- stunnel-users - stunnel.org

Stunnel supports ECC certificate?
by Bao, Robert 03 Jun '10

03 Jun '10

I searched the entire archive, couldn't find the answer/solution I am looking for. I have to post to this group, and appreciate any help/suggestion from any you. I use the latest 1.0.0 OpenSSL and 4.33 Stunnel. I used OpenSSL commands that very similar to what is described in the following link to create the ECC certificate and the private key file. http://src.opensolaris.org/source/xref/sfw/usr/src/lib/openssl/openssl-0 .9.8n/demos/ssltest-ecc/ECC-RSAcertgen.sh Start Stunnel, see the following errors: Key file: (actual path to the private key file)\HOST.KEY error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key There was a similar posting 4-5 years ago, and Mike answered it (the answer was: Stunnel didn't support ECC at that time). http://stunnel.mirt.net/pipermail/stunnel-users/2005-October/000817.html Seems like this is still true today. Then, when the ECC support will be added to Stunnel? If Stunnel already supports ECC certificate, how do I make it work? Thanks. Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipient's use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

1 0

deploy stunnel
by Arko-Quick, Patricia K 02 Jun '10

02 Jun '10

Is there a way to deploy stunnel to all users versus the current user logged in? I would like to deploy it with sms to all users of the machine.

1 0

Default for TIMEOUTidle?
by Markus Borst 27 May '10

27 May '10

I want to modify TIMEOUTidle in our configuration. To be sure to set it to sensible values, I need to know the default value, but I can't find it in the docs. Greetings Markus Borst -- TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst Adresse: Petersentrasse 30, 64287 Darmstadt, Germany Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

1 0

Transparent mode, alternative env.c
by Hans Werner Strube 25 May '10

25 May '10

The method for passing the remote address and port to an exec'ed program through getenv() calls in the preloaded libstunnel.so fails for programs that clean the environment initially. This can be circumvented placing getenv() in an _init() function and storing the results in static variables. Here is my alternative env.c (without the copyright and license), which I have been using for more than a year: * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * /* getpeername() can't be declared in the following includes */ #define getpeername no_getpeername #include <sys/types.h> #include <sys/socket.h> /* for AF_INET */ #include <netinet/in.h> #include <arpa/inet.h> /* for inet_addr() */ #include <stdlib.h> /* for getenv() */ #ifdef __BEOS__ #include <be/bone/arpa/inet.h> /* for AF_INET */ #include <be/bone/sys/socket.h> /* for AF_INET */ #else #include <sys/socket.h> /* for AF_INET */ #endif #undef getpeername static uint32_t rem_host=0; static uint16_t rem_port=0; /* Requires shared-library linking by ld, not cc (except with gcc -nostdlib) */ void _init() { char *value; if((value=getenv("REMOTE_HOST")) && *value != '\0') rem_host = inet_addr(value); if((value=getenv("REMOTE_PORT")) && *value != '\0') rem_port = htons(atoi(value)); } int getpeername(int s, struct sockaddr_in *name, int *len) { char *value; name->sin_family = AF_INET; name->sin_addr.s_addr = rem_host; name->sin_port = rem_port; return 0; } /* End of env.c */

1 0

STRLEN in common.h may be too small
by Hans Werner Strube 25 May '10

25 May '10

In common.h of stunnel-4.x, the parameter STRLEN (used for many buffers) is set to 256. This is insufficient in some cases, e.g., the CAPABILITY response of an IMAP server or the pathname of a file may be too long, resulting in errors. If you encounter such cases (e.g., messages "Input line too long"), increase STRLEN, e.g., to 512.

