- stunnel-users - stunnel.org

Reconfiguration while running
by James Moe 27 May '07

27 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, Does Stunnel offer a way to reload the configuration file? Usually that is done with SIGHUP but the code looks like it just terminates. Does it have a way to sense that the conf has changed and reloads it? Or must Stunnel be terminated and restarted? - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (OS/2) iD8DBQFGWhbJzTcr8Prq0ZMRAoy8AJ4ocDWfBEvEfoIYoypURg2hTxUh0gCfajo1 nVXpKD5iBFEx6ZHauPemnsU= =vGul -----END PGP SIGNATURE-----

1 0

Quick question relating to end to end encryption with hapoxy:
by lists 27 May '07

27 May '07

I'm using stunnel to decrypt HTTPS and pass it to HAPROXY to insert a cookie and it works very well and very fast. Is their a way of making HAPROXY talk to the backend servers in HTTPS? i.e.. End to end encryption. Can I re-direct it back through stunnel in reverse? Thanks in advance, Malcolm.

2 1

Brocken Connections
by Manfred Alfaré 25 May '07

25 May '07

Hi! I have some trouble using STUNNEL on WIN98 to secure connections to HFS (Http File Server), and hope, somebody can help me. I can connect to HFS with the Browser (Firefox 2.0.0.3, IE 6.0, on the same machine HFS is running, an other one in LAN and a third via internet) and download files, bat every downloaded File is corrupt. In most cases, transfer seems to terminate normally, but the downloaded file ist to short, sometimes there is popup, that tells me, that the file could not be read, because the connection is broken. The log file shows the following: ********************************* stunnel 4.20 on x86-pc-mingw32-gnu with OpenSSL 0.9.8d 28 Sep 2006 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 No limit detected for the number of clients https accepted connection from 85.127.28.154:63819 https connected remote server from 127.0.0.1:1287 Connection closed: 1632 bytes sent to SSL, 476 bytes sent to socket https accepted connection from 85.127.28.154:63821 https accepted connection from 85.127.28.154:63823 https connected remote server from 127.0.0.1:1290 https connected remote server from 127.0.0.1:1291 Connection closed: 919 bytes sent to SSL, 349 bytes sent to socket Connection closed: 720 bytes sent to SSL, 402 bytes sent to socket https accepted connection from 85.127.28.154:63825 https accepted connection from 85.127.28.154:63827 https connected remote server from 127.0.0.1:1294 https connected remote server from 127.0.0.1:1295 Connection closed: 715 bytes sent to SSL, 402 bytes sent to socket Connection closed: 277 bytes sent to SSL, 402 bytes sent to socket https accepted connection from 85.127.28.154:63829 https connected remote server from 127.0.0.1:1297 Connection closed: 269 bytes sent to SSL, 402 bytes sent to socket https accepted connection from 85.127.28.154:63831 https connected remote server from 127.0.0.1:1299 Connection closed: 920 bytes sent to SSL, 349 bytes sent to socket https accepted connection from 85.127.28.154:63833 https connected remote server from 127.0.0.1:1301 https accepted connection from 85.127.28.154:63835 https connected remote server from 127.0.0.1:1303 Connection closed: 920 bytes sent to SSL, 349 bytes sent to socket readsocket: Connection reset by peer (WSAECONNRESET) (10054) Connection reset: 1289938 bytes sent to SSL, 481 bytes sent to socket ************************* My STUNNEL.CONF looks like this: ******************************** ; File with certificate and private key cert = stunnel.pem key = stunnel.pem ; Log (1= minimal, 5=recommended, 7=all) and log file) ; Preceed with a ";" to disable logging debug = 5 output = stunnel.log ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Data compression algorithm: zlib or rle compression = zlib ; SSL bug options / NO SSL:v2 (SSLv3 and TLSv1 is enabled) options = ALL options = NO_SSLv2 ; Service-level configuration ; Stunnel listens to port 443 (HTTPS) to any IP ; and connects to port 44300 (HFS) on localhost [https] accept = 0.0.0.0:443 connect = 127.0.0.1:44300 TIMEOUTclose = 0 ************************************* Your help will be appreciated. Regards Manfred Alfare (not a native englisch speaker :-(

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 34, Issue 5
by GNUtoo＠no-log.org 23 May '07

