- stunnel-users - stunnel.org

any way to search the archives?
by grimholtz＠mailbolt.com 19 Oct '04

19 Oct '04

Hi, Is there any way to search the archives at http://mirt.net/pipermail/stunnel-users/ or do I just have to go through them manually? Thank you for any reply, Eric Jung

2 1

Stunnel and streaming audio
by grimholtz＠mailbolt.com 19 Oct '04

19 Oct '04

Hi, I'm using stunnel 4.05 on Windows 2000 for both client and server. I have VNC working just fine over port 443. Now I want to stream audio from the server to the client over port 21 with stunnel and any streaming audio server. I can't get this to work. I'm currently using Windows Media Encoder for streaming because it is simple and free, but I don't mind switching to SHOUTcast or something else. This is the stunnel server configuration: CAfile = CAcert.pem CApath = certificates cert = server.pem client = no verify = 3 [vnc] accept = 443 connect = 127.0.0.1:15351 [audiostream] accept = 21 connect = 127.0.0.1:80 On the client-side, I have this configuration: CAfile = CAcert.pem CApath = certificates cert = client.pem client = yes verify = 3 [vnc] accept = 127.0.0.1:15351 connect = someurl.com:443 [audiostream] accept = 127.0.0.1:80 connect = someurl.com:21 VNC works fine but streaming audio does not. It doesn't matter if I change port 21 to something else; I get the same error. The output on the server-side stunnel console is: 2004.10.18 13:16:02 LOG5[2036:1732]: audiostream connected from xxx.xxx.xxx.xxx:59090 The output on the client-side stunnel console is: 2004.10.18 13:21:07 LOG5[1088:1300]: audiostream connected from 127.0.0.1:1467 2004.10.18 13:21:07 LOG3[1088:1300]: SSL_connect: Peer suddenly disconnected stunnel -version on the server-side displays this info: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = stunnel.pem RNDbytes = 64 RNDoverwrite = yes service = stunnel session = 300 seconds taskbar = yes verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds 2004.10.18 20:47:05 LOG3[1316:2092]: Server is down openssl version on the server-side displays this info: OpenSSL 0.9.7d 17 Mar 2004 Anyone have ideas? Thank you in advance for any advice, Eric Jung

1 0

Client certificates still valid after removal with verify = 3
by Michael Brown 18 Oct '04

18 Oct '04

I'm having a problem with my stunnel 4.05 setup: We are using a setup where each client that connects has to have a valid certificate present on the filesystem (verify = 3). After the client connects once, it seems that the certificate is cached by either the SSL libraries or stunnel: stunnel.conf: <<< cert = /etc/stunnel/servercert.pem CAfile = /usr/share/ssl/CA/cacert.pem CApath = /etc/stunnel/clientdb verify = 3 [https] accept = 443 connect = remote.server.name:443 local = 192.168.0.6 >>> Some output: Oct 15 19:36:34 machine stunnel[14139]: VERIFY OK: depth=1, /C=CA/ST=Ontario/L=Here/O=Us/OU=Bigwigs/CN=CA Cert/emailAddress=certainly(a)here.com Oct 15 19:36:34 fruitfly stunnel[14139]: VERIFY OK: depth=0, /C=CA/ST=Ontario/O=Us/OU=slackers anonymous/CN=Daniel Unceman/emailAddress=dunce(a)here.com ... and the same thing after I remove the hash link in /etc/stunnel/clientdb. But only after I restart does it to the right thing: Oct 15 19:40:24 fruitfly stunnel[15247]: VERIFY OK: depth=1, /C=CA/ST=Ontario/L=Here/O=Us/OU=Bigwigs/CN=CA Cert/emailAddress=certainly(a)here.com Oct 15 19:40:24 fruitfly stunnel[15247]: VERIFY ERROR ONLY MY: no cert for /C=CA/ST=Ontario/O=Us/OU=slackers anonymous/CN=Daniel Unceman/emailAddress=dunce(a)here.com Help! We don't want to have to restart stunnel every time we remove a user. Thanks, Michael Brown -- Michael Brown {0x527670C0} | `One of the main causes of the fall of Systems Administrator | the Roman Empire was that, lacking zero, +1 519 888 7111 x2339 | they had no way to indicate successful michaelb(a)opentext.com | termination of their C programs.' - Firth

2 1

New feature
by Michal Trojnara 18 Oct '04

18 Oct '04

Dear Users, New line in stunnel 4.06 ChangeLog: - Multiple connect=host:port options are allowed in a single service section. Remote hosts are connected using round-robin algorithm. What do you think? Best regards, Mike

