- stunnel-users - stunnel.org

stunnel.conf in %USERAPPDATA%
by Sebastian Rose-Indorf 19 Mar '12

19 Mar '12

Hello, I use Stunnel with Windows. The configuration file "stunnel.conf" and the log file "stunnel.log" are in the %USERAPPDATA%\Stunnel folder. Stunnel starts and works without problems. But the GUI options "Edit stunnel.conf" and "Reload stunnel.conf" do not work. Is remedy possible? Sebastian

2 3

Re: [stunnel-users] stunnel with smb from 2 networks behind firewalls
by Philippe 19 Mar '12

19 Mar '12

I have found the stunnel version on PCB : stunnel 4.35 on x86_64-pc-linux-gnu with OpenSSL 1.0.0e 6 Sep 2011 the version on PCA is 4.52 this is perhaps a too big difference isn't it ? Best Philippe

1 0

Help for connecting to Https
by Ali Kabiri 18 Mar '12

18 Mar '12

Hi I have IP & Port with User & Pass from HttpS server I want connect to this server and using for tunneling, (something like vpn, a little of course!) I use stunnel on iPad Please help me I need this for usual using of Internet Please help me Please... Ali

1 0

Re: [stunnel-users] issue with running stunnel
by Thomas Eifert 18 Mar '12

18 Mar '12

Hi again Dewen; It sounds to me like Stunnel isn't being accessed at all. You should be seeing something in the Stunnel log window. I run Stunnel under Windows, so what I generally do is get Stunnel to listen to the loopback interface at address 127.0.0.1, or some other address within the loopback interface range. As such, if I was attempting to access it with a utility like Netcat, my basic stunnel.conf would look something like this for the client side: debug =7 [service.name] client = yes accept = 127.0.0.1:12035 connect = destination.address:1230 Then, I would point Netcat to the listening address and port. In your case, that might be netcat 127.0.0.1:12035. Then see if Stunnel logs your connection attempt. Again, this is under Windows, so your mileage may vary. Let us know how it works out for you. Regards; Thomas On 3/17/2012 12:32 PM, Dewen Kong wrote: > Hi Thomas, > > Thank you for your help. > > here is the config file in one computer >>> client = yes >>> [ncat] >>> accept = 12035 >>> connect = ***.***.***.***:1230 >> and on this computer, I run the command: cat test.file | >> netcat ***.***.***.***: 12035. to connect the remote server with >> IP( ***.***.***.***) on port 12035. I figure on stunnel will accept >> the port 12035 and connect to the remote server on port 1230 or I >> thought. > > and no another remote server, I run the command netcat -l -p 1230 > which means listen to the port 1230. > > after I run the test, it seems on remote server didn't receive > anything on the port 1230.the log file of stunnel dooesn't have any > record of this communication. the last line of the log file is still > "configuration successfully" > > and the version of stunnel I use is 4.42 > > > any suggests that may be wrong? > > > Dewen Kong > >> >> > > On Fri, Mar 16, 2012 at 10:14 PM, Thomas Eifert <kxkvi(a)wi.rr.com > <mailto:kxkvi@wi.rr.com>> wrote: > > Dewen; > > I think I misread your post. Please forgive me, as I'm unfamiliar > with the Netcat application. > > If you could provide some additional detail, that might be helpful. > > Regards; > > Thomas > > > > On 3/16/2012 9:38 PM, Thomas Eifert wrote: >> Dewen; >> >> I don't know anything about Netcat, so I'm taking a stab in the >> dark here, but it looks as if >> you're pointing Netcat at port 1230, while your config file >> indicates that Stunnel would be >> listening on port 12035. Try redirecting Netcat to the listening >> port. >> >> If you need to post again, please indicate the version of Stunnel >> you are using, and what >> platform your are running it on. >> >> Regards; >> >> Thomas >> >> >> On 3/16/2012 5:35 PM, Dewen Kong wrote: >>> Hi all, >>> I am a new guy to stunnel. >>> here is the issue I meet, i install my stunnel in the lab. and >>> trying to run the test with netcat. >>> Here is the config file i test: >>> client side: >>> ... >>> ... >>> output = stunnel.log >>> client = yes >>> [ncat] >>> accept = 12035 >>> connect = ***.***.***.***:1230 >>> then I run "stunnel test.conf "and the the log file shows >>> configuration successfully >>> then I run the command "cat test.file | netcat ***.***.***.*** >>> 12035 on the client side >>> and run netcat -l -p 1230 > output >>> nothing happens. >>> And I check the log file. there is no record about the netcat. >>> I don't know what happened. >>> >>> >>> -- >>> */Dewen Kong/* >>> >>> >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> >>> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >> >> -- >> Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately. >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> >> http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > -- > Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately. > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > > > -- > */Dewen Kong/* -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

win-32 : console version with foreground mode & no icon area activity
by IvankoB for-mse 17 Mar '12

17 Mar '12

Needed to start/terminate/{supply private key password}/{catch errors} via pipe reader/writer (MSEgui pipe components) so that a STunnel session only serves a single application.

