- stunnel-users - stunnel.org

stunnel.conf
by Bob Williams 02 Sep '04

02 Sep '04

I'm totally new to Stunnel, which I'm running on a Windows XP platform. Where can I find a newbie's tutorial, e.g. to tell me what stunnel expects to find in stunnel.conf? Many thanks for your help. -- Bob

1 0

FTP site
by Michal Trojnara 02 Sep '04

02 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, My ftp site is back online. Thanks to Brian Hatch for reporting the problem. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBN0vB/NU+nXTHMtERAqQ4AJ95KWL5PUpLZOMqQ4xOJYKqeVwgxgCfVIcc yMYncLDroE5wwHxJj5QtjGI= =Tryt -----END PGP SIGNATURE-----

1 0

stunnel3
by Michal Trojnara 01 Sep '04

01 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I've written a perl script to emulate stunnel 3.x command line with stunnel versions 4.05 and later. I hope you'll like it. It's ready for download here: ftp://stunnel.mirt.net/stunnel/stunnel3 Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBNkEq/NU+nXTHMtERAvVGAJ4yuDLNrCOFTLfuuFRIzwShDkd/lwCfcVLa bLhgSAs2gXuzca8ZkJmCb9Q= =SInU -----END PGP SIGNATURE-----

1 0

Samba and stunnel
by Charles A. Monteiro 01 Sep '04

01 Sep '04

just wondering if anybody has had any difficulties with wrapping samba with stunnel, Sambo 3.0 apparently has dropped the support for ssl and therefore we are now also considering using stunnel to wrap Samba. thanks -Charles -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

1 0

Marketing Stunnel
by Charles A. Monteiro 01 Sep '04

01 Sep '04

So I now need to sell stunnel to those that make decisions. It would be helpful to get an understanding of how widely deployed it is. It also would be useful to have a number of company names that I could drop, especially if said companies were major corporations and especially if they were players in the finance/banking industry. thanks in advance, -Charles -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

4 4

re: [stunnel-users] client auth saga
by markzero＠logik.ath.cx 30 Aug '04

30 Aug '04

On Monday 30 of August 2004 20:38, markzero at logik.ath.cx wrote: > To be honest, I'm just generally paranoid. I'd rather have a prospective > attacker have to crack two passwords (the root and one wheel group) than > one. I thought I'd write the above just so I didn't get a big lecture, > hehe. :) > You're not paranoid enough. You still use passwords! 8-) I'm currently in the process of moving everything over to keypairs. I'm not blessed with security conscious users, and it's hard to get them to understand that a keypair is actually more convenient (especially if you use an agent). :) > > I recommend to use CAfile instead of CApath for simple configurations. > > It doesn't need a hashed directory and is not relative to chroot jail. > > So something like: > > CApath = /var/stunnel/certs > No! > CAfile = /var/stunnel/certs/your_cert.pem Oops, yeah I see what you mean. > I'm paranoid that someone has been at my testing configs now. :) I > previously had a working setup, which worries me even further as I *did* > use a symlink. Yes, you can use symlinks, but instead of: ln -s /a/b/c/x /a/b/c/y use: cd /a/b/c ln -s x y Please notice (ls -l) the results are not the same! That must have been it. > Best regards, > Mike > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.4 (GNU/Linux) > > iD8DBQFBM3dd/NU+nXTHMtERApCuAKDe+RWT1S0MQJ4Fr+FSyk8qyqwgpwCg4XED > zBBeDZ6AU+LPU+iejancYGI= > =8uvI > -----END PGP SIGNATURE-----