1 0

Using stunnel to RDP into a SSL-enabled Windows box
by Daren Krive 11 May '10

11 May '10

Hi everyone, First of all I apologize if this has been asked before or if I am totally misunderstanding the purpose of stunnel altogether. If so please bear with my ignorance. I am an IT consultant and I manage about 20+ Windows-based servers. Some of these servers are accessible via VPN while others are accessible directly via RDP over the Internet. For those that are exposed to the net I am using the SSL certificate feature of Remote Desktop by going into “Terminal Services Configuration” and configuring the connection to use an SSL (most of the time a self-signed cert). I can connect to these machines no problem from Windows and I get a “lock” icon in my RDP client. However I cannot connect to these machines using rdestkop under Ubuntu. I have determined that if I turn off the requirement to use SSL on the server side (and instead allow the connection to use the built-in encryption of RDP) then I am able to connect with rdesktop. I would very much like to avoid rebooting just to connect to these servers. I am also not willing to remove the requirement for the SSL connection. Is there a way I can use stunnel on my Ubuntu box to first establish a secure SSL connection and then use rdesktop over that connection? I have searched high and low for info on this and found nothing. I have found instructions on how to use the Windows version of stunnel to secure RDP but that isn’t what I am trying to do. The server is already using an SSL cert to encrypt the connection (not sure how many people know Windows 2003 and up can do this). I am looking to get around the apparent lack of SSL support in rdesktop. Best regards, Daren.

3 3

running as a windows service
by Graham Chiu 10 May '10

10 May '10

I downloaded and ran the windows binary 4.33. When I use the stunnel.pem it runs fine as a service. I created my own pem ( using Openssl on OpenSolaris ) and it won't run now as a service. I get a timeout message. If I then uninstall it as a service, and run it as an application, it works. Ideas on getting to run as a service with my pem? The log says nothing of note. -- Graham Chiu

2 1

Safari SSL Problems
by Rene Plattner 05 May '10

05 May '10

Hi, has anyone Problems with Safari? I habe Problems with Safari 3 + 4 on Windows with stunnel Version 4.27 + 4.33 Everytime if I want to connect to an SSL terminated (stunnel) webservice, Safari asks for an client certificate, allthough I set the option verify to default (=none). Kind regards, René Plattner -- -------------------------------------------------------------- Dipl.-Ing. René Plattner Zentraler Informatikdienst (Central IT-Services) Universität Innsbruck Technikerstrasse 23 Tel: ++43512/507-2360 6020 Innsbruck Fax: ++43512/507-2944 Austria E-Mail: rene.plattner(a)uibk.ac.at Homepage: http://www.uibk.ac.at/zid -------------------------------------------------------------- D92E 1AE3 A8AA 9A57 8E5B 9204 F5D0 95DB 4030 742D http://homepage.uibk.ac.at/~c1021058/keys/0x4030742D.pub --------------------------------------------------------------

1 0

zlib error in build for W32
by J F 04 May '10

04 May '10

Hi, I'm trying to build from source stunnel-4.33 for W32 in a machine with Debian lenny following the guidelines provided in INSTALL.W32. First I received complains from the compiler about zlib.h not found. Then I copied the zlib headers from /usr/include in include directory under openssl tree. Now openssl 1.0 compiles smoothly but when I try to compile stunnel I received the following error: i586-mingw32msvc-gcc -s -o stunnel.exe file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -L/usr/src/openssl-1.0.0 -lzdll -lcrypto.dll -lssl.dll -lws2_32 -lgdi32 -mwindows /usr/lib/gcc/i586-mingw32msvc/4.2.1-sjlj/../../../../i586-mingw32msvc/bin/ld: cannot find -lzdll collect2: ld returned 1 exit status make: *** [stunnel.exe] Error 1 Am I doing some basic mistake? JF

2 1

How to start windows service with realtime priority?
by Ryan Dunn 20 Apr '10

20 Apr '10

I've been trying to figure out how to start the stunnel service on windows with a realtime priority, and so far, all attempts have failed. I've tried setting the ImagePath to 'start /realtime "C:\Program Files\stunnel\stunnel.exe" -service -install' and inserting that into a bat file and calling that instead, but that didn't work either. Does anyone know how to specify the startup priority of a windows service? Is that something that the program would need to support? Thanks, Ryan

