- stunnel-users - stunnel.org

HTTPS Connect patches for 4.20
by Gym Crazy 28 Jun '07

28 Jun '07

Hi Folks Wonder if you can help me. A predecessor of mine set up stunnel version 4.05 on OpenBSD 3.8. He didn't leave much documentation unfortunately. He also used a patch and re-compiled it. That patch was connect-proxy.mwald.patch. We are getting some performance issues and want to of course move to the latest stable stunnel release 4.20, before asking for any help but we are in a bit of a bind. We are firstly not sure if there is an updated connect-proxy.mwald.patch that works well with stunnel 4.20 (I have searched and searched but can't seem to find any). Or else if there is a patch that performs the same type of function as connect-proxy.mwald.patch but that is stable to use with stunnel 4.20. Any help would be greatly appreciated :-D Regards Paul H ____________________________________________________________________________________ Looking for a deal? Find great prices on flights and hotels with Yahoo! FareChase. http://farechase.yahoo.com/

1 0

Certificates and public/private keys
by Dario Teixeira 26 Jun '07

26 Jun '07

Dear Stunnel users, I have a webserver running on a machine behind a firewall. I can easily punch a hole on the firewall, allowing any user on the Internet to access the webserver. However, I want to restrict access *only* to some people, those in possession of a secret key. At first sight, this seems like a job for plain ssh tunneling rather than stunnel, but as far as I understand it, ssh tunnels require that the connecting users have an account on the server machine. That won't happen here. It seems that stunnel is therefore more appropriate for this particular problem. Now, the port forwarding mechanics seem similar to those in ssh. I have no problems understanding those. The only problems I am having are figuring out the generation of keys. My excuses if I am using a terminology based on ssh or if I am way off about the capabilities of stunnel, but how can I generate the server's private and public keys? (the latter to be handed out to the clients) I have followed the instructions in the README.Debian file that accompanies the Debian stunnel4 package to produce a stunnel.pem certificate. With it, I have successfully established a stunnel connection between two machines. However, I have to use the same stunnel.pem file on both the client and the server, which strikes me as dangerous. Which parts are really needed on the client and server? Thanks in advance for your help! Cheers, Dario ___________________________________________________________ Yahoo! Answers - Got a question? Someone out there knows the answer. Try it now. http://uk.answers.yahoo.com/

2 1

Preferred way to start stunnel @boot time
by Van 26 Jun '07

26 Jun '07

So I've got stunnel running perfectly on my linux server to forward ssl requests to my pop and imap ports. I need to make sure this happens automatically if the machine is rebooted. On the stunnel site it talks about running stunnel either as a daemon or running stunnel out of xinetd. I was just wondering, which way do people using it out there think is preferable? And why? Neither seems as direct or simple as putting @reboot root /sbin/start_stunnel into my crontab, which is what I did (start_stunnel being a shell script with the proper command and some comments). Just another uneventful way to do the same thing? -Van

2 1

Java Applet Client for STUNNEL-fronted server
by Richard's Hotmail 21 Jun '07

21 Jun '07

Hi, I'm new to the list and apologize if this question is inappropriate, or quite basic, but I really hope someone can help. I currently have an intranet-resident JAVA Applet that connects back to the Application Server via standard TCP/IP sockets using the java.net.Socket class, and everything is peachy. What I'm looking at doing now is making it Internet friendly by providing host authentication (don't care about client authentication at the mo) and strong cryptography between client and server. OpenSSL and Stunnel (I don't want to have to make the Application Server SSL compatible if I don't have to) are available on the server box therefore I would dearly love an example of a JAVA client that can talk javax.net.SSL (or something else) to a Stunnel-fronted server. (Less is definitely more here - The least number of client keys and or certificate-generations the better!) Can anyone please help me with this? Obviously example-code would be ideal, as would first-hand accounts of the trials and tribulations, but I'll certainly settle for web-references to the appropriate docs or other relevant material! Are all the JSSE libraries/code reqd bundled with the JDK and runtime JVM ready? Is there a better way? (Sadly IPsec is not an option here) Maybe there's an alternate solution that can preserve the client's true IP address and present it to the Application Server's "Listen"? Cheers Richard Maher

