- stunnel-users - stunnel.org

Re: [stunnel-users] openssl cross compiling for windows
by Jon Daley 27 Oct '10

27 Oct '10

On Wed, 27 Oct 2010, Michal Trojnara wrote: > 1. Install mingw32 tools: > apt-get install mingw32 Yes, I did that. > 2. Cross-compile and install zlib > (see the zlib documentation for details) Yes, I was doing that, but then was leaving it out since I don't need it (AFAIK). > 3. Cross-compile OpenSSL: > ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared > zlib-dynamic > make And you end up with 3 dlls in the openssl directory? > 4. Cross-compile stunnel: > cd src > make stunnel.exe I can compile stunnel.exe fine, I just can't run it, because I don't have all three of the dlls. -- Jon Daley http://jon.limedaley.com ~~ If you do a job too well, you will get stuck with it. -- Slous

2 1

openssl cross compiling for windows
by Jon Daley 27 Oct '10

27 Oct '10

I am trying to compile openssl and stunnel for Win32, using my Debian host. openssl compilation: ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared no-zlib && make The only problem I'm having is that libssl32.dll is not being created. I have the other libssl* files: libssl.a libssl.dll.a libssl.pc So, then I download the precompiled dlls of openssl from here: http://www.slproweb.com/products/Win32OpenSSL.html But, they require an additional vc redistributable, and since it seems like I'm so close, it'd be nice to finish it off the rest of the way. stunnel compiles fine pointing it at the openssl directory, but on run-time, it complains that libssl32.dll can't be found. Thanks. -- Jon Daley http://jon.limedaley.com ~~ There are no traffic jams when you go the extra mile. -- Anonymous

2 1

Stunnel dropping data on binary uploads from most browsers.
by Bill Crowell 16 Oct '10

