- stunnel-users - stunnel.org

stunnel 4.15 released
by Michal Trojnara 11 Mar '06

11 Mar '06

Version 4.15, 2006.03.11, urgency: LOW: * Release notes - There are a lot of new features in this version. I recommend to test it well before upgrading your mission-critical systems. * Bugfixes - Fix for pthreads on Solaris 10 (thx to Hans Werner Strube <strube(a)physik3.gwdg.de>). - Attempt to autodetect socklen_t type in configure script. - Default threading model changed to pthread for better portability. - DH parameters are not included in the certificate by default. * New features sponsored by Software House http://www.swhouse.com/ - Most SSL-related options (including client, cert, key) are now available on service level, so it is possible to have an SSL client and an SSL server in a single stunnel process. - Windows CE (version 3.0 and higher) support. * New features - Client mode CONNECT protocol support (RFC 2817 section 5.2). http://www.ietf.org/rfc/rfc2817.txt - Retrying exec+connect services added. * File locations are more compliant to Filesystem Hierarchy Standard 2.3 - configuration and certificates are in $prefix/etc/stunnel/ - binaries are in $prefix/sbin/ - default pid file is $prefix/var/run/stunnel.pid - manual is $prefix/man/man8/stunnel.8 - other docs are in $prefix/share/doc/stunnel/ - libstunnel is in $prefix/lib - chroot directory is setup in $prefix/var/lib/stunnel/ this directory is chmoded 1770 and group nogroup sha1sum for stunnel-4.15.tar.gz: 735406c1ca94904581158a434214e1f6568539d0 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Mike

1 0

"STACK_RESERVE is too high" after every connect
by Rob Munsch 10 Mar '06

10 Mar '06

Hello. I've recently gone on a self-inflicted crash course on openssl and seem to have gotten a centralized logging system going, logging to MySQL. I'm seeing everything i'd expect to see, but with an extra bit: what is STACK_RESERVE, and why is it too high? Some context, mildly sanitized: |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: syslog-ng connected from x.x.x.x:44032| |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: VERIFY OK: depth=1, /C=US/ST=Pennsylvania/L=Philadelphia/O=Solutions for Progress/CN=blah.com/emailAddress=blah@blah| |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: VERIFY OK: depth=0, /C=US/ST=Pennsylvania/O=Solutions for Progress/OU=IT/CN=IT/emailAddress=blah@blah| |Mar 9 20:39:02 isis stunnel: LOG5[24810:6]: Connection closed: 0 bytes sent to SSL, 2891 bytes sent to socket| |Mar 9 20:39:02 isis stunnel: LOG3[24810:6]: STACK_RESERVE is too high| this is daemon.log on the server machine (isis). Messages from the remote host are going to MySQL successfully. But at the end of every apparently-successful transaction, there's this stack complaint. Can't find anything in the archives or via Google for "stunnel stack_reserve," which i found really odd, which is why i'm here... Version output: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 Thanks! -- Rob Munsch Solutions For Progress IT

2 1

RE: How to get tcpwrappers configured/compiled into stunnel 4.04 on Tru64 UNIX 5.1B
by John Lanier 08 Mar '06

