- stunnel-users - stunnel.org

Windows OpenSSL DLL Version
by algol sigfrid 26 Sep '06

26 Sep '06

2 1

seg fault stunnel 4-14 on SLES10
by Jon Howse 22 Sep '06

22 Sep '06

Hi, I am getting a seg fault with stunnel on an installation of SLES10. This is the first SLES10 server I have set up after having set up many SLES9 servers (approx twelve) which all communicate through stunnel to a central syslog server. The version of stunnel we are using on SLES9 is: stunnel-4.05-20.1. The other machines are a mix of 32bit and 64bit Xeons. The seg fault seems to happen when syslog starts to talk through stunnel. The program is a binary rpm install for 64bit SLES10 and is being run in standalone mode as a client connecting to a stunnel/syslog server running SLES9. OS:- SLES10 x86_64 Packages:- Stunnel 4-14-14.2 Syslog-ng-1.6.8-20.4 Openssl-0.9.8a-18.4 uname -a: Linux server 2.6.16.21-0.15-smp #1 SMP Tue Jul 25 15:28:49 UTC 2006 x86_64 x86_64 x86_64 GNU/Linux libc version: libc.so.6 => /lib64/libc.so.6 (0x00002ae068cf2000) openssl version: OpenSSL 0.9.8a 11 Oct 2005 stunnel.conf:- # Copyright by Michal Trojnara 2002-2004 # --with changes for SuSE package # client = yes | no # client mode (remote service uses SSL) # default: no (server mode) client = yes # # chroot + user (comment out to disable) # chroot = /var/lib/stunnel/ setuid = stunnel setgid = nogroup # note about the chroot feature and the "exec" keyword to start other # services... # while the init script /etc/init.d/stunnel will copy the binaries and libraries # into the chroot jail, more files might be needed in the jail (configuration files etc.) pid = /var/run/stunnel.pid # # debugging # debug = 7 output = /var/log/stunnel.log # # Some performance tunings # # disable Nagle algorithm (a.k.a. tinygram prevention, see man 7 tcp) socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # compression = rle # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Authentication stuff # verify = 2 # Don't forget to c_rehash CApath; CApath is located inside chroot jail: # CApath = /certs # It's often easier to use CAfile: # CAfile = /etc/stunnel/certs.pem # Don't forget to c_rehash CRLpath; CRLpath is located inside chroot jail: # CRLpath = /crls # Alternatively you can use CRLfile: # CRLfile = /etc/stunnel/crls.pem CAfile = /etc/openldap/rootcert.pem cert = /etc/ssl/certs/thorincert.pem key = /etc/ssl/certs/thorinkey.pem verify = 2 [5140] accept = 127.0.0.1:514 connect = xxx.xxx.xxx.xxx:5140 /var/log/messages:- kernel: Kernel logging (proc) stopped. Sep 21 13:51:00 thorin kernel: Kernel log daemon terminating. Sep 21 13:51:01 thorin syslog-ng[3146]: syslog-ng version 1.6.8 going down Sep 21 13:51:01 thorin syslog-ng[3769]: syslog-ng version 1.6.8 starting Sep 21 13:51:01 thorin syslog-ng[3769]: Changing permissions on special file /dev/tty10 Sep 21 13:51:01 thorin syslog-ng[3769]: Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds Sep 21 13:51:06 thorin kernel: klogd 1.4.1, log source = /proc/kmsg started. Sep 21 13:51:06 thorin kernel: stunnel[3739]: segfault at 000000005569a9f0 rip 000055555555b793 rsp 00005555556b2f60 error 4 var/log/stunnel.log:- stunnel 4.14 on x86_64-suse-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2006.09.21 13:48:25 LOG7[3396:1]: RAND_status claims sufficient entropy for the PRNG 2006.09.21 13:48:25 LOG6[3396:1]: PRNG seeded successfully 2006.09.21 13:48:25 LOG7[3396:1]: Certificate: /etc/ssl/certs/thorincert.pem 2006.09.21 13:48:25 LOG7[3396:1]: Key file: /etc/ssl/certs/thorinkey.pem 2006.09.21 13:48:25 LOG7[3396:1]: Loaded verify certificates from /etc/openldap/rootcert.pem 2006.09.21 13:48:25 LOG6[3396:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.09.21 13:48:25 LOG6[3396:1]: poll() used - no FD_SETSIZE limit for file descriptors 2006.09.21 13:48:25 LOG5[3396:1]: 500 clients allowed 2006.09.21 13:48:25 LOG7[3396:1]: FD 4 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: FD 5 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: FD 6 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: SO_REUSEADDR option set on accept socket 2006.09.21 13:48:25 LOG7[3396:1]: 5140 bound to 127.0.0.1:514 2006.09.21 13:48:25 LOG7[3397:1]: Created pid file /var/run/stunnel.pid 2006.09.21 13:48:25 LOG7[3397:0]: Waiting -1 second(s) for 2 file descriptor(s) 2006.09.21 13:49:20 LOG7[3397:0]: CONTEXT 1, FD=4, (IN)->() 2006.09.21 13:49:20 LOG7[3397:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.09.21 13:49:20 LOG7[3397:1]: 5140 accepted FD=7 from 127.0.0.1:7323 2006.09.21 13:49:20 LOG7[3397:1]: Creating a new context 2006.09.21 13:49:20 LOG7[3397:1]: Context 2 created 2006.09.21 13:49:20 LOG7[3397:2]: Context swap: 1 -> 2 It waits at the last entry until syslog tries to connect. And that's where the useful logging stops, after that it's a seg fault. Hope you can point me in the right direction... Jon Howse ---------------------------------------------------------------------------- St Brendan's Sixth Form College --- STAFF e-mail Please consider the environment before printing this email. This e-mail is confidential and intended solely for the use of the individual to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of St Brendan's Sixth Form College. If you are not the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender. Please report any abuse of this e-mail service to postmaster(a)stbrn.ac.uk ---------------------------------------------------------------------------- *** This e-mail has been scanned by Symantec Anti-Virus software. ***

