July 2008 - stunnel-users

stunnel exits silently on startup
by Luis López de Quintana 21 Jul '08

21 Jul '08

Problem: stunnel doesn't run: ldq@ldq:~$ stunnel4 /etc/stunnel.cnf ldq@ldq:~$ ps aux | grep stunnel ldq 15683 0.0 0.0 2332 1392 pts/0 S+ 11:08 0:00 man stunnel ldq 25289 0.0 0.0 1776 608 pts/1 S+ 11:59 0:00 grep stunnel stunnel.cnf: ldq@ldq:~$ cat /etc/stunnel.cnf client = yes debug = debug [nntps] accept = 127.0.0.1:1109 connect = news.giganews.com:443 Version: stunnel 4.140-5ubuntu1 libc6 ldq@ldq:~$ uname -a Linux ldq 2.6.18.5 SMP Thu May 8 01:31:23 UTC 2008 x86_64 GNU/Linux -- LdQ

2 2

Problem with Solaris 10u5 x86 and Stunnel 4.25
by Patrick Dung 19 Jul '08

19 Jul '08

Hi I use this to compile stunnel: The gcc and openssl is from Solaris SFW. # export CC=/usr/sfw/bin/gcc # ./configure --with-threads=pthread --with-ssl=/usr/sfw --localstatedir=/var After installing and starting stunnel, I found there are mutiple stunnel processes. There is a PID file which store one of the stunnel process. I have tried to kill that PID, stunnel is bring down. But there other stunnel processes running. Any ideas? Regards Patrick

1 0

Config Sanity Check
by Caplan, Michael 18 Jul '08

18 Jul '08

Hi There, I am working through an issue with a script that builds a socket connection to stunnel. Stunnel is being used to relay to an Apache web server. I'm building a localhost TCP connection on port 54322, and writing my HTTP data. When reading data back from the socket connection in my script I'm sometimes getting nothing, and other times getting the proper result. I can confirm that the web server is always receiving the request and returning a proper response. Wireshark shows SSL data being transmitted and received, so stunnel is doing its thing. However, the response does not seem to be relayed to my script on the other side of stunnel *sometimes*. My hunch is that I am doing something wrong with my script, but I am hoping that an stunnel guru can rule out any oddities with my stunnel setup. My config is below as well as the output of my log file. Any thoughts? Thanks! Mike cert = connector.pem debug = 7 output = c:\ssl.log ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [registerserver] client = yes accept =54321 connect =www.int.ddx.com:443 [connector2server] client = yes accept =54322 connect =asd.int.ddx.com:443 [server2connector] accept = 54323 connect = 9000 2008.07.18 21:41:41 LOG7[13648:13748]: Snagged 64 random bytes from C:/.rnd 2008.07.18 21:41:41 LOG7[13648:13748]: Wrote 1024 new random bytes to C:/.rnd 2008.07.18 21:41:41 LOG7[13648:13748]: RAND_status claims sufficient entropy for the PRNG 2008.07.18 21:41:41 LOG7[13648:13748]: PRNG seeded successfully 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service registerserver 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service connector2server 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service server2connector 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service test 2008.07.18 21:41:41 LOG5[13648:13748]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.18 21:41:41 LOG5[13648:13748]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.07.18 21:41:46 LOG7[13476:13096]: Snagged 64 random bytes from C:/.rnd 2008.07.18 21:41:47 LOG7[13476:13096]: Wrote 1024 new random bytes to C:/.rnd 2008.07.18 21:41:47 LOG7[13476:13096]: RAND_status claims sufficient entropy for the PRNG 2008.07.18 21:41:47 LOG7[13476:13096]: PRNG seeded successfully 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service registerserver 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service connector2server 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service server2connector 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service test 2008.07.18 21:41:47 LOG5[13476:13096]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.18 21:41:47 LOG5[13476:13096]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Please consider the environment before printing this email. E-mail messages may contain viruses, worms, or other malicious code. By reading the message and opening any attachments, the recipient accepts full responsibility for taking protective action against such code. Henry Schein is not liable for any loss or damage arising from this message. The information in this email is confidential and may be legally privileged. It is intended solely for the addressee(s). Access to this e-mail by anyone else is unauthorized.

1 0

Difference between verify level 2 and 3
by Sandeep Kumar 15 Jul '08

15 Jul '08

Hi, I searched a lot on google, in the archives, and in the FAQ page, but could not find the differences between verify levels 2 and 3, other than the one line explanation given on the FAQ/man page. Specifically, I want to ask: 1. Is verify level 3 same as 2, but asks for client certificates as well? (Seems unlikely but still..) 2. Since verify level 2 also demands CApath/CAfile to be present, then it also is ultimately verifying against locally installed certs, which is supposed to be level 3's behaviour? Thanks & regards, Sandeep Kumar http://web.iiit.ac.in/~sandeep_kr

2 2

stunnel-portforwarding
by vinod bhasi 15 Jul '08

15 Jul '08

Hi All, I am a newbie as far as stunnel is concerned. I need help urgently on how to do port forwarding with Stunnel. Any help is appreciated. Thanks and Regards, Vinod Bhasi Save all your chat conversations. Find them online at http://in.messenger.yahoo.com/webmessengerpromo.php

1 0

SSL with SMTP problem - sTunnel 4.25 Windows
by dscycler 14 Jul '08

14 Jul '08

I am using sTunnel 4.25 for Windows to send and receive e-mail from a GoldMine client. sTunnel has worked well over the years but am having an issue with a particular mail host, Live Office. They have implemented SMTP SSL on port 25. The debug log is as follows: 2008.07.14 13:45:11 LOG7[2136:5356]: smtp accepted FD=224 from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:5356]: Creating a new thread 2008.07.14 13:45:11 LOG7[2136:5356]: New thread created 2008.07.14 13:45:11 LOG7[2136:4944]: smtp started 2008.07.14 13:45:11 LOG7[2136:4944]: FD 224 in non-blocking mode 2008.07.14 13:45:11 LOG5[2136:4944]: smtp accepted connection from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:4944]: FD 232 in non-blocking mode 2008.07.14 13:45:11 LOG7[2136:4944]: smtp connecting 64.70.94.196:25 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: waiting 10 seconds 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: connected 2008.07.14 13:45:11 LOG5[2136:4944]: smtp connected remote server from 127.0.0.1:1908 2008.07.14 13:45:11 LOG7[2136:4944]: Remote FD=232 initialized 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): before/connect initialization 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): SSLv3 write client hello A 2008.07.14 13:45:11 LOG7[2136:4944]: SSL alert (write): fatal: handshake failure 2008.07.14 13:45:11 LOG3[2136:4944]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2008.07.14 13:45:11 LOG5[2136:4944]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.07.14 13:45:11 LOG7[2136:4944]: smtp finished (0 left) I am looking for help to troubleshoot the connection problem. Is this an sTunnel issue or a mail server issue? Are there conf file settings to address the issue? Thanks, DavidS

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 48, Issue 8
by Pietro Di Primo 10 Jul '08

