- stunnel-users - stunnel.org

UDP applications
by Paul 20 Dec '04

20 Dec '04

Hi all, Is there any roadmap for Stunnel to support UDP applications? Cant a simple UDP forwarder (with proper buffering to ensure a tcp-like stream of data) do the job? May be this topic is discussed and brainstormed before. I couldnot find any relevant details about this in the archives. Thanks and Regards, Paul

2 1

Need help: verification of client and server certificates
by Mike_Stunnel 20 Dec '04

20 Dec '04

For my Stunnel server, I'm using Windows ME, OpenSSL 0.9.7e and Stunnel 4.05. I've create my own Certificate Authority on my server and created and signed a server and multiple client certificates for Stunnel. I plan to use Stunnel to secure my VNC connections to my PC - to encrypt the traffic and to validate the clients. On the server side: ------------------- I want to limit connections to my Stunnel server to only those Stunnel clients that present a client certificate that I already have a copy of on my server. And I want Stunnel server to only recognize my own Certificate Authority as a valid CA for the clients' certificates. Is this possible? What options do I need to specify in the Stunnel server configuration file to make this work? The documentation is confusing to me - for example, do I use CAfile or CApath to point Stunnel to the the CA certificate? Will Stunnel recognize other CAs as trusted, if their certificates have been loaded by other programs like a browsers or mail reader? Etcetera .. On the client side: ------------------- As with the server, I want my Stunnel client to only recognize my own CA as trusted. And I want it to validate the server certificate as thoroughly as possible. Is that verify level 3? I need the CA certificate on my client, but do I use CAfile or CAcert in the config file to point to it? Do I need a copy of the server certificate on my client so that the client can verify the server's certificate? I'm so confused! I've read the FAQ and Related links on stunnel.org and also the past 4 months' mailing list digests but I'm still not clear on the certificate verification process. or all the options in the configuration file.

1 0

Socks Support
by Paul 15 Dec '04

15 Dec '04

I have been working/using stunnel for quite sometime... I am using it along with SOcks. So was wondering is there anyone who is already working on providing socks (v4 or v5) support to existing stunnel? Also is there any1 else who is also requires socks functionality in stunnel? Thanks and Regards, Paul.

2 1

Stunnel Keeps Closing Connections with an Error
by Jerry Baker 09 Dec '04

09 Dec '04

I am using Stunnel 4.05 on Windows 98/XP to connect VNC clients to a Windows XP server. I am continually getting disconnected by Stunnel with the following error: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac I have tried using the OpenSSL 0.9.7d binaries from stunnel.org AND compiling OpenSSL 0.9.7e myself. Either way, the same result. Thanks in advance.

1 0

SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate
by Ron Kindermann 09 Dec '04

09 Dec '04

Hello, I use stunnel on WinXP to connect to my ISP's pops server and get the following error message in my log: 2004.12.09 12:47:09 LOG5[4888:6096]: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7e 25 Oct 2004 2004.12.09 12:47:11 LOG5[4888:4612]: WIN32 platform: 30000 clients allowed 2004.12.09 12:47:46 LOG5[4888:5432]: pops.xs4all.nl:995 connected from 127.0.0.1:61950 2004.12.09 12:47:46 LOG5[4888:5432]: VERIFY IGNORE: depth=0, /C=NL/ST=Noord Holland/L=Diemen/O=XS4ALL Internet B.V./CN=pops.xs4all.nl 2004.12.09 12:47:46 LOG5[4888:5432]: VERIFY IGNORE: depth=0, /C=NL/ST=Noord Holland/L=Diemen/O=XS4ALL Internet B.V./CN=pops.xs4all.nl 2004.12.09 12:47:46 LOG5[4888:5432]: VERIFY IGNORE: depth=0, /C=NL/ST=Noord Holland/L=Diemen/O=XS4ALL Internet B.V./CN=pops.xs4all.nl 2004.12.09 12:47:46 LOG3[4888:5432]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate This is my config: CAfile = xxxxx cert = xxxxx CRLpath = xxxxx client = yes # debug = 4 key = xxxxx options = DONT_INSERT_EMPTY_FRAGMENTS output = stunnel.log RNDbytes = 64 RNDfile = .rnd RNDoverwrite = yes service = Stunnel client session = 300 taskbar = no verify = 0 [pops.xs4all.nl:995] accept = 127.0.0.1:5000 connect = pops.xs4all.nl:995 delay = yes [pop.gmail.com:995] accept = 127.0.0.1:5003 connect = pop.gmail.com:995 delay = yes The "xxxxx" are good filepaths because I can connect to pop.gmail.com:465 just fine. Anyone got a clue where to look? Thanks, Ron