1 0

client auth saga
by markzero＠logik.ath.cx 30 Aug '04

30 Aug '04

Frustration doesn't begin to express it! SEC Productions presents: * THE CLIENT AND SERVER AUTH SAGA * lets get on with it: complete walkthrough of ssl cert creation ----------------------------------------- By the way, please don't lecture me on ssh'ing into machines as root, they are located on an isolated network and of course, all logging in as root is disabled when they are put into production. :) There now follows a step by step account of everything so far... command prompt key: ca# = certificate authority machine (or my isolated desktop, whichever you prefer). records# = log server dns# = my dns server (the logging client) (obvious output of scripts snipped) ----------------------------------------- ca# cd /etc/ssl/misc ca# ./CA.sh -newca <snip> ca# ./CA.sh -newreq <snip> Request (and private key) is in newreq.pem ca# ./CA.sh -sign Signed certificate is in newcert.pem ca# cat newreq.pem newcert.pem > log_server.pem Then I realised that I needed it to be passwordless. ca# openssl rsa -in newreq.pem -out decryptedcert.pem ca# cat decryptedcert.pem newcert.pem > log_server_np.pem (log_server_np.pem is now passwordless) ca# scp log_server_np.pem records:/etc/ssl/stunnel_cert/ ca# scp demoCA/cacert.pem dns:/var/stunnel/cert/cacert.pem we'll just try with server side auth at the moment, on the loghost: records# cat /etc/stunnel/stunnel.conf cert = /etc/ssl/stunnel_cert/log_server_np.pem chroot = /var/stunnel pid = /var/run/stunnel.pid CApath = /certs CRLpath = /crls #verify = 2 debug = 7 output = stunnel.log setuid = _stunnel setgid = _stunnel [syslogngs] accept = 192.168.1.9:5514 connect = 127.0.0.1:5515 on the client: dns# cat /etc/stunnel/stunnel.conf #cert = /etc/stunnel/cert/clientkeycert.pem chroot = /var/stunnel pid = /var/run/stunnel.pid CAfile = /certs/cacert.pem CRLpath = /crls debug = 7 output = stunnel.log client = yes setuid = _stunnel setgid = _stunnel [syslogngs] accept = 127.0.0.1:5515 connect = 192.168.1.9:5514 looks good... dns# telnet localhost 5515 (in the interests of patience and readability, the output of stunnel.log isn't posted here, suffice to say the connection is successful and works) now to step up to client and server authentication. ca# openssl req -x509 -newkey rsa:2048 -keyout clientkey.pem -out \ clientcert -days 365 (forgot to use -nodes) ca# openssl rsa -in clientkey.pem -out client_decrypted_key.pem ca# cat clientkey.pem clientcert.pem > clientkeycert.pem ca# ./c_hash clientkeycert.pem 4410a4d9.0 => clientkeycert.pem ca# scp clientkeycert.pem dns:/etc/stunnel/cert ca# scp clientcert.pem records:/var/stunnel/certs on the server: records# ln -s /var/stunnel/certs/clientcert.pem \ /var/stunnel/certs/4410a4d9.0 adjust the stunnel.conf on both hosts accordingly: records# cat /etc/stunnel/stunnel.conf cert = /etc/ssl/stunnel_cert/log_server_np.pem chroot = /var/stunnel pid = /var/run/stunnel.pid CApath = /certs CRLpath = /crls verify = 3 debug = 7 output = stunnel.log setuid = _stunnel setgid = _stunnel [syslogngs] accept = 192.168.1.9:5514 connect = 127.0.0.1:5515 dns# cat /etc/stunnel/stunnel.conf cert = /etc/stunnel/cert/clientkeycert.pem chroot = /var/stunnel pid = /var/run/stunnel.pid CAfile = /certs/cacert.pem CRLpath = /crls debug = 7 output = stunnel.log client = yes setuid = _stunnel setgid = _stunnel [syslogngs] accept = 127.0.0.1:5515 connect = 192.168.1.9:5514 and just to show the permissions: records# ls -al /etc/ssl/ drwx------ 2 _stunnel _stunnel 512 Aug 30 12:19 stunnel_cert records# ls -al /etc/ssl/stunnel_cert -rw------- 1 _stunnel _stunnel 4320 Aug 30 12:19 log_server_np.pem records# ls -al /var/stunnel/certs/ lrwxr-xr-x 1 root _stunnel 33 Aug 30 14:33 4410a4d9.0 -> /var/stunnel/certs/clientcert.pem -rw------- 1 _stunnel _stunnel 1489 Aug 30 14:32 clientcert.pem