- stunnel-users - stunnel.org

The verify=3 option in client mode
by Philipp Hartwig 09 Apr '11

09 Apr '11

Hello, I'm using stunnel in client mode to provide an SSL connection for offlineimap[1] which does not support verification of SSL certificates. As I've read stunnel does not compare the name of the server offering the certificate to the server name mentioned in the certificate (in the CN field for example). So if I used the following section in my stunnel.conf client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile = /usr/share/ca-certificates/mozilla/Equifax_Secure_CA.crt verify = 2 stunnel would happily accept any certificate signed by Equifax for an arbitrary website. Is this correct? So I've switched to using the verify=3 option and I just want to make sure I configured it correctly. I'm now using the following section client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile= /home/ph/.certs/imaps.pem verify = 3 imaps.pem is a file containing two certificates, namely the first and the last certificate in the certificate chain of imap.gmail.com, that is the Equifax CA certificate and the server certificate itself. I then use offlineimap to establish an unencrypted connection to 127.0.0.1:4322. My understanding is that stunnel will now exclusively accept the server certificate stored in the imaps.pem file rendering all MITM attacks impossible. I'd be grateful if someone could confirm that this setup makes sense. Is this the way the verify=3 option is supposed to use? First I thought that it should be enough to just provide the server certificate in the imaps.pem file, but then openssl would complain about a self-signed certificate, so I included the CA certificate as well. Regards, Philipp [1] https://github.com/jgoerzen/offlineimap/wiki/

2 3

Is local mode on WIN32 working?
by Joerg Behrend 09 Apr '11

09 Apr '11

The changelog of stunnel 4.33 states that "Experimental support for local mode on WIN32 platform" is working and that should be tried exec = c:\windows\system32\cmd.exe In practice, it is for me not working, a connection is accepted but always reset with the stunnel log message: readsocket: Connection reset by peer (WSAECONNRESET) (10054) It was tested using the 4.35 Windows installer. Are there other requirements or settings necessary? Is a recompilation with special options senseful? Thanks! Joerg

1 0

issue making stunnel 4.35 use an apache http proxy to go out?
by Matt Wise 08 Apr '11

08 Apr '11

I've got an Apache proxy on port 3128 that will allow our clients to get outbound with a 'CONNECT" to a few services.. I'm trying to make stunnel use this service, and it seems to be ignoring my configuration completely. Tcpdumps show NO packets going outbound on port 3128... any ideas what i'm doing wrong? This config allows an inbound connection to port 1234 to hit port 2345 (a local service), while also handling the setup of an inbound connection to localhost:514 to a remote host on port 1514... debug = 7 pid = /var/run/stunnel.pid service = stunnel syslog = yes foreground = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 fips = no # Localhost:1234 hits localhost:2345 [cseservices] client = no accept = 1234 connect = 127.0.0.1:2345 CAfile = /etc/stunnel/ssl/tunnel-CAs.cert.pem cert = /etc/stunnel/ssl/server.pub key = /etc/stunnel/ssl/server.key verify = 2 ## Localhost:514 hits remotehost:1514 [syslog] client = yes accept = 514 connect = xxx:1514 CAfile = /var/lib/puppet/ssl/certs/ca.pem key = /var/lib/puppet/ssl/private_keys/xxx.pem cert = /var/lib/puppet/ssl/certs/xxx.pem session = 5 TIMEOUTidle = 600 TIMEOUTbusy = 600 TIMEOUTclose = 300 TIMEOUTconnect = 10 verify = 2 protocol=connect protocolHost=proxy:3128 protocolAuthentication=basic —Matt

1 1

Re: [stunnel-users] stunnel through elb.. need packets sent semi-frequently
by Leandro Avila 08 Apr '11

08 Apr '11

Hi I'm not sure this will work, but have you checked the option TIMEOUTidle = <num_seconds> ? Sounds to me like the setting you might be looking for ----------------- Leandro Avila ----- Original Message ----- From:Matt Wise <mwise(a)netflix.com> To:"stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Cc: Sent:Thursday, April 7, 2011 6:04 PM Subject:Re: [stunnel-users] stunnel through elb.. need packets sent semi-frequently I'm using stunnel to pass some data through an Amazon ELB. Unfortunately, there are times when the session times out due to packets not passing for 60 seconds (an amazon ELB timeout). I'm wondering whether theres some way I can configure stunnel itself to pass some whitespaces or something back and forth every few seconds to make sure the session stays open and live? (and yes, I'm posing the same question to the app developer who's ap we're passing through.. but I'm looking at both avenues.. ) _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

3 2

stunnel through elb.. need packets sent semi-frequently
by Matt Wise 08 Apr '11

08 Apr '11

I'm using stunnel to pass some data through an Amazon ELB. Unfortunately, there are times when the session times out due to packets not passing for 60 seconds (an amazon ELB timeout). I'm wondering whether theres some way I can configure stunnel itself to pass some whitespaces or something back and forth every few seconds to make sure the session stays open and live? (and yes, I'm posing the same question to the app developer who's ap we're passing through.. but I'm looking at both avenues.. )

