- stunnel-users - stunnel.org

bidirectional tunnel
by Leo Cherepanov 14 Mar '08

14 Mar '08

Hello. First of all - thanx a lot, I'm using stunnel every day and it helps me. It will help me even more :) if I can make bidirectional tunnel between external server S and computer C behind nat-proxy-firewall. Of course, C is initiator. I mean after tunnel is up, there is a port-forward C:port1->S:port2 (already works) _and_ S:port3->C:port4 Once again, S has an external ip, C has a private ip. Is this schema posible? Thanx en avance.

1 0

SSLV3 decompression failure???
by Earl Stenlund 13 Mar '08

13 Mar '08

I've been running into the error below: SSL_connect: 14094406: error:14094406:SSL routines:SSL3_READ_BYTES:sslv3 alert decompression failure Running Vista SP1 with stunnel 4.21 connecting to newshosting. It seems to come and go. Any ideas on what is causing this or how to fix it? Thanks, Earl

1 0

Re: [stunnel-users] Compiling Stunnel 4.21 on Solaris 10
by cod3fr3ak 13 Mar '08

13 Mar '08

Is this not compatible with Openssl 0.9.8f? I think 0.9.8g only reacently came out. Is this the only thing wrong. All my other applications work with this version of openssl. BTW I am using the sunfreeware version, because I wanted to avoid having to compile a bunch of software. i was planning to only compile Stunnel, and maybe swatch. I'll compile Openssl if there is no other way but I'd rather not. Any ideas? R

1 0

Compiling Stunnel 4.21 on Solaris 10
by cod3fr3ak 13 Mar '08

13 Mar '08

I am trying to compile Stunnel 4.21 on Solaris 10 with no luck. I am using Openssl 0.9.8f. After running configure, I run make and receive the following output: (truncated for size) ------------------------------------------------------- /bin/bash ../libtool --tag=CC --mode=link gcc -m64 -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o -lz -ldl -lsocket -lnsl -lpthread -L/usr/local/ssl/lib -lssl -lcrypto gcc -m64 -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o -lz -ldl -lsocket -lnsl -lpthread -L/usr/local/ssl/lib -lssl -lcrypto Undefined first referenced symbol in file BIO_set_flags protocol.o SSL_CTX_set_info_callback ctx.o ld: fatal: Symbol referencing errors. No output written to stunnel collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `stunnel' Current working directory /tmp/stunnel-4.20/src *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' I have tried Stunnel version 4.21, 4.20 with the same results. I have used Stunnel to help build several secure log servers in the past, and I've never had problems getting it compiled and installed. Any help would be greatly appreciated. cod3fr3ak

1 0

Re: [stunnel-users] stunnel not seeing ca bundle files
by Ludolf Holzheid 12 Mar '08

12 Mar '08

On Wed, 2008-03-12 09:05:17 -0700, sf.techguy(a)gmail.com wrote: > [..] > > Tried the command above on the 1st of 5 crt files (openssl pkcs12 -in > filename.crt -out filename.pem), and am getting this error: > > 19319:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag:tasn_dec.c:1007: > 19319:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 > error:tasn_dec.c:305:Type=PKCS12 > > Any ideas why that might be happening? It seems your files do not contain a PKCS#12 structure (containing the key and the whole certificate chain). I should have recognize this by the fact you have one file for each certificate. Sorry. Maybe you should give the x509 openssl command a try: openssl x509 -in filename.crt -inform DES -out filename.pem HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

stunnel not seeing ca bundle files
by sf.techguy＠gmail.com 12 Mar '08

12 Mar '08

I'm running stunnel 4.14 on Darwin 7.0.0 (Mac OS X Server 10.4.11), with OpenSSL 0.9.71. I purchased a security certificate from comodo, and was able to get it installed and working (mostly) with stunnel, but when I browse to the website, I get an error that the the browser can't verify the identity of the site, due to a problem w/the security cert. I called comodo, and they the error is caused by stunnel not seeing the intermediate certificate files that they told me need to be installed in order for their certificate to work. These files were: ComodoUTNServerCA.crt UTNAddTrustServerCA.crt AddTrustExternalCARoot.crt EssentialSSLCA.crt my_server_net.crt I modified stunnel.conf, and included this line: CApath = ca-certs/ (<- dir path, relative to chroot, containing above files) But the error persists. Can anyone tell me if what comodo support is telling me is even correct? I've verified that my .key and .crt files match by running: $ openssl x509 -noout -modulus -in server.crt | openssl md5 $ openssl rsa -noout -modulus -in server.key | openssl md5 And the output of both matches. Not sure what to try next. Any help much appreciated! Thanks in advance...

