- stunnel-users - stunnel.org

autostart stunnel at boot
by christof mestdag 03 Apr '06

03 Apr '06

hi is there another solution for booting stunnel without writting a custom rc5 script ? DO i have to make changes to make it works as a daemon? -> stunnel.conf client=yes output=/var/log/stunnel.log [ldaps] accept=localhost:389 connect=192.168.1.101:636

1 0

Re: [stunnel-users] Config for client proxy https (privoxy + stunnel)
by Xavier Cheney 02 Apr '06

02 Apr '06

Hi everybody, I found my mistake !! The process is not good. This is the correct process : browser (localhost:8118) <-> (localhost:8118) privoxy <-web-> server [and] (localhost:8888) stunnel (server:443) So with only privoxy like proxy in my Firefox config - when I ask http://server/page.html , data is modified by privoxy - when I ask https://server/page.html, data is transmitted by privoxy - when I ask http://localhost:888/page.html data is modified by privoxy and the real data transmitted is https://server/page.html , stunnel managing SSL between localhost and server. My new config : [https] accept = 8888 connect = server:443 In fact, it was the stunnel main function that I didn't understand. Sorry :) Thanks to exos, and hope it will help someone, Xavier Xavier Cheney <xav26000(a)yahoo.fr> a écrit : Hi, I wan to customize web page before viewing by my browser Firefox. With "privoxy" (www.privoxy.org) I can modify (proxy filter) HTTP web page, but not HTTPS pages. So, I want to use stunnel, to transfer HTTPS in HTTP between my proxy and server, like this : browser (8118) <-> (8118) privoxy (8888) <-> (8888) stunnel (server:443) <-web-> server This is my stunnel.conf : ---------------------------------------------------- ciphers = RC4-MD5:DES-CBC3-SHA verify = 0 debug = 7 client = yes [https] accept = 8888 connect = server.server.com:443 TIMEOUTclose = 0 ---------------------------------------------------- And my log : ---------------------------------------------------- 2006.03.31 11:40:02 LOG7[3396:2944]: RAND_status claims sufficient entropy for the PRNG 2006.03.31 11:40:02 LOG6[3396:2944]: PRNG seeded successfully 2006.03.31 11:40:02 LOG7[3396:2944]: SSL context initialized for service https 2006.03.31 11:40:02 LOG5[3396:2944]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.03.31 11:40:02 LOG5[3396:2944]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.03.31 11:40:02 LOG5[3396:2952]: No limit detected for the number of clients 2006.03.31 11:40:02 LOG7[3396:2952]: FD 192 in non-blocking mode 2006.03.31 11:40:02 LOG7[3396:2952]: SO_REUSEADDR option set on accept socket 2006.03.31 11:40:02 LOG7[3396:2952]: https bound to 0.0.0.0:8888 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=200 from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3320]: https started 2006.03.31 11:40:07 LOG7[3396:3320]: FD 200 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3320]: https connected from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:3320]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3320]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: waiting 10 seconds 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: connected 2006.03.31 11:40:07 LOG7[3396:3320]: Remote FD=232 initialized 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): before/connect initialization 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server certificate A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server done A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client key exchange A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:07 LOG7[3396:3320]: 1 items in the session cache 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects (SSL_connect()) 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 client renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects (SSL_accept()) 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache hits 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache misses 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache timeouts 2006.03.31 11:40:07 LOG6[3396:3320]: SSL connected: new session negotiated 2006.03.31 11:40:07 LOG6[3396:3320]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2006.03.31 11:40:07 LOG7[3396:3320]: Socket closed on read 2006.03.31 11:40:07 LOG7[3396:3320]: SSL write shutdown 2006.03.31 11:40:07 LOG7[3396:3320]: SSL alert (write): warning: close notify 2006.03.31 11:40:07 LOG7[3396:3320]: SSL_shutdown retrying 2006.03.31 11:40:07 LOG7[3396:3320]: SSL doesn't need to read or write 2006.03.31 11:40:07 LOG6[3396:3320]: s_poll_wait timeout: connection close 2006.03.31 11:40:07 LOG5[3396:3320]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:07 LOG7[3396:3320]: https finished (0 left) 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=220 from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3944]: https started 2006.03.31 11:40:07 LOG7[3396:3944]: FD 220 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3944]: https connected from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:3944]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3944]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3944]: connect_wait: waiting 10 seconds 2006.03.31 11:40:08 LOG7[3396:3944]: connect_wait: connected 2006.03.31 11:40:08 LOG7[3396:3944]: Remote FD=232 initialized 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): before/connect initialization 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:08 LOG7[3396:3944]: 1 items in the session cache 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects (SSL_connect()) 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 client renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects (SSL_accept()) 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 1 session cache hits 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache misses 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache timeouts 2006.03.31 11:40:08 LOG6[3396:3944]: SSL connected: previous session reused 2006.03.31 11:40:08 LOG7[3396:3944]: Socket closed on read 2006.03.31 11:40:08 LOG7[3396:3944]: SSL write shutdown 2006.03.31 11:40:08 LOG7[3396:3944]: SSL alert (write): warning: close notify 2006.03.31 11:40:08 LOG7[3396:3944]: SSL_shutdown retrying 2006.03.31 11:40:08 LOG7[3396:3944]: SSL doesn't need to read or write 2006.03.31 11:40:08 LOG6[3396:3944]: s_poll_wait timeout: connection close 2006.03.31 11:40:08 LOG5[3396:3944]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:08 LOG7[3396:3944]: https finished (0 left) ---------------------------------------------------- Note the first "Socket closed on read". I think the problem is there. The web reply is "Bad Request (Invalid URL)" Where did I do a mistake ? Thanks for answer, Xavier

