- stunnel-users - stunnel.org

Mutual Authentication
by Sameer Rahmani 11 Mar '13

11 Mar '13

Hi guys, I want to have secure tunnel to my server and also i want only specified clients can connect via the tunnel to the server. I was reading about mutual authentication but i can't run stunnel using verify=2 or 3 or 4. I confused. Can you please explain for me what should i do to use 2way ssl connection? how does stunnel use this?

2 1

It doesn't work.
by Raemsh Pungavanam 11 Mar '13

11 Mar '13

Hi , i have following issue with latest version of stunnel and openssl. version ====== stunnel - 4.55 openssl - 1.0.1e stunnel.conf ========== # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 # Comment it out on Win32 #cert = /etc/tr69/stunnel.pem key = /etc/tr69/stunnel.pem # chroot = /usr/local/var/run/stunnel/ # PID is created inside chroot jail pid = /var/run/ssl.pid setuid = root setgid = root # Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = TLSv1.2 # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Authentication stuff verify = 1 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: #CAfile = /usr/local/etc/stunnel/certs.pem #CAfile = /etc/tr69/ca.crt # CRL path or file (inside chroot jail): #CRLpath = /crls # or simply use CAfile instead: #CRLfile = /usr/local/etc/stunnel/crls.pem # Some debugging stuff debug = 7 output = /var/log/ssl.log foreground = yes # Use it for client mode client = yes # Service-level configuration [https] CAfile = /flash/Cert.pem accept = 127.0.0.1:8001 connect = acs.qacafe.com:80 #accept = 8080 cat /var/log/ssl.log ============== 2013.03.11 18:29:04 LOG5[5849:0]: stunnel 4.55 on mips-openwrt-linux-uclibc platform 2013.03.11 18:29:04 LOG5[5849:0]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2013.03.11 18:29:04 LOG5[5849:0]: Threading:FORK SSL:+ENGINE+OCSP Auth:none Sockets:POLL+IPv6 2013.03.11 18:29:04 LOG5[5849:0]: Reading configuration from file /etc/tr69/stunnel.conf 2013.03.11 18:29:04 LOG7[5849:0]: Compression not enabled 2013.03.11 18:29:04 LOG7[5849:0]: PRNG seeded successfully 2013.03.11 18:29:04 LOG6[5849:0]: Initializing service [https] 2013.03.11 18:29:04 LOG4[5849:0]: Insecure file permissions on /etc/tr69/stunnel.pem 2013.03.11 18:29:04 LOG7[5849:0]: Loaded verify certificates from /flash/Cert.pem 2013.03.11 18:29:04 LOG7[5849:0]: Loaded /flash/Cert.pem revocation lookup file 2013.03.11 18:29:04 LOG7[5849:0]: SSL options set: 0x00000004 2013.03.11 18:29:04 LOG5[5849:0]: Configuration successful 2013.03.11 18:29:04 LOG7[5849:0]: Service [https] (FD=17) bound to 127.0.0.1:8001 2013.03.11 18:29:04 LOG7[5849:0]: Created pid file /var/run/ssl.pid 2013.03.11 18:29:21 LOG7[5849:0]: Service [https] accepted (FD=4) from 127.0.0.1:36039 2013.03.11 18:29:21 LOG7[5920:0]: Service [https] started 2013.03.11 18:29:21 LOG5[5920:0]: Service [https] accepted connection from 127.0.0.1:36039 2013.03.11 18:29:22 LOG6[5920:0]: connect_blocking: connecting 6.0.0.1:80 2013.03.11 18:29:22 LOG7[5920:0]: connect_blocking: s_poll_wait 