7 9

Using stunnel with HTTP as server and client
by Wayne A Collins 14 Oct '04

14 Oct '04

I am new to the product and encryption as well, but am looking for some unix examples using with an HTTP client and a server to communicate with HTTP/S applications. I have looked through the archives, but they only go back 3 months. I know this has had to have been done many times but am missing something. Thanks, Wayne A. Collins IBM Global Services IT Architect, eBI - Communications & Public Sectors wacollin(a)us.ibm.com 941-792-0448 Office 800-759-8888 Pin # 1019403 Pager

3 2

Re: Problem running Stunnel
by Olivier Kaloudoff 13 Oct '04

13 Oct '04

Hi Robert, > When I run stunnel nothing seems to be happening. The terminal > accepts the command but does nothing. The log file doesn't produce any > output either nor does running stunnel in the foreground. (...) > What is meant to happen when I run stunnel, is there a way that I > can test if it is working. I previously tested imapd using telnet 0 143. > I'm using this > http://www.stepwise.com/Articles/Workbench/eart.4.0.html > article but its out of date, uses 3.x command line inputs, so I've tried > to convert those to the config file. put the following in your stunnel.conf to have useful debugging informations for 4.x: # Some debugging stuff debug = 7 output = /tmp/stunnel.log # comment out pid = line, that causes problems. # (to be re-enabled later if you need) # pid = /tmp/stunnel.pid launch your stunnel process with the following: stunnel stunnel.conf and watch your logfile at the same time: tail -f /tmp/stunnel.log Regards, Olivier

1 0

Stunnel V4.05 error with rsync
by craig hobbs 12 Oct '04

12 Oct '04

Hello, I am using stunnel v4.05 with rsync v2.6.0 and solaris9 as both my client and server machine. I am running rsync in daemon mode on the server and starting an rsync transfer on the client. I am getting a frequent error where my rsync client process just appears to hang. On the client side I will receive several 'SSL_read returned WANT_: retrying/SSL_write returned WANT_: retrying' messages back-to-back and then finally the message is always 'Socket closed on read'. Some data does get transferred but it appears from the messages that the socket looses its connection, and the the rsync process just hangs until time-out. Currently in no-blocking mode with the following limits: FD_SETSIZE=1024, file ulimit=2147483647 -> 500 clients allowed Is there any stunnel bug or system resource limit that could be the problem ?? Thanks for the help. ~Craig stunnel.conf file example from client: # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 # Comment it out on Win32 cert = /usr/local/etc/stunnel/stunnel.pem #chroot = /usr/local/var/run/stunnel/ # PID is created inside chroot jail pid = /var/tmp/stunnel.pid #setuid = nobody #setgid = nogroup # Some debugging stuff debug = 7 output = /var/tmp/stunnel.log foreground = yes # Use it for client mode client = yes # Service-level configuration [rsync] accept = 8000 connect = some_host.com:20000 stunnel log file example from client: 2004.10.11 14:44:32 LOG7[26651:7]: rsync started 2004.10.11 14:44:32 LOG5[26651:7]: rsync connected local_host_ip:43586 2004.10.11 14:44:32 LOG7[26651:7]: FD 9 in non-blocking mode 2004.10.11 14:44:32 LOG7[26651:7]: rsync connecting remote_host_ip:20000 2004.10.11 14:44:32 LOG7[26651:7]: remote connect #1: EINPROGRESS: retrying 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: FD=9, DIR=write 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: ok 2004.10.11 14:44:32 LOG7[26651:7]: Remote FD=9 initialized 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): before/connect initialization 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 write client hello A 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: FD=9, DIR=read 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: ok 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 read server hello A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 read finished A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 write change cipher spec A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 write finished A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 flush data 2004.10.11 14:44:32 LOG7[26651:7]: 3 items in the session cache 2004.10.11 14:44:32 LOG7[26651:7]: 6 client connects (SSL_connect()) 2004.10.11 14:44:32 LOG7[26651:7]: 6 client connects that finished 2004.10.11 14:44:32 LOG7[26651:7]: 0 client renegotiatations requested 2004.10.11 14:44:32 LOG7[26651:7]: 0 server connects (SSL_accept()) 2004.10.11 14:44:32 LOG7[26651:7]: 0 server connects that finished 2004.10.11 14:44:32 LOG7[26651:7]: 0 server renegotiatiations requested 2004.10.11 14:44:32 LOG7[26651:7]: 3 session cache hits 2004.10.11 14:44:32 LOG7[26651:7]: 0 session cache misses 2004.10.11 14:44:32 LOG7[26651:7]: 0 session cache timeouts 2004.10.11 14:44:32 LOG6[26651:7]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc =AES(256) Mac=SHA1 2004.10.11 14:44:59 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:44:59 LOG7[26651:7]: SSL_read returned WANT_: retrying 2004.10.11 14:45:06 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:45:06 LOG7[26651:7]: SSL_read returned WANT_: retrying 2004.10.11 14:45:10 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:45:10 LOG7[26651:7]: SSL_read returned WANT_: retrying 2004.10.11 14:46:32 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:46:32 LOG7[26651:7]: SSL socket closed on SSL_read