3 2

(no subject)
by Eddie Castelli 11 Mar '08

11 Mar '08

Dear all, Some years ago I have installed Apache, PHP and mySQL. Now I need to update. Unfortunately I can't remember if I installed a package or individual program elements. Could please someone help me and guide me trough as I need urgently the update. Many thanks in advance. -- best regards Eddie

3 3

behaviour on remote disconnection
by Marek Jarycki 11 Mar '08

11 Mar '08

Hi. I'm using 3.26 version of stunnel. How to disallow creating local sockets (on client side) when remote (server) is not available? My application detects socket creation errors and it works without stunnel, but in stunnel the socket is always opening correctly so I have to wait for timeouts to discover network disconnection. Regards, deimoss

2 1

Re: [stunnel-users] unknown protocol error (140770FC) with xinetd
by Ian Pilcher 10 Mar '08

10 Mar '08

Ian Pilcher wrote: > ... and the (non-working) server-side stunnel configuration: > > cert = /etc/stunnel/rsyncs_cert.pem > key = /etc/stunnel/private/rsyncs_key.pem > client = no > pid = /var/run/stunnel.pid > RNDfile = /var/run/stunnel/random_seed > foreground = yes > debug = debug > output = /var/run/stunnel/stunnel.log > > exec = /usr/bin/rsync > execargs = rsync --daemon Amazing how sending off the question gets the old brain cells working (or maybe it was the second cup of coffee). The problem was "foreground = yes". Since xinet.d redirects stderr back over the network connection, the stunnel startup messages were going back to the client. For some reason, the client didn't think that was a proper SSL handshake. ;-) -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

1 0

unknown protocol error (140770FC) with xinetd
by Ian Pilcher 10 Mar '08

10 Mar '08

I am trying to set up rsync over SSL with stunnel. I've got things working when I run stunnel standalone on both systems, but I have been unable to get things working when I run stunnel via xinetd on the server (haven't tried using xinet on the client yet). Here is the (standalone) server configuration that works: cert = /etc/stunnel/rsyncs_cert.pem key = /etc/stunnel/private/rsyncs_key.pem client = no pid = /var/run/stunnel.pid RNDfile = /var/run/stunnel/random_seed foreground = yes debug = debug ;output = /var/run/stunnel/stunnel.log [rsyncs] accept = 2873 exec = /usr/bin/rsync execargs = rsync --daemon Here is the (non-working) server-side xinetd configuration: # default: off # description: rsync tunneled over SSL (stunnel) service rsyncs { disable = no flags = IPv4 socket_type = stream wait = no user = root server = /usr/sbin/stunnel } ... and the (non-working) server-side stunnel configuration: cert = /etc/stunnel/rsyncs_cert.pem key = /etc/stunnel/private/rsyncs_key.pem client = no pid = /var/run/stunnel.pid RNDfile = /var/run/stunnel/random_seed foreground = yes debug = debug output = /var/run/stunnel/stunnel.log exec = /usr/bin/rsync execargs = rsync --daemon Trying to connect to the non-working configuration with openssl s_client, I get: CONNECTED(00000003) write to 0x9b9e938 [0x9b9f068] (133 bytes => 133 (0x85)) 0000 - 80 83 01 03 01 00 5a 00-00 00 20 00 00 39 00 00 ......Z... ..9.. 0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............ 0020 - 00 00 33 00 00 32 00 00-2f 03 00 80 00 00 66 00 ..3..2../.....f. 0030 - 00 05 00 00 04 01 00 80-00 00 63 00 00 62 00 00 ..........c..b.. 0040 - 15 00 00 12 00 00 09 06-00 40 00 00 65 00 00 64 .........@..e..d 0050 - 00 00 14 00 00 11 00 00-08 00 00 06 04 00 80 00 ................ 0060 - 00 03 02 00 80 3e b4 89-34 c1 e6 93 97 2d 8d ca .....>..4....-.. 0070 - 90 e1 4c 51 e1 71 c7 54-ed 52 0c 6e 2e 47 90 9b ..LQ.q.T.R.n.G.. 0080 - 8e c6 73 3d d8 ..s=. read from 0x9b9e938 [0x9ba45c8] (7 bytes => 7 (0x7)) 0000 - 32 30 30 38 2e 30 33 2008.03 18523:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:567: The server log shows: 2008.03.10 11:32:23 LOG5[18563:3086215456]: stunnel 4.20 on i386-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2008.03.10 11:32:23 LOG5[18563:3086215456]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.03.10 11:32:23 LOG7[18563:3086215456]: stunnel started 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 0 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 1 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 4 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 5 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: Connection from 127.0.0.1:38481 permitted by libwrap 2008.03.10 11:32:23 LOG5[18563:3086215456]: stunnel accepted connection from 127.0.0.1:38481 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): before/accept initialization 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 read client hello A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write server hello A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write certificate A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write server done A 2008.03.10 11:32:23 LOG3[18563:3086215456]: SSL_accept: Peer suddenly disconnected 2008.03.10 11:32:23 LOG5[18563:3086215456]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.03.10 11:32:23 LOG7[18563:3086215456]: stunnel finished (0 left) Anyone have any ideas? Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