08 Mar '06

Hello, I am a newbie to stunnel and tcpwrappers, so please bear with me: I am trying to compile tcpwrapper support into stunnel v4.04 on Tru64 UNIX v5.1B (apparently v4.14 does not compile on 5.1A or higher, per http://stunnel.mirt.net/pipermail/stunnel-users/2006-January/000935.html) I am having what appears to be problems getting tcpwrapper support to compile with 4.04. I have consulted the following resources, but I am still having problems: ------------------------------------------------------------------------------------------------------- 1. http://www.stunnel.org/faq/troubleshooting.html#ToC9 "configure isn't finding my TCP Wrapper installation" Solution: You probably have it in a non-standard place, ie somewhere that gcc can't find it on it's own. Let's say you had your tcp wrappers installed in /opt/tcpd_7.6. To help gcc find your include files and libraries, you'd want to set three environment variables as follows: CFLAGS="$CFLAGS -I/opt/tcpd_7.6/include" CPPFLAGS="$CPPFLAGS -I/opt/tcpd_7.6/include" LDFLAGS="$LDFLAGS -L/opt/tcpd_7.6/lib" export CFLAGS CPPFLAGS LDFLAGS And then re-run configure. This is the generic way to have configure find specific libraries, and is not specific to Stunnel itself. 2. http://www.stunnel.org/faq/run.html#ToC5 "Running stunnel with TCP wrappers" You do not need to use the tcpd binary to wrap stunnel (although you could). You can can compile in support for TCP wrappers when you compile stunnel itself. The configure program should be able to determine if the libwrap library (-lwrap) and headers are available in standard locations. ............. I have openssl 0.9.7h installed on ccpe01 v51b pk#5, with tcp-wrappers7.6. I did the configure, make and make install and things. All stages appeared successful, but then I attempted the ./configure --with-tcp-wrappers and it errored with -lwrap not found. checking for SSL directory... /usr/local/ssl checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... no checking for socket in -lsocket... no checking for pthread_create in -lpthread... no checking for pthread_create in -lc_r... no checking for openpty in -lutil... yes checking whether to use the libwrap (TCP wrappers) library... yes checking for hosts_access in -lwrap... not found <-- .............. So then I tried assigning the 3 environment variables and things got worse. The include and lib directories are referenced for tcpd 7.6, but after installing tcp wrappers I do not find include or lib directories for tcpd. Q: Should I expect NOT to see the include or lib directories as defined in #1 above, and, if so, will specifying the absolute path to the tcpwrapper images (EX: /var/tcp_wrappers/tcp_wrappers_7.6) suffice? 3. I followed these instructions when compiling/configuring tcpd v7.6 (downloaded from ftp://ftp.porcupine.org/pub/security/index.html) ............ 7.1 - Easy configuration and installation ----------------------------------------- The "easy" recipe requires no changes to existing software or configuration files. Basically, you move the daemons that you want to protect to a different directory and plug the resulting holes with copies of the wrapper programs. If you don't run Ultrix, you won't need the miscd wrapper program. The miscd daemon implements among others the SYSTAT service, which produces the same output as the WHO command. Type `make' and follow the instructions. The Makefile comes with ready-to-use templates for many common UNIX implementations (sun, ultrix, hp-ux, aix, irix,...). .............. Thanks in advance for any guidance and/or advice that you can offer. --John Lanier

1 0

Special Installs -- Static Binaries and Required Files
by Hal Vaughan 08 Mar '06

08 Mar '06

I may need to include Stunnel with my application so my clients behind restrictive firewalls can still enable me to work on their systems with RealVNC. I'm working with clients on both Windows and Linux. Windows: I know the installer has the files included in it in an archive, but what archive format is it, or what kind or archive program on Linux can I use to read it? Is installing Stunnel on Windows just a matter of copying the files, or are there settings I have to change in the registry? Linux: Is there any way to get static binaries (yes, I know they're bigger) so I can just copy over files to install it as a program (not as a service -- I noticed Debian set it up as a service)? Thanks! Hal

1 0

Stunnel Won't Start on Linux (even with fixed /etc/default/stunnel)
by Hal Vaughan 08 Mar '06

08 Mar '06

I'm trying to start stunnel4 on Linux. I've modified the /etc/stunnel/stunnel.conf file so I can use it with RealVNC. When I run "stunnel4 /etc/stunnel/stunnel.conf" or "/etc/init.d/stunnel4 start", neither command gives me errors or any output, even with -d 7 set. After the shell returns control to me, I do "ps -ax" and have yet to see any instance of stunnel running. There is never a file in /var/run/stunnel to indicate a working daemon if I start it as one. I have edited /etc/default/stunnel4 to look like this (changed ENABLED). I've included it and my /etc/stunnel/stunnel.conf below. No matter what I do, there is never any evidence that stunnel is staring or doing anything. Even error messages would be a big help, so I'd at least know what was wrong. Any help appreciated. I'm sure it's something so obvious I don't see how I could miss it. Thanks for any help. Hal -----------------/etc/default/stunnel4------------------------ # /etc/default/stunnel # Julien LEMOINE <speedblue(a)debian.org> # September 2003 # Change to one to enable stunnel ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" # Change to one to enable ppp restart scripts PPP_RESTART=0 ------------/etc/stunnel/stunnel.conf-------------------- CAfile = /etc/stunnel/CAcert.pem CApath = /etc/stunnel/ cert = server.pem client = no verify = 3 debug = 7 [vnc] accept = 443 connect = 127.0.0.1:5500

