- stunnel-users - stunnel.org

Multiple Domains for https
by Brian McGinity 15 Dec '11

15 Dec '11

Will Stunnel work with multiple domains? For example if abc.com and xyz.com both resolve to the same ip address where the web server is running locally on port 4080. Going when to https://abc.com or https://xyz.com stunnel will encrypt the traffic and forward to the local 4080 port in the clear. What if 10 or 20 domains needed to be served by the same web server?

2 3

Reload/change CRL?
by John Abloyer 15 Dec '11

15 Dec '11

Hi, Is there a way to reload CRL, or actually change to a newer, *without* restarting stunnel?

2 1

Is Stunnel Right Tool for....?
by Brian McGinity 14 Dec '11

14 Dec '11

Is Stunnel the right tool for this situation? I am using an Intel disk monitoring tool which has the ability to send out email alerts. In the Email Setup it asks for Host, From and To, there is not a username or pw. Could Stunnel be configured to add the username and pw and send the message to gmail's smtp?

2 1

stunnel-4.50 on Nexus S android
by Jason Haar 14 Dec '11

14 Dec '11

Hi there I'm trying out the stunnel android binary from 4.50 on a rooted 2.3.6 Android, mapping localhost port 80 to a remote client-cert protected ActiveSync server. It crashes after a client makes a connection. Here's the "debug = 7" logs 2011.12.14 07:44:55 LOG7[8738:2949960768]: Private key loaded 2011.12.14 07:44:55 LOG7[8738:2949960768]: SSL options set: 0x00000004 2011.12.14 07:44:55 LOG6[8738:2949960768]: SSL context initialized 2011.12.14 07:44:55 LOG5[8738:2949960768]: Configuration successful 2011.12.14 07:44:55 LOG7[8738:2949960768]: Option SO_REUSEADDR set on accept socket 2011.12.14 07:44:55 LOG7[8738:2949960768]: Service ActiveSync bound to 0.0.0.0:80 2011.12.14 07:44:55 LOG7[8738:2949960768]: Service ActiveSync opened FD=5 2011.12.14 07:44:55 LOG7[8738:2949960768]: Created pid file /data/local/etc/stunnel/pid 2011.12.14 07:44:59 LOG7[8738:2949960768]: Service ActiveSync accepted FD=6 from 127.0.0.1:58088 2011.12.14 07:44:59 LOG7[8738:1525312]: Service ActiveSync started 2011.12.14 07:44:59 LOG7[8738:1525312]: Option TCP_NODELAY set on local socket ...[I do "telnet 127.0.0.1 80" ] 2011.12.14 07:44:59 LOG5[8738:1525312]: Service ActiveSync accepted connection from 127.0.0.1:58088 Segmentation fault Any ideas how to debug this? I basically grabbed a working config off my Linux laptop and moved it over (different paths of course), so I assume the binary is missing something? -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 1

