- stunnel-users - stunnel.org

Using Stunnel for ICMP traffic
by Montoya_Paul＠emc.com 03 Dec '04

03 Dec '04

Dear group, Would anyone know how I can go about setting up Stunnel to tunnel all ICMP traffic between two systems? I'm just looking for the basic steps required in the process. Any useful documentation links would be great. Thank you much in advance. Regards, > Paul Montoya > Associate Implementation Specialist > Scottsdale, AZ > EMC² > where information lives > http://www.emc.com <http://www.emc.com>

2 1

same questions about problems with stunnel-4.05 and the old 3.2x command line
by 86493293＠gmx.net 02 Dec '04

02 Dec '04

Hi Michal, i'm using stunnel since version 3.2x and now i'm trying to switch to version 4.05. but there still some problems left so i searched the "net" and found only one article about this problems (http://stunnel.mirt.net/pipermail/stunnel-users/2004-August/000013.html) but this solution seems not to work for me or i'm a little bit to stupid to understand it. i used 3.2x with the following command line: $ stunnel -P ~/ -v2 -A ./publickey.pem -p privatekey.pem -r target_host.net:666 -c -d 127.0.0.1:7777 Then i tried to write me my own config-file for stunnel-4.05. $ cat /etc/stunnel/stunnel.conf # pid is created in an jail pid = /home/user/.stunnel/stunnel.pid # Some debugging stuff debug = 7 output = /home/user/.stunnel/stunnel.log # use it for client mode client = yes foreground = yes # Authentification verify = 3 cert = /home/user/privatekey.pem CAfile = /home/user/publickey.pem # Service-Level Configuration [application] accept = 127.0.0.1:666 connect = targethost.net:7777 But this one does not work. The stunnel.log told me this: $ cat /home/user/stunnel.log 2004.12.01 22:20:12 LOG5[15233:1006686208]: stunnel 4.05 on i386-unknown-openbsd3.6 PTHREAD+LIBWRAP with OpenSSL 0.9.7d 17 Mar 2004 2004.12.01 22:20:12 LOG7[15233:1006686208]: Snagged 64 random bytes from /dev/arandom 2004.12.01 22:20:12 LOG7[15233:1006686208]: RAND_status claims sufficient entropy for the PRNG 2004.12.01 22:20:12 LOG6[15233:1006686208]: PRNG seeded successfully 2004.12.01 22:20:12 LOG7[15233:1006686208]: Certificate: /home/privatekey.pem 2004.12.01 22:20:12 LOG7[15233:1006686208]: Key file: /home/user/privatekey.pem 2004.12.01 22:20:12 LOG7[15233:1006686208]: Loaded verify certificates from /home/user/publickey.pem 2004.12.01 22:20:12 LOG5[15233:1006686208]: FD_SETSIZE=1024, file ulimit=128 -> 61 clients allowed 2004.12.01 22:20:12 LOG7[15233:1006686208]: FD 7 in non-blocking mode 2004.12.01 22:20:12 LOG7[15233:1006686208]: SO_REUSEADDR option set on accept socket 2004.12.01 22:20:12 LOG7[15233:1006686208]: application bound to 127.0.0.1:666 2004.12.01 22:20:12 LOG7[15233:1006686208]: FD 8 in non-blocking mode 2004.12.01 22:20:12 LOG7[15233:1006686208]: FD 9 in non-blocking mode 2004.12.01 22:20:12 LOG7[15233:1006686208]: Created pid file /var/run/stunnel.pid It looks for me normal but i can not connect to this local port and i can not seen the "stunnel" as an process in my "ps -al |grep stunnel". And there is no error message or something like that. But when i try to connect to this local adress 127.0.0.1:666 i get always an "lost connection". Please tell me if my config-file is right?! So i know that the mistake must be at the "application" and not in my stunnel.conf. Thx for your help! With Regards Mario -- GMX ProMail mit bestem Virenschutz http://www.gmx.net/de/go/mail +++ Empfehlung der Redaktion +++ Internet Professionell 10/04 +++

