- stunnel-users - stunnel.org

Stunnel 4.31 released
by Michal Trojnara 03 Feb '10

03 Feb '10

The ChangeLog entry: Version 4.31, 2010.02.03, urgency: MEDIUM: * New features - Log file reopen on USR1 signal was added. * Bugfixes - Some regression issues introduced in 4.30 were fixed. SHA-1 value for stunnel-4.31.tar.gz: f51fc544a0554f6eee2bfca1fcb8ddcb8386ce32 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

after 4.30 no more working
by Axel Reinhold 03 Feb '10

03 Feb '10

My current compile-install-configure-run environment is broken with 4.30. Up to 4.29 stunnel is working ok for me. 4.30 compiles, installs but when running it (i simply start /opt/ssl/bin/stunnel) the behaviour is completely different. Up to version 4.29 the program simply starts and logs to syslog: root@bongo opt]# /opt/ssl/bin/stunnel root@bongo opt]# grep stunnel /var/log/maillog Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: stunnel 4.29 on i686-pc-linux-gnu with OpenSSL 0.9.8l 5 Nov 2009 Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Jan 27 21:38:25 bongo stunnel: LOG6[31985:16384]: file ulimit = 1024 (can be changed with 'ulimit -n') Jan 27 21:38:25 bongo stunnel: LOG6[31985:16384]: poll() used - no FD_SETSIZE limit for file descriptors Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: 500 clients allowed Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 9 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 10 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 11 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: imaps bound to 0.0.0.0:993 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 12 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: pop3s bound to 0.0.0.0:995 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 13 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: arcorpop3 bound to 127.0.0.1:3003 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 14 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: bnvhpop3 bound to 127.0.0.1:3004 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 15 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: netidpop3 bound to 127.0.0.1:3005 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 16 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: icybolt bound to 127.0.0.1:3006 Jan 27 21:38:25 bongo stunnel: LOG7[31991:16384]: Created pid file /var/run/stunnel.pid With 4.30 i get lots of messages to the console and stunnel does not fork into background - where is the magic to get the old behaviour with 4.30? At the end stunnel reports: daemon: No such file or directory (2) root@bongo opt]# /opt/ssl/bin/stunnel Reading configuration from file /etc/ssl/stunnel/stunnel.conf Snagged 64 random bytes from /root/.rnd Wrote 1024 new random bytes to /root/.rnd RAND_status claims sufficient entropy for the PRNG PRNG seeded successfully Certificate: /etc/ssl/stunnel/freakout.pem Certificate loaded Key file: /etc/ssl/stunnel/freakout.key Private key loaded SSL context initialized for service imaps Certificate: /etc/ssl/stunnel/freakout.pem Certificate loaded Key file: /etc/ssl/stunnel/freakout.key Private key loaded SSL context initialized for service pop3s SSL context initialized for service arcorpop3 SSL context initialized for service bnvhpop3 SSL context initialized for service netidpop3 SSL context initialized for service icybolt Configuration successful No limit detected for the number of clients FD=8 in non-blocking mode FD=9 in non-blocking mode FD=10 in non-blocking mode Option SO_REUSEADDR set on accept socket Service imaps bound to 0.0.0.0:993 Service imaps opened FD=10 FD=11 in non-blocking mode Option SO_REUSEADDR set on accept socket Service pop3s bound to 0.0.0.0:995 Service pop3s opened FD=11 FD=12 in non-blocking mode Option SO_REUSEADDR set on accept socket Service arcorpop3 bound to 127.0.0.1:3003 Service arcorpop3 opened FD=12 FD=13 in non-blocking mode Option SO_REUSEADDR set on accept socket Service bnvhpop3 bound to 127.0.0.1:3004 Service bnvhpop3 opened FD=13 FD=14 in non-blocking mode Option SO_REUSEADDR set on accept socket Service netidpop3 bound to 127.0.0.1:3005 Service netidpop3 opened FD=14 FD=15 in non-blocking mode Option SO_REUSEADDR set on accept socket Service icybolt bound to 127.0.0.1:3006 Service icybolt opened FD=15 Created pid file /var/run/stunnel.pid daemon: No such file or directory (2) removing pid file /var/run/stunnel.pid Axel

3 5

after 4.30 no more working
by Axel Reinhold 01 Feb '10

01 Feb '10

> Axel Reinhold wrote: > > root@bongo opt]# /opt/ssl/bin/stunnel > [cut] > > daemon: No such file or directory (2) > > removing pid file /var/run/stunnel.pid > > That's interesting. I couldn't reproduce it. > > Could you install strace tool and than execute: > strace -f -o /tmp/stunnel.log /opt/ssl/bin/stunnel > , and than send us the output of /tmp/stunnel.log? > > Mike Here's the strace-log.

