- stunnel-users - stunnel.org

[win32] stunnel/OpenSSL/Synergy howto
by P. Jansen 25 Mar '07

25 Mar '07

Hi stunnel users and especially newbies, on http://stunnel.mirt.net/docs.html you can find a link to a stunnel/OpenSSL/Synergy howto for the Win32 platform. It is a short but hopefully useful doc how to install, configure and use stunnel. Feedback and comments are welcome. - Patrick

1 0

Solaris 10 and MySQL questions
by mdpeters 25 Mar '07

25 Mar '07

My goal is to have a web server transfer MySQL data via an AES tunnel to a MySQL database server with an added encryption card. Both systems have the same SSL and Stunnel software installed. My web servers database seems to be functioning as normal. I would like to verify that what I have is complete and effective. It is not apparent to me if I have finished construction or how to verify this works like I want it to. I'm not sure how I would verify that Stunnel is being used. Do I need to run Stunnel as a background service full time? Is there something I am missing here? ++++++ # /usr/local/sbin/stunnel -version stunnel 4.20 on sparc-sun-solaris2.10 with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.3.2 # uname -a SunOS slinky 5.10 Generic_118833-17 sun4u sparc SUNW,Ultra-80 # /usr/local/sbin/stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 65535 SO_SNDBUF -- -- -- 65535 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 # openssl ciphers -v DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1 IDEA-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=IDEA(128) Mac=MD5 RC2-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1 DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 DES-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC2-CBC-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export ++++++

1 0

How to surf the web over proxy?
by P. Jansen 25 Mar '07

25 Mar '07

Hi, I know there is a way to do the following with SSH+PuTTY, with stunnel too? Do I need further software? Windows office computer --> (HTTP) --> Corporate firewall/proxy --> (HTTP) --> Home computer --> WWW Regards, Patrick

1 0

Stunnel 4.20 with TCP Wrappers 7.6 problem in configure.ac
by lists＠d-ra.ath.cx 18 Mar '07

18 Mar '07

Hi, the following patch makes stunnel 4.20 to operate with TCP wrappers 7.6. I had not tried other versions of stunnel nor TCP wrappers. The problem is the missing libnsl, so TCP wrappers will never be activated in ./configure Regards Dieter --- configure.ac.orig 2007-03-17 12:57:32.000000000 +0100 +++ configure.ac 2007-03-17 12:55:19.000000000 +0100 @@ -310,7 +310,7 @@ AC_MSG_RESULT([no (autodetecting)]) AC_MSG_CHECKING([for hosts_access in -lwrap]) saved_LIBS="$LIBS" - LIBS="$saved_LIBS -lwrap" + LIBS="$saved_LIBS -lwrap -lnsl" AC_LINK_IFELSE( [AC_LANG_PROGRAM( [[int hosts_access(); int allow_severity, deny_severity;]],

2 9

Getting a "Peer suddenly disconnected" error
by David Goodwin 09 Mar '07

09 Mar '07

Hey all, I'm getting this in the /var/adm/messages log on the server side when attempting to connect from the client: Mar 8 22:23:33 SERVERNAME stunnel: [ID 821868 daemon.error] LOG3[27429:4]: SSL_connect: Peer suddenly disconnected I have the server configured as follows: cat /etc/stunnel/stunnel.test.conf client=yes debug=debug cert=/etc/stunnel/stunnel.pem [sunrpc] accept=112 connect=127.0.0.1:111 TIMEOUTclose=10 This is started just by running stunnel with the config file and then starting rpcbind normally. The client is configured as follows: # cat /etc/stunnel/stunnel.test.conf client=yes debug=debug cert=/etc/stunnel/imnxnsm0.pem [sunrpc] accept=111 connect=SERVERNAME:112 The error shows up when I attempt to run "rpcinfo -p 127.0.0.1". Snoop is showing the following (adjusted to remove hostnames/ips): CLIENT -> SERVER TCP D=112 S=63986 Syn Seq=867918817 Len=0 Win=24820 Options=<nop,nop,sackOK,mss 1460> SERVER -> CLIENT TCP D=63986 S=112 Syn Ack=867918818 Seq=209756753 Len=0 Win=24820 Options=<nop,nop,sackOK,mss 1460> CLIENT -> SERVER TCP D=112 S=63986 Ack=209756754 Seq=867918818 Len=0 Win=24820 CLIENT -> SERVER TCP D=112 S=63986 Ack=209756754 Seq=867918818 Len=88 Win=24820 SERVER -> CLIENT TCP D=63986 S=112 Ack=867918906 Seq=209756754 Len=0 Win=24820 SERVER -> CLIENT TCP D=63986 S=112 Rst Seq=209756754 Len=0 Win=24820 I'm pretty new to stunnel, and am having a heck of a time getting this to work. This configuration is the closest I've been to success so far. Is there a better way for me to wrap rpcbind perhaps? Any help with this will be appreciated. Thanks, Civil