1 0

Q: stunnel checking of certs?
by Heiko Nardmann 02 Dec '04

02 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi together! Two questions: 1) does stunnel read the cert files/directories only once at startup or every time it has to check a certificate? 2) does stunnel support CRLs? e.g. getting the CRL via LDAP? - -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de) Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFBrIIEpm53PRScYygRAtQ6AKC9JSTTK7mAL+51JSWkTI5U52HtJQCeMvCR gEiUxqi43/pFMD/3dR6hVeE= =MFLP -----END PGP SIGNATURE-----

2 2

Compiling on Solaris
by Didier Gehéniau 01 Dec '04

01 Dec '04

Hi all, The problem i have, i found a lot on the internet. Unfortunatly non of the solutions (if there was one) did nog help. When doing ./configure i get the folowing output: [snip] checking for a BSD-compatible install... auto/install-sh -c checking whether build environment is sane... yes checking whether make sets $(MAKE)... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking build system type... sparc-sun-solaris2.8 checking host system type... sparc-sun-solaris2.8 checking for gcc... gcc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for a BSD-compatible install... auto/install-sh -c checking whether make sets $(MAKE)... (cached) yes checking for ld used by GCC... /usr/ccs/bin/ld checking if the linker (/usr/ccs/bin/ld) is GNU ld... no checking for /usr/ccs/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/local/bin/nm -B checking for a sed that does not truncate output... /usr/bin/sed checking whether ln -s works... yes checking how to recognise dependent libraries... pass_all checking command to parse /usr/local/bin/nm -B output... ok checking how to run the C preprocessor... gcc -E checking for egrep... egrep checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... ranlib checking for strip... strip checking for objdir... .libs checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.lo... yes checking if gcc supports -fno-rtti -fno-exceptions... yes checking whether the linker (/usr/ccs/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking dynamic linker characteristics... solaris2.8 ld.so checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no creating libtool checking for SSL directory... /usr/local/ssl checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for dlopen in -ldl... yes checking for shl_load in -ldld... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... yes checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... no checking whether to use the libwrap (TCP wrappers) library... (default) checking for hosts_access in -lwrap... no checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... yes checking sys/filio.h presence... yes checking for sys/filio.h... yes checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... no checking for _getpty... no checking for daemon... no checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for setsid... yes checking for unsigned char... yes checking size of unsigned char... configure: error: cannot compute sizeof (unsigned char), 77 See `config.log' for more details. [/snip] I installed gstdint.h and linked stdint.h to it. (should be a solution for some persons) gcc -v gives: [snip] Reading specs from /usr/local/lib/gcc/sparc-sun-solaris2.8/3.4.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.4.2 [/snip] Anyone an Idee? Regards, Didier

2 1

Re: [stunnel-users] How use certificates with stunnel -- Newbie question
by mtrojnar＠mirt 28 Nov '04

28 Nov '04

Shatadal wrote: I guess there's a client=yes here. > # IMAP service, listens on localhost:1200 > [myisp-imaps] > accept=localhost:1200 > connect=myisp.com:993 Ok. IMAPS port is 993. > # SMTP service, listens on localhost:260 > [myisp-smtps] > accept=localhost:260 > connect=myisp.com:25 You either need to switch from SMTP to SSMTP: [myisp-ssmtp] accept=localhost:260 connect=myisp.com:465 or enable SMTP SSL protocol negotiation: [myisp-smtp-ssl] accept=localhost:260 connect=myisp.com:25 protocol=smtp (whatever is supported by your ISP) Best regards, Mike