6.0.0.1:80: waiting 10 seconds 2013.03.11 18:29:22 LOG5[5920:0]: connect_blocking: connected 6.0.0.1:80 2013.03.11 18:29:22 LOG5[5920:0]: Service [https] connected remote server from 61.200.100.100:35694 2013.03.11 18:29:22 LOG7[5920:0]: Remote socket (FD=17) initialized 2013.03.11 18:29:22 LOG7[5920:0]: SNI: sending servername: acs.qacafe.com 2013.03.11 18:29:22 LOG7[5920:0]: SSL state (connect): before/connect initialization 2013.03.11 18:29:22 LOG7[5920:0]: SSL state (connect): SSLv3 write client hello A 2013.03.11 18:30:15 LOG7[5849:0]: Service [https] accepted (FD=4) from 127.0.0.1:36042 2013.03.11 18:30:15 LOG7[5973:0]: Service [https] started 2013.03.11 18:30:15 LOG5[5973:0]: Service [https] accepted connection from 127.0.0.1:36042 2013.03.11 18:30:15 LOG6[5973:0]: connect_blocking: connecting 6.0.0.1:80 2013.03.11 18:30:15 LOG7[5973:0]: connect_blocking: s_poll_wait 6.0.0.1:80: waiting 10 seconds 2013.03.11 18:30:15 LOG5[5973:0]: connect_blocking: connected 6.0.0.1:80 2013.03.11 18:30:15 LOG5[5973:0]: Service [https] connected remote server from 61.200.100.100:35697 2013.03.11 18:30:15 LOG7[5973:0]: Remote socket (FD=17) initialized 2013.03.11 18:30:15 LOG7[5973:0]: SNI: sending servername: acs.qacafe.com 2013.03.11 18:30:15 LOG7[5973:0]: SSL state (connect): before/connect initialization 2013.03.11 18:30:15 LOG7[5973:0]: SSL state (connect): SSLv3 write client hello A 2013.03.11 18:31:40 LOG7[5849:0]: Service [https] accepted (FD=4) from 127.0.0.1:49029 2013.03.11 18:31:40 LOG7[6023:0]: Service [https] started 2013.03.11 18:31:40 LOG5[6023:0]: Service [https] accepted connection from 127.0.0.1:49029 2013.03.11 18:31:40 LOG6[6023:0]: connect_blocking: connecting 6.0.0.1:80 2013.03.11 18:31:40 LOG7[6023:0]: connect_blocking: s_poll_wait 6.0.0.1:80: waiting 10 seconds 2013.03.11 18:31:40 LOG5[6023:0]: connect_blocking: connected 6.0.0.1:80 2013.03.11 18:31:40 LOG5[6023:0]: Service [https] connected remote server from 61.200.100.100:40051 2013.03.11 18:31:40 LOG7[6023:0]: Remote socket (FD=17) initialized 2013.03.11 18:31:40 LOG7[6023:0]: SNI: sending servername: acs.qacafe.com 2013.03.11 18:31:40 LOG7[6023:0]: SSL state (connect): before/connect initialization 2013.03.11 18:31:40 LOG7[6023:0]: SSL state (connect): SSLv3 write client hello A 2013.03.11 18:33:45 LOG7[5849:0]: Service [https] accepted (FD=4) from 127.0.0.1:49032 2013.03.11 18:33:45 LOG7[6074:0]: Service [https] started 2013.03.11 18:33:45 LOG5[6074:0]: Service [https] accepted connection from 127.0.0.1:49032 2013.03.11 18:33:45 LOG6[6074:0]: connect_blocking: connecting 6.0.0.1:80 2013.03.11 18:33:45 LOG7[6074:0]: connect_blocking: s_poll_wait 6.0.0.1:80: waiting 10 seconds 2013.03.11 18:33:45 LOG5[6074:0]: connect_blocking: connected 6.0.0.1:80 2013.03.11 18:33:45 LOG5[6074:0]: Service [https] connected remote server from 61.200.100.100:40054 2013.03.11 18:33:45 LOG7[6074:0]: Remote socket (FD=17) initialized 2013.03.11 18:33:45 LOG7[6074:0]: SNI: sending servername: acs.qacafe.com 2013.03.11 