June 2006 - stunnel-users

Stunnel Crash: Gmail SMTP over TLS
by Shatadal Ghosh 23 Aug '06

23 Aug '06

Hi, I am using stunnel 4.15 on Windows XP SP1 with Mozilla Thunderbird as the e-mail client. I do not have openSSL installed locally. I do have the libssl32.dll and libeay32.dll in the same directory as stunnel.exe (C:\Program Files\stunnel). I am running stunnel as a service. Stunnel crashes when I use it to send e-mail (SMTP via TLS) via gmail. According to the e-mail client configuration page on the gmail website http://mail.google.com/support/bin/answer.py?answer=13287&topic=1555 I tried to use SMTP over TLS to connect to smtp.gmail.com:587 My gmail-smtps block in stunnel.conf was ; SMTP service, listens on localhost:250 [gmail-smtps] protocol=smtp accept=localhost:250 connect=smtp.gmail.com:587 On trying to send an e-mail message via the above configuration stunnel crashed. The log file is as follows 2006.06.14 03:17:15 LOG5[3956:3512]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.06.14 03:17:15 LOG5[3956:3512]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.06.14 03:17:15 LOG5[3956:3600]: No limit detected for the number of clients 2006.06.14 03:17:15 LOG7[3956:3600]: FD 172 in non-blocking mode 2006.06.14 03:17:15 LOG7[3956:3600]: SO_REUSEADDR option set on accept socket 2006.06.14 03:17:15 LOG7[3956:3600]: gmail-pop3s bound to 127.0.0.1:1100 2006.06.14 03:17:15 LOG7[3956:3600]: FD 180 in non-blocking mode 2006.06.14 03:17:15 LOG7[3956:3600]: SO_REUSEADDR option set on accept socket 2006.06.14 03:17:15 LOG7[3956:3600]: gmail-smtps bound to 127.0.0.1:250 ....# info about other mail connections 2006.06.14 03:17:26 LOG7[3956:3600]: gmail-smtps accepted FD=236 from 127.0.0.1:3665 2006.06.14 03:17:26 LOG7[3956:3600]: Creating a new thread 2006.06.14 03:17:26 LOG7[3956:3600]: New thread created 2006.06.14 03:17:26 LOG7[3956:2812]: gmail-smtps started 2006.06.14 03:17:26 LOG7[3956:2812]: FD 236 in non-blocking mode 2006.06.14 03:17:26 LOG7[3956:2812]: TCP_NODELAY option set on local socket 2006.06.14 03:17:26 LOG5[3956:2812]: gmail-smtps connected from 127.0.0.1:3665 2006.06.14 03:17:26 LOG7[3956:2812]: FD 268 in non-blocking mode 2006.06.14 03:17:26 LOG7[3956:2812]: gmail-smtps connecting 64.233.167.111:587 2006.06.14 03:17:26 LOG7[3956:2812]: connect_wait: waiting 10 seconds 2006.06.14 03:17:26 LOG7[3956:2812]: connect_wait: connected 2006.06.14 03:17:26 LOG7[3956:2812]: Remote FD=268 initialized 2006.06.14 03:17:26 LOG7[3956:2812]: TCP_NODELAY option set on remote socket 2006.06.14 03:17:26 LOG5[3956:2812]: Negotiations for smtp (client side) started 2006.06.14 03:17:26 LOG7[3956:2812]: <- 220 mx.gmail.com ESMTP w66sm450524pyw 2006.06.14 03:17:26 LOG7[3956:2812]: -> 220 mx.gmail.com ESMTP w66sm450524pyw <logfile ends> What mistake am I making? Fortunately it seems that gmail supports SMTP over SSL too (smtp.gmail.com:465) and I am using that. However I am also facing this problem with another account which unfortunately allows SMTP only over TLS. Thanks, Shatadal. --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 0624-1, 06/13/2006 Tested on: 6/14/2006 6:22:04 AM avast! - copyright (c) 2000-2006 ALWIL Software. http://www.avast.com _________________________________________________________________ Is your PC infected? Get a FREE online computer virus scan from McAfee® Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