unsubscribe
by Brian McGinity 14 Dec '11

14 Dec '11

Unsubscribe

1 0

SSL alert (write): fatal: protocol version
by René Legault 14 Dec '11

14 Dec '11

Hi, I have an issue when using Stunnel. Can somebody help me? I have a module on my network that sends non-SSL e-mail but my ISP (Sympatico.ca) is accepting only SSL communication. This is my stunnel.conf file: cert = stunnel.pem protocol = smtp ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [smtp] accept=192.168.1.17:25 connect = smtphm.sympatico.ca:25 And this is my log: 2011.12.13 19:55:06 LOG7[2468:1644]: Service smtp accepted FD=316 from 192.168.1.200:12149 2011.12.13 19:55:06 LOG7[2468:1644]: Creating a new thread 2011.12.13 19:55:06 LOG7[2468:1644]: New thread created 2011.12.13 19:55:06 LOG7[2468:2684]: Service smtp started 2011.12.13 19:55:06 LOG5[2468:2684]: Service smtp accepted connection from 192.168.1.200:12149 2011.12.13 19:55:06 LOG6[2468:2684]: connect_blocking: connecting 65.55.172.251:25 2011.12.13 19:55:06 LOG7[2468:2684]: connect_blocking: s_poll_wait 65.55.172.251:25: waiting 10 seconds 2011.12.13 19:55:06 LOG5[2468:2684]: connect_blocking: connected 65.55.172.251:25 2011.12.13 19:55:06 LOG5[2468:2684]: Service smtp connected remote server from 192.168.1.17:3013 2011.12.13 19:55:06 LOG7[2468:2684]: Remote FD=392 initialized 2011.12.13 19:55:06 LOG6[2468:2684]: Client-mode smtp protocol negotiations started 2011.12.13 19:55:06 LOG7[2468:2684]: <- 220 BLU0-SMTP6.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Tue, 13 Dec 2011 16:55:06 -0800 2011.12.13 19:55:06 LOG7[2468:2684]: -> 220 BLU0-SMTP6.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Tue, 13 Dec 2011 16:55:06 -0800 2011.12.13 19:55:06 LOG7[2468:2684]: -> EHLO localhost 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-BLU0-SMTP6.phx.gbl Hello [65.94.163.170] 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-TURN 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-SIZE 41943040 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-ETRN 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-PIPELINING 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-DSN 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-ENHANCEDSTATUSCODES 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-8bitmime 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-BINARYMIME 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-CHUNKING 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-VRFY 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-TLS 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-STARTTLS 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250 OK 2011.12.13 19:55:06 LOG7[2468:2684]: -> STARTTLS 2011.12.13 19:55:06 LOG7[2468:2684]: <- 220 2.0.0 SMTP server ready 2011.12.13 19:55:06 LOG6[2468:2684]: Client-mode smtp protocol negotiations succeeded 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): before/connect initialization 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write client hello A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 read server hello A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 read server certificate A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 read server done A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write client key exchange A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write change cipher spec A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write finished A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 flush data 2011.12.13 19:55:07 LOG7[2468:2684]: SSL state (connect): SSLv3 read finished A 2011.12.13 19:55:07 LOG7[2468:2684]: 1 items in the session cache 2011.12.13 19:55:07 LOG7[2468:2684]: 86477 client connects (SSL_connect()) 2011.12.13 19:55:07 LOG7[2468:2684]: 86477 client connects that finished 2011.12.13 19:55:07 LOG7[2468:2684]: 0 client renegotiations requested 2011.12.13 19:55:07 LOG7[2468:2684]: 0 server connects (SSL_accept()) 2011.12.13 19:55:07 LOG7[2468:2684]: 0 server connects that finished 2011.12.13 19:55:07 LOG7[2468:2684]: 0 server renegotiations requested 2011.12.13 19:55:07 LOG7[2468:2684]: 0 session cache hits 2011.12.13 19:55:07 LOG7[2468:2684]: 0 external session cache hits 2011.12.13 19:55:07 LOG7[2468:2684]: 0 session cache misses 2011.12.13 19:55:07 LOG7[2468:2684]: 0 session cache timeouts 2011.12.13 19:55:07 LOG6[2468:2684]: SSL connected: new session negotiated 2011.12.13 19:55:07 LOG6[2468:2684]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2011.12.13 19:55:07 LOG6[2468:2684]: Compression: null, expansion: null 2011.12.13 19:55:07 LOG7[2468:2684]: SSL alert (write): fatal: protocol version 2011.12.13 19:55:07 LOG3[2468:2684]: SSL_read: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.12.13 19:55:07 LOG5[2468:2684]: Connection reset: 19 bytes sent to SSL, 219 bytes sent to socket 2011.12.13 19:55:07 LOG7[2468:2684]: Service smtp finished (0 left) 2011.12.13 19:55:07 LOG7[2468:2684]: str_stats: 16 block(s), 353 data byte(s), 544 control byte(s) What am I doing wrong? Thanks Rene

1 0

Problems with Stunnel 4.5*
by Sebastian Rose-Indorf 12 Dec '11

12 Dec '11

Hello Mike, many thanks for your work. However, I have problems with the current Stunnel versions. (I work with Windows 64bit.) Stunnel 4.47 works without problems. Stunnel 4.51b1 however - starts only if "fips = no" is set; - not accepts my certificate and my private key (SHA384 or RMD160, AES128 or IDEA) any more: error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib error queue: 2306A075: error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error error queue: 23077073: error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error SSL_CTX_use_PrivateKey_file: 6074079: error:06074079:digital envelope routines:EVP_PBE_CipherInit:unknown pbe algorithm Yours sincerely Sebastian