1 0

Would you plz help me? I have problem with defining ciphers in stunnel
by hjanzadeh＠sinamicro.com 19 Sep '06

19 Sep '06

1 0

4.17 stunnel with syslog-ng
by Jason Englander 15 Sep '06

15 Sep '06

I have a logging server at home set up with syslog-ng and stunnel. Earlier this morning, I upgraded stunnel on a logging client machine from 4.15 to 4.17, no problems. I upgraded the server from 4.15 to 4.17 and stunnel seemed to hang (run, but not detach) on startup. Very long story short (it was too early, I hadn't had enough coffee yet <g>), stunnel was trying to log to syslog, which wasn't running yet. Putting aside that I should've been using "output = /var/log/stunnel.log" instead, for a log server of all things :-), did something change in stunnel or did I screw something up that I don't remember doing? My startup script has been starting stunnel, then syslog-ng for years. I haven't downgraded to verify that it does/doesn't happen starting with a particular version, but I might do that later today out of curiosity. (before fixing, upgrading "important" machines) Also, FYI - configure created a file named "6," in the source directory with this in it: no LIBS=-lz -ldl -lutil -lpthread -L/usr/local/ssl/lib -lssl -lcrypto This seems to be the offending line in configure: echo "${ECHO_T}no" >&6, LIBS="$saved_LIBS" -> echo "${ECHO_T}no" >&6; LIBS="$saved_LIBS" I ran 'autoreconf -f -i' (autoconf 2.60, automake 1.9.6) and the line isn't in the new ./configure any more. Jason -- Jason Englander <jason(a)englanders.cc> 394F 7E02 C105 7268 777A 3F5A 0AC0 C618 0675 80CA