1 0

Re: [stunnel-users] Trying to get stunnel to work for forwarding pop3sto ipop3 port
by Van 21 Jun '07

21 Jun '07

Getting closer. I now get- [van@mailserver ]$ sudo stunnel /usr/local/etc/stunnel/stunnel.conf localhost:ipop3 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem But that doesn't make sense to me. mail.pem permissions are the same as my cert's and it works fine. [van@mailserver change_passwd]$ ls -al /usr/local/etc/stunnel/mail.pem -rw-r--r-- 1 root root 2942 Jun 20 18:21 /usr/local/etc/stunnel/ mail.pem [van@mailserver change_passwd]$ ls -al /etc/httpd/certs/www.crt -rw-r--r-- 1 root root 1074 Jun 1 12:30 /etc/httpd/certs/www.crt Is the error misleading? Or what should the mail.pem perms be? Van On Jun 20, 2007, at 9:33 PM, Kevin Cook wrote: > > If you are using a stunnel.conf file, I would replace the '-d pop3s > -r' > with the absolute path to the .conf file: > > sudo /usr/local/sbin/stunnel /usr/local/etc/stunnel/stunnel.conf > > I believe command line options were typically used more in older > versions, but now all configuration is done in the configuration file. > > > Kevin > > -----Original Message----- > From: Van [mailto:vanyel@medusa.bioc.aecom.yu.edu] > Sent: Wednesday, June 20, 2007 6:03 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Trying to get stunnel to work for forwarding > pop3sto ipop3 port > > Hello, > > This is my introduction to stunnel. I've inherited control of a > pop3 and > imap server running Red Hat Linux 4 that I want to access via pop3s > and > imaps. I'm starting out with securing the pop3 since most users are > using it. > > I downloaded stunnel 4.20 and compiled it according to the > instructions > on stunnel.org. > > I read the certificates section of the site and made a new .pem file > that I named mail.pem and have in the /usr/local/etc/stunnel/ > directory > that /usr/local/etc/stunnel/stunnel.conf asks for. But when I try to > run stunnel like in the Examples section I get : > > [van@mailserver ~]$ sudo /usr/local/sbin/stunnel -d pop3s -r > localhost:ipop3 > 2007.06.20 17:59:54 LOG3[25516:3086419648]: -d: No such file or > directory (2) > Syntax: > stunnel [<filename>] ] -fd <n> | -help | -version | -sockets > <filename> - use specified config file instead of /usr/local/ > etc/stunnel/stunnel.conf > -fd <n> - read the config file from a file descriptor > -help - get config file help > -version - display version and defaults > -sockets - display default socket options > > I'm a little lost here. Never dealt with a .pem file before stunnel. > I have a self-signed cert I'm successfully using for https webmail on > the server and guessing stunnel couldn't see that, I appended my file > 'mailserver.crt' into my mail.pem file and edited stunnel.conf so it > has > > ;CAfile = /usr/local/etc/stunnel/certs.pem CAfile = > /usr/local/etc/stunnel/mail.pem > > but no dice. Same result. > > Trying to debug, I find 'stunnel -V' also gives the same result. > > Can someone point out what's going wrong? > > > -Van > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

2 2

Trying to get stunnel to work for forwarding pop3s to ipop3 port
by Van 20 Jun '07

