- stunnel-users - stunnel.org

stunnel dies on win32 - Try again with out HTML
by Richard Whiffen 05 Oct '04

05 Oct '04

We have a problem where stunnel dies on our Win32 boxes when we attempt load tests: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = stunnel.pem RNDbytes = 64 RNDoverwrite = yes service = stunnel session = 300 seconds taskbar = yes verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds When we had one stunnel.cnf for all services it would crash almost imediately (less than a minute after starting the load). When we created separate processes for each target server it lasts longer, 5 to 10 minutes, but still dies. The frustrating part is we get no indications in the log files of what's going on. It dies in seemingly random spots. The last log entry is never the same and there's nothing in the cmd window that launched it to indicate what happened. The conf is fairly simple: #script test conf cert = \stunnel\ohetestisg1.pem Cafile = \stunnel\css-ca-cert.pem CApath = \stunnel\certs output = \stunnel\stunnel-media.log #verify = 3 client = yes debug = 7 [**mediaserver] accept = 127.0.0.3:80 connect = 10.162.130.26:444 TIMEOUTclose = 0 We're connecting to a Cisco Content Server Switch if that helps. So I'm wondering where to go next. Any ideas on how to troubleshoot this? Rich Whiffen _________________________________________________________________ Check out Election 2004 for up-to-date election news, plus voter tools and more! http://special.msn.com/msn/election2004.armx

1 0

stunnel dies on win32
by Richard Whiffen 05 Oct '04

05 Oct '04

1 0

Stunnel.org
by ramesh k 05 Oct '04

05 Oct '04

Hi I have one little problem with stunnel .I saw your source and document very instresting .But I cant able to compile your souce code [Stunnel.org] in windows xp @ vc++ envirnment.and I have downloaded supportive compiler mingw ,openssl & libssl32.dll and libeay32.dll . In that source syslog.h is not supporting for vc++ . So kindly reply with Clear details to compile that source Regds Ramesh.k

1 0

Re: [stunnel-users] Bug or bad configuration ?
by Michal Trojnara 04 Oct '04

04 Oct '04

Dear fwd, > stunnel: md_rand.c:312: ssleay_rand_add: Assertion `md_c[1] == > md_count[1]' > failed. > 2004.10.03 10:14:44 LOG5[30267:1024]: Received signal 15; terminating Your OpenSSL library is not properly compiled: http://lists.freebsd.org/pipermail/freebsd-bugs/2003-April/000362.html > # stunnel -version > stunnel 4.05 on i686-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7c 30 > Sep > 2003 You use an obsolete version of OpenSSL library. You should upgrade it. http://www.openssl.org/news/secadv_20040317.txt Best regards, Mike

2 1

Stunnel help
by Mohammed Riyaz 30 Sep '04

30 Sep '04

Hi, I have installed stunnel-4.05 along with openssl-0.9.7d. I am not able to run it in either daemon or client mode. I read through the stunnel.org webpage but could find any help. when i run /usr/local/sbin/stunnel -d 7898 -r 631 i get the following output. 2004.09.24 15:10:47 LOG3[4752:1073866848]: -d: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /usr/local/etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options I have copied the sampel config file as /usr/local/etc/stunnel/stunnel.conf. what should i do to avoid this? Is there any good document avalibel explaing step by step installation and configuration of stunnel? Thank you, -Riyaz

2 1

stunnel: command not found
by Robin Martin 24 Sep '04

24 Sep '04

Hi Guys, I am trying to install stunnel-4.05 on Mac 10.2.8. I am following this http://www.stepwise.com/Articles/Workbench/eart.4.0.html article. I am up to Step 8: Testing your setup. The article is old, but I am aware that stunnel 4.* requires a configuration file rather than command line inputs. My config file is [imapd] accept = 993 exec = /usr/local/libexec/imapd execargs = imaps My problem is, when I run (taken from the article) sudo stunnel -c -f -r localhost:993 I get the following, stunnel: command not found Can I use command line arguments here? It seems to be a very non-specific error. While hunting around for an answer I read somewhere else that stunnel likes to die silently? So perhaps I am doing something wrong but getting a vague error message? Is there a log file that I can look at? Thank you for any help, it is appreciated and I hope I've provided sufficient information. Best Regards, Robin _________________________________________________________________ Find love today with ninemsn personals. Click here: http://ninemsn.match.com?referrer=hotmailtagline

