- stunnel-users - stunnel.org

issue with running stunnel
by Dewen Kong 17 Mar '12

17 Mar '12

Hi all, I am a new guy to stunnel. here is the issue I meet, i install my stunnel in the lab. and trying to run the test with netcat. Here is the config file i test: client side: ... ... output = stunnel.log client = yes [ncat] accept = 12035 connect = ***.***.***.***:1230 then I run "stunnel test.conf "and the the log file shows configuration successfully then I run the command "cat test.file | netcat ***.***.***.*** 12035 on the client side and run netcat -l -p 1230 > output nothing happens. And I check the log file. there is no record about the netcat. I don't know what happened. -- *Dewen Kong*

2 2

Stunnel 1.45 on Win7 x64, OCSP blows up
by Michael Olson 16 Mar '12

16 Mar '12

I'm using stunnel in client mode on a Windows 7 x64 workstation, installed using ftp://ftp.stunnel.org/stunnel/stunnel-4.52-installer.exe Everything works until I try to check the server certificate for revocation using an OCSP server, at which point stunnel crashes whenever I make a connection. The following error pops up in a dialog box: OPENSSL_Uplink(0FBE5000,14): no OPENSSL_Applink My config is pretty simple: -------------------------------------------------------------- debug = 7 # I do want FIPS enabled, but I figured one problem at a time. fips = no CAfile = ca-bundle.crt verify = 2 OCSP = http://ocsp.test.net/ options = NO_SSLv2 [test1] client = yes accept = 127.0.0.1:80 connect = web.test.net:443 -------------------------------------------------------------- The log gets as far as: 2012.03.02 11:07:41 LOG7[4296:5008]: OCSP: server connected when it crashes. -- Mike

2 3

need suggestion on this issue?
by Dewen Kong 16 Mar '12

16 Mar '12

Hi guys, Right now I am working on this issue trying to encrypt the communication between terminals and our back of house computer. I am trying to solve this problem with stunnel. If the terminal is 'smart' like computer, it will be no issue. implement the stunnel on both end. But it come to be a problem there is some dumb terminal, No way to set up stunnel in its side. I not sure stunnel can works here any more. if not, is there any other methods that may work? -- *Dewen Kong*

2 1

Stunnel->Stunnel Failure Behavior...
by Matt Wise 13 Mar '12

13 Mar '12

I'm using Stunnel in our environment to tunnel our ZooKeeper connections... it works reasonably well as long as ZooKeeper is running on our ZooKeeper servers properly. Here's an example of our server and client configs: Server: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > sslVersion = TLSv1 > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > debug = 4 > [zookeeper] > accept = 0.0.0.0:2182 > failover = rr > connect = 127.0.0.1:2181 Client: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > sslVersion = TLSv1 > client = yes > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > debug = 4 > [zookeeper] > accept = 127.0.0.1:2182 > failover = rr > connect = zookeeper1:2182 > connect = zookeeper2:2182 > connect = zookeeper3:2182 Now the intended behavior is that if 'zookeeper1', 'zookeeper'2, or 'zookeeper3' go down that the client will re-establish a connection with one of the other servers. However, that doesnt seem to be happening. Instead, when the connection dies, Stunnel seems to go into a massive loop trying to re-connect to the original server. > Feb 22 21:41:24 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) Whats missing in my config to make the failover work properly? —Matt

2 2

Stunnel stopped working: Will not sync with Google using Outlook 2007 on Ubuntu 11:10 64-bit
by Jonathan Harrison 13 Mar '12

