June 2012 - stunnel-users

socket status
by Dee Ayy 20 Jun '12

20 Jun '12

My socket in Eiffel will report that it is connected, but when it tries to write to the socket, it will fail and report Connection reset by peer I/O error The syslog shows 1) ... accepted connection from 127.0.0.1:.. 2) connect_blocking: getsockopt A_REMOTE_IP:A_REMOTE_PORT: Connection refused (111) 3) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket I believe that my socket is connecting locally fine 127.0.0.1:.. in step 1, and then the remote connection via stunnel is failing in step 2, but I have tried to write to the socket in between steps 1 and 2. Is this proper behavior? How can I know the status of the remote connection? Wait a while and then test? Is the socket state really just the state of the local stunnel connection? Should stunnel report a different state (as seen by my socket) until it determines the remote socket state?

1 0

What version of stunnel am I using?
by Dee Ayy 20 Jun '12

20 Jun '12

I don't see a version here stunnel -version 2012.06.20 16:44:05 LOG7[25078:3074172608]: RAND_status claims sufficient entropy for the PRNG 2012.06.20 16:44:05 LOG7[25078:3074172608]: PRNG seeded successfully 2012.06.20 16:44:05 LOG3[25078:3074172608]: /etc/stunnel/stunnel.pem: No such file or directory (2) apt-cache search stunnel on Ubuntu has stunnel4

1 0

Error connecting through IE6
by Karl Kloppenborg 15 Jun '12

15 Jun '12

Hey Stunnel guys! I've got a bit of an issue in which users on ie6 cannot connect through HTTPs to my haproxy cluster, they get a 404 page cannot be displayed. Works fine in all other browsers ;) The logs from Stunnel are: 2012.06.13 01:06:09 LOG7[28347:47884616028640]: local socket: FD=14 allocated (non-blocking mode) 2012.06.13 01:06:09 LOG7[28347:47884616028640]: Service incoming-https accepted FD=14 from [ClientIP]:1208 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https started 2012.06.13 01:06:09 LOG7[28347:1078843712]: Option TCP_NODELAY set on local socket 2012.06.13 01:06:09 LOG7[28347:1078843712]: Waiting for a libwrap process 2012.06.13 01:06:09 LOG7[28347:1078843712]: Acquired libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Releasing libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Released libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https permitted by libwrap from [ClientIP]:1208 2012.06.13 01:06:09 LOG5[28347:1078843712]: Service incoming-https accepted connection from [ClientIP]:1208 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): before/accept initialization 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read client hello A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write server hello A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write certificate A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write server done A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 flush data 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read client key exchange A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read finished A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write change cipher spec A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write finished A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 flush data 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 items in the session cache 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client connects (SSL_connect()) 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client connects that finished 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client renegotiations requested 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 server connects (SSL_accept()) 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 server connects that finished 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 server renegotiations requested 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 session cache hits 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 external session cache hits 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 session cache misses 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 session cache timeouts 2012.06.13 01:06:09 LOG6[28347:1078843712]: SSL accepted: new session negotiated 2012.06.13 01:06:09 LOG6[28347:1078843712]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2012.06.13 01:06:09 LOG7[28347:1078843712]: remote socket: FD=15 allocated (non-blocking mode) 2012.06.13 01:06:09 LOG6[28347:1078843712]: connect_blocking: connecting [HAPROXY IP]:81 2012.06.13 01:06:09 LOG7[28347:1078843712]: connect_blocking: s_poll_wait [HAPROXY IP]:81: waiting 10 seconds 2012.06.13 01:06:09 LOG5[28347:1078843712]: connect_blocking: connected [HAPROXY IP]:81 2012.06.13 01:06:09 LOG5[28347:1078843712]: Service incoming-https connected remote server from [HAPROXY IP]:55823 2012.06.13 01:06:09 LOG7[28347:1078843712]: Remote FD=15 initialized 2012.06.13 01:06:09 LOG7[28347:1078843712]: Option TCP_NODELAY set on remote socket 2012.06.13 01:06:09 LOG5[28347:1078843712]: Error detected on SSL (read) file descriptor: Connection reset by peer (104) 2012.06.13 01:06:09 LOG5[28347:1078843712]: Connection reset: 0 bytes sent to SSL, 320 bytes sent to socket 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https finished (0 left) 2012.06.13 01:06:09 LOG7[28347:1078843712]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) Could stunnel be at play here or am I looking at the wrong thing? Thanks! Karl. Karl Kloppenborg Programming Ninja Crucial Paradigm Pty Ltd Suite 1 Level 3 104-106 Commonwealth St Surry Hills NSW 2010 Australia 1300 884 839 - Sales & Support (AU Only) <https://support.crucialp.com/> Click here for the Support Desk d: 02 8202 9994 f: 02 92818261 m: 0416 236 908 e: <mailto:karl@crucial.com.au> karl(a)crucial.com.au Crucial Paradigm is a leading Web Hosting provider that specialises in Cloud solutions. We are commited to keeping our planet green, please reduce, reuse and recycle your office paper. Description: crucial_2012