1 0

newb: setting up and debugging a windows stunnel
by Jay Sprenkle 19 Apr '10

19 Apr '10

Good afternoon, I'm trying to use stunnel to secure a legacy application's communications. I can't seem to get it setup and working. Can anyone provide any hints where I'm going wrong? Here's what I'm trying to accomplish: A windows service on a client machine connects to a server on port 7000 using TCP. I'd like to encrypt the communication between client and server. Here's what I've tried: Created a new server that accepts ssl connections on port 7443. Got a certificate for the server and installed it. Installed stunnel on my windows machine (version 7.43 from the distribution archive file). Installed libssl32.dll and libeay32.dll in the same directory as stunnel.exe ( from the openssl-0.9.8h-1 binary distribution). Installed it as a service using "stunnel -install" Configured stunnel as follows: debug=7 output=C:\p4\internal\Utility\Proxy\proxy.log service=Proxy taskbar=no [exchange] accept=7000 client=yes connect=proxy.blah.com:7443 I changed my hosts file to trick the old application: server.blah.com 127.0.0.1 proxy.blah.com IP-address-of-server.blah.com "server.blah.com" now resolves to the machine it's running on (i.e. stunnel). "proxy.blah.com" goes to the real server. stunnel should connect to the server. I start the stunnel service and try to connect. It looks like it's working but the stunnel service just shuts down with no message. 2010.04.19 13:16:21 LOG5[4924:3716]: stunnel 4.33 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2010.04.19 13:16:21 LOG5[4924:3716]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.04.19 13:16:49 LOG5[4924:3748]: Service exchange accepted connection from 127.0.0.1:4134 2010.04.19 13:16:49 LOG6[4924:3748]: connect_blocking: connecting x.80.60.32:7443 2010.04.19 13:16:49 LOG5[4924:3748]: connect_blocking: connected x.80.60.32:7443 2010.04.19 13:16:49 LOG5[4924:3748]: Service exchange connected remote server from x.253.120.19:4135 2010.04.19 13:20:24 LOG5[3668:3856]: Reading configuration from file stunnel.conf 2010.04.19 13:20:24 LOG7[3668:3856]: Snagged 64 random bytes from C:/.rnd 2010.04.19 13:20:24 LOG7[3668:3856]: Wrote 1024 new random bytes to C:/.rnd 2010.04.19 13:20:24 LOG7[3668:3856]: RAND_status claims sufficient entropy for the PRNG 2010.04.19 13:20:24 LOG7[3668:3856]: PRNG seeded successfully 2010.04.19 13:20:24 LOG7[3668:3856]: SSL context initialized for service exchange 2010.04.19 13:20:24 LOG5[3668:3856]: Configuration successful 2010.04.19 13:20:24 LOG5[3668:3856]: No limit detected for the number of clients 2010.04.19 13:20:24 LOG7[3668:3856]: FD=312 in non-blocking mode 2010.04.19 13:20:24 LOG7[3668:3856]: Option SO_REUSEADDR set on accept socket 2010.04.19 13:20:24 LOG7[3668:3856]: Service exchange bound to 0.0.0.0:7000 2010.04.19 13:20:24 LOG7[3668:3856]: Service exchange opened FD=312 2010.04.19 13:20:24 LOG5[3668:3856]: stunnel 4.33 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2010.04.19 13:20:24 LOG5[3668:3856]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.04.19 13:21:02 LOG7[3668:4556]: Service exchange accepted FD=372 from 127.0.0.1:4156 2010.04.19 13:21:02 LOG7[3668:4556]: Creating a new thread 2010.04.19 13:21:02 LOG7[3668:4556]: New thread created 2010.04.19 13:21:02 LOG7[3668:3756]: Service exchange started 2010.04.19 13:21:02 LOG7[3668:3756]: FD=372 in non-blocking mode 2010.04.19 13:21:02 LOG5[3668:3756]: Service exchange accepted connection from 127.0.0.1:4156 2010.04.19 13:21:02 LOG7[3668:3756]: FD=396 in non-blocking mode 2010.04.19 13:21:02 LOG6[3668:3756]: connect_blocking: connecting x.80.60.32:7443 2010.04.19 13:21:02 LOG7[3668:3756]: connect_blocking: s_poll_wait x.80.60.32:7443: waiting 10 seconds 2010.04.19 13:21:02 LOG5[3668:3756]: connect_blocking: connected x.80.60.32:7443 2010.04.19 13:21:02 LOG5[3668:3756]: Service exchange connected remote server from x.253.120.19:4157 2010.04.19 13:21:02 LOG7[3668:3756]: Remote FD=396 initialized 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): before/connect initialization 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write client hello A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read server hello A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read server certificate A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read server done A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write client key exchange A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write change cipher spec A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write finished A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 flush data 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read finished A The client thinks the connection is closed: No connection could be made because the target machine actively refused it 127.0.0.1:7000 at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress) at System.Net.Sockets.Socket.Connect(EndPoint remoteEP) at Service.ConnUtility.Connect() Any suggestions? Thanks