2 2

Re: [stunnel-users] STunnel server handshake fails
by Leandro Avila 08 Apr '11

08 Apr '11

Hello, I think you probably want to use the sslVersion = TLSv1 setting in your configuration. Instead of the options for OpenSSL Hope that helps ----------------- Leandro Avila ________________________________ From: John C. Kadyk <jckadyk(a)pacbell.net> To: stunnel-users(a)stunnel.org Sent: Thursday, April 7, 2011 7:06 PM Subject: Re: [stunnel-users] STunnel server handshake fails STunnel server handshake fails I'm trying to set up STunnel so our non-SSL network scanner can email scans through our email server, which requires TLS. A desktop email client with the same server/port settings can send email OK. I think I have STunnel configured correctly, but there's a handshake failure when it tries to connect to the server. STunnel seems to be attempting an SSLv3 connection even though I turned that option off in the config file. I want to force it to use TLS but not sure how to do that. Any suggestions greatly appreciated. Here's the config file: cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 1025 connect = mail022-1.exch022.serverdata.net:1025 <http://mail022-1.exch022.serverdata.net:1025> ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini and here's the log: 2011.04.07 16:41:04 LOG5[3744:516]: Reading configuration from file stunnel.conf 2011.04.07 16:41:04 LOG7[3744:516]: Snagged 64 random bytes from C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: Wrote 1024 new random bytes to C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: PRNG seeded successfully 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service pop3s 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service imaps 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service ssmtp 2011.04.07 16:41:04 LOG5[3744:516]: Configuration successful 2011.04.07 16:41:04 LOG5[3744:516]: No limit detected for the number of clients 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=136 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s bound to 0.0.0.0:995 <http://0.0.0.0:995> 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s opened FD=136 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=124 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps bound to 0.0.0.0:993 <http://0.0.0.0:993> 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps opened FD=124 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=148 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp bound to 0.0.0.0:1025 <http://0.0.0.0:1025> 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp opened FD=148 2011.04.07 16:41:04 LOG5[3744:516]: stunnel 4.35 on x86-pc-mingw32-gnu with OpenSSL 1.0.0c 2 Dec 2010 2011.04.07 16:41:04 LOG5[3744:516]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2011.04.07 16:41:17 LOG7[3744:2436]: local socket: FD=232 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG7[3744:2436]: Service ssmtp accepted FD=232 from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:2436]: Creating a new thread 2011.04.07 16:41:17 LOG7[3744:2436]: New thread created 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp started 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on local socket 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp accepted connection from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:4012]: remote socket: FD=268 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG6[3744:4012]: connect_blocking: connecting 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: connect_blocking: connected 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp connected remote server from 10.10.17.249:4081 <http://10.10.17.249:4081> 2011.04.07 16:41:17 LOG7[3744:4012]: Remote FD=268 initialized 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on remote socket 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): before/connect initialization 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): SSLv3 write client hello A 2011.04.07 16:41:17 LOG7[3744:4012]: SSL alert (write): fatal: handshake failure 2011.04.07 16:41:17 LOG3[3744:4012]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.04.07 16:41:17 LOG5[3744:4012]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp finished (0 left) Any suggestions greatly appreciated. Thanks! John _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

STunnel server handshake fails
by John C. Kadyk 08 Apr '11

08 Apr '11

I'm trying to set up STunnel so our non-SSL network scanner can email scans through our email server, which requires TLS. A desktop email client with the same server/port settings can send email OK. I think I have STunnel configured correctly, but there's a handshake failure when it tries to connect to the server. STunnel seems to be attempting an SSLv3 connection even though I turned that option off in the config file. I want to force it to use TLS but not sure how to do that. Any suggestions greatly appreciated. Here's the config file: cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 1025 connect = mail022-1.exch022.serverdata.net:1025 <http://mail022-1.exch022.serverdata.net:1025> ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini and here's the log: 2011.04.07 16:41:04 LOG5[3744:516]: Reading configuration from file stunnel.conf 2011.04.07 16:41:04 LOG7[3744:516]: Snagged 64 random bytes from C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: Wrote 1024 new random bytes to C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: PRNG seeded successfully 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service pop3s 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service imaps 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service ssmtp 2011.04.07 16:41:04 LOG5[3744:516]: Configuration successful 2011.04.07 16:41:04 LOG5[3744:516]: No limit detected for the number of clients 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=136 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s bound to 0.0.0.0:995 <http://0.0.0.0:995> 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s opened FD=136 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=124 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps bound to 0.0.0.0:993 <http://0.0.0.0:993> 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps opened FD=124 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=148 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp bound to 0.0.0.0:1025 <http://0.0.0.0:1025> 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp opened FD=148 2011.04.07 16:41:04 LOG5[3744:516]: stunnel 4.35 on x86-pc-mingw32-gnu with OpenSSL 1.0.0c 2 Dec 2010 2011.04.07 16:41:04 LOG5[3744:516]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2011.04.07 16:41:17 LOG7[3744:2436]: local socket: FD=232 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG7[3744:2436]: Service ssmtp accepted FD=232 from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:2436]: Creating a new thread 2011.04.07 16:41:17 LOG7[3744:2436]: New thread created 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp started 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on local socket 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp accepted connection from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:4012]: remote socket: FD=268 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG6[3744:4012]: connect_blocking: connecting 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: connect_blocking: connected 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp connected remote server from 10.10.17.249:4081 <http://10.10.17.249:4081> 2011.04.07 16:41:17 LOG7[3744:4012]: Remote FD=268 initialized 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on remote socket 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): before/connect initialization 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): SSLv3 write client hello A 2011.04.07 16:41:17 LOG7[3744:4012]: SSL alert (write): fatal: handshake failure 2011.04.07 16:41:17 LOG3[3744:4012]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.04.07 16:41:17 LOG5[3744:4012]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp finished (0 left) Any suggestions greatly appreciated. Thanks! John

1 0

Can't get transparent mode to work from remote IP
by Ben Schmidt 02 Apr '11

02 Apr '11

Hello stunnel Mailinglist, I'm new to stunnel and so far it works just fine. What impressed me the most is that is faster then Apache's mod_ssl. My only Problem is that I can't get stunnel to work in transparent mode. When I try to access it from a remote IP I get timeouts connecting to the Non-SSL Server. I'm prettymuch relying on the manual in section "transparent": http://www.stunnel.org/static/stunnel.html Scenario: local 10.0.0.0/22 > Server with stunnel (10.0.3.48/22) > local apache My config: http://pastebin.com/BQmXeT5b Log: http://pastebin.com/enQTAWB9 "stunnel -sockets": http://pastebin.com/Zbz9FTr6 "iptables -L -v": http://pastebin.com/0b90Nay8 executing iptables, again: http://pastebin.com/T87cGPBX The apache listening on port 80 reporting hits from the Computers private IP but not from any remote IPs in the same network. Firewalls and stuff like that are not the Problem. The remote Computer can access port 80 without any Problems and it works fine when I switch from stunnel to apaches mod_ssl. My Testsetup is using 4.29 on ubuntu 10.10 GNU/Linux amd64 with kernel 2.6.35 and OpenSSL 0.9.8o Could anybody please point me in the rigth direction, I know that I'm missing something but I just can't figure it out. Thanks a lot, Ben