2 1

connection timeout
by SqM 10 Oct '04

10 Oct '04

Hi! I have an application that itself has the possibility to use a backup server. I.e config of primary and secondary server. I have set up the application to connect to localhost on 2 different ports ( 1000 and 1001 ) and each of the ports are forwarded to a primary and secondary server. When testing this setup i find that if i route packets to the primary server to /dev/null in order for the application to select the secondary server the application seems to be happy since stunnel answers. After aproxx 300 seconds i can see in the log that stunnel gives up and that the application sees this. The appliation then happily selects the secondary server. The question then is if it is possible to make stunnel a little bit faster in giving up.. I.e. perhaps 30 sec instead of 300 sec. I found one setting in the client config that seems to do this but the question is.. Is this the correct way to do it.. I.e. setting "TIMEOUTbusy = 30 seconds" seems to fix my problem but is this the rigth way or is there a better way? /Sqm

2 2

RE: [stunnel-users] RE: stunnel on Solaris 2.6 or 7?
by Garg, Jai V (Jai) 10 Oct '04

10 Oct '04

I have more information. I commented out chroot in the config file and it works. #chroot = /usr/local/var/run/stunnel/ -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users-bounces@mirt.net]On Behalf Of Garg, Jai V (Jai) Sent: Friday, October 08, 2004 6:04 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] RE: stunnel on Solaris 2.6 or 7? I have more informaton on the problem. It is giving the following error when doing pthread_create() in create_client() open(/dev/zero): No such file or directory libthread panic: alloc_chunk (PID: 8605 LWP 1) stacktrace: ef3c9938 ef3c83e8 ef3c8184 ef3cebf0 ef3cbdf8 ef3cfe80 1ad24 1ba28 1bbb8 13e68 0 -----Original Message----- From: Garg, Jai V (Jai) Sent: Friday, October 08, 2004 3:42 PM To: stunnel-users(a)mirt.net Subject: stunnel on Solaris 2.6 or 7? Hello, Has anyone successfully used stunnel on Solaris 2.6 or Solaris 7? I would appreciate if you can provide the binary. I am using gcc (tried both 3.3.2 and 3.4.2) on 2.6. It compiles, but it seems to hang somewhere after accepting a connection. Here's the log: 2004.10.08 13:05:20 LOG5[21833:1]: stunnel 4.05 on sparc-sun-solaris2.6 PTHREAD with OpenSSL 0.9.7d 17 Mar 20 04 2004.10.08 13:05:20 LOG7[21833:1]: RAND_status claims sufficient entropy for the PRNG 2004.10.08 13:05:20 LOG6[21833:1]: PRNG seeded successfully 2004.10.08 13:05:20 LOG5[21833:1]: FD_SETSIZE=1024, file ulimit=64 -> 29 clients allowed 2004.10.08 13:05:20 LOG7[21833:1]: FD 4 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: SO_REUSEADDR option set on accept socket 2004.10.08 13:05:20 LOG7[21833:1]: SeS_SOCKS_NJ bound to 0.0.0.0:1373 2004.10.08 13:05:20 LOG7[21833:1]: FD 5 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: FD 6 in non-blocking mode 2004.10.08 13:05:20 LOG7[21834:1]: Created pid file /stunnel-client.pid 2004.10.08 13:05:25 LOG7[21834:1]: SeS_SOCKS_NJ accepted FD=0 from 155.184.22.17:62844 2004.10.08 13:05:25 LOG7[21834:1]: FD 0 in non-blocking mode I appreciate all help with this. Jai

2 2

NFS over Stunnel
by E SA 09 Oct '04

09 Oct '04

Hi, Is there anbody running NFS over Srunnel? I need to do so for Solaris. Can this be done? Has anybody done it? Any pointers? Beforehand, thank you for your help. Best regards, Erick Sanz _______________________________ Do you Yahoo!? Declare Yourself - Register online to vote today! http://vote.yahoo.com

3 2