dns# ls -al /etc/stunnel/dns# ls -al /etc/stunnel/ drwx------ 3 _stunnel _stunnel 512 Aug 29 21:50 . drwx------ 2 _stunnel _stunnel 512 Aug 30 14:18 cert -rw------- 1 _stunnel _stunnel 301 Aug 30 14:22 stunnel.conf -rw------- 1 _stunnel _stunnel 13401 Aug 29 22:21 stunnel.log dns# ls -al /etc/stunnel/cert/ -rw------- 1 _stunnel _stunnel 3168 Aug 30 14:18 clientkeycert.pem dns# ls -al /var/stunnel/ drwx------ 5 _stunnel _stunnel 512 Aug 29 21:28 . drwx------ 2 _stunnel _stunnel 512 Aug 30 13:59 cert drwx------ 2 _stunnel _stunnel 512 Aug 29 21:16 crl drwx------ 3 _stunnel _stunnel 512 Aug 29 21:28 var dns# ls -al /var/stunnel/cert/ drwx------ 2 _stunnel _stunnel 512 Aug 30 13:59 . -rw------- 1 _stunnel _stunnel 1115 Aug 30 13:59 cacert.pem now, to test. records# /usr/local/sbin/stunnel /etc/stunnel/stunnel.conf dns# /usr/local/sbin/stunnel /etc/stunnel/stunnel.conf the log files on both show no errors, lets try a connection from dns to records... dns# telnet localhost 5515 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. urgh! what went wrong? records# cat stunnel.log 2004.08.30 14:46:43 LOG5[27205:1006690304]: stunnel 4.05 on i386-unknown-openbsd3.5 PTHREAD with OpenSSL 0.9.7c 30 Sep 2003 2004.08.30 14:46:43 LOG7[27205:1006690304]: Snagged 64 random bytes from /dev/arandom 2004.08.30 14:46:43 LOG7[27205:1006690304]: RAND_status claims sufficient entropy for the PRNG 2004.08.30 14:46:43 LOG6[27205:1006690304]: PRNG seeded successfully 2004.08.30 14:46:43 LOG7[27205:1006690304]: Certificate: /etc/ssl/stunnel_cert/log_server_np.pem 2004.08.30 14:46:43 LOG7[27205:1006690304]: Key file: /etc/ssl/stunnel_cert/log_server_np.pem 2004.08.30 14:46:43 LOG7[27205:1006690304]: Verify directory set to /certs 2004.08.30 14:46:43 LOG7[27205:1006690304]: CRL directory set to /crls 2004.08.30 14:46:43 LOG5[27205:1006690304]: Peer certificate location /certs 2004.08.30 14:46:43 LOG5[27205:1006690304]: FD_SETSIZE=1024, file ulimit=128 -> 61 clients allowed 2004.08.30 14:46:43 LOG7[27205:1006690304]: FD 10 in non-blocking mode 2004.08.30 14:46:43 LOG7[27205:1006690304]: SO_REUSEADDR option set on accept socket 2004.08.30 14:46:43 LOG7[27205:1006690304]: syslogngs bound to 192.168.1.9:5514 2004.08.30 14:46:43 LOG7[27205:1006690304]: FD 11 in non-blocking mode 2004.08.30 14:46:43 LOG7[27205:1006690304]: FD 12 in non-blocking mode 2004.08.30 14:46:43 LOG7[20297:1006690304]: Created pid file /var/run/stunnel.pid 2004.08.30 14:46:51 LOG7[20297:1006690304]: syslogngs accepted FD=13 from 192.168.1.6:7109 2004.08.30 14:46:51 LOG7[20297:1006690304]: FD 13 in non-blocking mode 2004.08.30 14:46:51 LOG7[20297:1006693376]: syslogngs started 2004.08.30 14:46:51 LOG5[20297:1006693376]: syslogngs connected from 192.168.1.6:7109 2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): before/accept initialization 2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 read client hello A 2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 write server hello A 2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 write certificate A 2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 write certificate request A 2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 flush data 2004.08.30 14:46:51 LOG7[20297:1006693376]: waitforsocket: FD=13, DIR=read 2004.08.30 14:46:52 LOG7[20297:1006693376]: waitforsocket: ok 2004.08.30 14:46:52 LOG4[20297:1006693376]: VERIFY ERROR: depth=0, error=self signed certificate: /C=UK/L=London/O=SI/OU=SEC/CN=LogClient/emailAddress=root@localhost 2004.08.30 14:46:52 LOG7[20297:1006693376]: SSL alert (write): fatal: bad certificate 2004.08.30 14:46:52 LOG3[20297:1006693376]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2004.08.30 14:46:52 LOG7[20297:1006693376]: syslogngs finished (0 left) --- dns# cat stunnel.log 2004.08.30 14:33:24 LOG5[10920:1006690304]: stunnel 4.05 