2 2

DLLs for OpenSSL 0.9.8e
by Michal Trojnara 09 Mar '07

09 Mar '07

Dear Users, I've built the DLLs for OpenSSL 0.9.8e. They're available for download from: ftp://stunnel.mirt.net/openssl/binary-0.9.8e-zdll/ Best regards, Mike

1 0

problem accesing a https site as a Windows version client
by Gustavo 09 Mar '07

09 Mar '07

I'm running stunnel version 4.2 on Windows XP I can access a lot of websites, example https://servicios.afip.gov.ar/tramites_con_clave_fiscal/misAportes/images/t… but CAN'T access https://apwebserver.rentasgcba.gov.ar/ablpatib_ssl/images/Actitud_BsAs_negr… apparently a response never arrives to my PC my conf file is cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = yes ; Service-level configuration [https1] client = yes accept = 6001 connect = servicios.afip.gov.ar:443 TIMEOUTclose = 0 [https] client = yes accept = 6002 connect = apwebserver.rentasgcba.gov.ar:443 TIMEOUTclose = 5 ; vim:ft=dosini

2 1

Download speed affected with stunnel help needed please.
by tom hammond 07 Mar '07

07 Mar '07

Using HFS 2.1d http://www.rejetto.com and Stunnel 4.20 on single WinXP machine. The list of parameters you are using for stunnel, and if you are running it standalone or from inetd/xinetd: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [https] accept = # connect = # TIMOUTclose = 0 I dont'understand 3-7 as given here: http://www.stunnel.org/support/ only used OpenSSL to make CERT Win32 OpenSSL v0.9.8e Light *************************************** Description: HFS is a webserver that can only utilize HTTP, therefore I turned to Stunnel to implement https. When using HTTPs: for UPLOADING I get full speed. When using HTTPs: for DOWNLoADING the speed in cut drastically, 20x slower. The odd thing is, multiple downloads can go at once eg: 20 connections @80kb/second However no single connection will get over 80 or 100kb/second I searched the net and couldn't find a solution, but continuously came across mention of "loopback" problems with stunnel and http servers (old posts) or saying stuff about Microsoft winsock, found a few mentions of VNC server having an option to "enable loopback connections" Another thing I saw but closed (oops) was mention of disabling an HTTP server in order to avoid loopback problems with HTTPS serving.(HFS has no option because it is designed to serve ONLY HTTP) I have tons of hope for an easy solution for the following reasons: #1, uploading works perfect #2 just downloaded demo of Easy File Sharing Web Server(not free like HFS) and the download speed works through HTTPS. I have no clue as to how to fix this, saw one entry in the stunnel config at ssl.org: socket = a:SO_BINDTODEVICE=lo I DID attempt to enter this line into the config under my 2 original entries, but then stunnel would not start. Thank you --------------------------------- TV dinner still cooling? Check out "Tonight's Picks" on Yahoo! TV.