2 1

stunnel: command not found
by Robin Martin 24 Sep '04

24 Sep '04

Hi Guys, I am trying to install stunnel-4.05 on Mac 10.2.8. I am following this http://www.stepwise.com/Articles/Workbench/eart.4.0.html article. I am up to Step 8: Testing your setup. The article is old, but I am aware that stunnel 4.* requires a configuration file rather than command line inputs. My config file is [imapd] accept = 993 exec = /usr/local/libexec/imapd execargs = imaps My problem is, when I run (taken from the article) sudo stunnel -c -f -r localhost:993 I get the following, stunnel: command not found Can I use command line arguments here? It seems to be a very non-specific error. While hunting around for an answer I read somewhere else that stunnel likes to die silently? So perhaps I am doing something wrong but getting a vague error message? Is there a log file that I can look at? Thank you for any help, it is appreciated and I hope I've provided sufficient information. Best Regards, Robin

1 0

rsync over stunnel 4
by Steven Timm 23 Sep '04

23 Sep '04

There's an example of rsync over stunnel at http://www.stunnel.org/examples/rsync_mike.html but it appears to be using stunnel 3 syntax. Has anyone successfully made this work using stunnel 4? right now /etc/stunnel.conf is same on client and server, has [rsync] accept = 2222 connect = 873 Steve Timm ------------------------------------------------------------------ Steven C. Timm, Ph.D (630) 840-8525 timm(a)fnal.gov http://home.fnal.gov/~timm/ Fermilab Computing Div/Core Support Services Dept./Scientific Computing Section Assistant Group Leader, Farms and Clustered Systems Group Lead of Computing Farms Team

1 0

performance data
by Michal Trojnara 21 Sep '04

21 Sep '04

Dear Users, I've prepared a table that summarizes my benchmarks. I hope you'll find it useful. http://stunnel.mirt.net/perf.html Best regards, Mike

1 0

Pass phrase dialog
by John Bradley 18 Sep '04

18 Sep '04

When I start stunnel 4.05, I am presented with a dialog that requests that I enter a pass phrase in order to access our private key. Is there anyway to bypass this dialog. I would like to add the pass phrase to the config file, so that the dialog isn't presented. Security isn't an issue. Our config file will be in a secure location. Otherwise, our operations people are going the have to know the pass phrase to start stunnel. Thanks for your help. John ---------------------------------------------- John Bradley Software Development Lava Trading Inc. 95 Morton Street, 4th Floor New York, NY 10014 Tel: 212.609.0162 Fax: 212.609.0101 www.lavatrading.com <http://www.lavatrading.com/> This communication (including attachments) contains information that may be confidential. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any distribution, copying or use of this communication or the information in it (including, in any attachments) is strictly prohibited. If you have received this communication in error please notify us by e-mail or by telephone 212-609-0162 and then delete the e-mail and all attachments and any copies thereof.

2 1

unclosed connection issue
by Ken G 15 Sep '04

15 Sep '04

I'm running stunnel 3.xx with thttpd (an embedded http server) on a small embedded machine on a pci card running linux. Establishing ssh, ftp, and http connections and using OpenSSL has all worked fine since they've been installed. I've been experiencing a strange issue. It seems that stunnel fails (somehow) to inform https clients that the connection has been closed. The sequence of events that I'm observing goes like this: T+0.0s: https client initiates request on port 443 (https). T+0.1s: stunnel establishes connection with thttpd on port 80. T+0.4s: thttpd finishes and dies, closing connection with stunnel. T+0.5s: stunnel finishes sending thttpd's output to its client, and then stops, believing that it has finished that connection. If forked, this copy of stunnel dies. The client (internet explorer, firefox, mozilla... doesn't matter) still believes that the connection is active, and waits for additional data. T+10.5s: Roughly 10 seconds later the client decides that the server timed out and displays what has been sent so far, which is the entire page. The only visible symptom is that small webpages seem to take 10 seconds to load. The visible symptom, then, is that webpages below a certain size (where that size is determined by the browser's willingness to refresh its view as data is being sent) take about 10 seconds to load. Is it possible that this behavior is due to stunnel? _______________________________ Do you Yahoo!? Express yourself with Y! Messenger! Free. Download now. http://messenger.yahoo.com