Bad certificate? (was Expired certificate?)
by Boxall, John 30 Jun '06

30 Jun '06

Mike, I've created a self-signed certificate on my Windows test box using OpenSSL 0.9.7j (the version from Shining Light). I created the key file with the following command: "openssl genrsa 1024 > \host.key Here is the command I used to create the self-signed cert: "openssl req -new -x509 -nodes -sha1 -days 9999 -key \host.key > \host.cert" I then copied the key/cert to the appropriate file in the stunnel directory. I then copied the cert to the Solaris server and included it with all other client certs. Here is the Windows configuration file: ; ;CLIENT-ONLY stunnel configuration file ; client = yes cert = C:\Program Files\stunnel\stunnel.pem-client-certificate CAfile = C:\Program Files\stunnel\stunnel.pem-server-certificate ;chroot = /var/run/stunnel ;pid = /usr/local/var/run/stunnel/stunnel.pid ;setuid = stunnel ;setgid = stunnel verify = 3 ;foreground = yes debug = 7 output = C:\Program Files\stunnel\stunnel.log [5140] accept = 127.0.0.1:514 connect = 172.17.99.143:5140 Here is the Solaris configuration file: ; ;SERVER-ONLY stunnel configuration file ; cert = /usr/local/etc/stunnel/stunnel.pem-server-certificate CAfile = /usr/local/etc/stunnel/stunnel.pem-all-client-certificates ;chroot = /var/run/stunnel ;pid = /var/run/stunnel/run/stunnel.pid ;setuid = stunnel ;setgid = stunnel verify = 3 ;foreground = yes debug = 7 output=/stunnel.log [5140] accept = 172.17.99.143:5140 connect = 127.0.0.1:514 The following happens on the Windows box when I first launch stunnel: 2006.06.30 09:51:31 LOG5[516:360]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.06.30 09:51:31 LOG5[516:360]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.06.30 09:51:31 LOG5[516:392]: No limit detected for the number of clients 2006.06.30 09:51:31 LOG7[516:392]: FD 1904 in non-blocking mode 2006.06.30 09:51:31 LOG7[516:392]: SO_REUSEADDR option set on accept socket 2006.06.30 09:51:31 LOG7[516:392]: 5140 bound to 127.0.0.1:514 Nothing happens on the Solaris box. When I start EventReporter, the following happens, in a continuous loop (until I stop EventReporter): 2006.06.30 10:16:26 LOG7[296:700]: 5140 accepted FD=156 from 127.0.0.1:1154 2006.06.30 10:16:26 LOG7[296:700]: Creating a new thread 2006.06.30 10:16:26 LOG7[296:700]: New thread created 2006.06.30 10:16:27 LOG7[296:1204]: 5140 started 2006.06.30 10:16:27 LOG7[296:1204]: FD 156 in non-blocking mode 2006.06.30 10:16:27 LOG5[296:1204]: 5140 connected from 127.0.0.1:1154 2006.06.30 10:16:27 LOG7[296:1204]: FD 188 in non-blocking mode 2006.06.30 10:16:27 LOG7[296:1204]: 5140 connecting 172.17.99.143:5140 2006.06.30 10:16:27 LOG7[296:1204]: connect_wait: waiting 10 seconds 2006.06.30 10:16:27 LOG7[296:1204]: connect_wait: connected 2006.06.30 10:16:27 LOG7[296:1204]: Remote FD=188 initialized 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): before/connect initialization 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write client hello A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read server hello A 2006.06.30 10:16:27 LOG5[296:1204]: VERIFY OK: depth=0, /C=CA/ST=ONTARIO/L=TORONTO/O=BANK OF MONTREAL/OU=LMG-DTS/CN=jdb2u10 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read server certificate A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read server certificate request A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read server done A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write client certificate A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write client key exchange A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write certificate verify A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write change cipher spec A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write finished A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 flush data 2006.06.30 10:16:27 LOG3[296:1204]: SSL_connect: Peer suddenly disconnected 2006.06.30 10:16:27 LOG5[296:1204]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.06.30 10:16:27 LOG7[296:1204]: 5140 finished (0 left) On the Solaris box, here is the matching entry, also in a continuous loop: 2006.06.30 10:16:47 LOG7[1214:1]: 5140 accepted FD=2 from 172.17.99.150:1155 2006.06.30 10:16:47 LOG7[1214:800]: 5140 started 2006.06.30 10:16:47 LOG7[1214:800]: FD 2 in non-blocking mode 2006.06.30 10:16:47 LOG5[1214:800]: 5140 connected from 172.17.99.150:1155 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): before/accept initialization 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 read client hello A 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 write server hello A 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 write certificate A 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 write certificate request A 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 flush data 2006.06.30 10:16:48 LOG4[1214:800]: VERIFY ERROR: depth=0, error=self signed certificate: /C=CA/ST=ONTARIO/L=TORONTO/O=BMO/OU=LMG-DTS/CN=jdb1winxp 2006.06.30 10:16:48 LOG7[1214:800]: SSL alert (write): fatal: bad certificate 2006.06.30 10:16:48 LOG3[1214:800]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2006.06.30 10:16:48 LOG5[1214:800]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.06.30 10:16:48 LOG7[1214:800]: 5140 finished (1 left) It appears the server cert is ok, but "something" is wrong with the client (Windows box) cert. Any chance you could post the command used in the "make install" to kick off the creation of the self-signed cert on Unix? I grep'd for it, but couldn't find it. Regards, John Boxall