1 0

init_ssl: s_poll_wait timeout
by William Biagi 06 Mar '07

06 Mar '07

I am using a Eudora client configured to use STARTLS to send mail through stunnel to a sendmail server. The stunnel config is as follows: cert = /usr/local/etc/stunnel/stunnel.pem key = /usr/local/etc/stunnel/stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 options = DONT_INSERT_EMPTY_FRAGMENTS delay = yes TIMEOUTconnect = 300 TIMEOUTbusy = 300 setuid = smtpauth setgid = smtpauth debug = 7 client = no foreground = yes pid = [smtps] accept = 465 connect = localhost:25 protocol=smtp When I send mail the connection is established with port 465 on stunnel but it fails to negotiate the ssl session. THis is the log: 2007.03.06 15:45:08 LOG7[17753:1024]: Snagged 64 random bytes from /root/.rnd 2007.03.06 15:45:08 LOG7[17753:1024]: Wrote 1024 new random bytes to /root/.rnd 2007.03.06 15:45:08 LOG7[17753:1024]: RAND_status claims sufficient entropy for the PRNG 2007.03.06 15:45:08 LOG7[17753:1024]: PRNG seeded successfully 2007.03.06 15:45:08 LOG7[17753:1024]: Configuration SSL options: 0x00000800 2007.03.06 15:45:08 LOG7[17753:1024]: SSL options set: 0x00000800 2007.03.06 15:45:08 LOG7[17753:1024]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2007.03.06 15:45:08 LOG7[17753:1024]: Certificate loaded 2007.03.06 15:45:08 LOG7[17753:1024]: Key file: /usr/local/etc/stunnel/stunnel.pem 2007.03.06 15:45:08 LOG7[17753:1024]: Private key loaded 2007.03.06 15:45:08 LOG7[17753:1024]: SSL context initialized for service smtps 2007.03.06 15:45:08 LOG5[17753:1024]: stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.7l 28 Sep 2006 2007.03.06 15:45:08 LOG5[17753:1024]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 2007.03.06 15:45:08 LOG6[17753:1024]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.06 15:45:08 LOG6[17753:1024]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.06 15:45:08 LOG5[17753:1024]: 500 clients allowed 2007.03.06 15:45:08 LOG7[17753:1024]: FD 3 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: FD 4 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: FD 5 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: SO_REUSEADDR option set on accept socket 2007.03.06 15:45:08 LOG7[17753:1024]: smtps bound to 0.0.0.0:465 2007.03.06 15:45:08 LOG7[17753:1024]: No pid file being created 2007.03.06 15:45:18 LOG7[17753:1024]: smtps accepted FD=6 from 208.41.111.165:2542 2007.03.06 15:45:18 LOG7[17755:1026]: smtps started 2007.03.06 15:45:18 LOG7[17755:1026]: FD 6 in non-blocking mode 2007.03.06 15:45:18 LOG7[17755:1026]: TCP_NODELAY option set on local socket 2007.03.06 15:45:18 LOG5[17755:1026]: smtps accepted connection from 208.41.111.165:2542 2007.03.06 15:45:18 LOG7[17755:1026]: SSL state (accept): before/accept initialization 2007.03.06 15:45:20 LOG6[17755:1026]: init_ssl: s_poll_wait timeout 2007.03.06 15:45:20 LOG5[17755:1026]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.03.06 15:45:20 LOG7[17755:1026]: smtps finished (0 left) 2007.03.06 15:47:00 LOG3[17753:1024]: Received signal 2; terminating Can anyone tell me what I am doing wrong? BB

1 0

High CPU system usage on Solaris
by armando.salvatori＠accenture.com 05 Mar '07

05 Mar '07

We use stunnel process to encrypt Oracle connections from a set of 4-6 application server. On the DB server, 20 cpus Solaris machine running Oracle, we have more then 400 LWPS for stunnel and the relative 400 oracle connections. We experience a huge amount of cpu usage (system component), about 40%, after stunnel setup (stunnel 4.15 version) Is it usual? Do you have experience on similar situation? Do you have any suggestions to improve cpu usage or to address performance issue/tuning? Thank you very much AS This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

