003)
depth=0 /C=US/ST=Nevada/L=Las Vegas/O=Bechtel/OU=RSL/CN=test1
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=US/ST=Nevada/L=Las Vegas/O=Bechtel/OU=RSL/CN=test1
verify return:1
30463:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake 
failure:s23_lib.c:226:


Is a "self signed" Cert OK?  I didn't sign anything though.  Compiling 
stunnel created a cert.  Installing openssl I think created a cert.  Do 
these need to match somehow?  If so how do you do that?  I think I'm 
lost here...

Regards

Doug P


Douglas Phillipson wrote:
> I have a Solaris 2.6 box and am trying to get pop3 over SSL running.  I 
> use:
> 
> qpopper 4.0.5
> openssl-0.9.7g
> stunnel 4.10  compiled with gcc 2.95.3
> 
> When I compiled stunnel it made a private ket and certificate in 
> /usr/local/etc/stunnel/stunnel.pem.
> 
> Do I need anything else?
> 
> I have the following configuration:
> 
> Inetd.conf:
> 
> pop3 stream tcp nowait root /usr/local/sbin/popper qpopper -S  -t /poplog
> 
> stunnel.conf:
> 
> cert = /usr/local/etc/stunnel/stunnel.pem
> key = /usr/local/etc/stunnel/stunnel.pem
> debug = 7
> output = /stunnel.log
> pid = /stunnel.pid
> client = yes
> 
> [pop3s]
> accept  = 995
> connect = 110
> 
> I run stunnel and get the following output:
> 
> 2005.07.06 11:34:17 LOG5[17873:1]: stunnel 4.10 on sparc-sun-solaris2.6 
> UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005
> 2005.07.06 11:34:18 LOG7[17873:1]: Snagged 64 random bytes from //.rnd
> 2005.07.06 11:34:18 LOG7[17873:1]: Wrote 1024 new random bytes to //.rnd
> 2005.07.06 11:34:18 LOG7[17873:1]: RAND_status claims sufficient entropy 
> for the PRNG
> 2005.07.06 11:34:18 LOG6[17873:1]: PRNG seeded successfully
> 2005.07.06 11:34:18 LOG7[17873:1]: Certificate: 
> /usr/local/etc/stunnel/stunnel.pem
> 2005.07.06 11:34:18 LOG7[17873:1]: Key file: 
> /usr/local/etc/stunnel/stunnel.pem
> 2005.07.06 11:34:18 LOG6[17873:1]: file ulimit = 64 (can be changed with 
> 'ulimit -n')
> 2005.07.06 11:34:18 LOG6[17873:1]: poll() used - no FD_SETSIZE limit for 
> file descriptors
> 2005.07.06 11:34:18 LOG5[17873:1]: 29 clients allowed
> 2005.07.06 11:34:18 LOG7[17873:1]: FD 4 in non-blocking mode
> 2005.07.06 11:34:18 LOG7[17873:1]: FD 5 in non-blocking mode
> 2005.07.06 11:34:18 LOG7[17873:1]: FD 6 in non-blocking mode
> 2005.07.06 11:34:18 LOG7[17873:1]: SO_REUSEADDR option set on accept socket
> 2005.07.06 11:34:18 LOG7[17873:1]: pop3s bound to 0.0.0.0:995
> 2005.07.06 11:34:18 LOG7[17874:1]: Created pid file /stunnel.pid
> 2005.07.06 11:34:18 LOG7[17874:0]: Waiting -1 second(s) for 2 file 
> descriptor(s)
> 
> 
> I connect via pop3 in thunderbird with ssl and qpopper always says:
> (null) at localhost (127.0.0.1): -ERR Unknown command: "".
>  (nulI/O error flushing output to client  at localhost [127.0.0.1]: 
> Broken pipe (32)l) at localhost (127.0.0.1): -ERR POP EOF or I/O Error
> 
> Stunnel says:
> 
> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->()
> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->(IN)
> 2005.07.06 11:37:13 LOG7[17884:1]: pop3s accepted FD=0 from 
> 172.20.10.7:45464
> 2005.07.06 11:37:13 LOG7[17884:1]: Creating a new context
> 2005.07.06 11:37:13 LOG7[17884:1]: Context 2 created
> 2005.07.06 11:37:13 LOG7[17884:2]: pop3s started
> 2005.07.06 11:37:13 LOG7[17884:2]: FD 0 in non-blocking mode
> 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on local socket
> 2005.07.06 11:37:13 LOG5[17884:2]: pop3s connected from 172.20.10.7:45464
> 2005.07.06 11:37:13 LOG7[17884:2]: FD 1 in non-blocking mode
> 2005.07.06 11:37:13 LOG7[17884:2]: pop3s connecting 127.0.0.1:110
> 2005.07.06 11:37:13 LOG7[17884:2]: Remote FD=1 initialized
> 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on remote socket
> 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): before/connect 
> initialization
> 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): SSLv3 write 
> client hello A
> 2005.07.06 11:37:13 LOG7[17884:0]: Waiting 300 second(s) for 3 file 
> descriptor(s)
> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->()
> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->()
> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 2, FD=1, (IN)->(IN)
> 
> The mail never gets delivered to either Thunderbird or outlook express.
> I get a certificate approval request from Thunderbird to which I grant, 
> then nothing.  If I disable ssl in thunderbird the mail gets accepted 
> normally.
> 
> What might I be doing wrong???
> 
> Thanks
> 
> Doug P
> _______________________________________________
> stunnel-users mailing list
> stunnel-users at mirt.net
> http://stunnel.mirt.net/mailman/listinfo/stunnel-users
> 
>