1 0

Stunnel connection from A to B but direction from B to A?
by Carsten Krüger 13 Apr '10

13 Apr '10

Hi, is it possible with stunnel to connect from host A to host B but to have the port redirection the other way? host A has a webserver on 127.0.0.1:80 host A connects to Host B (example.dyndns.org:8000) Host B opens a browser on page http://127.0.0.1:80 and reaches the webserver on A If yes, how do I have to configure A and B? The manpage didn't enlighten me. The normal way A connects to B and A reaches webserver on B works perfectly. greetings Carsten

2 1

multiple systems
by tony westenhofer 12 Apr '10

12 Apr '10

Hello, My currently working setup is using verify=2 (at client only )and the server1's info is in my .pem on the clients. This works fine, but if need to have server2 act as backup when server1 is down. Can I just add server2's info to the .pem or do I need to setup multiple files for the different keys? Thanks in advance for saving me some lab time! Noob _________________________________________________________________ The New Busy think 9 to 5 is a cute idea. Combine multiple calendars with Hotmail. http://www.windowslive.com/campaign/thenewbusy?tile=multicalendar&ocid=PID2…

1 0

"bind: Address already in use (48)"
by Dino Buzzetti 12 Apr '10

12 Apr '10

Please pardon me if this is an improper question to the list. But I am a freshman who uses stunnel to connect to his university library proxy from abroad. I had stunnel installed and it worked properly, but after an upgrade of all old ports, solicited by the installation process of a new application requiring MacPorts, stunnel doesn't work anymore. I have tried to re-install it, but I still get the same error message > Error binding squidssl to ::1:8095 > bind: Address already in use (48) Any clue as to what might have engaged the 8095 address and on how I might try to solve the problem? Best, -dino buzzetti