make compile error options.c parse_ocsp_url
by William Biagi 03 Mar '07

03 Mar '07

./configure was successful but the make gave me the following: Making all in src make[1]: Entering directory `/home/bbiagi/stunnel-4.20/src' if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.20\" -DPACKAGE_STRING=\"stunnel\ 4.20\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.20\" -DHOST=\"i686-pc-linux-gnu\" -DCPU_I686=1 -DVENDOR_PC=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_TCPD_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/include -MT options.o -MD -MP -MF ".deps/options.Tpo" -c -o options.o options.c; \ then mv -f ".deps/options.Tpo" ".deps/options.Po"; else rm -f ".deps/options.Tpo"; exit 1; fi options.c: In function `parse_ocsp_url': options.c:1762: warning: implicit declaration of function `OCSP_parse_url' options.c:1767: structure has no member named `ocsp_addr' options.c:1769: structure has no member named `ocsp_path' options.c: In function `parse_ocsp_flag': options.c:1786: `OCSP_NOCERTS' undeclared (first use in this function) options.c:1786: (Each undeclared identifier is reported only once options.c:1786: for each function it appears in.) options.c:1787: `OCSP_NOINTERN' undeclared (first use in this function) options.c:1788: `OCSP_NOSIGS' undeclared (first use in this function) options.c:1789: `OCSP_NOCHAIN' undeclared (first use in this function) options.c:1790: `OCSP_NOVERIFY' undeclared (first use in this function) options.c:1791: `OCSP_NOEXPLICIT' undeclared (first use in this function) options.c:1792: `OCSP_NOCASIGN' undeclared (first use in this function) options.c:1793: `OCSP_NODELEGATED' undeclared (first use in this function) options.c:1794: `OCSP_NOCHECKS' undeclared (first use in this function) options.c:1795: `OCSP_TRUSTOTHER' undeclared (first use in this function) options.c:1796: `OCSP_RESPID_KEY' undeclared (first use in this function) options.c:1797: `OCSP_NOTIME' undeclared (first use in this function) options.c: At top level: options.c:1758: warning: `parse_ocsp_url' defined but not used options.c:1781: warning: `parse_ocsp_flag' defined but not used make[1]: *** [options.o] Error 1 make[1]: Leaving directory `/home/bbiagi/stunnel-4.20/src' make: *** [all-recursive] Error 1 I am trying to install on a red hat 7.3 with openssl-0.9.6b-18

2 1

RE: Stunnel Forks Out of Control
by Duncan Brown 24 Feb '07

24 Feb '07

Hi all, Ok, I've gone through my last log file for when this issue happens. There's "1130 finished (2 left)" (where 1030 is the port we're listening on) at 10:22am, for example. Then, the next "1130 finished" doesn't happen for about another 20 minutes (which is weird), and then says, "1131 finished (124 left)". It's at this point that a lot of "connection reset by peer"'s happen and "0 bytes sent to SSL" also happen. It looks as though there are a bunch of connections being accepted but not handled. Can anyone assist? The debug level 7 log file is available if necessary. Thanks again, guys. Cheers, Duncan

2 1

RE: Stunnel Forks Out of Control
by Duncan Brown 23 Feb '07

23 Feb '07

Hi all, As an update, it looks like I'm using Stunnel 4.15. I thought it said 4.20, unless I managed to compile an older version. Regardless, I think the problem is happening in both versions. It looks as though it can't catch up on processing cached requests or something. Does that help at all? Cheers, Duncan

1 0

Stunnel Forks Out of Control
by Duncan Brown 21 Feb '07

21 Feb '07

Hi all, I apologize if this issue appears in the archives but I've scoured them and can't find any similar instances (if this problem does occur in the archives then if someone could point it out to me I'd be grateful as well). So, here goes: I'm running Stunnel on Debian Linux. I run it in daemon mode and have the .conf file set to listen on a specific port and redirect to another port. Listening on the connecting end of Stunnel is another daemon I've created that listens on the same port for TCP traffic as part of a client-server application I have (a new process is forked for each connection). On the client end is a .NET application that communicates with the server via TCP with Stunnel installed. In my code, I've made sure that whenever a client-server session is finished, the server closes the socket, whether or not there was an error. Now, everything seems to work flawlessly for a period of time (this period of time is variable, from anywhere between 1 day to 1 month). Then, all of a sudden, Stunnel "explodes"; for example, while there might be one or two forks of my own daemon, there might be 128 instances of Stunnel, all of which are in a sleeping state (that is, if I run ps -aux, their "STAT" attribute is "S"), whereas before it exploded it was pretty much a 1:1 relationship. When it "explodes", I have to kill Stunnel and restart it, which is a pain in the rear-end given what I'm trying to do. Why is it doing this? How do I stop it from happening? I apologize again if this has already been brought up somewhere else, but I've been unable to find any references to any similar problems. If it's a "newbie" mistake or something I'll gladly accept it and learn from it. Please find below the information requested for a problem for the mailing list: - I'm using v4.20 - No parameters are used from the command-line when starting Stunnel; it just uses the standard .conf file which I've edited. - Output of "uname -a" : "Linux buffed 2.4.27-2-386 #1 Wed Aug 17 09:33:35 UTC 2005 i686 GNU/Linux" - I'm using libc v6 - Output of "gcc -v" : Reading specs from /usr/lib/gcc-lib/i486-linux/3.3.5/specs Configured with: ../src/configure -v --enable-languages=c,c++,java,f77,pascal,objc,ada,treelang --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --with-gxx-include-dir=/usr/include/c++/3.3 --enable-shared --enable-__cxa_atexit --with-system-zlib --enable-nls --without-included-gettext --enable-clocale=gnu --enable-debug --enable-java-gc=boehm --enable-java-awt=xlib --enable-objc-gc i486-linux Thread model: posix gcc version 3.3.5 (Debian 1:3.3.5-13) - I'm using OpenSSL v0.9.7e (25 Oct 2004) Thanks in advance for any help. Cheers, Duncan

