- stunnel-users - stunnel.org

Certificates, Servers & Clients. Clarify this please.
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Now that I've read a bunch of articles and have seen a pile of examples of how pairs of a certificate and a private key can be created I must say they all suggest different approaches and techniques to creating certificates and ultimately bewildered me. Could anyone please explain as simply as possible, in layman's terms what exactly must be done? Let's talk about simple scenario with two hosts (A & B) involved, both running stunnel. Let us assume host A is the server and host B is the client. cert = CAfile = must be created. And we use verify level 3 (verify = 3) So, what exactly do we do now? And what happens in the dialog between these two machines? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Can't start stunnel (dies mysteriously)
by Ivan Lezhnjov Jr. 19 Aug '08

19 Aug '08

Hello there I run stunnel version 4.21 and openssl version 0.9.8h. In my setup I aim to create a tunnel to send log files through to a centralized loghost. Host A (loghost) runs Source Mage GNU/Linux (with stunnel 4.21, openssl 0.9.8h) and host B runs Slackware 11 system (with stunnel 4.17, openssl 0.9.8h). The problem is that stunnel starts on host B but won't start on host A. Here's the snippet of /var/log/messages that records stunnel start-up event: root@sega:/home/users/ilj % stunnel && tail /var/log/messages -n 3 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: 500 clients allowed I've actually been trying to run stunnel for the first time ever so I don't really know if this output confirms that everything is alright but judging solely from what is put in log file it seems stunnel has started successfully. Unfortunately, this isn't quite true root@sega:/home/users/ilj % ps ax | grep stun 29618 pts/4 R+ 0:00 grep stun So, this is the problem I have. It doesn't start on host A. Host A has the following stunnel configuration: root@sega:/home/users/ilj % cat /etc/stunnel/stunnel.conf cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5101] accept = 217.117.75.2:5101 connect = 127.0.0.1:1999 Host B sports a little bit different configuration file: root@xerxes:~ % cat /etc/stunnel/stunnel.conf client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5101] accept = 127.0.0.1:1999 connect = 217.117.75.2:5101 On both hosts (A & B) I run stunnel standalone as root. > 4. Output of "stunnel -f -D 7 <your-parameters>". Erm.. it doesn't seem to work for me. There's no -D parameter according to man stunnel. The following information below is about host A only: root@sega:/home/users/ilj % stunnel -version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none root@sega:/home/users/ilj % uname -a Linux sega 2.6.24 #5 SMP PREEMPT Wed May 7 18:22:29 EEST 2008 i686 GNU/Linux root@sega:/home/users/ilj % gaze from /usr/lib/libc.a glibc-2.7:/usr/lib/libc.a root@sega:/home/users/ilj % gcc -v Reading specs from /usr/lib/gcc/i686-pc-linux-gnu/4.2.3/specs Target: i686-pc-linux-gnu Configured with: /usr/src/gcc-4.2.3/configure --host=i686-pc-linux-gnu --prefix=/usr --infodir=/usr/share/info --mandir=/usr/share/man --enable-threads=posix --with-system-zlib Thread model: posix gcc version 4.2.3 root@sega:/home/users/ilj % gaze installed | grep openssl openssl:20080615:installed:0.9.8h -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Disable libwrap at runtime?
by Jans, Kert 16 Aug '08

16 Aug '08

Hi, Is it possible to disable libwrap support at runtime? I've reviewed the archives and documentation and cannot determine if this is possible. I know it is possible to compile-out support for libwrap by using: configure --disable-libwrap Is compiling-out support the only way? I'd like to disable support in a pre-build version of stunnel. Regards, Kert

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 15 Aug '08

15 Aug '08

Ah ha - "verify = 3" - thanks! On 15/08/2008, at 9:12 AM, Brian Hatch wrote: >> > Mutual authentication uses the verify option on both > ends, rather than just on one end. Both sides verify, > and both sides present a certificate.

