February 2010 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Re: [stunnel-users] Stunnel on the same machine
by subrata＠indiatimes.com 01 Aug '11

01 Aug '11

The configuration files are : pid = /var/stunnel.pid ;chroot = /var/lib/stunnel setuid = nobody setgid = nobody foreground =yes ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept = 3307 connect = 192.168.1.6:3307 On 192.168.1.6 ---------------------- pid = /var/stunnel.pid setuid =nobody setgid = nobody foreground = yes client = no ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept =3307 connect =3306 connecting like /usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307 Enter password: On entring password the following lines appear : ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 Subrata ----- Original Message ----- From: Brian Hatch <bri(a)stunnel.org> To: subrata(a)indiatimes.com Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST) Subject: Re: [stunnel-users] Stunnel on the same machine Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted: > After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there. What do your stunnel configuration files look like? Other problem: mysql client may decide to use a local domain socket when connecting to localhost, thwarting your attempts to go via Stunnel. You might want to 'strace mysql ...' and look for the connect() lines. -- Brian Hatch Time flies like an Systems and arrow. Fruit flies Security Engineer like a banana. http://www.ifokr.org/bri/ Every message PGP signed -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

How do you configure Stunnel Ver 4.31 for TLSv1 - More Info
by David M. Douglass 12 Mar '10

12 Mar '10

Reference: Stunnel Ver 4.31 Windows Binaries This is the actual configuration file I am using. There is not too much to it. As shown below, this WORKS for Gmail's SSL port.. Port 465. Notice that the sslVersion statement is remarked "out". +++++++++++++++++++++++++++ output = STUNNEL.log taskbar = NO cert = stunnel.pem client = yes [SSMTP] accept=DADSXPPRO:8025 connect=smtp.gmail.com:465 ;sslVersion = TLSv1 ++++++++++++++++++++++++++++ In theory (as I have read it...), to change this to TLS, I enable the sslVersion line, And change the port (for Gmail) to 587. Port 587 and TLS for Gmail have been tested and verified via Microsoft Outlook testing. But when I do so, I cannot even log onto the Gmail server. I get the error message referenced in the first message: 2010.02.25 10:35:44 LOG3[2696:2740]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number It occurs to me that I am only using the "stunnel.pem" file, as supplied by the installer program. Do I have a certificate issue? David M. Douglass david(a)az-douglass.net Home (480) 839-2629 Cell (602) 908-9092

4 5

Problem with openssl engine
by Nick Sayer 28 Feb '10

28 Feb '10

I'm trying to use a smart card to hold on to the private key for my server. Since access to the smart card is restricted to one process at a time (not sure why it can't be shared, but that's a whole separate discussion), I'd like to use stunnel as the machine-wide SSL proxy. The problem is that with the pkcs11 engine configuration set up, it fails. 2010.02.27 00:15:03 LOG5[91580:0]: imaps accepted connection from 71.141.64.2:32934 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): before/accept initialization 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 read client hello A 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 write server hello A 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 write certificate A 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 write server done A 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 flush data 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 read client key exchange A 2010.02.27 00:15:03 LOG7[91580:0]: SSL alert (write): fatal: bad record mac 2010.02.27 00:15:03 LOG3[91580:0]: SSL_accept: 1408F119: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2010.02.27 00:15:03 LOG5[91580:0]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.02.27 00:15:03 LOG7[91576:0]: Cleaning up the signal pipe 2010.02.27 00:15:03 LOG7[91576:0]: Process 91580 finished with code 0 (0 left) ^C2010.02.27 00:15:42 LOG3[91576:0]: Received signal 2; terminating This happens *whether or not* I use the private key on the smart card itself. If I load the private key from a disk file, it still happens - even if there is no engineNum statement in the service configuration block. The only way to make it not happen is to comment out the engineCtrl lines. engine=dynamic engineCtrl=SO_PATH:/usr/local/lib/engines/engine_pkcs11.so engineCtrl=ID:pkcs11 engineCtrl=LIST_ADD:1 engineCtrl=LOAD engineCtrl=MODULE_PATH:/usr/local/lib/pkcs11/opensc-pkcs11.so engineCtrl=INIT engineCtrl=PIN:12345678 [imaps] accept = 4993 connect = 143 engineNum = 1 key = id_10 ;cert = id_10 cert = /www.crt It's also worth noting that stunnel seems unable to pull the cert out of the card - that cert=id_10 line should work (works with openssl s_server). This stunnel was compiled last night from the FreeBSD ports tree with WITH_STUNNEL_SSL_ENGINE turned on. stunnel 4.29 on i386-portbld-freebsd8.0 with OpenSSL 0.9.8k 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = 5 pid = /var/tmp/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Note that the same card in the same system can successfully provide ssl server sockets with Java using the Sun PKCS11 JCE provider configured to talk to the opensc PKCS11 module. So there's nothing wrong with the card.