1 0

Windows FIPS compile
by Joe Kemp 10 Mar '08

10 Mar '08

I am trying to get stunnel to compile against a fips openssl. I read in install.fips that it is not yet supported. Is anyone currently working on this? If so I would love to join forces or any info on the specific issues would help get me started. Thanks. -Joe

2 2

help
by Paque Alexandre 10 Mar '08

10 Mar '08

Hi, I am writing you because I haven’t found solution on the web. In order to secure a connection between servers (1 client and 1 server stunnel), I chose the stunnel tool. However, I have an issue when I unplugged the network cable. If I unplug the network cable on the remote side, Stunnel will detect the cutting only on the local side. In fact, I would like to configure stunnel client in order to detect the unplugged network cable on server side. I tried many configurations but without success: socket = l:TCP_NODELAY=1 socket = l:SO_LINGER=1:1 socket = l:SO_KEEPALIVE=1 socket = l:SO_REUSEADDR=1 socket = r:TCP_NODELAY=1 socket = r:SO_LINGER=1:1 socket = r:SO_KEEPALIVE=1 socket = r:SO_REUSEADDR=1 Could you help me? Thanks you in advance, Alex _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

ssl mutual authentication
by Simon Santoro 09 Mar '08

09 Mar '08

Hello all. I am sure I am missing something really obvious here, but I can't get this to work. HTTP client (localhost) -> stunnel (localhost) -> HTTPS server (remote host) I'd like to user stunnel as proxy for my HTTP requests that go to a HTTPS server (apache if that makes any difference) on a remote host (fresh) that uses a cert to authenticate the request. I wrote this little ruby script[2] to test the request, and it works, so i am sure that on the server/client/cert end there is no problem. Now I'd like to use a simple wget or w3m to get the file from the remote server trough stunnel, but I keep getting SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed The only difference between the ruby script and the stunnel setup is that in the ruby script i have two different files for the crt and the key, and with stunnel I joined those files together with cat s2(a)magnesium.key s2(a)magnesium.crt >s2(a)magnesium.pam on localhost i run: $ stunnel -r fresh:443 -d localhost:11443 -c -f -D 7 -c -S 0 -p certs/s2(a)magnesium.pem -a certs/ -A certs/freshCA.crt -v 3 -P none 2008.03.09 21:21:38 LOG5[9026:3082811056]: Using 'fresh.443' as tcpwrapper service name 2008.03.09 21:21:38 LOG7[9026:3082811056]: RAND_status claims sufficient entropy for the PRNG 2008.03.09 21:21:38 LOG6[9026:3082811056]: PRNG seeded successfully 2008.03.09 21:21:38 LOG7[9026:3082811056]: Certificate: certs/s2(a)magnesium.pem Enter PEM pass phrase: 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_defaults is 0 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_dir is certs/ 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_file is certs/freshCA.crt 2008.03.09 21:21:40 LOG7[9026:3082811056]: Loaded verify certificates from certs/freshCA.crt 2008.03.09 21:21:40 LOG7[9026:3082811056]: Set verify directory to certs/ 2008.03.09 21:21:40 LOG5[9026:3082811056]: Peer certificate location certs/ 2008.03.09 21:21:40 LOG5[9026:3082811056]: stunnel 3.26 on i486-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.8e 23 Feb 2007 2008.03.09 21:21:40 LOG7[9026:3082811056]: No pid file being created 2008.03.09 21:21:40 LOG5[9026:3082811056]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2008.03.09 21:21:40 LOG7[9026:3082811056]: SO_REUSEADDR option set on accept socket 2008.03.09 21:21:40 LOG7[9026:3082811056]: fresh.443 bound to 127.0.0.1:11443 then, I try to connect to localhost:11443 with w3m, in the hope that my HTTP request is encrypted and send to fresh:443, and stunnel should check if the PEER certificate is correct, but all I get is: 2008.03.09 21:26:44 LOG7[9214:3082585776]: fresh.443 accepted FD=6 from 127.0.0.1:43888 2008.03.09 21:26:44 LOG7[9214:3082423184]: fresh.443 started 2008.03.09 21:26:44 LOG5[9214:3082423184]: fresh.443 connected from 127.0.0.1:43888 2008.03.09 21:26:44 LOG7[9214:3082423184]: fresh.443 connecting 192.168.0.2:443 2008.03.09 21:26:44 LOG7[9214:3082423184]: Remote FD=7 initialized 2008.03.09 21:26:44 LOG7[9214:3082423184]: Relying on OpenSSL RSA Blinding. 