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 14 Aug '08

14 Aug '08

On 14/08/2008, at 8:00 PM, Michal.Trojnara(a)mobi-com.net wrote: > Sure. Stunnel supports mutual SSL authentication. > Please read the fine manual for details. Hi Mike, Thanks for the reply. I did quite a lot of trawling on the web, your website and the stunnel man pages and couldn't find any guidance on mutual ssl authentication configuration. Are you able to give me a pointer, perhaps a URL to something that contains an example? Thanks again. Cheers, -C

1 0

Stunnel connection drops after four http requests
by Renner, Christopher R 13 Aug '08

13 Aug '08

With quite a bit of help from a list member here, I have stunnel 4.25 running on OSX 1.5.4 (PHP development environment). Problem is I can only get four http requests to the server before the connection is dropped. Stunnel is still running in the background.

1 0

Mutual SSL Authentication
by Christopher Hunt 13 Aug '08

13 Aug '08

Hi there, Does stunnel have any in-built support for mutual SSL authentication? If not are there plans to incorporate support? Cheers, -C

2 1

question
by Ted Ehrlich 12 Aug '08

12 Aug '08

1 0

OSX 10.5 install?
by Renner, Christopher R 11 Aug '08

11 Aug '08

> >> Hi, >> >> New list member here. I¹m going through the archives now, and have Googled >> my way to exhaustion, looking for up-to-date instructions to install stunnel >> on a Mac desktop. >> >> I do PHP web application development and need to be able to connect to a NAS >> space via stunnel on my desktop dev environment in order to simulate the live >> environment. >> >> Does anyone 1) have a link to current OSX install instructions, or 2) care to >> share such instructions with me off the top of your head? >> >> I tried working through this darwinports page ( >> http://stunnel.darwinports.com/) but 1) it sends me to Macports.org for the >> .dmg file thereby installing macports and not darwinports....and after that >> the ³port² command is unrecognized in terminal when trying to install >> stunnel. >> >> >> Thanks. >>

2 1

Socket connection status
by Jeffrey Buck 08 Aug '08

08 Aug '08

Hi, I'm running stunnel 4.04 on ia64-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003. I have basically taken a generic TCP interface and implemented a STUNNEL client/server setup to allow the connection to transfer data using SSL. I have an issue with checking the status of the connection when a connection attempt is made. We are using ObjectSpace libraries for all of our tcp related connections so I don't have the low level calls that are actually being made, but here is a brief description of what is happenning.... We create an os_tcp_socket object and call the connect_to() method. This establishes a connection to the stunnel client on my local machine....which in turn makes the connection the the stunnel server on the remote machine. The problem I'm am having is when I can't get to the remote machine. After the connect_to() call, we check the status of the socket and unless I sleep for 5-10 seconds, it always seems to think that the connection is ok...which kind-of makes sense because it is able to connect to the stunnel client port since it is local...but in fact, if there isn't access to the remote machine, eventually stunnel will close that initial connection to that socket (that where the 5-10 second delay seems to help). The status I really want is weather or not the entire connection was successful through stunnel to the remote machine. Is there a better way to do this other than putting a sleep() in. Right now I have a 10 second sleep in between the connect_to() call and the status check on the local/client stunnel TCP port. That seems to be enough time for stunnel to attept to complete the connection and kill the connection to it's local/client port so that when I check the status of it, it comes back bad. If this is the best way to do it...what is the amount of time needed for stunnel to attempt to complete it's connection to the remote machine? Thanks! Jeff

2 3

Yahoo SSL
by Bernie Murciano 29 Jul '08

29 Jul '08

1 0

Re: [stunnel-users] help with stunnell
by Ludolf Holzheid 28 Jul '08

28 Jul '08

On Thu, 2008-07-24 23:37:22 -0700, vinodsreehari(a)yahoo.com wrote: > [..] > > I configured stnnel in one server as server mode ,for accepting > connection on 8070 ,and connect to 80 . It works only if i specify > https://ipaddress:8070 This is because the default port for https is 443. If you'd configure stunnel to accept on port 443, `https://ipaddress' would work. > I have configured one client server also to accept connection on 80 > and redirect to teh 8070 of server. I want to know that is that teh > way its working . If there is a stunnel instance on the client machine accepting connections on port 80 and connecting to the web server at the https port (default or not), a user could specify `http://localhost' to connect to the web server (and the traffic between the client machine and the server would be secured). > And is it possible to implement the same in a live enviroment ,in > which teh webserver will run on different port ,but users dont need > to specify the port number . Yes. As soon as the destination port for the 'first hop' of a redirected/tunneled connection is the default port for the protocol in question, there is no need to specify the port number. The port numbers of 'intermediate hops' are configuration options for the two stunnel instances (in this case), so the user dosn't have to care about them. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Wrong documentation
by Sandeep Kumar 25 Jul '08