3 10

stunnel 4.50 released
by Michal Trojnara 12 Dec '11

12 Dec '11

Dear Users, I have released version 4.50 of stunnel. The ChangeLog entry: Version 4.50, 2011.12.03, urgency: MEDIUM: * New features - Added Android port. - Updated INSTALL.FIPS. * Bugfixes - Fixed internal memory allocation problem in inetd mode. - Fixed FIPS mode on Microsoft Vista, Server 2008, and Windows 7. This fix required to compile OpenSSL FIPS-compliant DLLs with MSVC 9.0, instead of MSVC 10.0. msvcr100.dll was replaced with msvcr90.dll. GPL compatibility issues are explained in the GPL FAQ: http://www.gnu.org/licenses/gpl-faq.html#WindowsRuntimeAndGPL - POP3 server-side protocol negotiation updated to report STLS capability (thx to Anthony Morgan). Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.50.tar.gz: 933467009529bae4f338bb20e758e0ea20b0759130e7695ea2193c4f270e5eaf Best regards, Mike

4 18

Problem with sslv2 clients
by Markus Borst 09 Dec '11

09 Dec '11

Hi, we have a strange problem with newer stunnel versions (4.50 on windows), compared to older ones (known to work is version 4.35). The problem seems to be, that if a client sends a SSLv2 Helo message, the stunnel server simply resets the TCP connection, without trying to negotioate anything. Setup: Stunnel is used top provide ssl/tls for imap, Hobbit is used to monitor service availability. The Hobbit module to monitor imaps seems to try SSLv2 first, but also supports newer versions (SSLv3 and TLSv1). The ssl connection never gets established, stunnel sends a tcp RST, hobbit never retries. We can force some hobbit modules to use TLSv1 exclusively, but not all of them. We fear that some older mailclients will also have problems initiating a connection, so we keep stunnel 4.35 running for now. stunnel.conf: fips = no debug = 7 output = stunnel.log [imaps] accept = 130.83.174.1:993 connect = 127.0.0.1:143 cert = imap.xxx.company.yy.pem stunnel.log: 2011.12.09 14:55:12 LOG5[6820:2144]: Service imaps accepted connection from xxx.yyy.zzz.105:45294 2011.12.09 14:55:12 LOG3[6820:2144]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.12.09 14:55:12 LOG5[6820:2144]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.12.09 14:55:12 LOG7[6820:2144]: Service imaps finished (0 left) 2011.12.09 14:55:12 LOG7[6820:2144]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) Wireshark Packet Trace (see attached image). What's wrong here? Shouldn't client and server negotiate the methods used? The client seems to offer TLS ("Version: TLS 1.0 ..."), but instead of negotiating, the server simply closes the connection. Greetings Markus Borst

1 0

NFS over sTunnel
by Elodie BOSSIER 08 Dec '11

08 Dec '11

Greetings again, I have a problem to mount a NFS share via my sTunnel. If i don't use the stunnel it's work : #mount -t nfs 188.165.214.229:/home /mnt/nfs/ #df -h [...] 188.165.214.229:/home 7.2T 12G 6.9T 1% /mnt/nfs #umount /mnt/nfs but if i use the stunnel client it's don't work : #mount -t nfs 127.0.0.1:/home /mnt/nfs/ (.......sleep....... and i need to ctrl+C to stop my command) The log into the serveur is : 2011.12.08 00:55:54 LOG7[12438:140256813074176]: nfs accepted FD=18 from 178.33.214.192:8671 2011.12.08 00:55:54 LOG7[12438:140256812631808]: nfs started 2011.12.08 00:55:54 LOG7[12438:140256812631808]: FD 18 in non-blocking mode 2011.12.08 00:55:54 LOG7[12438:140256812631808]: TCP_NODELAY option set on local socket 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Waiting for a libwrap process 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Acquired libwrap process #0 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Releasing libwrap process #0 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Released libwrap process #0 2011.12.08 00:55:54 LOG7[12438:140256812631808]: nfs permitted by libwrap from 178.33.214.192:8671 2011.12.08 00:55:54 LOG5[12438:140256812631808]: nfs accepted connection from 178.33.214.192:8671 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): before/accept initialization 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 read client hello A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 write server hello A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 write change cipher spec A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 write finished A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 flush data 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 read finished A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 1 items in the session cache 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 client connects (SSL_connect()) 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 client connects that finished 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 client renegotiations requested 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 12 server connects (SSL_accept()) 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 12 server connects that finished 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 server renegotiations requested 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 9 session cache hits 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 external session cache hits 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 session cache misses 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 1 session cache timeouts 2011.12.08 00:55:54 LOG6[12438:140256812631808]: SSL accepted: previous session reused 2011.12.08 00:55:54 LOG7[12438:140256812631808]: FD 19 in non-blocking mode 2011.12.08 00:55:54 LOG6[12438:140256812631808]: connect_blocking: connecting 127.0.0.1:2049 2011.12.08 00:55:54 LOG7[12438:140256812631808]: connect_blocking: s_poll_wait 127.0.0.1:2049: waiting 10 seconds 2011.12.08 00:55:54 LOG5[12438:140256812631808]: connect_blocking: connected 127.0.0.1:2049 2011.12.08 00:55:54 LOG5[12438:140256812631808]: nfs connected remote server from 127.0.0.1:51193 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Remote FD=19 initialized 2011.12.08 00:55:54 LOG7[12438:140256812631808]: TCP_NODELAY option set on remote socket ( my ctrl+C is here ) 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL alert (read): warning: close notify 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL closed on SSL_read 2011.12.08 00:56:58 LOG7[12438:140256812631808]: Socket write shutdown 2011.12.08 00:56:58 LOG7[12438:140256812631808]: Socket closed on read 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL write shutdown 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL alert (write): warning: close notify 2011.12.08 00:56:58 LOG6[12438:140256812631808]: SSL_shutdown successfully sent close_notify 2011.12.08 00:56:58 LOG5[12438:140256812631808]: Connection closed: 76 bytes sent to SSL, 164 bytes sent to socket 2011.12.08 00:56:58 LOG7[12438:140256812631808]: nfs finished (0 left) (End of the log server) My config client : [rquotad] accept = 1040 connect = 188.165.214.229:1041 [mountd] accept = 1048 connect = 188.165.214.229:1049 [nfs] accept = 2049 connect = 188.165.214.229:2050 [status] accept = 1039 connect = 188.165.214.229:1038 [portmapper] accept = 111 connect = 188.165.214.229:112 [nlockmgr] accept = 1047 connect = 188.165.214.229:1046 My config server : [rquotad] accept = 1041 connect = 1040 [mountd] accept = 1049 connect = 1048 [nfs] accept = 2050 connect = 2049 [status] accept = 1038 connect = 1039 [portmapper] accept = 112 connect = 111 [nlockmgr] accept = 1046 connect = 1047 Do you have an idea please ?

