Stunnel setup with Usenet Explorer

bushsolo · Post by **bushsolo** » Wed May 02, 2007 3:16 pm

Sounds promising, I'm sure you would not find anyone complaining about a 1.3Mb program.

About the Root certificates, there is indeed an option to export certificates from IE7.

I presume we would need to find out from our news server which CA they use?

So if my usenet server uses GoDaddy I would go export the GoDaddy cert from IE7, is this correct?

alex · Post by **alex** » Thu May 03, 2007 2:26 am

Root certificates can be also downloaded from the certificate issuer site.

I'll check matters regarding certificates later.

alex · Post by **alex** » Fri May 04, 2007 2:52 am

ok the version without certificates is working here, at quick look i checked it with secnews.netscape.com

if someone wants to test the speed let me know, i can compile it and put download link right here.

the bandwidth will show the actual data download speed not the raw encrypted bandwidth, so it will be easy to compare performance with and without SSL.

i found out i forgot to synchronize keep alive with server subsets, i'm not sure i'll correct this first or check the certificate subject. btw keep alive is working with SSL as well.

stevendm · Post by **stevendm** » Fri May 04, 2007 3:40 am

I would like to test.

alex · Post by **alex** » Fri May 04, 2007 5:23 am

http://www.netwu.com/ue/ue1742ssl.rar

anyone if sees any crashes please don't forget to email me or paste here log.txt (i changed some server related code and adjusted client as well to be in accord with the changes, problems very unlikely though since the server runs perfectly)

as to SSL i would appreciate feedback about difference in the data download speed in the status bar so we can estimate how many % in bandwidth SSL overhead takes.

i may change the version if you are interested better set watch on this thread.

stevendm · Post by **stevendm** » Fri May 04, 2007 1:57 pm

I must be doing something wrong.

I previously had UE 1.7.3 running with stunnel and working fine.

I stopped the stunnel service and set it to manual start. I turned of the standard windows firewall. I disabled all of my existing servers. I created a new server to secure.usenetserver.com port 563 and checked the ssl checkbox. I cannot get headers and cannot get a newgroup list.

I am running Vista Ultimate, if that makes a difference.

What have I done wrong?

alex · Post by **alex** » Fri May 04, 2007 2:01 pm

is the version 1.7.4.2 ?

what error do you get in the headers "error" pane? (you should see the red question sign task manager tab).

stevendm · Post by **stevendm** » Fri May 04, 2007 2:11 pm

No error, it just stays with progress "Pending".
Yes, it is 1.7.4.2, according to the about box

alex · Post by **alex** » Fri May 04, 2007 2:14 pm

maybe the server number of tasks is zero?

if so check also default settings for a new server, properties->servers, otherwise how a newly created server got zero tasks.

stevendm · Post by **stevendm** » Fri May 04, 2007 2:32 pm

That's it. Setting max tasks to zero seems to be a bug. I remember now that I have seen this before.

As far as speed goes I see no difference between UE 1.7.3 with stunnel and 1.7.4.2. In fact, I see a speed increase from 1.7.3 through secure-tunnel and SSH from about 500 to 800 kB/s so I am a happy camper.

How do I test to make sure that this communication is actually going through SSL and my communication is secure?

alex · Post by **alex** » Fri May 04, 2007 2:37 pm

if you configured to ssl port it cannot do straight connection, if you uncheck "ssl" in the server properties - it won't work at all, with normal connection server writes first, with ssl - the client does so if non-ssl client tries to connect to ssl port - the client and the server both will be waiting and then maybe timeout error will result.

i also put small yellow lock sign on the server with ssl enabled.

to change default number of connections for new server edit menu->properties->servers, select the topmost "new server" item and set leftmost "max.tasks" to something else than zero and press "ok".

stevendm · Post by **stevendm** » Fri May 04, 2007 3:05 pm

I use a program called dumeter to monitor the speed of my internet connection. It runs in the system tray and reports all ethernet activity. With 1.7.3 and secure-tunnel the speeds reported in dumeter and UE were essentially the same. Now that I have switched over to SSL, UE reports ~800 kB/s and dumeter reports ~30 mbps. Do you know why dumeter reports such a high number? My internet connection is supposed to be capped at 8mbps so it seems like dumeter is wrong.

Am I downloading at 8 mbps or 30 mbps? I do not want to make my internet isp mad.

alex · Post by **alex** » Fri May 04, 2007 3:47 pm

UE shows the decrypted data download speed, the raw data bandwidth is be a bit higher because it also includes the SSL overhead. So if your ISP doesn't cap download speed based on packet content, your server is able to saturate your connection and noone is intercepting your packets or you don't care naturally you get better download speed without SSL.

Also maybe a positive moment if you are using SSL is data integrity - if e.g. you have malfunctioning firewall which corrupts downloads - you won't get corrupted downloads at all but rather as soon as a corruption occurs the download will be aborted (and retried - since I made all SSL errors retriable).

stevendm · Post by **stevendm** » Fri May 04, 2007 8:40 pm

I have been running since this morning and it looks good. The only problem I had is that I tried to go to a non SSL server and it wouldn't connect, even with the SSL checkbox off and going to port 119. You might want to double check me

bushsolo · Post by **bushsolo** » Sat May 05, 2007 7:14 am

I just changed turned off SSL and set it back to port 119, do not have any problems downloading!

I am not experiencing any slow down using SSL, at work I got 8MBytes and at home I still get my meager 150KBytes.