16 Oct '10

All, I'm hoping that someone can assist with this. I'm using Stunnel on 2 different systems: Mac and FC 13 to front-end my web server for a custom database system. It works flawlessly except for uploading large binary files. The problem comes when trying to upload say a 2.5MB image file. The number of bytes actually transferred to the exec program is usually under 1K or right at about 33K. Using Firefox on Windows works all the time. I can observe the transfer by watching the stunnel.log file. When the data is piped into the openSSL engine, the number of bytes written to socket is being picked up by the exec program and processed so the loss is between the browser and the output side of Stunnel. The message itself is a multi-part message that is not mime-encoded. The part with the image is set in the boundary properly and contains the JPEG binary. (Thanks to HTTPwatch!) My Stunnel Version is: [root@linux log]# stunnel -version stunnel 4.33 on i386-redhat-linux-gnu with OpenSSL 1.0.0a-fips 1 Jun 2010 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none My configuration file on the Linux box is: cert = /etc/stunnel/server.crt key = /etc/stunnel/server.key debug = 7 output = /var/log/stunnel.log ;socket = l:SO_LINGER=1:60 ;socket = r:TCP_NODELAY=1 client = no sslVersion = SSLv3 [https] libwrap = no accept = 443 exec = /usr/qmsys/bin/qm execargs = /usr/qmsys/bin/qm -b7 -quiet -aPAVUK "P.HTTP" options = DONT_INSERT_EMPTY_FRAGMENTS TIMEOUTidle = 30 TIMEOUTbusy = 5 TIMEOUTclose = 0 *** A RANDOM SUCCESSFUL TRANSFER *** 2010.10.15 10:03:12 LOG7[946:3078133552]: Service https accepted FD=0 from 24.171.161.99:1998 2010.10.15 10:03:12 LOG7[946:3078241136]: Service https started 2010.10.15 10:03:12 LOG7[946:3078241136]: FD=0 in non-blocking mode 2010.10.15 10:03:12 LOG5[946:3078241136]: Service https accepted connection from 24.171.161.99:1998 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): before accept initialization 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 read client hello A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 write server hello A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 write change cipher spec A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 write finished A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 flush data 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 read finished A 2010.10.15 10:03:12 LOG7[946:3078241136]: 8 items in the session cache 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 client connects (SSL_connect()) 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 client connects that finished 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 client renegotiations requested 2010.10.15 10:03:12 LOG7[946:3078241136]: 35 server connects (SSL_accept()) 2010.10.15 10:03:12 LOG7[946:3078241136]: 35 server connects that finished 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 server renegotiations requested 2010.10.15 10:03:12 LOG7[946:3078241136]: 27 session cache hits 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 external session cache hits 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 session cache misses 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 session cache timeouts 2010.10.15 10:03:12 LOG6[946:3078241136]: SSL accepted: previous session reused 2010.10.15 10:03:12 LOG6[946:3078241136]: Local mode child started (PID=1179) 2010.10.15 10:03:12 LOG7[946:3078241136]: Remote FD=13 initialized 2010.10.15 10:03:13 LOG7[946:3078241136]: Socket closed on read 2010.10.15 10:03:13 LOG7[946:3078241136]: SSL write shutdown 2010.10.15 10:03:13 LOG7[946:3078241136]: SSL alert (write): warning: close notify 2010.10.15 10:03:13 LOG6[946:3078241136]: SSL_shutdown successfully sent close_notify 2010.10.15 10:03:13 LOG6[946:3078241136]: s_poll_wait timeout: connection close 2010.10.15 10:03:13 LOG5[946:3078241136]: Connection closed: 2895 bytes sent to SSL, 2469539 bytes sent to socket 2010.10.15 10:03:13 LOG7[946:3078241136]: Service https finished (0 left) 2010.10.15 10:03:13 LOG7[946:3078133552]: Cleaning up the signal pipe 2010.10.15 10:03:13 LOG6[946:3078133552]: Child process 1179 finished with code 0 2010.10.15 10:03:13 LOG7[946:3078133552]: Signal pipe is empty *** MOST OF THE TIME - AN UNSUCCESSFUL TRANSFER *** 2010.10.15 10:05:01 LOG7[946:3078133552]: Service https accepted FD=0 from 24.171.161.99:1985 2010.10.15 10:05:01 LOG7[946:3077921648]: Service https started 2010.10.15 10:05:01 LOG7[946:3077921648]: FD=0 in non-blocking mode 2010.10.15 10:05:01 LOG5[946:3077921648]: Service https accepted connection from 24.171.161.99:1985 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): before/ accept initialization 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 read client hello A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 write server hello A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 write change cipher spec A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 write finished A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 flush data 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 read finished A 2010.10.15 10:05:01 LOG7[946:3077921648]: 9 items in the session cache 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 client connects (SSL_connect()) 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 client connects that finished 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 client renegotiations requested 2010.10.15 10:05:01 LOG7[946:3077921648]: 44 server connects (SSL_accept()) 2010.10.15 10:05:01 LOG7[946:3077921648]: 44 server connects that finished 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 server renegotiations requested 2010.10.15 10:05:01 LOG7[946:3077921648]: 35 session cache hits 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 external session cache hits 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 session cache misses 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 session cache timeouts 2010.10.15 10:05:01 LOG6[946:3077921648]: SSL accepted: previous session reused 2010.10.15 10:05:01 LOG6[946:3077921648]: Local mode child started (PID=1213) 2010.10.15 10:05:01 LOG7[946:3077921648]: Remote FD=13 initialized 2010.10.15 10:05:04 LOG7[946:3077921648]: Socket closed on read 2010.10.15 10:05:04 LOG7[946:3077921648]: SSL write shutdown 2010.10.15 10:05:04 LOG7[946:3077921648]: SSL alert (write): warning: close notify 2010.10.15 10:05:04 LOG6[946:3077921648]: SSL_shutdown successfully sent close_notify 2010.10.15 10:05:04 LOG6[946:3077921648]: s_poll_wait timeout: connection close 2010.10.15 10:05:04 LOG5[946:3077921648]: Connection closed: 2895 bytes sent to SSL, 66703 bytes sent to socket 2010.10.15 10:05:04 LOG7[946:3077921648]: Service https finished (0 left) 2010.10.15 10:05:04 LOG7[946:3078133552]: Cleaning up the signal pipe 2010.10.15 10:05:04 LOG6[946:3078133552]: Child process 1213 finished with code 0 2010.10.15 10:05:04 LOG7[946:3078133552]: Signal pipe is empty *** All test cases are the same upload of the same image file. In all tests the number of bytes sent to socket matches what the exec program is receiving in its pipe. My feeling is that there is a connection issue between the browser and Stunnel. The successful upload of the test occurs sometimes with all browsers and appears to always work with Firefox for Windows. It has a 90% failure rate on Safari for Windows, Safari for Mac, Opera for Windows, Opera for Mac, etc. In all cases of testing, the number of bytes "sent to socket" is received by my exec program and consists of a truncated message from the browser. It appears that the data is simply being truncated somewhere in the Stunnel process. Any help is always appreciated! If there are more tests to be run to track down the problem, please advise and I will run them. Regards, Bill Bill Crowell, President Pavuk Technologies, LLC PO Box 33097 Charlotte, NC 28233-3097 Office +1 704.248.0024 Mobile +1 704.607.6077 Skype pavuk.com

2 1

Recompiling Stunnel at version 4.34 appears to fix dropped data problem
by Bill Crowell 15 Oct '10

15 Oct '10

I reported a consistent data loss from most browsers when transferring large files. Compiling version 4.34 on Mac OS X 10.6.4 with the latest Xcode toolkit has resolved the connection problem for all browsers that I have tested except for Safari 5.0 on both Windows and Mac. It has also fixed a connection problem with IE 6 which was not accepting any connection to Stunnel prior to this installation. *** This problem still persists on my linux box running 4.33 installed from FC13. I will attempt a compile of 4.34 and see if this fixes the problem there as well. Fedora does not yet have a package for 4.34. Bill Bill Crowell, President Pavuk Technologies, LLC PO Box 33097 Charlotte, NC 28233-3097 Office +1 704.248.0024 Mobile +1 704.607.6077 Skype pavuk.com