2 1

cannot compile stunnel on solaris 10 in a zone
by tomvo＠absi.be 15 Sep '06

15 Sep '06

Hi, I'm trying to compile stunnel on a solaris 10 (06/06 release) in a normal (non-global) zone. the compile fails at the mknod command. How do I install stunnel ? I could ofcourse create the device myself in the global zone, but i think it was in /usr/local/var/lib/stunnel/dev, I don't think that our user zone will have access to this device if we create it in the global zone. Anyone else struggled with the same problem ? thx, Tom. --------------------------------------------------------------------------- Tom Van Overbeke - ABSI Service Delivery Coordinator email: tomvo(a)absi.be Tel: +32 2 333 40 00 - Fax: +32 2 333 40 60 website: http://www.absi.be ---------------------------------------------------------------------------

1 0

stunnel problem on hp-ux 11.11
by matt.miller＠accenture.com 13 Sep '06

13 Sep '06

System specs: HP-UX 11.11 Stunnel 4.15 OpenSSL 0.8.7i Config File: ; Certificate/key is needed in server mode and optional in client mode ;cert = /opt/iexpress/stunnel/etc/stunnel/mail.pem ;key = /opt/iexpress/stunnel/etc/stunnel/mail.pem ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /opt/iexpress/stunnel/var/lib/stunnel/ ;setuid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /tmp/stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /opt/iexpress/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /opt/iexpress/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;foreground = yes output = stunnel.log ; Service-level configuration [pop3s] ; Use it for client mode client = yes ;accept = 995 ;connect = 110 accept = localhost:110 connect = POP3S.MAILSERVER:995 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Problem: When I try to execute the following command "telnet localhost 110" I get an entry in the stunnel log file and I am unable to connect to the secure pop3 server. I know that this is not a firewall issue because I can telnet directly to the POP3S.MAILSERVER on port 995 and establish a connection, I also know that the server works fine because I set up stunnel on my windows xp machine and that did not have a problem establishing a connection. Any help on this issue would be great. Here is the log I am getting 2006.08.10 18:23:03 LOG5[16138:1]: stunnel 4.15 on hppa2.0w-hp-hpux11.11 with Op 2006.08.10 09:43:55 LOG5[7158:1]: 2000 clients allowed 2006.08.10 09:43:55 LOG7[7158:1]: FD 4 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: FD 5 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: FD 6 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: SO_REUSEADDR option set on accept socket 2006.08.10 09:43:55 LOG7[7158:1]: pop3s bound to 127.0.0.1:110 2006.08.10 09:43:55 LOG7[7263:1]: Created pid file /tmp/stunnel.pid 2006.08.10 16:15:45 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57040 2006.08.10 16:15:45 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 16:30:34 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57156 2006.08.10 16:30:34 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 16:45:34 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57275 2006.08.10 16:45:34 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:00:36 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57401 2006.08.10 17:00:36 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:15:36 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57506 2006.08.10 17:15:36 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:30:35 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57614 2006.08.10 17:30:35 LOG3[7263:1]: Connection rejected: create_client failed Matt T. Miller Accenture Minneapolis, MN USA 612-277-1826 aim: mttmiller8 email: matt.miller(a)accenture.com This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

RE: [stunnel-users] stunnel and AJP
by Jones Scott - sjones 13 Sep '06

13 Sep '06

Any chance you could send me a sample configuration file? :) Just got it install and going to start trying to get it setup. I am going to try to end the tunnel on a BigIP box. So just set it up on the apache server and hope it can end on the BigIP box. Thanks -----Original Message----- From: Richard.Hall [mailto:Richard.Hall@ingenta.com] Sent: Friday, August 25, 2006 4:08 PM To: Jones Scott - sjones Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel and AJP Jason, On Fri, 25 Aug 2006, Jones Scott - sjones wrote: > Has anyone used stunnel to secure AJP traffic from apache to jboss Short answer: Yes. - Apache + mod_jk configured to talk to stunnel client on localhost rather than to JBoss AJP13 port - stunnel client talks to remote stunnel server - stunnel server talks to JBoss AJP13 port on _its_ localhost. Works a treat :-) We've even done it with a third machine in the middle, running an stunnel server and client back-to-back. Just don't ask why! HTH, Richard ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. *************************************************************************

