August 2004 - stunnel-users

Stunnel to the rescue
by Steven Sporen 23 Aug '04

23 Aug '04

Hi, Is it possible to configure STUNNEL to provide support for STARTTLS with IMAP (Microsoft Exchange Server doesn't support this) Have a look at RFC2595 http://www.faqs.org/rfcs/rfc2595.html The reason is - Symbian cell phones only allow secure IMAP via this method they can't connect to SIMAP. Please help Thanks

2 1

RE: [stunnel-users] Newbie: Keep getting connection closed
by david-e.hansen＠ubs.com 17 Aug '04

17 Aug '04

Charles, Check to see if you are being bitten by the "Eudora" problem -- add the following line to the top of your stunnel.conf file, and see if it magically starts working: options = DONT_INSERT_EMPTY_FRAGMENTS You can also see a related set of mails from myself, describing the problem we had. Regards, David Hansen -----Original Message----- From: stunnel-users-admin(a)mirt.net [mailto:stunnel-users-admin@mirt.net]On Behalf Of Charles A. Monteiro Sent: Dienstag, 17. August 2004 18:31 To: stunnel-users(a)mirt.net Subject: [stunnel-users] Newbie: Keep getting connection closed We are using a proprietary protocol over tcp/ip which works fine and has for a number of years. I have tested it without stunnel and it checks fine as well. I keep getting the connection closed when I run through stunnel. I don't understand if something bad has actually happened i.e. from the error warnings. Is an "alert" a bad thing i.e. does it indicate that something is broken? Does stunnel normally close the connection after every message exchange? I have included the logs for both the stunnel client and server as well as the respective conf files. thanks in advance, -Charles --------------------------------------- client log: 2004.08.17 11:13:27 LOG7[1824:1544]: 55555 accepted FD=536 from 127.0.0.1:1085 2004.08.17 11:13:27 LOG7[1824:1544]: FD 536 in non-blocking mode 2004.08.17 11:13:27 LOG7[1824:1544]: Creating a new thread 2004.08.17 11:13:27 LOG7[1824:1544]: New thread created 2004.08.17 11:13:27 LOG7[1824:1040]: 55555 started 2004.08.17 11:13:27 LOG5[1824:1040]: 55555 connected from 127.0.0.1:1085 2004.08.17 11:13:27 LOG7[1824:1040]: FD 564 in non-blocking mode 2004.08.17 11:13:27 LOG7[1824:1040]: 55555 connecting 192.168.20.76:55555 2004.08.17 11:13:27 LOG7[1824:1040]: remote connect #1: EWOULDBLOCK: retrying 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: FD=564, DIR=write 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: ok 2004.08.17 11:13:27 LOG7[1824:1040]: Remote FD=564 initialized 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): before/connect initialization 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write client hello A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read server hello A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read server certificate A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read server done A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write client key exchange A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write change cipher spec A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write finished A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 flush data 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: FD=564, DIR=read 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: ok 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read finished A 2004.08.17 11:13:27 LOG7[1824:1040]: 6 items in the session cache 2004.08.17 11:13:27 LOG7[1824:1040]: 7 client connects (SSL_connect()) 2004.08.17 11:13:27 LOG7[1824:1040]: 7 client connects that finished 2004.08.17 11:13:27 LOG7[1824:1040]: 0 client renegotiatations requested 2004.08.17 11:13:27 LOG7[1824:1040]: 0 server connects (SSL_accept()) 2004.08.17 11:13:27 LOG7[1824:1040]: 0 server connects that finished 2004.08.17 11:13:27 LOG7[1824:1040]: 0 server renegotiatiations requested 2004.08.17 11:13:27 LOG7[1824:1040]: 1 session cache hits 2004.08.17 11:13:27 LOG7[1824:1040]: 0 session cache misses 2004.08.17 11:13:27 LOG7[1824:1040]: 0 session cache timeouts 2004.08.17 11:13:27 LOG6[1824:1040]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.08.17 11:13:27 LOG7[1824:1040]: Socket closed on read 2004.08.17 11:13:27 LOG7[1824:1040]: SSL write shutdown (output buffer empty) 2004.08.17 11:13:27 LOG7[1824:1040]: SSL alert (write): warning: close notify 2004.08.17 11:13:27 LOG7[1824:1040]: SSL_shutdown retrying 2004.08.17 11:13:27 LOG7[1824:1040]: SSL alert (read): warning: close notify 2004.08.17 11:13:27 LOG7[1824:1040]: SSL closed on SSL_read 2004.08.17 11:13:27 LOG7[1824:1040]: Socket write shutdown (output buffer empty) 2004.08.17 11:13:27 LOG5[1824:1040]: Connection closed: 110 bytes sent to SSL, 13 bytes sent to socket 2004.08.17 11:13:27 LOG7[1824:1040]: 55555 finished (0 left) ------------------------------------------------------------- server log: 2004.08.17 11:03:12 LOG7[28177:3073021920]: 55555 accepted FD=7 from 192.168.20.77:1086 2004.08.17 11:03:12 LOG7[28177:3073021920]: FD 7 in non-blocking mode 2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 started 2004.08.17 11:03:12 LOG5[28177:3062528944]: 55555 connected from 192.168.20.77:1086 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): before/accept initialization 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=7, DIR=read 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read client hello A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write server hello A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write certificate A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write server done A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 flush data 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=7, DIR=read 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read client key exchange A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read finished A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write change cipher spec A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write finished A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 flush data 2004.08.17 11:03:12 LOG7[28177:3062528944]: 2 items in the session cache 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client connects (SSL_connect()) 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client connects that finished 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client renegotiatations requested 2004.08.17 11:03:12 LOG7[28177:3062528944]: 18 server connects (SSL_accept()) 2004.08.17 11:03:12 LOG7[28177:3062528944]: 10 server connects that finished 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 server renegotiatiations requested 2004.08.17 11:03:12 LOG7[28177:3062528944]: 2 session cache hits 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 session cache misses 2004.08.17 11:03:12 LOG7[28177:3062528944]: 6 session cache timeouts 2004.08.17 11:03:12 LOG6[28177:3062528944]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.08.17 11:03:12 LOG7[28177:3062528944]: FD 8 in non-blocking mode 2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 connecting 192.168.20.76:4242 2004.08.17 11:03:12 LOG7[28177:3062528944]: remote connect #1: EINPROGRESS: retrying 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=8, DIR=write 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok 2004.08.17 11:03:12 LOG7[28177:3062528944]: Remote FD=8 initialized 2004.08.17 11:03:12 LOG7[28177:3062528944]: Socket closed on read 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL alert (write): warning: close notify 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL write shutdown (output buffer empty) 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL alert (read): warning: close notify 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL closed on SSL_read 2004.08.17 11:03:12 LOG7[28177:3062528944]: Socket write shutdown (output buffer empty) 2004.08.17 11:03:12 LOG5[28177:3062528944]: Connection closed: 13 bytes sent to SSL, 110 bytes sent to socket 2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 finished (0 left) ------------------------------------------------------------------------------------------------------------------- My client stunnel.conf: cert=stunnel.pem client=yes debug=7 [55555] accept=localhost:55555 connect=192.168.20.76:55555 - eof - My server stunnel.conf: cert=stunnel.pem debug=7 output=stunnel.err [55555] accept=192.168.20.76:55555 connect=192.168.20.76:4242 - eof - -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/ _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users Visit our website at http://www.ubs.com This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes and should not be construed as a solicitation or offer to buy or sell any securities or related financial instruments.

