January 2005 - stunnel-users

Re: [stunnel-users] Activating Stunnel After Exiting (Newbie)
by Andre Tertling 20 Jan '05

20 Jan '05

[...] >Pack 2.) After close Agent, I right-click the Stunnel icon on the task >bar and choose Exit. If I try to activate Stunnel later, by >double-clicking its desktop icon, I am presented with an error window >headed "stunnel 4.07 on Win32" with the following message: "Failed to >create a new service". Looking at Properties on the desktop, I see that >the Target is "C:\stunnel\stunnel-4.07.exe -install". This looks wrong, >as it appears to be the option for initial installation of the program. I >assume I need to change this, or discover another method of re- [...] You already found the culprit. The command line option "-install" attempts to install the stunnel service. As it is already present in the services list, this has to fail. You can easily start and stop stunnel using the net command from a command line window: net start stunnel to start stunnel, or: net stop stunnel to shut it down again. You could make up a batch file to launch stunnel automatically for the time agent is running: --file runagent.cmd begin-- @echo off net stunnel start C:\Program Files\Agent!\Agent32.exe net stunnel stop --file runagent.cmd end-- Just edit the path for agent32.exe to match the path where you have Forté Agent installed, and you're done. P.S. I know net stunnel start can complain about that the service is already running, but that's just cosmetical and I was too lazy to implement logic to check if the service is already running ;) Best regards, Andre

1 1

Activating Stunnel After Exiting (Newbie)
by mhrtmhd94＠att.net 20 Jan '05

20 Jan '05

Hi. I just installed Stunnel, in order to be able to continue Agent as my mews reader. This works well. Based on the cautions on the website, I have decided to keep Stunnel active only when I am using Agent. Stunnel opens when I boot Windows - (XP Home Edition with Service Pack 2.) After close Agent, I right-click the Stunnel icon on the task bar and choose Exit. If I try to activate Stunnel later, by double-clicking its desktop icon, I am presented with an error window headed "stunnel 4.07 on Win32" with the following message: "Failed to create a new service". Looking at Properties on the desktop, I see that the Target is "C:\stunnel\stunnel-4.07.exe -install". This looks wrong, as it appears to be the option for initial installation of the program. I assume I need to change this, or discover another method of re-opening stunnel. As it stands now, I have to reboot to accomplish this. Any assistance will be appreciated. Thanks.

1 0

stunnel-users@mirt.net
by eric wyzerski 17 Jan '05

17 Jan '05

Hi, Im trying to bind my 465 port tu my 25 port to have a ssl-smtp with the following command: stunnel -p /etc/stunnel.pem2 -d 465 -r localhost:25 However when I try to connect to port 465, I get the following error, stunnel[3443]: SSL_accept: Peer suddenly disconnected Any idea? Thank you Eric _________________________________________________________________ Take advantage of powerful junk e-mail filters built on patented Microsoft® SmartScreen Technology. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

2 1

Problem with zlib compression
by Allan Guild 13 Jan '05

13 Jan '05

I'm having problems with zlib compression - stunnel 4.07 on my client machne crashes whenever I try and start a session. With compression set to rle or not defined, there is no problem. I am securing a MySQL connection between a Windows client and Mandrake Linux 10.1 server. Client Configuration: Stunnel 4.07 and openssl 0.9.7e-zlib binaries downloaded from Stunnel website stunnel.conf ------------ cert=./Allan_Guild_Work.pem key=./Allan_Guild_Work_key.pem client=yes compression=zlib [Primary Club] accept=3306 connect=195.137.78.107:3307 TIMEOUTbusy=5 ------------- Server Configuration: Stunnel 4.07 and openssl 0.9.7e (compiled with zlib support) rebuilt from Mandrake Cooker SRPMS stunnel.conf ------------ CApath=/etc/ssl/stunnel/certs/ cert=/etc/ssl/stunnel/CAcert.pem key=/etc/ssl/stunnel/CAkey.pem client=no foreground=yes pid=/var/run/stunnel.pid verify=0 compression=zlib [Primary Club] accept=3307 connect=3306 ------------ When I try and connect, I get the following output from the client (which then crashes): ------------- 2005.01.11 19:04:14 LOG5[308:2172]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.01.11 19:04:14 LOG5[308:1688]: No limit detected for the number of clients 2005.01.11 19:04:16 LOG5[308:804]: Primary Club connected from 127.0.0.1:4769 ------------- and the following from the server: ------------- 2005.01.11 19:21:30 LOG5[25439:1076523680]: stunnel 4.07 on i586-mandrake-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 2005.01.11 19:21:30 LOG5[25439:1076523680]: 500 clients allowed 2005.01.11 19:21:53 LOG5[25439:1073900464]: Primary Club connected from 212.135.219.66:3974 2005.01.11 19:21:53 LOG5[25439:1073900464]: VERIFY IGNORE: depth=0, /C=UK/ST=Some-State/L=London/O=Primary Club/CN=Allan Guild/emailAddress=allan.guild(a)bitsnpieces.org.uk 2005.01.11 19:21:53 LOG5[25439:1073900464]: VERIFY IGNORE: depth=0, /C=UK/ST=Some-State/L=London/O=Primary Club/CN=Allan Guild/emailAddress=allan.guild(a)bitsnpieces.org.uk 2005.01.11 19:21:57 LOG3[25439:1073900464]: SSL_read (ERROR_SYSCALL): Connection reset by peer (104) 2005.01.11 19:21:57 LOG5[25439:1073900464]: Connection reset: 3843 bytes sent to SSL, 55 bytes sent to socket ------------- Any advice would be greatly appreciated (Do I need a zlib dll?), Allan