13 Mar '12

I made some changes to my stunnel config, and had one account working. I added the remaining 3 and it seemed to start to work, but now it has stopped. Outbound (send) seems to be fine. Any ideas????? Telnet and post listening test results: [CODE]$ netstat -an | grep -iw LISTEN tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3001 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3002 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3003 0.0.0.0:* LISTEN tcp6 0 0 :::80 :::* LISTEN tcp6 0 0 ::1:631 :::* LISTEN tcp6 0 0 :::445 :::* LISTEN tcp6 0 0 :::139 :::* LISTEN baronipc@baronipc:~$ telnet localhost 3000 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ telnet localhost 3001 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ telnet localhost 3002 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ telnet localhost 3003 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ [/CODE] Copy of config file: [CODE] ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/mail.pem ;key = /etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 [imaps Work] accept = 127.0.0.1:3000 connect = imap.gmail.com:993 [imaps Personal] accept = 127.0.0.1:3001 connect = imap.gmail.com:993 [imaps Admin] accept = 127.0.0.1:3002 connect = imap.gmail.com:993 [imaps Co] accept = 127.0.0.1:3003 connect = imap.gmail.com:993 ;[ssmtp Work] ;accept = 127.0.0.1:4000 ;connect = smtp.gmail.com:465 ;[ssmt Personal] ;accept = 127.0.0.1:4001 ;connect = smtp.gmail.com:465 ;[ssmtp Admin] ;accept = 127.0.0.1:4002 ;connect = smtp.gmail.com:587 ;[ssmtp Co] ;accept = 127.0.0.1:4003 ;connect = smtp.gmail.com:587 ;[ssmtp other] ;accept = 127.0.0.1:4004 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini[/CODE] And /etc/default/stunnel4 [CODE]# /etc/default/stunnel # Julien LEMOINE <speedblue(a)debian.org> # September 2003 # Change to one to enable stunnel automatic startup ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" # Change to one to enable ppp restart scripts PPP_RESTART=0[/CODE] -- Regards Jonathan

1 0

How to get stunnel to listen on an IPv6 interface?
by jshardlo 11 Mar '12

11 Mar '12

Hi - my server was recently connected to IPv6 as well as the original IPv4 network. I have been using stunnel for some time on the IPv4 network but now that I have IPv6 access I can't work out how to get stunnel to listen on that interface as well. I checked that my stunnel has IPv6 support:- /usr/sbin/stunnel -version stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none I have a configuration like this: [pop3s] accept = 995 connect = 110 But when I do netstat I can see that it is only listening for port 995 on IPv4... netstat -an | grep 995 tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN netstat -an -A inet6 | grep 995 And of course when I connect to port 995 over the IPv6 network I get "connection refused". Any ideas how to get stunnel to listen on the v6 address? Thanks ! -- View this message in context: http://old.nabble.com/How-to-get-stunnel-to-listen-on-an-IPv6-interface--tp… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 1

Stunnel.conf won't load with certain ciphers.
by Thomas Eifert 09 Mar '12

09 Mar '12

Hello all: I'm running Stunnel 4.52 under WinXP SP3. Last night I had some questions about how the cipher list in Stunnel interacts with the cipher negotiation routine between client and server, so I did some experiments in an attempt to address those questions. In the course of doing so, I noticed that, if I attempt to load certain ciphers, Stunnel would stall at configuration load. Using OpenSSL to list TLS ciphers with 4.52's libraries yields the following: ~~~~~~~~~~~~~~~~~~~~~ C:\Program Files\stunnel>openssl ciphers -v -tls1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1 RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1 DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export C:\Program Files\stunnel> ~~~~~~~~~~~~~~~~~~~~~ As such, ciphers RC4-SHA and RC4-MD5 appear to be valid. However, any attempt at using those in client mode causes Stunnel to stall when reading the cipher from stunnel.conf: ~~~~~~~~~~~~~~~~~~~~~ 2012.03.08 20:17:10 LOG5[432:592]: Reading configuration from file stunnel.conf 2012.03.08 20:17:10 LOG5[432:592]: FIPS mode is enabled 2012.03.08 20:17:10 LOG7[432:592]: Compression not enabled 2012.03.08 20:17:10 LOG7[432:592]: Snagged 64 random bytes from C:/.rnd 2012.03.08 20:17:10 LOG7[432:592]: Wrote 1024 new random bytes to C:/.rnd 2012.03.08 20:17:10 LOG7[432:592]: PRNG seeded successfully 2012.03.08 20:17:10 LOG6[432:592]: Initializing SSL context for service nntps.1 2012.03.08 20:17:10 LOG7[432:592]: Loaded verify certificates from peer-nntps.1.pem 2012.03.08 20:17:10 LOG7[432:592]: Loaded peer-nntps.1.pem revocation lookup file 2012.03.08 20:17:10 LOG7[432:592]: SSL options set: 0x00000004 2012.03.08 20:17:10 LOG6[432:592]: SSL context initialized 2012.03.08 20:17:10 LOG6[432:592]: Initializing SSL context for service nntps.2 2012.03.08 20:17:10 LOG7[432:592]: Loaded verify certificates from peer-nntps.2.pem 2012.03.08 20:17:10 LOG7[432:592]: Loaded peer-nntps.2.pem revocation lookup file 2012.03.08 20:17:10 LOG3[432:592]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match 2012.03.08 20:17:10 LOG3[432:592]: Failed to reload the configuration file 2012.03.08 20:17:10 LOG7[432:592]: Signal pipe is empty ~~~~~~~~~~~~~~~~~~~~ This is the relevant snippet from my stunnel.conf file: ~~~~~~~~~~~~~~~~~~~~ debug = 7 delay = yes output = stunnel.log [nntps.1] client = yes sslVersion = TLSv1 ciphers = DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA cafile = peer-nntps.1.pem verify = 4 accept = 127.0.1.1:119 connect = news.server.com:443 [nntps.2] client = yes sslVersion = TLSv1 ciphers = RC4-SHA cafile = peer-nntps.2.pem verify = 4 accept = 127.0.1.2:119 connect = news.server.org:563 ~~~~~~~~~~~~~~~~~~~~ Any attempt at using ciphers RC4-SHA or RC4-MD5. with or without TLS specified, results in the same configuration crash. I don't really need to use those ciphers, but since I observed this behavior, I thought I'd better report it. Any comments welcome. Regards; Thomas . -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 3