2 1

Stunnel 4.3 not forwarding to server socket
by Vladimir Stariradev 28 Jan '10

28 Jan '10

Dear Stunnel users, I'm running stunnel on my server which accepts connections from my mobile phone emulator (j2me) like so: midlet app -> port:5555 stunnel -> port:6666 server. My midlet, which can be treated as a java app, uses ssl://127.0.0.1:5555 to connect to stunnel. I can establish a connection between the stunnel and the app because I can get information on the certificate. The problem is that when I send data from the midlet to the server, the server doesn't accept it, nor does it signal that anything has been received even when I have double-checked that the streams are setup. I have pasted my config and log files below. Any suggestions are fully appreciated. Regards, Vladimir version: stunnel 4.30 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 stunnel.conf: cert = SecIM.pem debug = 7 ;output = stunnel.log [SecureIM] accept = 5555 connect = 6666 client = no Log file: 2010.01.28 17:51:09 LOG5[3828:1772]: Reading configuration from file stunnel.conf 2010.01.28 17:51:09 LOG7[3828:1772]: Snagged 64 random bytes from C:/.rnd 2010.01.28 17:51:09 LOG7[3828:1772]: Wrote 0 new random bytes to C:/.rnd 2010.01.28 17:51:09 LOG7[3828:1772]: RAND_status claims sufficient entropy for the PRNG 2010.01.28 17:51:09 LOG7[3828:1772]: PRNG seeded successfully 2010.01.28 17:51:09 LOG7[3828:1772]: Certificate: SecIM.pem 2010.01.28 17:51:09 LOG7[3828:1772]: Certificate loaded 2010.01.28 17:51:09 LOG7[3828:1772]: Key file: SecIM.pem 2010.01.28 17:51:11 LOG7[3828:1772]: Private key loaded 2010.01.28 17:51:11 LOG7[3828:1772]: SSL context initialized for service SecureIM 2010.01.28 17:51:11 LOG5[3828:1772]: Configuration successful 2010.01.28 17:51:11 LOG5[3828:1772]: No limit detected for the number of clients 2010.01.28 17:51:11 LOG7[3828:1772]: FD=168 in non-blocking mode 2010.01.28 17:51:11 LOG7[3828:1772]: Option SO_REUSEADDR set on accept socket 2010.01.28 17:51:11 LOG7[3828:1772]: Service SecureIM bound to 0.0.0.0:5555 2010.01.28 17:51:11 LOG7[3828:1772]: Service SecureIM opened FD=168 2010.01.28 17:51:11 LOG5[3828:1772]: stunnel 4.30 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.28 17:51:11 LOG5[3828:1772]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.28 17:52:13 LOG7[3828:2836]: Service SecureIM accepted FD=212 from 127.0.0.1:56133 2010.01.28 17:52:13 LOG7[3828:2836]: Creating a new thread 2010.01.28 17:52:13 LOG7[3828:2836]: New thread created 2010.01.28 17:52:13 LOG7[3828:3336]: Service SecureIM started 2010.01.28 17:52:13 LOG7[3828:3336]: FD=212 in non-blocking mode 2010.01.28 17:52:13 LOG7[3828:3336]: Option TCP_NODELAY set on local socket 2010.01.28 17:52:13 LOG5[3828:3336]: Service SecureIM accepted connection from 127.0.0.1:56133 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): before/accept initialization 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 read client hello A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write server hello A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write certificate A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write server done A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 flush data 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 read client key exchange A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 read finished A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write change cipher spec A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write finished A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 flush data 2010.01.28 17:52:13 LOG7[3828:3336]: 1 items in the session cache 2010.01.28 17:52:13 LOG7[3828:3336]: 0 client connects (SSL_connect()) 2010.01.28 17:52:13 LOG7[3828:3336]: 0 client connects that finished 2010.01.28 17:52:13 LOG7[3828:3336]: 0 client renegotiations requested 2010.01.28 17:52:13 LOG7[3828:3336]: 1 server connects (SSL_accept()) 2010.01.28 17:52:13 LOG7[3828:3336]: 1 server connects that finished 2010.01.28 17:52:13 LOG7[3828:3336]: 0 server renegotiations requested 2010.01.28 17:52:13 LOG7[3828:3336]: 0 session cache hits 2010.01.28 17:52:13 LOG7[3828:3336]: 0 external session cache hits 2010.01.28 17:52:13 LOG7[3828:3336]: 0 session cache misses 2010.01.28 17:52:13 LOG7[3828:3336]: 0 session cache timeouts 2010.01.28 17:52:13 LOG6[3828:3336]: SSL accepted: new session negotiated 2010.01.28 17:52:13 LOG6[3828:3336]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2010.01.28 17:52:13 LOG7[3828:3336]: FD=424 in non-blocking mode 2010.01.28 17:52:13 LOG6[3828:3336]: connect_blocking: connecting 127.0.0.1:6666 2010.01.28 17:52:13 LOG7[3828:3336]: connect_blocking: s_poll_wait 127.0.0.1:6666: waiting 10 seconds 2010.01.28 17:52:13 LOG5[3828:3336]: connect_blocking: connected 127.0.0.1:6666 2010.01.28 17:52:13 LOG5[3828:3336]: Service SecureIM connected remote server from 127.0.0.1:56134 2010.01.28 17:52:13 LOG7[3828:3336]: Remote FD=424 initialized 2010.01.28 17:52:13 LOG7[3828:3336]: Option TCP_NODELAY set on remote socket 2010.01.28 17:54:02 LOG3[3828:3336]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2010.01.28 17:54:02 LOG5[3828:3336]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.01.28 17:54:02 LOG7[3828:3336]: Service SecureIM finished (0 left)