1 0

Re: [stunnel-users] stunnel daemon mode
by Joe Williams 08 Oct '10

08 Oct '10

> In inetd mode, you get a new Stunnel process for every connection. > Initialization must occur in *each* new process - they don't share > any state, including any session ids. > > In daemon mode, there's one stunnel process (threaded) which can > share state between threads, so it is much better. Ah I see, so running a single process (w/ pthreads) under runit I get the same effect as daemon mode. Correct? -Joe Name: Joseph A. Williams Email: joe(a)joetify.com Blog: http://www.joeandmotorboat.com/ Twitter: http://twitter.com/williamsjoe

1 0

stunnel daemon mode
by Joe Williams 07 Oct '10

07 Oct '10

According to http://www.sans.org/reading_room/whitepapers/vpns/stunnel-ssling-internet-s… In addition, Stunnel performance is improved by running it in daemon mode instead of inetd. Running Stunnel in daemon mode provides the following benefits: no SSL initialization necessary with every connection, and SSL session caching. Is this still the case? Running in the foreground you don't get these? Thanks. -Joe Name: Joseph A. Williams Email: joe(a)joetify.com Blog: http://www.joeandmotorboat.com/ Twitter: http://twitter.com/williamsjoe

1 0

fingerprint does not match
by Nelson 02 Oct '10

02 Oct '10

I have a running machine with stunnel installed for HTTPS services. Now, I want to setup another machine using the same configuration and key from my 1ST machine. I have installed stunnel patch with x-forwarded-for. However, everytime I try to start it up, it shows: Starting universal SSL tunnel: stunnelReading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match failed. I'm using the same key and cert that my 1ST machine is using. Would there be a problem? I've no problem starting stunnel yesterday. I just encountered this error when I change my ip address. I make sure that my config also listen to this ip address. Would anyone know how to fix this problem? Tried to Google but to no avail.

3 2

pop3 stunnel nmh to gmail
by Joseph Brenner 27 Sep '10

27 Sep '10

I'm an nmh user running ubuntu jaunty, and I want to get my local email working over SSL connections to a gmail account (POP3/SMTP). So I'm trying to get some form of mh to talk over SSL using stunnel4. I'm looking for suggestions on what I might be doing wrong, and hints on how to go about isolating the problems. I've succeeded in using slypheed to get mail from gmail, so I know the gmail account is working and is set-up for pop3 and so on. When I run mh's inc command, though, it just reports: "inc: no servers available" I can see that I've got stunnel running by doing a: ps ax | egrep stun | egrep -v egrep 5937 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5938 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5939 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5940 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5941 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5942 ? SNs 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf Google has some instructions up about servers and port numbers (but no examples specific to stunnel): http://mail.google.com/support/bin/answer.py?hl=en&answer=13287 Here's a summary of the kind of configurations I've been trying: /etc/default/stunnel4: ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" PPP_RESTART=0 /etc/stunnel/stunnel.conf: sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [pop3s] accept = 127.0.0.1:995 connect = pop.gmail.com:110 [smtps] accept = 127.0.0.1:465 connect = smtp.gmail.com:25 /etc/nmh/mts.conf: mts: smtp hostable: /etc/nmh/hosts localname: smtp.gmail.com # localname: gmail.com masquerade: mmdfldir: /var/mail mmdflfil: # pophost: localhost # pophost: pop.gmail.com:995 pophost: pop.gmail.com:110 # pophost: pop.gmail.com # servers: localhost servers: smtp.gmail.com /var/log/stunnel4/stunnel.log 2010.09.21 11:11:41 LOG7[6528:140533218399984]: Snagged 64 random bytes from /dev/urandom 2010.09.21 11:11:41 LOG7[6528:140533218399984]: RAND_status claims sufficient entropy for the PRNG 2010.09.21 11:11:41 LOG7[6528:140533218399984]: PRNG seeded successfully 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SSL context initialized for service pop3s 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SSL context initialized for service imaps 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SSL context initialized for service smtps 2010.09.21 11:11:41 LOG5[6528:140533218399984]: stunnel 4.22 on x86_64-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2010.09.21 11:11:41 LOG5[6528:140533218399984]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2010.09.21 11:11:41 LOG6[6528:140533218399984]: file ulimit = 1024 (can be changed with 'ulimit -n') 2010.09.21 11:11:41 LOG6[6528:140533218399984]: poll() used - no FD_SETSIZE limit for file descriptors 2010.09.21 11:11:41 LOG5[6528:140533218399984]: 500 clients allowed 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 10 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 11 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 12 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SO_REUSEADDR option set on accept socket 2010.09.21 11:11:41 LOG7[6528:140533218399984]: pop3s bound to 127.0.0.1:1109 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 13 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SO_REUSEADDR option set on accept socket 2010.09.21 11:11:41 LOG7[6528:140533218399984]: imaps bound to 0.0.0.0:993 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 14 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SO_REUSEADDR option set on accept socket 2010.09.21 11:11:41 LOG7[6528:140533218399984]: smtps bound to 127.0.0.1:259 2010.09.21 11:11:41 LOG7[6534:140533218399984]: Created pid file /stunnel4.pid /var/log/mail.log Sep 21 13:40:32 fineline gnu-pop3d[15484]: Incoming connection opened Sep 21 13:40:32 fineline gnu-pop3d[15484]: connect from 127.0.0.1 Sep 21 13:40:32 fineline gnu-pop3d[15484]: User `doomvox(a)gmail.com': nonexistent Sep 21 13:40:32 fineline gnu-pop3d[15484]: Session ended for no user I'm using the "stunnel4" package for ubuntu jaunty: /usr/bin/stunnel4 -version stunnel 4.22 on x86_64-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none uname -a Linux fineline 2.6.24-16-generic #1 SMP Thu Apr 10 12:47:45 UTC 2008 x86_64 GNU/Linux gcc -v Using built-in specs. Target: x86_64-linux-gnu Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.3.3-5ubuntu4' --with-bugurl=file:///usr/share/doc/gcc-4.3/README.Bugs --enable-languages=c,c++,fortran,objc,obj-c++ --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.3 --program-suffix=-4.3 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --with-tune=generic --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu Thread model: posix gcc version 4.3.3 (Ubuntu 4.3.3-5ubuntu4) openssl version OpenSSL 0.9.8g 19 Oct 2007