18:33:45 LOG7[6074:0]: SSL state (connect): before/connect initialization 2013.03.11 18:33:45 LOG7[6074:0]: SSL state (connect): SSLv3 write client hello A 2013.03.11 18:34:22 LOG6[5920:0]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.03.11 18:34:22 LOG5[5920:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.03.11 18:34:22 LOG7[5920:0]: Remote socket (FD=17) closed 2013.03.11 18:34:22 LOG7[5920:0]: Local socket (FD=4) closed 2013.03.11 18:34:22 LOG7[5920:0]: Service [https] finished 2013.03.11 18:34:22 LOG7[5920:0]: str_stats: 19 block(s), 877 data byte(s), 798 control byte(s) 2013.03.11 18:34:22 LOG7[5849:0]: Dispatching signals from the signal pipe 2013.03.11 18:34:22 LOG7[5849:0]: Processing SIGCHLD 2013.03.11 18:34:22 LOG7[5849:0]: Process 5920 finished with code 0 2013.03.11 18:34:22 LOG7[5849:0]: Signal pipe is empty 2013.03.11 18:35:15 LOG6[5973:0]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.03.11 18:35:15 LOG5[5973:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.03.11 18:35:15 LOG7[5973:0]: Remote socket (FD=17) closed 2013.03.11 18:35:15 LOG7[5973:0]: Local socket (FD=4) closed 2013.03.11 18:35:15 LOG7[5973:0]: Service [https] finished 2013.03.11 18:35:15 LOG7[5973:0]: str_stats: 19 block(s), 877 data byte(s), 798 control byte(s) 2013.03.11 18:35:15 LOG7[5849:0]: Dispatching signals from the signal pipe 2013.03.11 18:35:15 LOG7[5849:0]: Processing SIGCHLD 2013.03.11 18:35:15 LOG7[5849:0]: Process 5973 finished with code 0 2013.03.11 18:35:15 LOG7[5849:0]: Signal pipe is empty 2013.03.11 18:36:40 LOG6[6023:0]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.03.11 18:36:40 LOG5[6023:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.03.11 18:36:40 LOG7[6023:0]: Remote socket (FD=17) closed 2013.03.11 18:36:40 LOG7[6023:0]: Local socket (FD=4) closed 2013.03.11 18:36:40 LOG7[6023:0]: Service [https] finished 2013.03.11 18:36:40 LOG7[6023:0]: str_stats: 19 block(s), 877 data byte(s), 798 control byte(s) 2013.03.11 18:36:40 LOG7[5849:0]: Dispatching signals from the signal pipe 2013.03.11 18:36:40 LOG7[5849:0]: Processing SIGCHLD 2013.03.11 18:36:40 LOG7[5849:0]: Process 6023 finished with code 0 2013.03.11 18:36:40 LOG7[5849:0]: Signal pipe is empty 2013.03.11 18:38:45 LOG6[6074:0]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.03.11 18:38:45 LOG5[6074:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.03.11 18:38:45 LOG7[6074:0]: Remote socket (FD=17) closed 2013.03.11 18:38:45 LOG7[6074:0]: Local socket (FD=4) closed 2013.03.11 18:38:45 LOG7[6074:0]: Service [https] finished 2013.03.11 18:38:45 LOG7[6074:0]: str_stats: 19 block(s), 877 data byte(s), 798 control byte(s) 2013.03.11 18:38:45 LOG7[5849:0]: Dispatching signals from the signal pipe 2013.03.11 18:38:45 LOG7[5849:0]: Processing SIGCHLD 2013.03.11 18:38:45 LOG7[5849:0]: Process 6074 finished with code 0 2013.03.11 18:38:45 LOG7[5849:0]: Signal pipe is empty Normally under which circumstances this can happen. please help me totally clue less ... Rgds, Ramesh P