Re: [stunnel-users] Memory allocated in a different thread at network.c, line 63
by Philippe A. 08 Mar '12

08 Mar '12

Hello Michal, 2012/3/5 Michal Trojnara <Michal.Trojnara(a)mirt.net> > > I am using fork mode because of leaks with pthread. In 4.33+pthread, >> stunnel virt size (per top) went up to 216m after 40k transactions. In >> fork mode, stunnel size after the same test was 20744 (kilobytes). In >> 4.45, I have 187m and 20676k respectively. >> > > I observed the same symptoms. Stunnel grows to ~200MB of virtual memory > after some time of usage. Then it stops growing further. I guess this > issue is caused by heap fragmentation rather than a memory leak. Otherwise > the growth would not be limited to ~200MB. > https://en.wikipedia.org/wiki/**C_dynamic_memory_allocation<https://en.wikipedia.org/wiki/C_dynamic_memory_allocation> I ran a test overnight that confirmed your point. I generated 480k+ stunnel transactions. This morning, stunnel memory usage is virt=187m and res=42m. My result after 40k transactions was exactly the same (in both cases with pthread+zlib). > I understand that virt includes shared libs, and that any issue with a >> shared lib will impact virt size. I did not have the opportunity to test >> without zlib support in openssl. Since we are not using compression, I >> wonder how much avoiding zlib would help. >> > > zlib only uses lots of memory when it's enabled. > I ran another test to clarify this. zlib appears to be adding around 3 megabytes at most. This is at least what I see under my setup and type of usage. pthread+zlib, 40k transactions before: virt=20680, res=792 after: virt=187m, res=42m pthread+nozlib, 40k transactions before: virt=20688, res=896 after: virt=185m, res=39m I have seen no benefit of compiling without zlib in fork mode. I guess it only makes forking a bit lighter. 2012/3/5 Michal Trojnara <Michal.Trojnara(a)mirt.net> > You may also try to set a lower value of MMAP_THRESHOLD to reduce heap > fragmentation: > https://www.kernel.org/doc/man-pages/online/pages/man3/malloc.3.html > This will be worth a look. Knowing what is influencing stunnel size is nice since it can avoid us restarting the processes once in a while (which we currently never do in fork mode). Thanks for your great help!

1 0

How to pass remote IP to local SMTP/POP3 server
by Zdenek Valach (INBOX) 08 Mar '12

08 Mar '12

Hi I have question, because I was not able to find answer anywhere on internet. I started to use Stunnel in server mode to provide POP3S/SMTPS functionality. Everything works fine except that I am missing remote IP of connecting client. I am using Windows version so I can not use transparent proxy mode working on Unix. Is there way how to make Stunnel for example after each establishment of TCP connection to send to SMTP/POP3 server port some special command like REMOTEIP 123.123.123.123<crlf> to pass this information there. I know it is not in SMTP/POP3 standard but it is simple for me extend behavior of SMTP/POP3 service by this command? Thank you very much for any advice Zdenek ____________________________________________________________ FREE 3D MARINE AQUARIUM SCREENSAVER - Watch dolphins, sharks & orcas on your desktop! Check it out at http://www.inbox.com/marineaquarium

2 3

mknod: not owner building stunnel on Solaris SPARC 10 zone
by Jiri ROHLICEK 07 Mar '12