1 1

Re: [stunnel-users] need to restart stunnel if stunnel starts before network?
by Michal Trojnara 23 Jan '10

23 Jan '10

Zhang Weiwu wrote: > For developer how do you think make stunnel resolving the domain when > establishing connection? Sure. This is already implemented and described in the manual: http://stunnel.mirt.net/static/stunnel.html The option is: delay = yes Mike

1 0

FIPS compilation patch for stunnel 4.30
by Michal Trojnara 21 Jan '10

21 Jan '10

Dear Users, Please find a tiny patch for FIPS mode of stunnel 4.30: ftp://stunnel.mirt.net/stunnel/fips.patch BTW: Please consider making a donation if you appreciate my work on configuration file reloading feature. Use PayPal Donate button on http://stunnel.mirt.net/ Mike

1 0

Stunnel 4.30 released
by Michal Trojnara 21 Jan '10

21 Jan '10

The ChangeLog entry: Version 4.30, 2010.01.21, urgency: LOW/EXPERIMENTAL: * New features - Graceful configuration reload with HUP signal on Unix and with GUI on Windows. This release involves major modifications of the code. I expect some regression issues, so please make sure to test this version well before running it on your production systems. SHA-1 value for stunnel-4.30.tar.gz: 46d21c3ad0e761d697f4de8c258ef999287f13f9 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

need to restart stunnel if stunnel starts before network?
by Zhang Weiwu 20 Jan '10

20 Jan '10

Hello. One reason to opt for stunnel instead of ssh -L to secure a local non-ssl client is, that if user use stunnel, it can work transparently, start working only when a connection is listened, so user do not have to start ssh-L before using the client and do not have to shut it down after using the client. However these days through the use of NetworkManager, the network interfaces are often not brought up when stunnel started as a system service. Instead, the network interfaces are brought up by users, in case of wifi or wan, after user typed password. I found I have to first start network interfaces, and run /etc/init.d/stunnel restart to prepare to run the insecure client. Is there a way to run in stunnel in such a way it does nothing except listening, and can recover from network restart, which happens from time to time for road warriors like me? Thanks in advance. I didn't find answer on FAQ by the way.

2 1

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 20 Jan '10

20 Jan '10

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. _________________________________________________________________ Windows Live: Gör det enklare för dina vänner att se vad du håller på med på Facebook. http://www.microsoft.com/sverige/windows/windowslive/see-it-in-action/socia…

1 0

PKI certs
by Lendl, Daniel 13 Jan '10

13 Jan '10

Will stunnel will work with PKI certs vs self-signed? Dan Lendl 919-257-3062

2 1