2 1

stunnel going to BigIP ssl
by Jones Scott - sjones 13 Sep '06

13 Sep '06

Has anyone used stunnel to end at a BipIP to decode the ssl traffic? If so, any issues or concerns? Thanks *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

1 0

"SSL_read returned WANT_READ: retrying" at 30Hz
by Vincent Lascaux 12 Sep '06

12 Sep '06

Hi, I'm trying to use rsync (2.6.8) through STunnel (4.16) to synchronize two PC over the internet (they both have the same version of stunnel and rsync). On the server, I have STunnel running with this configuration: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log [rsync] accept = 273 connect = 873 On the client I have this configuration: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log client = yes [rsync] accept = 873 connect = UrlOfMyServer:273 Then I connect with rsync using rsync -a -h --progress --stats --partial Account@localhost::RemotePath LocalPath I think the connection is not really stable. RSync sometimes hang. The log file on the client side show 2006.09.11 21:33:11 LOG7[2008:1468]: SSL_read returned WANT_READ: retrying at 30Hz (that's right, it means 30 times a second). My log file nearly gets bigger faster than my downloaded file ;) Is it expected? What does this line mean? I turned TCP_NODELAY to 0 thinking that it my give me synchronous sockets and that it would remove that error, but it didn't... Any help appreciated, Thanks -- Vincent

2 3

Stunnel 4.17 released
by Michal Trojnara 10 Sep '06

10 Sep '06

This is a bugfix release. Upgrade is recommended. Version 4.17, 2006.09.10, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8c. * Bugfixes - Problem with detecting getaddrinfo() in ./configure fixed. - Compilation problem due to misplaced #endif in ssl.c fixed. - Duplicate 220 in smtp_server() function in protocol.c fixed. - Minor os2.mak update. - Minor update of safestring()/safename() macros. sha1sum for stunnel-4.17.tar.gz file: 7a0ea800935e798bf938756000b57d002a99c280 Homepage and download: http://stunnel.mirt.net/ Best regards, Mike

1 0

Multiple HTTPS endpoints
by Andrew Culross 07 Sep '06

07 Sep '06

Can I use stunnel to connect mutiple https endpoints? I'm wondering if a config file like the below would work: [https] accept = 9876 connect = xxx.xxx.xxx.xxx:443 [https] accept = 9875 connect =yyy.yyy.yyy.yyy:443 Thanks in advance ! Andrew Culross TwoFour Systems (914) 220-8849 www.TwoFour.Com The views and opinions expressed in this e-mail message are the sender's own and do not necessarily represent the views and opinions of {TwoFour Systems, LLC or F-O-R Software, LLC}

1 0

Re: [stunnel-users] RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 07 Sep '06

07 Sep '06

Hans Werner Strube wrote: > Michal Trojnara wrote: ... > > I'm going to do it the hard way and add another parameter to > > s_poll_wait() function. > > > > IMHO the timeout should be between 100ms and 500ms. What do you think? > > I have not tested the minimum required. However, it should be as short > as possible, since for a client using TLS, the full delay will always > occur on starting a connection. ... I have now done some measurements using snoop on a Solaris Ultra 2 SMTP server (100 MBit/s) with a Windows XP SP2 client (AMD Duron 1 GHz, 56 kBit/s phone-line modem, SeaMonkey 1.04 mail sender [equivalent to Thunderbird 1.5.x]). The delays between the end of initial connection handshake and the first nonzero data packet for six connections were usually between 10 and 100 ms but once reached 150 ms. Thus, 200 ms may be a reasonable value (although the sample is too small to rule out rare failures).

