January 2006 - stunnel-users

ad tdions
by Malcolm William Mason 22 Jan '06

22 Jan '06

I am, apparently on this But how do I post to it as others seen to. Pro Posterioribus

1 0

Looking for a job in UK or Ireland
by Michal Trojnara 22 Jan '06

22 Jan '06

Hi, I hope you don't mind this time I'll use stunnel mailing lists for something personal. I've just updated my Resume: http://mike.mirt.net/cv-en.pdf Do you know of interesting job openings? Possibly as an architect or in a similar position. Best regards, Mike

1 0

https to http proxy is buggy with IE
by Glen 22 Jan '06

22 Jan '06

Hi Everyone, I am trying to use stunnel to do the ssl portion for the web server. Mainly because the certificate I have is easy to setup in stunnel (was originally created for an openssl based serer) and the web server supports it's own propriatery cert format which I would like to avoid having to convert to. I have it working fine with all browsers except for the buggy Internet Explorer. With internet explorer anything requiring a page redirect fails (from viewing the logs it appears the socket gets closed before the redirect is finished resulting in a blank page being sent to the browser. I have tried the TIMEOUTclose = 0 but that hasn't helped. Any suggestions? thanks, Glen

2 1

stunnel 4.14 errors and dropped connection
by stunnelusers＠tinfoil.cotse.net 21 Jan '06

21 Jan '06

Hello, If I leave my computer downloading via stunnel and come back to it later, I find the download has stopped halfway and in the stunnel log it says: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) and then a number of lines like: Error resolving 'xxx.xxx.xxx': Neither nodename nor servname known (EAI_NONAME) where xxx.xxx.xxx is the url I was downloading from. I am using stunnel 4.14 on win xp. If I try to load a web page like google I get told it cannot be found. I have to switch off the router and switch it back on. When Windows finds the "new" connection it resets itself and everything works perfectly again, for a while, and then it happens all over again. This did not happen before I upgraded to 4.14. What is happening? Why is it happening? How do i stop it? Thanks.

1 0

RE: [stunnel-users] exclusively TLS
by Moehrke, John (GE Healthcare) 20 Jan '06

20 Jan '06

It is not the list of ciphers that I want to choose from. We are indeed using a select set of ciphers and that seems to be working fine. My problem is that when stunnel connects to the server it is trying sslv3, and this causes an error as the server is only supporting TLS. I could easily be wrong... John > > I need to talk to a server that is requiring pure TLS. It seems that > > STUNNEL always starts with SSL. How do I get STUNNEL to > start the client > > side conversation with TLS? > > http://www.stunnel.org/faq/stunnel.html#global_options > > ciphers = cipherlist > > Select permitted SSL ciphers > > A colon delimited list of the ciphers to allow in the SSL > connection. > For example DES-CBC3-SHA:IDEA-CBC-MD5 > > > For an exhaustive table of allowed ciphersuite values, if > it's not in the > stunnel manual check > http://www.modssl.org/docs/2.8/ssl_reference.html#ToC9 > > Jan > > -- > http://www.surfnet.nl/organisatie/jame > >

2 1

exclusively TLS
by Moehrke, John (GE Healthcare) 20 Jan '06

20 Jan '06

I need to talk to a server that is requiring pure TLS. It seems that STUNNEL always starts with SSL. How do I get STUNNEL to start the client side conversation with TLS? John Moehrke Enterprise Security Architect GE Healthcare T 262 293 1667 W126 N7449 Flint Road, Suite 200, Menomonee Falls, WI 53051 John.Moehrke(a)med.ge.com <mailto:John.Moehrke@med.ge.com> www.gehealthcare.com <http://www.gehealthcare.com/> What I may see or hear in the course of the treatment or even outside of the treatment in regard to the life of men, which on no account one must spread abroad, I will keep to myself, holding such things shameful to be spoken about. (One Portion of the Hippocratic Oath - Hippocrates, circa 400 B.C.)

2 1

Stunnel in a three tier setup
by Louis Young 19 Jan '06

19 Jan '06

Hi Guys I would like to set up stunnel in a three tier environment, i.e. instead of just having a client and a server, I have a client, midware and server. I tried doing this: On the client: [VNC on TestMachine] accept = 9000 connect = 192.168.100.12:9000 192.168.100.12 is the "mid-ware" machine: On this "mid-ware" machine: [VNC on TestMachine] accept = 9000 connect = 192.168.100.16:9000 192.168.100.16 is the destination: Then on the destination: [VNC] accept = 9000 connect = 192.168.100.16:5900 The only machine with client=yes is the client and they all use the same key. If I change the settings on the client to point directly to the destination (i.e. using only two machines), it works, but with three machines there seems to be a problem Any ideas? Regards, Louis Young Systems Administrator Kwikpay SA (Pty) Ltd

2 1

verify server certification is missing
by Olivier twist 17 Jan '06

17 Jan '06

I think a functionnality is missing in stunnel. I compare the behaviour of stunnel and apache mod-ssl. If you have a certificate signed by third party, apache checks the root certificate like stunnel do this with -v 1 option but apache don't ask for a client certificate, stunnel do this :-( I think that stunnel should control server certificate chain defined in CA file even if option -v 1 is not set !!! Could you give your opinion? If I use stunnel and not apache it's because I have some protocols to handle with ssl and stunnel is a very easy to use solution. Thanks Oliver

1 0

Delay option
by Stefaan Van Dooren 16 Jan '06

16 Jan '06

Hi, I'm setting up stunnel and I'm facing a problem with dynamic IP-adresses. Searching google and the man pages I tought that the "delay = yes" option would solve my problem, but it doesn't seems to. If I had "delay = yes" to my config file, none of my services seems to work anymore. If I remove it, everything is working fine, until the the remote-IP changes, and I have to restart stunnel. What am I doing wrong ? Or isn't this the right option for this job ? Stunnel -version : stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Stefaan

2 1

Connection Refused by libwrap
by Eddie Atherton 15 Jan '06

15 Jan '06

Hi, With Version 4.14, I've now started seeing the following messages occaisionally when I fire up 4 concurrent connections from my Windows box, via stunnel on Linux, to my NewsServer: Jan 3 17:55:13 The-Tardis stunnel: LOG3[17760:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17760:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[17761:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17761:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[17761:400]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17761:400]: Connection from 192.168.0.2:2074 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:400]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:400]: Connection from 192.168.0.2:2074 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:401]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:401]: Connection from 192.168.0.2:2075 REFUSED by libwrap Following this, the connections continues as normal. Now, ASAIK, I'm not using the wrappers. I'm starting stunnel as a daemon, in rc.local. There are no entries in inetd.conf for the port that the windows machine connects from. Here's the relevent parts of the config file: ; Use it for client mode client = yes [nntps] accept = 563 connect = newsgroups.comcast.net:563 Cheers, Eddie

2 2