1 0

Stunnel 4.15 cannot handle PKCS8 format private keys
by David Gillingham 29 Jun '06

29 Jun '06

In modifying stunnel to work with the OpenSSL FIPS-certified module, I found out that private keys cannot be in the default OpenSSL format; they must be in PKCS8 format (due to the MD5 algorithm being disabled in FIPS mode). Talking to Dr. Henson of the OpenSSL group I was able to convert my private keys from the default format to PKCS8, but I found that stunnel was not able to handle these keys. I got the following error output (note that server.pem contains a PKCS8 private key and a PKCS7 public cert): 2006.06.08 17:49:38 LOG7[1120:616]: Certificate: server.pem 2006.06.08 17:49:38 LOG7[1120:616]: Key file: server.pem 2006.06.08 17:49:42 LOG3[1120:616]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2006.06.08 17:49:42 LOG3[1120:616]: error stack: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib 2006.06.08 17:49:42 LOG3[1120:616]: error stack: 2306A075 : error:2306A075:PKCS12 routines:PKCS12_DECRYPT_D2I:pkcs12 pbe crypt error 2006.06.08 17:49:42 LOG3[1120:616]: error stack: 23077073 : error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error 2006.06.08 17:49:42 LOG3[1120:616]: SSL_CTX_use_RSAPrivateKey_file: 6074079: error:06074079:digital envelope routines:EVP_PBE_CipherInit:unknown pbe algorithm 2006.06.08 17:49:42 LOG3[1120:616]: Server is down Continuing with Dr. Henson, he informed me that this ssl error output meant that "the PBE table has not been initialized in the application". I corrected this by adding a call to OpenSSL_add_all_algorithms() into ssl_init() in ssl.c. This fixed my error with the PEM files. I am posting this so that this bug may be fixed for the next stunnel release. Additionally, I'd like verification that my fix makes sense given the structure of the stunnel code. From doing some searches in the stunnel source, I could not find any existing code that initialized the PBE table so adding the call to ssl_init() made sense _to me_. Michal: do you agree?