1 0

Config for client proxy https (privoxy + stunnel)
by Xavier Cheney 31 Mar '06

31 Mar '06

Hi, I wan to customize web page before viewing by my browser Firefox. With "privoxy" (www.privoxy.org) I can modify (proxy filter) HTTP web page, but not HTTPS pages. So, I want to use stunnel, to transfer HTTPS in HTTP between my proxy and server, like this : browser (8118) <-> (8118) privoxy (8888) <-> (8888) stunnel (server:443) <-web-> server This is my stunnel.conf : ---------------------------------------------------- ciphers = RC4-MD5:DES-CBC3-SHA verify = 0 debug = 7 client = yes [https] accept = 8888 connect = server.server.com:443 TIMEOUTclose = 0 ---------------------------------------------------- And my log : ---------------------------------------------------- 2006.03.31 11:40:02 LOG7[3396:2944]: RAND_status claims sufficient entropy for the PRNG 2006.03.31 11:40:02 LOG6[3396:2944]: PRNG seeded successfully 2006.03.31 11:40:02 LOG7[3396:2944]: SSL context initialized for service https 2006.03.31 11:40:02 LOG5[3396:2944]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.03.31 11:40:02 LOG5[3396:2944]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.03.31 11:40:02 LOG5[3396:2952]: No limit detected for the number of clients 2006.03.31 11:40:02 LOG7[3396:2952]: FD 192 in non-blocking mode 2006.03.31 11:40:02 LOG7[3396:2952]: SO_REUSEADDR option set on accept socket 2006.03.31 11:40:02 LOG7[3396:2952]: https bound to 0.0.0.0:8888 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=200 from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3320]: https started 2006.03.31 11:40:07 LOG7[3396:3320]: FD 200 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3320]: https connected from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:3320]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3320]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: waiting 10 seconds 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: connected 2006.03.31 11:40:07 LOG7[3396:3320]: Remote FD=232 initialized 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): before/connect initialization 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server certificate A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server done A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client key exchange A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:07 LOG7[3396:3320]: 1 items in the session cache 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects (SSL_connect()) 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 client renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects (SSL_accept()) 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache hits 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache misses 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache timeouts 2006.03.31 11:40:07 LOG6[3396:3320]: SSL connected: new session negotiated 2006.03.31 11:40:07 LOG6[3396:3320]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2006.03.31 11:40:07 LOG7[3396:3320]: Socket closed on read 2006.03.31 11:40:07 LOG7[3396:3320]: SSL write shutdown 2006.03.31 11:40:07 LOG7[3396:3320]: SSL alert (write): warning: close notify 2006.03.31 11:40:07 LOG7[3396:3320]: SSL_shutdown retrying 2006.03.31 11:40:07 LOG7[3396:3320]: SSL doesn't need to read or write 2006.03.31 11:40:07 LOG6[3396:3320]: s_poll_wait timeout: connection close 2006.03.31 11:40:07 LOG5[3396:3320]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:07 LOG7[3396:3320]: https finished (0 left) 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=220 from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3944]: https started 2006.03.31 11:40:07 LOG7[3396:3944]: FD 220 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3944]: https connected from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:3944]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3944]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3944]: connect_wait: waiting 10 seconds 2006.03.31 11:40:08 LOG7[3396:3944]: connect_wait: connected 2006.03.31 11:40:08 LOG7[3396:3944]: Remote FD=232 initialized 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): before/connect initialization 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:08 LOG7[3396:3944]: 1 items in the session cache 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects (SSL_connect()) 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 client renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects (SSL_accept()) 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 1 session cache hits 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache misses 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache timeouts 2006.03.31 11:40:08 LOG6[3396:3944]: SSL connected: previous session reused 2006.03.31 11:40:08 LOG7[3396:3944]: Socket closed on read 2006.03.31 11:40:08 LOG7[3396:3944]: SSL write shutdown 2006.03.31 11:40:08 LOG7[3396:3944]: SSL alert (write): warning: close notify 2006.03.31 11:40:08 LOG7[3396:3944]: SSL_shutdown retrying 2006.03.31 11:40:08 LOG7[3396:3944]: SSL doesn't need to read or write 2006.03.31 11:40:08 LOG6[3396:3944]: s_poll_wait timeout: connection close 2006.03.31 11:40:08 LOG5[3396:3944]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:08 LOG7[3396:3944]: https finished (0 left) ---------------------------------------------------- Note the first "Socket closed on read". I think the problem is there. The web reply is "Bad Request (Invalid URL)" Where did I do a mistake ? Thanks for answer, Xavier --------------------------------- Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international.Téléchargez la version beta. --------------------------------- Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international.Téléchargez la version beta.

