December 2007 - stunnel-users

'PIN' engine control command
by Ludolf Holzheid 14 Dec '07

14 Dec '07

Dear list, I'm trying to use stunnel on Windows with an USB token (`CryptoMate' from ACS). However, I can't manage to make stunnel ask for the token PIN: o Loading the private key works if I specify the PIN in the configuration file (`engineCtrl = PIN:...'). o If there is no `PIN' engine control option in the configuration file, loading the private key fails. The log message are: error stack: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error stack: 800050A0 : error:800050A0:Vendor defined:PKCS11_login:PIN incorrect Do I have to add a special engine control option to the configuration file in order to get asked for the PIN or is it intended to `just work'? Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

2 2

rtmps with stunnel on linux
by David Schulberg 14 Dec '07

14 Dec '07

Hi, Cannot get rtmps working with Firefox (IceWeasel) on Linux. I have rtmps working fine with Firefox and IE on Windows XP. The error I see in stunnel (see below) when I try rtmps through a Linux browser is "peer suddenly disconnected". Also curious that there are 2 attempts made. 2007.12.13 16:31:41 LOG7[2624:1192]: https accepted FD=212 from 124.190.241.7:59728 2007.12.13 16:31:41 LOG7[2624:1192]: Creating a new thread 2007.12.13 16:31:41 LOG7[2624:1192]: New thread created 2007.12.13 16:31:41 LOG7[2624:2576]: https started 2007.12.13 16:31:41 LOG7[2624:2576]: FD 212 in non-blocking mode 2007.12.13 16:31:41 LOG7[2624:2576]: TCP_NODELAY option set on local socket 2007.12.13 16:31:41 LOG5[2624:2576]: https accepted connection from 124.190.241.7:59728 2007.12.13 16:31:41 LOG7[2624:2576]: SSL state (accept): before/accept initialization 2007.12.13 16:31:41 LOG3[2624:2576]: SSL_accept: Peer suddenly disconnected 2007.12.13 16:31:41 LOG5[2624:2576]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.12.13 16:31:41 LOG7[2624:2576]: https finished (0 left) 2007.12.13 16:31:41 LOG7[2624:1192]: https accepted FD=236 from 124.190.241.7:59729 2007.12.13 16:31:41 LOG7[2624:1192]: Creating a new thread 2007.12.13 16:31:41 LOG7[2624:1192]: New thread created 2007.12.13 16:31:41 LOG7[2624:2572]: https started 2007.12.13 16:31:41 LOG7[2624:2572]: FD 236 in non-blocking mode 2007.12.13 16:31:41 LOG7[2624:2572]: TCP_NODELAY option set on local socket 2007.12.13 16:31:41 LOG5[2624:2572]: https accepted connection from 124.190.241.7:59729 2007.12.13 16:31:41 LOG7[2624:2572]: SSL state (accept): before/accept initialization 2007.12.13 16:31:41 LOG3[2624:2572]: SSL_accept: Peer suddenly disconnected 2007.12.13 16:31:41 LOG5[2624:2572]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.12.13 16:31:41 LOG7[2624:2572]: https finished (0 left) Regards, David Schulberg

1 0

Re: [stunnel-users] * lencoboy Stunnel client and Centos 5 Apache
by Luis Rodrigo Gallardo Cruz 12 Dec '07

12 Dec '07

[Again, please send your responses to the list.] On Wed, Dec 12, 2007 at 06:18:58PM +0000, Mario Neè wrote: > > On Wed, Dec 12, 2007 at 05:00:08PM +0000, Mario Neè wrote: > > > > From: rodrigo(a)nul-unu.com > > > > This takes what is sent to local port 1443, encrypts it, and sends it > > > > like that to the remote 192.168.x.x:443 This means that the remote > > > > Apache needs to be listening on port 443 with ssl enabled there. Is > > > > this what you wanted? > > > > > > yes it's what i want. > > > > > > > Ok. Then I'd guess the problem is that apache is not expecting SSL on > > port 443. Read up on how to enable it. I'd guess a good start is > > http://httpd.apache.org/docs/2.0/mod/mod_ssl.html > > > if i try to connect to 192.168.x.x:443 with firefox everything > works, only with stunnel i get that error Do you try to connect with http://192.168.x.x:443 or with https://192.168.x.x:443 (note the 's')? -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