on i386-unknown-openbsd3.5 PTHREAD with OpenSSL 0.9.7c 30 Sep 2003 2004.08.30 14:33:24 LOG7[10920:1006690304]: Snagged 64 random bytes from /dev/arandom 2004.08.30 14:33:24 LOG7[10920:1006690304]: RAND_status claims sufficient entropy for the PRNG 2004.08.30 14:33:24 LOG6[10920:1006690304]: PRNG seeded successfully 2004.08.30 14:33:24 LOG7[10920:1006690304]: Certificate: /etc/stunnel/cert/clientkeycert.pem 2004.08.30 14:33:24 LOG7[10920:1006690304]: Key file: /etc/stunnel/cert/clientkeycert.pem 2004.08.30 14:33:24 LOG5[10920:1006690304]: FD_SETSIZE=1024, file ulimit=128 -> 61 clients allowed 2004.08.30 14:33:24 LOG7[10920:1006690304]: FD 10 in non-blocking mode 2004.08.30 14:33:24 LOG7[10920:1006690304]: SO_REUSEADDR option set on accept socket 2004.08.30 14:33:24 LOG7[10920:1006690304]: syslogngs bound to 127.0.0.1:5515 2004.08.30 14:33:24 LOG7[10920:1006690304]: FD 11 in non-blocking mode 2004.08.30 14:33:24 LOG7[10920:1006690304]: FD 12 in non-blocking mode 2004.08.30 14:33:24 LOG7[11717:1006690304]: Created pid file /var/run/stunnel.pid 2004.08.30 14:33:30 LOG7[11717:1006690304]: syslogngs accepted FD=13 from 127.0.0.1:20109 2004.08.30 14:33:30 LOG7[11717:1006690304]: FD 13 in non-blocking mode 2004.08.30 14:33:30 LOG7[11717:1006693376]: syslogngs started 2004.08.30 14:33:30 LOG5[11717:1006693376]: syslogngs connected from 127.0.0.1:20109 2004.08.30 14:33:30 LOG7[11717:1006693376]: FD 14 in non-blocking mode 2004.08.30 14:33:30 LOG7[11717:1006693376]: syslogngs connecting 192.168.1.9:5514 2004.08.30 14:33:30 LOG7[11717:1006693376]: remote connect #1: EINPROGRESS: retrying 2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: FD=14, DIR=write 2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: ok 2004.08.30 14:33:30 LOG7[11717:1006693376]: Remote FD=14 initialized 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): before/connect initialization 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write client hello A 2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: FD=14, DIR=read 2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: ok 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 read server hello A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 read server certificate A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 read server certificate request A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 read server done A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write client certificate A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write client key exchange A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write certificate verify A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write change cipher spec A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write finished A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 flush data 2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: FD=14, DIR=read 2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: ok 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL alert (read): fatal: bad certificate 2004.08.30 14:33:30 LOG3[11717:1006693376]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate 2004.08.30 14:33:30 LOG7[11717:1006693376]: syslogngs finished (0 left) (sorry about the unwrapped lines) I've also tried using ktrace, but the ktrace.out drops off before the connection (making it useless). I don't understand what can be wrong, I've retraced my steps over and over. I did actually have it working before, but due to testing, reinstalled the OS and now it doesn't work. I'm loathe to install the developement tools, as there are so many it would be a nightmare to remove them after (prompting a reinstall, and look what happened last time). Any ideas? Anything I've done blindingly obviously wrong? Why did it work before and not now? ARGH! cheers mark