3 2

Stunnel doesn't work at all since 4.30
by Denis Solovyov 05 Apr '10

05 Apr '10

Dear friends, I use stunnel for a long time to provide pop3s connections inside a local network. It is quite an old linux server under 2.4 kernel. Stunnel is started from xinetd. xinetd.conf: service pop3s { socket_type = stream wait = no user = root server = /usr/local/bin/stunnel server_args = /usr/local/etc/stunnel/pop3s.conf bind = [ip_address] } /usr/local/etc/stunnel/pop3s.conf: cert = /usr/local/etc/stunnel/mail.pem debug = debug exec = /usr/local/sbin/popa3d execargs = popa3d Everything worked perfectly before 4.30, but when I installed 4.30 pop3s connections just stopped. There is absolutely nothing in logs, just start and stop; example: Mar 24 20:29:51 aldema xinetd[2235]: START: pop3s pid=19123 from=[ip] Mar 24 20:29:51 aldema xinetd[2235]: EXIT: pop3s status=1 pid=19123 duration=0(sec) It is "all.log", i.e. syslog puts everything (*.*) into this file. If starting xinetd with '-v' option, nothing interesting is shown in its own verbose output. When I use 4.29 all.log looks like (with debug = info): Mar 21 09:40:04 aldema xinetd[2235]: START: pop3s pid=32516 from=[ip] Mar 21 09:40:04 aldema stunnel: LOG5[32516:16384]: stunnel 4.29 on i686-pc-linux-gnu with OpenSSL 0.9.7e Mar 21 09:40:04 aldema stunnel: LOG5[32516:16384]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Mar 21 09:40:04 aldema stunnel: LOG5[32516:16384]: stunnel accepted connection from[ip]:4020 Mar 21 09:40:04 aldema stunnel: LOG6[32516:16384]: SSL accepted: new session negotiated Mar 21 09:40:04 aldema stunnel: LOG6[32516:16384]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 Mar 21 09:40:04 aldema stunnel: LOG6[32516:16384]: Local mode child started (PID=32517) Mar 21 09:40:05 aldema popa3d[32517]: Authentication passed for [username] from 127.0.0.1 Mar 21 09:40:05 aldema popa3d[32517]: 0 messages (0 bytes) loaded Mar 21 09:40:05 aldema popa3d[32517]: 0 (0) deleted, 0 (0) left Mar 21 09:40:05 aldema stunnel: LOG6[32516:16384]: SSL_shutdown successfully sent close_notify Mar 21 09:40:05 aldema stunnel: LOG5[32516:16384]: Connection closed: 29 bytes sent to SSL, 48 bytes sent to socket Mar 21 09:40:05 aldema xinetd[2235]: EXIT: pop3s status=0 pid=32516 duration=1(sec) When 4.30 was released I thought it may be buggy because it was marked "experimental", but now I see 4.32 and the same behaviour. Actually, I don't know what to do... nothing in logs really confuses me. Does it mean stunnel crashes at startup (running "stunnel -version" is OK)? Any ideas? Thank you. With the best regards, Denis Solovyov

1 1

Openssl-1.0.0 incompatibility
by Carter Browne 02 Apr '10

02 Apr '10

Is there any update on the compatibility issues between openssl-0.9.8n and openssl-1.0.0? The same configuration file was used in both cases. Linux CentOS 5.4 and SuSE 11.1. Stunnel and openssl both built from sources. I have a number of self-signed certificates in a sub-directory. With openssl-1.0.0, the error is: VERIFY ERROR: depth=0, error= self signed certificate:... SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned With openssl-0.9.8n VERIFY OK: depth=0, ... I have compiled and linked a version of openssh-5.4p1 from sources with openssl-1.0.0 and it works correctly. Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

Re: [stunnel-users] stunnel sends empty list of trusted CAs
by Sebastian Bork 01 Apr '10

01 Apr '10

2010/3/31 Michal Trojnara <Michal.Trojnara(a)mirt.net> > You should have implemented it the other way around: The "cert" option should contain the complete certificate chain of stunnel, > and "CApath"/"CAfile" should only contain the trusted CA certificate for "verify > = 2", and the trusted peer certificate for "verify = 3". Hi, thank you for your quick reply! Alas, I think we started with a misunderstanding. I know how the own certificate and the partner certificates are configured, and the instance with verify=3 works for some thirty partners. All client certificates are validated just as they should be. The file I set in "cert" contains the three certificates in the server certificate chain for stunnel, in the correct order. "CApath" is set to a directory that has all the symlinks with md5 hashes for the client certificates (the certificates themselves are all in their own subdirectories, with another set of symlinks, so I can use the subdirectory for an stunnel client process, and the directory at the top for the server). So when I wrote I put the whole certificate chain for each partner in the CA path, I meant in the directory there is the partner certificate as well as the certificate(s) of the CA that they got their certificate from. With "openssl verify -CApath . partner.crt" I check if everything is complete. Maybe this is overkill, if I do not really need a self-signed certificate at the top, but it shouldn't hurt either. The problem is this: their SAP software (I think they use the Business Connector, but it might be their PI directly, as indicated by the "XI" at the end of the capture file - I am no SAP guru) does not send a partner certificate. The partner claims this is because the "Distinguished Names" list is empty. In this list the server is supposed to send all the CAs it accepts, so the client can then chose one of the certificates it has installed to present it to the server. Since the list is empty, no certificate is found. So I need to find a way to send back a list of accepted root CA certificates. What I tried, and described in the mail, was this: I set up a second stunnel with verify=2. For this, I use the same file in "cert", but a new directory for CApath. In this directory, I have put the symlink for the CA certificate of the partner (their own company-wide CA) , in the hope that this is not only used to verify their client certificate when they present it, but also sent in the Distinguished Names list of accepted CAs. Unfortunately, this did not work, that list is still empty. I have attached the data of the connection attempt, including a screenshot the partner sent us, which shows the field they are talking about with a size of "0", Is there any way, regardless of how complex, to send the DNs? I'll gladly patch the source and compile instead of using a binary package, as long as it helps.

