stunnel-users

stunnel-users@stunnel.org

6 participants
3313 discussions

Problem with the client certificate
by Michael Renner 27 Dec '08

27 Dec '08

Moin, it seems that I understood something wrong with stunnel client certificates. First of all: until now I run stunnel 4.18 and stunnel 4.21 with debian and kubuntu without client certificates (with success). I use it to reach a proprietary application through an untrusted network. Now, I want the clients to authenticate against the server. Therefor, as a quick and dirty test, I used the same stunnel.pem file at the server and at the client side. The configuration at the server side (where the application is waiting for connections, in this example it is just a script) looks like this: cert = /etc/stunnel/stunnel.pem #chroot = /var/run/stunnel/ pid = /tmp/stunnel.pid setuid = nobody setgid = nogroup output = /var/log/stunnel4.log exec = /root/stest.sh verify = 1 [BreakOut] accept = 192.168.0.1:443 Here is the configuration at the client side, where a browser establish a connection cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 0 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [BreakOut] accept = 127.0.0.1:8080 connect = 192.168.0.1:443 First of all: is it right to set 'verify = 1' at the server side, and 'verify = 0' at the client side? It seems right to me, because the client should authenticate, but not the other way. Anyhow: As soon as a connection is opened using this configuration it will terminate at the same second. renner@mars:~$ telnet localhost 8080 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. In the clients logfile I see SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A VERIFY IGNORE: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de VERIFY OK: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de VERIFY IGNORE: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de VERIFY OK: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de SSL state (connect): SSLv3 read server certificate A SSL state (connect): SSLv3 read server certificate request A SSL state (connect): SSLv3 read server done A SSL state (connect): SSLv3 write client certificate A SSL state (connect): SSLv3 write client key exchange A SSL state (connect): SSLv3 write certificate verify A SSL state (connect): SSLv3 write change cipher spec A SSL state (connect): SSLv3 write finished A SSL state (connect): SSLv3 flush data SSL alert (read): fatal: bad certificate SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket BreakOut finished (0 left) And, more interesting, at the server side: BreakOut connected from 84.57.55.105:57987 VERIFY ERROR: depth=0, error=self signed certificate: /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Is something wrong with my self signed certificate? In my first tests I used one that I made with tinyCA, an other was made according http://www.stunnel.org/faq/certs.html: * openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem * openssl gendh 512 >> stunnel.pem * openssl rsa -in stunnel.pem -out new.pem * edit new.pem, merge some parts with stunnel.pem and rename it Any hint? Thanks -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 0

Windows binary kits on 64 bit 2003 server or 2008 server
by Rich Jordan 24 Dec '08

24 Dec '08

Sorry to sully the list with wintel questions, but I haven't been able to locate an answer, and without systems available to test the obvious method of finding out is not available. We're running Stunnel V4.26 on a windows 2003 32-bit server, communicating with several better platforms running Stunnel V4.20 and newer, no issues. One interested customer is running windows 2003 server, 64-bit, and plans on moving to win2008 server 64 bit in the not too distant future. I do not have access to either OS/system and they're reluctant to install without knowing ahead of time what might happen. I'm hoping someone has tried the current STunnel binary kit on either or both of those systems. Will the kit run on 64-bit windows 2003, and is it usable on windows 2008? If not is this a situation where a build from source on either/both of those windows systems will produce working code? I've also found a number of hits for reputed OpenSSL ports for 64 bit windows. Any particular ones known to be good? Thanks for any info. Rich Illuc ivi, illud feci

1 0

Re: [stunnel-users] Wrapping a CherryPy server?
by Lucas Burdick 19 Dec '08

19 Dec '08

Hmm, I guess I didn't send my previous followup to the list. After setting the log to output properly, I was able to troubleshoot my problem. The chroot directory was non-existent and therefore didn't allow my .pid to be created. I have created the directory and everything now works as it should. Thanks for the help. Sorry for the trouble. Lucas -----Original Message----- From: Michael Renner [mailto:michael.renner@gmx.de] Sent: December-19-08 11:07 AM To: stunnel-users(a)mirt.net; Lucas Burdick Subject: Re: [stunnel-users] Wrapping a CherryPy server? On Friday 19 December 2008, Lucas Burdick wrote: > Hi There, Moin, > I?m trying to encrypt a cherrypy web page that I?m serving up. The page > itself works just fine on port 80, but I can?t seem to get stunnel to wrap > it. I?m using 4.26 on CentOS 5.2. I?ve put in my stunnel.conf: [...] > I?ve also tried commenting out the above mentioned .conf entry. I get the > error that inetd mode needs a remote host or executable. I?m trying to run > in daemon mode but I don?t think I?m doing it right. > > Please help, or ask me questions, or tell me to elaborate or something. can you call stunnel using the forground option and check the logfile? start stunnel like this ... $ stunnel -D debug -f -o /var/log/stunnel.log ........ CU -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 0