1 0

stunnel maximum clients to server
by bruce bushby 26 Mar '11

26 Mar '11

Hi I'm about to add stunnel to my buildroot embedded project (ARM926EJ-S) and I was hoping the list could answer a few performance questions? I've been looking for a way to encrypt the connections between my embedded units and my server. From what I understood about openvpn, the server starts to give problems beyond 1024 "concurrent sessions" .... I'm looking at a design that can handle 4K concurrent sessions....although it'll take a few years to get that big. My embedded devices have a GSM modem and setup a ppp0 interface over gprs. I'm considering stunnel in the hope that I could have up to 3000 stunnel connections coming into my servers. I say 3K because by the tike I reach this figure I hope to have implemented better switches and off load the overhead of the encrypted connection to the switch. The requirement is that the embedded "non-ssl aware client" will be able to communicate with the server over a secure tunnel. Am I completely on the wrong road? .... could stunnel cater for something like this? Thanks in advance!

3 2

Certificate request popup when clicking on MS Office links in a stunnel HTTPS redirect to Domino HTTP server?
by Josiah Fizer 25 Mar '11

25 Mar '11

We have a Lotus Domino server hosting some Microsoft Office documents. For improved security, I started using stunnel to redirect pacts from the HTTP servers via HTTPS. Everything works perfectly, however when a user clicks a document link they are prompted for login credentials or a certificate. This would seem to be because MS Office is trying to open the remote document in edit mode rather then downloading it locally or opening it in read mode. I've tried a number of stunnel configuration options but nothing seems to work. At current I am using the following simple configuration. Any insight into the issue would be appreciated. cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify=0 [https] accept = 443 connect = localhost:80 TIMEOUTclose = 0

1 0

Re: [stunnel-users] Windows Firewall has blocked some features of thisprogram
by jay＠experts-exchange.com 22 Mar '11

22 Mar '11

Hi Josealf, Thank you for your response and for this information. Is there a VB script or other method I can use for this purpose? I use a signed Java applet to download, install, and execute stunnel, but can insert a step to run a VB or other script on the host prior. I suspect the stunnel installer may do this already, but after looking, did not see anything. Thank you > You can add the required firewall exceptions as part of your installation > tasks. You just need to allow connections to the incoming port(s) your > stunnel config use. > > -----Original Message----- > From: jay(a)experts-exchange.com > Sender: stunnel-users-bounces(a)stunnel.org > Date: Mon, 21 Mar 2011 17:39:11 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Windows Firewall has blocked some features of > this > program > > Folks, > > While bundling stunnel with my user application, upon kick off I see this > error message.*1 Is there a way to avoid this security warning? I am > trying to figure out if signing the binaries will escape this situation, > or if it is related to the binary not containing a string table. I > investigated linking the win32 binary with MS Visual Studio 2005 to see > if > the presence of the version string info in the binary would help*2, but > so > far I have been unable to directly link. I originally built stunnel using > cygwin's mingw32-gcc*3, so linking using MSDEV is not too easy.*4 > > Thanks > > > Refs: > *1 "Windows Security Alert. To help protect your computer, Windows > Firewall has blocked some features of this program. Do you want to keep > blocking this program? Name: stunnel Publisher: Unknown" > > *2 stunnel/src/version.rc, > > // pdelaage TODO 20101111: this file works with MS VC / EVC > // But with MINGW, properties are NOT displayed in Windows Explorer > // although they are embedded in the final exe program. > // anyway, using a .o coming from MS VC does not change anything, > // and linking the gcc version.o with ms tools works! > // so the problem is in fact in gcc-linking, not in version.o. > > > *2 mingw64-i686-gcc-core 4.5.1-2 > > Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src > $ i686-w64-mingw32-gcc-4.5.1 -s -o stunnel.exe file.obj client.obj > log.obj > options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj > verify.obj sthreads.obj stunnel.obj gui.obj resources.obj > -L/cygdrive/c/openssl/lib -L/cygdrive/c/dl/stunnel/zlib-1.2.5 > -lcrypto.dll > -lssl.dll -lz -lws2_32 -lgdi32 -mwindows -v > Using built-in specs. > COLLECT_GCC=i686-w64-mingw32-gcc-4.5.1 > COLLECT_LTO_WRAPPER=/usr/lib/gcc/i686-w64-mingw32/4.5.1/lto-wrapper.exe > Target: i686-w64-mingw32 > Configured with: > /cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1/configure > --srcdir=/cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1 > --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin > --libexecdir=/usr/lib --datadir=/usr/share --localstatedir=/var > --sysconfdir=/etc --datarootdir=/usr/share > --docdir=/usr/share/doc/mingw64-i686-gcc -C --build=i686-pc-cygwin > --host=i686-pc-cygwin --target=i686-w64-mingw32 > --with-sysroot=/usr/i686-w64-mingw32/sys-root > --with-build-sysroot=/usr/i686-w64-mingw32/sys-root --disable-multilib > --disable-win32-registry > --enable-languages=c,ada,c++,fortran,objc,obj-c++ > --enable-fully-dynamic-strings --enable-libgomp --enable-sjlj-exceptions > --enable-version-specific-runtime-libs --with-dwarf2 > --enable-decimal-float=bid --enable-lto > Thread model: win32 > gcc version 4.5.1 (GCC) > COMPILER_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/bin/ > LIBRARY_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/:/usr/i686-w64-mingw32/sys-root/mingw/lib/ > COLLECT_GCC_OPTIONS='-s' '-o' 'stunnel.exe' '-L/cygdrive/c/openssl/lib' > '-L/cygdrive/c/dl/stunnel/zlib-1.2.5' '-mwindows' '-v' '-mtune=generic' > '-march=pentiumpro' > /usr/lib/gcc/i686-w64-mingw32/4.5.1/collect2.exe > --sysroot=/usr/i686-w64-mingw32/sys-root -m i386pe --subsystem windows > -Bdynamic -o stunnel.exe -s > /usr/i686-w64-mingw32/sys-root/mingw/lib/crt2.o > /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtbegin.o -L/cygdrive/c/openssl/lib > -L/cygdrive/c/dl/stunnel/zlib-1.2.5 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1 > -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32 > -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib > -L/usr/i686-w64-mingw32/sys-root/mingw/lib file.obj client.obj log.obj > options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj > verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -lcrypto.dll > -lssl.dll -lz -lws2_32 -lgdi32 -lmingw32 -lgcc_eh -lgcc -lmoldname > -lmingwex -lmsvcrt -lgdi32 -lcomdlg32 -luser32 -lkernel32 -ladvapi32 > -lshell32 -lmingw32 -lgcc_eh -lgcc -lmoldname -lmingwex -lmsvcrt > /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtend.o > > Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src > $ > > *4 Link attempt under windows: > > C:\dl\stunnel\stunnel-4.35\src>link /libpath:"C:\openssl\lib" > /libpath:"c:\dl\stunnel\zlib-1.2.5" /machine:I386 /nologo > /out:"stunnel.exe" /incremental:no /release /mapinfo:exports > /subsystem:windows /opt:ref /opt:icf wsock32.lib kernel32.lib user32.lib > gdi32.lib comdlg32.lib advapi32.lib shell32.lib msvcrt.lib libcmt.lib > libcrypto.a libssl.a libz.a file.obj client.obj log.obj options.obj > protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj > sthreads.obj stunnel.obj gui.obj resources.obj > msvcrt.lib(_stat.obj) : warning LNK4078: multiple '.drectve' sections > found with different attributes (00000A00) > options.obj : error LNK2019: unresolved external symbol ___chkstk > referenced in function _parse_conf > gui.obj : error LNK2019: unresolved external symbol _strdup referenced in > function _WinMain@16 > libcrypto.a(asn_mime.o) : error LNK2001: unresolved external symbol > __alloca > libcrypto.a(bss_file.o) : error LNK2019: unresolved external symbol > __alloca referenced in function _BIO_new_file > libcrypto.a(cryptlib.o) : error LNK2001: unresolved external symbol > __alloca > libcrypto.a(err_prn.o) : error LNK2001: unresolved external symbol > __alloca > libcrypto.a(bn_prime.o) : error LNK2001: unresolved external symbol > __alloca > libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol > ___umoddi3 referenced in function _fmtint > libcrypto.a(bn_word.o) : error LNK2001: unresolved external symbol > ___umoddi3 > libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol > ___udivdi3 referenced in function _fmtint > stunnel.exe : fatal error LNK1120: 5 unresolved externals > > C:\dl\stunnel\stunnel-4.35\src> > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users >

