- stunnel-users - stunnel.org

When the Port is in the URL
by George, Bijoy 10 Nov '04

10 Nov '04

Hello Everyone, I am using stunnel-3.19 and am trying to forward port 12345 on my local machine to a URL that has the following syntax: http://TestBox1:7201/sourceApp/Calculate.do?type=sf I am not sure how to set the stunnel up in this instance, but have failed with the following command: stunnel -c -d localhost:12345 -r TestBox:7201 Can someone please shed some light on my plight! Thanks!

1 0

Stunnel 4.05 engine patch
by Diarmuid O'Neill 10 Nov '04

10 Nov '04

Hi, A couple of people have asked, so here's a patch that should work with stunnel-4.05. Untar the source archive. Copy the patch to the stunnel-4.05 directory. Run patch -p1<stunnel-4.05-engine.diff. Run autoconf (Beware, i have seen make funnies which i think relate to the version of automake 1.4-p2 worked for me, 1.6 did not). Now build as normal. When running ./configure, be sure to include the --enable-ssl-engine option (see ./configure --help). To enable a particular engine, include a line in your conf file "SSLEngine = myengine". Thanks, Diarmuid. <<stunnel-4.05_engine-patch.diff>> ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the postmaster at the address below. ITS-Support(a)aepsystems.com Unless the contrary is specifically indicated above nothing in this message is intended to constitute an electronic signature within the meaning of the Electronic Commerce Act 2000 or similar legislation enacted elsewhere in the world. This footnote also confirms that this email message has been swept for the presence of computer viruses. *****************************************************************************

1 0

Re: [stunnel-users] How to configure Stunnel for ICMP packets?
by Rutger Thomschitz 09 Nov '04

09 Nov '04

> > I have just started using Stunnel 4.04 with OpenSSL. This > > may seem a bit strange, but, I would like to configure > > Stunnel such that it will encrypt all my Ping packets. > > The reason in a nut shell is that I would like to use > > Ping to determine the network overhead added by SSL, as > > part of my research. How can I set up stunnel (i.e. > > stunnel.conf) to tunnel all ICMP (i.e. Ping) packets? > > If you compare ICMP ECHO REQUEST/REPLY to Stunnel in any > way then your research is useless. It's an apples to oranges > comparison. You're comparing ICMP to TCP. > > Better is to compare TCP to TCP. For example, create a client/server > protocol as follows: > > * The TCP connection is established. > * The client sends one integer that is the length of the data, > followed by the data itself. Call this a 'packet' if you will. > * The server reads the integer, followed by the rest of the data, > and sends that data back. > * The client verifies the data was received correctly, and then > procedes to send a new 'packet'. > > > Then you can implement this connection on its own, and then via > Stunnel on both ends, and compare the results. Now you've got > apples-to-apples comparison. > > (Suggest you implement the server as an inetd-started application, > and start it from Stunnel via the 'exec' option, to keep the extra > cleartext TCP connection out of the mix.) > > Side possibilities: > > * Try alternate 'packet sizes' for comparison. > * Try different crypto protocols for comparison. > > > -- > Brian Hatch $it = $it || $another; > Systems and > Security Engineer > http://www.ifokr.org/bri/ Brian, Thank you for the advice and replying so quickly. Since my end goal was to see how additional network overhead due to security affects voice over IP (UDP), are there any other SSL enabled applications similar to Stunnel that supports UDP? (I am looking into Zebedee; however, it of course does not implement SSL.) Thanks again, Rutger Thomschutz -- ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm

2 1

poll() rather than select() eta (4.0.6?)
by rocco.s 09 Nov '04

09 Nov '04

is stunnel 4.0.6 going to use poll() rather than select() (for more than 500/1024 clients et al) ala http://marc.theaimsgroup.com/?l=stunnel-users&m=108238799929981&w=2 and http://marc.theaimsgroup.com/?l=stunnel-users&m=108081347531925&w=2