2 1

Critical error on stunnel 434 for WinCE/Windows Mobile: no service at all, because of failure in thread creation
by Pierre DELAAGE 26 Sep '10

26 Sep '10

Hello Michal, Maybe you remember me, I am the man that refreshed stunnel for winCE up to 4.27 version. Thank you for having included my code to your mainstream at that time. As a win32 regular programmer I always check that my code is as close as possible as that of the main win32 stream for PC. I am writing you today to point out a critical bug that prevent stunnel 4.34 from servicing any service at all . I have fixed that bug and will send you a refresh of all the sources (that needed some after some win32 PC version updates) soon. SO DO NOT DO ANYTHING. the bug is in sthread.c: the wince _beginthread port has been modified (by someone else but me) as this : v434: handle=CreateThread(NULL, stack_size, (LPTHREAD_START_ROUTINE)start_address, arglist, STACK_SIZE_PARAM_IS_A_RESERVATION, &thread_id); the "STACK_SIZE_PARAM_IS_A_RESERVATION" flag is the novelty from 4.27. The problem is that beginthread is being called from gui.c with stacksize=0 SO THAT a stack of 0 size "TRIES to be RESERVED" and then CreateThread FAILS to return a valid handle. That is to say that no thread is created, and thus NO TUNNELING SERVICE at all can be delivered. So stunnel cannot work at all. Solution : the proper call is : handle=CreateThread(NULL, stack_size, (LPTHREAD_START_ROUTINE)start_address, arglist, (stack_size > 0) ? STACK_SIZE_PARAM_IS_A_RESERVATION:0, &thread_id); I repeat and insist : please DO NOT DO anything to the code, as I will send soon a refresh with various other updates (because apart from that critical bug, the code needs other refresh to compile properly), and as I am also working on a refresh of openssl up to 1.0.0a (those gentlemen at openssl never included any wce patch to their mainstream, which is really a pity, but another story). See you soon, Thank you again for all the work you do for the community of people, Pierre

2 4

stunnel v4.32 & mac v10.6.3
by Cherry Ngai 25 Sep '10

25 Sep '10

Hello, I am new to stunnel. My stunnel v4.32 is installed to my mac v10.6.3 using MacPort. I am trying to setup active directory, but there is no process start when i run sudo /opt/local/bin/stunnel /opt/local/etc/stunnel/stunnel.conf There is no error msg after i run the command. I believe it could have something to do with my configuration? Having it running in debug mode, I can't find the created output file. Could someone help me? Or tell me where i can find the output file? Thanks! Stunnel seems successfully installed, as it has returned the following with the command "sudo stunnel -version" stunnel 4.32 on i686-apple-darwin10.3.0 with OpenSSL 1.0.0a 1 Jun 2010 Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /opt/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /opt/local/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Here is my config: cert = /opt/local/etc/stunnel/stunnel.pem key = /opt/local/etc/stunnel/stunnel.pem sslVersion = SSLv3 chroot = /opt/local/var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log client = yes [ActiveDirectory1] accept = 391 connect = SOME_IP:636 Cheers, Cherry

1 0

Target version/timeframe for drawing identity certs from Windows cert store?
by Bucci, David G 22 Sep '10