2 2

stunnel dropping connection with media wiki
by christopher＠baus.net 11 Jan '05

11 Jan '05

Hi all, I've been using stunnel with SMTP, IMAP, and HTTP with out a problem. Yesterday I installed media wiki on Fedora Core 2 w/ Apache. It works fine if I access it directly, but if I access the site via stunnel, the proxy drops connection. I was wondering if anybody else has seen this type of problem. I am tempted to dig into it, but I am honestly short on time right now. I think it might have something to do with the redirects that Media wiki uses, but that's just a wild guess. Christopher Baus ======== Implementing an HTTP proxy? Consider a fast, secure alternative http://www.baus.net/ads/license

1 0

Re: [stunnel-users] OpenSSL - write:errno=131
by Hans Werner Strube 11 Jan '05

11 Jan '05

> (BTW, I use here the word "managed" becuase it was not straightforward: the > up-to-date version - 4.07 - wouldn't compile under Solaris.) For this special problem, try my patch from 04 Jan 05 in this list, Subject: stunnel-4.07 on non-IPv6 systems

1 0

openssl and a pkcs#11 device
by Edward 11 Jan '05

11 Jan '05

Hello, Has anyone ever tried to build stunnel using openssl with a pkcs#11 crypto device? Regards, Edward Stempel -- "The responsibility of a citizen is to keep his mouth open." - Gunther Grass

1 0

OpenSSL - write:errno=131
by Andrzej Marecki 10 Jan '05

10 Jan '05

I managed to compile and install stunnel 4.06 under Solaris 2.6. (BTW, I use here the word "managed" becuase it was not straightforward: the up-to-date version - 4.07 - wouldn't compile under Solaris.) My stunnel.conf file reads: cert=/opt/etc/stunnel/pop3.pem chroot = /opt/var/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid output=/var/log/stunnel.log client = no [spop3] accept = localhost:995 connect = localhost:110 [ssmtp] accept = localhost:465 connect = localhost:25 -------------- /opt/etc/stunnel/pop3.pem has been set up according the instructions at: http://www.freebsd.hello.pl/files/modules.php?name=News&file=article&sid=5 ...so I do hope it's OK ;-). Anyway, stunnel daemon works - what I get in stunnel.log reads: stunnel 4.06 on sparc-sun-solaris2.6 PTHREAD+POLL with OpenSSL 0.9.7e 25 Oct 2004 29 clients allowed (Date & time of the messages quoted above are omitted.) Now I try to test stunnel: #/opt/bin/openssl s_client -connect localhost:995 -prexit ...and what I get is: CONNECTED(00000003) write:errno=131 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 148 bytes --- New, (NONE), Cipher is (NONE) --------------- I get the same when "openssl s_client -connect localhost:995" is issued by a non-privileged user. Needless to say I can't connect to port 995 using a bone fide MUA running on a PC under M$W (Thunderbird to be exact). Can you help me, please. Andrzej -- ----------------------------------------------------------------------------- Andrzej Marecki | Torun Centre for Astronomy | e-mail: amr(a)astro.uni.torun.pl N. Copernicus University | WWW: http://www.astro.uni.torun.pl ul. Gagarina 11 | tel: +48 56 6113032 PL-87-100 Torun, POLAND | fax: +48 56 6113009 ----------------------------------------------------------------------------- "If Bill Gates actually had to admin his own stuff, he'd shoot himself." -----------------------------------------------------------------------------