1 0

stunnel-4.15-2.el5.1 zombie when xinetd
by tatiana philippova 26 Feb '10

26 Feb '10

Hi All, I have a problem with stunnel in xinetd mode. It cannot connect to specified localhost:port - always getting child stunnel defunct as a result.. 4789 ? Ss 0:00 \_ stunnel /etc/stunnel/stunnel.conf 4790 ? Z 0:00 \_ [stunnel] <defunct> I'm trying use rsync via stunnel (!ssh for rsync does not suits me in this particular case, but I need encrypt backup traffic anyway.. so have chosen stunnel) client config: cert = /etc/stunnel/stunnel_client_cert.pem client = yes pid = /var/run/stunnel.pid debug = 7 output = /var/log/stunnel.log sslVersion = SSLv2 [ssync] accept = 873 connect = myhost.somewhere.net:273 server config: cert = /etc/stunnel/certs/host.pem key = /etc/stunnel/certs/private/cakey.pem client = no pid = /var/run/stunnel.pid debug = 7 #foreground = yes output = /var/log/stunel.log connect = 873 xinetd config: # default: off # description: SSL wrapper for rsyncd service ssync { disable = no socket_type = stream wait = no user = root server = /usr/sbin/stunnel server_args = /etc/stunnel/stunnel.conf log_on_success += HOST DURATION log_on_failure += HOST only_from = 192.168.5.15 127.0.0.1 } on server side /etc/services: ssync 273/tcp # rsync over stunnel # ps axf | grep rsyn 15637 ? S 0:00 /usr/bin/rsync -4 --daemon --no-detach # netstat -an --program | grep 273 tcp 0 0 0.0.0.0:273 0.0.0.0:* LISTEN 4751/xinetd # netstat -an --program | grep 873 tcp 0 0 127.0.0.1:873 0.0.0.0:* LISTEN 15637/rsync In case of server stunnel running as standalone - everything works perfectly well, but I need it working as xinetd service rather than standalone Could somebody kindly advise what I'm doing wrong? soft on server side: stunnel-4.15-2.el5.1, openssl-0.9.8e-7.el5 OS CentOS release 5.3 (Final), kernel 2.6.18-128.1.6.el5 on client side: stunnel-4.30-1.i386.rpm (compiled as rpmbuild -ta stunnel-4.30.tar.gz) openssl-0.9.8g-9.14.fc9.i686 OS Fedora release 9 (Sulphur) kernel 2.6.28 Many thanks in advance Taphy

1 0

How do you configure Stunnel Ver 4.31 for TLSv1
by David M. Douglass 26 Feb '10

26 Feb '10

I am using the Windows Binary of Version 4.31, and an external email utility that sends SMTP outgoing email. I can configure for specific ports (no problem). and I can send SSMTP SSLv3 with success. That is GOOD ! I am trying to configure Stunnel for sending TLSv1 without success. I understand (via the Version command and screen) that Stunnel defaults to SSLv3. How do I change that to TLSv1 ?? I found the parameter : sslVersion = version select version of SSL protocol Allowed options: all, SSLv2, SSLv3, TLSv1 This appears to be a "SERVICE LEVEL" option, and I have tried to use the line: sslVersion = TLSv1 in the [SSMTP] group of options (along with accept = and connect = ), but get an error message in the log file, which is shown next: 2010.02.25 10:35:44 LOG3[2696:2740]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I have also tried to put the sslVersion = line in the general configuration area, but generate the same error message. The outbound email does, in fact, fail. Can anyone suggest what I am doing wrong ?? Or offer a solution for configuring Stunnel (V4.31) for TLSv1 ?? David M. Douglass david(a)az-douglass.net Home (480) 839-2629 Cell (602) 908-9092