22 Sep '10

Hi - in an exchange last week, Michal, it sounded like you might be planning on adding the capability/option to the Windows version to select an identity certificate from the Windows certificate store (because it turns out OpenSSL added some supporting infrastructure for doing so, if I understood correctly). For planning purposes, do you have any sense yet of whether that's really going to happen, and in what timeframe or what target version? I think that'd be a change of high interest to a lot of people ... one suggestion, it would help integrators if there was a way to configure a msg into whatever selection dialog that comes up, asking the user to select a certificate from their identity store. Thinking out loud -- probably also, in the case where multiple client tunnels are being set up, a way to make it either a global selection (for all client services), or a service specific selection -- hmm, though global only is probably fine, thinking about, since an integrator could always create a 2nd config, if a 2nd tunnel is needed Thinking further, you would probably want to be careful that it would work early on during login, since I imagine like us, integrators would want to start it from a user's Startup folder, or from a login script. I don't know Windows well enough to know if that constrains you (if the window mgr is up during login script exec, etc.). Thx! ---- David G. Bucci If you can't think of anything kind to say, could you at least have the decency to be vague?

1 0

Server side logging, no connection details logged
by Bucci, David G 22 Sep '10

22 Sep '10

Hi - using Stunnel to enforce client certificate based authentication, and as part of that, we want to log accesses, and the CN used to access, on the server side (kind of an audit log). On the client side, with debug set to 7, we get details about the connection, the SSL steps in the handshake, etc. - but on the server side, even with debug = 7, we're not seeing any info at all about the connections that are occurring. Sooo ... is there a way to enable such logging on the server side of the tunnel? Or possibly turn on independent logging in the OpenSSL libs that are used? I looked, but haven't found anything online about this. Thx! ---- David G. Bucci If you can't say anything nice, at least have the decency to be vague.

1 2

FIPS compliance
by Bucci, David G 21 Sep '10

21 Sep '10

The documentation on fips= seems ambiguous to me ... does leaving it at the default of "yes" /prevent/ FIPS 140-2 compliance mode, or mandate it? Or does it do something else I'm not understanding? Basically, the q. is, what do you have to configure to ensure that you're operating in a FIPS 140-2 compliant manner (at least, as the version of OpenSSL libs bundled understood it)? Do you have to specify ciphers that are validated, etc.? Or just set that config option to "yes" ("no"?)? And how can one tell if the stunnel binary in use was compiled with FIPS support active? (I'm using the Windows 4.33 binary d/l'ed from mirt.net). Tia! ---- David G. Bucci Chuck Norris can kick through all 6 degrees of separation, hitting anyone, anywhere, in the face, at any time. -- ChuckNorrisFacts.com

2 1

Large performance difference: Solaris vs Linux
by Cliffe, Stephen 20 Sep '10

20 Sep '10

Hi, I've just been comparing the performance of stunnel on Solaris 10 & Linux (Centos 5.5) and am seeing a big difference. I'm using stunnel 4.33 compiled with the same options on both platforms and the tcpstress benchmarking tool (http://stunnel.mirt.net/?page=perf). On a Dell 780 running Solaris 10 I got 163.31 connections/second but on an older, slower Dell 620 running Linux I got 408.01 connections/second. Both machines were otherwise idle. Does anyone know why there would be such a big difference between the two OS's? Thanks, Steve. Steve Cliffe Senior Engineer - Development Infrastructure Team Andrew Network Solutions Asia Pacific [ Address : Andrew Corporation Building (39), Northfields Avenue, Wollongong University, NSW, Australia 2500 ] [ Postal Address : PO Box U40, Wollongong University, NSW, Australia 2500 ] [ Tel : +61 2 4221 2991] [ Fax : +61 2 4221 2901 ] [ Email : Stephen.Cliffe(a)andrew.com] Visit Andrew on the Web at www.andrew.com<http://www.andrew.com/> [cid:image001.gif@01CB5688.22C2E4D0][cid:image002.gif@01CB5688.22C2E4D0]

3 5

Generically referencing file locations in stunnel.conf
by Bucci, David G 20 Sep '10