1 0

Stunnel client failed to connect to a server?
by Xia David You -X (xiyou - Varite Inc.＠Cisco) 31 Mar '06

31 Mar '06

Hi, I have a client which is build on stunnel which is failed to talk to a secured server while we can connect to the server with IE as client. We have both Server certificate and Client Certificate. From looking the log, it appears that the IE also got the same failure in the first step, but it did not give up and tried again with "2 1 0.0470 (0.0470) C>S SSLv2 compatible client hello" and successed. so what did we do wrong here? some extra openssl library need to be built in? thanks David Both Sever side SSL dump attached (IE client and Stunnel client).

1 0

unpublished Ceritificate
by Happy Manocha 28 Mar '06

28 Mar '06

Hi all, I am a newbie with Stunnel. Can anyone let me know how can I configure my client for a server , which does not have published certificate. Though I am able to connect but it gives a warning message "The server you are connected to is using a security certificate that could not be verifed...etc". Is there any way to avoid it? An early response will be appreciated. Regds Happy Manocha

2 1

stunnel runs in background but fails to do his job
by christof mestdag 19 Mar '06

19 Mar '06

hi, i'm having difficulties using the stunnel program. I've got some help to change the syntax from 3.X to 4.X but it doesn't work. I've got this config file -> client=yes output=/var/log/stunnel.log [ldaps] accept=localhost:389 connect=192.168.1.101:636 I run it with /usr/sbin/stunnel ./stunnel.conf -> check background: ps -ef | grep stunnel root 3270 ..... /usr/sbin/stunnel ./stunnel.conf Problem is when i close on server gate 389 i can't get any input. I expect the traffic going towards port 636 on server but it doenst. I can close port 636 and open just 389. He keeps sending everyting towards 389. I also tried to create a stunnel.conf by using make stunnel.conf in the tools directory ( in you tar.gz ) but nothing changes. /var/log/stunnel.log says -> date : stunnel 4.05 on i386-red hat .... with openssl 0.9.7a ->date : FD_SETSIZE=1024 file ulimt=1024 -> 500 clients allowed any input for my problem. It's kinda important. I'm really fed up with the tutorials which shows it works and everything always fails at my place :( greetz christof

1 0

converting old syntax to 4.x syntax
by christof mestdag 17 Mar '06

17 Mar '06

Hi, i've got a old syntax and i don't find what the new syntax might be. stunnel -c -d localhost:389 -r win2003server:636 ( I want to make a tunnel to the ssl port of the active directory server to allow password changes ) i've read a possibility which allows no use of certificates but it was in old syntax. any input to change that syntax? i thought it might be something like this. -> client=yes foreground=no accept = 389 connect = win2003server.FME.local what do i do with this. an upgrade manual speaks of an stunnel.conf file. But this one doesn't excists on my Red Hat Desktop computer. It says also that we have an /usr/local/etc/stunnel dir but i don't have that also. I only have an /etc/stunnel dir (which is totally empty ) and the /usr/sbin/stunnel tool ( version 4.05 ) thx in advance

2 2

Multiple Host Certificates
by Sligar, Benjamin 17 Mar '06

17 Mar '06

Is it possible to run one instance of stunnel and have it verify certain ports against different certificates? For instance: [listen1 5003] accept = 5003 connect = 10.61.0.132:7300 [listen2 5008] accept = 5008 connect = 10.61.0.132:7300 Would it be possible to have listen2 validate on a seperate certificate, or, will I need to run a second instance of stunnel on my box and have it point to the different certificate? Basically, I want to know if I can setup a different certificate on a per-port basis. I don't see any options in the definition of the listen port that I can specify a different CERT, only the default CERT option at the top of the config file. Version: stunnel-4.04 Options cert = /usr/local/conf/ssl.pem chroot = /usr/local/stunnel-4.04/var/run/stunnel/ pid = /stunnel.pid setuid = www setgid = webgroup options = NO_SSLv2 ciphers = DES-CBC3-SHA:IDEA-CBC-SHA:RC4-SHA:RC4-MD5:AES256-SHA:AES128-SHA uname -a Linux ssl 2.4.7-10 #1 Thu Sep 6 17:27:27 EDT 2001 i686 unknown gcc -v Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/2.96/specs gcc version 2.96 20000731 (Red Hat Linux 7.1 2.96-98) openssl version OpenSSL 0.9.6b [engine] 9 Jul 2001 This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

Help with config of stunnel.
by mike smith 16 Mar '06

16 Mar '06

I am trying to set up a tunnel for telnet. I am doing this just to learn how to get stunnel to work. I thought this would be easy way to learn how to use stunnel for other uses we have. My problem is I don't understand how to start it on the client side. I can telnet to the server without stunnel but I don't know how to start stunnel on the client side. The log file shows ssltelnet bound to 0.0.0.0:23 for the client and ssltelnet bound to 0.0.0.0:992 for the server If you have any ideas what I may need to do I would be greatfull. I'm sure that I'm missing a step configuring it. This is what my stunnel.conf files look like for the server cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/run/stunnel/ pid = /stunnel.pid setuid = nobody setgid = nobody client = no debug = 7 output = /stunnel.log [ssltelnet] accept = 992 connect = 23 For the Client cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/run/stunnel/ pid = /stunnel.pid setuid = nobody setgid = nobody client = yes debug = 7 output = /stunnel.log [ssltelnet] accept = 23 connect = 192.168.1.102:992 --------------------------------- Yahoo! Travel Find great deals to the top 10 hottest destinations! --------------------------------- Yahoo! Travel Find great deals to the top 10 hottest destinations!

