1

I've got STunnel configured to proxy non SSL POP3 requests to GMail on port 111. This is working fine when STunnel is running as a desktop app, but when I run the STunnel service, I can't connect to port 111 on the machine (using Outlook Express for example).

The Stunnel log file shows the port binding is succeeding, but it never sees a connection. There's something preventing the connection to that port when STunnel is running as a service?

Here's stunnel.conf

cert = stunnel.pem

; Some performance tunings  
socket = l:TCP_NODELAY=1  
socket = r:TCP_NODELAY=1  

; Some debugging stuff useful for troubleshooting  
debug = 7  
output = stunnel.log  

; Use it for client mode  
client = yes

; Service-level configuration

[gmail]  
accept = 127.0.0.1:111  
connect = pop.gmail.com:995  

stunnel.log from service

2010.10.07 12:14:22 LOG5[80444:72984]: Reading configuration from file stunnel.conf  
2010.10.07 12:14:22 LOG7[80444:72984]: Snagged 64 random bytes from C:/.rnd  
2010.10.07 12:14:23 LOG7[80444:72984]: Wrote 1024 new random bytes to C:/.rnd  
2010.10.07 12:14:23 LOG7[80444:72984]: PRNG seeded successfully  
2010.10.07 12:14:23 LOG7[80444:72984]: Certificate: stunnel.pem  
2010.10.07 12:14:23 LOG7[80444:72984]: Certificate loaded  
2010.10.07 12:14:23 LOG7[80444:72984]: Key file: stunnel.pem  
2010.10.07 12:14:23 LOG7[80444:72984]: Private key loaded  
2010.10.07 12:14:23 LOG7[80444:72984]: SSL context initialized for service gmail  
2010.10.07 12:14:23 LOG5[80444:72984]: Configuration successful  
2010.10.07 12:14:23 LOG5[80444:72984]: No limit detected for the number of clients  
2010.10.07 12:14:23 LOG7[80444:72984]: FD=156 in non-blocking mode  
2010.10.07 12:14:23 LOG7[80444:72984]: Option SO_REUSEADDR set on accept socket  
2010.10.07 12:14:23 LOG7[80444:72984]: Service gmail bound to 0.0.0.0:111  
2010.10.07 12:14:23 LOG7[80444:72984]: Service gmail opened FD=156  
2010.10.07 12:14:23 LOG5[80444:72984]: stunnel 4.34 on x86-pc-mingw32-gnu with OpenSSL 1.0.0a 1 Jun 2010  
2010.10.07 12:14:23 LOG5[80444:72984]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6  