10 Jul '08

Thank you for reply. I tryied it but it doesn't work because my client run some separated subprocesses and are them that contact the server so, if an extern process try to connect to 127.0.0.1:<the_found_port> while one of that subprocess has finished and the next is not yet started, it will be able to do it and also my subprocess will be pending (i tryed it). Hope i was able to explain the situation. Any suggestion? Thanks in advace > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 9 Jul 2008 13:26:03 +0200 (CEST) > From: "Pietro Di Primo" <pietro.diprimo(a)ct.infn.it> > Subject: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: > <2553.193.206.208.201.1215602763.squirrel(a)imapfis.ct.infn.it> > Content-Type: text/plain;charset=utf-8 > > Hi, I have a client server application, and want to tunnel it in this way: > a script select a free port in a random way, write the stunnel.conf file. > with "accept=<the_found_port>" and "connect=<my_server>" and run my client > application passing to 127.0.0.1:<the_found_port> as server address. > The problem is that i need to be sure that no other client or user can > access <the_found_port> while the application is running. > I guess that it should be possible to do it, but i wasn't able to. > > Can anybody help me? > > Thanks > > > -- > --- > > Ing. Pietro Di Primo > INFN - Istituto Nazionale di Fisica Nucleare > Grid Computing Research Area > Via S. Sofia 78 95123 CATANIA (Italy) > Voice : +39 095 378-5446/5517 > Fax. : +39 095 378 5518 > Mobile : +39 320 8591527 > E-mail : pietro.diprimo(a)ct.infn.it > Skype : pietrodiprimo > > > > ------------------------------ > > Message: 2 > Date: Wed, 9 Jul 2008 14:08:23 +0200 > From: Micha? Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: Re: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: <6ba9f1b703149916bb1a61fb68a1e377(a)mirt.net> > Content-Type: text/plain; charset="UTF-8" > > > Pietro Di Primo wrote: >> Hi, I have a client server application, and want to tunnel it in this > way: >> a script select a free port in a random way, write the stunnel.conf >> file. >> with "accept=<the_found_port>" and "connect=<my_server>" and run my > client >> application passing to 127.0.0.1:<the_found_port> as server address. >> The problem is that i need to be sure that no other client or user can >> access <the_found_port> while the application is running. >> I guess that it should be possible to do it, but i wasn't able to. > > Simply bind the specific network interface with: > accept=127.0.0.1:<the_found_port> > > Best regards, > Mike > > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 48, Issue 8 > ******************************************** > -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

client-server tunnelling
by Pietro Di Primo 09 Jul '08

09 Jul '08

Hi, I have a client server application, and want to tunnel it in this way: a script select a free port in a random way, write the stunnel.conf file. with "accept=<the_found_port>" and "connect=<my_server>" and run my client application passing to 127.0.0.1:<the_found_port> as server address. The problem is that i need to be sure that no other client or user can access <the_found_port> while the application is running. I guess that it should be possible to do it, but i wasn't able to. Can anybody help me? Thanks -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

FW: how to start ??
by dominique 07 Jul '08

07 Jul '08

Hello, First time I am using stunnel. 1. The issue I had is with Altiris and Exchange. All our Exchange Servers are SSL now and Altiris is not-SSL. Altiris is reading an exchange mailbox and gives back an error : "Error receiving data from socket". So the infrastructure is composed of two servers one Altiris Server not-SSL which is attempting to communicate to an Exchange Server with SSL. The Altiris Server is trying to read the email in one mailbox hosted by an Exchange SSL Server 2. Stunnel 4.25 x86-pc-mingw32-gnu with openssl 0.9.8h 28 May 2008 3. Windows 2003 Server environment 4. stunnel -d -r 5. 2008.07.07 13:34:41 LOG7[4748:1676]: RAND_status claims sufficient entropy for the PRNG 2008.07.07 13:34:41 LOG7[4748:1676]: PRNG seeded successfully 2008.07.07 13:34:41 LOG7[4748:1676]: Certificate: stunnel.pem 2008.07.07 13:34:41 LOG7[4748:1676]: Certificate loaded 2008.07.07 13:34:41 LOG7[4748:1676]: Key file: stunnel.pem 2008.07.07 13:34:41 LOG7[4748:1676]: Private key loaded 2008.07.07 13:34:41 LOG7[4748:1676]: SSL context initialized for service pop3 2008.07.07 13:34:41 LOG5[4748:1676]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.07 13:34:41 LOG5[4748:1676]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.07.07 13:34:41 LOG5[4748:3596]: No limit detected for the number of clients 2008.07.07 13:34:41 LOG7[4748:3596]: FD 284 in non-blocking mode 2008.07.07 13:34:41 LOG7[4748:3596]: SO_REUSEADDR option set on accept socket 2008.07.07 13:34:41 LOG3[4748:3596]: Error binding pop3 to 149.142.194.230:995 2008.07.07 13:34:41 LOG3[4748:3596]: bind: Can't assign requested address (WSAEADDRNOTAVAIL) (10049) 2008.07.07 13:34:41 LOG3[4748:3596]: Server is down 6. no file gcc. Thanks, Dominique Dominique_duchemin(a)hotmail.com