Log rotation patch
by Christophe Nanteuil 17 Dec '08

17 Dec '08

Hello, NB : I propose this patch in alpha version. It has been tested only on a Linux Mandriva. (in the alpha version, it's recommended to use it on logs you might loose). Why to use this patch ? One reason I have to restart periodically stunnel is to do log rotation. This patch allows log rotation while running stunnel by implementing it directly inside. Therefore, the established connections are not closed by log rotation. Patch to version : 4.26 (should work on earlier versions). Type : new feature Description : Log rotation inside stunnel How to use this patch ? 3 new options are added in config file (see manual) maxLogSize : maximum size of log file (output option in config file). If logs have to be added, a log rotation is initiated. maxLogFiles : how many log files you want to keep. Default 7. useLogCompression : specify if rotated log files kept must be compressed or not. (requires zlib to be set). Just recompile stunnel after applying patch in stunnel directory: patch -p1 < /path/to/stunnel-logrot-0.10a.patch Test results are welcomed. Regards -- Christophe Nanteuil

1 0

Re: [stunnel-users] Stunnel 4 failing to connect to gmail
by Alex Limberis 15 Dec '08

15 Dec '08

HI Asif, Unfortunately that is the way gmail works. It changes the from to the gmail address rather than the computer domain. Unfortunately, this mostly makes it useless if you are trying to use it as a smarthost. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users-bounces@mirt.net] On Behalf Of Asif Iqbal Sent: Monday, December 15, 2008 2:06 PM To: Scott Gifford Cc: stunnel-users(a)mirt.net; nullmailer(a)lists.untroubled.org Subject: Re: [stunnel-users] Stunnel 4 failing to connect to gmail On Mon, Dec 15, 2008 at 4:49 PM, Scott Gifford <sgifford(a)suspectclass.com> wrote: > "Asif Iqbal" <vadud3(a)gmail.com> writes: > > [...] > >> I said it too soon. It passed that bind error but it still failing in ssl. >> I am seeing `SSL alert (write): fatal: handshake failure' > > Hello again Asif, glad you decided to try out stunnel! Yep, as you suggested :-) > > Try using port 465 instead of 587. That worked! I were able to send an email and I did receive it. It says the email came from `vadud3(a)gmail.com' instead of the sender, which is me(a)myhomecomputer.domain I am using this in /etc/nullmailer/remotes file localhost smtp --port=25 --user=vadud3 --pass=s3cr3t > > It looks like Google's STARTTLS command requires an EHLO to be sent > first, which is a someqhat unusual requirement. I don't think stunnel > does that. Port 465 will start talking SSL directly, without > requiring SMTP commands first. > > Good luck! > > ----Scott. > -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by Leandro Avila 12 Dec '08

12 Dec '08

Not sure if ranting will get you the kind of answer that you look for but it was certainly entertaining for me. Anyway... I agree, some times things can be a little frustraiting but I guess that depends on how much time on how much work you want to put into it. Sorry to hear you feel stupid. Everyone has to start from 0 at shome point and it takes time to get a good handle to how things work. The question is... do you really want to know how things work or just want them to work without having to do much? A google search of "SSL Explained" http://wildbill.nulldevice.net/presentations/sslpreso/ I liked slide 11/35 nice little diagram of SSL handshake wich helps to visualize in very general terms how an SSL connection works. The rest of the slides are good too check them out! In your particular case that forced you to change from plain-text to SSL connections to your mail server. You had a couple of options. - First and most obvious is to use SSL support build into your mail client (Thunderbird, Outlook,etc) most if not all modern mail clients support SSL natively. No need for stunnel there. - If your mail client does not support SSL then stunnel is the way to go. But your issue is on how stunnel is being used. As client. When you are a client... you always want to verify your server. You want to make sure you are connected to the right server. You want to use verify=2 in stunnel.conf How do we verify that the server I just connected is in fact the right server? That is the Certificate Authority's job. We ultimately have to trust the CA they issued the certificate for the server owner. They signed the certificate with their key. and we use the CA's certificate to verify that signature. Here is the catch... operating systems, and some programs are shipped with a prebuild collection of CA certificates. Unfortunatelly stunnel does not. However, most CAs let you download their certificates for your own use. In your particular case, looks like the server you are connecting to uses a certificate issued by Equifax Secure Certificate Authority Here they have the download page for the CA Certificates. http://www.geotrust.com/resources/root-certificates/ You pointed out that they refuse connections if the client presents a certificate. Yes, that is somehow a common practice. Mutual authentication (both server and client send certificates to each other and verify them) is impractical in some cases. Thanks ----------------- Leandro Avila