1 1

stunnel in client and server mode in same time
by Elodie BOSSIER 07 Dec '11

07 Dec '11

Greetings, I would like use stunnel in client & server mode but i don't find the way to do it, it's don't work My stunnel is a client of a remote MySQL server and a server of a NFS in local Do you have an idea please ?

4 3

FIPS_mode_set error
by Stefano Lodi 02 Dec '11

02 Dec '11

The problem referred to by Koenraad affects Windows 7 32 bit as well. Anyway fips=no fixes it.

2 1

FIPS on Win7
by james.poole＠rsa.com 01 Dec '11

01 Dec '11

It looks like there is a known issue with FIPS running on Windows 7 from the mail archives. Is there something I could do to help get this fixed? I was planning on using stunnel to allow a FIPS compliant transmission of data over the wire. Win7 - 32bit Output - From the console window: stunnel 4.49 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8r-fips 8 Feb 2011 Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match Old Thread: http://www.stunnel.org/pipermail/stunnel-users/2011-November/003374.html Thanks for any help, James

2 1

Key and Certificate file issue!
by Hamid.Shahid＠sungard.com 30 Nov '11

30 Nov '11

Hi, I am trying to establish a SSL connection with a remote server on a random port 10170. I have got a public key from the server side. And I have sent my public key to the server. And I am trying to use my certificate file and the public key of the server like this. cert = sunPrimary.pem key = sunStunnel.pem But the problem is both the public key from server and my own certificate file starts with "-----BEGIN CERTIFICATE-----" by default. So now, if I don't change the "-----BEGIN CERTIFICATE-----" header of the my certificate to "-----BEGIN PRIVATE KEY-----" I get errors and if I change it to private key and make the public key of the server as certificate then I still get errors. Please let me know, how can I use the key and certificate together. Thanks. Kind Regards, Hamid Shahid

2 3

Pop3, CAPA before STLS (allow stunnel to work with android devices using proto pop3 option).
by Anthony Morgan 30 Nov '11