2 1

Windows Firewall has blocked some features of this program
by jay＠experts-exchange.com 22 Mar '11

22 Mar '11

Folks, While bundling stunnel with my user application, upon kick off I see this error message.*1 Is there a way to avoid this security warning? I am trying to figure out if signing the binaries will escape this situation, or if it is related to the binary not containing a string table. I investigated linking the win32 binary with MS Visual Studio 2005 to see if the presence of the version string info in the binary would help*2, but so far I have been unable to directly link. I originally built stunnel using cygwin's mingw32-gcc*3, so linking using MSDEV is not too easy.*4 Thanks Refs: *1 "Windows Security Alert. To help protect your computer, Windows Firewall has blocked some features of this program. Do you want to keep blocking this program? Name: stunnel Publisher: Unknown" *2 stunnel/src/version.rc, // pdelaage TODO 20101111: this file works with MS VC / EVC // But with MINGW, properties are NOT displayed in Windows Explorer // although they are embedded in the final exe program. // anyway, using a .o coming from MS VC does not change anything, // and linking the gcc version.o with ms tools works! // so the problem is in fact in gcc-linking, not in version.o. *2 mingw64-i686-gcc-core 4.5.1-2 Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src $ i686-w64-mingw32-gcc-4.5.1 -s -o stunnel.exe file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -L/cygdrive/c/openssl/lib -L/cygdrive/c/dl/stunnel/zlib-1.2.5 -lcrypto.dll -lssl.dll -lz -lws2_32 -lgdi32 -mwindows -v Using built-in specs. COLLECT_GCC=i686-w64-mingw32-gcc-4.5.1 COLLECT_LTO_WRAPPER=/usr/lib/gcc/i686-w64-mingw32/4.5.1/lto-wrapper.exe Target: i686-w64-mingw32 Configured with: /cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1/configure --srcdir=/cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1 --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --libexecdir=/usr/lib --datadir=/usr/share --localstatedir=/var --sysconfdir=/etc --datarootdir=/usr/share --docdir=/usr/share/doc/mingw64-i686-gcc -C --build=i686-pc-cygwin --host=i686-pc-cygwin --target=i686-w64-mingw32 --with-sysroot=/usr/i686-w64-mingw32/sys-root --with-build-sysroot=/usr/i686-w64-mingw32/sys-root --disable-multilib --disable-win32-registry --enable-languages=c,ada,c++,fortran,objc,obj-c++ --enable-fully-dynamic-strings --enable-libgomp --enable-sjlj-exceptions --enable-version-specific-runtime-libs --with-dwarf2 --enable-decimal-float=bid --enable-lto Thread model: win32 gcc version 4.5.1 (GCC) COMPILER_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/bin/ LIBRARY_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/:/usr/i686-w64-mingw32/sys-root/mingw/lib/ COLLECT_GCC_OPTIONS='-s' '-o' 'stunnel.exe' '-L/cygdrive/c/openssl/lib' '-L/cygdrive/c/dl/stunnel/zlib-1.2.5' '-mwindows' '-v' '-mtune=generic' '-march=pentiumpro' /usr/lib/gcc/i686-w64-mingw32/4.5.1/collect2.exe --sysroot=/usr/i686-w64-mingw32/sys-root -m i386pe --subsystem windows -Bdynamic -o stunnel.exe -s /usr/i686-w64-mingw32/sys-root/mingw/lib/crt2.o /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtbegin.o -L/cygdrive/c/openssl/lib -L/cygdrive/c/dl/stunnel/zlib-1.2.5 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib -L/usr/i686-w64-mingw32/sys-root/mingw/lib file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -lcrypto.dll -lssl.dll -lz -lws2_32 -lgdi32 -lmingw32 -lgcc_eh -lgcc -lmoldname -lmingwex -lmsvcrt -lgdi32 -lcomdlg32 -luser32 -lkernel32 -ladvapi32 -lshell32 -lmingw32 -lgcc_eh -lgcc -lmoldname -lmingwex -lmsvcrt /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtend.o Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src $ *4 Link attempt under windows: C:\dl\stunnel\stunnel-4.35\src>link /libpath:"C:\openssl\lib" /libpath:"c:\dl\stunnel\zlib-1.2.5" /machine:I386 /nologo /out:"stunnel.exe" /incremental:no /release /mapinfo:exports /subsystem:windows /opt:ref /opt:icf wsock32.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib msvcrt.lib libcmt.lib libcrypto.a libssl.a libz.a file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj msvcrt.lib(_stat.obj) : warning LNK4078: multiple '.drectve' sections found with different attributes (00000A00) options.obj : error LNK2019: unresolved external symbol ___chkstk referenced in function _parse_conf gui.obj : error LNK2019: unresolved external symbol _strdup referenced in function _WinMain@16 libcrypto.a(asn_mime.o) : error LNK2001: unresolved external symbol __alloca libcrypto.a(bss_file.o) : error LNK2019: unresolved external symbol __alloca referenced in function _BIO_new_file libcrypto.a(cryptlib.o) : error LNK2001: unresolved external symbol __alloca libcrypto.a(err_prn.o) : error LNK2001: unresolved external symbol __alloca libcrypto.a(bn_prime.o) : error LNK2001: unresolved external symbol __alloca libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol ___umoddi3 referenced in function _fmtint libcrypto.a(bn_word.o) : error LNK2001: unresolved external symbol ___umoddi3 libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol ___udivdi3 referenced in function _fmtint stunnel.exe : fatal error LNK1120: 5 unresolved externals C:\dl\stunnel\stunnel-4.35\src>

2 1

stunnel in DMZ : accept=22 / connect=other.server.net:22 - gets stuck! - need help!
by Bernhard.Baeumle＠mt.com 17 Mar '11

17 Mar '11

Hi I use stunnel on a DMZ server for tunnelling/forwarding/proxying... (whatever term is correct). The situation is as follows: Hardware : External PC <==> DMZ server <==> company-internal server Operational : https://xxx.yy.zz (443) <==> (443) stunnel (80) <==> (80) SVN Server listening on port 80 NEW/NEED HELP : plink (22) <==> (22) stunnel (22) <==> (22) sshd listening on port 22 stunnel.conf (on the DMZ server) looks like this: cert = my_tunnel.pem key = my_tunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = a:SO_REUSEADDR=0 debug = 7 output = C:\Program Files (x86)\stunnel\stunnel.log ;client = yes [forward_443_to_80] accept = 443 connect = my.company-server.net:80 [forward_22] accept = 22 connect = my.company-server.net:22 NOTE: Forwarding 443 to my.company-server.net:80 => WORKS FINE! NOW I try SSH with my PC connected to the company's network (without hopping at the DMZ): "plink -A -v -l username -i cert_file -P 22 dmz-server-name.net" => THIS WORKS FINE! NOW I try SSH with my PC from external network (which needs hopping at the DMZ): "plink -A -v -l username -i cert_file -P 22 dmz-server-name.net" Firewalls and ports seem to be open. The stunnel.log looks like this: <<starting stunnel service>> 2011.03.17 15:27:09 LOG5[4772:3852]: Reading configuration from file stunnel.conf 2011.03.17 15:27:09 LOG7[4772:3852]: Snagged 64 random bytes from C:/.rnd 2011.03.17 15:27:09 LOG7[4772:3852]: Wrote 1024 new random bytes to C:/.rnd 2011.03.17 15:27:09 LOG7[4772:3852]: PRNG seeded successfully 2011.03.17 15:27:09 LOG6[4772:3852]: Could not load DH parameters from my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: ECDH initialized 2011.03.17 15:27:09 LOG7[4772:3852]: Certificate: my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: Certificate loaded 2011.03.17 15:27:09 LOG7[4772:3852]: Key file: my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: Private key loaded 2011.03.17 15:27:09 LOG7[4772:3852]: SSL context initialized for service forward_443_to_80 2011.03.17 15:27:09 LOG6[4772:3852]: Could not load DH parameters from my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: ECDH initialized 2011.03.17 15:27:09 LOG7[4772:3852]: Certificate: my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: Certificate loaded 2011.03.17 15:27:09 LOG7[4772:3852]: Key file: my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: Private key loaded 2011.03.17 15:27:09 LOG7[4772:3852]: SSL context initialized for service forward_22 2011.03.17 15:27:09 LOG5[4772:3852]: Configuration successful 2011.03.17 15:27:09 LOG5[4772:3852]: No limit detected for the number of clients 2011.03.17 15:27:09 LOG7[4772:3852]: accept socket: FD=168 allocated (non-blocking mode) 2011.03.17 15:27:09 LOG7[4772:3852]: Option SO_REUSEADDR set on accept socket 2011.03.17 15:27:09 LOG7[4772:3852]: Service forward_443_to_80 bound to 0.0.0.0:443 2011.03.17 15:27:09 LOG7[4772:3852]: Service forward_443_to_80 opened FD=168 2011.03.17 15:27:09 LOG7[4772:3852]: accept socket: FD=280 allocated (non-blocking mode) 2011.03.17 15:27:09 LOG7[4772:3852]: Option SO_REUSEADDR set on accept socket 2011.03.17 15:27:09 LOG7[4772:3852]: Service forward_22 bound to 0.0.0.0:22 2011.03.17 15:27:09 LOG7[4772:3852]: Service forward_22 opened FD=280 2011.03.17 15:27:09 LOG5[4772:3852]: stunnel 4.35 on x86-pc-mingw32-gnu with OpenSSL 1.0.0c 2 Dec 2010 2011.03.17 15:27:09 LOG5[4772:3852]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 <<calling plink...>> 2011.03.17 15:27:26 LOG7[4772:4208]: local socket: FD=320 allocated (non-blocking mode) 2011.03.17 15:27:26 LOG7[4772:4208]: Service forward_22 accepted FD=320 from 123.4.5.6:2950 2011.03.17 15:27:26 LOG7[4772:4208]: Creating a new thread 2011.03.17 15:27:26 LOG7[4772:4208]: New thread created 2011.03.17 15:27:26 LOG7[4772:4756]: Service forward_22 started 2011.03.17 15:27:26 LOG7[4772:4756]: Option TCP_NODELAY set on local socket 2011.03.17 15:27:26 LOG5[4772:4756]: Service forward_22 accepted connection from 123.4.5.6:2950 2011.03.17 15:27:26 LOG7[4772:4756]: SSL state (accept): before/accept initialization <<and here it gets stuck!!!!!!!>> plink says: Looking up host "dmz-server-name.net" Connecting to 123.12.1.1 port 22 <<and here it gets stuck!!!!!!!>> PLEASE HELP!!!

2 1

SSL_read: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call
by Julian Ramirez 16 Mar '11

16 Mar '11

Hello all, I am using stunnel in order to send encrypted http request/response messages to an external system called Tradeweb. Our python program sends the message to stunnel and stunnel sends it to Tradeweb through a proxy. My version of stunnel is the following stunnel 4.35 on sparc-sun-solaris2.10 with OpenSSL 0.9.8r 8 Feb 2011 and it has been installed in a Solaris 10 operating system. My configuration file looks like this CAfile=/home/aps/tfk/stunnel/etc/stunnel/tradeweb_ca.cer client=yes verify=2 debug=7 output=stunnel.log [TradeXpress] # Port on which STUNNEL listens for local connections accept=stunnelserveripaddress:17000 # Destination address and port of TW data-center libwrap=no connect=proxyipaddress:80 protocol=connect protocolHost=tradewebipaddress:443 I have a python program that sends a http post message to stunnel. When I send the message I can see the following in the log (see below) The message gets to the other end (tradeweb system), but it looks like the encryption does not work properly. The relevant lines of the log are (see full log below) 2011.03.14 18:24:19 LOG7[6089:2]: SSL alert (write): warning: no certificate 2011.03.14 18:29:25 LOG3[6089:2]: SSL_read: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call 2011.03.14 18:29:25 LOG5[6089:2]: Connection reset: 521 bytes sent to SSL, 0 bytes sent to socket Do you know what is the problem? Thank you, Julian 2011.03.14 18:23:54 LOG5[6083:1]: Reading configuration from file stunnel.conf 2011.03.14 18:23:54 LOG7[6083:1]: Snagged 64 random bytes from /home/usr/vptfk/.rnd 2011.03.14 18:23:54 LOG7[6083:1]: Wrote 1024 new random bytes to /home/usr/vptfk/.rnd 2011.03.14 18:23:54 LOG7[6083:1]: PRNG seeded successfully 2011.03.14 18:23:54 LOG7[6083:1]: Loaded verify certificates from /home/aps/tfk/stunnel/etc/stunnel/tradeweb_ca.cer 2011.03.14 18:23:54 LOG7[6083:1]: Loaded /home/aps/tfk/stunnel/etc/stunnel/tradeweb_ca.cer revocation lookup file 2011.03.14 18:23:54 LOG7[6083:1]: SSL context initialized for service TradeXpress 2011.03.14 18:23:54 LOG5[6083:1]: Configuration successful 2011.03.14 18:23:54 LOG5[6083:1]: No limit detected for the number of clients 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=5 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=6 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=7 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=8 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=9 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: signal_pipe: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: signal_pipe: FD=10 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: accept socket: FD=11 allocated (non-blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: Option SO_REUSEADDR set on accept socket 2011.03.14 18:23:54 LOG7[6083:1]: Service TradeXpress bound to 0.0.0.0:17000 2011.03.14 18:23:54 LOG7[6083:1]: Service TradeXpress opened FD=11 2011.03.14 18:23:54 LOG7[6089:1]: Created pid file /home/aps/tfk/stunnel/var/run/stunnel/stunnel.pid 2011.03.14 18:23:54 LOG5[6089:1]: stunnel 4.35 on sparc-sun-solaris2.10 with OpenSSL 0.9.8r 8 Feb 2011 2011.03.14 18:23:54 LOG5[6089:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.03.14 18:23:54 LOG7[6089:1]: Dispatching signals from the signal pipe 2011.03.14 18:23:54 LOG7[6089:1]: Signal pipe is empty 2011.03.14 18:24:19 LOG7[6089:1]: local socket: FD=0 allocated (non-blocking mode) 2011.03.14 18:24:19 LOG7[6089:1]: Service TradeXpress accepted FD=0 from stunnelserveripaddress:61449 2011.03.14 18:24:19 LOG7[6089:2]: Service TradeXpress started 2011.03.14 18:24:19 LOG5[6089:2]: Service TradeXpress accepted connection from stunnelserveripaddress:61449 2011.03.14 18:24:19 LOG7[6089:2]: remote socket: FD=1 allocated (non-blocking mode) 2011.03.14 18:24:19 LOG6[6089:2]: connect_blocking: connecting proxyipaddress:80 2011.03.14 18:24:19 LOG7[6089:2]: connect_blocking: s_poll_wait proxyipaddress:80: waiting 10 seconds 2011.03.14 18:24:19 LOG5[6089:2]: connect_blocking: connected proxyipaddress:80 2011.03.14 18:24:19 LOG5[6089:2]: Service TradeXpress connected remote server from stunnelserveripaddress:61450 2011.03.14 18:24:19 LOG7[6089:2]: Remote FD=1 initialized 2011.03.14 18:24:19 LOG5[6089:2]: Negotiations for connect (client side) started 2011.03.14 18:24:19 LOG7[6089:2]: -> CONNECT tradewebipaddress:443 HTTP/1.1 2011.03.14 18:24:19 LOG7[6089:2]: -> Host: tradewebipaddress:443 2011.03.14 18:24:19 LOG7[6089:2]: -> 2011.03.14 18:24:19 LOG7[6089:2]: <- HTTP/1.1 200 Connection established 2011.03.14 18:24:19 LOG6[6089:2]: CONNECT request accepted 2011.03.14 18:24:19 LOG7[6089:2]: <- 2011.03.14 18:24:19 LOG5[6089:2]: Protocol negotiations succeeded 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): before/connect initialization 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write client hello A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read server hello A 2011.03.14 18:24:19 LOG7[6089:2]: Starting certificate verification: depth=1, /C=US/ST=New York/L=New York/O=TradeWeb LLC - The Online Bond Markets/OU=Network Administration/CN=TradeWeb LLC - The Online Bond Markets/emailAddress=bruce.mackinnon(a)tradeweb.c 2011.03.14 18:24:19 LOG5[6089:2]: Certificate accepted: depth=1, /C=US/ST=New York/L=New York/O=TradeWeb LLC - The Online Bond Markets/OU=Network Administration/CN=TradeWeb LLC - The Online Bond Markets/emailAddress=bruce.mackinnon(a)tradeweb.com 2011.03.14 18:24:19 LOG7[6089:2]: Starting certificate verification: depth=0, /C=US/ST=New Jersey/L=Jersey City/O=TradeWeb LLC - The Online Bond Markets/OU=STP Production/CN=62.189.50.234 2011.03.14 18:24:19 LOG5[6089:2]: Certificate accepted: depth=0, /C=US/ST=New Jersey/L=Jersey City/O=TradeWeb LLC - The Online Bond Markets/OU=STP Production/CN=62.189.50.234 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read server certificate A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read server certificate request A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read server done A 2011.03.14 18:24:19 LOG7[6089:2]: SSL alert (write): warning: no certificate 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write client certificate A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write client key exchange A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write change cipher spec A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write finished A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 flush data 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read finished A 2011.03.14 18:24:19 LOG7[6089:2]: 0 items in the session cache 2011.03.14 18:24:19 LOG7[6089:2]: 1 client connects (SSL_connect()) 2011.03.14 18:24:19 LOG7[6089:2]: 1 client connects that finished 2011.03.14 18:24:19 LOG7[6089:2]: 0 client renegotiations requested 2011.03.14 18:24:19 LOG7[6089:2]: 0 server connects (SSL_accept()) 2011.03.14 18:24:19 LOG7[6089:2]: 0 server connects that finished 2011.03.14 18:24:19 LOG7[6089:2]: 0 server renegotiations requested 2011.03.14 18:24:19 LOG7[6089:2]: 0 session cache hits 2011.03.14 18:24:19 LOG7[6089:2]: 0 external session cache hits 2011.03.14 18:24:19 LOG7[6089:2]: 0 session cache misses 2011.03.14 18:24:19 LOG7[6089:2]: 0 session cache timeouts 2011.03.14 18:24:19 LOG6[6089:2]: SSL connected: new session negotiated 2011.03.14 18:24:19 LOG6[6089:2]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2011.03.14 18:29:25 LOG3[6089:2]: SSL_read: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call 2011.03.14 18:29:25 LOG5[6089:2]: Connection reset: 521 bytes sent to SSL, 0 bytes sent to socket 2011.03.14 18:29:25 LOG7[6089:2]: Service TradeXpress finished (0 left) RAMIREZ Julián Technical Consultant Wall Street Systems <http://www.wallstreetsystems.com/> - Empowering Treasury, Trading and Settlement