1 0

issue with running stunnel
by Dewen Kong 17 Mar '12

17 Mar '12

Hi all, I am a new guy to stunnel. here is the issue I meet, i install my stunnel in the lab. and trying to run the test with netcat. Here is the config file i test: client side: ... ... output = stunnel.log client = yes [ncat] accept = 12035 connect = ***.***.***.***:1230 then I run "stunnel test.conf "and the the log file shows configuration successfully then I run the command "cat test.file | netcat ***.***.***.*** 12035 on the client side and run netcat -l -p 1230 > output nothing happens. And I check the log file. there is no record about the netcat. I don't know what happened. -- *Dewen Kong*

2 2

Stunnel 1.45 on Win7 x64, OCSP blows up
by Michael Olson 16 Mar '12

16 Mar '12

I'm using stunnel in client mode on a Windows 7 x64 workstation, installed using ftp://ftp.stunnel.org/stunnel/stunnel-4.52-installer.exe Everything works until I try to check the server certificate for revocation using an OCSP server, at which point stunnel crashes whenever I make a connection. The following error pops up in a dialog box: OPENSSL_Uplink(0FBE5000,14): no OPENSSL_Applink My config is pretty simple: -------------------------------------------------------------- debug = 7 # I do want FIPS enabled, but I figured one problem at a time. fips = no CAfile = ca-bundle.crt verify = 2 OCSP = http://ocsp.test.net/ options = NO_SSLv2 [test1] client = yes accept = 127.0.0.1:80 connect = web.test.net:443 -------------------------------------------------------------- The log gets as far as: 2012.03.02 11:07:41 LOG7[4296:5008]: OCSP: server connected when it crashes. -- Mike

2 3

need suggestion on this issue?
by Dewen Kong 16 Mar '12

16 Mar '12

Hi guys, Right now I am working on this issue trying to encrypt the communication between terminals and our back of house computer. I am trying to solve this problem with stunnel. If the terminal is 'smart' like computer, it will be no issue. implement the stunnel on both end. But it come to be a problem there is some dumb terminal, No way to set up stunnel in its side. I not sure stunnel can works here any more. if not, is there any other methods that may work? -- *Dewen Kong*

2 1

Stunnel->Stunnel Failure Behavior...
by Matt Wise 13 Mar '12

13 Mar '12

I'm using Stunnel in our environment to tunnel our ZooKeeper connections... it works reasonably well as long as ZooKeeper is running on our ZooKeeper servers properly. Here's an example of our server and client configs: Server: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > sslVersion = TLSv1 > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > debug = 4 > [zookeeper] > accept = 0.0.0.0:2182 > failover = rr > connect = 127.0.0.1:2181 Client: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > sslVersion = TLSv1 > client = yes > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > debug = 4 > [zookeeper] > accept = 127.0.0.1:2182 > failover = rr > connect = zookeeper1:2182 > connect = zookeeper2:2182 > connect = zookeeper3:2182 Now the intended behavior is that if 'zookeeper1', 'zookeeper'2, or 'zookeeper3' go down that the client will re-establish a connection with one of the other servers. However, that doesnt seem to be happening. Instead, when the connection dies, Stunnel seems to go into a massive loop trying to re-connect to the original server. > Feb 22 21:41:24 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) Whats missing in my config to make the failover work properly? —Matt

2 2

Stunnel stopped working: Will not sync with Google using Outlook 2007 on Ubuntu 11:10 64-bit
by Jonathan Harrison 13 Mar '12

13 Mar '12

I made some changes to my stunnel config, and had one account working. I added the remaining 3 and it seemed to start to work, but now it has stopped. Outbound (send) seems to be fine. Any ideas????? Telnet and post listening test results: [CODE]$ netstat -an | grep -iw LISTEN tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3001 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3002 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3003 0.0.0.0:* LISTEN tcp6 0 0 :::80 :::* LISTEN tcp6 0 0 ::1:631 :::* LISTEN tcp6 0 0 :::445 :::* LISTEN tcp6 0 0 :::139 :::* LISTEN baronipc@baronipc:~$ telnet localhost 3000 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ telnet localhost 3001 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ telnet localhost 3002 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ telnet localhost 3003 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ [/CODE] Copy of config file: [CODE] ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/mail.pem ;key = /etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 [imaps Work] accept = 127.0.0.1:3000 connect = imap.gmail.com:993 [imaps Personal] accept = 127.0.0.1:3001 connect = imap.gmail.com:993 [imaps Admin] accept = 127.0.0.1:3002 connect = imap.gmail.com:993 [imaps Co] accept = 127.0.0.1:3003 connect = imap.gmail.com:993 ;[ssmtp Work] ;accept = 127.0.0.1:4000 ;connect = smtp.gmail.com:465 ;[ssmt Personal] ;accept = 127.0.0.1:4001 ;connect = smtp.gmail.com:465 ;[ssmtp Admin] ;accept = 127.0.0.1:4002 ;connect = smtp.gmail.com:587 ;[ssmtp Co] ;accept = 127.0.0.1:4003 ;connect = smtp.gmail.com:587 ;[ssmtp other] ;accept = 127.0.0.1:4004 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini[/CODE] And /etc/default/stunnel4 [CODE]# /etc/default/stunnel # Julien LEMOINE <speedblue(a)debian.org> # September 2003 # Change to one to enable stunnel automatic startup ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" # Change to one to enable ppp restart scripts PPP_RESTART=0[/CODE] -- Regards Jonathan

1 0