1 0

Stunnel proxy aware
by Kennet Svanberg 21 Feb '07

21 Feb '07

Hi, I'm quite happy with stunnel-4.05 but don't know how to add any of the proxy patches to make my own windows binaries. I also saw that others have wondered http://linode.mirt.net/pipermail/stunnel-users/2006-December/001404.html

1 0

Stunnel on AIX 5.3 and AIX 5.2 - Solution
by Trevor Maistry 21 Feb '07

21 Feb '07

Hi, I downloaded stunnel version 4.05, changed the configuration file to use "cc" instead of "gcc" and compiled on AIX 5300-04 and AIX 5200-03. Compilations worked fine. However, you must compile on the machine you want to use it on. Otherwise you will have problems. Copy the "stunnel", "stunnel.pem" and sample "stunnel.conf-sample.in" files into /usr/local/bin. Rename the "stunnel.conf-sample.in" to " "stunnel.conf". Change the "stunnel.conf" accordingly and start "stunnel" like so "./stunnel stunnel.conf". Hope this helps. Regards, Trevor Maistry Principal Systems Consultant ============================================= Information and Communication Technology Division University of KwaZulu-Natal King George v Avenue, Durban, 4041 Tel : +2731-2602475 Fax: +2731-2602125 Cell: +2782-787-5583 Email : maistryt(a)ukzn.ac.za =============================================: Please find our Email Disclaimer here: http://www.ukzn.ac.za/disclaimer/

1 0

Re: new Cygwin maintainer for stunnel
by Michal Trojnara 20 Feb '07

20 Feb '07

On Tuesday 20 February 2007 20:59, Andrew Schulman wrote: > Please add Cygwin to the list of "known good" OSes at > http://stunnel.mirt.net/, and add me to the list of maintainers in the > PORTS file. Done. Thank you. Mike

1 0

help
by RICH 16 Feb '07

16 Feb '07

Hi to all i need help i have install stunnel rpm in mandriva but can not find the config file