23 May '07

> >>> in cygwin i have the following errors: >>> $ openssl req -new -x509 -days 365 -nodes -config >>> /etc/stunnel/stunnel.conf -out stunnel.pem -keyout stunnel.pem >>> Generating a 512 bit RSA private key >>> ..++++++++++++ >>> .....++++++++++++ >>> writing new private key to 'stunnel.pem' >>> ----- >>> unable to find 'distinguished_name' in config >>> problems making Certificate Request >>> 1988:error:0E06D06C:configuration file routines:NCONF_get_string:no >>> value:conf_lib.c:329:group=req name=distinguished_name >>> >>> $ /usr/bin/stunnel.exe >>> 2007.05.13 22:37:12 LOG4[2188:6422536]: Wrong permissions on >>> /etc/stunnel/mail.pem >>> 2007.05.13 22:37:12 LOG3[2188:6422536]: Error reading certificate file: >>> /etc/stunnel/stunnel.pem >>> 2007.05.13 22:37:12 LOG3[2188:6422536]: error stack: 140DC009 : >>> error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib >>> 2007.05.13 22:37:12 LOG3[2188:6422536]: >>> SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM >>> routines:PEM_read_bio:no start line >>> >>> and i ran all as Administrator >> >> Can you please post your /etc/stunnel/stunnel.conf, and also the results >> of >> 'ls -al /etc/stunnel'. Thanks, Andrew. >> > $ ls -al /etc/stunnel/ > total 6 > drwx------+ 2 FC1 Users 0 May 13 22:37 . > drwx------+ 11 FC1 Users 0 May 13 21:56 .. > lrwxrwxrwx 1 Administrator Nessuno 11 May 13 22:37 mail.pem -> > stunnel.pem > -rwx------ 1 Administrator Nessuno 1578 May 13 22:36 stunnel.conf > -rwx------+ 1 FC1 Users 1533 May 13 22:13 stunnel.conf-sample > -rw-r--r-- 1 Administrator Nessuno 497 May 13 22:36 stunnel.pem > > > $ cat /etc/stunnel/stunnel.conf > #; Sample stunnel configuration file by Michal Trojnara 2002-2006 > #; Some options used here may not be adequate for your particular > configuration > #; Please make sure you understand them (especially the effect of chroot > jail) > > #; Certificate/key is needed in server mode and optional in client mode > #;cert = /etc/stunnel/mail.pem > key = /etc/stunnel/mail.pem > > #; Protocol version (all, SSLv2, SSLv3, TLSv1) > sslVersion = SSLv3 > > #; Some security enhancements for UNIX systems - comment them out on Win32 > chroot = /var/lib/stunnel/ > setuid = nobody > setgid = nobody > #; PID is created inside chroot jail > pid = /stunnel.pid > > #; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > #;compression = rle > > #; Workaround for Eudora bug > #;options = DONT_INSERT_EMPTY_FRAGMENTS > > #; Authentication stuff > #;verify = 2 > #; Don't forget to c_rehash CApath > #; CApath is located inside chroot jail > #;CApath = /certs > #; It's often easier to use CAfile > #;CAfile = /etc/stunnel/certs.pem > #; Don't forget to c_rehash CRLpath > #; CRLpath is located inside chroot jail > #;CRLpath = /crls > #; Alternatively you can use CRLfile > #;CRLfile = /etc/stunnel/crls.pem > > #; Some debugging stuff useful for troubleshooting > #;debug = 7 > #;output = stunnel.log > > #; Use it for client mode > #;client = yes > > #; Service-level configuration > > #;[pop3s] > #;accept = 995 > #;connect = 110 > > #;[imaps] > #;accept = 993 > #;connect = 143 > > #;[ssmtp] > #;accept = 465 > #;connect = 25 > > #;[https] > ##;accept = 443 > #;connect = 80 > #;TIMEOUTclose = 0 > > #; vim:ft=dosini > > [vnc] > accept = 127.0.0.1:5500 > connect = 192.168.1.107:443 now that i have posted the config file...do i need to post something else?

2 1

Re: [stunnel-users] Simple SMTP encryption
by Hans Werner Strube 21 May '07

21 May '07

James Moe wrote: > client = yes > > [smtps] > accept = 127.0.0.1:465 > connect = smtpauth.earthlink.net:25 > > I missed the part somewhere that tells Stunnel to issue a STARTTLS to > the smtp server before attempting to negotiate a TLS connection. Add (under [smtps]): protocol = smtp