1 0

verify option question
by Alaadin 13 Sep '04

13 Sep '04

hello, i am using stunnel4.x under linux in my server i set verify option level 3 and in my clinet i added stunnel.pem so verify can happen now can my isp knows my key of encrytion and decrypt ? so it is safe to set verify level 3 ? or it shouldnot ? can my isp decrpt my traffic or knows what sites i visted? thanks

1 0

Wish: Option verify service-dependent
by Hans Werner Strube 13 Sep '04

13 Sep '04

With stunnel-4.x, it would be greatly desirable to make the option "verify" (and possibly the related certs) in stunnel.conf service-dependent rather than global. I have not looked at the code sufficiently to determine whether and how this could be possible.

2 1

Re: [stunnel-users] Stunnel-3.26 / OpenSSL 0.9.6m / Solaris / SSL _accept: Peer sudden ly disconnected
by Martin Kneissl 13 Sep '04

13 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Michal Trojnara wrote: | | What about using my stunnel3 script instead? | | BTW: I really would like to know your comments on this script. | Does anyone need stunnel 3.x, now? | Unfortunately we will have to keep stunnel 3.x for some time (probably at least until next summer), due to a large distributed installation. I appreciate to have the wrapper script to migrate the current installations. If this was available when stunnel 4 was released we probably would have it in our installations right now... Anyone to verify my patch for stunnel-3.26? Best regards, Martin. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3-nr1 (Windows XP) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBRU5SnNbgBz1XxU4RAspgAJ9akmjZNTOig+YW69nRUCDX/hfTFwCfSwqL TKb3reUiIdYwVntSZSgQVgg= =wb9x -----END PGP SIGNATURE-----

1 0

Stunnel-3.26 / OpenSSL 0.9.6m / Solaris / SSL_accept: Peer sudden ly disconnected
by "Kneißl, Martin" 10 Sep '04