1 0

IE tries to verify client certificate?
by Don Werve 15 Mar '06

15 Mar '06

I've got stunnel providing SSL wrapper services for an otherwise SSL-stupid vendor-webserver-thingy that listens on port 80. I'm using a wildcard certificate purchased from $VENDOR, and it seems to work fine in Safari, Firefox, w3m, and basically everything SSL aware known to Man. Except, that is, Internet Explorer, where the user gets a popup window asking them to choose a certificate to verify their connection. This is really throwing me for a loop; I've tried setting 'verify = 0' and 'options = ALL' in the service definition under stunnel, no dice. Any ideas why IE thinks it needs to verify, but nothing else does? -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

1 0

GeoTrust QuickSSL cert and stunnel
by Steve Shepherd 15 Mar '06

15 Mar '06

I've got a client that has a GeoTrust "QuickSSL" certificate (we normally deal with Thawte). I installed the cert/key, but it is not functioning (pulling up default certificate), so I figured I would need the CA. I gathered the CA, so in the file I have: Certificate Private Key Certificate GeoTrust CA Where is the default location to install other CA's and/or chained certs? Thanks!

1 0

RE: [stunnel-users] Static Version Built?
by Kevin A. McGrail 15 Mar '06

15 Mar '06

That would be my guess but the last time I wanted static binaries was Redhat 2.1 on a DEC Alpha-based machine, sorry. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users-bounces@mirt.net] On Behalf Of Hal Vaughan Sent: Wednesday, March 15, 2006 1:25 PM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Static Version Built? On Wednesday 15 March 2006 13:04, Kevin A. McGrail wrote: > Do you have static libraries in your SSL lib or just shared libraries? > i.e. libssl.a (static) and libssl.so (dynamic) or just one or the > other? > > Have you tested with ldd? > > For example, on my machine, I get this showing me I'm linking > dynamically. > > ldd /usr/sbin/stunnel > libutil.so.1 => /lib/libutil.so.1 (0x40023000) > libpthread.so.0 => /lib/i686/libpthread.so.0 (0x40027000) > libnsl.so.1 => /lib/libnsl.so.1 (0x4003b000) > libdl.so.2 => /lib/libdl.so.2 (0x40050000) > libssl.so.2 => /lib/libssl.so.2 (0x40053000) > libcrypto.so.2 => /lib/libcrypto.so.2 (0x40080000) > libc.so.6 => /lib/i686/libc.so.6 (0x42000000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) > > Regards, > KAM Yes, I'm getting the same thing, so it's linking to the shared libraries, even though in the cases I've checked, I have the static libraries. Hal _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

RE: [stunnel-users] Static Version Built?
by Kevin A. McGrail 15 Mar '06

15 Mar '06

Do you have static libraries in your SSL lib or just shared libraries? i.e. libssl.a (static) and libssl.so (dynamic) or just one or the other? Have you tested with ldd? For example, on my machine, I get this showing me I'm linking dynamically. ldd /usr/sbin/stunnel libutil.so.1 => /lib/libutil.so.1 (0x40023000) libpthread.so.0 => /lib/i686/libpthread.so.0 (0x40027000) libnsl.so.1 => /lib/libnsl.so.1 (0x4003b000) libdl.so.2 => /lib/libdl.so.2 (0x40050000) libssl.so.2 => /lib/libssl.so.2 (0x40053000) libcrypto.so.2 => /lib/libcrypto.so.2 (0x40080000) libc.so.6 => /lib/i686/libc.so.6 (0x42000000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) Regards, KAM -----Original Message----- From: Hal Vaughan [mailto:hal@thresholddigital.com] Sent: Wednesday, March 15, 2006 12:55 PM To: Kevin A. McGrail Subject: Re: [stunnel-users] Static Version Built? On Wednesday 15 March 2006 12:24, you wrote: > It's not going to use source. It's going to use headers and compiled > libraries. Specifying it just helps point it to the correct headers > and libraries if you for example, have them installed in an unusual > place or have more than one set on your machine. Does it link to those libs or incorporate them into the binary (if I'm building static with the correct command line options)? Sorry to ask so many questions, but I've had no experience in C or C++. Thanks, Hal

2 1

Static Version Built?
by Hal Vaughan 15 Mar '06

15 Mar '06

Okay, I think I have a static version of Stunnel now. Thanks to help and answers from Jan and Keven! I did this: ./configure --with-ssl=/usr --enable-static --disable-shared --disable-libwrap I'm not sure about the "--with-ssl" option, but it didn't seem to want to work without it. So I have a few questions: 1) How can I be sure it is static? 2) If it isn't static and I run it on a system that does not have all it needs, will it give me errors immediately, or only if a subroutine needs a library that isn't there. 3) Does the "--disable-libwrap" or anything else remove any features? 4) Does using the "--with-ssl" option make it use the libs on my system and make it non-static? 5) My "best guess" is that to install a static version, I just copy over the files src/stunnel and src/libstunnel.la to /usr/bin and /usr/lib, respectively. Is that right? (And, of course, copy man files to the right place.) Thanks -- I hope I'll be done with all these questions soon. Hal