30 Nov '11

Hi, I'm running a pop3 server on a non-standard port and having stunnel listen on both 110 and 995 like so: [pop3_ssl] accept = 995 connect = ... [pop3_tls] accept = 110 connect = ... protocol = pop3 When connecting from an android device (2.3 on Nexus S at least), it confirms the server supports STLS using CAPA (and seemingly will not configure otherwise), so I modified protocol.c to announce support: < fdputline(c, c->local_wfd.fd, "+OK Stunnel capability list follows"); < fdputline(c, c->local_wfd.fd, "STLS"); < fdputline(c, c->local_wfd.fd, "."); --- > fdputline(c, c->local_wfd.fd, "-ERR Stunnel does not support capabilities"); It seems to me that there is no harm in this, because the RFC states that the client MUST recheck the servers capabilities with another CAPA command after starting TLS. It may be better to check the servers actual capabilities, add STLS to them and return that, but this does work. Any thoughts or comments? Tony Morgan --- Sent from Post.fm

1 0

FIPS_mode_set error
by Koenraad Lelong 29 Nov '11

29 Nov '11

Hi, I have an application which uses stunnel. Using stunnel 4.25 everything works fine. If I replace this with stunnel 4.49, I get an error, see the log : No limit detected for the number of clients make_sockets: s_socket#1: FD=228 allocated (blocking mode) make_sockets: s_socket#2: FD=232 allocated (blocking mode) make_sockets: s_accept: FD=236 allocated (non-blocking mode) stunnel 4.49 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8r-fips 8 Feb 2011 Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match Server is down My stunnel.conf : cert = my.keycrt socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = certs CAfile = cacert.pem debug = 7 ; output = c:\Program Files\stunnel\stunnel.log client = yes [Server] accept = 6051 connect = server.example.com:8051 What am I doing wrong ? I'm trying this on Win7-64bit. On WinXP-32bit it works fine. Thanks for any clarification, Regards, Koenraad Lelong.

2 2

stunnel 4.49 released
by Michal Trojnara 28 Nov '11

28 Nov '11

Dear Users, I have released version 4.49 of stunnel. The ChangeLog entry: Version 4.49, 2011.11.28, urgency: MEDIUM: * Bugfixes - Missing Microsoft Visual C++ Redistributable (msvcr100.dll) required by FIPS-compliant OpenSSL library was added to the Windows installer. - A bug was fixed causing crashes on MacOS X and some other platforms. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.49.tar.gz: dcb0e1f21e9fcf56f4d67bc7a5a4ef8720845b61063a749953417db2616cb20d Best regards, Mike