1 0

Simple SMTP encryption
by James Moe 19 May '07

19 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hello, stunnel 4.20 with OpenSSL 0.9.8d 28 Sep 2006 I wish have my MUA to send messages encrypted to a secure mail server. Stunnel is set up as a client with the following configuration: client = yes [smtps] accept = 127.0.0.1:465 connect = smtpauth.earthlink.net:25 I missed the part somewhere that tells Stunnel to issue a STARTTLS to the smtp server before attempting to negotiate a TLS connection. The "failed handshake" bit is because the server is rejecting the command because of NULLs in the text stream. 501 NULL characters are not allowed in SMTP commands. Then there is the "wrong version" error. I suppose that is a side effect of the handshake failure? Here is a typical connection log: 2007.05.19 12:52:42 LOG7[232:4239]: smtps accepted FD=12 from 127.0.0.1:52672 2007.05.19 12:52:42 LOG7[232:4239]: Creating a new thread 2007.05.19 12:52:42 LOG7[232:4239]: New thread created 2007.05.19 12:52:42 LOG7[264:4239]: smtps started 2007.05.19 12:52:42 LOG7[264:4239]: FD 12 in non-blocking mode 2007.05.19 12:52:42 LOG7[264:4239]: TCP_NODELAY option set on local socket 2007.05.19 12:52:42 LOG5[264:4239]: smtps accepted connection from 127.0.0.1:52672 2007.05.19 12:52:42 LOG7[264:4239]: FD 15 in non-blocking mode 2007.05.19 12:52:42 LOG7[264:4239]: smtps connecting 207.69.189.201:25 2007.05.19 12:52:42 LOG7[264:4239]: connect_wait: waiting 10 seconds 2007.05.19 12:52:42 LOG7[264:4239]: connect_wait: connected 2007.05.19 12:52:42 LOG5[264:4239]: smtps connected remote server from 192.168.69.14:52673 2007.05.19 12:52:42 LOG7[264:4239]: Remote FD=15 initialized 2007.05.19 12:52:42 LOG7[264:4239]: TCP_NODELAY option set on remote socket 2007.05.19 12:52:42 LOG7[264:4239]: SSL state (connect): before/connect initialization 2007.05.19 12:52:42 LOG7[264:4239]: SSL state (connect): SSLv3 write client hello A 2007.05.19 12:52:42 LOG7[264:4239]: SSL alert (write): fatal: handshake failure 2007.05.19 12:52:42 LOG3[264:4239]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2007.05.19 12:52:42 LOG5[264:4239]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.05.19 12:52:42 LOG7[264:4239]: smtps finished (0 left) - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (OS/2) iD8DBQFGT1lQzTcr8Prq0ZMRAv50AJ9Kydmi3F/VBQ8hvpr+HmodUZhJEgCfQjbz TRdvnzpATUH/y3gzA1EXMYo= =jTqm -----END PGP SIGNATURE-----

1 0

Several connections on a short period of time problem
by Teigao, Rafael Coninck 16 May '07

16 May '07

Hi, I'm running Stunnel 4.20 to connect a Win client to a Win server. On the server it runs as a service, but on the client side I call it every time a connection is requested with a different config file (I need dynamic configuration) If I connect, disconnect and connect again very quickly (say, in 10 seconds), the fourth time (usually) that I try to connect will give me error 10060 (timeout) on the client application (not Stunnel). Does Stunnel restrict the amount of connection from the same client based on time or something like that? Thanks, Rafael.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 34, Issue 4
by GNUtoo＠no-log.org 15 May '07

