- stunnel-users - stunnel.org

stunnel 4.0.6 stunnel uid/gid removal
by Noah 30 Dec '04

30 Dec '04

stunnel-4.0.6 FreeBSD-4.9 I just installed stunnel 4.0.6 and noticed during the portinstall that the defualt behavior was to remove the stunnel uid and gid. can somebody clue me in as to why this was the Process? I cant find any relevant information on the web. cheers, Noah

2 1

engine-patch
by Alexander Lazic 29 Dec '04

29 Dec '04

Hi, we have a the following openssl: --- OpenSSL 0.9.7d 17 Mar 2004 built on: Wed Nov 3 13:28:35 CET 2004 platform: solaris-sparcv9-gcc options: bn(64,32) md2(int) rc4(ptr,char) des(idx,cisc,16,long) idea(int) blowfish(ptr) compiler: gcc -DOPENSSL_SYSNAME_ULTRASPARC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_KRB5 -DOPENSSL_NO_ENGINE -m32 -mcpu=ultrasparc -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W -DMD5_ASM --- We don't have the engine enabled therefore the current stunnel don't compile :-( I have attached the patch for the current (4.06) stunnel version. BTW: I need the 'X-Forwarded-For' header, in where is the right position to add it in the 4.06 version. I think in 'src/client.c => transfer()' but i'am not sure, where there ;-) Thanx for help ;-) al ;-)

2 2

enforcing minimum cipher set available
by auto403973＠hushmail.com 29 Dec '04

29 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 is there a way (perhaps using extended 'options' section?), to enforce a minimum cipher strength / type for the connecting client? a solution would be to use apache 2's sslproxy to stunnel (yikes), but stunnel rocks :) apache / mod_ssl - from httpd.conf # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:- SSLv2:+EXP:+eNULL -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkHSUs4ACgkQdgNHoxEs/oi+2ACfYPDjijulcO0luIPfV2oYZ4aLWdAA niumLVXQRaEEK12TO5EF12e9ay/b =aNe8 -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get secure FREE email: http://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger http://www.hushmail.com/services-messenger?l=434 Promote security and make money with the Hushmail Affiliate Program: http://www.hushmail.com/about-affiliate?l=427

2 1

using stunnel for smb networking
by David Bear 28 Dec '04

28 Dec '04

out of curiousity, has anyone been able to use stunnel as a cheap vpn for smb/cifs windows networks? We have a stupid firewall policy that blocks ALL port 139 traffic. Yes, thats good most of the time since microsoft rpc's are notoriously insecure. It does cause a problem when we have other units at other universities with different firewall policies however, so I was hoping to go around the different bureacracies and tunnel it myself. just curious. -- David Bear phone: 480-965-8257 fax: 480-965-9189 College of Public Programs/ASU Wilson Hall 232 Tempe, AZ 85287-0803 "Beware the IP portfolio, everyone will be suspect of trespassing"

1 0

Re: [stunnel-announce] Problem with stunnel 4.06 on FreeBSD andpossibly other systems
by Michal Trojnara 28 Dec '04

28 Dec '04

Jay W. Reffner wrote: > Could you explain the problem on FreeBSD? > Do you think the problems exists in OpenBSD as well? poll() call uses a negative parameter value to indicate an infinite timeout. On some systems (like Linux) any negative value is accepted, while some other systems (like FreeBSD or HP-UX) require -1 here. On affected systems stunnel starts an infinite loop and does not accept any connections. I'm not sure if OpenBSD is affected. Best regards, Mike

1 0

Re: [stunnel-announce] Problem with stunnel 4.06 on FreeBSD andpossibly other systems
by Michal Trojnara 28 Dec '04

28 Dec '04

Jay W. Reffner wrote: > Could you explain the problem on FreeBSD? > Do you think the problems exists in OpenBSD as well? poll() call uses a negative parameter value to indicate an infinite timeout. On some systems (like Linux) any negative value is accepted, while some other systems (like FreeBSD or HP-UX) require -1 here. On affected systems stunnel starts an infinite loop and does not accept any connections. I'm not sure if OpenBSD is affected. Best regards, Mike