1 0

Stunnel SMP enabled?
by Michael Curran 06 Mar '13

06 Mar '13

I am running an Ubuntu system with Stunnel for 443 connections to an application on the back end. Essentially acting as a load balancer. When I look at the processor stats per processor (this is a 6-cpu system) I see cpu0 with almost 4% usage , compared to the other 5 processors hiting maybe .5% usage across the board. Is stunnel SMP enabled and passes processing amongst all 6 Procs? Or does it bind to one Proc and as long as its active it does all its work on just one PROC. We are having a lot of dropped connections when the overall system CPU hits about 23-25% .. which seems to me that it could be pushing just one CPU hard and the other 5 become basically idle. I am setting up to capture some SAR data to help confirm this effort, but it would if I knew that stunnel was setup for SMP processing.

1 0

Re: [stunnel-users] Stunnel as an "HTTPS to HTTPS" proxy
by Javier 05 Mar '13

05 Mar '13

On Tue, 05 Mar 2013 09:04:41 +0200 "jmwb(a)webmail.co.za" <jmwb(a)webmail.co.za> wrote: > Thank you for your response Javier. > > I now understand how to phrase what I am looking for. What I am looking for is > effectively an SSL Man-in-The-Middle (but please be assured that I am not > looking to build malware). However, I am still not certain from your response > that Stunnel can do this. Can the client-side handle SSL or does it only > support clear-text on the client side? > > jmwb Hi, in the example I gave to you is like this. Hope this can help you to understand how stunnel works in such scenario. 1. Web browser without SSL support. 2. It sends clear text to the IP:port where stunnel client is listening. 3. Stunnel in the client machine send ciphered text to the machine with Stunnel acting as server. 4. Stunnel in the server machine sends clear text to the web server. 5. The web server hasn't SSL support. 6. The communication is reversed to reply to the client side. With a diagram. Browser <> clear text <> stunnel<> ciphered <> stunnel <> clear text <> web server Of course, it is possible to make a MiTM attack between browser and stunnel and stunnel and web server at both sides, but not in between. To accomplish such attack you'll first need to access one of the machines and find such scenario. If both sides support SSL you don't need stunnel (unless one of the sides doesn't support SSL) and, therefore, all communications are ciphered P2P. No clear text. Except keyboard/mouse loggers in the client side. As said, is a secure tunnel, an SSL proxy. As you wish. Regards.

1 0

Re: [stunnel-users] Disable SNI in stunnel win32 version
by Lilienberg, Daniel () 05 Mar '13

05 Mar '13

I want to use my Apache as a secure proxy (where Stunnel adds the SSL layer). With SNI enabled, I must send all hosts I want to connect to which is impossible ? This is for internet proxy usage, so all sites on Internet must be available through the proxy. It worked fine before SNI. From: Brian Wilkins [mailto:[email protected]] Sent: den 5 mars 2013 14:14 To: Lilienberg, Daniel () Subject: Re: [stunnel-users] Disable SNI in stunnel win32 version Does this help? http://langui.sh/2009/11/03/ssl-vhosting-on-the-same-ip-aka-sni/ On Tue, Mar 5, 2013 at 8:10 AM, Lilienberg, Daniel () <daniel.lilienberg(a)volvocars.com<mailto:[email protected]>> wrote: Hi, In my local vmware setup im using Apache with mod_ssl on the server side and Stunnel on client side to make a secure proxy. Im using Chrome as webbrowser to connect locally to the apache which bounces me to internet. In my setup everything worked with the older Stunnel 4.3x, but when you upgraded to a newer Openssl it enabled SNI and now its broken. Can I disable SNI in any way or so I need to recompile stunnel with an older OpenSSL package ? Im running on Win32. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Disable SNI in stunnel win32 version
by Lilienberg, Daniel () 05 Mar '13

05 Mar '13

Hi, In my local vmware setup im using Apache with mod_ssl on the server side and Stunnel on client side to make a secure proxy. Im using Chrome as webbrowser to connect locally to the apache which bounces me to internet. In my setup everything worked with the older Stunnel 4.3x, but when you upgraded to a newer Openssl it enabled SNI and now its broken. Can I disable SNI in any way or so I need to recompile stunnel with an older OpenSSL package ? Im running on Win32.