2 1

(no subject)
by Edgar Hodge 08 Nov '04

08 Nov '04

un-subscribe stunnel-users(a)mirt.net

1 0

jailed stunnel can't find DNS
by conover＠rahul.net 08 Nov '04

08 Nov '04

My stunnel.conf file looks like: debug = 7 cert = /usr/local/stunnel/etc/stunnel/stunnel.pem chroot = /usr/local/stunnel/var/run/ pid = /stunnel.pid output = stunnel.log CAfile = /usr/local/stunnel/etc/stunnel/certs.pem verify = 3 delay = yes client = yes setuid = stunnel setgid = stunnel . . . and the stunnel.log file: . . . 2004.11.07 16:49:10 LOG7[3794:1025]: smtps started 2004.11.07 16:49:10 LOG5[3794:1025]: smtps connected from 127.0.0.1:1143 2004.11.07 16:49:10 LOG3[3794:1025]: Failed to resolve hostname 'abc.wxyz.net' 2004.11.07 16:49:10 LOG3[3794:1025]: Failed to initialize remote connection 2004.11.07 16:49:10 LOG7[3794:1025]: smtps finished (0 left) Removing chroot in stunnel.conf fixes the problem, but its no longer jailed. Hints? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

3 3

Using qmail with stunnel
by conover＠rahul.net 08 Nov '04

08 Nov '04

Someone ask about using qmail with stunnel. In /var/qmail/control/smtproutes, put: :localhost:12325 Which routes all undeliverable/default email traffic to localhost, port 12325. And in /usr/local/stunnel/etc/stunnel/stunnel.conf, put: [smtps] accept=12325 connect=myremote.com:32125 (man(1) qmail-control(5) for particulars,) so the local stunnel will know what to do with it-route it to myremote.com, port 32125. And in myremote.com's stunnel.conf, put: [smtps] accept=32125 connect=localhost:25 so myremote.com will route it to localhost, port 25, smtp. Works fine on TCP/A?DSL, or a demand dial PPP connection, bringing the telco line up for the email transaction, and then disconnecting, (kind of like UUCP.) If a multi-user dial connection, it is advisable to put the number '1' in /var/qmail/control/concurrencyremote, (without the single quotes,) to throttle the number of concurrent transactions going down the line, else if there are a bunch of messages in qmail's queue when the connection is made, qmail will choke the line with 20, (the default,) concurrent transactions to empty the queue-and no one will be able to get a packet in edgewise down the PPP link. John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

1 0

How to configure Stunnel for ICMP packets?
by Rutger Thomschitz 08 Nov '04

08 Nov '04

Dear group, I have just started using Stunnel 4.04 with OpenSSL. This may seem a bit strange, but, I would like to configure Stunnel such that it will encrypt all my Ping packets. The reason in a nut shell is that I would like to use Ping to determine the network overhead added by SSL, as part of my research. How can I set up stunnel (i.e. stunnel.conf) to tunnel all ICMP (i.e. Ping) packets? Thank you very much in advance. I look forward to any replies. Sincerely, Rutger olds76(a)email.com -- ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm

2 1

(no subject)
by isidore11 07 Nov '04

07 Nov '04

1 0

RE: [stunnel-users] UDP End-points
by Les Niles 06 Nov '04

06 Nov '04

Pardon my ignorance, but why not run PPP over stunnel and then UDP over that? No new encapsulation to invent. Performance would be lousy, so it would be stupid to use for some streaming media protocol, but for low-bandwidth UDP-based protocols like NTP, DNS, RADIUS, etc. it might well be useful. -les -----Original Message----- From: stunnel-users-bounces(a)mirt.net On Behalf Of Michal Trojnara Subject: Re: [stunnel-users] UDP End-points Leigh, > Perhaps I wasn't quite as clear as I intended.. :) > I'm not suggesting that SSL over UDP should be done.. I'm suggesting > that stunnel could potentially act as a UDP-over-encrypted-TCP > gateway. Okay. Now I understand your idea (I hope). I would have to design a propriatary datagram-over-byte-stream (DOBS) protocol (at least length of UDP packets has to be encoded aside from the content), and then tunnel UDP over DOBS over SSL over TCP. This is why I don't like it: 1. Such tunneling is not very effective. There's a *huge* protocol overhead. 2. It's not standard. One of the main ideas behind stunnel is its interoperability. 3. I think it's much easier to write such encrypting UDP forwarder from scratch using IPSec-style datagram protocol, than to modify stunnel. 4. It breaks my KISS principle. 8-) In fact I would really like to find a time (or a sponsor) to develop such UDP encrypting forwarder. BTW: Maybe it's better to use IPSec or VTUN instead of a proxy? Best regards, Mike