10 Sep '04

Hello everybody, I recompiled the newest "traditional" versions of OpenSSL and stunnel on Solaris, Linux, and HPUX. None of the defaults were changed except for --prefix and --openssldir/--with-ssl and --install_prefix Simple tests went through without problems on Linux and HPUX. For Solaris I have a big problem. Any help is appreciated, for example a trustworthy Stunnel-3.26 binary statically linked with OpenSSL 0.9.6m for Solaris 2.6 could also help. Summary ======= Stunnel listens on host medusa 12480 for SSL and forwards plain HTTP to apache on another host (sirius). When I try a HTTPS request to medusa:12480 using a browser or wget, the connection is broken immediately. When stunnel runs under the system call tracer truss the same commands succeed most of the time. In the truss output one can see an EAGAIN on the -r socket of stunnel. That might indicate that there is a problem when TCP buffers do not fill quickly receiving on the -r side. Details ======= Client side: (IP is 192.168.50.153) C:\>wget --spider https://medusa:12480 --12:59:18-- https://medusa:12480/ => `index.html' Resolving medusa... 192.168.41.13 Connecting to medusa[192.168.41.13]:12480... connected. Unable to establish SSL connection. Unable to establish SSL connection. Stunnel side: [mkn@medusa] stunnel-3.26 721$ ./stunnel -p ./stunnel.pem -D 7 -d 12480 -r sirius:80 -f -Pnone 2004.09.08 13:06:52 LOG5[29399:1]: Using 'sirius.80' as tcpwrapper service name 2004.09.08 13:06:52 LOG4[29399:1]: Wrong permissions on ./stunnel.pem 2004.09.08 13:06:52 LOG7[29399:1]: Snagged 64 random bytes from /nfss/home/mkn/.rnd 2004.09.08 13:06:53 LOG7[29399:1]: Wrote 1024 new random bytes to /nfss/home/mkn/.rnd 2004.09.08 13:06:53 LOG7[29399:1]: RAND_status claims sufficient entropy for the PRNG 2004.09.08 13:06:53 LOG6[29399:1]: PRNG seeded successfully 2004.09.08 13:06:53 LOG7[29399:1]: Certificate: ./stunnel.pem 2004.09.08 13:06:53 LOG5[29399:1]: stunnel 3.26 on sparc-sun-solaris2.6 PTHREAD+LIBWRAP with OpenSSL 0.9.6m 17 Mar 2004 2004.09.08 13:06:53 LOG7[29399:1]: No pid file being created 2004.09.08 13:06:53 LOG5[29399:1]: FD_SETSIZE=1024, file ulimit=64 -> 28 clients allowed 2004.09.08 13:06:53 LOG7[29399:1]: SO_REUSEADDR option set on accept socket 2004.09.08 13:06:53 LOG7[29399:1]: sirius.80 bound to 0.0.0.0:12480 2004.09.08 13:06:56 LOG7[29399:1]: sirius.80 accepted FD=7 from 192.168.50.153:1937 2004.09.08 13:06:56 LOG7[29399:4]: sirius.80 started 2004.09.08 13:06:56 LOG5[29399:4]: sirius.80 connected from 192.168.50.153:1937 2004.09.08 13:06:56 LOG7[29399:4]: sirius.80 connecting 192.168.41.223:80 2004.09.08 13:06:56 LOG7[29399:4]: Remote FD=9 initialized 2004.09.08 13:06:56 LOG7[29399:4]: Stunnel manual RSA blinding enabled 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): before/accept initialization 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 read client hello A 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 write server hello A 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 write certificate A 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 write server done A 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 flush data 2004.09.08 13:06:56 LOG3[29399:4]: SSL_accept: Peer suddenly disconnected 2004.09.08 13:06:56 LOG7[29399:4]: sirius.80 finished (0 left) [mkn@medusa] stunnel-3.26 722$ ./stunnel -V stunnel 3.26 on sparc-sun-solaris2.6 PTHREAD+LIBWRAP with OpenSSL 0.9.6m 17 Mar 2004 Default behaviour: run in inetd mode (unless -d used) run in background (unless -f used) run in ssl server mode (unless -c used) Compile time defaults: -v level no verify -a directory (none) -A file (none) -S sources 2 -t timeout 300 seconds -B bytes 64 -D level 5 -P pid dir /opt/stunnel/var/stunnel/ -p pemfile in server mode: stunnel.pem in client mode: none Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 8192 SO_SNDBUF -- -- -- 8192 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 255 TCP_NODELAY -- -- -- 0 [mkn@medusa] stunnel-3.26 724$ uname -a SunOS medusa 5.6 Generic_105181-39 sun4u sparc SUNW,Ultra-Enterprise [mkn@medusa] stunnel-3.26 726$ gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.6/2.95.2/specs gcc version 2.95.2 19991024 (release) When running the same stunnel under truss, I sometimes have success in retrieving the document, but