2 1

Expired certificate?
by Boxall, John 29 Jun '06

29 Jun '06

Michal, et al, When attempting to connect from a Windows box to a Solaris box (as the server), the Solaris stunnel log (debug = 7) shows that the certificate on the Windows box (included with the download) has expired. I can connect from a Solaris 9 client box with no problems. The Solaris box is running as an NTP client to an internal NTP server. The Windows box isn't logged into a domain, but the time is within 5 minutes of the Solaris box. Solaris server: Solaris 9 (2004/09, no patches) OpenSSL 0.9.8a Stunnel 4.15 Application: Syslog-ng 1.6.11 (working fine on a client Solaris 9 box) Windows client: Windows XP Stunnel 4.15 Application: EventReporter 8.0.268/8.0.219 stunnel.conf: (borrowed and modified from a Solaris client box) ; ;CLIENT-ONLY stunnel configuration file ; client = yes cert = C:\Program Files\stunnel\stunnel.pem-client-certificate CAfile = C:\Program Files\stunnel\stunnel.pem-server-certificate ;chroot = /var/run/stunnel ;pid = /usr/local/var/run/stunnel/stunnel.pid ;setuid = stunnel ;setgid = stunnel verify = 3 ;foreground = yes debug = 7 output = C:\Program Files\stunnel\stunnel.log [5140] accept = 127.0.0.1:514 connect = 192.168.0.143:5140 If the certificate has truly expired, could you post a new one? If not, any suggestions? Regards, John Boxall

2 1

Re: [stunnel-users] patch to build stunnel 4.15 with VS2005
by David Gillingham 29 Jun '06

29 Jun '06

Surely. Here are the contents of the patch file for vs.mak. >cat 4.15-MSVC2005.patch diff -cr stunnel-4.15-orig/src/vc.mak stunnel-4.15/src/vc.mak *** stunnel-4.15-orig/src/vc.mak Sat Jan 21 10:17:32 2006 --- stunnel-4.15/src/vc.mak Thu Jun 29 17:31:43 2006 *************** *** 1,2 **** ! # makefile for VC is not ready... --- 1,42 ---- ! # Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2006 ! # ! # Modified by David Gillingham (dgillingham(a)gmail.com) for Visual ! # Studio + # Modify this to point to your actual openssl compile directory + # (You did already compile openssl, didn't you???) + SSLDIR=..\openssl-0.9.7j + + OBJS=stunnel.obj ssl.obj ctx.obj file.obj client.obj protocol.obj \ + sthreads.obj log.obj options.obj network.obj resolver.obj \ + gui.obj + + CC=cl + CFLAGS=-MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo \ + -I"$(SSLDIR)\inc32" $(DEFINES) + DEFINES=-DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE \ + -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO \ + -DHAVE_GETNAMEINFO -D_MBCS + + LINK=link + LDFLAGS=-INCREMENTAL:NO -NOLOGO -SUBSYSTEM:WINDOWS -OPT:REF \ + -OPT:ICF -LTCG -MACHINE:X86 -ERRORREPORT:PROMPT + LIBS=-LIBPATH:"$(SSLDIR)\out32dll" wsock32.lib ssleay32.lib \ + libeay32.lib user32.lib gdi32.lib shell32.lib comdlg32.lib \ + advapi32.lib + + all: stunnel.exe + + clean: + del $(OBJS) resources.res + del *.manifest + del stunnel.exe + + stunnel.exe: $(OBJS) resources.res + $(LINK) $(LDFLAGS) $(LIBS) -OUT:$@ $** + IF EXIST $@.manifest mt -nologo -manifest $@.manifest -outputresource:$@;1 + + resources.res: resources.rc resources.h stunnel.ico + rc -fo $@ resources.rc + + $(OBJS): *.h vc.mak On 6/29/06, Michal Trojnara <Michal.Trojnara(a)mobi-com.net> wrote: > > That's possible. Could you prepare a patch with a minimal set of > changes (not including anything needed to build those Unix-specific files?).