2 3

Stunnel 4.05 on AIX
by Baker Nelson 27 Aug '04

27 Aug '04

Hello all, Still having trouble getting stunnel 4.05 to run on my AIX 5.2 box. Wanted to pass along the following warning that showed up running the configure script. Could a problem with PTHEADS be causing the failure? Thanks baker checking for sys/select.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking pthread.h usability... no checking pthread.h presence... yes configure: WARNING: pthread.h: present but cannot be compiled configure: WARNING: pthread.h: check for missing prerequisite headers? configure: WARNING: pthread.h: proceeding with the preprocessor's result configure: WARNING: ## ------------------------------------ ## configure: WARNING: ## Report this to bug-autoconf(a)gnu.org. ## configure: WARNING: ## ------------------------------------ ## checking for pthread.h... yes

1 0

Compilation problem of stunnel-4.05 on solaris 9
by PEYROL Didier 27 Aug '04

27 Aug '04

hi , I get this error when i try to do ./configure on stunnel-4.05 on solaris9 config.log in attachement. Some people could help me??? ./configure checking for a BSD-compatible install... auto/install-sh -c checking whether build environment is sane... yes checking whether make sets $(MAKE)... no checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking build system type... sparc-sun-solaris2.9 checking host system type... sparc-sun-solaris2.9 checking for gcc... gcc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for a BSD-compatible install... auto/install-sh -c checking whether make sets $(MAKE)... (cached) no checking for ld used by GCC... /usr/ccs/bin/ld checking if the linker (/usr/ccs/bin/ld) is GNU ld... no checking for /usr/ccs/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/ccs/bin/nm -p checking for a sed that does not truncate output... /usr/bin/sed checking whether ln -s works... yes checking how to recognise dependent libraries... pass_all checking command to parse /usr/ccs/bin/nm -p output... ok checking how to run the C preprocessor... gcc -E checking for egrep... egrep checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... no checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... : checking for strip... : checking for objdir... .libs checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.lo... yes checking if gcc supports -fno-rtti -fno-exceptions... yes checking whether the linker (/usr/ccs/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... no checking dynamic linker characteristics... solaris2.9 ld.so checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no creating libtool checking for SSL directory... /usr/local/ssl checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for dlopen in -ldl... yes checking for shl_load in -ldld... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... yes checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... no checking whether to use the libwrap (TCP wrappers) library... (default) checking for hosts_access in -lwrap... no checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... yes checking sys/filio.h presence... yes checking for sys/filio.h... yes checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... no checking for _getpty... no checking for daemon... no checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for setsid... yes checking for unsigned char... yes checking size of unsigned char... configure: error: cannot compute sizeof (unsigned char), 77 See `config.log' for more details. BR Didier

1 0

MySQL client through stunnel on win32
by Rumi Szabolcs 26 Aug '04

26 Aug '04

Hello! I have tried the following setup: server: MySQL 4.0.20 with native OpenSSL 0.9.7d support on Linux client: MySQL 4.0.20 without SSL support, through stunnel 4.0.5 on WinXP As it can be suspected from the above, I was trying to use the mysqld with ssl support directly as the server side of the connection, without stunnel. I saw a pseudo-https client solution in the stunnel docs where this approach seemed to work. The client stunnel.conf: cert = client-test.crt key = client-test.key client = yes debug = debug [mysqlclient] accept = 3306 connect = server.host.fqdn:3306 The mysql client reported the following error, right after asking for the password: ERROR 2013: Lost connection to MySQL server during query Here is the log from the client stunnel: 2004.08.26 17:19:43 LOG5[2396:1256]: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7d 17 Mar 2004 2004.08.26 17:19:43 LOG7[2396:1908]: RAND_status claims sufficient entropy for the PRNG 2004.08.26 17:19:43 LOG6[2396:1908]: PRNG seeded successfully 2004.08.26 17:19:43 LOG7[2396:1908]: Certificate: client-test.crt 2004.08.26 17:19:43 LOG7[2396:1908]: Key file: client-test.key 2004.08.26 17:19:43 LOG5[2396:1908]: WIN32 platform: 30000 clients allowed 2004.08.26 17:19:43 LOG7[2396:1908]: FD 1828 in non-blocking mode 2004.08.26 17:19:43 LOG7[2396:1908]: SO_REUSEADDR option set on accept socket 2004.08.26 17:19:43 LOG7[2396:1908]: mysqlclient bound to 0.0.0.0:3306 2004.08.26 17:19:52 LOG7[2396:1908]: mysqlclient accepted FD=1836 from 127.0.0.1:3269 2004.08.26 17:19:52 LOG7[2396:1908]: FD 1836 in non-blocking mode 2004.08.26 17:19:52 LOG7[2396:1908]: Creating a new thread 2004.08.26 17:19:52 LOG7[2396:1908]: New thread created 2004.08.26 17:19:52 LOG7[2396:1816]: mysqlclient started 2004.08.26 17:19:52 LOG5[2396:1816]: mysqlclient connected from 127.0.0.1:3269 2004.08.26 17:19:52 LOG7[2396:1816]: FD 1816 in non-blocking mode 2004.08.26 17:19:52 LOG7[2396:1816]: mysqlclient connecting xx.xx.xx.xx:3306 2004.08.26 17:19:52 LOG7[2396:1816]: remote connect #1: EWOULDBLOCK: retrying 2004.08.26 17:19:52 LOG7[2396:1816]: waitforsocket: FD=1816, DIR=write 2004.08.26 17:19:52 LOG7[2396:1816]: waitforsocket: ok 2004.08.26 17:19:52 LOG7[2396:1816]: remote connect #2: EINVAL: ok 2004.08.26 17:19:52 LOG7[2396:1816]: Remote FD=1816 initialized 2004.08.26 17:19:52 LOG7[2396:1816]: SSL state (connect): before/connect initialization 2004.08.26 17:19:52 LOG7[2396:1816]: SSL state (connect): SSLv3 write client hello A 2004.08.26 17:19:52 LOG7[2396:1816]: SSL alert (write): fatal: handshake failure 2004.08.26 17:19:52 LOG3[2396:1816]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2004.08.26 17:19:52 LOG7[2396:1816]: mysqlclient finished (0 left) What is wrong here? Thank you! Regards, Szabolcs Rumi

1 0