20 Sep '10

Hi - I'm back to trying to run Stunnel with a different user certificate for each user. So far, the best technique I've found is to have a separate stunnel.conf for each user (in their home directory, which is referenced by envvar %USERPROFILE%), and run stunnel using that configuration file. As part of that, I'm trying to generically reference file locations (log, user certificates) in the .conf. But I haven't found a way short of fully pathing the locations in the .conf e.g. "output=c:\users\dbucci\stunnel\stunnel.log". That's undesirable, because it means I have to make every user's .conf unique. So ... is there a generic way to accomplish this? I've tried setting the "Start In" location in the Windows shortcut to that location (via envvar %USERPROFILE%, which allows me to make every user's shortcut generic), then saying "output=.\stunnel.log", but without success - it seems to always be using c:\program files\stunnel as it's starting point for reference. Likewise, the envvar isn't usable in the .conf Note that I thought about creating a subdir per user in C:\program files\stunnel (with appropriate perms for that user), but can't, because in many of our deployment locations, users aren't permitted to write to c:\program files. Btw, this is why I'm asking about the commandline parms in Windows - I don't seem to be able to get them to work, but if I could, I could say e.g. "-o %USERPROFILE%\stunnel\stunnel.log", and that would work generically for every user. Likewise, I could use "-A %USERPROFILE&\stunnel\usercert.pem" and have a generic way of installing user certs. Heck, if I could set ALL the options via command line (-c, -r, etc.) I would love to simply do away with a user-specific .conf file. So ... sorry for rambling a bit, but any help with the intent of what I'm trying to accomplish, make as generic as possible a user-specific config setup? Thx! ---- David G. Bucci Chuck Norris can kick through all 6 degrees of separation, hitting anyone, anywhere, in the face, at any time. -- ChuckNorrisFacts.com

2 2

Command line args available on Windows version 4.33?
by Bucci, David G 20 Sep '10

20 Sep '10

Hi - are all the command line arguments documented at http://www.stunnel.org/faq/args.html#ToC1 available in the Windows 4.33 version? When you execute stunnel -V, very few are listed. And if they are available, do they take precedence over a configuration file, if one is used? (Is a .conf mandatory, or can you set all the required options via command line in the Windows version?) Thx! ---- David G. Bucci Chuck Norris can kick through all 6 degrees of separation, hitting anyone, anywhere, in the face, at any time. -- ChuckNorrisFacts.com

2 1

Accept connections only from local processes?
by Bucci, David G 20 Sep '10

20 Sep '10

Hi - I'm looking to configure Stunnel in client mode to accept connections only from the PC it's running on. Would the config option "socket = a:SO_BINDTODEVICE=lo" accomplish that? And would this work on Windows? (is there a "lo" interface on Windows?) I'm going to do some testing, but thought I'd ask in case someone already knows I'll be pounding sand. And before anyone asks, turning on a firewall isn't an option - we don't have control of all the PCs involved. ---- David G. Bucci Chuck Norris can kick through all 6 degrees of separation, hitting anyone, anywhere, in the face, at any time. -- ChuckNorrisFacts.com

2 1

(no subject)
by Sunil Karumuri 17 Sep '10

17 Sep '10

Hello- I am new to Stunnel and have a basic architecture question. I have Stunnel installed on box A where it receives http messages from multiple client processes . Stunnel sends them to box B via https (mutual ssl). We are seeing that Stunnel opens one connection for each client processes. Can we configure Stunnel to have only ONE SSL connection (or a pool of connections) between box A and B and have Stunnel use the open connection for all traffic from various clients ? We would like to avoid the overhead of SSL-handshake for each new client process. Thanks for the help. Sunil

3 2

Hey buddy, can you review a log file?
by Jay Sprenkle 08 Sep '10

08 Sep '10

Good afterrnoon, Can anyone review the stunnel log file below and see if there's any indication of a problem? What we're doing with stunnel: We're using stunnel to encrypt a tcp connection between a client and our server. What's happening: A client is reporting the connection fails. I believe it's a timeout issue on the client software. My interpretation of this log is that the session is open about 4 seconds then closed by the client. Is that correct? Thanks in advance Stunnel Log: 2010.09.08 14:34:38 LOG7[1392:2328]: Service exchange started 2010.09.08 14:34:38 LOG7[1392:2328]: FD=200 in non-blocking mode 2010.09.08 14:34:38 LOG5[1392:2328]: Service exchange accepted connection from 127.0.0.1:2340 2010.09.08 14:34:38 LOG7[1392:2328]: FD=224 in non-blocking mode 2010.09.08 14:34:38 LOG6[1392:2328]: connect_blocking: connecting xxx.242.123.150:7443 2010.09.08 14:34:38 LOG7[1392:2328]: connect_blocking: s_poll_wait xxx.242.123.150:7443: waiting 10 seconds 2010.09.08 14:34:38 LOG5[1392:2328]: connect_blocking: connected xxx.242.123.150:7443 2010.09.08 14:34:38 LOG5[1392:2328]: Service exchange connected remote server from 192.168.1.29:2341 2010.09.08 14:34:38 LOG7[1392:2328]: Remote FD=224 initialized 2010.09.08 14:34:38 LOG7[1392:2328]: SSL state (connect): before/connect initialization 2010.09.08 14:34:38 LOG7[1392:2328]: SSL state (connect): SSLv3 write client hello A 2010.09.08 14:34:38 LOG7[1392:2328]: SSL state (connect): SSLv3 read server hello A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 read server certificate A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 read server done A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 write client key exchange A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 write change cipher spec A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 write finished A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 flush data 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 read finished A 2010.09.08 14:34:39 LOG7[1392:2328]: 1 items in the session cache 2010.09.08 14:34:39 LOG7[1392:2328]: 1 client connects (SSL_connect()) 2010.09.08 14:34:39 LOG7[1392:2328]: 1 client connects that finished 2010.09.08 14:34:39 LOG7[1392:2328]: 0 client renegotiations requested 2010.09.08 14:34:39 LOG7[1392:2328]: 0 server connects (SSL_accept()) 2010.09.08 14:34:39 LOG7[1392:2328]: 0 server connects that finished 2010.09.08 14:34:39 LOG7[1392:2328]: 0 server renegotiations requested 2010.09.08 14:34:39 LOG7[1392:2328]: 0 session cache hits 2010.09.08 14:34:39 LOG7[1392:2328]: 0 external session cache hits 2010.09.08 14:34:39 LOG7[1392:2328]: 0 session cache misses 2010.09.08 14:34:39 LOG7[1392:2328]: 0 session cache timeouts 2010.09.08 14:34:39 LOG6[1392:2328]: SSL connected: new session negotiated 2010.09.08 14:34:39 LOG6[1392:2328]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2010.09.08 14:34:44 LOG7[1392:2328]: SSL socket closed on SSL_read 2010.09.08 14:34:44 LOG7[1392:2328]: Socket write shutdown 2010.09.08 14:34:44 LOG5[1392:2328]: Connection closed: 8 bytes sent to SSL, 48 bytes sent to socket 2010.09.08 14:34:44 LOG7[1392:2328]: Service exchange finished (0 left) -- --- "Is real reporting dead? News at 11!"