1 0

windows load levels
by Alex Turner 05 Sep '06

05 Sep '06

Guys, Bit of a newbie question here - but very import to me at least. We are looking to secure a web server that does no currently support SSL. One reason for this is that we want to be able to run the server on multiple hosts and doing so means sharing the sessions etc :-( So - I am interested if anyone has tested the stuffing out of stunnel on windows. IE seeing how well it could handle several hundred sockets simultaneously. Not only from a resource point of view, but from a scaling (n, n**2 etc) point of view. Any input at all will be very welcome. Soon I will be starting some test of my own using JMeter to load test. If anyone is interested in the results I will be happy to post. Cheers AJ Alexander J Turner Ph.D. HYPERLINK "http://www.deployview.com"www.deployview.com HYPERLINK "http://www.nerds-central.blogspot.com"www.nerds-central.blogspot.com HYPERLINK "http://www.project-network.com"www.project-network.com -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.11.7/437 - Release Date: 04/09/2006

2 1

Stunnel and CryptoApi
by Marco Aldegheri 05 Sep '06

05 Sep '06

Hello list! Someone knows if there is any way to integrate a Windows stunnel in client mode with the Windows Certificate Store? As OpenVPN does with the cryptoapicert parameter in my opinion it would be very useful because: 1. the private key would not just reside in a pem file but could be set not exportable. 2. the private key could be saved on a smartcard. I found a japaneese wstunnel project that seems to do it but I couldn't find any document about it in english and the gui is only in japaneese. Any hints? Thank you, Marco Aldegheri __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Real address of client
by Gonzalo Diethelm 03 Sep '06

03 Sep '06

Hello, linux: Linux asus-gonzo 2.6.15-26-686 #1 SMP PREEMPT Thu Aug 3 03:13:28 UTC 2006 i686 GNU/Linux stunnel: stunnel 4.14 on i486-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 apache: Apache/2.0.55 I am using stunnel in Ubuntu to provide https serving to an http-only Apache installation. The stunnel config is: cert = /home/gonzo/src/bg/run/SSL/server.crt key = /home/gonzo/src/bg/run/SSL/server.crt chroot = /var/run/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = no [https] accept = 443 connect = 80 TIMEOUTclose = 0 Everything works perfectly, except for one minor detail: on the server, my PHP scripts do not have access to the real IP address of the client, and they always see this value as 127.0.0.1. I am aware the manual says that, if you use -l or -L, there will be an additional REMOTE_HOST environment variable with the desired IP address, but I am not sure how to make this work from a setup like mine, where the http server process is already running. Any help or hints are greatly appreciated. Best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

2 1

4.16 compilation fails for openssl without engine
by Hans Werner Strube 01 Sep '06

01 Sep '06

When openssl was compiled without engine support, compilation of src/ssl.c in stunnel-4.16 fails because of a misplaced #endif. Patch: --- src/ssl.c.ORI Thu Jun 29 23:12:03 2006 +++ src/ssl.c Fri Sep 1 11:30:25 2006 @@ -286,8 +286,6 @@ s_log(LOG_DEBUG, "Engine %d initialized", current_engine+1); } -#endif - ENGINE *get_engine(int i) { if(i<1 || i>current_engine) return NULL; @@ -294,4 +292,6 @@ return engines[i-1]; } +#endif + /* End of ssl.c */

1 0

Duplicate 220 in protocol.c, smtp_server
by Hans Werner Strube 01 Sep '06

01 Sep '06

At least since stunnel 4.15 - but not yet in 4.09 (don't know about the intermediate versions) - there is a (cosmetic only?) bug in the "welcome" forwarding of the smtp_server in protocol.c (lines 177-187 in 4.16): fdgetline(c, c->remote_fd.fd, line); if(!isprefix(line, "220")) { s_log(LOG_ERR, "Unknown server welcome"); longjmp(c->err, 1); } fdprintf(c, c->local_wfd.fd, "220%s + stunnel", line); fdgetline(c, c->local_rfd.fd, line); if(!isprefix(line, "EHLO ")) { s_log(LOG_ERR, "Unknown client EHLO"); longjmp(c->err, 1); } Although the line read from remote_fd.fd already starts with "220", another 220 is prepended in forwarding to local_wfd.fd, line 182. This seems to haveno adverse effects, but this line should better be changed to: fdprintf(c, c->local_wfd.fd, "%s + stunnel", line);