stunnel.log from desktop (working) process

2010.10.07 12:10:31 LOG5[80824:81200]: Reading configuration from file stunnel.conf  
2010.10.07 12:10:31 LOG7[80824:81200]: Snagged 64 random bytes from C:/.rnd  
2010.10.07 12:10:32 LOG7[80824:81200]: Wrote 1024 new random bytes to C:/.rnd  
2010.10.07 12:10:32 LOG7[80824:81200]: PRNG seeded successfully  
2010.10.07 12:10:32 LOG7[80824:81200]: Certificate: stunnel.pem  
2010.10.07 12:10:32 LOG7[80824:81200]: Certificate loaded  
2010.10.07 12:10:32 LOG7[80824:81200]: Key file: stunnel.pem  
2010.10.07 12:10:32 LOG7[80824:81200]: Private key loaded  
2010.10.07 12:10:32 LOG7[80824:81200]: SSL context initialized for service gmail  
2010.10.07 12:10:32 LOG5[80824:81200]: Configuration successful  
2010.10.07 12:10:32 LOG5[80824:81200]: No limit detected for the number of clients  
2010.10.07 12:10:32 LOG7[80824:81200]: FD=156 in non-blocking mode  
2010.10.07 12:10:32 LOG7[80824:81200]: Option SO_REUSEADDR set on accept socket  
2010.10.07 12:10:32 LOG7[80824:81200]: Service gmail bound to 0.0.0.0:111  
2010.10.07 12:10:32 LOG7[80824:81200]: Service gmail opened FD=156  
2010.10.07 12:10:33 LOG5[80824:81200]: stunnel 4.34 on x86-pc-mingw32-gnu with OpenSSL 1.0.0a 1 Jun 2010  
2010.10.07 12:10:33 LOG5[80824:81200]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6  
2010.10.07 12:10:33 LOG7[80824:81844]: Service gmail accepted FD=188 from 127.0.0.1:24813  
2010.10.07 12:10:33 LOG7[80824:81844]: Creating a new thread  
2010.10.07 12:10:33 LOG7[80824:81844]: New thread created  
2010.10.07 12:10:33 LOG7[80824:25144]: Service gmail started  
2010.10.07 12:10:33 LOG7[80824:25144]: FD=188 in non-blocking mode  
2010.10.07 12:10:33 LOG7[80824:25144]: Option TCP_NODELAY set on local socket  
2010.10.07 12:10:33 LOG5[80824:25144]: Service gmail accepted connection from 127.0.0.1:24813  
2010.10.07 12:10:33 LOG7[80824:25144]: FD=212 in non-blocking mode  
2010.10.07 12:10:33 LOG6[80824:25144]: connect_blocking: connecting 209.85.227.109:995  
2010.10.07 12:10:33 LOG7[80824:25144]: connect_blocking: s_poll_wait 209.85.227.109:995: waiting 10 seconds  
2010.10.07 12:10:33 LOG5[80824:25144]: connect_blocking: connected 209.85.227.109:995  
2010.10.07 12:10:33 LOG5[80824:25144]: Service gmail connected remote server from 192.168.1.9:24814  
2010.10.07 12:10:33 LOG7[80824:25144]: Remote FD=212 initialized  
2010.10.07 12:10:33 LOG7[80824:25144]: Option TCP_NODELAY set on remote socket  
2010.10.07 12:10:33 LOG7[80824:25144]: SSL state (connect): before/connect initialization  
2010.10.07 12:10:33 LOG7[80824:25144]: SSL state (connect): SSLv3 write client hello A  
2010.10.07 12:10:33 LOG7[80824:25144]: SSL state (connect): SSLv3 read server hello A  
2010.10.07 12:10:33 LOG7[80824:25144]: SSL state (connect): SSLv3 read server certificate A  
2010.10.07 12:10:33 LOG7[80824:25144]: SSL state (connect): SSLv3 read server done A  
2010.10.07 12:10:33 LOG7[80824:25144]: SSL state (connect): SSLv3 write client key exchange A  
2010.10.07 12:10:33 LOG7[80824:25144]: SSL state (connect): SSLv3 write change cipher spec A  
2010.10.07 12:10:33 LOG7[80824:25144]: SSL state (connect): SSLv3 write finished A  
2010.10.07 12:10:33 LOG7[80824:25144]: SSL state (connect): SSLv3 flush data  
2010.10.07 12:10:33 LOG7[80824:25144]: SSL state (connect): SSLv3 read finished A  
2010.10.07 12:10:33 LOG7[80824:25144]:    1 items in the session cache  
2010.10.07 12:10:33 LOG7[80824:25144]:    1 client connects (SSL_connect())  
2010.10.07 12:10:33 LOG7[80824:25144]:    1 client connects that finished  
2010.10.07 12:10:33 LOG7[80824:25144]:    0 client renegotiations requested  
2010.10.07 12:10:33 LOG7[80824:25144]:    0 server connects (SSL_accept())  
2010.10.07 12:10:33 LOG7[80824:25144]:    0 server connects that finished  
2010.10.07 12:10:33 LOG7[80824:25144]:    0 server renegotiations requested  
2010.10.07 12:10:33 LOG7[80824:25144]:    0 session cache hits  
2010.10.07 12:10:33 LOG7[80824:25144]:    0 external session cache hits  
2010.10.07 12:10:33 LOG7[80824:25144]:    0 session cache misses  
2010.10.07 12:10:33 LOG7[80824:25144]:    0 session cache timeouts  
2010.10.07 12:10:33 LOG6[80824:25144]: SSL connected: new session negotiated  
2010.10.07 12:10:33 LOG6[80824:25144]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5   
2010.10.07 12:10:34 LOG7[80824:25144]: SSL socket closed on SSL_read  
2010.10.07 12:10:34 LOG7[80824:25144]: Sending socket write shutdown  
2010.10.07 12:10:34 LOG5[80824:25144]: Connection closed: 53 bytes sent to SSL, 118 bytes sent to socket  
2010.10.07 12:10:34 LOG7[80824:25144]: Service gmail finished (0 left)  
3
  • Can you post stunnel.conf?
    – gm3dmo
    Oct 6, 2010 at 20:24
  • I've edited the original to show the stunnel.conf. Any input would be appreciated, thanks. Oct 7, 2010 at 9:20
  • are you running it as a local service or under a user? the settings in services.msc should tell you.
    – Silverfire
    Aug 30, 2011 at 7:24

2 Answers 2

1

I've had the same problem on a W2003 x64 Datacenter server (a virtual server). Turning off the windows firefall didn't solve the problem. One thing made me wonder: the service didn't show up in the services.msc - list.

After adding service=stunnel to the conf-file it seemed to work.

Then I restarted the server and it didn't work again. I logged in, restarted the service via services.msc and it worked again. Really strange thing.

0

Try putting:

foreground = yes

in there.

Does "stunnel.log" contain anything you can post?

9
  • foreground = yes caused the server not to start. Maybe because it's a 'Unix only' option in the manual and I'm running Windows. Oct 7, 2010 at 11:11
  • I've appended an stunnel.log from the working and non-working processes. The Non-working one just never seems to receive a connection ?? Oct 7, 2010 at 12:05
  • I tried stunnel 4.34 on Windows XP, worked ok when run as a service. Do you see anything in the windows event log ?(run eventvwr.exe) when it run as a service?
    – gm3dmo
    Oct 7, 2010 at 20:00
  • Yes, I've done that on XP too and it works on XP! I'm getting the problem on a Windows 2003 Server SP2 box. It's baffling me. Nothing in any of the event logs when it's running as a service. Oct 8, 2010 at 13:11
  • Is it possible that when it's run in the foreground Windows 2003 asked you if you wanted to allow stunnel to use the network and so now in the foreground it's happy for it to run whereas when it's a service the Windows firewall blocks it. Can you disable Windows firewall temporarily to test or a add a rule for allowing TCP on 995?
    – gm3dmo
    Oct 8, 2010 at 17:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .