[stunnel-users] Stunnel + Hybrid-ircd issues
Strykar
s at hackerzlair.org
Sat Feb 9 01:39:35 CET 2008
Hi,
I'm running Hybrid-7.2 on two PCs, one of which has a dynamic IP, as Hybrid
wants a static IP and not hostname in its connect section, we are trying to
use stunnel to encrypt server<->server communication.
Server 1 specs (To which I'm connecting) running FreeBSD 6.3:
***********************************************
#stunnel -version
stunnel 4.05 on amd64-unknown-freebsd5.3 PTHREAD+LIBWRAP with OpenSSL 0.9.7e
25 Oct 2004
Global options
cert = /usr/local/etc/stunnel/stunnel.pem
ciphers = ALL:!ADH:+RC4:@STRENGTH
debug = 5
key = /usr/local/etc/stunnel/stunnel.pem
pid = /var/tmp/stunnel.pid
RNDbytes = 64
RNDfile = /dev/urandom
RNDoverwrite = yes
#gcc -v
Using built-in specs.
Configured with: FreeBSD/amd64 system compiler
Thread model: posix
gcc version 3.4.6 [FreeBSD] 20060305
#uname
FreeBSD 6.3-STABLE FreeBSD 6.3-STABLE #6: Tue Jan 22 13:23:51 GMT 2008
root@:/usr/obj/usr/src/sys/SVR1 amd64
Server 2 specs (From which I'm connecting via stunnel as a client) running
OpenBSD 4.2:
******************************************************************
#stunnel -version
stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006
Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
Global options
debug = 5
pid = /usr/local/var/run/stunnel/stunnel.pid
RNDbytes = 64
RNDfile = /dev/arandom
RNDoverwrite = yes
Service-level options
cert = /etc/stunnel/stunnel.pem
ciphers = ALL:!ADH:+RC4:@STRENGTH
key = /etc/stunnel/stunnel.pem
session = 300 seconds
sslVersion = SSLv3 for client, all for server
TIMEOUTbusy = 300 seconds
TIMEOUTclose = 60 seconds
TIMEOUTconnect = 10 seconds
TIMEOUTidle = 43200 seconds
verify = none
# gcc -v
Reading specs from /usr/lib/gcc-lib/i386-unknown-openbsd4.2/3.3.5/specs
Configured with:
Thread model: single
gcc version 3.3.5 (propolice)
# cat stunnel.conf:
cert = /etc/ssl/private/stunnel.pem
key = /etc/ssl/private/rsa.key
setuid = _stunnel
setgid = _stunnel
pid = /var/run/stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
foreground = yes
[irc]
client = yes
accept = localhost:994
connect = xxx.xxx.xxx.xxx:994
Here's the debug logged to stderr:
# stunnel
2008.02.08 19:34:54 LOG7[11904:2237644800]: Snagged 64 random bytes from
/dev/arandom
2008.02.08 19:34:54 LOG7[11904:2237644800]: RAND_status claims sufficient
entropy for the PRNG
2008.02.08 19:34:54 LOG7[11904:2237644800]: PRNG seeded successfully
2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate:
/etc/ssl/private/stunnel.pem
2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate loaded
2008.02.08 19:34:54 LOG7[11904:2237644800]: Key file:
/etc/ssl/private/rsa.key
2008.02.08 19:34:54 LOG7[11904:2237644800]: Private key loaded
2008.02.08 19:34:54 LOG7[11904:2237644800]: SSL context initialized for
service irc
2008.02.08 19:34:54 LOG5[11904:2237644800]: stunnel 4.20 on
i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006
2008.02.08 19:34:54 LOG5[11904:2237644800]: Threading:PTHREAD SSL:ENGINE
Sockets:POLL,IPv6 Auth:LIBWRAP
2008.02.08 19:34:54 LOG6[11904:2237644800]: file ulimit = 128 (can be
changed with 'ulimit -n')
2008.02.08 19:34:54 LOG6[11904:2237644800]: poll() used - no FD_SETSIZE
limit for file descriptors
2008.02.08 19:34:54 LOG5[11904:2237644800]: 61 clients allowed
2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 6 in non-blocking mode
2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 7 in non-blocking mode
2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 8 in non-blocking mode
2008.02.08 19:34:54 LOG7[11904:2237644800]: SO_REUSEADDR option set on
accept socket
2008.02.08 19:34:54 LOG7[11904:2237644800]: irc bound to 127.0.0.1:994
2008.02.08 19:34:54 LOG7[11904:2237644800]: Created pid file
/var/run/stunnel.pid
2008.02.08 19:35:15 LOG7[11904:2237644800]: irc accepted FD=9 from
127.0.0.1:8579
2008.02.08 19:35:15 LOG7[11904:2336256000]: irc started
2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 9 in non-blocking mode
2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on local
socket
2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode
2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 11 in non-blocking mode
2008.02.08 19:35:15 LOG7[11904:2336256000]: Connection from 127.0.0.1:8579
permitted by libwrap
2008.02.08 19:35:15 LOG5[11904:2336256000]: irc accepted connection from
127.0.0.1:8579
2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode
2008.02.08 19:35:15 LOG7[11904:2336256000]: irc connecting 69.50.175.50:994
2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: waiting 10 seconds
2008.02.08 19:35:15 LOG7[11904:2237644800]: Cleaning up the signal pipe
2008.02.08 19:35:15 LOG6[11904:2237644800]: Child process 26562 finished
with code 0
2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: connected
2008.02.08 19:35:15 LOG5[11904:2336256000]: irc connected remote server from
192.168.1.101:42954
2008.02.08 19:35:15 LOG7[11904:2336256000]: Remote FD=10 initialized
2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on remote
socket
2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect):
before/connect initialization
2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write
client hello A
2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read
server hello A
2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read
server certificate A
2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read
server done A
2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write
client key exchange A
2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write
change cipher spec A
2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write
finished A
2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 flush
data
2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read
finished A
2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 items in the session cache
2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects
(SSL_connect())
2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects that
finished
2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 client renegotiations
requested
2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects
(SSL_accept())
2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects that
finished
2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server renegotiations
requested
2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache hits
2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache misses
2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache timeouts
2008.02.08 19:35:15 LOG6[11904:2336256000]: SSL connected: new session
negotiated
2008.02.08 19:35:15 LOG6[11904:2336256000]: Negotiated ciphers: AES256-SHA
SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2008.02.08 19:35:15 LOG3[11904:2336256000]: SSL_read: Connection reset by
peer (54)
2008.02.08 19:35:15 LOG5[11904:2336256000]: Connection reset: 0 bytes sent
to SSL, 0 bytes sent to socket
2008.02.08 19:35:15 LOG7[11904:2336256000]: irc finished (0 left)
What is going on here with "SSL_read: Connection reset by peer (54)"?
This process keeps repeating itself without the ircd's linking.
- S
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.stunnel.org/pipermail/stunnel-users/attachments/20080209/7611f960/attachment.html>
More information about the stunnel-users
mailing list