2 1

Re: chrooting 4.05 - can't get UID for user _stunnel
by Brian Hatch 17 Aug '04

17 Aug '04

> Amazing how none of the OpenBSD packages ever actually seem to work. :) Whoa - them's fighting words. ;-) (Happily a Debian Linux user. My packages may be two years old, but they work, dammit.) -- Brian Hatch Anarchy: it's not the law, Systems and it's just a good idea. Security Engineer http://www.ifokr.org/bri/ Every message PGP signed

1 0

Newbie: Keep getting connection closed
by Charles A. Monteiro 17 Aug '04

17 Aug '04

We are using a proprietary protocol over tcp/ip which works fine and has for a number of years. I have tested it without stunnel and it checks fine as well. I keep getting the connection closed when I run through stunnel. I don't understand if something bad has actually happened i.e. from the error warnings. Is an "alert" a bad thing i.e. does it indicate that something is broken? Does stunnel normally close the connection after every message exchange? I have included the logs for both the stunnel client and server as well as the respective conf files. thanks in advance, -Charles --------------------------------------- client log: 2004.08.17 11:13:27 LOG7[1824:1544]: 55555 accepted FD=536 from 127.0.0.1:1085 2004.08.17 11:13:27 LOG7[1824:1544]: FD 536 in non-blocking mode 2004.08.17 11:13:27 LOG7[1824:1544]: Creating a new thread 2004.08.17 11:13:27 LOG7[1824:1544]: New thread created 2004.08.17 11:13:27 LOG7[1824:1040]: 55555 started 2004.08.17 11:13:27 LOG5[1824:1040]: 55555 connected from 127.0.0.1:1085 2004.08.17 11:13:27 LOG7[1824:1040]: FD 564 in non-blocking mode 2004.08.17 11:13:27 LOG7[1824:1040]: 55555 connecting 192.168.20.76:55555 2004.08.17 11:13:27 LOG7[1824:1040]: remote connect #1: EWOULDBLOCK: retrying 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: FD=564, DIR=write 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: ok 2004.08.17 11:13:27 LOG7[1824:1040]: Remote FD=564 initialized 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): before/connect initialization 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write client hello A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read server hello A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read server certificate A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read server done A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write client key exchange A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write change cipher spec A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write finished A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 flush data 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: FD=564, DIR=read 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: ok 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read finished A 2004.08.17 11:13:27 LOG7[1824:1040]: 6 items in the session cache 2004.08.17 11:13:27 LOG7[1824:1040]: 7 client connects (SSL_connect()) 2004.08.17 11:13:27 LOG7[1824:1040]: 7 client connects that finished 2004.08.17 11:13:27 LOG7[1824:1040]: 0 client renegotiatations requested 2004.08.17 11:13:27 LOG7[1824:1040]: 0 server connects (SSL_accept()) 2004.08.17 11:13:27 LOG7[1824:1040]: 0 server connects that finished 2004.08.17 11:13:27 LOG7[1824:1040]: 0 server renegotiatiations requested 2004.08.17 11:13:27 LOG7[1824:1040]: 1 session cache hits 2004.08.17 11:13:27 LOG7[1824:1040]: 0 session cache misses 2004.08.17 11:13:27 LOG7[1824:1040]: 0 session cache timeouts 2004.08.17 11:13:27 LOG6[1824:1040]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.08.17 11:13:27 LOG7[1824:1040]: Socket closed on read 2004.08.17 11:13:27 LOG7[1824:1040]: SSL write shutdown (output buffer empty) 2004.08.17 11:13:27 LOG7[1824:1040]: SSL alert (write): warning: close notify 2004.08.17 11:13:27 LOG7[1824:1040]: SSL_shutdown retrying 2004.08.17 11:13:27 LOG7[1824:1040]: SSL alert (read): warning: close notify 2004.08.17 11:13:27 LOG7[1824:1040]: SSL closed on SSL_read 2004.08.17 11:13:27 LOG7[1824:1040]: Socket write shutdown (output buffer empty) 2004.08.17 11:13:27 LOG5[1824:1040]: Connection closed: 110 bytes sent to SSL, 13 bytes sent to socket 2004.08.17 11:13:27 LOG7[1824:1040]: 55555 finished (0 left) ------------------------------------------------------------- server log: 2004.08.17 11:03:12 LOG7[28177:3073021920]: 55555 accepted FD=7 from 192.168.20.77:1086 2004.08.17 11:03:12 LOG7[28177:3073021920]: FD 7 in non-blocking mode 2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 started 2004.08.17 11:03:12 LOG5[28177:3062528944]: 55555 connected from 192.168.20.77:1086 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): before/accept initialization 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=7, DIR=read 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read client hello A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write server hello A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write certificate A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write server done A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 flush data 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=7, DIR=read 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read client key exchange A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read finished A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write change cipher spec A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write finished A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 flush data 2004.08.17 11:03:12 LOG7[28177:3062528944]: 2 items in the session cache 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client connects (SSL_connect()) 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client connects that finished 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client renegotiatations requested 2004.08.17 11:03:12 LOG7[28177:3062528944]: 18 server connects (SSL_accept()) 2004.08.17 11:03:12 LOG7[28177:3062528944]: 10 server connects that finished 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 server renegotiatiations requested 2004.08.17 11:03:12 LOG7[28177:3062528944]: 2 session cache hits 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 session cache misses 2004.08.17 11:03:12 LOG7[28177:3062528944]: 6 session cache timeouts 2004.08.17 11:03:12 LOG6[28177:3062528944]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.08.17 11:03:12 LOG7[28177:3062528944]: FD 8 in non-blocking mode 2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 connecting 192.168.20.76:4242 2004.08.17 11:03:12 LOG7[28177:3062528944]: remote connect #1: EINPROGRESS: retrying 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=8, DIR=write 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok 2004.08.17 11:03:12 LOG7[28177:3062528944]: Remote FD=8 initialized 2004.08.17 11:03:12 LOG7[28177:3062528944]: Socket closed on read 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL alert (write): warning: close notify 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL write shutdown (output buffer empty) 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL alert (read): warning: close notify 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL closed on SSL_read 2004.08.17 11:03:12 LOG7[28177:3062528944]: Socket write shutdown (output buffer empty) 2004.08.17 11:03:12 LOG5[28177:3062528944]: Connection closed: 13 bytes sent to SSL, 110 bytes sent to socket 2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 finished (0 left) ------------------------------------------------------------------------------------------------------------------- My client stunnel.conf: cert=stunnel.pem client=yes debug=7 [55555] accept=localhost:55555 connect=192.168.20.76:55555 - eof - My server stunnel.conf: cert=stunnel.pem debug=7 output=stunnel.err [55555] accept=192.168.20.76:55555 connect=192.168.20.76:4242 - eof - -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