1 0

Stunnel as an "HTTPS to HTTPS" proxy
by jmwb＠webmail.co.za 04 Mar '13

04 Mar '13

Hi, Please could you tell me if Stunnel supports HTTPS on the client-side i.e. a true SSL proxy with client-side SSL and server-side SSL (or if anyone has developed a version that does)? I have tried searching for this without luck because it is difficult to narrow down the search criteria e.g. Stunnel is already cited as an SSL proxy. jmwb ____________________________________________________________ South Africas premier free email service - www.webmail.co.za For super low premiums, click here. http://www.dialdirect.co.za/landing/oct/1/?vdn=15752

2 1

stunnel 4.55 released (security update)
by Michal Trojnara 03 Mar '13

03 Mar '13

Dear Users, I have released version 4.55 of stunnel. This is a massive bugfix release, including a security bugfix. Update is highly recommended. The ChangeLog entry: Version 4.55, 2013.03.03, urgency: HIGH: * Security bugfix - OpenSSL updated to version 1.0.1e in Win32/Android builds. - Buffer overflow vulnerability fixed in the NTLM authentication of the CONNECT protocol negotiation. See https://www.stunnel.org/CVE-2013-1762.html for details. * New features - SNI wildcard matching in server mode. - Terminal version of stunnel (tstunnel.exe) build for Win32. * Bugfixes - Fixed write half-close handling in the transfer() function (thx to Dustin Lundquist). - Fixed EAGAIN error handling in the transfer() function (thx to Jan Bee). - Restored default signal handlers before execvp() (thx to Michael Weiser). - Fixed memory leaks in protocol negotiation (thx to Arthur Mesh). - Fixed a file descriptor leak during configuration file reload (thx to Arthur Mesh). - Closed SSL sockets were removed from the the transfer() c->fds poll. - Minor fix in handling exotic inetd-mode configurations. - WCE compilation fixes. - IPv6 compilation fix in protocol.c. - Windows installer fixes. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-4.55.tar.gz: 5a4acecfabd454415c727435acdfca7dc46aa542998fb278293f494a6d36d37a Best regards, Mike

1 0

Broken pipes and TCP resets on parallel requests over stunnel
by Jan Bee 22 Feb '13