1 0

stunnel 4.16 released
by Michal Trojnara 01 Sep '06

01 Sep '06

A new version of stunnel has been released. Version 4.16, 2006.08.31, urgency: MEDIUM: * New features sponsored by Hewlett-Packard - A new global option to control engine: engineCtrl = <command>[:<parameter>] - A new service-level option to select engine to read private key: engineNum = <engine number> - OCSP support: ocsp = <URL> * New features - A new option to select version of SSL protocol: sslVersion = all|SSLv2|SSLv3|TLSv1 - Visual Studio vc.mak by David Gillingham <dgillingham(a)gmail.com>. - OS2 support by Paul Smedley (http://smedley.info) * Bugfixes - An ordinary user can install stunnel again. - Compilation problem with --enable-dh fixed. - Some minor compilation warnings fixed. - Service-level CRL cert store implemented. - GPF on protocol negotiations fixed. - Problem detecting addrinfo() on Tru64 fixed. - Default group is now detected by configure script. - Check for maximum number of defined services added. - OpenSSL_add_all_algorithms() added to SSL initialization. - configure script sections reordered to detect pthread library funcions. - RFC 2487 autodetection improved (thx to Hans Werner Strube). High resolution s_poll_wait() not currently supported by UCONTEXT threading. - More precise description of cert directory file names (thx to Muhammad Muquit). * Other changes - Maximum number of services increased from 64 to 256 when poll() is used. Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1 hash for stunnel-4.16.tar.gz file: 6772e0c7f26c2596564ba66978597db8cd229a72 Best regards, Mike

2 1

Windows simultaneous sockets
by Alex 26 Aug '06

26 Aug '06

Guys, Bit of a newbie question here - but very import to me at least. We are looking to secure a web server that does no currently support SSL. One reason for this is that we want to be able to run the server on multiple hosts and doing so means sharing the sessions etc :-( So - I am interested if anyone has tested the stuffing out of stunnel on windows. IE seeing how well it could handle several hundred sockets simultaneously. Not only from a resource point of view, but from a scaling (n, n**2 etc) point of view. Any input at all will be very welcome. Soon I will be starting some test of my own using JMeter to load test. If anyone is interested in the results I will be happy to post. Cheers AJ -- www.deployview.com www.nerds-central.com www.project-network.com

1 0

stunnel and AJP
by Jones Scott - sjones 25 Aug '06

25 Aug '06

Has anyone used stunnel to secure AJP traffic from apache to jboss *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

2 1

stunnel 4-15 through proxy server
by Ingvar Tjøstheim 25 Aug '06

25 Aug '06

Hello I am on a network at work behind a firewall and a proxy server. I can connect to my friends linux computer with putty using proxy configuration and port 443. My friend set up his SSH server on port 443, of course. Yesterday, back home, I installed the following on my Windows2000 computer: Win32OpenSSL-v0.9.8b stunnel ver 4-14 FreeProxy version 3.92 This is the stunnel config file for my home computer: client=no verify=0 [wow] accept = 443 connect = 127.0.0.1:3456 TIMEOUTclose = 0 I set up my router to forward port 443 to this computer. I also registered a DynDNS domain and set up a client to update it. Then, still at home, I prepared another computer which I brought to work today. I installed the following on an XP machine: Win32OpenSSL-v0.9.8b stunnel ver 4-14 (which I upgraded to 4.15 today) SockScap_sc32r238 I set up SockScap to connect to 127.0.0.1 on port 2345 and used it to tunnel a program to the internet through my LAN and this Win2K computer. This was working fine when I was at home. My network at home has no proxy server, and I changed stunnel on my XP computer once at work to version 4-15. Then I added the two protocol lines in the config file as you see below. This is the config file on my XP computer at work: verify = 0 client = yes [wow] accept = 2345 protocol = connect protocolHost = www-proxy.DOMAINNAME.no:80 connect = MYDOMAINNAME.dnsalias.com:443 TIMEOUTclose = 0 Now, the funny thing is that it doesn't work. I used to have a SSH server on my computer at home (which is not running now), and I could connect to it from work. I know the setup could work if I just did things right. I know the FreeProxy and SockScap stuff works, cause it did at home. stunnel and the network is the only difference. Still I get these messages on the XP machine running stunnel as client at work when the SockScap program connects to it: 2006.08.25 10:02:29 LOG5[1280:2940]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.08.25 10:02:29 LOG5[1280:2940]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.08.25 10:02:29 LOG5[1280:2156]: No limit detected for the number of clients 2006.08.25 10:02:59 LOG5[1280:664]: wow connected from 127.0.0.1:3723 2006.08.25 10:03:05 LOG5[1280:972]: wow connected from 127.0.0.1:3725 2006.08.25 10:03:09 LOG5[1280:664]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.08.25 10:03:15 LOG5[1280:972]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket ...and it doesn't work. The program I try using through the tunnel never manages to connect. Anyone have a clue? Thank you very much!