2 3

How use certificates with stunnel -- Newbie question
by Shatadal 25 Nov '04

25 Nov '04

Hi, I am a new user of stunnel and I am using it to connect to some SSL enabled e-mail accounts. Instead of directly connecting to the mail server I am connecting to it via stunnel so that my e-mail scanner scan the messages before sending it to the mail server (it does not natively support SSL connections) My setup: OS: Win XP Home edition. All updates are installed except for service pack 2. E-mail client: Mozilla Thunderbird 0.9 E-mail scanner : Alwil Avast 4.5 I have an e-mail account at myisp.com. To connect to myisp I need to enable SSL. On connecting via SSL I get a certificate which I can choose to accept permanently, temporarily for the current session or reject it. Alwil Avast mail scanner does not support scanning of e-mail sent and received over SSL. So to enable it to scan such e-mail, my client connects to localhost where stunnel is listening and stunnel forwards the connection to my isp. This is my stunnel.conf file # IMAP service, listens on localhost:1200 [myisp-imaps] accept=localhost:1200 connect=myisp.com:993 # SMTP service, listens on localhost:260 [myisp-smtps] accept=localhost:260 connect=myisp.com:25 Unfortunately while the IMAP connection works perfectly the SMTP does not. Thunderbird keeps sending the message until I cancel it. This is the log file 2004.11.25 03:10:03 LOG5[2508:3848]: myisp-smtps connected from 127.0.0.1:2751 2004.11.25 03:10:08 LOG3[2508:3848]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2004.11.25 03:11:03 LOG5[2508:192]: myisp-smtps connected from 127.0.0.1:2755 2004.11.25 03:11:08 LOG3[2508:192]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2004.11.25 13:36:40 LOG5[2508:2112]: myisp-smtps connected from 127.0.0.1:4818 2004.11.25 13:36:45 LOG3[2508:2112]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2004.11.25 14:01:44 LOG5[2508:3208]: myisp-smtps connected from 127.0.0.1:1188 2004.11.25 14:01:50 LOG3[2508:3208]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I am guessing the problem is something to do with the handling of the certificate I get when I use my client to connect directly to the SMTP server via SSL. Can someone explain to me how to make stunnel accept the certificate and continue the SSL transaction? I tried to read through the faq for certificates but I couldn't understand how it was to be done. Thanks, Shatadal. --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 0448-0, 11/23/2004 Tested on: 11/25/2004 3:46:33 PM avast! - copyright (c) 2000-2004 ALWIL Software. http://www.avast.com

1 0

Sercure POP from Outlook Express using Stunnel on a linux server to talk to an exchance server.
by CONN, Aurelia 25 Nov '04

25 Nov '04

Hi I'm just about to investigate setting up a secure pop connection to an exchange server - can anyone point to helpfull resources or say if it can/cannot be done. Using Outlook (Express) as mail client SSL and Stunnel installed on Redhat 9 Mailserver is Exchange 5.5 on Windows NT 4.0 For example, will I have to configure/install on all three boxes? All my initial testing will be done internally so no firewall issues at this stage. Thanks in advance. Oz. ________________________________________________________________________ airwide solutions has changed its email address format to firstname.lastname(a)airwidesolutions.com. Any slb.com email addresses are no longer valid. If you experience difficulty contacting our staff, please email info(a)airwidesolutions.com. ________________________________________________________________________

1 0

SSL Engine patch on Windows?
by Kartik Subbarao 22 Nov '04

22 Nov '04

I'm trying to use stunnel with the SSL Hardware Engine patch (posted by Neil Dunbar to this mailing list in March) on Windows. I apply the patch to the 4.05 codebase and build stunnel with MinGW. I'm able to use stunnel normally without exercising any hardware engine functionality. This tells me that the basics are working. I then run stunnel with the config file containing the following kinds of hardware engine parameters: SSLEngine=c:\windows\system32\engine_pkcs11.dll SSLEngineOpt=MODULE_PATH=c:\windows\system32\acpkcs201.dll But when I run stunnel, I get errors with dynamic library loading like: error stack: 260B6084 : error:260B6084:engine routines:DYNAMIC_LOAD:dso not found And similar errors like that. This gives me the impression that I haven't linked stunnel properly on windows to be able to use OpenSSL dynamic libraries. Or perhaps some other explanation that I don't understand :-) Is it possible to compile stunnel on Windows (either with MinGW or with Visual C++) to be able to use the hardware engine patch? Any pointers/assistance would be greatly appreciated. Thanks, -Kartik