25 Jul '08

On Thu, Jul 24, 2008 at 9:39 PM, Brian Hatch <bri(a)stunnel.org> wrote: > In the neigborhood of 2008-07-24 09:40 +0530, Sandeep Kumar mentioned: > > > Look at this page > http://www.stunnel.org/faq/stunnel.html#configuration_file > > In service level options section, under the explanation of "CRLpath" it > is > > said that all files in it should be of the form XXXXXXXX.0. But my > stunnnel > > setup worked only when i names as XXXXXXXX.r0 instead of XXXXXXXX.0. > > What version of openssl are you running? stunnel 4.15 with OpenSSL 0.9.8b > > > > -- > Brian Hatch "Have you asked Kirk if > Systems and he'd like the job?" > Security Engineer "You can't hide from me! > http://www.ifokr.org/bri/ I will find you. > > Every message PGP signed > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.1 (GNU/Linux) > > iD8DBQFIiKlFVkMj8/ymYEsRAmKxAJ9CTLp0Xi8n1VxdFup/kBUuZe6scwCfcvyu > WQG8BlfrUV8RcP31/ZUEbJk= > =EBgc > -----END PGP SIGNATURE----- > > -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

Help on configuring Stunnel
by Patel Dippen-CDP054 24 Jul '08

24 Jul '08

I downloaded the pre-compiled Windows version of Stunnel (stunnel-4.25-installer.exe). We need to deploy this on 2 machines A and B. The way it works is: - B connects to A - then A connects to B How should I configure Stunnel on machine A, since, in the first case A is the Server and in the 2nd scenario A becomes the Client. Questions on deploying Stunnel on machine A: - Can I run just 1 instance of Stunnel on machine A? It seems I cannot since I have to set the "client = yes" in the 2nd scenario - Do I need to run multiple instances, 1 running as the Server and the 2nd as the Client? Here is the config file I used on the machine A: **************************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [iPerfS] accept = 5010 connect = 127.0.0.1:5001 [iPerfS] accept = 5002 connect = 12.50.0.25:5020 **************************** Here is the config file I used on the machine B: **************************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [iPerfC] accept = 5001 connect = 12.50.0.26:5010 [iPerfS] accept = 5020 connect = 127.0.0.1:5002 **************************** Regards, Dippen

1 0

Stunnel 4.24 patch to allow stunnel to search for the OCSP responder within an X.509 certificate's AIA extension.
by Bruce Keats 24 Jul '08

24 Jul '08

Hi all, This patch also fixes a problem with stunnel accepting an "unknown" response as "good" and allows the connection to be setup. An OCSP responder can return one of three responses (good, revoked, unknown), however the code would accept "unknown" as good. This patch fixes that problem and treats an "unknown" response as a failure. Stunnel can query an OCSP responder to determine the revocation status of a certificate when stunnel is verifying the certificate. The code works great, however it is uses a preconfigured OCSP responder. The OCSP responder's IP/hostname is specified in the stunnel configuration file as a URI. I found this rather restrictive, so I added code to extract the OCSP responder's URI from the certificate. As per RFC 3280, one of the valid extensions for X.509 certificate is the Authority Information Access (AIA) where the "accessMethod" can be "is-ad-ocsp" to identify the OCSP responders location as per RFC2560. There can be more than one OCSP responder listed in the AIA because it is a sequence. Each location is queried in the order they appear within the certificate until either a "good" or "revoked" response is received. If an "known" response or a failure then the next OCSP responder is checked. If all OCSP responder queries result in failure then the validation also fails.. A new configuration option "OCSPaia" was added. If the "OCSPaia=yes" then the stunnel will look for the OCSP responder(s) within the certificate's AIA. The locally configured "OCSP=<url>" overrides the OCSPaia option. Bruce