1 0

Re: [stunnel-users] safestring and safename insecure
by Hans Werner Strube 24 Aug '06

24 Aug '06

Michal Trojnara wrote: > Assuming on some systems isprint(x) != isprint(x&0xff): any idea how to > exploit this "insecure" code? > > BTW: At least on Linux and Mac OS X isprint() returns 0 in both cases. The same holds for Solaris. I did not actually encounter an error but just got the idea that something may be insecure here by looking at the lines. After all, isprint etc. are often table-based macros without range-checking the argument. And "man isprint" clearly says that the character is unsigned: (Solaris:) The macro isascii() is defined on all integer values; the rest are defined only where the argument is an int, the value of which is representable as an unsigned char, or EOF, (Linux:) These functions check whether c, which must have the value of an unsigned char or EOF, falls into a certain character class according to the current locale.

1 0

safestring and safename insecure
by Hans Werner Strube 24 Aug '06

24 Aug '06

The macros safestring and safename in common.h are insecure if called for a character with high bit set, because (int)*p will sign-extend the byte on machines where char is signed. Possible patch (here for safestring; for safename correspondingly with isprint -> isalnum): do {char *p; for(p=(s); *p; p++) if(!isprint((int)*(unsigned char *)p)) *p='.';} while(0)

2 1

Re: [stunnel-users] accept is not allowed in inetd mode
by Tomasz Feliksiak 24 Aug '06

24 Aug '06

> I'm afraid I won't be able to tell you what's wrong with your > /etc/stunnel/smtps.conf without your /etc/stunnel/smtps.conf file. > 8-) > I guess you didn't define any service section. > > BTW. Please make sure to read the fine manual. There's also a Polish > version. > http://stunnel.mirt.net/static/stunnel.pl.html > > Greetings from Poland, > Mike You were right. I only define ports but dont uncomment protocol names in [] (like [pop3s]). [pop3s] accept = 995 connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 465 connect = 25 Now it looks like this and it's working (earlier i have two configs, one per service). Poor thing about this is that it don't log anything before you dont uncomment this [] :P - hope no one other make this mistake. When I uncomment everything else was simple cause I have log :) and know what's going on. There was a problem with binding to ports cause I try to run it by inetd but I find your post at google to not run it by inetd. I change stunnel-inetd-4.15-1 to stunnel-standalone-4.15-1 (PLD Rulez :P) and problems gone. Is possible to run stunnel by inetd??? Thanks for help Michal. Stunnel is great :) Ps. I read the manual, english version. Sad thing is that I dont find out where I make mistake and when I read Polish wersion I do. Good thing is that it will be help for others who make this simple mistake. -- Pozdrawiam Tomasz Feliksiak vonom(a)intertel.net.pl