Re: [stunnel-users] * lencoboy Stunnel client and Centos 5 Apache
by Luis Rodrigo Gallardo Cruz 12 Dec '07

12 Dec '07

[Please, respond to the list, not to the private mail of whoever answers you.] On Wed, Dec 12, 2007 at 05:00:08PM +0000, Mario Neè wrote: > > From: rodrigo(a)nul-unu.com > > On Wed, Dec 12, 2007 at 09:36:35AM +0000, Mario Neè wrote: > > > i'm trying to connect a stunnel client to the welcome page of Apache > > > in Centos 5 (Fresh install with no changes to Apache conf). > > > > > > command to create a client (on Feisty Fawn Ubuntu): > > > sudo stunnel -c -d 1443 -r 192.168.x.x:443 > > > > This takes what is sent to local port 1443, encrypts it, and sends it > > like that to the remote 192.168.x.x:443 This means that the remote > > Apache needs to be listening on port 443 with ssl enabled there. Is > > this what you wanted? > > yes it's what i want. > Ok. Then I'd guess the problem is that apache is not expecting SSL on port 443. Read up on how to enable it. I'd guess a good start is http://httpd.apache.org/docs/2.0/mod/mod_ssl.html -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

newbie config not running
by fuzzy_4711 12 Dec '07

12 Dec '07

Hello list. I am new to stunnel and do have some problems to get it running. The server is a WinXPSP2 behind a router. The router has port forwarding enabled for port 9999 to the stunnel server (4.21). On the same box a vnc server is running on port 5900 which I like to tunnel. Firewall is opened. The netstat -a -n shows the server listening on the desired port (9999). My server config looks like that: cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [VNC Server] accept = 9999 connect = 5900 The client side is a linux box with config setting: client = yes [VNC Server] accept = 5900 connect = 9999 I turned on debugging and stunnel.log seems to be okay - no error messages. But I am not able to get an connection. What am I doing wrong? Stefan

5 8

* lencoboy Stunnel client and Centos 5 Apache
by Mario Neè 12 Dec '07

12 Dec '07

Hello, i'm trying to connect a stunnel client to the welcome page of Apache in Centos 5 (Fresh install with no changes to Apache conf). command to create a client (on Feisty Fawn Ubuntu): sudo stunnel -c -d 1443 -r 192.168.x.x:443 if i try to connect to http://localhost:1443 and a look in /var/log/syslog i see this error: SSL_connect: error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression. _________________________________________________________________ Ti piace giocare con le lettere? Prova ABCLive! http://messengergiochi.it.msn.com/

2 1

server reads ecrypted data on connect ?
by Nikolaj G. 10 Dec '07

10 Dec '07

Hello stunnel'ers, First of all - im a newbie into openssl and stunnel. Im trying to stunnel between my own java socket server and client. The stunnel is established, but the server reads encrypted data on connect. Since I dont send anything, Im surprised to see encrypted data in the server log. Could someone please help. Ive managed to create a root certificate, a request and signing it, using: http://www.eclectica.ca/howto/ssl-cert-howto.php Thanks in advance. /nikolaj PS see configuration below: ----------------------------------------------- Packages (Fedora Core 6): openssl-devel-0.9.8b-15.fc6 openssl-0.9.8b-15.fc6 stunnel-4.15-2 ----------------------------------------------- The SERVER stunnel.conf: ; Certificate/key is needed in server mode CAfile = /root/ssl/cacert.pem cert = /root/ssl/key-cert.pem pid = /root/ssl/stunnel.pid ; Some debugging stuff useful for troubleshooting debug = 7 foreground=yes #setuid = stunnel #setgid = stunnel [mystunnel] accept = ratata.cirque.dk:998 connect = 127.0.0.1:8200 ----------------------------------------------- The CLIENT stunnel.conf: ; Certificate/key is needed in server mode CAfile = /root/ssl/eclectica/cacert.pem pid = /root/ssl/eclectica/stunnel.pid ; Some debugging stuff useful for troubleshooting debug = 7 foreground=yes ; enable client mode client = yes [mystunnel] accept = 127.0.0.1:998 connect = ratata.cirque.dk:8200 ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