1 0

How to use stunnel
by Gabriel kamega 24 Feb '10

24 Feb '10

Hello sir, Thank you for my subscription. This is the issue: I want to sent automaticly email via smtp.gmail.com server, And I think I need stunnel program. My questions are : *How to use stunnel ?* ; *How to configure the stunnel.conf file ?* I have dowloaded stunnel.exe version 431, but I can't download the * stunnel.pem* file. on the net I see that I have to install with this command : stunnel -install is that all ? on WXP Professionnel SP2 Regards merci

1 0

Access control/TCP wrappers
by Craig Watkinson 23 Feb '10

23 Feb '10

Hi, We're using stunnel to provide a secure interface to an old server that doesn't support HTTPS natively. I'd like to implement some access control so that connections are only supported from specific IP addresses. I am using v4.27 of stunnel that I downloaded from HPs website, and am running it from inittab to ensure it is always running. Unfortunately I don't think it's compiled with libwrap. Should I see libwrap listed when I run ldd against the binary (see below for output)? I think it's possible to run stunnel from inetd. Could I wrapper it here? Is the following entry correct? stunnel stream tcp nowait root /usr/lbin/tcpd /opt/iexpress/stunnel/bin/stunnel stunnel I think this would work, but I'm concerned that if stunnel was to crash or be killed that there would be nothing restarting it if we ran it from inetd. Any advice much appreciated Craig ------------------------------------- # ./stunnel -version stunnel 4.27 on ia64-hp-hpux11.23 with OpenSSL 0.9.7m 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = 5 pid = /opt/iexpress/stunnel/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL+RC4:@STRENGTH key = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # ldd ./stunnel libdl.so.1 => /usr/lib/hpux32/libdl.so.1 libnsl.so.1 => /usr/lib/hpux32/libnsl.so.1 libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1 libunwind.so.1 => /usr/lib/hpux32/libunwind.so.1 libc.so.1 => /usr/lib/hpux32/libc.so.1 libxti.so.1 => /usr/lib/hpux32/libxti.so.1 libuca.so.1 => /usr/lib/hpux32/libuca.so.1 libdl.so.1 => /usr/lib/hpux32/libdl.so.1 _________________________________________________________________ Do you have a story that started on Hotmail? Tell us now http://clk.atdmt.com/UKM/go/195013117/direct/01/

2 2

4.26 and commercial certificate - Now working.
by Editor (Kevin) 20 Feb '10

20 Feb '10

Hi: Thanks. Everything is working now. > Message: 1 > Date: Wed, 17 Feb 2010 07:11:16 -0800 (PST) > From: Leandro Avila <leandro.avila(a)ymail.com> > Subject: Re: [stunnel-users] Small challenge with version 4.26 and a > commercial certificate > To: stunnel-users(a)mirt.net > Message-ID: <544640.49520.qm(a)web111011.mail.gq1.yahoo.com> > Content-Type: text/plain; charset=us-ascii > > Hi Kevin, > > I think there is ambiguous information about this. > The man page states that the private key should be unencrypted > However, the changelog states that the support for pass phrases was fixed in v4.20 > > I'll do some testing see what I can find. Or maybe someone can shed some light on the issue. > > Best regards > > ----------------- > Leandro Avila

1 0

Re: [stunnel-users] Make reports an error on Aix with stunnel-4.30
by Michal Trojnara 20 Feb '10

20 Feb '10

Derek Nicholls wrote: > gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith > -I/opt/freeware/include -o stunnel file.o client.o log.o options.o > protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o > pty.o libwrap.o -lz -ldl -L/opt/freeware/lib -lssl -lcrypto > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_set_info_callback > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_new_cb > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_get_cb > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_remove_cb > ld: 0711-317 ERROR: Undefined symbol: .BIO_set_flags > ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more > information. > collect2: ld returned 8 exit status > make: 1254-004 The error code from the last command is 1. What it means is that the linker has found on its path another version of libssl, older than your headers in /opt/freeware/include. Mike

1 0