07 Mar '12

Hello,I've been building stunnel 4.52 on Solaris 10 SPARC zone. Configure and make went fine, make install failed in tools with error if uname | grep SunOS; then \ ../auto/install-sh -c -d -m 755 /tmp/stunnel/var/lib/stunnel/dev; \ mknod /tmp/stunnel/var/lib/stunnel/dev/zero c 13 12; \ chmod 666 /tmp/stunnel/var/lib/stunnel/dev/zero; \ fi SunOS mknod: Not owner -- mknod is not allowed in solaris zone, only in global. One of many notices of this error skayser's http://www.mail-archive.com/devel@lists.opencsw.org/msg03031.html asks if mknod is needed on solaris 10. So I tried after configure comment out the mknod section in tools/Makefile. -- install-data-local: ... ... if uname | grep SunOS; then \ ${INSTALL} -d -m 755 $(DESTDIR)$(localstatedir)/lib/stunnel/dev; \ mknod $(DESTDIR)$(localstatedir)/lib/stunnel/dev/zero c 13 12; \ chmod 666 $(DESTDIR)$(localstatedir)/lib/stunnel/dev/zero; \ fi -- Now make install ends OK and stunnel works fine (I use it as client only). Isn't creating ./dev/zero not needed anymore? Thanks Jiri Rohlicek jrohlicek(a)aplis.cz

1 0

Username and Password in Stunnel
by Jim Murphy 07 Mar '12

07 Mar '12

I have a program that only allows me to enter a From email address and a mail server IP in its setup. Is there any way that I could enter a username and a password in stunnel.conf and let Stunnel send this information out to Office 365 or Gmail for delivery? Thanks! Jim

3 2

Re: [stunnel-users] Memory allocated in a different thread at network.c, line 63
by Philippe A. 07 Mar '12

07 Mar '12

Hello Michal, 2012/3/5 Michal Trojnara <Michal.Trojnara(a)mirt.net> > I fixed it: > ftp://ftp.stunnel.org/stunnel/**beta/stunnel-4.53b10.tar.gz<ftp://ftp.stunnel.org/stunnel/beta/stunnel-4.53b10.tar.gz> > Please give it a try and let me know whether it works for you. I tried the beta and the error is definitely gone. However I will stick with 4.45 for now as my next deployment is already prepared. Thanks a lot for your assistance!

1 0

Couple of issues with 4.45
by Philippe A. 07 Mar '12

07 Mar '12

Hello, I have encountered a couple of issues with stunnel 4.45 on RHEL 5.5. I tried configuring stunnel to log messages in /var/log/messages and later found that messages were logged both in that file AND /var/log/messages. In stunnel.conf, I had specified: debug=local6.info In syslog.conf: local6.* /var/log/stunnel.log I could achieve what I wanted only with the combination of the following two options: syslog=no output=/usr/local/app/stunnel/var/stunnel.log Is this expected? The second issue I have noticed is that stunnel seems to have a bit of trouble handling the hup signal. If you start stunnel specifying a relative path to the config, sending hup will cause stunnel to log and error but it won't exit. 2012.03.01 16:31:29 LOG5[19000:0]: Reading configuration from file etc/server.conf 2012.03.01 16:31:29 LOG3[19000:0]: etc/server.conf: No such file or directory (2) 2012.03.01 16:31:29 LOG3[19000:0]: Cannot read configuration 2012.03.01 16:31:29 LOG3[19000:0]: Failed to reload the configuration file If you specify an absolute path, no error will be reported but stunnel will exit anyway.

2 3

No sub folders, calendar or contacts
by Jonathan Harrison 05 Mar '12

05 Mar '12

Dear sirs I am using Ubuntu 11.10 64-bit, Outlook 2007 and 4 x gmail accounts (1 x personal (gmail.com) and 3 x business (baroni-limited.com, hosted by gmail). I have set up Stunnel, I belive the latest version and created a SSL license as instructed. The Stunnel Telnets OK and I can send and recieve eMails (I do send directly via my ISP rather than use Stunnel) without any problem. Where I seem to be having problems is that: I have no sub folders to each account. None are appearing. I have no calendars - I have followed the instructions but they fail to load. I have no contacts. Message from Outlook: Sync error > > Task 'Synchronizing subscribed folders for Baroni.' reported error > (0x800CCC0E) : 'Outlook cannot synchronize subscribed folders for Baroni. > Error: Cannot connect to the server. If you continue to receive this > message, contact your server administrator or Internet service provider > (ISP).' > > Task 'Internet Calendar Subscriptions' reported error (0x8004010F) : 'The > operation failed. An object cannot be found.' > Config attached - I hope. It is most likely I have missed something or done something wrong. I have not found anything to help me on the web or archives, could you please advise. If you feel you need a copy of the the logs, please advise and I shall happily provide what I can. I am assuming I have just missed something. -- Regards Jonathan