HTTPS hardcoded redirects
by Ezio Ostorero 10 Dec '07

10 Dec '07

All, I have a problem similar to the one described in http://mirt.net/pipermail/stunnel-users/2006-October/001324.html i.e. I ***wish*** to use the recording functionalities of JMeter while accessing an apache-SSL-secured Tomcat web server. JMeter does not allow recording on SSL so I have to ... un-cipher my HTTPS sessions, stunnel looks like the right choice. Being an stunnel newbie, I started here: http://www.stunnel.org/examples/https_client.html , this HOWTO looks quite close to my configuration. We have a plain-vanilla tomcat server behind an apache/SSL, and I want to access this web application from an HTTP-only browser. So, I configure stunnel as a "client", I run it on my PC, with the following configuration: [psuedo-https] accept = 8080 connect = <server>:443 TIMEOUTclose = 0 I read it as follows: stunnel talk cleartext HTTP on the local 8080 port and forwards in crypted HTTPS on the <server> port 443 I set the URL in my browser to http://localhost:8080/oi/ and this happens: 1) Ethereal sez that my PC and <server> start an SSLv3 conversation, good, we're on track 2) I have an HTTP analyzer plugged in my browser that shows me the content of the first GET that is a redirect to an SSO server (on the same <server>:443 port) for user authentication https://<server>/ssoserver/login?service=...... 3) My browser then issue a GET to https://<server>/ssoserver/login?service=...... and is GAME OVER, my beloved stunnel is cleanly bypassed by the hardcoded https://<server>/ string Any suggestion? Is it a dead end? Any dirty trick I could play with? Such as running multiple stunnel instances, setting <server> = localhost in my hosts file etc.? Thanks, Ezio -- Ezio Ostorero, Catania Seltz e limone col sale. Arriminatu, non annacatu

1 0

Re: [stunnel-users] Problem compiling win32 stunnel.exe v 4.21
by butterspoon＠gmail.com 09 Dec '07

09 Dec '07

On 09/12/2007, Luis Rodrigo Gallardo Cruz <rodrigo(a)nul-unu.com> wrote: > On Sun, Dec 09, 2007 at 11:30:01PM +0000, Hidden wrote: > > Okay, so I'm trying to build stunnel.exe (ver 4.21) under Debian Linux > > 2.6.22.1 as a prelude to applying some patches and I'm getting > > stuck. > > Just to make sure I understand: You are trying to build *for* windows > *in* Debian. Yup, just like the documentation (INSTALL.W32) says: 1) install mingw32 cross-compiler o a Unix/Linux machine (native compilation on a Windows machine is possible, but not supported) [...] 5) type "make stunnel.exe" > You seem to be mixing up (the names of) unix libs with windows ones. Well, something is. I'm just doing it by the book! > Anyways, would it not be easier to compile in windows? Anyone else here build stunnel.exe? What did you use? T

1 0

Problem compiling win32 stunnel.exe v 4.21
by Hidden 09 Dec '07

09 Dec '07

Okay, so I'm trying to build stunnel.exe (ver 4.21) under Debian Linux 2.6.22.1 as a prelude to applying some patches and I'm getting stuck. I've followed the instructions in the makefile – Install mingw32; compile and install openssl; unpack and make stunnel.exe. mingw makes a bunch of object files for a while, but then at the link stage it bombs with i586-mingw32msvc/bin/ld: cannot find -lzdll make was when trying to execute the command: i586-mingw32msvc-gcc -s -o stunnel.exe file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -L/usr/src/openssl-0.9.8g -lzdll -leay32 -lssl32 -lws2_32 -lgdi32 -mwindows eay32 is nowhere to be found either. It and ssl32 are clearly related to openssl, but I can't see any suitable files in either the openssl build directory (/usr/src/openssl-0.9.8g as advertised). zdll could be something to do with zlib (which I have, ver 1.2.3) and eay32 and ssl32 are obviously related to openssl, but the only libraries under openssl are libssl.a and libcrypto.a (although optimistically trying to bolt in libssl in place of ssl32 doesn't work). ws2_32 and gdi32 are windows sockets and GDI, for what it's worth. I can't find the required libs on the internet anywhere, and maybe it's all down to me being a novice with mingw. I do notice the tantalizingly named files zlib1.dll, libeay32.dll, and libssl32.dll in the precompiled Windows binary distribution of stunnel, but surely I can't use them in any way? I'd love some help from anyone who knows this system better! Thanks, Tony

2 1