1 1

cannot connect to gmail (STARTTLS trouble ?)
by Sebastien WILLEMIJNS 05 Dec '04

05 Dec '04

hello, i'm trying to test gmail SMTP server with postie (a commandline poster) and stunnel.... POP access to port 995 is OK SMTP access with gmail is bad (authentification failed) SMTP access with gmx.net and vfemail.net is OK In eudora software , it speak about 3 methods to use SSL, how to try in stunnel these method ? ********************* STUNNEL.CNF client = yes [X]>> stunnel.cnf accept = 1664 connect = smtp.gmail.com:465 ******************** WIN32 COMMANDLINE IS "stunne~1.exe stunnel.cnf" ********************* EUDORA DOC The Generic Properties tab is used to set the SSL options for sending mail (SMTP). The available options are: * Never -- tells Eudora not to use SSL * If Available, STARTTLS -- tells Eudora to use SSL if it is available * Required, Alternate Port -- tells Eudora that the use of SSL is required, on the alternate port (more on this in a minute) * Required, STARTTLS -- tells Eudora that the use of SSL is required *********************** MY GMAIL LOG here's the log i have +OK Gpop ready. USER willemijns(a)gmail.com +OK send PASS PASS xxxxxxxx +OK Welcome. STAT +OK 0 0 There are 0 messages waiting (0 bytes) QUIT +OK Farewell. %%%%%%%%%%% 220 smtp.gmail.com ESMTP 79sm7704rna EHLO 80-125-222-144.dti.cegetel.net 250-smtp.gmail.com at your service 250-SIZE 20971520 250-8BITMIME 250-AUTH PLAIN LOGIN 250 ENHANCEDSTATUSCODES AUTH PLAIN 334 = AHXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX2 235 2.7.0 Accepted EHLO 80-125-222-144.dti.cegetel.net 250-smtp.gmail.com at your service 250-SIZE 20971520 250-8BITMIME 250-AUTH PLAIN LOGIN 250 ENHANCEDSTATUSCODES Connected to 'smtp.gmail.com:465' MAIL FROM:<willemijns(a)gmail.com> 530 5.7.0 Authentication Required Could not send: error= -1 Status: 530 5.7.0 Authentication Required **********i've noticied when it works well (with GMX.NET) i can see "250 STARTTLS" as: Query for (NS) 'runbox.com' [127.0.0.1] MX/A server (0) = '' 220 {mp009} GMX Mailservices ESMTP EHLO localhost 250-{mp009} GMX Mailservices 250-8BITMIME 250-ENHANCEDSTATUSCODES 250-AUTH=LOGIN CRAM-MD5 PLAIN 250-AUTH CRAM-MD5 LOGIN PLAIN 250 STARTTLS AUTH PLAIN 334 Go on AHXXXXXXXXXXXXXXXXXXXXXXXXXXX== 235 2.7.0 {mp009} Go ahead EHLO localhost 250-{mp009} GMX Mailservices 250-8BITMIME 250-ENHANCEDSTATUSCODES 250-AUTH=LOGIN CRAM-MD5 PLAIN 250-AUTH CRAM-MD5 LOGIN PLAIN 250 STARTTLS Connected to '127.0.0.1:1664' MAIL FROM:<willemijns(a)gmx.net> 250 2.1.0 {mp009} ok RCPT TO:<vivil(a)runbox.com> 250 2.1.5 {mp009} ok DATA 354 {mp009} Go ahead To: vivil(a)runbox.com (...) thanks of your help :-) ----- End Forwarded Message ----- ----- End Forwarded Message -----

1 0

Using Stunnel for ICMP traffic
by Montoya_Paul＠emc.com 03 Dec '04

03 Dec '04

Dear group, Would anyone know how I can go about setting up Stunnel to tunnel all ICMP traffic between two systems? I'm just looking for the basic steps required in the process. Any useful documentation links would be great. Thank you much in advance. Regards, > Paul Montoya > Associate Implementation Specialist > Scottsdale, AZ > EMC² > where information lives > http://www.emc.com <http://www.emc.com>

2 1

same questions about problems with stunnel-4.05 and the old 3.2x command line
by 86493293＠gmx.net 02 Dec '04