1 0

Wrong documentation
by Sandeep Kumar 24 Jul '08

24 Jul '08

Look at this page http://www.stunnel.org/faq/stunnel.html#configuration_file In service level options section, under the explanation of "CRLpath" it is said that all files in it should be of the form XXXXXXXX.0. But my stunnnel setup worked only when i names as XXXXXXXX.r0 instead of XXXXXXXX.0. -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

help with stunnel port forwarding
by vinod bhasi 23 Jul '08

23 Jul '08

Hi, Please help me with stunnel port forwarding . My apache is running at port 8000 .I want this to be forwarded to 80 so that normal users dont need to specify the port number . Can anyone help me with the configuration in both client and server side .Im confused as stunnel wont run with same port used by apache. Any help will be appreciated Thanks in advancve Vinod Bhasi Did you know? You can CHAT without downloading messenger. Go to http://in.webmessenger.yahoo.com/

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 48, Issue 13
by Patrick Dung 21 Jul '08

21 Jul '08

Message: 3 Date: Mon, 21 Jul 2008 11:34:22 +0200 From: Micha? Trojnara <Michal.Trojnara(a)mobi-com.net> Subject: Re: [stunnel-users] Problem with Solaris 10u5 x86 and Stunnel 4.25 To: stunnel-users(a)mirt.net Message-ID: <2a3f79f5f6dd65f2ced02b2e9929368b(a)mirt.net> Content-Type: text/plain; charset="UTF-8" http://stunnel.mirt.net/pipermail/stunnel-users/2008-June/002021.html Mike On Sat, 19 Jul 2008 01:53:17 -0700 (PDT), Patrick Dung <patrick_dkt(a)yahoo.com.hk> wrote: > Hi > > I use this to compile stunnel: > The gcc and openssl is from Solaris SFW. > > # export CC=/usr/sfw/bin/gcc > # ./configure --with-threads=pthread --with-ssl=/usr/sfw > --localstatedir=/var > > After installing and starting stunnel, I found there are mutiple stunnel > processes. > There is a PID file which store one of the stunnel process. > I have tried to kill that PID, stunnel is bring down. > But there other stunnel processes running. > > Any ideas? > > Regards > Patrick > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users I see. Thanks for reply. Yesterday, I have tried to compile stunnel with Sun Studio. It got problem linking with libwrap, so I turned off libwrap support. And it compile (without knowing there is a libwrap patch) and there is only one single running stunnel process. Regards Patrick

1 0

stunnel exits silently on startup
by Luis López de Quintana 21 Jul '08

21 Jul '08

Problem: stunnel doesn't run: ldq@ldq:~$ stunnel4 /etc/stunnel.cnf ldq@ldq:~$ ps aux | grep stunnel ldq 15683 0.0 0.0 2332 1392 pts/0 S+ 11:08 0:00 man stunnel ldq 25289 0.0 0.0 1776 608 pts/1 S+ 11:59 0:00 grep stunnel stunnel.cnf: ldq@ldq:~$ cat /etc/stunnel.cnf client = yes debug = debug [nntps] accept = 127.0.0.1:1109 connect = news.giganews.com:443 Version: stunnel 4.140-5ubuntu1 libc6 ldq@ldq:~$ uname -a Linux ldq 2.6.18.5 SMP Thu May 8 01:31:23 UTC 2008 x86_64 GNU/Linux -- LdQ

2 2

Problem with Solaris 10u5 x86 and Stunnel 4.25
by Patrick Dung 19 Jul '08

19 Jul '08

Hi I use this to compile stunnel: The gcc and openssl is from Solaris SFW. # export CC=/usr/sfw/bin/gcc # ./configure --with-threads=pthread --with-ssl=/usr/sfw --localstatedir=/var After installing and starting stunnel, I found there are mutiple stunnel processes. There is a PID file which store one of the stunnel process. I have tried to kill that PID, stunnel is bring down. But there other stunnel processes running. Any ideas? Regards Patrick