1 0

Stunnel compilation issue on Mac OS X 10.5 powerpc
by Cedric Lor 28 Nov '11

28 Nov '11

Hi, I've been trying to compile stunner (4.47) on a power pc Mac OS X Leopard (OS X 10.5) platform after a manual update to openssl v.1.0.0.e ggc is version 4.0.1. I run into an error according to which there would be undefined symbols in stunnel-ctx.o (see make output below). I can't figure out to which feature stunner-ctx.o is related, whether I need this feature and how to disable it in ./configure if I don't need it. Please note that I managed to install stunner 4.46 via fink on the same machine (such fink install of stunnel required installing a specific instance of openssl (v.1.0.0.0.e) within fink). Would anyone be able to identify from the make output below whether the issue comes from stunnel or from my openssl manual install? Many thanks. Cedric Making all in src make all-am /bin/sh ../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c -o env.lo env.c libtool: compile: gcc -DHAVE_CONFIG_H -I. -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -fno-common -DPIC -o .libs/env.o mv -f .deps/env.Tpo .deps/env.Plo /bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wextra -Wno-long-long -pedantic -avoid-version -o libstunnel.la -rpath /usr/local/lib/stunnel env.lo -lz -ldl -lutil -lpthread -lwrap libtool: link: gcc -dynamiclib -Wl,-undefined -Wl,dynamic_lookup -o .libs/libstunnel.dylib .libs/env.o -lz -ldl -lutil -lpthread -lwrap -install_name /usr/local/lib/stunnel/libstunnel.dylib -Wl,-single_module libtool: link: dsymutil .libs/libstunnel.dylib || : libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c mv -f .deps/stunnel-str.Tpo .deps/stunnel-str.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-file.o -MD -MP -MF .deps/stunnel-file.Tpo -c -o stunnel-file.o `test -f 'file.c' || echo './'`file.c mv -f .deps/stunnel-file.Tpo .deps/stunnel-file.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-client.o -MD -MP -MF .deps/stunnel-client.Tpo -c -o stunnel-client.o `test -f 'client.c' || echo './'`client.c mv -f .deps/stunnel-client.Tpo .deps/stunnel-client.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-log.o -MD -MP -MF .deps/stunnel-log.Tpo -c -o stunnel-log.o `test -f 'log.c' || echo './'`log.c mv -f .deps/stunnel-log.Tpo .deps/stunnel-log.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-options.o -MD -MP -MF .deps/stunnel-options.Tpo -c -o stunnel-options.o `test -f 'options.c' || echo './'`options.c mv -f .deps/stunnel-options.Tpo .deps/stunnel-options.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-protocol.o -MD -MP -MF .deps/stunnel-protocol.Tpo -c -o stunnel-protocol.o `test -f 'protocol.c' || echo './'`protocol.c mv -f .deps/stunnel-protocol.Tpo .deps/stunnel-protocol.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-network.o -MD -MP -MF .deps/stunnel-network.Tpo -c -o stunnel-network.o `test -f 'network.c' || echo './'`network.c mv -f .deps/stunnel-network.Tpo .deps/stunnel-network.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-resolver.o -MD -MP -MF .deps/stunnel-resolver.Tpo -c -o stunnel-resolver.o `test -f 'resolver.c' || echo './'`resolver.c mv -f .deps/stunnel-resolver.Tpo .deps/stunnel-resolver.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ssl.o -MD -MP -MF .deps/stunnel-ssl.Tpo -c -o stunnel-ssl.o `test -f 'ssl.c' || echo './'`ssl.c mv -f .deps/stunnel-ssl.Tpo .deps/stunnel-ssl.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ctx.o -MD -MP -MF .deps/stunnel-ctx.Tpo -c -o stunnel-ctx.o `test -f 'ctx.c' || echo './'`ctx.c mv -f .deps/stunnel-ctx.Tpo .deps/stunnel-ctx.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-verify.o -MD -MP -MF .deps/stunnel-verify.Tpo -c -o stunnel-verify.o `test -f 'verify.c' || echo './'`verify.c mv -f .deps/stunnel-verify.Tpo .deps/stunnel-verify.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c mv -f .deps/stunnel-sthreads.Tpo .deps/stunnel-sthreads.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c stunnel.c: In function 'daemonize': stunnel.c:447: warning: 'daemon' is deprecated (declared at /usr/include/stdlib.h:283) stunnel.c: At top level: stunnel.c:70: warning: 'signal_pipe_redirect' declared 'static' but never defined mv -f .deps/stunnel-stunnel.Tpo .deps/stunnel-stunnel.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-pty.o -MD -MP -MF .deps/stunnel-pty.Tpo -c -o stunnel-pty.o `test -f 'pty.c' || echo './'`pty.c mv -f .deps/stunnel-pty.Tpo .deps/stunnel-pty.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-libwrap.o -MD -MP -MF .deps/stunnel-libwrap.Tpo -c -o stunnel-libwrap.o `test -f 'libwrap.c' || echo './'`libwrap.c mv -f .deps/stunnel-libwrap.Tpo .deps/stunnel-libwrap.Po /bin/sh ../libtool --tag=CC --mode=link gcc -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -lz -ldl -lutil -lpthread -lwrap libtool: link: gcc -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -lz -ldl -lutil -lpthread -lwrap -pthread Undefined symbols: "_EC_KEY_new_by_curve_name", referenced from: _context_init in stunnel-ctx.o "_SSL_get_servername", referenced from: _servername_cb in stunnel-ctx.o "_SSL_CTX_sess_set_get_cb", referenced from: _context_init in stunnel-ctx.o "_SSL_CTX_set_info_callback", referenced from: _context_init in stunnel-ctx.o "_BIO_set_flags", referenced from: _base64 in stunnel-protocol.o "_SSL_set_SSL_CTX", referenced from: _servername_cb in stunnel-ctx.o "_SSL_CTX_sess_set_new_cb", referenced from: _context_init in stunnel-ctx.o "_SSL_CTX_sess_set_remove_cb", referenced from: _context_init in stunnel-ctx.o "_EC_KEY_free", referenced from: _context_init in stunnel-ctx.o ld: symbol(s) not found collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[1]: *** [all] Error 2 make: *** [all-recursive] Error 1