2 2

RE: [stunnel-users] Re: Can stunnel do this?
by Matteo D'Amato 07 Mar '06

07 Mar '06

Here is what I'm getting Insude stunnel.conf file: cert=/usr/local/etc/stunnel/stunnel.pem cafile=/usr/local/etc/stunnel/stunnel.pem output=/var/log/stunnel.log client=yes debug=7 [1440] accept=10.10.10.2:1440 connect=192.168.19.50:1078 Launched using: stunnel /etc/stunnel/stunnel.conf -p /usr/local/etc/stunnel/stunnel.pem Log file: 2006.03.07 08:30:01 LOG5[13209:0]: Received signal 15; terminating 2006.03.07 08:30:01 LOG7[13209:0]: removing pid file /usr/local/var/stunnel/stunnel.pid 2006.03.07 08:30:20 LOG5[13219:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.03.07 08:30:20 LOG7[13219:1]: Snagged 64 random bytes from /root/.rnd 2006.03.07 08:30:20 LOG7[13219:1]: Wrote 1024 new random bytes to /root/.rnd 2006.03.07 08:30:20 LOG7[13219:1]: RAND_status claims sufficient entropy for the PRNG 2006.03.07 08:30:20 LOG6[13219:1]: PRNG seeded successfully 2006.03.07 08:30:20 LOG7[13219:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2006.03.07 08:30:20 LOG7[13219:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2006.03.07 08:30:20 LOG6[13219:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.03.07 08:30:20 LOG6[13219:1]: poll() used - no FD_SETSIZE limit for file descriptors 2006.03.07 08:30:20 LOG5[13219:1]: 500 clients allowed 2006.03.07 08:30:20 LOG7[13219:1]: FD 4 in non-blocking mode 2006.03.07 08:30:20 LOG7[13219:1]: FD 5 in non-blocking mode 2006.03.07 08:30:20 LOG7[13219:1]: FD 6 in non-blocking mode 2006.03.07 08:30:20 LOG7[13219:1]: SO_REUSEADDR option set on accept socket 2006.03.07 08:30:20 LOG7[13219:1]: 1440 bound to 10.10.10.2:1440 2006.03.07 08:30:20 LOG7[13220:1]: Created pid file /usr/local/var/stunnel/stunnel.pid 2006.03.07 08:30:20 LOG7[13220:0]: Waiting -1 second(s) for 2 file descriptor(s) 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.03.07 08:31:46 LOG7[13220:1]: 1440 accepted FD=7 from 10.10.10.100:1049 2006.03.07 08:31:46 LOG7[13220:1]: Creating a new context 2006.03.07 08:31:46 LOG7[13220:1]: Context 2 created 2006.03.07 08:31:46 LOG7[13220:2]: Context swap: 1 -> 2 2006.03.07 08:31:46 LOG7[13220:2]: 1440 started 2006.03.07 08:31:46 LOG7[13220:2]: FD 7 in non-blocking mode 2006.03.07 08:31:46 LOG7[13220:2]: FD 8 in non-blocking mode 2006.03.07 08:31:46 LOG7[13220:2]: FD 9 in non-blocking mode 2006.03.07 08:31:46 LOG7[13221:0]: Waiting 300 second(s) for 3 file descriptor(s) 2006.03.07 08:31:46 LOG7[13221:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13221:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:46 LOG7[13221:0]: CONTEXT 2, FD=9, (OUT)->(OUT) 2006.03.07 08:31:46 LOG7[13220:0]: Waiting 300 second(s) for 3 file descriptor(s) 2006.03.07 08:31:46 LOG7[13220:0]: Cleaning up the signal pipe 2006.03.07 08:31:46 LOG6[13220:0]: Child process 13221 finished with code 0 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(INHUP) 2006.03.07 08:31:46 LOG7[13220:2]: Connection from 10.10.10.100:1049 permitted by libwrap 2006.03.07 08:31:46 LOG5[13220:2]: 1440 connected from 10.10.10.100:1049 2006.03.07 08:31:46 LOG7[13220:2]: FD 8 in non-blocking mode 2006.03.07 08:31:46 LOG7[13220:2]: 1440 connecting 192.168.19.50:1078 2006.03.07 08:31:46 LOG7[13220:2]: connect_wait: waiting 10 seconds 2006.03.07 08:31:46 LOG7[13220:0]: Waiting 10 second(s) for 3 file descriptor(s) 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2006.03.07 08:31:46 LOG7[13220:2]: connect_wait: connected 2006.03.07 08:31:46 LOG7[13220:2]: Remote FD=8 initialized 2006.03.07 08:31:46 LOG7[13220:2]: SSL state (connect): before/connect initialization 2006.03.07 08:31:46 LOG7[13220:2]: SSL state (connect): SSLv3 write client hello A 2006.03.07 08:31:46 LOG7[13220:0]: Waiting 300 second(s) for 3 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.03.07 08:31:47 LOG7[13220:1]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:1]: Context swap: 2 -> 1 2006.03.07 08:31:47 LOG7[13220:1]: Current context: 1 2006.03.07 08:31:47 LOG7[13220:1]: 1440 accepted FD=9 from 10.10.10.100:1050 2006.03.07 08:31:47 LOG7[13220:1]: Creating a new context 2006.03.07 08:31:47 LOG7[13220:1]: Context 3 created 2006.03.07 08:31:47 LOG7[13220:3]: Context