2 1

Stunnel not working with Qmail
by Paul Swainson 06 Nov '04

06 Nov '04

Hi to all list members, I will try to as descriptive as possible about the problem. I have a qmail install and I had used courier for imap, imapssl & pop3dssl. I wanted to implement smtp ssl. I have gone through the stuff at stunnel.org but I don't think its my qmail config that's the problem. This is the first time I have used stunnel, I compiled no probs and before doing so I installed open ssl 0.9.7e I have created a conf for stunnel and here it is: Cat /usr/local/etc/stunnel/smtpsd.conf cert = /usr/local/etc/stunnel/stunnel.pem exec = /var/qmail/bin/qmail-smtpd #******** execargs = /var/qmail/bin/qmail-smtpd mydomain.com /home/vpopmail/bin/vchkpw /usr/bin/true 2>&1 #******** client = yes foreground = yes in the qmail run (smtpsd) script I have amended it to read #!/bin/sh QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" export QMAILQUEUE QMAILDUID=`id -u vpopmail` NOFILESGID=`id -g vpopmail` MAXSMTPD=`cat /var/qmail/control/concurrencyincoming` LOCAL=`head -1 /var/qmail/control/me` if [ -z "$QMAILDUID" -o -z "$NOFILESGID" -o -z "$MAXSMTPD" -o -z "$LOCAL" ]; then echo QMAILDUID, NOFILESGID, MAXSMTPD, or LOCAL is unset in echo /var/qmail/supervise/qmail-smtpd/run exit 1 fi if [ ! -f /var/qmail/control/rcpthosts ]; then echo "No /var/qmail/control/rcpthosts!" echo "Refusing to start SMTP listener because it'll create an open relay" exit 1 fi exec /usr/local/bin/softlimit -m 40000000 \ /usr/local/bin/tcpserver -v -R -l "$LOCAL" -x /etc/tcp.smtp.cdb -c "$MAXSMTPD" \ -u "$QMAILDUID" -g "$NOFILESGID" 0 465 \ #********* /usr/local/sbin/stunnel /usr/local/etc/stunnel/smtpsd.conf #********* Execargs has in the stunnel conf is the line from smtpd run script, when it runs I don't have any output to the log so I can only assume stunnel is dying before it starts the session. Has anyone got this working? I know that it can but a lot of examples are for pop3ds. If I type stunnel /usr/local/etc/stunnel/smtpsd.conf I get the following error: Unable to open "/dev/cryptonet" Any help on this would be much appreciated, Thanks Regards Paul Swainson

2 1

compressed stunnel?
by jonathan.wilson 06 Nov '04

06 Nov '04

Hi all, I found some references to compression options in openssl.org - specifically to the SSL_COMP_add_compression_method() routine. Is there any way to invoke/use this from stunnel? Thanks, Jonathan Wilson

2 1

Re: stunnel consumes 99% cpu at HPUX
by Gavin Ho 06 Nov '04

06 Nov '04

Mike, thanks for your information. Each of our HPUX machines has 2 CPUs. Actually, before post my problem on this mailing list, I tried to search on Google but can't find any hints to solve the problem. Then I tried to browse the stunnel 4.0.5 source code and can't find any hints too. But I noticed that someone said on some historical newsgroup postings the problem may be related to openssl. Do you think thats true? I will wait for the version 4.0.6 and hope it can solve my problem. Cheers, Gavin -- ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm

2 1

stunnel consumes 99% cpu at HPUX
by gykho＠ogcio.gov.hk 04 Nov '04

04 Nov '04

Hi All, We set up stunnel from two linux machines located at DMZ to a HPUX cluster located at Private Zone. There is firewall in between. We use stunnel to encrypt Tomcat AJP traffic from apache web servers on linux machines to JBoss app server a HPUX cluster. The stunnel run at HPUX cluster was started as deamon mode and listened on a cluster failover IP instead of host IP. We found that the stunnel process at HPUX cluster consumed 99% CPU after run for a few days (started at Oct 26 10:26 and it was reported 99% CPU at Oct 29 23:00, under a very low traffic. Can anyone help? The debug log at HPUX is also attached, as shown in the log there was no requeset on Oct29 but the CPU still shot up to 99%. Cheers, Gavin Output of "stunnel -version" from Linux side ================================== stunnel 4.04 on i386-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds Output of "uanme -a" from Linux side =========================== Linux www12-id.spica.hksarg 2.4.21-15.ELsmp #1 SMP Thu Apr 22 00:18:24 EDT 2004 i686 i686 i386 GNU/Linux Output of "gcc -v" from Linux side ======================== Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --host=i386-redhat-linux Thread model: posix gcc version 3.2.3 20030502 (Red Hat Linux 3.2.3-39) Output of "openssl version" from Linux side =============================== OpenSSL 0.9.7a Feb 19 2003 "stunnel conf" at Linux side ================== chroot = /u01/var/run/stunnel # PID is created inside chroot jail pid = /deptstunnel.pid setuid = nobody setgid = nobody socket=r:SO_KEEPALIVE=1 # Some debugging stuff debug = 7 output = /u01/var/stunnel/deptstunnel.log foreground = no # Use it for client mode client = yes # Service-level configuration [App] accept = localhost:8111 connect = hpux-service-ip:8111 Output of "stunnel -version" from HPUX side ================================ stunnel 4.05 on hppa2.0w-hp-hpux11.11 PTHREAD+LIBWRAP with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 EGD = /var/run/egd-pool key = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem pid = /opt/iexpress/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds Output of "uname -a" from HPUX side =========================== HP-UX dptshr1 B.11.11 U 9000/800 2640250230 unlimited-user license Output of "openssl version" from HPUX side =============================== OpenSSL 0.9.7d 17 Mar 2004 "stunnel conf" at HPUX side ================== cert = /u01/etc/stunnel/deptstunnel.cer key = /u01/etc/stunnel/deptstunnel.key chroot = /u01/var/run/stunnel/ # PID is created inside chroot jail pid = /deptstunnel.pid setuid = stunnel setgid = stunnel # Some debugging stuff debug = 7 output = /u01/var/stunnel/deptstunnel.log foreground = no # Use it for client mode #client = yes # Service-level configuration [App] accept = hpux-service-ip:8111 connect = localhost:9111 === ENDS ===

2 1

UDP End-points
by Red Phoenix 03 Nov '04

03 Nov '04

Michal Trojnara mentioned: > On 2004-11-02, at 02:02, Red Phoenix wrote: > > Establishing a SSL connection over UDP would be pretty tough, but has > > anyone thought about the possibility of allowing the 'listen' and > > 'destination' points to be UDP ports, with the main comms routed over > > TCP? This would effectively accomplish what most UDP requestors need. > It's not as easy as you think. SSL requires a stream of data as a > transport. It's much more than a simple UDP forwarder. Perhaps I wasn't quite as clear as I intended.. :) I'm not suggesting that SSL over UDP should be done.. I'm suggesting that stunnel could potentially act as a UDP-over-encrypted-TCP gateway. For example: (For the moment, lets focus on syslog data): Pre-stunnel: Server 1 Sends syslog messages to UDP port 514 on Server 2. Server1 and Server2 both then install stunnel: Server1: Syslog messages are redirected to localhost UDP port 514 (rather than Server2 UDP port 514). Server1: Stunnel listens on UDP port 514, and sends encrypted data to Server2 on TCP port 12345 Server2: Stunnel listens on TCP port 12345, decrypts the data, and sends to localhost UDP port 514. This way, stunnel acts as the UDP to TCP (encrypted) to UDP gateway - in a similar way that it can currently act as a pure TCP -> TCP (encrypted) -> TCP gateway. Regards, Leigh.

3 3

Remove Me
by Lauren Hillquist 03 Nov '04

03 Nov '04

How do I get off this mailing list? Lauren

2 1

OpenSSL 0.9.7e WIN32 binaries
by Michal Trojnara 02 Nov '04

02 Nov '04

Dear Users, I've built WIN32 binaries of the latest OpenSSL library. They're available for download on my ftp site: ftp://stunnel.mirt.net/openssl/binary-0.9.7e-zlib/ Best regards, Mike

1 0

Compilation problem of stunnel-4.05 on solaris 9
by Susan Shao 02 Nov '04

02 Nov '04

hello, I am trying to configure Stunnel-4.05 on Solaris9 and got the some error you posted on the Stunnel list group. But I didn't find any solution to solve this problem on the web. I just wonder if you have solved this and got Stunned installed? I would really appreciate if you can let me know. Thank you!