1 0

Config Sanity Check
by Caplan, Michael 19 Jul '08

19 Jul '08

Hi There, I am working through an issue with a script that builds a socket connection to stunnel. Stunnel is being used to relay to an Apache web server. I'm building a localhost TCP connection on port 54322, and writing my HTTP data. When reading data back from the socket connection in my script I'm sometimes getting nothing, and other times getting the proper result. I can confirm that the web server is always receiving the request and returning a proper response. Wireshark shows SSL data being transmitted and received, so stunnel is doing its thing. However, the response does not seem to be relayed to my script on the other side of stunnel *sometimes*. My hunch is that I am doing something wrong with my script, but I am hoping that an stunnel guru can rule out any oddities with my stunnel setup. My config is below as well as the output of my log file. Any thoughts? Thanks! Mike cert = connector.pem debug = 7 output = c:\ssl.log ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [registerserver] client = yes accept =54321 connect =www.int.ddx.com:443 [connector2server] client = yes accept =54322 connect =asd.int.ddx.com:443 [server2connector] accept = 54323 connect = 9000 2008.07.18 21:41:41 LOG7[13648:13748]: Snagged 64 random bytes from C:/.rnd 2008.07.18 21:41:41 LOG7[13648:13748]: Wrote 1024 new random bytes to C:/.rnd 2008.07.18 21:41:41 LOG7[13648:13748]: RAND_status claims sufficient entropy for the PRNG 2008.07.18 21:41:41 LOG7[13648:13748]: PRNG seeded successfully 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service registerserver 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service connector2server 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service server2connector 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service test 2008.07.18 21:41:41 LOG5[13648:13748]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.18 21:41:41 LOG5[13648:13748]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.07.18 21:41:46 LOG7[13476:13096]: Snagged 64 random bytes from C:/.rnd 2008.07.18 21:41:47 LOG7[13476:13096]: Wrote 1024 new random bytes to C:/.rnd 2008.07.18 21:41:47 LOG7[13476:13096]: RAND_status claims sufficient entropy for the PRNG 2008.07.18 21:41:47 LOG7[13476:13096]: PRNG seeded successfully 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service registerserver 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service connector2server 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service server2connector 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service test 2008.07.18 21:41:47 LOG5[13476:13096]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.18 21:41:47 LOG5[13476:13096]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Please consider the environment before printing this email. E-mail messages may contain viruses, worms, or other malicious code. By reading the message and opening any attachments, the recipient accepts full responsibility for taking protective action against such code. Henry Schein is not liable for any loss or damage arising from this message. The information in this email is confidential and may be legally privileged. It is intended solely for the addressee(s). Access to this e-mail by anyone else is unauthorized.

1 0

Difference between verify level 2 and 3
by Sandeep Kumar 16 Jul '08

16 Jul '08

Hi, I searched a lot on google, in the archives, and in the FAQ page, but could not find the differences between verify levels 2 and 3, other than the one line explanation given on the FAQ/man page. Specifically, I want to ask: 1. Is verify level 3 same as 2, but asks for client certificates as well? (Seems unlikely but still..) 2. Since verify level 2 also demands CApath/CAfile to be present, then it also is ultimately verifying against locally installed certs, which is supposed to be level 3's behaviour? Thanks & regards, Sandeep Kumar http://web.iiit.ac.in/~sandeep_kr

2 2

stunnel-portforwarding
by vinod bhasi 16 Jul '08

16 Jul '08

Hi All, I am a newbie as far as stunnel is concerned. I need help urgently on how to do port forwarding with Stunnel. Any help is appreciated. Thanks and Regards, Vinod Bhasi Save all your chat conversations. Find them online at http://in.messenger.yahoo.com/webmessengerpromo.php