1 0

Stunnel configuration for multiple domains on single IP
by Amol 11 Mar '11

11 Mar '11

I was trying to configure stunnel to work for multiple domains on the same IP address, just wanted to know how to configure stunnel to listen on different ports? has anyone done it yet? [https-lo] cert=/etc/stunnel/ssl/group-cert.pem key = /etc/stunnel/ssl/lo.key accept=x.x.x.x:443 connect=x.xxx.xx.11:8000 TIMEOUTclose=0 xforwardedfor=yes [https-lo2] cert=/etc/stunnel/ssl/group2-cert.pem key = /etc/stunnel/ssl/lo2.key accept=xx.xx.xx.xx:444 connect=x.xxx.xx.11:80 TIMEOUTclose=0 xforwardedfor=yes but i still get this error when i access the second domain (lo2) (Error code: ssl_error_bad_cert_domain)

1 1

Periodic stunnel 4.34 core dumps on AIX 5.3
by Allex, Paul M (USA E D EA STS) 11 Mar '11

11 Mar '11

Hello, I have noticed that stunnel will periodically core dump on AIX 5.3. My configuration: stunnel 4.34 AIX 5.3 OpenSSL 0.9.8m After some initial investigation, I did find the following post about stunnel core dumps on AIX 5.3: http://www.stunnel.org/pipermail/stunnel-users/2007-April/001528.html Some of the core dumps were definitely due to this issue, so I rebuilt stunnel using the steps outlined in the post. Now I do not see the stack overflow core dumps, however I am still seeing other cores. These cores have little to no valuable information in them, so I do not have a lot to go off of. The one thing I have noticed is that stunnel seems to be consuming more and more memory over time. I set up several tests to see what would be causing this. Tests: 1. Send large amounts of data through stunnel using a simple client and server. This seemed to have no affect on the long term memory usage of stunnel. 2. Repeatedly create and drop connections to stunnel. For this I wrote a short script that simply creates a connection to stunnel using telnet in a a tight loop. I did not start anything for the stunnel instance to connect to, so telnet would create a connection and get it closed immediately. telnet --> stunnel --> nothing The process started with a size of 836 KB and seems to increase by about .1 to .2 KB per connection. $ count=1; while true; do tn localhost 10500; echo $count; count=$(( count + 1 )); done Trying... Escape character is '^T'. Connection closed. 1 ... Trying... Connected to loopback. Escape character is '^T'. Connection closed. 15475 Trying... Connected to loopback. Escape character is '^T'. Connection closed. 15476 Trying... Connected to loopback. Escape character is '^T'. Connection closed. 15477 $ monitor_process test_stunnel Size: 836 ... Size: 2556 Size: 2564 Size: 2564 Size: 2564 Size: 2568 Size: 2572 Size: 2572 Size: 2592 I have not dug into the code yet, so I suppose that will be my next task. If anyone has any ideas or suggestions on what else to look at, I would really appreciate it. Thanks, Paul Allex