1 0

UDP end-points
by Red Phoenix 02 Nov '04

02 Nov '04

Establishing a SSL connection over UDP would be pretty tough, but has anyone thought about the possibility of allowing the 'listen' and 'destination' points to be UDP ports, with the main comms routed over TCP? This would effectively accomplish what most UDP requestors need. I was thinking along the lines of: Server1 (source): client = yes [syslogcrypt] # listen on udp port 514 for syslog messages uaccept = 514 # connect to remote stunnel TCP port 5140 connect = 5140 - - - - - Server2 (destination): client = no [syslogcrypt] # listen on 5140 accept = 5140 # connect to local udp port 514 uconnect = 514 Logic would be along the lines of: if client = yes and uconnect is used, then die (or assume they meant tcp). if client = no and uaccept is used, then die (or assume tcp). it should be reasonably easy to add a flag into LOCAL_OPTIONS somewhere, so that it opens a UDP server/client - along the lines of (mangled out of a simple udp server app I wrote): int sockfd,rbind; struct sockaddr_in serv_addr, client_addr; int port,sockopt=1; char buffer[1234]; if((sockfd=socket(AF_INET, SOCK_DGRAM,0))<0) { fprintf(stderr,"UDP Server: errno = %d\n", errno); fprintf(stderr,"Cannot open datagram socket\n"); exit(1); } setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &sockopt, sizeof(sockopt)); // check that ports are available, and files exist? bzero((char *) &serv_addr, sizeof(serv_addr)); serv_addr.sin_family = AF_INET; serv_addr.sin_addr.s_addr = htonl(INADDR_ANY); serv_addr.sin_port = htons(portnumber); if((rbind = bind(sockfd, (struct sockaddr *) &serv_addr, sizeof(serv_addr))) < 0) { fprintf(stderr,"Port is not available. Exiting.\n"); exit(2); } while(1) { length=recvfrom(sockfd,buffer,sizeof(buffer)-1,0,(struct sockaddr *) &client_addr,&addrlen); } Any thoughts? Regards, Leigh.

2 1

Re: [stunnel-users] permanent tunnel
by Michal Trojnara 01 Nov '04

01 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Saturday 30 of October 2004 01:16, Ramin Ali Dousti wrote: > You're right in that I don't have persistent TCP connection. I just > want to make sure that the SSL handshake > does not take place with every short-lived connection. You don't want to negotiate new keys for every connection, right? In SSL there's a mechanism for it called "session cache". In stunnel you can increase the timeout for session cache with "session" option (on both client and sever). Just set it to a very high value (a month? a year?). The default is 300 seconds (5 minutes). Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBg0Kf/NU+nXTHMtERAl0mAKDODCg+9LwUVoBfx+i6ou7iYmjgcQCfYprS Mv3KKdhQTUcs81yIw/KNT70= =NWHN -----END PGP SIGNATURE-----

2 2

VPN with windows
by Angelo Raspanti 30 Oct '04

30 Oct '04

I have experimented with succes to use stunnel for make a VPN between two PC with linux.It work with start pppd on both sides when the SSL negotiation is termined with success. At this time server and client sides launch the pppd daemon and the connecction with IP address read from pppd command line (written in config file of stunnel) is made. To make a VPN with two linux BOX is easily ! But if one of the two sides is a Windows plattaform ? I think that the use of this tecnique is noot possible. How to make un VPN between a Linux Plattaform and a Windows plattaform ? Is possible ? Thanks in advance and sorry for my bad english

1 0

RE: [stunnel-users] Stunnel & Java SSL
by richard＠oversight.co.nz 30 Oct '04

30 Oct '04

Managed to sort this issue out by upgrading my JVM to 1.5.0 and adding the certificated in under the Java control panel. Ran into another problem afterwards with my application generating an UNKNOWN PROTOCOL error on the 3rd TCP session after successfully accepting the first two... very strange. I think I'm going to have to give up on the idea of using Java's or IE's SSL system and use Stunnel as a client too. Found a great GUI for Stunnel on Mac OS X called SSL Enabler, shame theres not one as nice for Windows! Richard Watson > Upgrade your OpenSSL package for a start... it's up to .9.7d, tho I use > .9.7a. Re-compile OpenSSL on your machine... try then. > > Did you download a binary of STunnel? > > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net > [mailto:stunnel-users-bounces@mirt.net] On Behalf Of > richard(a)oversight.co.nz > Sent: Friday, 29 October 2004 11:47 a.m. > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Stunnel & Java SSL > > I'm developing a website where a java applet is downloaded over an > https session provided by Stunnel (stunnel 4.04 on i586-pc-linux-gnu > PTHREAD with OpenSSL 0.9.6c 21 dec 2001) running on port 1080. > The applet codebase in the html code is set to > https://x.x.x.x:1080/xxxx.jar > > To complicate this issue, Stunnel is set to verify=3 i.e. it requires a > valid client certificate. > It seems that the java implementation of SSL (JVM 1.4.1_03) won't > respond to prompts for client certificates?? > Stunnel simply times out with the following error.... > > 2004.10.29 11:45:34 LOG7[6881:1024]: service accepted FD=10 from > 192.168.1.2:19302004.10.29 11:45:34 LOG7[6881:1024]: FD 10 in > non-blocking mode > 2004.10.29 11:45:34 LOG7[6897:6146]: service finished (0 left) > 2004.10.29 11:45:34 LOG7[6898:7171]: service started > 2004.10.29 11:45:34 LOG5[6898:7171]: service connected from > 192.168.1.2:1930 2004.10.29 11:45:34 LOG7[6898:7171]: SSL state > (accept): before/accept initialization2004.10.29 11:45:34 > LOG7[6898:7171]: waitforsocket: FD=10, DIR=read > 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok > 2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 read > client hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): > SSLv3 write server hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL > state (accept): SSLv3 write > certificate A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): > SSLv3 write > certificate request A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state > (accept): SSLv3 flush data > 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read > 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok > 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (read): warning: no > certificate2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, > DIR=read > 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok > 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (write): fatal: > handshake failure2004.10.29 11:45:39 LOG3[6898:7171]: SSL_accept: > 140890C7: > error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not > return a certificate2004.10.29 11:45:39 LOG7[6898:7171]: service > finished (0 left) > > Does anyone know a way around this? > > Thank you, > > Richard Watson > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