sometimes I get: (...initialisation omitted...) poll(0xEFFFD4E0, 2, -1) = 1 fcntl(7, F_GETFL, 0x00000000) = 2 fstat64(7, 0xEFFFF3D8) = 0 getsockopt(7, 65535, 8192, 0xEFFFF4DC, 0xEFFFF4D4) = 0 fstat64(7, 0xEFFFF3D8) = 0 getsockopt(7, 65535, 8192, 0xEFFFF4DC, 0xEFFFF4D8) = 0 setsockopt(7, 65535, 8192, 0xEFFFF4DC, 4) = 0 fcntl(7, F_SETFL, 0x00000082) = 0 accept(7, 0xEFFFF5D0, 0xEFFFF548) = 8 fstat64(7, 0xEFFFF3D8) = 0 getsockopt(7, 65535, 8192, 0xEFFFF4DC, 0xEFFFF4D8) = 0 setsockopt(7, 65535, 8192, 0xEFFFF4DC, 4) = 0 fcntl(7, F_SETFL, 0x00000002) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 83) = 83 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 1 ] : s i r i u s . 8 0 a c c e p t e d F D = 8 f r o m 1 9 2 . 1 6 8 . 5 0 . 1 5 3 : 2 7 6 3\n fcntl(8, F_SETFD, 0x00000001) = 0 lwp_cond_signal(0xEF66B278) = 0 lwp_cond_wait(0xEF66B278, 0xEF66B288, 0xEF565C48) = 0 lwp_self() = 3 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 52) = 52 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : s i r i u s . 8 0 s t a r t e d\n brk(0x000F73A8) = 0 brk(0x000FF3A8) = 0 getpeername(8, 0x000F56C4, 0xEF20BC78) = 0 getpid() = 2339 [2337] getpeername(8, 0x000DF2E0, 0xEF20B44C) = 0 getsockname(8, 0x000DF2F0, 0xEF20B44C) = 0 open("/etc/hosts.allow", O_RDONLY) Err#2 ENOENT getpid() = 2339 [2337] open("/proc/2339/psinfo", O_RDONLY) = 9 read(9, "\f\0 F H\0\0\005\0\0\t #".., 336) = 336 close(9) = 0 fstat(-1, 0xEF209E40) Err#9 EBADF open("/dev/conslog", O_WRONLY) = 9 fcntl(9, F_SETFD, 0x00000001) = 0 fstat(9, 0xEF209E40) = 0 fstat(9, 0xEF20A8A0) = 0 time() = 1094642471 getpid() = 2339 [2337] putmsg(9, 0xEF209F58, 0xEF209F4C, 0) = 0 open("/etc/.syslog_door", O_RDONLY) = 10 door_info(10, 0xEF209E90) = 0 getpid() = 2339 [2337] door_call(10, 0xEF209E78) = 0 close(10) = 0 open("/etc/hosts.deny", O_RDONLY) Err#2 ENOENT fstat(9, 0xEF20A8A0) = 0 time() = 1094642471 getpid() = 2339 [2337] putmsg(9, 0xEF209F58, 0xEF209F4C, 0) = 0 open("/etc/.syslog_door", O_RDONLY) = 10 door_info(10, 0xEF209E90) = 0 getpid() = 2339 [2337] door_call(10, 0xEF209E78) = 0 close(10) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 79) = 79 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 5 [ 2 3 3 9 : 4 ] : s i r i u s . 8 0 c o n n e c t e d f r o m 1 9 2 . 1 6 8 . 5 0 . 1 5 3 : 2 7 6 3\n so_socket(2, 2, 0, "", 1) = 10 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 73) = 73 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : s i r i u s . 8 0 c o n n e c t i n g 1 9 2 . 1 6 8 . 4 1 . 2 2 3 : 8 0\n connect(10, 0xEF20BC00, 16) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 59) = 59 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : R e m o t e F D = 1 0 i n i t i a l i z e d\n time() = 1094642471 getpid() = 2339 [2337] time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 70) = 70 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : S t u n n e l m a n u a l R S A b l i n d i n g e n a b l e d\n time() = 1094642471 brk(0x000FF3A8) = 0 brk(0x001033A8) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 83) = 83 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : S S L s t a t e ( a c c e p t ) : b e f o r e / a c c e p t i n i t i a l i z a t i o n\n brk(0x001033A8) = 0 brk(0x001093A8) = 0 brk(0x001093A8) = 0 brk(0x0010D3A8) = 0 read(8, 0x00102C78, 11) Err#11 EAGAIN time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 73) = 73 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 3 [ 2 3 3 9 : 4 ] : S S L _ a c c e p t : P e e r s u d d e n l y d i s c o n n e c t e d\n setsockopt(10, 65535, 128, 0xEF20BC78, 8) = 0 close(10) = 0 setsockopt(8, 65535, 128, 0xEF20BC78, 8) = 0 close(8) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 62) = 62 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : s i r i u s . 8 0 f i n i s h e d ( 0 l e f t )\n lwp_cond_signal(0xEF66B278) = 0 lwp_cond_wait(0xEF66B278, 0xEF66B288, 0xEF543CA0) = 0 lwp_mutex_unlock(0xEF66B288) = 0 lwp_mutex_lock(0xEF66B288) = 0 time() = 1094642471 lwp_mutex_lock(0xEF66B288) = 0 lwp_cond_broadcast(0xEF670F50) = 0 poll(0xEFFFD4E0, 2, -1) (sleeping...) With kind regards, Martin Kneissl _________________________ Atos Worldline GmbH CRM and Telco Pascalstrasse 19 52076 Aachen Germany Phone: +49 (0) 2408 148 173 Fax: +49 (0) 2408 148 204 mailto:martin.kneissl@atosorigin.com www.atosworldline.de