1 0

stunnel on Qnx 6.3
by Rajashekhar Durgadmath 15 Feb '07

15 Feb '07

Hello All, I am facing problems running stunnel for Qnx 6.3 cross compiled on solaris. I want to provide a https front end to thtttpd (www.acme.com). stunnel starts but fails. Logs are like this: 1980.01.01 15:01:46 LOG5[1069085:1]: stunnel 4.20 on sparc-sun-solaris2.9 with OpenSSL 0.9.8 05 Jul 2005 1980.01.01 15:01:46 LOG5[1069085:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 1980.01.01 15:01:46 LOG6[1069085:1]: file ulimit = 1000 (can be changed with 'ulimit -n') 1980.01.01 15:01:46 LOG6[1069085:1]: poll() used - no FD_SETSIZE limit for file descriptors 1980.01.01 15:01:46 LOG5[1069085:1]: 488 clients allowed 1980.01.01 15:01:46 LOG7[1069085:1]: FD 4 in non-blocking mode 1980.01.01 15:01:46 LOG7[1069085:1]: FD 5 in non-blocking mode 1980.01.01 15:01:46 LOG7[1069085:1]: FD 6 in non-blocking mode 1980.01.01 15:01:46 LOG7[1069085:1]: SO_REUSEADDR option set on accept socket 1980.01.01 15:01:46 LOG7[1069085:1]: stunnel bound to xxx.xx.xxx.xxx:443 1980.01.01 15:01:46 LOG7[1073200:1]: Created pid file /stunnel.pid <Browser connects> 1980.01.01 15:05:12 LOG7[1073200:1]: stunnel accepted FD=7 from yyy.yy.yyy.yyy:64822 1980.01.01 15:05:12 LOG7[1073200:2]: stunnel started 1980.01.01 15:05:12 LOG7[1073200:2]: FD 7 in non-blocking mode 1980.01.01 15:05:12 LOG7[1073200:2]: TCP_NODELAY option set on local socket 1980.01.01 15:05:12 LOG5[1073200:2]: stunnel accepted connection from qqq.qqq.qqq.qqq:64822 1980.01.01 15:05:12 LOG5[1073200:2]: Server mode 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): before/accept initialization 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 read client hello A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 write server hello A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 write certificate A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 write server done A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 flush data 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 read client key exchange A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 read finished A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 write change cipher spec A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 write finished A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 flush data 1980.01.01 15:05:13 LOG7[1073200:2]: 1 items in the session cache 1980.01.01 15:05:13 LOG7[1073200:2]: 0 client connects (SSL_connect()) 1980.01.01 15:05:13 LOG7[1073200:2]: 0 client connects that finished 1980.01.01 15:05:13 LOG7[1073200:2]: 0 client renegotiations requested 1980.01.01 15:05:13 LOG7[1073200:2]: 1 server connects (SSL_accept()) 1980.01.01 15:05:13 LOG7[1073200:2]: 1 server connects that finished 1980.01.01 15:05:13 LOG7[1073200:2]: 0 server renegotiations requested 1980.01.01 15:05:13 LOG7[1073200:2]: 0 session cache hits 1980.01.01 15:05:13 LOG7[1073200:2]: 1 session cache misses 1980.01.01 15:05:13 LOG7[1073200:2]: 0 session cache timeouts 1980.01.01 15:05:13 LOG6[1073200:2]: SSL accepted: new session negotiated 1980.01.01 15:05:13 LOG6[1073200:2]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 < SSL Negotiation done > 1980.01.01 15:08:49 LOG3[1073200:2]: remote socket: Address family not supported by protocol family (247) <<<<<< 1980.01.01 15:08:49 LOG5[1073200:2]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 1980.01.01 15:08:49 LOG7[1073200:2]: stunnel finished (0 left) I checked the address family; it is AF_INET :) socket syscall in client.c:989 is failing. I know the error "Address family not supported by protocol family (247)" says it all, but there are other applications running on the box which do the same thing and it works for them. Versions: OpenSSL 0.9.8 and stunnel 4.20. stunnel.conf ## stunnel.conf starts cert = /etc/localhost_cert.pem key = /etc/localhost_key.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /some_dir setuid = root setgid = root ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /some_dir/stunnel.log [https] accept = <Qnx box IP>:443 connect = <Qnx box IP>:80 ## stunnel.conf end # uname -a QNX localhost 6.3.0 2006/04/27-13:08:16EST armbe It was configured thus: ./configure --prefix=/vob/nmi/3rd_party/stunnel --enable-dependency-tracking --with-ssl=/vob/nmi/3rd_party/openssl/ --build=armbe-qnx --host=sparc-sun-solaris2.9 --with-threads=pthread --disable-libwrap Removing the --disable-libwrap does not help. stunnel is started like this: stunnel /etc/stunnel.conf -d http -r localhost:http -p /etc This also did not help: stunnel /etc/stunnel.conf -d https -r localhost:http -p /etc stunnel /etc/stunnel.conf # stunnel -version stunnel 4.20 on sparc-sun-solaris2.9 with OpenSSL 0.9.8 05 Jul 2005 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /some_path/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /some_path/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /some_path/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Please reply, All comments appreciated. Cheers, Raj --------------------------------- New Yahoo! Mail is the ultimate force in competitive emailing. Find out more at the Yahoo! Mail Championships. Plus: play games and win prizes.