1 0

patch to build stunnel 4.15 with VS2005
by David Gillingham 29 Jun '06

29 Jun '06

All-- I have created a patch that will allow stunnel 4.15 to be built with Visual Studio 2005's command line environment. I have only tested it with VS2k5, but it should work for all Visual Studio .NET versions (that is, VS 7.0 or later). After you apply this patch to the source tree, you will need to run the makefile from a Visual Studio Command prompt (Start->Programs->Visual Studio->Visual Studio Tools->Visual Studio Command Prompt). From there, change the working directory to the stunnel\src folder and execute the command "nmake -f vs.mak all". After the build process has completed, you will have a working stunnel.exe. This patch will modify vc.mak to a working makefile for nmake (mimicing the basic structure of mingw.mak), common.h to include a couple missing headers for the I/O functions in pty.c, and env.c to include the winsock headers under the Win32 environment (replicating how it was done in common.h). This patch that is a result of internal testing/development I've done here at work and am releasing it to this list (and the stunnel developers) so that these changes could possibly be included in future stunnel releases. To the stunnel devs: if there's any additional work that can be done to get this integrated by the next release, just mention it. The other day, I tried sending the patch to the list as an attachment, but my message never showed up on either the mirt.net or google groups mirrors. I can only assume it was rejected because of the attachment. What follows is the full text of my patch file. > cat 4.15-MSVC2005.patch diff -cr stunnel-4.15-orig/src/common.h stunnel-4.15/src/common.h *** stunnel-4.15-orig/src/common.h Fri Mar 10 08:54:56 2006 --- stunnel-4.15/src/common.h Fri Jun 23 21:41:00 2006 *************** *** 153,158 **** --- 153,164 ---- #endif #include <windows.h> + /* include Visual Studio headers needed for I/O manipulation */ + #ifdef _MSC_VER + #include <io.h> + #include <fcntl.h> + #endif + #define ECONNRESET WSAECONNRESET #define ENOTSOCK WSAENOTSOCK #define ENOPROTOOPT WSAENOPROTOOPT diff -cr stunnel-4.15-orig/src/env.c stunnel-4.15/src/env.c *** stunnel-4.15-orig/src/env.c Sat Jan 7 13:47:36 2006 --- stunnel-4.15/src/env.c Mon Jun 26 21:11:25 2006 *************** *** 31,45 **** /* getpeername() can't be declared in the following includes */ #define getpeername no_getpeername #include <sys/types.h> #include <sys/socket.h> /* for AF_INET */ #include <netinet/in.h> #include <arpa/inet.h> /* for inet_addr() */ #include <stdlib.h> /* for getenv() */ #ifdef __BEOS__ #include <be/bone/arpa/inet.h> /* for AF_INET */ #include <be/bone/sys/socket.h> /* for AF_INET */ - #else - #include <sys/socket.h> /* for AF_INET */ #endif #undef getpeername --- 31,52 ---- /* getpeername() can't be declared in the following includes */ #define getpeername no_getpeername #include <sys/types.h> + #ifdef USE_WIN32 + #ifdef _WIN32_WCE + #include <winsock.h> + #else + #include <winsock2.h> + #include <ws2tcpip.h> + #endif /* _WIN32_WCE */ + #else /* USE_WIN32 */ #include <sys/socket.h> /* for AF_INET */ #include <netinet/in.h> #include <arpa/inet.h> /* for inet_addr() */ + #endif /* USE_WIN32 */ #include <stdlib.h> /* for getenv() */ #ifdef __BEOS__ #include <be/bone/arpa/inet.h> /* for AF_INET */ #include <be/bone/sys/socket.h> /* for AF_INET */ #endif #undef getpeername diff -cr stunnel-4.15-orig/src/vc.mak stunnel-4.15/src/vc.mak *** stunnel-4.15-orig/src/vc.mak Sat Jan 21 10:17:32 2006 --- stunnel-4.15/src/vc.mak Tue Jun 27 21:02:15 2006 *************** *** 1,2 **** ! # makefile for VC is not ready... --- 1,45 ---- ! # Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2006 ! # ! # Modified by David Gillingham (dgillingham(a)gmail.com) for Visual ! # Studio ! ! # Modify this to point to your actual openssl compile directory ! # (You did already compile openssl, didn't you???) ! SSLDIR=..\..\openssl-0.9.7j ! ! DEFINES=-DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE \ ! -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO \ ! -DHAVE_GETNAMEINFO -D_MBCS ! CC=cl ! CFLAGS=-MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo \ ! -I"$(SSLDIR)\inc32" $(DEFINES) ! ! LINK=link ! LDFLAGS=-INCREMENTAL:NO -NOLOGO -SUBSYSTEM:WINDOWS -OPT:REF \ ! -OPT:ICF -LTCG -MACHINE:X86 -ERRORREPORT:PROMPT ! LIBS=-LIBPATH:"$(SSLDIR)\out32dll" wsock32.lib ssleay32.lib \ ! libeay32.lib user32.lib gdi32.lib shell32.lib comdlg32.lib \ ! advapi32.lib ! ! OBJS=stunnel.obj ssl.obj ctx.obj file.obj client.obj protocol.obj \ ! sthreads.obj log.obj options.obj network.obj resolver.obj \ ! gui.obj ! ! ! all: stunnel.exe ! ! clean: ! del $(OBJS) resources.res ! del *.manifest ! del stunnel.exe ! ! stunnel.exe: $(OBJS) resources.res ! $(LINK) $(LDFLAGS) $(LIBS) -OUT:$@ $** ! IF EXIST $@.manifest mt -manifest $@.manifest -outputresource:$@;1 ! ! resources.res: resources.rc resources.h stunnel.ico ! rc /fo $@ resources.rc ! ! $(OBJS): $*.c *.h ! $(CC) $(CFLAGS) -c $*.c