22 Feb '13

Hi, I'm running stunnel (ubuntu 4.42-1, confirmed with 4.54 that has been built from source) against a backend I've only limited control over which was running fine for a long time. At some point in the last few days, the clients stopped being able to make *concurrent* HTTP requests (by different threads) over the stunnel. The client applications using the tunnel enounter a 'Connection refused' error. The issue has been isolated to curl requests (instead of the original client application). Running a tcpdump on both, loopback and uplink, showed that every additional request results in an ACK from the stunnel to both the client and the remote side and a few ms later a RST, ACK is sent in the *same* direction (again from the stunnel to both client and remote end). The stunnel log shows an error about a broken pipe whenever these failures occur: Feb 18 11:09:24 x2 stunnel: LOG7[555:139702117717760]: Socket closed on read Feb 18 11:09:24 x2 stunnel: LOG7[555:139702117717760]: Sending SSL write shutdown Feb 18 11:09:24 x2 stunnel: LOG7[555:139702117717760]: SSL alert (write): warning: close notify Feb 18 11:09:24 x2 stunnel: LOG6[555:139702117717760]: SSL_shutdown successfully sent close_notify Feb 18 11:09:24 x2 stunnel: LOG5[555:139702117717760]: Error detected on socket (read) file descriptor: Broken pipe (32) Feb 18 11:09:24 x2 stunnel: LOG5[555:139702117717760]: Connection reset: 1320 bytes sent to SSL, 48625 bytes sent to socket Feb 18 11:09:24 x2 stunnel: LOG7[555:139702117717760]: Service xtunnel finished (4 left) An strace on the stunnel shows: 6425 <... setsockopt resumed> ) = 0 6425 close(18 <unfinished ...> 6465 poll([{fd=15, events=POLLOUT}, {fd=22, events=POLLIN}], 2, 43200000 <unfinished ...> 6425 <... close resumed> ) = 0 6465 <... poll resumed> ) = 2 ([{fd=15, revents=POLLOUT|POLLERR|POLLHUP}, {fd=22, revents=POLLIN}]) 6425 sendto(13, "<31>Feb 18 11:34:35 stunnel: LOG7[6395:140601236756224]: Service xtunnel finished (4 left)", 99, MSG_NOSIGNAL, NULL, 0 <unf inished ...> 6465 getsockopt(15, SOL_SOCKET, SO_ERROR, [32], [4]) = 0 6425 <... sendto resumed> ) = 99 6465 futex(0x7fe045ec3754, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...> 6425 futex(0x7fe045ec3754, FUTEX_WAKE_PRIVATE, 1 <unfinished ...> 6465 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable) 6425 <... futex resumed> ) = 0 6465 sendto(13, "<29>Feb 18 11:34:35 stunnel: LOG5[6395:140601236686592]: Error detected on socket (read) file descriptor: Broken pipe (32)", 122, MSG_NOSIGNAL, NULL, 0 <unfinished ...> 6425 write(2, "2013.02.15 11:34:35 LOG7[6395:140601236756224]: Service xtunnel finished (4 left)\n", 91 <unfinished ...> 6465 <... sendto resumed> ) = 122 6425 <... write resumed> ) = 91 6465 futex(0x7fe045ec3754, FUTEX_WAKE_PRIVATE, 1 <unfinished ...> 6425 sendto(13, "<31>Feb 18 11:34:35 stunnel: LOG7[6395:140601236756224]: str_stats: 0 block(s), 0 byte(s)", 89, MSG_NOSIGNAL, NULL, 0 <unfinished ...> 6465 <... futex resumed> ) = 0 6465 write(2, "2013.02.15 11:34:35 LOG5[6395:140601236686592]: Error detected on socket (read) file descriptor: Broken pipe (32)\n", 114 <unfinished ...> $ ps auxww|grep stunnel4 shows: root 28587 0.1 0.0 437844 7780 ? Ss 09:37 0:11 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29170 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29171 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29172 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29173 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29174 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf The stunnel config looks like this: foreground=yes debug=7 pid=/var/run/xtunnel.pid client=yes CAfile=/etc/ssl/certs/xtunnel-chains.pem verify=3 engine=dynamic engineCtrl=SO_PATH:/usr/lib/engines/engine_pkcs11.so engineCtrl=ID:pkcs11 engineCtrl=LIST_ADD:1 engineCtrl=LOAD engineCtrl=MODULE_PATH:libopencryptoki.so.0 engineCtrl=INIT engineCtrl=PIN:XXXXXX [xtunnel] engineNum=1 key=id_4 cert=/etc/xtunnel/client-cert.pem accept=127.0.0.1:9999 connect=192.168.200.1:8443 Does anyone have an idea what could be going wrong here or how to troubleshoot this any further? Thanks! Jan

1 0

Stunnel in pgsql mode, libpq, and SSL session caching..
by Matt Wise 17 Feb '13

17 Feb '13

Is there any level of SSL Session Caching when using Stunnel in pgsql mode, and using libpq-based Postgres clients? If not, I'm wondering what tuning we can do on the Stunnel side to get the best performance if we have alot of clients that connect very fequently to the servers.. --matt

1 0