1 0

slow transfer of smtp
by jason kawaja 15 Feb '07

15 Feb '07

greetings. clients connects normally when not using ssl (stunnel). when using ssl the connection on the client end appears to take about a minute but does eventually work (mail is sent through encrypted). shown below is the log with debug=7 and a space between the area where a "pause" seems to be, ideas on what could be occurring during this time to induce the "pause"? client = machine making connection. server = machine running stunnel accepting the connection. 2007.02.14 12:24:06 LOG7[69377:134631424]: imaps accepted FD=9 from client:62847 2007.02.14 12:24:06 LOG7[69377:134633984]: imaps started 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 9 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: TCP_NODELAY option set on local socket 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 10 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 11 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: Connection from client: 62847 permitted by libwrap 2007.02.14 12:24:06 LOG5[69377:134633984]: imaps connected from client:62847 2007.02.14 12:24:06 LOG7[69377:134631424]: Cleaning up the signal pipe 2007.02.14 12:24:06 LOG6[69377:134631424]: Child process 69387 finished with code 0 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): before/ accept initialization 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 read client hello A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write server hello A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write certificate A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write server done A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 read client key exchange A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 read finished A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write change cipher spec A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write finished A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:06 LOG7[69377:134633984]: 1 items in the session cache 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 client connects (SSL_connect()) 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 client connects that finished 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 client renegotiatations requested 2007.02.14 12:24:06 LOG7[69377:134633984]: 1 server connects (SSL_accept()) 2007.02.14 12:24:06 LOG7[69377:134633984]: 1 server connects that finished 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 server renegotiatiations requested 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 session cache hits 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 session cache misses 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 session cache timeouts 2007.02.14 12:24:06 LOG6[69377:134633984]: SSL accepted: new session negotiated 2007.02.14 12:24:06 LOG6[69377:134633984]: Negotiated ciphers: AES128- SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 10 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: imaps connecting server:143 2007.02.14 12:24:06 LOG7[69377:134633984]: connect_wait: waiting 10 seconds 2007.02.14 12:24:06 LOG7[69377:134633984]: connect_wait: connected 2007.02.14 12:24:06 LOG7[69377:134633984]: Remote FD=10 initialized 2007.02.14 12:24:06 LOG7[69377:134633984]: TCP_NODELAY option set on remote socket 2007.02.14 12:24:08 LOG7[69377:134631424]: ssmtp accepted FD=11 from client:62848 2007.02.14 12:24:08 LOG7[69377:134881280]: ssmtp started 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 11 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: TCP_NODELAY option set on local socket 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 12 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 13 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: Connection from client: 62848 permitted by libwrap 2007.02.14 12:24:08 LOG5[69377:134881280]: ssmtp connected from client:62848 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): before/ accept initialization 2007.02.14 12:24:08 LOG7[69377:134631424]: Cleaning up the signal pipe 2007.02.14 12:24:08 LOG6[69377:134631424]: Child process 69391 finished with code 0 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 read client hello A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write server hello A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write certificate A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write server done A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 read client key exchange A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 read finished A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write change cipher spec A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write finished A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:08 LOG7[69377:134881280]: 2 items in the session cache 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 client connects (SSL_connect()) 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 client connects that finished 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 client renegotiatations requested 2007.02.14 12:24:08 LOG7[69377:134881280]: 2 server connects (SSL_accept()) 2007.02.14 12:24:08 LOG7[69377:134881280]: 2 server connects that finished 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 server renegotiatiations requested 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 session cache hits 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 session cache misses 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 session cache timeouts 2007.02.14 12:24:08 LOG6[69377:134881280]: SSL accepted: new session negotiated 2007.02.14 12:24:08 LOG6[69377:134881280]: Negotiated ciphers: AES128- SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 12 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: ssmtp connecting server:25 2007.02.14 12:24:08 LOG7[69377:134881280]: connect_wait: waiting 10 seconds 2007.02.14 12:24:08 LOG7[69377:134881280]: connect_wait: connected 2007.02.14 12:24:08 LOG7[69377:134881280]: Remote FD=12 initialized 2007.02.14 12:24:08 LOG7[69377:134881280]: TCP_NODELAY option set on remote socket 2007.02.14 12:25:06 LOG7[69377:134631424]: imaps accepted FD=13 from client:62850 2007.02.14 12:25:06 LOG7[69377:134882816]: imaps started 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 13 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: TCP_NODELAY option set on local socket 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 14 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 15 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: Connection from client: 62850 permitted by libwrap 2007.02.14 12:25:06 LOG5[69377:134882816]: imaps connected from client:62850 2007.02.14 12:25:06 LOG7[69377:134631424]: Cleaning up the signal pipe 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): before/ accept initialization 2007.02.14 12:25:06 LOG6[69377:134631424]: Child process 69478 finished with code 0 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 read client hello A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 write server hello A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 write change cipher spec A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 write finished A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 flush data 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 read finished A 2007.02.14 12:25:06 LOG7[69377:134882816]: 2 items in the session cache 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 client connects (SSL_connect()) 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 client connects that finished 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 client renegotiatations requested 2007.02.14 12:25:06 LOG7[69377:134882816]: 3 server connects (SSL_accept()) 2007.02.14 12:25:06 LOG7[69377:134882816]: 3 server connects that finished 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 server renegotiatiations requested 2007.02.14 12:25:06 LOG7[69377:134882816]: 1 session cache hits 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 session cache misses 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 session cache timeouts 2007.02.14 12:25:06 LOG6[69377:134882816]: SSL accepted: previous session reused 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 14 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: imaps connecting server:143 2007.02.14 12:25:06 LOG7[69377:134882816]: connect_wait: waiting 10 seconds 2007.02.14 12:25:06 LOG7[69377:134882816]: connect_wait: connected 2007.02.14 12:25:06 LOG7[69377:134882816]: Remote FD=14 initialized 2007.02.14 12:25:06 LOG7[69377:134882816]: TCP_NODELAY option set on remote socket -- Jason Kawaja, 2-4568 IT Expert, UF Dept of ECE