2 1

Unable to open "/dev/cryptonet"
by alaadin＠alaadin.org 09 Sep '04

09 Sep '04

hello, when i run stunnel4.x under linux it gaves statment Unable to open "/dev/cryptonet" but it run normal .. what this error mean ? does it means stunnel is running but not encrypting ? and is there any problem running stunnel without "/dev/cryptonet ? secand question i have stunnel4.x running with verify 3 option can my isp read data between me and the other host .. if i am transmiting data through stunnel ? thanks.

2 1

Stunnel-3.26 / OpenSSL 0.9.6m / Solaris / SSL_accept: Peer sudden ly disconnected
by "Kneißl, Martin" 08 Sep '04

08 Sep '04

Correcting my previous post, > ... one can see an EAGAIN on the -r socket of stunnel. That's not true, the EAGAIN is on the accepted file descriptor. The problem is not solved, though ... Martin.

2 1

ssl - excessive message size
by Olivier Rademakers 06 Sep '04

06 Sep '04

Hi All, I am having trouble with a secure connection that used to work until now. I am using an stunnel connection to transfer data from an ldap server(127.0.0.1) to Win Active Directory server (machineB.domain.com) in order to update AD with updated ldap data. I have run stunnel in high verbosity manually so I could extract a log of a connection attempt. Here it is below: # stunnel -c -f -D 7 -P /var/ldapad/ -d 127.0.0.1:6360 -r machineB.domain.com:636 LOG5[9318:1]: Using 'machineB.domain.com.636' as tcpwrapper service name LOG7[9318:1]: RAND_status claims sufficient entropy for the PRNG LOG6[9318:1]: PRNG seeded successfully LOG5[9318:1]: stunnel 3.14 on sparc-sun-solaris2.7 PTHREAD LOG7[9318:1]: Created pid file /var/ldapad/stunnel.machineB.domain.com.636.pid LOG7[9318:1]: machineB.domain.com.636 bound to 127.0.0.1:6360 LOG7[9318:4]: machineB.domain.com.636 started LOG5[9318:4]: machineB.domain.com.636 connected from 127.0.0.1:55001 LOG7[9318:4]: machineB.domain.com.636 connecting 172.27.24.4:636 LOG7[9318:4]: Remote host connected LOG7[9318:4]: before/connect initialization LOG7[9318:4]: before/connect initialization LOG7[9318:4]: SSLv3 write client hello A LOG7[9318:4]: SSLv3 read server hello A LOG7[9318:4]: SSLv3 read server certificate A LOG7[9318:4]: SSLv3 read server key exchange A LOG7[9318:4]: SSLv3 read server key exchange A LOG3[9318:4]: SSL_connect: error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size LOG7[9318:4]: machineB.domain.com.636 finished (0 left) I have searched for this error but to no avail and am wondering if any of you have already come across such, and if so would have the beginning of a solution, and why not The Solution ;-) NB: When running stunnel with the "-c" operand (client mode), it is said the certificates are optional. I have captured the dialogue between the two machines, and apparently, the problem would be coming from the AD server as the DN (Distinguished Name) in the cert is ~8000 bytes long. The capture reveals other errors, checksum and more, so if needed I could append those to the problem stated here. Again, unix-ldap side has not changed to my knowledge. The script has always been the same, and it worked until now. The ldap server is SUN Solaris 2.8 with ssl 0.9.7b Version of stunnel: stunnel 3.21 on sparc-sun-solaris2.8 PTHREAD The AD server is a Windows 2000 machine. Please enlighten me, Olivier