2 3

Server is down
by Hamid.Shahid＠sungard.com 28 Nov '11

28 Nov '11

Hi, I am trying to connect to a remote SSL enabled server via stunnel. I am using a single file for key and certificate "sunStunnel.pem", just like the default "stunnel.pem" and I am getting following errors. Please let me know, what they mean and what should be done to resolve these? Note: I was able to telnet the machine, so server seems to be working. Thanks. ======= Config ======= debug = 7 output = stunnel.log cert = sunStunnel.pem [GPC-HOST] client = yes [syslog] accept = 127.0.0.1:2525 connect = <ip>:<port> ======= Log ======= No limit detected for the number of clients make_sockets: s_socket#1: FD=652 allocated (blocking mode) make_sockets: s_socket#2: FD=648 allocated (blocking mode) make_sockets: s_accept: FD=604 allocated (non-blocking mode) stunnel 4.47 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf Snagged 64 random bytes from C:/.rnd Wrote 1024 new random bytes to C:/.rnd PRNG seeded successfully Initializing SSL context for service GPC-HOST Certificate: sunStunnel.pem Certificate loaded Key file: sunStunnel.pem error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib error queue: D08303A: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error error queue: D06C03A: error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error SSL_CTX_use_PrivateKey_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag Server is down Kind Regards, Hamid Shahid

2 1

error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
by Hamid.Shahid＠sungard.com 28 Nov '11

28 Nov '11

Hi, I am trying to connect to a remote SSL enabled server via stunnel. I am using a single file for key and certificate "sunStunnel.pem", just like the default "stunnel.pem" and I am getting following errors. Please let me know, what they mean and what should be done to resolve these? Note: I was able to telnet the machine, so server seems to be working. Thanks. ======= Config ======= debug = 7 output = stunnel.log cert = sunStunnel.pem [GPC-HOST] client = yes [syslog] accept = 127.0.0.1:2525 connect = <ip>:<port> ======= Log ======= No limit detected for the number of clients make_sockets: s_socket#1: FD=652 allocated (blocking mode) make_sockets: s_socket#2: FD=648 allocated (blocking mode) make_sockets: s_accept: FD=604 allocated (non-blocking mode) stunnel 4.47 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf Snagged 64 random bytes from C:/.rnd Wrote 1024 new random bytes to C:/.rnd PRNG seeded successfully Initializing SSL context for service GPC-HOST Certificate: sunStunnel.pem Certificate loaded Key file: sunStunnel.pem error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib error queue: D08303A: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error error queue: D06C03A: error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error SSL_CTX_use_PrivateKey_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag Server is down Kind Regards, Hamid Shahid [cid:image001.gif@01CC6F01.EF535C90]<http://www.sungard.com/ten> Hamid Shahid * Integration Developer * Front Arena * Capital Markets * SunGard * Kungsbron 2, PO Box 70351, SE-107 24 Stockholm, Sweden * Tel +46 (0) 8 454 0167 * Direct +46 (0) 8 454 0167 * Mobile +46 (0) 76 869 2167 * hamid.shahid(a)sungard.com<mailto:ronny.andersson@sungard.com> * www.sungard.com<http://www.sungard.com/> Join SunGard's customers, partners and industry experts at www.sungard.com/ten<http://www.sungard.com/ten> to discuss how the need for more Transparency, Efficiency and Networks is changing our industry and to register for a city day event near you. VIENNA HOUSTON FRANKFURT BEIJING HONG KONG NEW YORK LONDON SEOUL ZURICH MUMBAI JOHANNESBURG DUBAI SAO PAULO CONFIDENTIALITY: This e-mail (including any attachments) may contain confidential, proprietary and privileged information, and unauthorized disclosure or use is prohibited. If you receive this e-mail in error, please notify the sender and delete this e-mail from your system.Thank you. P Please consider the environment before printing this e-mail.

1 0

stunnel 4.48 released
by Michal Trojnara 26 Nov '11

26 Nov '11

Dear Users, I have released version 4.48 of stunnel. The ChangeLog entry: Version 4.48, 2011.11.26, urgency: MEDIUM: * New features - FIPS support on Win32 platform added. OpenSSL 0.9.8r DLLs based on FIPS 1.2.3 canister are included with this version of stunnel. FIPS mode can be disabled with "fips = no" configuration file option. * Bugfixes - Fixed canary initialization problem on Win32 platform. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.48.tar.gz: 9fa723595726806cbf6547a2c453e695e33bf635f2d4771e80d110a06f27ea37 Best regards, Mike