2 2

Stunnel Crash: Gmail SMTP over TLS
by Shatadal Ghosh 23 Aug '06

23 Aug '06

Hi, I am using stunnel 4.15 on Windows XP SP1 with Mozilla Thunderbird as the e-mail client. I do not have openSSL installed locally. I do have the libssl32.dll and libeay32.dll in the same directory as stunnel.exe (C:\Program Files\stunnel). I am running stunnel as a service. Stunnel crashes when I use it to send e-mail (SMTP via TLS) via gmail. According to the e-mail client configuration page on the gmail website http://mail.google.com/support/bin/answer.py?answer=13287&topic=1555 I tried to use SMTP over TLS to connect to smtp.gmail.com:587 My gmail-smtps block in stunnel.conf was ; SMTP service, listens on localhost:250 [gmail-smtps] protocol=smtp accept=localhost:250 connect=smtp.gmail.com:587 On trying to send an e-mail message via the above configuration stunnel crashed. The log file is as follows 2006.06.14 03:17:15 LOG5[3956:3512]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.06.14 03:17:15 LOG5[3956:3512]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.06.14 03:17:15 LOG5[3956:3600]: No limit detected for the number of clients 2006.06.14 03:17:15 LOG7[3956:3600]: FD 172 in non-blocking mode 2006.06.14 03:17:15 LOG7[3956:3600]: SO_REUSEADDR option set on accept socket 2006.06.14 03:17:15 LOG7[3956:3600]: gmail-pop3s bound to 127.0.0.1:1100 2006.06.14 03:17:15 LOG7[3956:3600]: FD 180 in non-blocking mode 2006.06.14 03:17:15 LOG7[3956:3600]: SO_REUSEADDR option set on accept socket 2006.06.14 03:17:15 LOG7[3956:3600]: gmail-smtps bound to 127.0.0.1:250 ....# info about other mail connections 2006.06.14 03:17:26 LOG7[3956:3600]: gmail-smtps accepted FD=236 from 127.0.0.1:3665 2006.06.14 03:17:26 LOG7[3956:3600]: Creating a new thread 2006.06.14 03:17:26 LOG7[3956:3600]: New thread created 2006.06.14 03:17:26 LOG7[3956:2812]: gmail-smtps started 2006.06.14 03:17:26 LOG7[3956:2812]: FD 236 in non-blocking mode 2006.06.14 03:17:26 LOG7[3956:2812]: TCP_NODELAY option set on local socket 2006.06.14 03:17:26 LOG5[3956:2812]: gmail-smtps connected from 127.0.0.1:3665 2006.06.14 03:17:26 LOG7[3956:2812]: FD 268 in non-blocking mode 2006.06.14 03:17:26 LOG7[3956:2812]: gmail-smtps connecting 64.233.167.111:587 2006.06.14 03:17:26 LOG7[3956:2812]: connect_wait: waiting 10 seconds 2006.06.14 03:17:26 LOG7[3956:2812]: connect_wait: connected 2006.06.14 03:17:26 LOG7[3956:2812]: Remote FD=268 initialized 2006.06.14 03:17:26 LOG7[3956:2812]: TCP_NODELAY option set on remote socket 2006.06.14 03:17:26 LOG5[3956:2812]: Negotiations for smtp (client side) started 2006.06.14 03:17:26 LOG7[3956:2812]: <- 220 mx.gmail.com ESMTP w66sm450524pyw 2006.06.14 03:17:26 LOG7[3956:2812]: -> 220 mx.gmail.com ESMTP w66sm450524pyw <logfile ends> What mistake am I making? Fortunately it seems that gmail supports SMTP over SSL too (smtp.gmail.com:465) and I am using that. However I am also facing this problem with another account which unfortunately allows SMTP only over TLS. Thanks, Shatadal. --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 0624-1, 06/13/2006 Tested on: 6/14/2006 6:22:04 AM avast! - copyright (c) 2000-2006 ALWIL Software. http://www.avast.com _________________________________________________________________ Is your PC infected? Get a FREE online computer virus scan from McAfee® Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users