- stunnel-users - stunnel.org

Why 6 processes for single client-mode service configuration?
by Grant Edwards 12 Oct '11

12 Oct '11

I'm configuring stunnel to encrypt a single client-mode connection: client = yes foreground = yes syslog = yes pid = [stunnel-localhost] accept = localhost:4608 connect = localhost:4606 Why does that result in _six_ stunnel processes? [one parent and 5 children]? It's going to look a ridiculous if I have four instances like that configured and end up with _24_ stunnel processes. I can see two processes (one for data flowing in each direction) but six seems way overboard. -- Grant Edwards grant.b.edwards Yow! I feel like a wet at parking meter on Darvon! gmail.com

3 7

Stunnel 4.44 sendproxy patch
by Mark Janssen 11 Oct '11

11 Oct '11

Hi, I've updated the sendproxy patch from (http://haproxy.1wt.eu/ and http://haproxy.1wt.eu/download/patches/stunnel-4.33-exceliance-aloha-sendpr…) to stunnel 4.44 I'd appreciate it if this patch would be included in stunnel proper. -- Mark Janssen -- maniac(at)maniac.nl Unix / Linux Open-Source and Internet Consultant Maniac.nl Sig-IO.nl Vps.Stoned-IT.com

1 0

stunnel 4.35 hangs on slackware64 13.37
by crocket 10 Oct '11

10 Oct '11

If I rotate stunnel logs with logrotate and have logrotate send SIGUSR1 signal to stunnel, stunnel doesn't close and reopen a new log and hangs. If I rotate stunnel logs and have logrotate send SIGHUP to stunnel, stunnel writes two lines to a new log but hangs after then. It could be a CPU problem because my D525 ATOM CPU had a problematic history with other programs. But I'm not sure of this. Can anybody else reproduce the problem?

1 1

problem with configure
by JOSE 05 Oct '11

05 Oct '11

I am trying to compile /stunnel-4.04 and I am having this problem with the configure exiting because opf something it can not set bash-3.2# export LD_LIBRARY_PATH=/lib/:/usr/lib/:/usr/local/lib/:/usr/local/lib/hpux32/:/usr/local/include/:/opt/gtk2.6/lib/:/opt/openssl/0.9.8/lib/ bash-3.2# ./configure checking for a BSD-compatible install... auto/install-sh -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking build system type... ia64-hp-hpux11.31 checking host system type... ia64-hp-hpux11.31 checking for gcc... no checking for cc... cc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... no checking whether cc accepts -g... yes checking for a BSD-compatible install... auto/install-sh -c checking whether make sets ${MAKE}... (cached) yes checking for non-GNU ld... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... no checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -p checking whether ln -s works... yes checking how to recognise dependant libraries... file_magic (s[0-9][0-9][0-9]|PA-RISC[0-9].[0-9]) shared library checking command to parse /usr/bin/nm -p output... ok checking how to run the C preprocessor... cc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... ranlib checking for strip... strip checking for objdir... .libs checking for cc option to produce PIC... +Z checking if cc PIC flag +Z works... yes checking if cc static flag -Wl,-a -Wl,archive works... no checking if cc supports -c -o file.o... no checking if we can lock with hard links... yes checking whether the linker (/usr/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... relink checking whether stripping libraries is possible... no checking dynamic linker characteristics... hpux11.31 dld.sl checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no creating libtool checking for SSL directory... /usr checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... no checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... no checking whether to use the libwrap (TCP wrappers) library... (default) checking for hosts_access in -lwrap... yes checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... no checking for _getpty... no checking for daemon... no checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for unsigned char... yes checking size of unsigned char... configure: error: cannot compute sizeof (unsigned char), 77 I've been reading around and this seems to be a problem with libiconv, but I have it installed, I have attached the configure.log for review bash-3.2# swlist -l product|grep -i lib Libiconv 1.6.1.16 Libiconv - Character set conversion library libiconv 1.12 libiconv I dont wkat else is missing, I am running this on HP-UX 11.31, I would appreciate in advance any help or hints, thanks folks Jose

1 0

Windows 7 64-bit
by Tracy Drake (QI-C) 02 Oct '11

02 Oct '11

Quick inquiry from a Stunnel dummie [?] Can you point me to any doc on compatibility of Stunnel with Windows 7 64-bit? Any particular version required? Any/all feedback is appreciated. -- Tracy Drake BI Senior Consultant GSA-FAS FAME Contractor URSA Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