2008.03.09 21:26:44 LOG7[9214:3082423184]: SSL state (connect): before/connect initialization 2008.03.09 21:26:44 LOG7[9214:3082423184]: SSL state (connect): SSLv3 write client hello A 2008.03.09 21:26:45 LOG7[9214:3082423184]: SSL state (connect): SSLv3 read server hello A 2008.03.09 21:26:45 LOG5[9214:3082423184]: VERIFY OK: depth=1, /C=IT/O=S2 corp./CN=S2/emailAddress=s2@fresh 2008.03.09 21:26:45 LOG4[9214:3082423184]: VERIFY ERROR ONLY MY: no cert for /C=IT/O=S2 corp./CN=fresh 2008.03.09 21:26:45 LOG7[9214:3082423184]: SSL alert (write): fatal: certificate unknown 2008.03.09 21:26:45 LOG3[9214:3082423184]: SSL_connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2008.03.09 21:26:45 LOG7[9214:3082423184]: fresh.443 finished (0 left) Did I something wrong? What am I missing? Please help me, it would save me really a lot of work on the client side if I could get this going. Thanks! Simon [1] ---------------------------------------------------- #!/usr/bin/ruby SERVER_CERT_FILE = "certs/freshCA.crt" CERT_FILE = "certs/s2(a)magnesium.crt" CERT_FILE_KEY = "certs/s2(a)magnesium.key" require 'net/https' https = Net::HTTP.new('fresh', 443) https.use_ssl = true #client certificates https.cert = OpenSSL::X509::Certificate.new( File.read(CERT_FILE) ) https.key = OpenSSL::PKey::RSA.new( File.read(CERT_FILE_KEY), 'panza') #server certificate https.ca_file = SERVER_CERT_FILE https.verify_mode = OpenSSL::SSL::VERIFY_PEER #VERIFY_NONE https.read_timeout = 120 https.start do |https| request = Net::HTTP::Get.new('/notes/test_auth') # request.basic_auth 's', 'x' response = https.request(request) response.value puts response.body end ----------------------------------------------------

1 1

Connection Problem on Vista
by Earl Stenlund 08 Mar '08

08 Mar '08

I setup stunnel this afternoon to work with Newshosting. It was working fine but now I cannot connect using my desktop running Vista. I receive this message: SSL_connect: 14094406: error:14094406:SSL routines:SSL3_READ_BYTES:sslv3 alert decompression failure Stunnel connects fine on my laptop which is also running Vista. Help, Earl Stenlund

1 0

Username authentication
by Joe Kemp 07 Mar '08

07 Mar '08

I want to try to use stunnel as a "simple" client vpn. It solves all of my encryption issues but I would like to verify a username/password before it lets the traffic through. I didn't see any patches or hacks out there that did this. Has this been attempted before or am I on my own. I would also be interested in other solutions based on openssl that are not network device level VPNs clients. Already using client side certificates and I know that is the normal SSL authentication mechanism.... Thanks. -Joe

2 2

Send delay?
by Colin E 04 Mar '08

04 Mar '08

Please can you help a hardware engineer, who almost understands what he's doing. I'm using sTunnel 4.21 on a Windows 2000 machine, to provide a TCP program with SSL. This works very well. However the application is very time critical and must finish sending block of XML as quickly as possible. I suspect there is a delay in either sTunnel or openSSL, while it waits to see if there are any more characters before sending a packet. Is this correct? If it is, is there a work round. -- View this message in context: http://www.nabble.com/Send-delay--tp15826043p15826043.html Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 4