1 0

Re: [stunnel-users] Individual user certs for each person who uses Windows PC
by Bucci, David G 07 Sep '10

07 Sep '10

Thx for replying, Scott ... how did you handle multiple users on the PC, though? They all shared that cert? I thought about having a single location and copying to there on user login (from a standard location in a user's home dir, e.g.) ... then firing up stunnel ... but it seems like so much can go wrong, resulting in User B accessing using User A's certificate (because the copy failed, e.g.). And we're leery of exposing User A's cert to User B - especially since stunnel doesn't support encryption of the user's key, right? So the permissions would be a little tricky and maybe fragile. Seems like there should be a straightforward way to do it, dadnabit! ________________________________ From: Scott Gifford <sgifford(a)suspectclass.com> To: Bucci, David G Cc: stunnel-users(a)mirt.net <stunnel-users(a)mirt.net> Sent: Mon Aug 30 17:41:09 2010 Subject: EXTERNAL: Re: [stunnel-users] Individual user certs for each person who uses Windows PC On Mon, Aug 30, 2010 at 3:41 PM, Bucci, David G <david.g.bucci(a)lmco.com<mailto:david.g.bucci@lmco.com>> wrote: [ ... ] I've tried using envvars in the stunnel.conf (e.g., cert = %USERPROFILE%\usercert.pem), tried adjusting the command line to include "-p %USERPROFILE%\usercert.pem" as an option ... We implemented something similar by simply making a "C:\stunnel" directory on each PC, naming the certificate the same thing on all machines, then hardcoding that path into the stunnel configuration (e.g. "C:\stunnel\usercert.pem"). Not quite as nice as %USERPROFILE%\usercert.pem, but it worked. :-) Hope this is helpful, ----Scott.

5 11

Honor --sysconfdir and --localstatedir in stunnel.conf-sample.in
by Sebastian Kayser 01 Sep '10

01 Sep '10

Hi, I am packaging stunnel for opencsw.org. Would you guys mind merging a patch [1] to make use of --sysconfdir and --localstatedir (instead of @prefix@/{etc,var}) in the sample configuration file? Currently, if --sysconfdir and --localstatedir are passed to ./configure and are not a directory below prefix, the configuration file doesn't reflect this layout. The patch is against 4.33. Fedora seems to carry the same change [2]. Sebastian [1]http://gar.svn.sf.net/svnroot/gar/csw/mgar/pkg/stunnel/trunk/files/0001-M… [2]http://lists.fedoraproject.org/pipermail/scm-commits/2010-March/413078.ht…

3 4

[harri.kiiskinen@utu.fi: Bug#594876: stunnel4: Fails to connect, "Input line too long"]
by Rodrigo Gallardo 31 Aug '10