swap: 1 -> 3 2006.03.07 08:31:47 LOG7[13220:3]: 1440 started 2006.03.07 08:31:47 LOG7[13220:3]: FD 9 in non-blocking mode 2006.03.07 08:31:47 LOG7[13220:3]: FD 10 in non-blocking mode 2006.03.07 08:31:47 LOG7[13220:3]: FD 11 in non-blocking mode 2006.03.07 08:31:47 LOG7[13222:0]: Waiting 299 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 3, FD=11, (OUT)->(OUT) 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 299 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: Cleaning up the signal pipe 2006.03.07 08:31:47 LOG6[13220:0]: Child process 13222 finished with code 0 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(INHUP) 2006.03.07 08:31:47 LOG7[13220:3]: Connection from 10.10.10.100:1050 permitted by libwrap 2006.03.07 08:31:47 LOG5[13220:3]: 1440 connected from 10.10.10.100:1050 2006.03.07 08:31:47 LOG7[13220:3]: FD 10 in non-blocking mode 2006.03.07 08:31:47 LOG7[13220:3]: 1440 connecting 192.168.19.50:1078 2006.03.07 08:31:47 LOG7[13220:3]: connect_wait: waiting 10 seconds 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 10 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 3, FD=10, (INOUT)->(OUT) 2006.03.07 08:31:47 LOG7[13220:3]: connect_wait: connected 2006.03.07 08:31:47 LOG7[13220:3]: Remote FD=10 initialized 2006.03.07 08:31:47 LOG7[13220:3]: SSL state (connect): before/connect initialization 2006.03.07 08:31:47 LOG7[13220:3]: SSL state (connect): SSLv3 write client hello A 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 299 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(IN) 2006.03.07 08:31:47 LOG7[13220:2]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:2]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:2]: CONTEXT 3, FD=10, (IN)->() 2006.03.07 08:31:47 LOG7[13220:2]: Context swap: 3 -> 2 2006.03.07 08:31:47 LOG7[13220:2]: Current context: 2 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 300 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(IN) 2006.03.07 08:31:47 LOG7[13220:3]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:3]: Context swap: 2 -> 3 2006.03.07 08:31:47 LOG7[13220:3]: Current context: 3 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 300 second(s) for 4 file descriptor(s) 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(IN) 2006.03.07 08:32:02 LOG7[13220:2]: CONTEXT 3, FD=10, (IN)->() 2006.03.07 08:32:02 LOG7[13220:2]: Context swap: 3 -> 2 2006.03.07 08:32:02 LOG7[13220:2]: Current context: 2 2006.03.07 08:32:02 LOG7[13220:0]: Waiting 285 second(s) for 4 file descriptor(s) 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(IN) 2006.03.07 08:32:02 LOG7[13220:3]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:32:02 LOG7[13220:3]: Context swap: 2 -> 3 2006.03.07 08:32:02 LOG7[13220:3]: Current context: 3 2006.03.07 08:32:02 LOG7[13220:0]: Waiting 300 second(s) for 4 file descriptor(s) 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(IN) 2006.03.07 08:32:17 LOG7[13220:2]: CONTEXT 3, FD=10, (IN)->() 2006.03.07 08:32:17 LOG7[13220:2]: Context swap: 3 -> 2 2006.03.07 08:32:17 LOG7[13220:2]: Current context: 2 2006.03.07 08:32:17 LOG7[13220:2]: SSL alert (write): fatal: handshake failure 2006.03.07 08:32:17 LOG3[13220:2]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.03.07 08:32:17 LOG7[13220:2]: 1440 finished (1 left) 2006.03.07 08:32:17 LOG5[13220:2]: stack_info: size=65536, current=4208 (6%), maximum=4208 (6%) 2006.03.07 08:32:17 LOG7[13220:2]: Context 2 closed 2006.03.07 08:32:17 LOG7[13220:0]: Waiting 285 second(s) for 3 file descriptor(s) 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(IN) 2006.03.07 08:32:17 LOG7[13220:3]: Context set: 2 (dropped) -> 3 2006.03.07 08:32:17 LOG7[13220:3]: Current context: 3 2006.03.07 08:32:17 LOG7[13220:3]: Releasing context 2 2006.03.07 08:32:17 LOG7[13220:3]: SSL alert (write): fatal: handshake failure 2006.03.07 08:32:17 LOG3[13220:3]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.03.07 08:32:17 LOG7[13220:3]: 1440 finished (0 left) 2006.03.07 08:32:17 LOG5[13220:3]: stack_info: size=65536, current=4208 (6%), maximum=4208 (6%) 2006.03.07 08:32:17 LOG7[13220:3]: Context 3 closed 2006.03.07 08:32:17 LOG7[13220:0]: Waiting -1 second(s) for 2 file descriptor(s) --Matteo D'Amato