Newbie
by Rod Bodden 03 Mar '08

03 Mar '08

Hello to all! I'm trying to set up Stunnel for the first time. I hope to use it with HFS. I followed directions found on HFS website and ran into a problem creating a pem file. Could someone direct me to information about installing Stunnel? Or help me directly by sharing with me how to install Stunnel? I sincerely appreciate your help!!! Rod

1 0

Bugs
by Jan.Haering＠rz-kiru.de 29 Feb '08

29 Feb '08

Hallo, I have found 2 Bugs. 1. In Version 4.21: No Taskbar Icon is displayed when the service starts. Although the taskbar ist set in config file (taskbar = yes). 2. In probably all Versions (I have testet 4.18, 4.20 and 4.21) If i started the service over Start -> Programm Files -> stunnel -> Service Start (stunnel -start) no log files are written. If i start the service over services.msc from Windows or "sc start stunnel" log files are written. The icon log displayed the following message in version 4.18 and 4.20 2007.11.09 09:41:03 LOG3[2396:2400]: stunnel.log: Broken pipe (32) 2007.11.09 09:41:03 LOG3[2396:2400]: Unable to open output file: stunnel.log Best Regards Jan

5 9

webdav with stunnel and 'net use'
by detlef oertel 26 Feb '08

26 Feb '08

Hello list, what we want to do, is mounting a webdav share via https on a windows xp box. Therefore we tried to tunnel localhost:80 to server:443 The name of the test server is here bonifax. What works is: mounting direct via http net use x: "http://bonfax/opsi-depot" mounting over stunnel with 'Add Network Place Wizard' or RunDLL32.EXE netplwiz.dll,AddNetPlaceRunDll using the address: http://localhost/opsi-depot What fails is: ---------------------------- C:\WINDOWS>net use y: "http://localhost/opsi-depot" Systemfehler 67 aufgetreten. Der Netzwerkname wurde nicht gefunden. -------- Error 67 'network name not found' ------------------------ part of stunnel.conf ------------------------ ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration verify=0 [psuedo-https] accept = 80 connect = bonifax:443 TIMEOUTclose = 0 ------------------------ This is the log: ----------------------------- 2008.02.26 20:04:11 LOG7[1560:1404]: psuedo-https accepted FD=176 from 127.0.0.1:1861 2008.02.26 20:04:11 LOG7[1560:1404]: Creating a new thread 2008.02.26 20:04:11 LOG7[1560:1404]: New thread created 2008.02.26 20:04:11 LOG7[1560:3308]: psuedo-https started 2008.02.26 20:04:11 LOG7[1560:3308]: FD 176 in non-blocking mode 2008.02.26 20:04:11 LOG7[1560:3308]: TCP_NODELAY option set on local socket 2008.02.26 20:04:11 LOG5[1560:3308]: psuedo-https accepted connection from 127.0.0.1:1861 2008.02.26 20:04:11 LOG7[1560:3308]: FD 208 in non-blocking mode 2008.02.26 20:04:11 LOG7[1560:3308]: psuedo-https connecting 192.168.1.14:443 2008.02.26 20:04:11 LOG7[1560:3308]: connect_wait: waiting 10 seconds 2008.02.26 20:04:11 LOG7[1560:3308]: connect_wait: connected 2008.02.26 20:04:11 LOG5[1560:3308]: psuedo-https connected remote server from 192.168.2.234:1862 2008.02.26 20:04:11 LOG7[1560:3308]: Remote FD=208 initialized 2008.02.26 20:04:11 LOG7[1560:3308]: TCP_NODELAY option set on remote socket 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): before/connect initialization 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 write client hello A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read server hello A 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY IGNORE: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY OK: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY IGNORE: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY OK: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY IGNORE: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY OK: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read server certificate A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read server key exchange A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read server done A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 write client key exchange A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 write change cipher spec A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 write finished A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 flush data 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read finished A 2008.02.26 20:04:11 LOG7[1560:3308]: 1 items in the session cache 2008.02.26 20:04:11 LOG7[1560:3308]: 1 client connects (SSL_connect()) 2008.02.26 20:04:11 LOG7[1560:3308]: 1 client connects that finished 2008.02.26 20:04:11 LOG7[1560:3308]: 0 client renegotiations requested 2008.02.26 20:04:11 LOG7[1560:3308]: 0 server connects (SSL_accept()) 2008.02.26 20:04:11 LOG7[1560:3308]: 0 server connects that finished 2008.02.26 20:04:11 LOG7[1560:3308]: 0 server renegotiations requested 2008.02.26 20:04:11 LOG7[1560:3308]: 0 session cache hits 2008.02.26 20:04:11 LOG7[1560:3308]: 0 session cache misses 2008.02.26 20:04:11 LOG7[1560:3308]: 0 session cache timeouts 2008.02.26 20:04:11 LOG6[1560:3308]: SSL connected: new session negotiated 2008.02.26 20:04:11 LOG6[1560:3308]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2008.02.26 20:04:26 LOG7[1560:3308]: SSL alert (read): warning: close notify 2008.02.26 20:04:26 LOG7[1560:3308]: SSL closed on SSL_read 2008.02.26 20:04:26 LOG7[1560:3308]: Socket write shutdown 2008.02.26 20:04:26 LOG7[1560:3308]: SSL write shutdown 2008.02.26 20:04:26 LOG7[1560:3308]: SSL alert (write): warning: close notify 2008.02.26 20:04:26 LOG6[1560:3308]: SSL_shutdown successfully sent close_notify 2008.02.26 20:04:26 LOG5[1560:3308]: Connection closed: 311 bytes sent to SSL, 971 bytes sent to socket 2008.02.26 20:04:26 LOG7[1560:3308]: psuedo-https finished (0 left) ---------------------- stunnel version 4.21 Anyone any ideas what went wrong and how to go around ? regards detlef -- detlef oertel Tel. 06131 / 27561-10 Fax 06131 / 27561-22 eMail: d.oertel(a)uib.de uib umwelt informatik büro gmbh Firmensitz / Anschrift: Bonifaziusplatz 1B 55118 Mainz internet: www.uib.de Geschäftsführer: dr. detlef oertel Handelsregister: Amtsgericht Mainz HRB 6942