02 Dec '04

Hi Michal, i'm using stunnel since version 3.2x and now i'm trying to switch to version 4.05. but there still some problems left so i searched the "net" and found only one article about this problems (http://stunnel.mirt.net/pipermail/stunnel-users/2004-August/000013.html) but this solution seems not to work for me or i'm a little bit to stupid to understand it. i used 3.2x with the following command line: $ stunnel -P ~/ -v2 -A ./publickey.pem -p privatekey.pem -r target_host.net:666 -c -d 127.0.0.1:7777 Then i tried to write me my own config-file for stunnel-4.05. $ cat /etc/stunnel/stunnel.conf # pid is created in an jail pid = /home/user/.stunnel/stunnel.pid # Some debugging stuff debug = 7 output = /home/user/.stunnel/stunnel.log # use it for client mode client = yes foreground = yes # Authentification verify = 3 cert = /home/user/privatekey.pem CAfile = /home/user/publickey.pem # Service-Level Configuration [application] accept = 127.0.0.1:666 connect = targethost.net:7777 But this one does not work. The stunnel.log told me this: $ cat /home/user/stunnel.log 2004.12.01 22:20:12 LOG5[15233:1006686208]: stunnel 4.05 on i386-unknown-openbsd3.6 PTHREAD+LIBWRAP with OpenSSL 0.9.7d 17 Mar 2004 2004.12.01 22:20:12 LOG7[15233:1006686208]: Snagged 64 random bytes from /dev/arandom 2004.12.01 22:20:12 LOG7[15233:1006686208]: RAND_status claims sufficient entropy for the PRNG 2004.12.01 22:20:12 LOG6[15233:1006686208]: PRNG seeded successfully 2004.12.01 22:20:12 LOG7[15233:1006686208]: Certificate: /home/privatekey.pem 2004.12.01 22:20:12 LOG7[15233:1006686208]: Key file: /home/user/privatekey.pem 2004.12.01 22:20:12 LOG7[15233:1006686208]: Loaded verify certificates from /home/user/publickey.pem 2004.12.01 22:20:12 LOG5[15233:1006686208]: FD_SETSIZE=1024, file ulimit=128 -> 61 clients allowed 2004.12.01 22:20:12 LOG7[15233:1006686208]: FD 7 in non-blocking mode 2004.12.01 22:20:12 LOG7[15233:1006686208]: SO_REUSEADDR option set on accept socket 2004.12.01 22:20:12 LOG7[15233:1006686208]: application bound to 127.0.0.1:666 2004.12.01 22:20:12 LOG7[15233:1006686208]: FD 8 in non-blocking mode 2004.12.01 22:20:12 LOG7[15233:1006686208]: FD 9 in non-blocking mode 2004.12.01 22:20:12 LOG7[15233:1006686208]: Created pid file /var/run/stunnel.pid It looks for me normal but i can not connect to this local port and i can not seen the "stunnel" as an process in my "ps -al |grep stunnel". And there is no error message or something like that. But when i try to connect to this local adress 127.0.0.1:666 i get always an "lost connection". Please tell me if my config-file is right?! So i know that the mistake must be at the "application" and not in my stunnel.conf. Thx for your help! With Regards Mario -- GMX ProMail mit bestem Virenschutz http://www.gmx.net/de/go/mail +++ Empfehlung der Redaktion +++ Internet Professionell 10/04 +++

1 0

Q: stunnel checking of certs?
by Heiko Nardmann 02 Dec '04

02 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi together! Two questions: 1) does stunnel read the cert files/directories only once at startup or every time it has to check a certificate? 2) does stunnel support CRLs? e.g. getting the CRL via LDAP? - -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de) Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFBrIIEpm53PRScYygRAtQ6AKC9JSTTK7mAL+51JSWkTI5U52HtJQCeMvCR gEiUxqi43/pFMD/3dR6hVeE= =MFLP -----END PGP SIGNATURE-----

2 2

Compiling on Solaris
by Didier Gehéniau 01 Dec '04

01 Dec '04

Hi all, The problem i have, i found a lot on the internet. Unfortunatly non of the solutions (if there was one) did nog help. When doing ./configure i get the folowing output: [snip] checking for a BSD-compatible install... auto/install-sh -c checking whether build environment is sane... yes checking whether make sets $(MAKE)... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking build system type... sparc-sun-solaris2.8 checking host system type... sparc-sun-solaris2.8 checking for gcc... gcc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for a BSD-compatible install... auto/install-sh -c checking whether make sets $(MAKE)... (cached) yes checking for ld used by GCC... /usr/ccs/bin/ld checking if the linker (/usr/ccs/bin/ld) is GNU ld... no checking for /usr/ccs/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/local/bin/nm -B checking for a sed that does not truncate output... /usr/bin/sed checking whether ln -s works... yes checking how to recognise dependent libraries... pass_all checking command to parse /usr/local/bin/nm -B output... ok checking how to run the C preprocessor... gcc -E checking for egrep... egrep checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... ranlib checking for strip... strip checking for objdir... .libs checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.lo... yes checking if gcc supports -fno-rtti -fno-exceptions... yes checking whether the linker (/usr/ccs/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking dynamic linker characteristics... solaris2.8 ld.so checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no creating libtool checking for SSL directory... /usr/local/ssl checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for dlopen in -ldl... yes checking for shl_load in -ldld... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... yes checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... no checking whether to use the libwrap (TCP wrappers) library... (default) checking for hosts_access in -lwrap... no checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... yes checking sys/filio.h presence... yes checking for sys/filio.h... yes checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... no checking for _getpty... no checking for daemon... no checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for setsid... yes checking for unsigned char... yes checking size of unsigned char... configure: error: cannot compute sizeof (unsigned char), 77 See `config.log' for more details. [/snip] I installed gstdint.h and linked stdint.h to it. (should be a solution for some persons) gcc -v gives: [snip] Reading specs from /usr/local/lib/gcc/sparc-sun-solaris2.8/3.4.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.4.2 [/snip] Anyone an Idee? Regards, Didier

2 1