1 0

Using externally signed certificate with stunnel 4
by Tim Skirvin 07 Jul '08

07 Jul '08

I've got a comodo signed SSL certificate that I'm trying to use with stunnel4 to allow secure NNTP connections from a wide variety of clients. The certificate at least partially works; if I leave 'verify' off in the stunnel.conf file, then the service runs and users can connect, albeit while still having to verify the cert. But if I turn 'verify' on, then it doesn't work on *either* side. I've tried playing with CAfile and CApath without much luck. I'll attach my configuration files, the relevant pems, and some debugging information; is there something else I'm missing? I've already contacted comodo, and after several rounds of conversation they suggest I contact the list. Errors from the client side (note that I'm using a debug port here): + openssl s_client -connect news:565 -verify -debug verify depth is 0 CONNECTED(00000003) depth=2 /C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority verify error:num=19:self signed certificate in certificate chain verify return:0 6976:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:951: ...and on the server, I get this: 2008.06.30 14:08:38 LOG7[10039:47679267941088]: nntps accepted FD=7 from 171.64.19.111:56122 2008.06.30 14:08:38 LOG7[10039:1073809760]: nntps started 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 7 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 8 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 9 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:47679267941088]: Cleaning up the signal pipe 2008.06.30 14:08:38 LOG6[10039:47679267941088]: Child process 10247 finished with code 0 2008.06.30 14:08:38 LOG7[10039:1073809760]: Connection from 171.64.19.111:56122 permitted by libwrap 2008.06.30 14:08:38 LOG5[10039:1073809760]: nntps connected from 171.64.19.111:56122 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): before/accept initialization 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 read client hello A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write server hello A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write certificate A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write certificate request A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 flush data 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL alert (read): fatal: unknown CA 2008.06.30 14:08:38 LOG3[10039:1073809760]: SSL_accept: 14094418: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca 2008.06.30 14:08:38 LOG5[10039:1073809760]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.06.30 14:08:38 LOG7[10039:1073809760]: nntps finished (0 left) Basic Requested Information that wasn't supplied above: * stunnel 4.18-2 on Debian etch (2.6.18-6-686 #1 SMP) * Running standalone with '/usr/bin/stunnel4 /etc/news/stunnel.conf' * libc6, no gcc, OpenSSL 0.9.8c-4etch3 * The log on startup: 2008.06.30 14:00:15 LOG7[26276:3083523776]: Snagged 64 random bytes from /root/.rnd 2008.06.30 14:00:15 LOG7[26276:3083523776]: Wrote 1024 new random bytes to /root/.rnd 2008.06.30 14:00:15 LOG7[26276:3083523776]: RAND_status claims sufficient entropy for the PRNG 2008.06.30 14:00:15 LOG7[26276:3083523776]: PRNG seeded successfully 2008.06.30 14:00:15 LOG7[26276:3083523776]: Configuration SSL options: 0x01000000 2008.06.30 14:00:15 LOG7[26276:3083523776]: SSL options set: 0x01000000 2008.06.30 14:00:15 LOG7[26276:3083523776]: Certificate: /etc/ssl/certs/news-stunnel.pem 2008.06.30 14:00:15 LOG7[26276:3083523776]: Certificate loaded 2008.06.30 14:00:15 LOG7[26276:3083523776]: Key file: /etc/ssl/private/news-stunnel.key 2008.06.30 14:00:15 LOG7[26276:3083523776]: Private key loaded 2008.06.30 14:00:15 LOG7[26276:3083523776]: Loaded verify certificates from /etc/ssl/certs/comodo.cert 2008.06.30 14:00:15 LOG7[26276:3083523776]: SSL context initialized for service nntps - Tim Skirvin (tskirvin(a)stanford.edu) -- Information Technology Services http://www.stanford.edu/~tskirvin/ System Software Developer, Unix Team Stanford University

1 1