2 4

Logging change in 4.15
by MeeAGhost 15 Mar '06

15 Mar '06

Running 4.15 the messages below being written to STDOUT whenever I start stunnel but not written to the the file defined by output in the .conf file. In prior versions the messages were written to whatever I had defined output to equal. 2006.03.14 19:40:03 LOG7[11513:1]: Snagged 64 random bytes from /export/home/ghost/.rnd 2006.03.14 19:40:03 LOG7[11513:1]: Wrote 1024 new random bytes to /export/home/ghost/.rnd 2006.03.14 19:40:03 LOG7[11513:1]: RAND_status claims sufficient entropy for the PRNG 2006.03.14 19:40:03 LOG6[11513:1]: PRNG seeded successfully 2006.03.14 19:40:03 LOG7[11513:1]: Certificate: /usr/local/etc/stunnel/server.pem 2006.03.14 19:40:03 LOG7[11513:1]: Key file: /usr/local/etc/stunnel/server.pem 2006.03.14 19:40:03 LOG7[11513:1]: Loaded verify certificates from /usr/local/etc/stunnel/cacert.pem 2006.03.14 19:40:03 LOG7[11513:1]: Verify directory set to /usr/local/etc/stunnel/certificates 2006.03.14 19:40:03 LOG5[11513:1]: Peer certificate location /usr/local/etc/stunnel/certificates I looked in ctx.c and ssl.c at the calls to s_log (in log.c) but wasn't able to determine what would cause some messages to be written to the output file and the messages above to be written to STDOUT. I think it has to do with file_putline not being passed the output file name. Anyone else seeing this behavior? -- Chris

2 1

What is "lwrap"? (compiling problem)
by Hal Vaughan 15 Mar '06

15 Mar '06

I keep getting a message: /usr/bin/ld: cannot find -lwrap when I try make. I had to use: ./configure --with-ssl=/usr and it worked, but I keep getting the above error message. I've Googled for it and it seems to reference an SSL library, but it looks like I've got them all installed (unless it needs Python SSL libraries). Thanks! Hal

1 0

SSL Libraries on Debian
by Hal Vaughan 14 Mar '06

14 Mar '06

I tried compiling Stunnel on Debian and get an error -- I need the ssl libraries. I tried ./configure --with-ssl=/usr/lib/ssl, which is where libssl-dev was installed, and it doesn't help. There is a libssl file in /usr/lib, but --with-ssl=/usr/lib/ssl doesn't seem to work either. What package on Debian provides the needed headers (according to aptitude, libssl-dev, the one I installed, does, but experience is telling me otherwise). (This, btw, is why I am trying to make static binaries -- you can never tell what to expect on Linux systems at this point. Often config/make doesn't work and there are many times when packages don't work out for one reason or another.) Thanks for any help on this. Hal