1 0

stunnel.exe stops connecting
by Mike Brazil 27 Sep '11

27 Sep '11

I'm running stunnel 4.44 for both POP3 and SMTP with my email client, Outlook Express, and my Spam filter, Cactus Spam. The OS is Win XP SP3. I have added the following to stunnel.conf: client = yes debug = debug [pop3s] accept = 127.0.0.1:11010 connect = camel.arvixe.com:995 [ssmtp] accept = 25 connect = camel.arvixe.com:465 Other than adding those lines, I've not changed anything in the rest of stunnel.conf as it comes with the program. When I boot the computer, Outlook Express, Cactus Spam, and stunnel all start and function correctly. However, after a period of time (a few hours -- I haven't yet pinned down whether there is a specific length to the time period), something goes wrong with stunnel, in that it stops communicating with Outlook Express, and it's CPU usage goes up to 25% (quad-core Intel CPU) and stays at that level indefinitely until I terminate the process. It is only the stunnel.exe process that is affected -- the service continues to run without error. I then restart stunnel.exe, and it works normally once again for a few hours. I usually become aware that stunnel has stopped connecting with Outlook Express when I come back to the computer after a few hours away from it, so I have so far been unable to see whether anything observable occurs when it gets into trouble or whether the length of time it ran properly varies or is constant. -- Mike Brazil mike(a)milibra.net

1 0

stunnel 4.44 - tools/Makefile $(ssldir) vs $(SSLDIR)
by Sebastian Kayser 27 Sep '11

27 Sep '11

Hi, I am building a recent stunnel version for Solaris via opencsw.org and with 4.44 it seems as if --with-ssl is used to AC_SUBST([SSLDIR]), yet tools/Makefile uses lowercase $(ssldir). Lead to an empty expansion and failed calls to openssl in my case. $ grep -i ssldir Makefile tools/Makefile Makefile:SSLDIR = /opt/csw tools/Makefile:SSLDIR = /opt/csw tools/Makefile:openssl = $(ssldir)/bin/openssl Sebastian

1 0

Certificates
by Cary Corse 17 Sep '11

17 Sep '11

I'm trying to use stunnel to connect to a secure server for syslogging. I have a certificate from the central logging server. How do I load this into stunnel so that I can connect? Cheers and thanks Cary

4 4

stunnel 4.44 released
by Michal Trojnara 17 Sep '11

17 Sep '11

Dear Users, I have released version 4.44 of stunnel. The ChangeLog entry: Version 4.44, 2011.09.17, urgency: MEDIUM: * New features - Major automake/autoconf cleanup. - Heap buffer overflow protection with canaries. - Stack buffer overflow protection with -fstack-protector. * Bugfixes - Fixed garbled error messages on errors with setuid/setgid options. - SNI fixes (thx to Alexey Drozdov). - Use after free in fdprintf() (thx to Alexey Drozdov). This issue might cause GPF with "protocol" or "ident" options. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.44.tar.gz: fa0dfc33f323abfbc94aa993d90d37481cd2f652ee93ec2f8c333ac7a496c7b9 Best regards, Mike

1 0

Goldmine 6.7 behind a Server
by Blake Miller 15 Sep '11

15 Sep '11

We are planning to transition our email service to Google Apps with our Goldmine 6.7 Corporate Edition so need to use Stunnel. We have Goldmine setup and run from a central Server and a shared/networked drive F: Each client machine runs Goldmine, BUT via the server path noted earlier. When logged in locally to the server and running Goldmine locally, everything works great. Stunnel is connected, we're able to send/receive email, etc. However from a remote machine, it doesn't work. Have tried installing stunnel on the local machine. Have tried accessing the said ports via the Server's IP address from within the network. And have hacked around different config setups without luck. Being a NOOB with Stunnel, we're at a loss with further configuration without literally 'hacking around' in the dark any further. Our config file is just below Thanks in advance. Blake ; **************************************************************************** * ; * Global Options * ; **************************************************************************** * ; Debugging stuff (may useful for troubleshooting) debug = 7 output = stunnel.log ; **************************************************************************** * ; * Service Defaults (may also be specified in individual service sections) * ; **************************************************************************** * ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; The following options provide additional security at some performance penalty ; Default ECDH/DH parameters are strong/conservative, so it is quite safe to ; comment out these lines in order to get a performance boost options = SINGLE_ECDH_USE options = SINGLE_DH_USE ; **************************************************************************** * ; * Service Definitions (at least one service has to be defined) * ; **************************************************************************** * ; Example SSL server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ; Example SSL client mode services [gmail-pop3] client = yes accept = 127.0.0.1:9995 connect = pop.gmail.com:995 [gmail-smtp] client = yes accept = 127.0.0.1:4465 connect = smtp.gmail.com:465 ;[gmail-imap] ;client = yes ;accept = 127.0.0.1:143 ;connect = imap.gmail.com:993 ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem

3 4