2 3

Stunnel 4.53 for win32 - without config file
by Ivanko B 14 Jun '12

14 Jun '12

How to bypass reading any config file so that all needed options were fed from command line ? (security reasons)

5 7

Re: [stunnel-users] Getting Stunnel to Work Under Windows 7 64-bit
by Brian Wilkins 14 Jun '12

14 Jun '12

I should note that I have been running stunnel 4.45 on Windows 7 since Oct-2011 with no problems whatsoever. It has been running non-stop on Windows 7 to this date with no problems. I have not upgraded to the latest because I have not been able to have time to test the FIPS changes with my configuration yet. Brian

4 6

stunnel version 4.53 says SSL server needs a certificate on Windows 7?
by Wayne Walter 13 Jun '12

13 Jun '12

I have been using stunnel previous versions just fine. It didn't apparently have the feature of a certificate in SSL server mode. That's alright but not necessary for us as we're simply running a localhost server to tunnel to the remote server. Anyway, I have read the FAQ tutorial and such related to this and tried everything. No mater what I do with the cert or key settings it still gives this same error here's the complete output.... No limit detected for the number of clients stunnel 4.53 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from C:/.rnd Wrote 0 new random bytes to C:/.rnd PRNG seeded successfully Initializing service section [FIX] Section FIX: SSL server needs a certificate Server is down And here is the stunnel.conf file contents: ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [FIX] accept = 127.0.0.1:5679 connect = 216.52.236.112:5680 TIMEOUTconnect = 5 [FIXLIVE] accept = 127.0.0.1:5680 connect = 216.52.236.185:51581 TIMEOUTconnect = 5 Please not that stunnel came installed with an stunnel.pem file. I tried uncommenting the config line for the key. Also regenerated the key using openssh per instructions. I tried using absolute path to the cert file. Nothing makes any difference. Is this a defect in stunnel? Or am I doing something wrong?

2 1

Re: [stunnel-users] Log rollover
by Michael Curran 11 Jun '12

11 Jun '12

Windows our linux? Linux just add the log file location to the file that are part of rotate.d and thats solved daily. Sent from my Verizon Wireless 4GLTE smartphone. From : Brian Wilkins Subject : [stunnel-users] Log rollover I have noticed my stunnel log has reached 100MB on an unmanned system. Is there an option to cause the stunnel log to rollover and delete the old log file after a pre-defined period of time? If not, I can try adding it to log.c. Brian -----Original Message----- From: Brian Wilkins Sent: 6/11/2012 3:48:22 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Log rollover I have noticed my stunnel log has reached 100MB on an unmanned system. Is there an option to cause the stunnel log to rollover and delete the old log file after a pre-defined period of time? If not, I can try adding it to log.c. Brian

2 1

Log rollover
by Brian Wilkins 11 Jun '12

11 Jun '12

I have noticed my stunnel log has reached 100MB on an unmanned system. Is there an option to cause the stunnel log to rollover and delete the old log file after a pre-defined period of time? If not, I can try adding it to log.c. Brian

1 0

Using stunnel with Brother MFC-8890
by Scott McKeown 08 Jun '12

08 Jun '12

Hi Rolando, Can you please give us a bit more detail. What have you tried doing? How is your network setup? Whats your current STunnel Configuration file settings? Hopefully with this information we should be able to assist. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

1 0

Using stunnel with Brother MFC-8890
by Rolando Pineda 07 Jun '12

07 Jun '12

Hi, Someone can help me to use stunnel and set up my Brother MFC-8890 to send email through SSL using the stunnel? Thanks in advanced. -- Saludos, _____________ Rolando Pineda

1 0