3 4

stunnel 4.14 died silently under traffic stress test
by Zhuang Yuyao 14 Mar '06

14 Mar '06

Hi, While doing apache benchmark test, stunnel 4.14 died silently. Network topo: client(192.168.20.81 debian running ab2) ---(https)---> gateway(192.168.20.1 running stunnel in server mode) ---(http)---> web server(192.168.10.254) Gateway hardware: 80386 compatible cpu (VIA C3 400Mhz); RAM: 64M stunnel.conf: ############################### ..... compression = zlib client = no ciphers = DES-CBC3-SHA:DES-CBC3-MD5 verify = 1 [test] accept = 443 connect = 192.168.10.254:80 TIMEOUTclose = 0 ############################### Web Server hardware: Dell 2850 with 2G RAM. test_100k.html is a html file whose size is 100k bytes. test_4k.html is a html file whose size is 4k bytes. In client, I am using ab2 as the stress test tool: #ab2 -n 200 -c 100 https://192.168.20.1:443/test_4k.html (means 200 request and 100 concurrency) successfully finished. #ab2 -n 200 -c 100 https://192.168.20.1:443/test_100k.html (means 200 request and 100 concurrency) stunnel died after a few seconds, running log shows: 2006.03.09 15:20:39 LOG5[6962:1024]: stunnel 4.14 on i386-pc-linux-gnu PTHREAD+POLL+IPv4 with OpenSSL 0.9.7i 14 Oct 2005 2006.03.09 15:20:39 LOG5[6962:1024]: 500 clients allowed 2006.03.09 15:20:53 LOG5[6964:1026]: test connected from 192.168.20.81:50186 2006.03.09 15:20:53 LOG5[6965:2051]: test connected from 192.168.20.81:50187 2006.03.09 15:20:53 LOG5[6966:3076]: test connected from 192.168.20.81:50188 2006.03.09 15:20:53 LOG5[6967:4101]: test connected from 192.168.20.81:50189 2006.03.09 15:20:53 LOG5[6968:5126]: test connected from 192.168.20.81:50190 2006.03.09 15:20:54 LOG5[6969:6151]: test connected from 192.168.20.81:50191 2006.03.09 15:20:54 LOG5[6970:7176]: test connected from 192.168.20.81:50192 2006.03.09 15:20:54 LOG5[6971:8201]: test connected from 192.168.20.81:50193 2006.03.09 15:20:54 LOG5[6972:9226]: test connected from 192.168.20.81:50194 2006.03.09 15:20:54 LOG5[6973:10251]: test connected from 192.168.20.81:50195 2006.03.09 15:20:54 LOG5[6974:11276]: test connected from 192.168.20.81:50196 2006.03.09 15:20:54 LOG5[6975:12301]: test connected from 192.168.20.81:50197 2006.03.09 15:20:54 LOG5[6976:13326]: test connected from 192.168.20.81:50198 2006.03.09 15:20:54 LOG5[6977:14351]: test connected from 192.168.20.81:50199 2006.03.09 15:20:54 LOG5[6978:15376]: test connected from 192.168.20.81:50200 2006.03.09 15:20:54 LOG5[6979:16401]: test connected from 192.168.20.81:50201 2006.03.09 15:20:54 LOG5[6980:17426]: test connected from 192.168.20.81:50202 2006.03.09 15:20:54 LOG5[6981:18451]: test connected from 192.168.20.81:50203 2006.03.09 15:20:54 LOG5[6982:19476]: test connected from 192.168.20.81:50204 2006.03.09 15:20:54 LOG5[6983:20501]: test connected from 192.168.20.81:50205 2006.03.09 15:20:54 LOG5[6984:21526]: test connected from 192.168.20.81:50206 2006.03.09 15:20:54 LOG5[6985:22551]: test connected from 192.168.20.81:50207 2006.03.09 15:20:54 LOG5[6986:23576]: test connected from 192.168.20.81:50208 2006.03.09 15:20:54 LOG5[6987:24601]: test connected from 192.168.20.81:50209 2006.03.09 15:20:54 LOG5[6988:25626]: test connected from 192.168.20.81:50210 2006.03.09 15:20:54 LOG5[6989:26651]: test connected from 192.168.20.81:50211 2006.03.09 15:20:54 LOG5[6990:27676]: test connected from 192.168.20.81:50212 2006.03.09 15:20:54 LOG5[6991:28701]: test connected from 192.168.20.81:50213 2006.03.09 15:20:54 LOG5[6992:29726]: test connected from 192.168.20.81:50214 2006.03.09 15:20:54 LOG5[6993:30751]: test connected from 192.168.20.81:50215 2006.03.09 15:20:54 LOG5[6994:31776]: test connected from 192.168.20.81:50216 2006.03.09 15:20:54 LOG5[6995:32801]: test connected from 192.168.20.81:50217 2006.03.09 15:20:54 LOG5[6996:33826]: test connected from 192.168.20.81:50218 2006.03.09 15:20:54 LOG5[6997:34851]: test connected from 192.168.20.81:50219 2006.03.09 15:20:54 LOG5[6998:35876]: test connected from 192.168.20.81:50220 2006.03.09 15:20:54 LOG5[6999:36901]: test connected from 192.168.20.81:50221 2006.03.09 15:20:54 LOG5[7000:37926]: test connected from 192.168.20.81:50222 2006.03.09 15:20:54 LOG5[7001:38951]: test connected from 192.168.20.81:50223 2006.03.09 15:20:54 LOG5[7002:39976]: test connected from 192.168.20.81:50224 2006.03.09 15:20:54 LOG5[7003:41001]: test connected from 192.168.20.81:50225 2006.03.09 15:20:54 LOG5[7004:42026]: test connected from 192.168.20.81:50226 2006.03.09 15:20:55 LOG5[7005:43051]: test connected from 192.168.20.81:50227 2006.03.09 15:20:55 LOG5[7006:44076]: test connected from 192.168.20.81:50228 2006.03.09 15:20:55 LOG5[7007:45101]: test connected from 192.168.20.81:50229 2006.03.09 15:20:55 LOG5[7008:46126]: test connected from 192.168.20.81:50230 2006.03.09 15:20:55 LOG5[7009:47151]: test connected from 192.168.20.81:50231 2006.03.09 15:20:55 LOG5[7010:48176]: test connected from 192.168.20.81:50232 2006.03.09 15:20:55 LOG5[7011:49201]: test connected from 192.168.20.81:50233 2006.03.09 15:20:55 LOG5[7012:50226]: test connected from 192.168.20.81:50234 2006.03.09 15:20:55 LOG5[7013:51251]: test connected from 192.168.20.81:50235 2006.03.09 15:20:55 LOG5[7014:52276]: test connected from 192.168.20.81:50236 2006.03.09 15:20:55 LOG5[7015:53301]: test connected from 192.168.20.81:50237 2006.03.09 15:20:55 LOG5[7016:54326]: test connected from 192.168.20.81:50238 2006.03.09 15:20:55 LOG5[7017:55351]: test connected from 192.168.20.81:50239 2006.03.09 15:20:55 LOG5[7018:56376]: test connected from 192.168.20.81:50240 2006.03.09 15:20:55 LOG5[7019:57401]: test connected from 192.168.20.81:50241 2006.03.09 15:20:55 LOG5[7020:58426]: test connected from 192.168.20.81:50242 2006.03.09 15:20:55 LOG5[7021:59451]: test connected from 192.168.20.81:50243 2006.03.09 15:20:55 LOG5[7022:60476]: test connected from 192.168.20.81:50244 2006.03.09 15:20:55 LOG5[7023:61501]: test connected from 192.168.20.81:50245 2006.03.09 15:20:55 LOG5[7024:62526]: test connected from 192.168.20.81:50246 Killed It looks like that is resource on gateway is exhausted under such a traffic, but my question is: why stunnel just died instead of rejecting further connections. Thanks very much. Zhuang Yuyao