1 0

FIPS_mode_set:fingerprint does not match
by Jack 04 Mar '12

04 Mar '12

I have the following problem running stunnel on Centos 6.x 64bit with the following error: I have been search with google to see if there was a solution but nothing was found Thank you for your reply and your help, hopefully I can get this solved. ******************************************************************************** Clients allowed=500 stunnel 4.52 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:ENGINE,FIPS Auth:none Sockets:POLL,IPv6 Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match *******************************************************************************

3 2

Stunnel in Client / Server configuration
by Michael Curran 04 Mar '12

04 Mar '12

Hello, I have 2 servers in different locations across the country. I am using them as a paired tunnel that both act as server and client Server A has this configuration (cert definitions left out on purpose, but exist and are valid) ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4 setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle TIMEOUTclose=0 ; 128-bit or highter only ciphers = HIGH:MEDIUM ; Workaround for Eudora bug options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 ; Some debugging stuff useful for troubleshooting debug = local7.info ;warning [Tunnel from Server B] accept = 1.2.3.4:443 connect = 127.0.0.1:8082 [Tunnel to Server B] accept = 5.6.7.8:3132 connect = 9.10.11.12:4000 client = yes Server B (cert definitions left out on purpose, but exist and are valid) ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4 setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle TIMEOUTclose=0 ; 128-bit or highter only ciphers = HIGH:MEDIUM ; Workaround for Eudora bug options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 ; Some debugging stuff useful for troubleshooting debug = local7.debug ;warning [Tunnel to Server A] accept = 10.1.2.3:9443 connect = 1.2.3.4:443 client = yes [Tunnel from Server A] accept = 9.10.11.12:4000 connect = 10.4.5.6:3132 Communication through Server A (client) to Server B (server) works as expected Communication through Server B (client) back to Server A (server) recieves this error curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol (this is all the further it gets, the client says hello and the server responds with this) If I skip the local stunnel config and pass the traffic publicly through to Server A (running in client mode), from Server B, I get the expected http response I setup to test the tunnel. Im just assuming that if I am passing from Stunnel from one system to stunnel on another, one of them should be client and the other should be server. This works well on our old configurations and as far as I can see from a stunnel and network route perspective all rules are identical. Why would it work from Server B to Server A on the response if I go directly to Server A, but fail locally? The configuration looks correct, what else could I check?

2 1

Multiple Config Files
by Scott McKeown 02 Mar '12

02 Mar '12

Hi All, I'm new to the STunnel system but I'm loving what I have seen so far. However, I was wondering if its possible to have a setup something along the lines of the following: general.cfg - containing my general server system details http.cfg - containing the details of my HTTP server pop3.cfg - containing the details of my pop3 server etc. etc. but linking them all from one file so that if I want to remove the pop3 service I can just remove the pop3.cfg file and one line from the base file. I hope that someone understands what I'm getting at but if you need any more info please just let me know. Yours, Scott

3 3

Re: [stunnel-users] FIPS_mode_set:fingerprint does not match
by Jake Skinner 01 Mar '12

01 Mar '12

Have you tried disabling FIPS to see if your connection works without? Jake Skinner Telephony Technology Specialist Ontario Systems, LLC Office +1.765.751.7000 Thumbed posthaste from my mobile device; please forgive any typing or grammatical errors. ________________________________ From: stunnel-users-bounces(a)stunnel.org To: stunnel-users(a)stunnel.org Sent: Wed Feb 29 19:41:02 2012 Subject: [stunnel-users] FIPS_mode_set:fingerprint does not match I have the following problem running stunnel on Centos 6.x 64bit with the following error: I have been search with google to see if there was a solution but nothing was found Thank you for your reply and your help, hopefully I can get this solved. ******************************************************************************** Clients allowed=500 stunnel 4.52 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:ENGINE,FIPS Auth:none Sockets:POLL,IPv6 Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match ******************************************************************************* Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 1