1 0

SSL Handshake problems
by markzero＠logik.ath.cx 16 Aug '04

16 Aug '04

I have a tunnel that forwards connections from syslog-ng on localhost to my loghost. Or rather, I don't. In the stunnel logs, I repeatedly get: 2004.08.16 21:28:30 LOG5[23452:1006768128]: syslogngs connected from 127.0.0.1:32479 2004.08.16 21:28:30 LOG7[23452:1006768128]: SSL state (accept): before/accept initialization 2004.08.16 21:28:30 LOG3[23452:1006768128]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2004.08.16 21:28:30 LOG7[23452:1006768128]: syslogngs finished (2 left) 2004.08.16 21:28:31 LOG7[23452:1006693376]: SSL socket closed on SSL_read 2004.08.16 21:28:31 LOG5[23452:1006693376]: Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket 2004.08.16 21:28:31 LOG7[23452:1006693376]: syslogngs finished (1 left) 2004.08.16 21:30:01 LOG7[23452:1006763008]: waitforsocket: ok 2004.08.16 21:30:01 LOG3[23452:1006763008]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2004.08.16 21:30:01 LOG7[23452:1006763008]: syslogngs finished (0 left) ..yet connecting using: $ openssl s_client -connect localhost:5515 successfully connects to my loghost and prints the certificate details. Why on earth will s_client connect and not syslog-ng? Specific details: 192.168.1.6 syslog-ng -> localhost:5515 | stunnel <----------| | stunnel ----------> loghost:5514 loghost: 192.168.1.7 (hosts) ---> stunnel (192.168.1.7:5514) | syslog-ng (localhost:5515) I have now been trying to implement encrypted logging for a record time of three months now and so far every attempt has failed in some way or another. Can somebody please put an end to this adminstrative misery? (more verbose program output on request) mark

1 1

_GET_CLIENT_HELLO:unknown protocol
by markzero＠logik.ath.cx 16 Aug '04

16 Aug '04

Hi. I'm so close to having a working loghost, with stunnel encrypted connections. Not close enough however. I have syslog-ng setup to log to 127.0.0.1:5515 on all clients. The client config: [syslogngs] accept = 127.0.0.1:5515 connect = 192.168.1.7:5514 On the loghost, stunnel listens on *.5514 and forwards to connection to 127.0.0.1:5515 (which syslog-ng is listening on). (server config): [syslogngs] accept = 192.168.1.7:5514 connect = 127.0.0.1:5515 I'm making an assumption that the certificates are working, as I'm using (or attempting to use) both client and server authentication. Watching the stream with a packet sniffer shows absolutely no connections between the client and the loghost. Strings such as this appear in the stunnel.log repeatedly: 2004.08.16 20:42:26 LOG7[7690:1006693376]: syslogngs started 2004.08.16 20:42:26 LOG5[7690:1006693376]: syslogngs connected from 127.0.0.1:2956 2004.08.16 20:42:26 LOG7[7690:1006693376]: SSL state (accept): before/accept initialization 2004.08.16 20:42:26 LOG7[7690:1006693376]: waitforsocket: FD=13, DIR=read 2004.08.16 20:42:26 LOG7[7690:1006690304]: syslogngs accepted FD=14 from 127.0.0.1:24856 2004.08.16 20:42:26 LOG7[7690:1006690304]: FD 14 in non-blocking mode 2004.08.16 20:42:26 LOG7[7690:1006763008]: syslogngs started 2004.08.16 20:42:26 LOG5[7690:1006763008]: syslogngs connected from 127.0.0.1:24856 2004.08.16 20:42:26 LOG7[7690:1006763008]: SSL state (accept): before/accept initialization 2004.08.16 20:42:26 LOG7[7690:1006763008]: waitforsocket: FD=14, DIR=read 2004.08.16 20:42:26 LOG7[7690:1006763008]: waitforsocket: ok 2004.08.16 20:42:26 LOG3[7690:1006763008]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2004.08.16 20:42:26 LOG7[7690:1006763008]: syslogngs finished (1 left) 2004.08.16 20:47:26 LOG7[7690:1006693376]: waitforsocket: timeout 2004.08.16 20:47:26 LOG7[7690:1006693376]: syslogngs finished (0 left) Have I made some glaring error that I'm not aware of? thanks mark

1 0