2 7

Static Binaries for Linux? (Didn't get answer previously)
by Hal Vaughan 13 Mar '06

13 Mar '06

I've brought this up before and didn't get ANY answer at all, and I'm sure someone involved with Stunnel would at least know if what I'm asking is possible. I know help is given on a volunteer basis, so if someone could help me figure this out, it would be a huge help. So far I've spent over a week on getting Stunnel or another program to do the job and if I can't get this to work, I need to just drop Stunnel and figure out how to do the same thing in Java. So thanks for any help. I may need to include Stunnel with my application so my clients behind restrictive firewalls can still enable me to work on their systems with RealVNC. I'm working with clients on both Windows and Linux. Is there a way to get static binaries for Linux? I don't know C or C++ or much more than running ./configure && make && make install. I'd like to know if it is possible or what is needed to create static binaries of the files so I could easily install stunnel on any Linux system by just copying over the proper files. Also, what archive format does the Windows installer use? I'd like to do something similar for Windows, so if I could pull the files out of the installer and copy them over myself, it would be a huge help. Thanks! Hal

3 4

Compile failure with 4.15
by MeeAGhost 13 Mar '06

13 Mar '06

I ran ./configure --enable-dh --disable-libwrap then when I try to execute make the build fails: [...] if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.15\" -DPACKAGE_STRING=\"stunnel\ 4.15\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.15\" -DHOST=\"sparc-sun-solaris2.9\" -DCPU_SPARC=1 -DVENDOR_SUN=1 -DOS_SOLARIS2_9=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DHAVE_LIBNSL=1 -DHAVE_LIBSOCKET=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_SYS_FILIO_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE___MAKECONTEXT_V2=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETADDRINFO=1 -DHAVE_GETNAMEINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr/local\" -DHAVE_OSSL_ENGINE_H=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DUSE_DH=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/include -MT ctx.o -MD -MP -MF ".deps/ctx.Tpo" -c -o ctx.o ctx.c; \ then mv -f ".deps/ctx.Tpo" ".deps/ctx.Po"; else rm -f ".deps/ctx.Tpo"; exit 1; fi ctx.c: In function `init_dh': ctx.c:170: error: `section' undeclared (first use in this function) ctx.c:170: error: (Each undeclared identifier is reported only once ctx.c:170: error: for each function it appears in.) ctx.c:198: error: `ctx' undeclared (first use in this function) ctx.c: In function `crl_callback': ctx.c:491: warning: cast increases required alignment of target type make[1]: *** [ctx.o] Error 1 make[1]: Leaving directory `/tmp/stunnel-4.15/src' make: *** [all-recursive] Error 1 I checked ctx.c and couldn't see where section and ctx are being defined inside of the init_dh function nor could I see them defined in the header files. Am I missing something? TIA for any assistance. -- Chris

2 1

Rainbow Technologies CryptoSwift CS200 driver
by Michal Trojnara 11 Mar '06

11 Mar '06

Dear Users, I just bought a second-hand Rainbow Technologies CryptoSwift CS200 card to test engine support for stunnel. Unfortunately I can't find any Linux/Windows driver for this card. Do you have one? Please help. Best regards, Mike

2 1

stunnel 4.15 released
by Michal Trojnara 11 Mar '06

11 Mar '06

Version 4.15, 2006.03.11, urgency: LOW: * Release notes - There are a lot of new features in this version. I recommend to test it well before upgrading your mission-critical systems. * Bugfixes - Fix for pthreads on Solaris 10 (thx to Hans Werner Strube <strube(a)physik3.gwdg.de>). - Attempt to autodetect socklen_t type in configure script. - Default threading model changed to pthread for better portability. - DH parameters are not included in the certificate by default. * New features sponsored by Software House http://www.swhouse.com/ - Most SSL-related options (including client, cert, key) are now available on service level, so it is possible to have an SSL client and an SSL server in a single stunnel process. - Windows CE (version 3.0 and higher) support. * New features - Client mode CONNECT protocol support (RFC 2817 section 5.2). http://www.ietf.org/rfc/rfc2817.txt - Retrying exec+connect services added. * File locations are more compliant to Filesystem Hierarchy Standard 2.3 - configuration and certificates are in $prefix/etc/stunnel/ - binaries are in $prefix/sbin/ - default pid file is $prefix/var/run/stunnel.pid - manual is $prefix/man/man8/stunnel.8 - other docs are in $prefix/share/doc/stunnel/ - libstunnel is in $prefix/lib - chroot directory is setup in $prefix/var/lib/stunnel/ this directory is chmoded 1770 and group nogroup sha1sum for stunnel-4.15.tar.gz: 735406c1ca94904581158a434214e1f6568539d0 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Mike