1 0

RE: [stunnel-users] Stunnel and DistCache Patch
by Kling, Kent M. 10 Jan '05

10 Jan '05

autoconf-2.13-14 was my installed version. I upgraded to autoconf-2.53-8 and it now works. Thanks for helping out. Kent -----Original Message----- From: Peter Pentchev [mailto:roam@ringlet.net] Sent: Monday, January 10, 2005 8:08 AM To: Senthil Prabu.S Cc: Kling, Kent M.; stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Stunnel and DistCache Patch On Mon, Jan 10, 2005 at 11:05:19AM +0530, Senthil Prabu.S wrote: > The problem is that,since the patch you applied have modified the configure.ac file, a brand new configure script should be generated to reflect the change done at the configure.ac. So run "autoconf" command to produce new configure script. > > This will solve your problem. Well, it... depends :) The original poster mentions that when he ran autoconf, he got an error stating that configure.in could not be found. This might mean that he's running an older version of autoconf, one that only looks for configure.in, not configure.ac. Kent, what does 'rpm -qa | fgrep auto' tell you? G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)cnsys.bg roam(a)FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 I am the meaning of this sentence. This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services.Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

1 0

Stunnel and DistCache Patch
by Kling, Kent M. 10 Jan '05

10 Jan '05

we have a RedHat 7.2 system and we are trying to apply the distcache_geoff.patch to enable distcache 1.4.5 with stunnel-4.04. We have run into a snag after the configure script is run and we attempt the "make", it complains that configure.in is missing. In step 2 is our "configure" line wrong? # make output: cd . && aclocal cd . && automake --gnu --include-deps Makefile cd . \ && CONFIG_FILES=Makefile CONFIG_HEADERS= /bin/sh ./config.status config.status: creating Makefile cd . && autoconf autoconf: configure.in: No such file or directory make: *** [configure] Error 1 Our work around is to change directory into the /usr/src/stunnel-4.04/src and run "make" from that directory to create our stunnel binary. Any idea why it won't work from the top directory. our stunnel source resides in /usr/src/stunnel-4.04, distcache_geoff.patch is in /usr/src and distcache-1.4.5 is in /usr/local/distcache-1.4.5. Our installation steps are below: step 1. # patch -p0 < distcache_geoff.patch output: patching file stunnel-4.04/configure.ac patching file stunnel-4.04/src/common.h patching file stunnel-4.04/src/options.c patching file stunnel-4.04/src/prototypes.h patching file stunnel-4.04/src/ssl.c step 2. # cd stunnel-4.04 # export CFLAGS="-DHAVE_DISTCACHE_DC_CLIENT_H -I/usr/local/distcache-1.4.5/include"; export LDFLAGS="-L/usr/local/distcache-1.4.5/lib -ldistcache -lnal"; ./configure --prefix=/usr/local/stunnel-4.04 --with-ssl=/usr/local/openssl-0.9.7e --with-tcp-wrappers --disable-shared output: checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking build system type... i686-pc-linux-gnu checking host system type... i686-pc-linux-gnu checking for gcc... gcc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for a BSD-compatible install... /usr/bin/install -c checking whether make sets ${MAKE}... (cached) yes checking for ld used by GCC... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -B checking whether ln -s works... yes checking how to recognise dependant libraries... pass_all checking command to parse /usr/bin/nm -B output... ok checking how to run the C preprocessor... gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... ranlib checking for strip... strip checking for objdir... .libs checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.lo... yes checking if gcc supports -fno-rtti -fno-exceptions... yes checking whether the linker (/usr/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking dynamic linker characteristics... GNU/Linux ld.so checking if libtool supports shared libraries... yes checking whether to build shared libraries... no checking whether to build static libraries... yes creating libtool checking for SSL directory... /usr/local/openssl-0.9.7e checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... no checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... yes checking whether to use the libwrap (TCP wrappers) library... yes checking for hosts_access in -lwrap... yes checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... yes checking pty.h presence... yes checking for pty.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... yes checking for _getpty... no checking for daemon... yes checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for unsigned char... yes checking size of unsigned char... 1 checking for unsigned short... yes checking size of unsigned short... 2 checking for unsigned int... yes checking size of unsigned int... 4 checking for unsigned long... yes checking size of unsigned long... 4 configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tools/stunnel.conf-sample config.status: creating tools/stunnel.init Thanks, Kent Kling This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services.Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

3 2