1 0

SSL with SMTP problem - sTunnel 4.25 Windows
by dscycler 14 Jul '08

14 Jul '08

I am using sTunnel 4.25 for Windows to send and receive e-mail from a GoldMine client. sTunnel has worked well over the years but am having an issue with a particular mail host, Live Office. They have implemented SMTP SSL on port 25. The debug log is as follows: 2008.07.14 13:45:11 LOG7[2136:5356]: smtp accepted FD=224 from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:5356]: Creating a new thread 2008.07.14 13:45:11 LOG7[2136:5356]: New thread created 2008.07.14 13:45:11 LOG7[2136:4944]: smtp started 2008.07.14 13:45:11 LOG7[2136:4944]: FD 224 in non-blocking mode 2008.07.14 13:45:11 LOG5[2136:4944]: smtp accepted connection from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:4944]: FD 232 in non-blocking mode 2008.07.14 13:45:11 LOG7[2136:4944]: smtp connecting 64.70.94.196:25 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: waiting 10 seconds 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: connected 2008.07.14 13:45:11 LOG5[2136:4944]: smtp connected remote server from 127.0.0.1:1908 2008.07.14 13:45:11 LOG7[2136:4944]: Remote FD=232 initialized 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): before/connect initialization 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): SSLv3 write client hello A 2008.07.14 13:45:11 LOG7[2136:4944]: SSL alert (write): fatal: handshake failure 2008.07.14 13:45:11 LOG3[2136:4944]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2008.07.14 13:45:11 LOG5[2136:4944]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.07.14 13:45:11 LOG7[2136:4944]: smtp finished (0 left) I am looking for help to troubleshoot the connection problem. Is this an sTunnel issue or a mail server issue? Are there conf file settings to address the issue? Thanks, DavidS

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 48, Issue 8
by Pietro Di Primo 10 Jul '08

10 Jul '08

Thank you for reply. I tryied it but it doesn't work because my client run some separated subprocesses and are them that contact the server so, if an extern process try to connect to 127.0.0.1:<the_found_port> while one of that subprocess has finished and the next is not yet started, it will be able to do it and also my subprocess will be pending (i tryed it). Hope i was able to explain the situation. Any suggestion? Thanks in advace > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 9 Jul 2008 13:26:03 +0200 (CEST) > From: "Pietro Di Primo" <pietro.diprimo(a)ct.infn.it> > Subject: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: > <2553.193.206.208.201.1215602763.squirrel(a)imapfis.ct.infn.it> > Content-Type: text/plain;charset=utf-8 > > Hi, I have a client server application, and want to tunnel it in this way: > a script select a free port in a random way, write the stunnel.conf file. > with "accept=<the_found_port>" and "connect=<my_server>" and run my client > application passing to 127.0.0.1:<the_found_port> as server address. > The problem is that i need to be sure that no other client or user can > access <the_found_port> while the application is running. > I guess that it should be possible to do it, but i wasn't able to. > > Can anybody help me? > > Thanks > > > -- > --- > > Ing. Pietro Di Primo > INFN - Istituto Nazionale di Fisica Nucleare > Grid Computing Research Area > Via S. Sofia 78 95123 CATANIA (Italy) > Voice : +39 095 378-5446/5517 > Fax. : +39 095 378 5518 > Mobile : +39 320 8591527 > E-mail : pietro.diprimo(a)ct.infn.it > Skype : pietrodiprimo > > > > ------------------------------ > > Message: 2 > Date: Wed, 9 Jul 2008 14:08:23 +0200 > From: Micha? Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: Re: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: <6ba9f1b703149916bb1a61fb68a1e377(a)mirt.net> > Content-Type: text/plain; charset="UTF-8" > > > Pietro Di Primo wrote: >> Hi, I have a client server application, and want to tunnel it in this > way: >> a script select a free port in a random way, write the stunnel.conf >> file. >> with "accept=<the_found_port>" and "connect=<my_server>" and run my > client >> application passing to 127.0.0.1:<the_found_port> as server address. >> The problem is that i need to be sure that no other client or user can >> access <the_found_port> while the application is running. >> I guess that it should be possible to do it, but i wasn't able to. > > Simply bind the specific network interface with: > accept=127.0.0.1:<the_found_port> > > Best regards, > Mike > > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 48, Issue 8 > ******************************************** > -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users