1 1

configure/compile issue on AIX&In-Reply-To=
by Trevor Maistry 09 Feb '07

09 Feb '07

Hi, Does anyone have a version of Stunnel which runs on AIX 5.3? Also, what is the idle timeout set to and how do I change it? Many thanks. Regards, Trevor Maistry Principal Systems Consultant ============================================= Information and Communication Technology Division University of KwaZulu-Natal King George v Avenue, Durban, 4041 Tel : +2731-2602475 Fax: +2731-2602125 Cell: +2782-787-5583 Email : maistryt(a)ukzn.ac.za =============================================: Please find our Email Disclaimer here: http://www.ukzn.ac.za/disclaimer/

1 0

"The most recent stable Stunnel version?"
by Roger Fulton 04 Feb '07

04 Feb '07

Hi, I've checked the support pages. I've browsed the mailing list archives. I've perused the ChangeLog file. I can't find an answer to this question: At http://www.stunnel.org/download/binaries.html is stated "The most recent stable Stunnel version is flagged with a red asterisk (*)." I've used two different browsers, and I'll be danged if I see *any* version marked with *any* asterisk, red or otherwise. Would someone kindly direct this Stunnel newbie to the "most recent stable Stunnel version?" TIA.

2 1

Oracle JDBC Failover not working
by Dario Mariani 02 Feb '07

02 Feb '07

Hi all. We have a problem here with this configuration. before stunnel: BEA Weblogic, 2 JDBC, server1:1521 and server2:1521 Two SunCluster nodes with Oracle OPS/RAC (active-active conf), with NO shared address. So "server1" and "server2" are the phisical address. after stunnel: the JDBC config is 127.0.0.1:10001 and 127.0.0.1:10002 stunnel client is 10001->server1:11521 and 10002->server2:11521 stunnel server is 11521->localhost:1521 When we shut down the server1 (so oracle, listener and stunnel server is not responding), BEA cannot failover. A quick analisys shows that: 1. the JDBC connects to stunnel client, that accept the connection 2. stunnel client fails to connect to stunnel server 3. stunnel client close the connection with the JDBC 4. the JDBC cannot deal with the situation and doesn't failover. It seems like JDBC doesn't failover when he can open a connection but oracle doesn't reply. What i need is: is possible for Stunnel client to FIRST try to connect to the server, and then eventually accept the connection from the jdbc? Bye, dario.

2 1

Intermediate Cert validation problem
by Eric McCombs 31 Jan '07

31 Jan '07

I'm experiencing a problem validating intermediate cert on our Stunnel configuration. We are using Stunnel to forward IMAP, POP and SMTP SSL ports from our vpn server to our internal mail server. We originally used a self-signed cert on the vpn server. When clients connect via Outlook, Outlook Express, Thunderbird and various cell phone mail programs they received a warning message (Unable to verify identity of xxx) about the self-signed cert. To resolve this issue we purchased a SSL cert from Verisign to install on the vpn server. We generated the key and CSR and received the new cert from Verisign, which also requires an intermediate cert for verification. We have tried various methods to have the certs validated, combining the key, intermediate cert and server cert in one file, pointing to the CA_file, etc. but continue to see the Unable to verify identity message. Has anybody else encountered this problem and found a way to resolve the problem? Thanks in advance. Eric McCombs

1 1

(no subject)
by Hemesath, Dean CTR USTRANSCOM J6 25 Jan '07

25 Jan '07

To all, Can Stunnel communicate bi-directionally over a single port? Or does it listen on one and communicate on a different one? Thanks Dean

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users