31 Aug '10

----- Forwarded message from Harri Kiiskinen <harri.kiiskinen(a)utu.fi> ----- Date: Mon, 30 Aug 2010 13:26:07 +0300 From: Harri Kiiskinen <harri.kiiskinen(a)utu.fi> To: Debian Bug Tracking System <submit(a)bugs.debian.org> Subject: Bug#594876: stunnel4: Fails to connect, "Input line too long" Package: stunnel4 Version: 3:4.29-1local1 Severity: normal My Univ. recently updated their mail servers, and I could not read my mails anymore with Emacs/mew, that uses stunnel4 for encryption. It turned out the reason was, that the server responded with this string: * OK [CAPABILITY STARTTLS CAPABILITY IMAP4 IMAP4rev1 ACL QUOTA LITERAL+ NAMESPACE UIDPLUS CHILDREN BINARY UNSELECT SORT LANGUAGE IDLE XSENDER X-NETSCAPE XSERVERINFO X-SUN-SORT X-SUN-IMAP X-ANNOTATEMORE X-UNAUTHENTICATE XUM1 AUTH=PLAIN AUTH=PLAIN] Messaging Multiplexor (Sun Java(tm) System Messaging Server 7.3-11.01 (built Sep 1 2009)) It turned out that this was way much longer than what stunnel4 expects. In common.h, one finds #define STRLEN 256 When this is changed to #define STRLEN 512 and the package recompiled, everything works well. Perhaps the length of accepted strings should be increased? Or is this long a response against some standard? All the best, Harri K. -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (990, 'testing') Architecture: i386 (i686) Kernel: Linux 2.6.32-3-686 (SMP w/1 CPU core) Locale: LANG=en_IE.UTF-8, LC_CTYPE=en_IE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages stunnel4 depends on: ii adduser 3.112 add and remove users and groups ii libc6 2.11.2-2 Embedded GNU C Library: Shared lib ii libssl0.9.8 0.9.8o-1 SSL shared libraries ii libwrap0 7.6.q-19 Wietse Venema's TCP wrappers libra ii netbase 4.42 Basic TCP/IP networking system ii openssl 0.9.8o-1 Secure Socket Layer (SSL) binary a ii perl-modules 5.10.1-14 Core Perl modules stunnel4 recommends no packages. Versions of packages stunnel4 suggests: pn logcheck-database <none> (no description available) -- Configuration Files: /etc/stunnel/stunnel.conf changed [not included] -- no debconf information ----- End forwarded message ----- -- Rodrigo Gallardo

2 1

Individual user certs for each person who uses Windows PC
by Bucci, David G 30 Aug '10

30 Aug '10

Hi, all - I've searched, but can't find any answer on this. Is it possible to configure stunnel with client certificates on, and in such a way that individual users who logon have their own individual certificate used? I've tried using envvars in the stunnel.conf (e.g., cert = %USERPROFILE%\usercert.pem), tried adjusting the command line to include "-p %USERPROFILE%\usercert.pem" as an option ... the closest I've been able to think of (and it's a pretty blunt sword) is to create individual services, one per user and listening on different ports, then having each user access a different URL (well, different port#) ... I would prefer this all work when running as a Windows service, but if it's necessary to train the users to hit a start menu entry or something (e.g., if there's a way to do it using envvars on command line parameters), then the world probably won't end ... This is on Windows, but I'd also appreciate knowing how to do the same on Linux. Thx! ---- David G. Bucci When Dr. Bruce Banner becomes angry, he changes into the Incredible Hulk; when the Incredible Hulk becomes angry, he changes into Chuck Norris. -- ChuckNorrisFacts.com

2 1

Cross-compiling stunnel woes feedback
by Martin van den Nieuwelaar 30 Aug '10

30 Aug '10

Hi everyone (again). I thought I'd post some feedback regarding cross-compiling stunnel, which I have successfully done for an Arm based embedded system we use. I had to edit the 'configure' script in order to remove three sections of code that just check for the cross compiling option, and if set simply exit (message 'cannot check for file existence when cross compiling'). This behaviour really isn't condusive to successful cross compiling. :-) So as I say I removed these sections of code. Next, I configured with './configure --host=arm-linux', then 'make' and the rest are standard as usual. Perhaps the configure script for future releases could be a little more friendly for those cross compiling? Editing the configure file shouldn't be necessary. -- R A Ward Ltd. | We take the privacy of our customers seriously. Christchurch | All sensitive E-Mail attachments MUST be encrypted. New Zealand

2 2

"stunnel -version"
by Felix E. Klee 30 Aug '10

30 Aug '10

I installed the official stunnel 4.33 binary on Windows XP/32. And, when I execute "stunnel -version", a popup window appears with the following message: --------------------------- stunnel 4.33 on Win32 (not configured) --------------------------- Stunnel server is down due to an error. You need to exit and correct the problem. Click OK to see the error log window. --------------------------- OK --------------------------- Shouldn't that just work? What may be the cause for the problem? Indeed, I didn't configure stunnel yet. But I also realized that when I change something - for example the log level - in "stunnel.conf", then this is ignored by "stunnel -version". After clicking "OK" to close the popup message, I get some more info, though meaningless to me: stunnel 4.33 on x86-pc-mingw32-gnu with OpenSSL 1.0.0 29 Mar 2010 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Global options debug = notice RNDbytes = 64 RNDoverwrite = yes service = stunnel taskbar = yes Service-level options cert = stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Server is down

2 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users