1 0

Sun Niagra2
by Steve Harris 25 Feb '08

25 Feb '08

Hi all, Has built stunnel on the Sun Niagra 2 platform to take advantage of the on-chip crypto? Cheers - Steve -- NOTE: This message is confidential and may not be disclosed to anyone without the express written consent of the sender. ********************************************************************* PH: 250-381-1335 xt125

1 0

Log & Timestamp question
by Edward Blake 25 Feb '08

25 Feb '08

Stunnel currently logs times in the format hh:mm:ss. Is there a way to get a more exact time, such as UTC or down to the millisecond? Edward Blake

1 0

VNC, STUNNEL & HTTPTUNNEL ----- (((VNC)SSL)HTTP)
by sean bhola 25 Feb '08

25 Feb '08

I need to connect to my PC at work from home. The firewall at work has only ports 80 (http) and 443 (https) open, I also think there is a proxy. I was wondering which scenario would work. 1: To encapsulate vnc traffic within ssl using stunnel and pass it though port 443, OR 2: To encapsulate vnc traffic within ssl using stunnel, then encapsulate that within http using httptunnel and pass through port 80 OR 3: To encapsulate vnc traffic within http, then encapsulate that within ssl using stunnel and pass through port 443 I read this article http://www.securityfocus.com/infocus/1677 but still had the concerns above. Help would be much appreciated. Thanks. Sean

2 1

running SWAT through stunnel and uid/gid question
by Wayne Sherman 24 Feb '08

24 Feb '08

(using STunnel 4.21 on gentoo) I can successfully run the samba SWAT tool through stunnel with these settings: [swat] exec = /usr/sbin/swat execargs = swat accept = 901 But, I have discovered that in order to successfully log-in to swat, I have to comment these lines in the global section of stunnel.conf: #setuid = stunnel #setgid = stunnel Is there a way to specify the UID/GID per service (like the xinetd service level option "user") instead of globally? Thanks, Wayne

1 0

Re: [stunnel-users] Stunnel Configuration
by paque_alexandre＠yahoo.fr 19 Feb '08

19 Feb '08

1 0

Web based CRL file
by Edouard Dessioux 18 Feb '08

18 Feb '08

Hi, I have several questions about the CRL file : - is the file reloaded before each connection or is it first loaded at the stunnel startup ? - do you have any idea of how to use a web-based CRL file ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users