1 0

More Issues with Openssl 1.0.0
by Carter Browne 31 Mar '10

31 Mar '10

My standard configurations of stunnel use the verify=2 option. With recent versions of stunnel and openssl-0.9.8 for Linux systems, I have capath = /capath and stunnel searches directory /capath relative to chroot for the certificates. Using the same configuration file and openssl-1.0.0, this directory is no longer being searched. Any ideas about how to specify the location of capath with openssl-1.0.0? Thanks, Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

stunnel sends empty list of trusted CAs
by Sebastian Bork 31 Mar '10

31 Mar '10

Hi, I have a problem which Google did not help me with. A communications partner of one of our customers wants to connect their SAP Business Connector to our platform using HTTPS. Our software does not have SSL/TLS implemented, we rather use stunnel for all communications links, inbound or outbound, where the customer or partner wants to use HTTPS with client authentication. The normal setup is "verify = 3" and the complete certificate chain for each partner is put into the CA path. In most cases, this works without problems. However, in the handshake, after the server certificate is sent and stunnel asks the client to send a client certificate, stunnel sends an empty list of triusted CAs. SAP BC expects the list of supported CAs to contain certificates, instead of being empty. My hope was that using "verify = 2" might help, so I have configured a new server instance of stunnel, and have copied the certificate of the partner's own CA into the CA path. Unfortunately, the partner says it still does not work, and the log file shows they still do not send their certificate when the server asks for a client cert. It seems that stunnel still returns an empty list of trusted CAs, which causes SAP BC to find no certificate to send. Is there any way I can configure stunnel to send back either every certificate found in a path or file, or at least to send back some fixed value for the trusted CAs?

2 1

Problem with openssl-1.0.0
by Carter Browne 30 Mar '10

30 Mar '10

For the Windows version of stunnel-4.31 and 4.32 I tried running stunnel with openssl-1.0.0 compiled for Windows and ssleay32.dll renamed to libssl32.dll. When I make a connection using using stunnel, I get a invalid memory reference to location 0 in libeay32.dll. I have had no problem with this approach with many versions of openssl up through and including openssl-0.9.8n. Any ideas? Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

error:1408F10B
by Greg Groth 29 Mar '10

29 Mar '10

I'm having similar issues recently on two separate machines that are producing similar errors. In both instances, /var/log/messages starts filling up with lines similar to the following: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I can give further details on both systems, as well as the exact issue, if warranted. First off, can anyone explain what a 1408F10B error is? My gut feeling is that in both instances something changed on the client end (in both instances the client is a version of outlook). Any help would be greatly appreciated. Greg Groth