1 3

Faulting application stunnel-4.05.exe
by Paulo Cesar Soares da Silva 18 Nov '04

18 Nov '04

stunnel-4.05.exe executed as a service presents the following problems: Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8. Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module libeay32.dll, version 0.0.0.0, fault address 0x000564ec. The application, C:\Program Files\Crivo\tn3270\stunnel-4.05.exe, generated an application error The error occurred on 11/10/2004 @ 15:37:13.875 The exception generated was c0000005 at address 6B086CD8 (libssl32!SSL_set_session) Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x000086f7. Environment: Hardware IBM 86496BX Dual processor 3 GHz Software OS Name Microsoft(R) Windows(R) Server 2003, Standard Edition , Version 5.2.3790 Build 3790 The following files are in same folder (..\Program Files\Teste\Stunnel) stunnel-4.05.exe, 4.05 libeay32.dll, openssl-0.9.7d-zlib libssl32.dll, openssl-0.9.7d-zlib Comntents of stunnel.conf: client = yes verify = 0 service = stunnel 4.05 options = DONT_INSERT_EMPTY_FRAGMENTS [data] accept = localhost:3500 connect = www.teste.com.br:443 delay = yes I would appreciate if anyone can help me on this? many thanks in advance! Paulo Cesar Soares da Silva (11) 3231-5396 pcesar(a)crivo.com.br --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.794 / Virus Database: 538 - Release Date: 10/11/2004

1 0

List of Distinguished names in Certificate Request message
by Diarmuid O'Neill 17 Nov '04

17 Nov '04

Hi, At the moment, stunnel's client certificate verification implementation does not include any Distinguished Names (of the trusted CA certificates configured) in the Request Certificate message. Strictly speaking this violates RFC2246 (see below, apologies for formatting), but to date I've only seen one client that has a problem with it. Explorer deals with this by displaying all available user certificates. If the Distinguished Names are included in the cert req it only displays client certs signed by the appropriate CAs. The patch below does the necessary openssl bits and pieces to make up the lists of DNs so they're sent with the certificate requests. This has been tested under linux only. 7.4.4. Certificate request When this message will be sent: A non-anonymous server can optionally request a certificate from the client, if appropriate for the selected cipher suite. This message, if sent, will immediately follow the Server Key Exchange message (if it is sent; otherwise, the Server Certificate message). Structure of this message: enum { rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4), (255) } ClientCertificateType; opaque DistinguishedName<1..2^16-1>; struct { ClientCertificateType certificate_types<1..2^8-1>; DistinguishedName certificate_authorities<3..2^16-1>; } CertificateRequest; certificate_types This field is a list of the types of certificates requested, sorted in order of the server's preference. certificate_authorities A list of the distinguished names of acceptable certificate authorities. These distinguished names may specify a desired distinguished name for a root CA or for a subordinate CA; thus, this message can be used both to describe known roots and a desired authorization space. Note: DistinguishedName is derived from [X509]. Note: It is a fatal handshake_failure alert for an anonymous server to request client identification. Thanks, Diarmuid. <<stunnel-4.05_ca_list.patch>> ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the postmaster at the address below. ITS-Support(a)aepsystems.com Unless the contrary is specifically indicated above nothing in this message is intended to constitute an electronic signature within the meaning of the Electronic Commerce Act 2000 or similar legislation enacted elsewhere in the world. This footnote also confirms that this email message has been swept for the presence of computer viruses. *****************************************************************************

2 1