permanent tunnel
by Ramin Dousti 29 Oct '04

29 Oct '04

Hello, I'd like to set up an stunnel between two hosts which currently talk to each other unencrypted. The communication between these two hosts is HTTP and sporadic. What I'd like to achieve is a permanent stunnel between the hosts regardless of their communiucation pattern. Is this possible? And if yes, how? The current setup utilizes stunnel in server mode on the server side and stunnel in client mode on the client side. When a client issues a request, I see that an SSL tunnel is set up between the hosts and after the reception of the reply, the SSL tunnel is torn down. So, the question is, how can I nail down the SSL tunnel to be permanent? Thank you in advance, Ramin

2 1

SSL read returned WANT_: retrying
by Hacker, Dietmar 29 Oct '04

29 Oct '04

Has anybody a solution to this problem ? There was a thread about this msg in June. I am using a central Source staging server for my windows applications accessed via stunnel from remote over a Linux stunnel on the Internet gateway. Centrally I use SuSE Linux 8.2 with stunnel 4.04 and on the clients the current 4.05 windows binary version (also does not work with the older 4.04 windows binary version). The "SourceSave" Software does a directory comparision and then a download of all changed components. Without stunnel no problem. With stunnel after some traffic I always get "SSL returned WANT_: retrying" in the stunnel window and then the software stops downloading. Mit freundlichen Gruessen / With regards Dipl. Ing. Dietmar Hacker Grazer Wechselseitige Versicherung AG A-8010 Graz, Herrengasse 18-20 Tel.: +43 (316) 8037-256 Fax.: +43 (316) 8037-1256 mailto:dietmar.hacker@grawe.at

2 1

Stunnel & Java SSL
by richard＠oversight.co.nz 28 Oct '04

28 Oct '04

I'm developing a website where a java applet is downloaded over an https session provided by Stunnel (stunnel 4.04 on i586-pc-linux-gnu PTHREAD with OpenSSL 0.9.6c 21 dec 2001) running on port 1080. The applet codebase in the html code is set to https://x.x.x.x:1080/xxxx.jar To complicate this issue, Stunnel is set to verify=3 i.e. it requires a valid client certificate. It seems that the java implementation of SSL (JVM 1.4.1_03) won't respond to prompts for client certificates?? Stunnel simply times out with the following error.... 2004.10.29 11:45:34 LOG7[6881:1024]: service accepted FD=10 from 192.168.1.2:19302004.10.29 11:45:34 LOG7[6881:1024]: FD 10 in non-blocking mode 2004.10.29 11:45:34 LOG7[6897:6146]: service finished (0 left) 2004.10.29 11:45:34 LOG7[6898:7171]: service started 2004.10.29 11:45:34 LOG5[6898:7171]: service connected from 192.168.1.2:1930 2004.10.29 11:45:34 LOG7[6898:7171]: SSL state (accept): before/accept initialization2004.10.29 11:45:34 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 read client hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write server hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write certificate A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write certificate request A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 flush data 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (read): warning: no certificate2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (write): fatal: handshake failure2004.10.29 11:45:39 LOG3[6898:7171]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate2004.10.29 11:45:39 LOG7[6898:7171]: service finished (0 left) Does anyone know a way around this? Thank you, Richard Watson

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users