1 0

stunnel & HAProxy : patch still required ?
by Thomas Manson 24 Nov '11

24 Nov '11

Hi, I'm willing to use this kind of configuration : https client -->stunnel --> haproxy --> 2 web servers in http (or more) I've understand that haproxy can't handle the ssl part, that's why stunnel is needed. I've read that a Patch is required for stunnel to work with haproxy in this kind of confirmation "I run stunnel 4.32 with patch from http://haproxy.1wt.eu/download/patches/ on port 443 and forward it to port 81 on the same machine which is bound to haproxy." Can anyone tell me if this patch is now included in stunnel, in particular, does Ubuntu 11.10 include it ? I really would rather stay with package provided by ubuntu in order to have easy upgrade/security fix. I've experiences the work overload of manually compiling everything in Apache for instance ;) Any advices on this kind of setup ? documentation pointers? best practices ? Regards, Thomas. here is the current package version on ubuntu 11.10 thomas@daisybox:~/Documents$ aptitude show stunnel4 Package: stunnel4 New: yes State: not installed Version: 3:4.35-2build1 Priority: optional Section: universe/net Maintainer: Ubuntu Developers <ubuntu-devel-discuss(a)lists.ubuntu.com> Uncompressed Size: 541 k Depends: libc6 (>= 2.11), libssl1.0.0 (>= 1.0.0), libwrap0 (>= 7.6-4~), openssl, netbase, perl-modules PreDepends: adduser Suggests: logcheck-database Conflicts: stunnel4 Breaks: stunnel (< 3:4.20-3), stunnel (< 3:4.20-3) Replaces: stunnel, stunnel Provides: stunnel Description: Universal SSL tunnel for network daemons The stunnel program is designed to work as SSL encryption wrapper between remote client and local (inetd-startable) or remote server. The concept is that having non-SSL aware daemons running on your system you can easily setup them to communicate with clients over secure SSL channel. stunnel can be used to add SSL functionality to commonly used inetd daemons like POP-2, POP-3 and IMAP servers without any changes in the programs' code. This package contains a wrapper script for compatibility with stunnel 3.x Homepage: http://www.stunnel.org/ thomas@daisybox:~/Documents$ aptitude show stunnel No current or candidate version found for stunnel Package: stunnel State: not a real package Provided by: stunnel4

2 1

Patch: Include source IP in connection failure log lines
by Alex Gottschalk 23 Nov '11

23 Nov '11

I'm setting up an internet-facing server that will be running a service wrapped with stunnel. Given that, it made sense to me to use fail2ban to block repeat connection attempts from clients who don't have the right certificate (the system is using client-certificate authentication). Unfortunately, stunnel4 doesn't put the client source IP in connection failure log lines, so I made this quick patch to enable that. ---cut here---- --- src/client.c.orig 2011-10-05 16:47:48.000000000 -0700 +++ src/client.c 2011-10-05 16:50:37.000000000 -0700 @@ -358,10 +358,13 @@ continue; } } - if(c->opt->option.client) + if(c->opt->option.client) { sslerror("SSL_connect"); - else - sslerror("SSL_accept"); + } else { + char buf[255]; + sprintf(buf, "SSL_accept from %s ", c->accepted_address); + sslerror(buf); + } longjmp(c->err, 1); } if(SSL_session_reused(c->ssl)) { ----cut here----

1 0

Getting Stunnel to work
by Brian Miller 21 Nov '11

21 Nov '11

Hello, I recently moved my Homeseer software from web server 08 to server 08. I had stunnel working on there properly to send out e mails using a hotmail account. I downloaded the new verison of Stunnel and tried to use the same config but Stunnel was crashing. Both versions web server 08 and server 08 are 64bit. Below is the original stunnel config file that I used on web server 08, this is cashing stunnel to crash when I run it. Using the default settings works, but I need to edit the config. I'm not to smart in the whole stunnel / Homeseer side of things. I was told by the Homeseer community that I need this to use my hotmail e mail to send e mails. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 110 connect = pop3.live.com:995 [imaps] accept = 993 connect = 143 [ssmtp] accept = 25 connect = smtp.live.com:587 protocol = smtp ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

1 0

stunnel 4.47 released
by Michal Trojnara 20 Nov '11

20 Nov '11

Dear Users, I have released version 4.47 of stunnel. This version includes a number of important bugfixes. The ChangeLog entry: Version 4.47, 2011.11.21, urgency: MEDIUM: * Internal improvements - CVE-2010-3864 workaround improved to check runtime version of OpenSSL rather than compiled version, and to allow OpenSSL 0.x.x >= 0.9.8p. - Encoding of man page sources changed to UTF-8. * Bugfixes - Handling of socket/SSL close in transfer() function was fixed. - Logging was modified to save and restore system error codes. - Option "service" was restricted to Unix, as since stunnel 4.42 it wasn't doing anything useful on Windows platform. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.47.tar.gz: 0b70f8bad8b6963e6154606571a83a3f0e0dea88d7dbd7e3b83cde5a07dd95ae Best regards, Mike

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users