1 0

"STACK_RESERVE is too high" after every connect
by Rob Munsch 10 Mar '06

10 Mar '06

Hello. I've recently gone on a self-inflicted crash course on openssl and seem to have gotten a centralized logging system going, logging to MySQL. I'm seeing everything i'd expect to see, but with an extra bit: what is STACK_RESERVE, and why is it too high? Some context, mildly sanitized: |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: syslog-ng connected from x.x.x.x:44032| |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: VERIFY OK: depth=1, /C=US/ST=Pennsylvania/L=Philadelphia/O=Solutions for Progress/CN=blah.com/emailAddress=blah@blah| |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: VERIFY OK: depth=0, /C=US/ST=Pennsylvania/O=Solutions for Progress/OU=IT/CN=IT/emailAddress=blah@blah| |Mar 9 20:39:02 isis stunnel: LOG5[24810:6]: Connection closed: 0 bytes sent to SSL, 2891 bytes sent to socket| |Mar 9 20:39:02 isis stunnel: LOG3[24810:6]: STACK_RESERVE is too high| this is daemon.log on the server machine (isis). Messages from the remote host are going to MySQL successfully. But at the end of every apparently-successful transaction, there's this stack complaint. Can't find anything in the archives or via Google for "stunnel stack_reserve," which i found really odd, which is why i'm here... Version output: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 Thanks! -- Rob Munsch Solutions For Progress IT

2 1

RE: How to get tcpwrappers configured/compiled into stunnel 4.04 on Tru64 UNIX 5.1B
by John Lanier 08 Mar '06

08 Mar '06

Hello, I am a newbie to stunnel and tcpwrappers, so please bear with me: I am trying to compile tcpwrapper support into stunnel v4.04 on Tru64 UNIX v5.1B (apparently v4.14 does not compile on 5.1A or higher, per http://stunnel.mirt.net/pipermail/stunnel-users/2006-January/000935.html). I am having what appears to be problems getting tcpwrapper support to compile with 4.04. I have consulted the following resources, but I am still having problems: ------------------------------------------------------------------------------------------------------- 1. http://www.stunnel.org/faq/troubleshooting.html#ToC9 "configure isn't finding my TCP Wrapper installation" Solution: You probably have it in a non-standard place, ie somewhere that gcc can't find it on it's own. Let's say you had your tcp wrappers installed in /opt/tcpd_7.6. To help gcc find your include files and libraries, you'd want to set three environment variables as follows: CFLAGS="$CFLAGS -I/opt/tcpd_7.6/include" CPPFLAGS="$CPPFLAGS -I/opt/tcpd_7.6/include" LDFLAGS="$LDFLAGS -L/opt/tcpd_7.6/lib" export CFLAGS CPPFLAGS LDFLAGS And then re-run configure. This is the generic way to have configure find specific libraries, and is not specific to Stunnel itself. 2. http://www.stunnel.org/faq/run.html#ToC5 "Running stunnel with TCP wrappers" You do not need to use the tcpd binary to wrap stunnel (although you could). You can can compile in support for TCP wrappers when you compile stunnel itself. The configure program should be able to determine if the libwrap library (-lwrap) and headers are available in standard locations. ............. I have openssl 0.9.7h installed on ccpe01 v51b pk#5, with tcp-wrappers7.6. I did the configure, make and make install and things. All stages appeared successful, but then I attempted the ./configure --with-tcp-wrappers and it errored with -lwrap not found. checking for SSL directory... /usr/local/ssl checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... no checking for socket in -lsocket... no checking for pthread_create in -lpthread... no checking for pthread_create in -lc_r... no checking for openpty in -lutil... yes checking whether to use the libwrap (TCP wrappers) library... yes checking for hosts_access in -lwrap... not found <-- .............. So then I tried assigning the 3 environment variables and things got worse. The include and lib directories are referenced for tcpd 7.6, but after installing tcp wrappers I do not find include or lib directories for tcpd. Q: Should I expect NOT to see the include or lib directories as defined in #1 above, and, if so, will specifying the absolute path to the tcpwrapper images (EX: /var/tcp_wrappers/tcp_wrappers_7.6) suffice? 3. I followed these instructions when compiling/configuring tcpd v7.6 (downloaded from ftp://ftp.porcupine.org/pub/security/index.html): ............ 7.1 - Easy configuration and installation ----------------------------------------- The "easy" recipe requires no changes to existing software or configuration files. Basically, you move the daemons that you want to protect to a different directory and plug the resulting holes with copies of the wrapper programs. If you don't run Ultrix, you won't need the miscd wrapper program. The miscd daemon implements among others the SYSTAT service, which produces the same output as the WHO command. Type `make' and follow the instructions. The Makefile comes with ready-to-use templates for many common UNIX implementations (sun, ultrix, hp-ux, aix, irix,...). .............. Thanks in advance for any guidance and/or advice that you can offer. --John Lanier

1 0

Special Installs -- Static Binaries and Required Files
by Hal Vaughan 08 Mar '06

08 Mar '06

I may need to include Stunnel with my application so my clients behind restrictive firewalls can still enable me to work on their systems with RealVNC. I'm working with clients on both Windows and Linux. Windows: I know the installer has the files included in it in an archive, but what archive format is it, or what kind or archive program on Linux can I use to read it? Is installing Stunnel on Windows just a matter of copying the files, or are there settings I have to change in the registry? Linux: Is there any way to get static binaries (yes, I know they're bigger) so I can just copy over files to install it as a program (not as a service -- I noticed Debian set it up as a service)? Thanks! Hal

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users