2 1

stunnel in proxy mode won't start
by Dave Hinz 28 Jun '06

28 Jun '06

I'm trying to run stunnel in proxy mode, to accept connections on port 443, and forward them to an application listening at port 9999 on the same box. I believe I have the configuration correct, but I'm obviously overlooking something. Environment: stunnel 4.15 on sparc-sun-solaris2.9 with OpenSSL 0.9.7g 11 Apr 2005 I have built an stunnel.conf file, and a stunnel.pem file which are located in the correct place with the right permissions. I verified that by moving or changing permissions and seeing that errors were produced. I've changed the debug level to 7, and the following information is displayed when I try to start stunnel: cert# stunnel 2006.06.28 13:01:14 LOG7[9088:1]: Snagged 64 random bytes from /users/dave/.rnd 2006.06.28 13:01:14 LOG7[9088:1]: Wrote 1024 new random bytes to /users/dave/.rnd 2006.06.28 13:01:14 LOG7[9088:1]: RAND_status claims sufficient entropy for the PRNG 2006.06.28 13:01:14 LOG6[9088:1]: PRNG seeded successfully 2006.06.28 13:01:14 LOG7[9088:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2006.06.28 13:01:14 LOG7[9088:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2006.06.28 13:01:14 LOG7[9088:1]: Verify directory set to / 2006.06.28 13:01:14 LOG5[9088:1]: Peer certificate location / 2006.06.28 13:01:14 LOG7[9088:1]: SSL context initialized for service test cert# Same thing if I run it as stunnel stunnel.conf -fd The prompt comes back immediately, ps -ef shows no stunnel running, and nothing is answering on port 443 which is where I'm telling it to listen: stunnel.conf file: cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/etc/stunnel # PID is created inside chroot jail pid = /pid/stunnel.pid #setuid = nobody #setgid = nogroup # Authentication stuff verify = 3 # don't forget about c_rehash CApath # it is located inside chroot jail: CApath = / # Some debugging stuff debug = 7 output = stunnel.log # Use it for client mode client = no # Service-level configuration [test] accept = 127.0.0.1:443 connect = 127.0.0.1:9999 #TIMEOUTclose = 0 ---end stunnel.conf file--- The pem files are located in the same directory as the stunnel.conf, hence the "/" for the pathname above. What am I overlooking please?