1 0

Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 05 Dec '08

05 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, (I sent this yesterday but that one seems to have gotten lost....) Stunnel v4.20. When connecting to SBC/Yahoo, the session is terminated with a "bad certificate" message. See the log below. The tech folks claim all is well at their end. Is there something I am missing here? Here is the conf file: ....[ conf ].... socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes output = G:/c/voice/pmmdev/testcase/bin/stunnel.log verify = 0 debug = 7 cert = g:/c/voice/pmmdev/testcase/bin/sma-test.pem [sbc] accept = localhost:6325 connect = smtp.att.yahoo.com:465 ....[ end conf ].... ....[ connection log ].... 2008.11.11 00:14:17 LOG7[223:1737]: sbc accepted FD=15 from 127.0.0.1:61053 2008.11.11 00:14:17 LOG7[223:1737]: Creating a new thread 2008.11.11 00:14:17 LOG7[223:1737]: New thread created 2008.11.11 00:14:17 LOG7[251:1737]: sbc started 2008.11.11 00:14:17 LOG7[251:1737]: FD 15 in non-blocking mode 2008.11.11 00:14:17 LOG7[251:1737]: TCP_NODELAY option set on local socket 2008.11.11 00:14:17 LOG5[251:1737]: sbc accepted connection from 127.0.0.1:61053 2008.11.11 00:14:17 LOG7[251:1737]: FD 16 in non-blocking mode 2008.11.11 00:14:17 LOG7[251:1737]: sbc connecting 69.147.64.31:465 2008.11.11 00:14:17 LOG7[251:1737]: connect_wait: waiting 10 seconds 2008.11.11 00:14:17 LOG7[251:1737]: connect_wait: connected 2008.11.11 00:14:17 LOG5[251:1737]: sbc connected remote server from 192.168.69.14:61054 2008.11.11 00:14:17 LOG7[251:1737]: Remote FD=16 initialized 2008.11.11 00:14:17 LOG7[251:1737]: TCP_NODELAY option set on remote socket 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): before/connect initialization 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write client hello A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server hello A 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY IGNORE: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY OK: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY IGNORE: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY OK: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY IGNORE: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY OK: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server certificate A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server certificate request A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server done A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write client certificate A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write client key exchange A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write certificate verify A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write change cipher spec A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write finished A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 flush data 2008.11.11 00:14:18 LOG7[251:1737]: SSL alert (read): fatal: bad certificate 2008.11.11 00:14:18 LOG3[251:1737]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate 2008.11.11 00:14:18 LOG5[251:1737]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.11.11 00:14:18 LOG7[251:1737]: sbc finished (0 left) ....[ end log ].... - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJGe4zzTcr8Prq0ZMRAhSPAJ4h6YHyR+/W5brb7FK1tbbW1zYZ+wCglxpC 9k2qqpP2hN99BL0TnsNhlnw= =P74g -----END PGP SIGNATURE-----

6 7

Test, test. Hello?
by James Moe 05 Dec '08

05 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I have not received a posting for several days. Has the list really gone that quiet? - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD4DBQFJOXHezTcr8Prq0ZMRAqqQAJ0aUC0ZyZC+85WF4WZN3nntQjfrxgCY/zjt 3Jlthcur9UTtXOnNkVcPFg== =scXZ -----END PGP SIGNATURE-----

1 0

Extending stunnels connect functionality
by bernhard.czech＠nobiscum.de 24 Nov '08

24 Nov '08

Hi all, we are looking for somebody to extend stunnel's multiple connect functionality a bit as of: - adding the ability to send a configurable string to each "connect" and compare the answer against an configured expectation string - the expectation should also be able to be interpreted as an regular expression. - the testing interval should be configurable - an alternative port should be configurable - it should be possible to call a script instead of doing a connection with the connect string provided as a parameter. - a way of monitoring might all paths might be good (i.e. writing a status file on regular basis) These things are pretty much the same things that LVS ( http://www.linuxvirtualserver.org/) provides. But we would like to reduce the complexity in our environment a bit. If somebody is interested to implement this feel free to contact me. If possible with an amount of expected reward. Kind regards, Bernhard Czech -- Bernhard Czech nobisCum Individual GmbH [T] +49 (0) 931 / 79 66 7-90 44 [F] +49 (0) 931 / 79 66 7-29 [M] +49 (0)175 / 90 51 45 8 [@] Bernhard.Czech(a)nobiscum.de [URL] www.nobiscum.de [Anschrift] Sedanstraße 23, 97082 Würzburg, Germany [Registergericht] Würzburg, HRB 5159 [Geschäftsführer] Markus Frisch, Hans-Peter Holl

1 0

Tunnel traffic from a network interface
by Kjetil Holien 23 Nov '08

23 Nov '08

Hi! Is it possible to capture traffic from one network interface on one computer, tunnel it to a second computer by stunnel and then send it through a network interface on that computer? This without changing any data on the network traffic (MAC adresses, IP etc). Thanks for any answers! greetings, Kjetil

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users