1 0

Re: [stunnel-users] GNU (clarification)
by tony westenhofer 27 Mar '10

27 Mar '10

Mr. Trojnara, That is what I was after: > Please simply include stunnel source (stunnel-4.xx.tar.gz) on whatever media > (e.g. CD, DVD, web page, etc.) you use to distribute your product together > with stunnel binary. Thank you again for such a wonderful piece of work-- And supporting it!!!!! Best Regards Tony > From: stunnel-users-request(a)mirt.net > Subject: stunnel-users Digest, Vol 68, Issue 9 > To: stunnel-users(a)mirt.net > Date: Sat, 27 Mar 2010 12:00:02 +0100 > > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: GNU (Michal Trojnara) > 2. Re: auto-disconnecting people when CRL updated (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 26 Mar 2010 22:27:51 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > Subject: Re: [stunnel-users] GNU > To: stunnel-users(a)mirt.net > Message-ID: <201003262228.10766.Michal.Trojnara(a)mirt.net> > Content-Type: text/plain; charset="utf-8" > > tony westenhofer wrote: > > I am using stunnel (no code modifications) to encrypt communications > > for some applications to eventually be sold. First off outstanding work, > > stunnel saved hours of work having to figure out how to add the security > > desired. > > Thank you. That's exactly why I wrote it. 8-) > > > Now I am wanting to make sure to comply with licensing. > > Can someone be specific and help on this? > > As the author of stunnel I'll be glad to help. > > > I know we have to post a few things on the website for the > > product. (what? a link, an actually dl > > for stunnel...) > > Please simply include stunnel source (stunnel-4.xx.tar.gz) on whatever media > (e.g. CD, DVD, web page, etc.) you use to distribute your product together > with stunnel binary. > > > What about paper distribution for the product, what > > about stunnel must be included? > > I'm not sure I understand your question. > Do you distribute your software on paper? > > Do you mean any advertisement or documentation for your product? > The license does not require that you do anything about it, but it would be > nice of you to mention my name. > > Best regards, > Michal Trojnara > the author of stunnel >

1 0

auto-disconnecting people when CRL updated
by David van Zijl 26 Mar '10

26 Mar '10

Hello Is it possible to get stunnel to disconnect people on a graceful restart when a certificate has expired? Stunnel version 4.30 added the graceful reload option which is great because it will allow us to reload the CRLs, keep everybody connected and prevent new people connecting when their certs have expired (tested and working) - however existing connections are not terminated even though they have just expired... I'm not sure if we've missed a configuration option or if this is just not possible. A little background: We host an IRC server listening on localhost:6667, on top of that we have stunnel listening on the external interface port 6697 We're using the CAfile and CRLpath options to ensure that people are connecting with a valid certificate. Every hour a job runs to download the latest CRL files, if there is a change it restarts stunnel and kicks everybody off (we'd like to use a graceful restart instead) We are running stunnel on Red Hat Linux using the following line inside an init script to run it as a daemon: daemon /usr/local/bin/stunnel /etc/stunnel/stunnel.conf Excerpt from stunnel.conf: setuid = daemon setgid = daemon ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [irc-in] CAfile = /etc/ca/our-chains.pem CRLpath = /etc/crl accept = 192.168.0.1:6697setuid = daemon setgid = daemon connect = localhost:6667 verify = 2 Running stunnel -version tells me: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Kind Regards Dave

2 1

GNU
by tony westenhofer 26 Mar '10

26 Mar '10

Hello, I am using stunnel (no code modifications) to encrypt communications for some applications to eventually be sold. First off outstanding work, stunnel saved hours of work having to figure out how to add the security desired. Now I am wanting to make sure to comply with licensing. Can someone be specific and help on this? I know we have to post a few things on the website for the product. (what? a link, an actually dl for stunnel...) What about paper distribution for the product, what about stunnel must be included? Please be as specific as you can or better yet point me to an example of someone else already giving proper credit where due. Again thank you for your hard work (all involved). Second question, any recommendations for securing the stunnel folder without interfering with its functionality on Windows systems. Have not had time to try locking down different ntfs setting yet. Thanks in advance and I do apologies if my questions have already been covered in the past. If so please provide url. Tony _________________________________________________________________ Hotmail is redefining busy with tools for the New Busy. Get more from your inbox. http://www.windowslive.com/campaign/thenewbusy?ocid=PID27925::T:WLMTAGL:ON:…

2 1

Re: [stunnel-users] Stunnel 4.32 released
by Jose Alf. 26 Mar '10

26 Mar '10

Hi Michal, Thanks for the new 4.32 version. I tested beta 1 and 2 and everything worked fine on my side. Should have been released a day after because OpenSSL released a new version (0.9.8n) the same day. I compiled mine against it on Windows and it works. regards, Jose.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users