1 1

win32 stunnel - quiet service install
by Michael Brown 03 Sep '04

03 Sep '04

Greetings, It would be great if while installing as a service on win32, there was an option to install quietly - i.e. only pop up a dialog box to the user if there's a problem. Any chance of somebody nice compiling me a binary that does this? :) M. -- Michael Brown {0x527670C0} | `One of the main causes of the fall of Systems Administrator | the Roman Empire was that, lacking zero, +1 519 888 7111 x2339 | they had no way to indicate successful michaelb(a)opentext.com | termination of their C programs.' - Firth

1 0

stunnel.conf
by Bob Williams 02 Sep '04

02 Sep '04

I'm totally new to Stunnel, which I'm running on a Windows XP platform. Where can I find a newbie's tutorial, e.g. to tell me what stunnel expects to find in stunnel.conf? Many thanks for your help. -- Bob

1 0

FTP site
by Michal Trojnara 02 Sep '04

02 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, My ftp site is back online. Thanks to Brian Hatch for reporting the problem. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBN0vB/NU+nXTHMtERAqQ4AJ95KWL5PUpLZOMqQ4xOJYKqeVwgxgCfVIcc yMYncLDroE5wwHxJj5QtjGI= =Tryt -----END PGP SIGNATURE-----

1 0

stunnel3
by Michal Trojnara 01 Sep '04

01 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I've written a perl script to emulate stunnel 3.x command line with stunnel versions 4.05 and later. I hope you'll like it. It's ready for download here: ftp://stunnel.mirt.net/stunnel/stunnel3 Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBNkEq/NU+nXTHMtERAvVGAJ4yuDLNrCOFTLfuuFRIzwShDkd/lwCfcVLa bLhgSAs2gXuzca8ZkJmCb9Q= =SInU -----END PGP SIGNATURE-----

1 0

Samba and stunnel
by Charles A. Monteiro 01 Sep '04

01 Sep '04

just wondering if anybody has had any difficulties with wrapping samba with stunnel, Sambo 3.0 apparently has dropped the support for ssl and therefore we are now also considering using stunnel to wrap Samba. thanks -Charles -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

1 0

Marketing Stunnel
by Charles A. Monteiro 01 Sep '04

01 Sep '04

So I now need to sell stunnel to those that make decisions. It would be helpful to get an understanding of how widely deployed it is. It also would be useful to have a number of company names that I could drop, especially if said companies were major corporations and especially if they were players in the finance/banking industry. thanks in advance, -Charles -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

4 4

re: [stunnel-users] client auth saga
by markzero＠logik.ath.cx 30 Aug '04

30 Aug '04

On Monday 30 of August 2004 20:38, markzero at logik.ath.cx wrote: > To be honest, I'm just generally paranoid. I'd rather have a prospective > attacker have to crack two passwords (the root and one wheel group) than > one. I thought I'd write the above just so I didn't get a big lecture, > hehe. :) > You're not paranoid enough. You still use passwords! 8-) I'm currently in the process of moving everything over to keypairs. I'm not blessed with security conscious users, and it's hard to get them to understand that a keypair is actually more convenient (especially if you use an agent). :) > > I recommend to use CAfile instead of CApath for simple configurations. > > It doesn't need a hashed directory and is not relative to chroot jail. > > So something like: > > CApath = /var/stunnel/certs > No! > CAfile = /var/stunnel/certs/your_cert.pem Oops, yeah I see what you mean. > I'm paranoid that someone has been at my testing configs now. :) I > previously had a working setup, which worries me even further as I *did* > use a symlink. Yes, you can use symlinks, but instead of: ln -s /a/b/c/x /a/b/c/y use: cd /a/b/c ln -s x y Please notice (ls -l) the results are not the same! That must have been it. > Best regards, > Mike > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.4 (GNU/Linux) > > iD8DBQFBM3dd/NU+nXTHMtERApCuAKDe+RWT1S0MQJ4Fr+FSyk8qyqwgpwCg4XED > zBBeDZ6AU+LPU+iejancYGI= > =8uvI > -----END PGP SIGNATURE-----

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users