15 May '07

>> in cygwin i have the following errors: >> $ openssl req -new -x509 -days 365 -nodes -config >> /etc/stunnel/stunnel.conf -out stunnel.pem -keyout stunnel.pem >> Generating a 512 bit RSA private key >> ..++++++++++++ >> .....++++++++++++ >> writing new private key to 'stunnel.pem' >> ----- >> unable to find 'distinguished_name' in config >> problems making Certificate Request >> 1988:error:0E06D06C:configuration file routines:NCONF_get_string:no >> value:conf_lib.c:329:group=req name=distinguished_name >> >> $ /usr/bin/stunnel.exe >> 2007.05.13 22:37:12 LOG4[2188:6422536]: Wrong permissions on >> /etc/stunnel/mail.pem >> 2007.05.13 22:37:12 LOG3[2188:6422536]: Error reading certificate file: >> /etc/stunnel/stunnel.pem >> 2007.05.13 22:37:12 LOG3[2188:6422536]: error stack: 140DC009 : >> error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib >> 2007.05.13 22:37:12 LOG3[2188:6422536]: >> SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM >> routines:PEM_read_bio:no start line >> >> and i ran all as Administrator > > Can you please post your /etc/stunnel/stunnel.conf, and also the results > of > 'ls -al /etc/stunnel'. Thanks, Andrew. > $ ls -al /etc/stunnel/ total 6 drwx------+ 2 FC1 Users 0 May 13 22:37 . drwx------+ 11 FC1 Users 0 May 13 21:56 .. lrwxrwxrwx 1 Administrator Nessuno 11 May 13 22:37 mail.pem -> stunnel.pem -rwx------ 1 Administrator Nessuno 1578 May 13 22:36 stunnel.conf -rwx------+ 1 FC1 Users 1533 May 13 22:13 stunnel.conf-sample -rw-r--r-- 1 Administrator Nessuno 497 May 13 22:36 stunnel.pem $ cat /etc/stunnel/stunnel.conf #; Sample stunnel configuration file by Michal Trojnara 2002-2006 #; Some options used here may not be adequate for your particular configuration #; Please make sure you understand them (especially the effect of chroot jail) #; Certificate/key is needed in server mode and optional in client mode #;cert = /etc/stunnel/mail.pem key = /etc/stunnel/mail.pem #; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 #; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel/ setuid = nobody setgid = nobody #; PID is created inside chroot jail pid = /stunnel.pid #; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 #;compression = rle #; Workaround for Eudora bug #;options = DONT_INSERT_EMPTY_FRAGMENTS #; Authentication stuff #;verify = 2 #; Don't forget to c_rehash CApath #; CApath is located inside chroot jail #;CApath = /certs #; It's often easier to use CAfile #;CAfile = /etc/stunnel/certs.pem #; Don't forget to c_rehash CRLpath #; CRLpath is located inside chroot jail #;CRLpath = /crls #; Alternatively you can use CRLfile #;CRLfile = /etc/stunnel/crls.pem #; Some debugging stuff useful for troubleshooting #;debug = 7 #;output = stunnel.log #; Use it for client mode #;client = yes #; Service-level configuration #;[pop3s] #;accept = 995 #;connect = 110 #;[imaps] #;accept = 993 #;connect = 143 #;[ssmtp] #;accept = 465 #;connect = 25 #;[https] ##;accept = 443 #;connect = 80 #;TIMEOUTclose = 0 #; vim:ft=dosini [vnc] accept = 127.0.0.1:5500 connect = 192.168.1.107:443

1 0

certs problems in cygwin
by GNUtoo＠no-log.org 14 May '07

14 May '07

in cygwin i have the following errors: $ openssl req -new -x509 -days 365 -nodes -config /etc/stunnel/stunnel.conf -out stunnel.pem -keyout stunnel.pem Generating a 512 bit RSA private key ..++++++++++++ .....++++++++++++ writing new private key to 'stunnel.pem' ----- unable to find 'distinguished_name' in config problems making Certificate Request 1988:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=req name=distinguished_name $ /usr/bin/stunnel.exe 2007.05.13 22:37:12 LOG4[2188:6422536]: Wrong permissions on /etc/stunnel/mail.pem 2007.05.13 22:37:12 LOG3[2188:6422536]: Error reading certificate file: /etc/stunnel/stunnel.pem 2007.05.13 22:37:12 LOG3[2188:6422536]: error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib 2007.05.13 22:37:12 LOG3[2188:6422536]: SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line and i ran all as Administrator

2 1

with the windows version it isn't better...same kind of errors
by GNUtoo＠no-log.org 13 May '07

13 May '07

C:\Programmi\openssl>openssl.exe req -new -x509 -days 365 -nodes -config stunnel .conf -out stunnel.pem -keyout stunnel.pem Loading 'screen' into random state - done Generating a 512 bit RSA private key .....++++++++++++ .......................++++++++++++ writing new private key to 'stunnel.pem' ----- unable to find 'distinguished_name' in config problems making Certificate Request 1772:error:0E06D06C:configuration file routines:NCONF_get_string:no value:./cryp to/conf/conf_lib.c:329:group=req name=distinguished_name 2007.05.13 23:05:03 LOG3[304:860]: Error resolving 'VNC_client_IP_address': Neither nodename nor servname known (EAI_NONAME) Cannot resolve 'VNC_client_IP_address:443' - delaying DNS lookup 2007.05.13 23:05:03 LOG3[304:860]: Error reading certificate file: stunnel.pem 2007.05.13 23:05:03 LOG3[304:860]: error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib 2007.05.13 23:05:03 LOG3[304:860]: SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line 2007.05.13 23:05:03 LOG3[304:860]: Server is down

1 0