1 0

Re: Gmail / Eudora / SpamPal and Stunnel
by Sebastien WILLEMIJNS 28 Dec '04

28 Dec '04

(i copy message i have send via google groups) > I am running Eudora 6.2.0.14, Stunnel-4.04, SpamPal 1,583 maybe try latest build ? > Gmail REQUIRES SSL > A connection to my university email will not SEND over IMAP as you, i cannot send to gmail servers he stops now at (i have used "protocol = smtp" in options) 2004.12.23 23:24:05 LOG7[16629555:16525099]: waitforsocket: FD=124, DIR=read 2004.12.23 23:24:05 LOG7[16629555:16525099]: waitforsocket: ok 2004.12.23 23:24:05 LOG7[16629555:16525099]: <- 220 2.0.0 Ready to start TLS. 2004.12.23 23:24:05 LOG5[16629555:16525099]: Protocol negotiation succeded 2004.12.23 23:24:05 LOG7[16629555:16525099]: SSL state (connect): before/connect initialization 2004.12.23 23:24:05 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write client hello A 2004.12.23 23:24:05 LOG7[16629555:16525099]: waitforsocket: FD=124, DIR=read 2004.12.23 23:24:06 LOG7[16629555:16525099]: waitforsocket: ok 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read server hello A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read server certificate A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read server done A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write client key exchange A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write change cipher spec A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write finished A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 flush data 2004.12.23 23:24:06 LOG7[16629555:16525099]: waitforsocket: FD=124, DIR=read 2004.12.23 23:24:06 LOG7[16629555:16525099]: waitforsocket: ok 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read finished A 2004.12.23 23:24:06 LOG7[16629555:16525099]: 1 items in the session cache 2004.12.23 23:24:06 LOG7[16629555:16525099]: 1 client connects (SSL_connect()) 2004.12.23 23:24:06 LOG7[16629555:16525099]: 1 client connects that finished 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 client renegotiatations requested 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 server connects (SSL_accept()) 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 server connects that finished 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 server renegotiatiations requested 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 session cache hits 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 session cache misses 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 session cache timeouts 2004.12.23 23:24:06 LOG6[16629555:16525099]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 else for mail.vfemail.net:465 /mail.gmx.net:465 without "protocol = smtp" it works well... > Yes I know Spampal and Gmail is "belt and braces" but I have a challenge > here!!!! > Justified "give up you can't" would be equally appreciated so i do... only for gmail...

1 0

ERROR: stunnel-4.06.exe file is linked to missing export ...
by Sebastien WILLEMIJNS 28 Dec '04

28 Dec '04

> When I try to start and test stunnel-4.06 on Windows ME, I get the > following error message: > The STUNNEL-4.06.EXE file is linked to missing export > WS2_32.DLL:freeaddinfo Same thing on Win98SE :X

1 0

stunnel 4.06 problems with service on XP
by Mat Leinmueller 28 Dec '04

28 Dec '04

Hi, I tried to upgrade an existing 4.04 stunnel service to 4.06 (uninstalled service, reinstalled with new version). The service gets registered correctly, when I try to start it, however, it seems not to find the stunnel.conf file. After downgrading to 4.04 everything works again. Any suggestions? Mat

2 1

Error when executing stunnel 4.06 Windows binaries as service
by Liron Newman 28 Dec '04

28 Dec '04

Hello, I'm trying to run the offical stunnel 4.06 Win32 binaries from stunnel.org as a service, but I get the following error: "The procedure entry point freeaddrinfo could not be located in the dynamic link library WS2_32.DLL" I looked it up a bit and it seems to have something to do with IPv6, but I don't use it.. stunnel 4.05 works fine as a service, and worked without a problem for months now. I'm using Win2k SP4 fully patched. Help? :)

2 1