linux default installation
by John A. Wallace 29 Feb '12

29 Feb '12

Hello. I am comparing a default installation of "stunnel.conf" in Linux with that in Windows, and I found some differences that I have a couple questions about. The Windows installation installed in client mode by default, but the one for Linux in server mode. I made a backup copy of the default files for both. For now I want to run stunnel in Linux in client mode, so I am making some changes to it. The installed default for these six parameters are as follows: Client=no Chroot=/var/lib/stunnel/ Setuid=stunnel Setgid=nogroup Pid=/var/run/stunnel.pid Cert=/etc/stunnel/stunnel.pem Is it correct to change these settings for testing in client mode so that they match the current Windows' client mode configuration, like so: Client=yes #Chroot=/var/lib/stunnel/ #Setuid=stunnel #Setgid=nogroup #Pid=/var/run/stunnel.pid #Cert=/etc/stunnel/stunnel.pem

1 1

stunnel log delayed
by John A. Wallace 29 Feb '12

29 Feb '12

Hello, I am running stunnel on Linux in client mode, and I have the following setting in "stunnel.conf": output=stunnel.log The log does not get written to periodically while the program is running but is delayed until after I have closed the program. It would be helpful to be able to look at it from time to time, especially while troubleshooting. Any way "to push" the data down into the file sooner? Thanks. John

2 1

Memory allocated in a different thread at network.c, line 63
by Philippe A. 28 Feb '12

28 Feb '12

Hello, I find the following error my syslog when stopping stunnel 4.52. The program seems to be unable to shutdown cleanly (ex: pid file doesn`t get removed). stunnel: INTERNAL ERROR: Memory allocated in a different thread at network.c, line 63 This is how I configured: LDFLAGS=-Wl,-rpath,/usr/local/app/openssl/lib64 \ ./configure --prefix=/usr/local/app/stunnel \ --includedir=$PKG_HOME/openssl/include/ \ --with-ssl=$PKG_HOME/openssl/ \ --with-threads=fork \ --disable-libwrap Where PKG_HOME is a variable of my own. I had the same error with version 4.51. I do not see the error when running in foreground. I do not see the error either if I compile with threads instead of fork. In case this information is needed, this is how I configured openssl. ./config --prefix=/usr/local/app/openssl --libdir=lib64 shared zlib-dynamic no-ssl2 This is on RHEL 5.5 Regards.

2 2

stunnel for WCF services configured for.NETTCP binding
by larisa_y 24 Feb '12

24 Feb '12

Will Stunnel work for WCF services configured for.NETTCP binding? Thank you. -- View this message in context: http://old.nabble.com/stunnel-for-WCF-services-configured-for.NETTCP-bindin… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

SSLv3 on Win32 does not work
by Zdenek Valach (INBOX) 24 Feb '12

24 Feb '12

Hi I am using the latest version of stunnel in server mode (converting POP3S to POP3) I need to make service work in SSLv3 mode. In TLSv1 it works fine, when I add to stunnel.conf tag sslVersion = all, it still works fine, but when I use sslVersion = SSLv3 although config file is loaded properly, process EXE crashed during establishing the connection. It looks like some bug in actual version of stunnel. Does somebody experience same problem? Thank you very much in advance for any advice Thanks Zdenek ____________________________________________________________ Send any screenshot to your friends in seconds... Works in all emails, instant messengers, blogs, forums and social networks. TRY IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if2 for FREE

2 1

Stunnel for Android
by Huzella Balázs 23 Feb '12

23 Feb '12

Hi! I have downloaded the Android port of stunnel: http://mirrors.zerg.biz/stunnel/stunnel-4.52-android.zip I would like to use it on my Android tablet but I don't know how to start or use it. I have root access on the device. I placed the stunnel and openssl files into /data/stunnel/ directory. Both files have execute permission. Can anybody please provide some information on how to use this application? I haven't found any info on stunnel.org. Best Regards, Balázs Huzella

2 1

Multiple Domains for https
by Thomas Manson 23 Feb '12

23 Feb '12

Hi, I want to setup the following architecture : stunnel ---> haproxy --> 2 webserver. I run severa virtual host on the 2 webservers, and a subset of them needs https. I can allocate several IP address for the host that run stunnel. How do I configure a single stunnel process to have a certificate per IP for the port https? I tryed to add several section like the following : [mansonthomas.com] cert = /etc/stunnel/sites/mansonthomas.com/mansonthomas.com.crt accept = 88.190.17.222:443 connect = 127.0.0.1:82 xforwardedfor = yes TIMEOUTclose = 0 So the question is : Is it possible ? do you have a sample configuration file to share for this use case? Thanks, Thomas.

4 9

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users