1 0

RE: [stunnel-users] Re: Can stunnel do this?
by Kevin A. McGrail 07 Mar '06

07 Mar '06

This sounds like exactly what stunnel does. You want to have host A talk to Server A via SSL so you run stunneld on it. Then it will redirect that connection to server B via non-SSL. What protocol are we talking about here? Let's assume it's https: On Server A, setup stunnel with a conf file with these lines (as well as many others surely) [https] accept = 443 connect = serverb.smartbox.ca:80 Then your host connects to server a, negotiates SSL and the information is sent to the other server. I think your biggest issue is going to be the certificate on Server A so that the Host connects to the Server without certificate issues. Sincerely, Kevin A. McGrail aka KAM > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net > [mailto:stunnel-users-bounces@mirt.net] On Behalf Of Matteo D'Amato > Sent: Monday, March 06, 2006 7:20 PM > To: stunnel-users(a)mirt.net > Subject: RE: [stunnel-users] Re: Can stunnel do this? > > Stunnel can only be installed on Server A > > > > --Matteo D'Amato > > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net > [mailto:stunnel-users-bounces@mirt.net] On Behalf Of Matteo D'Amato > Sent: Monday, March 06, 2006 5:58 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Re: Can stunnel do this? > > Hi, > Can stunnel do this > > > Host A ---------> Server A ---------> Server B > SSL unencrypted > > This looks like the opposite of what stunnel does. I have a > host that speaks SSL that needs to talk to a server that does > not and the host must always initiate the connection. Any > ideas if this can be done with stunnel or is there another > way to do this. Thanks

1 0

RE: [stunnel-users] Re: Can stunnel do this?
by Matteo D'Amato 07 Mar '06

07 Mar '06

Stunnel can only be installed on Server A --Matteo D'Amato -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users-bounces@mirt.net] On Behalf Of Matteo D'Amato Sent: Monday, March 06, 2006 5:58 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Re: Can stunnel do this? Hi, Can stunnel do this Host A ---------> Server A ---------> Server B SSL unencrypted This looks like the opposite of what stunnel does. I have a host that speaks SSL that needs to talk to a server that does not and the host must always initiate the connection. Any ideas if this can be done with stunnel or is there another way to do this. Thanks -- Matteo D'Amato Smartbox Equipment Inc _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: Can stunnel do this?
by Matteo D'Amato 06 Mar '06

06 Mar '06

Hi, Can stunnel do this Host A ---------> Server A ---------> Server B SSL unencrypted This looks like the opposite of what stunnel does. I have a host that speaks SSL that needs to talk to a server that does not and the host must always initiate the connection. Any ideas if this can be done with stunnel or is there another way to do this. Thanks -- Matteo D'Amato Smartbox Equipment Inc

1 0

configure problem in 4.14
by MeeAGhost 06 Mar '06

06 Mar '06

Whether --enable-dh is defined or not the stunnel created certificates created during make-install will include DH support. This is because the USE_DH variable in tools/Makefile is undefined which in turn causes the test portion of the install-data-local section of the tools/Makefile below to fail test $(USE_DH) -eq 0 || $(openssl) gendh $$RND 512 >> stunnel.pem; \ $(openssl) x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ ${INSTALL} -m 600 stunnel.pem $(DESTDIR)$(confdir)/stunnel.pem; \ rm stunnel.pem; \ The test fails with this error message "/bin/bash: test: -eq: unary operator expected" since USE_DH is empty (undefined). I looked at the dh section of the configure script and it appears USE_DH is being set to 1 when --enable-dh is defined. However, USE_DH=1 is only in the DEFS section of tools/Makefile and not actually setting the value of USE_DH variable. I read in the change notes (from several years ago) that dh was disabled by default. I have been running stunnel for the past 3-4 years but have since I initially installed it back then I have been upgrading and therefore the above section of the tools\Makefile was skipped since I already had certificates defined. I went to install on a new box today and found the above 'problem'. So I am not sure how long this has been like this. Before I tried to figure out what is "wrong" I wanted to see if others have noticed this. I have seen this on Solaris 9 and in the cygwin 1.5.19.

2 1