1 0

stunnel.cfg file
by Dheeraj Sehrawat 28 Jun '06

28 Jun '06

Hi All, I am looking at a problem and found the system is using stunnel with web server. From my google search I have understood that stunnel is used to make the application SSL enable. Please validate my understanding. I found following stunnel.cfg file in properties directory Port0 Enabled=0 ExternalPort=0 LocalPort=0 SSLEnabled=0 UDP=0 Port1 Enabled=1 ExternalPort=1500 LocalPort=10080 SSLEnabled=0 Port2 Enabled=0 ExternalPort=1600 LocalPort=10080 SSLEnabled=1 ------------------------------------------------------ I have the following questions: 1] what is the meaning of ExternalPort and LocalPort ? How does these ports relate with each other? Please help me in understanding this configuration file. Thanks, Dheeraj __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: enabling zlib compression
by ahall＠madasafish.com 27 Jun '06

27 Jun '06

I'd really like to get this working, but I'm not sure what other information you require? All other posts on this subject refer to making sure zlib is included when openssl is compiled. Well, I've confirmed that it is. Would a strace of stunnel attempting to start up help? FYI - The output of stunnel -version displays... stunnel 4.15 on i686-pc-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP Could someone please provide me with some suggestions. Thanks very much. On Mon, 26 Jun 2006 13:09:36 , <ahall(a)madasafish.com> sent: >OK - after checking the OpenSSL src-rpm I can confirm that zlib is compiled... > >./Configure \ > --prefix=%{_prefix} --openssldir=%{_datadir}/ssl ${sslflags} \ > zlib no-idea no-mdc2 no-rc5 no-ec shared \ > --with-krb5-flavor=MIT \ > -I%{_prefix}/kerberos/include -L%{_prefix}/kerberos/%{_lib} \ > ${sslarch} > >Any ideas why the "compression=zlib" option still produces the "Failed to add >zlib compression method" error? > >Thanks very much. > > >>On Fri, 23 Jun 2006 17:01:24 , ahall(a)madasafish.com> sent: >> >>>Hi there, >>> >>>When I try to enable zlib compression at the server I get this error when >>>starting it up... >>> >>>2006.06.23 15:44:39 LOG3[3426:3086293504]: Failed to add zlib compression method >>> >>>How do I get zlib to work? Do I need to compile OpenSSL with zlib? >>> >>>I'm using Fedora Core 3 with stunnel-4.15, and OpenSSL and zlib are from RPM's. >>> >>>Thanks very much. > >---- - Madasafish - Voted Best Heavy Consumer Broadband Provider in the 2006 Internet Industry Awards http://www.madasafish.com/ ---- - Madasafish - Voted Best Heavy Consumer Broadband Provider in the 2006 Internet Industry Awards http://www.madasafish.com/

1 0

Patch to fix compile errors under MS Visual C++ 2005
by David Gillingham 26 Jun '06

26 Jun '06

Attached is a patch for stunnel 4.15 that allows the source to be built under Microsoft Visual Studio 2005. Here's a rundown of what's been changed: In common.h, I included io.h and fcntl.h so that pty.c would build without error. In env.c, I included the winsock headers (replicating how it was done for common.h), and removed a duplicate include of sys/socket.h. The latter change wasn't necessary for compiliation with MSVC, but I thought I'd remove what looked like an unncessary line. To get stunnel to build without warning, I defined the following preprocessor definitions: USE_WIN32 _CRT_SECURE_NO_DEPRECATE _CRT_NONSTDC_NO_DEPRECATE HAVE_GETADDRINFO HAVE_GETNAMEINFO _MBCS Later in the week, I'll post a patch to vs.mak to automate the build process (I'm still building with a solution file at the moment). To the stunnel developers: If there's anything extra I can do to ensure these changes are incorporated into the next release, please let me know.

1 0