20 Jun '07

Hello, This is my introduction to stunnel. I've inherited control of a pop3 and imap server running Red Hat Linux 4 that I want to access via pop3s and imaps. I'm starting out with securing the pop3 since most users are using it. I downloaded stunnel 4.20 and compiled it according to the instructions on stunnel.org. I read the certificates section of the site and made a new .pem file that I named mail.pem and have in the /usr/local/etc/stunnel/ directory that /usr/local/etc/stunnel/stunnel.conf asks for. But when I try to run stunnel like in the Examples section I get : [van@mailserver ~]$ sudo /usr/local/sbin/stunnel -d pop3s -r localhost:ipop3 2007.06.20 17:59:54 LOG3[25516:3086419648]: -d: No such file or directory (2) Syntax: stunnel [<filename>] ] -fd <n> | -help | -version | -sockets <filename> - use specified config file instead of /usr/local/ etc/stunnel/stunnel.conf -fd <n> - read the config file from a file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options I'm a little lost here. Never dealt with a .pem file before stunnel. I have a self-signed cert I'm successfully using for https webmail on the server and guessing stunnel couldn't see that, I appended my file 'mailserver.crt' into my mail.pem file and edited stunnel.conf so it has ;CAfile = /usr/local/etc/stunnel/certs.pem CAfile = /usr/local/etc/stunnel/mail.pem but no dice. Same result. Trying to debug, I find 'stunnel -V' also gives the same result. Can someone point out what's going wrong? -Van

1 0

stunnel client mode and CA chains
by Domenico Andreoli 13 Jun '07

13 Jun '07

Hi, I have always successfully used openssl/stunnel but now I am facing a new problem, a variation of the usual client-side authentication documentented everywhere. I have a root CA and child CA which is signed by the root one. I have also a client certificate that is signed only by the child CA. In order to verify the certificate signature using openssl I need to specify both the CA certificates, this works as expected. What I would like to achieve is to authenticate the clients using a stunnel server having only the root CA certificate. Is there some stunnel client configuration switch that allows to push the child CA certificate? One looking interesting is (from the manpage): cert = pemfile certificate chain PEM file name A PEM is always needed in server mode. Specifying this flag in client mode will use this certificate chain as a client side certificate chain. Using client side certs is optional. The certificates must be in PEM format and must be sorted starting with the certificate to the highest level (root CA). in particular "The certificates must be in PEM format and must be sorted starting with the certificate to the highest level (root CA)" lets me hope but I am not able to understand how it works. I made many tries but on server side I always get a "VERIFY ERROR: depth=1, error=invalid CA certificate:" referring to the child CA certificate and then a "SSL3_GET_CLIENT_CERTIFICATE:no certificate returned" followed by connection shutdown. Supposing the client private key is in a separate file, if I put the certificates in the order specified by the manpage I get a key mismatching error upon stunnel startup. If instead I put the client certificate as first, then server do not authenticate it. Where am I wrong? I cannot change the server configuration, it must work as it is. I have hundreds of them and I can update them only using the SSL connection. Thanks for any help. Regards, Domenico -----[ Domenico Andreoli, aka cavok --[ http://www.dandreoli.com/gpgkey.asc ---[ 3A0F 2F80 F79C 678A 8936 4FEE 0677 9033 A20E BC50

1 0

Issue with Stunnel / TCP Wrappers
by Kevin Cook 11 Jun '07

11 Jun '07

I have been a user of Stunnel for several years, but as of recent need to be able to deny TCP/IP requests dynamically on an IP address basis. I am attempting to use TCP wrappers, but not getting it to work with Stunnel. The Solaris 9 implementation I am using currently runs in a chroot'ed environment, so I am placing the hosts.deny file in this path (/chrootpath/etc/hosts.deny), as well as /usr/etc per everything I have read. This is not working. I am using a non-standard port not defined in /etc/services (29444). Any ideas?

1 0

stunnel autostart at boot
by Grant Kohler 11 Jun '07

11 Jun '07

Has anybody created a startup script to load stunnel when a machine boots? Thanks, -Grant

1 0

Re: [stunnel-users] [PATCH?] Senting a list of accepted CAs to the client
by Kevin Martin 07 Jun '07

07 Jun '07

Has anyone any information on this? It affects the ability of Thunderbird users (in this case) to use secure communications with IMAP mail servers using TLS/SSL. Please see the bugzillas below. Thanks. Kevin Martin https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237962 and list posting from 4/2007: Hello, stunnel currently does not send a list of accepted CAs, see e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=327001 Sending the list was #if 0-ed out sometime between stunnel 3.22 and 4.00, with no change log entry AFAICS. Does anyone remember know why was it disabled, and whether it is safe to reenable (e. g. using the attached patch)? Thanks, Mirek <patch snipped>...see the list posting from 4/2007 above for the attached patch.

1 0