- stunnel-users - stunnel.org

Test, test. Hello?
by James Moe 05 Dec '08

05 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I have not received a posting for several days. Has the list really gone that quiet? - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD4DBQFJOXHezTcr8Prq0ZMRAqqQAJ0aUC0ZyZC+85WF4WZN3nntQjfrxgCY/zjt 3Jlthcur9UTtXOnNkVcPFg== =scXZ -----END PGP SIGNATURE-----

1 0

Extending stunnels connect functionality
by bernhard.czech＠nobiscum.de 24 Nov '08

24 Nov '08

Hi all, we are looking for somebody to extend stunnel's multiple connect functionality a bit as of: - adding the ability to send a configurable string to each "connect" and compare the answer against an configured expectation string - the expectation should also be able to be interpreted as an regular expression. - the testing interval should be configurable - an alternative port should be configurable - it should be possible to call a script instead of doing a connection with the connect string provided as a parameter. - a way of monitoring might all paths might be good (i.e. writing a status file on regular basis) These things are pretty much the same things that LVS ( http://www.linuxvirtualserver.org/) provides. But we would like to reduce the complexity in our environment a bit. If somebody is interested to implement this feel free to contact me. If possible with an amount of expected reward. Kind regards, Bernhard Czech -- Bernhard Czech nobisCum Individual GmbH [T] +49 (0) 931 / 79 66 7-90 44 [F] +49 (0) 931 / 79 66 7-29 [M] +49 (0)175 / 90 51 45 8 [@] Bernhard.Czech(a)nobiscum.de [URL] www.nobiscum.de [Anschrift] Sedanstraße 23, 97082 Würzburg, Germany [Registergericht] Würzburg, HRB 5159 [Geschäftsführer] Markus Frisch, Hans-Peter Holl

1 0

Tunnel traffic from a network interface
by Kjetil Holien 23 Nov '08

23 Nov '08

Hi! Is it possible to capture traffic from one network interface on one computer, tunnel it to a second computer by stunnel and then send it through a network interface on that computer? This without changing any data on the network traffic (MAC adresses, IP etc). Thanks for any answers! greetings, Kjetil

1 0

Amount of FD's per connection
by Koornstra, Reinoud 21 Nov '08

21 Nov '08

Hi, I am using stunnel compiled to use threads. I read in the faq that a connection may use 1 to 4 fd's per connection. Normally this is only one, how can I influence this, I mean making sure there is one fd per connection? I also wish to limit the amount of max connections at the same time. Perhaps the most easy way is limit the amount of fd's per process with ulimit. However, depending on how many fd's are needed per connection it is difficult to set right now. Kind Regards, Reinoud.

2 2

xforwardedfor patch for 4.26?
by Chris Charman 19 Nov '08

19 Nov '08

Has anyone done such a thing? Alternately, are there good instructions someplace for setting up transparent proxy?

1 0

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 19 Nov '08

19 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/19/08 03:20 am, kith walls wrote: > When connecting to SBC/Yahoo you need to front the session with HTTP. > I am not clear what you mean. Would you give an example? >> Hello, >> Stunnel v4.20. >> When connecting to SBC/Yahoo, the session is > terminated >> with a "bad certificate" message. See the > log below. The tech folks claim >> all is well at their end. >> Is there something I am missing here? >> Here is the conf file: > - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJJEsmzTcr8Prq0ZMRAjiTAJ9n/nZO2zaZemqvsU2Y1ge30OYdJQCeN3Oc Wj0dFPjjSH7qbV5d5L/F3ck= =ijQ0 -----END PGP SIGNATURE-----

1 0

Proxy support in configuration file?
by Reinier van der Gugten 19 Nov '08

19 Nov '08

Is there proxy support for Stunnel, and if so, how do I specify the proxy server in the configuration file? If it is not supported, can you give me a price estimate on what it would cost to add it? Greetings, Reinier. E.g. I want to connect to an external location at: Myserver.com:443 The proxy is at: CustomerProxy:8080 And my application runs at the customer talking to: localhost:1433 The proxy does not require authentication. Looking at the docuemtation you linked me I found this example: CONNECT server.example.com:80 HTTP/1.1 Host: server.example.com:80 Proxy-Authorization: basic aGVsbG86d29ybGQ= Using my addresses, where goes what? CONNECT CustomerProxy:8080 HTTP/1.1 Host: Myserver.com:443 // Proxy-Authorization: basic aGVsbG86d29ybGQ= Kind regards, Reinier -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users-bounces@mirt.net] On Behalf Of Michal Trojnara Sent: vrijdag 14 november 2008 15:04 To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Proxy support On Fri, 14 Nov 2008 14:53:20 +0100, "Reinier van der Gugten" <info(a)rgit.eu> wrote: > Has someone got a working version of STunnel that can handle a proxy? Do you mean client mode CONNECT protocol support (RFC 2817 section 5.2)? http://www.ietf.org/rfc/rfc2817.txt It's supported in stunnel since version 4.15 (released 2006.03.11). Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

stunnel and expiring CRLs
by Jason Haar 19 Nov '08

19 Nov '08

Hi there Is stunnel capable of re-reading updated CRLs on the fly? Without needing to be restarted? I have tried both CRLfile and CRLpath (with the hashes) with no luck. It appear stunnel only reads them on startup and never refers to them again? There also seems to be no option to send a HUP or the like to force a re-read - only a full restart will make stunnel re-read the CRLs. i.e. our system works after a fresh restart until the original CRL expires, and then stunnel starts rejecting new connections with "Found CRL is expired - revoking all certificates until you get updated CRL" - even though there have been several CRL file (and hash) updates in between. Restarting stunnel makes it start working again. I've googled around and see several other people have asked similar questions over the years, and there are references by Michal Trojnara that it should work? This is stunnel-4.14-2 under CentOS5 with openssl-0.9.8b-8.3.el5_0.2. No chroot jail Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

4 5

Connection rejected: too many clients (>=500)?
by Chris Charman 18 Nov '08

18 Nov '08

Hey folks -- Can anyone tell me where the max number of clients is configured in 4.21? I'm running okay for a while, but then I end up with repeated messages as below in the logs: 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) [...] I've only seen reports of this problem, but no solution. Anyone out there who can help? Thanks in advance! -Chris ------------- Config below ----------------- ulimit unlimited stunnel -version stunnel 4.21 on x86_64-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none uname -a Linux domU-12-31-39-01-61-B2 2.6.21.7-2.fc8xen #1 SMP Fri Feb 15 12:34:28 EST 2008 x86_64 GNU/Linux stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 gcc -v Using built-in specs. Target: x86_64-linux-gnu Configured with: ../src/configure -v --enable-languages=c,c++,fortran,objc,obj-c++,treelang --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.2 --program-suffix=-4.2 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu Thread model: posix gcc version 4.2.3 (Ubuntu 4.2.3-2ubuntu7) openssl version OpenSSL 0.9.8g 19 Oct 2007

2 2

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 18 Nov '08

18 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/18/08 10:17 am, James Moe wrote: > Hello, > Stunnel v4.20. > When connecting to SBC/Yahoo, the session is terminated > with a "bad certificate" message. See the log below. The tech folks claim > all is well at their end. > Is there something I am missing here? > Here is the conf file: > My apologies. I lost control of the email program and it sent this message here instead of to a local host. - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJIvmqzTcr8Prq0ZMRAsb2AJ9ROwt9FH4GpfyNWQ020rpGmC7K/wCdGhdW Bs96qyJjjXSA9d+AwVktAac= =+UNT -----END PGP SIGNATURE-----

1 0