2 2

Re: [stunnel-users] Periodic stunnel 4.34 core dumps on AIX 5.3
by Allex, Paul M (USA E D EA STS) 10 Mar '11

10 Mar '11

I let the connection/memory script run over night and it appears that stunnel's memory usage has plateaued at 131,432 KB. I'm not sure how many connections had occurred when the memory usage leveled of, but currently there have been over 1.7 million connections to stunnel. I guess for now, please don't waste any time on this issue until I gather more information. Paul Allex

1 0

error:14094412:SSL routines:SSL3_READ_BYTES:sslv3
by don-stunnel-zyx＠isis.cs3-inc.com 04 Mar '11

04 Mar '11

stuff in [brackets] is replaced to protect the innocent stunnel.conf: ================ debug=5 output=/root/stunnel.log cert=/etc/pki/tls/certs/[certfile] CAfile=/etc/pki/tls/certs/[bundle].crt key=/etc/pki/tls/private/[private-key].key [debug] accept=801 client=yes connect=[...].com:443 ================ I then connect to localhost:801 and stunnel.log contains: ================ 2011.02.28 19:18:45 LOG5[20520:3086252944]: debug connected from 127.0.0.1:38472 2011.02.28 19:18:46 LOG3[20520:3086252944]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate 2011.02.28 19:18:46 LOG5[20520:3086252944]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket ================ I don't see anything wrong with the cert or private key - the following demo shows that at least openssl is happy with them: ================ echo "hello there" | openssl rsautl -certin -inkey /etc/pki/tls/certs/[certfile] -encrypt |openssl rsautl -inkey /etc/pki/tls/private/[private-key].key -decrypt hello there I've captured the packets sent between stunnel and the server and wireshark shows (at ssl level) client SSLv3 Client Hello server SSLv3 Server Hello, Certificate, Certificate Request, Server Hello Done client SSLv3 Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message server SSLv3 Alert (Level: Fatal, Description: Bad Certificate) followed by TCP resets So the server is complaining about my certificate. This is certainly not what I would have guessed the message in the log meant. It looks like an error from stunnel. So is it an error from stunnel or is it stunnel reporting a complaint from the server? And if the latter, what exactly did the server send? The entire message starting with error? or starting with 14094412? or what? Could this mean that the server doesn't understand the certificate (cause it's a 2K certificate instead of 1K?) or could it mean that the server doesn't like it for some other reason?

2 2

curl: (35) error:14094412:SSL routines:SSL3_READ_BYTES:sslv3
by don-stunnel-zyx＠isis.cs3-inc.com 01 Mar '11

01 Mar '11

Here's my command curl -E /root/key-cert https://ewsg-cert.prudent... and the result: curl: (35) error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate This seems weird to me: Note that this certificate is the private key and the private certificate concatenated! I assume the private certificate is just the certificate. In any case my file key-cert looks like -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- What does the error above mean and what could I possibly be doing wrong to cause it?

1 1

forcing my untangle server to scan my https traffic
by Bing H Bang 01 Mar '11

01 Mar '11

I'm so close to making this work, I can taste it. I also need some suggestions on how to fix the last hurdle. My setup 10.0.0.10 ip of my webserver 24.159.165.122 static ip of my untangle server (router mode) untangle server port forwards 443 to 10.0.0.10:10443 80 to 10.0.0.10:80 (web server only listens on 443) stunnel config file on the web server [https-terminate] client = no cert = /var/lib/stroot/cypherdog.com.pem accept = 10.0.0.10:10443 connect = 24.159.165.122:80 [https-re-engage] client = yes accept = 10.0.0.10:80 connect = 10.0.0.10:443 What I'm trying to do is accept https traffic, decrypt it, pass it through untangle, then encrypt it back as it gets delivered to the https port of the web server. This setup works in that I can point my browser at the https port of my untangle server and the web pages work properly. What doesn't work is the untangle server shows no scanning activity when I access the web pages. I think the path webserver->untangle->webserver does not trigger the scanning in untangle because the traffic it sees is from an internal ip going to the same internal ip. Is there a way to fix this, anyone?

3 3

Upgrade of evil.patch for version 4.35
by Jeremie Le Hen 22 Feb '11

22 Feb '11

Hi Michal, One of my former coworker and now friend undertook the upgrade of contrib/misc/evil.patch against the latest stunnel version. Would you mine putting this new version on your FTP site please? Thanks a lot. Regards, -- Jeremie Le Hen Humans are born free and equal. But some are more equal than others. Coluche

1 0

Problems SSLifying an "exec" Service without KeepAlive
by Jochen Bern 22 Feb '11

22 Feb '11

Hello everyone, today I tried to set up network access to a service using stunnel 4.35. The underlying service, by default, exits after every request+reply. When running stunnel in daemon mode, this seems to upset things such that subsequent connections hang. I cannot quite pinpoint whether it's a config problem, design (of my setup) problem, or bug, so any help's welcome ... More info: The underlying service accesses a Nagios' livestatus interface > http://mathias-kettner.de/checkmk_livestatus.html#H1:Remote%20access%20to%2… using the "unixcat" tool provided. Unless you specifically request connection keepalives, unixcat will close/exit after answering one request, *or* timing out waiting for one. That "exit procedure", AFAICT, isn't different from what the imapd or pppd in the stunnel(8) manpage's EXAMPLES section do ... I need to secure access to the service, so I'm throwing client cert verification and libwrap at the connections. The current daemon mode configuration (with several commented-out attempts) reads, slightly anonymized: client=no verify=3 pid=/var/run/stunnel/livestatus.pid #setuid=stunnel #socket = a:SO_REUSEADDR=0 #foreground= yes [livestatus] accept = [...PORT...] cert = [...SERVER...].pem key = [...SERVER...].key CAfile = [...CA...].pem CApath = [...TempStagingDirectory...] exec = /usr/local/bin/unixcat execargs = unixcat /var/lib/nagios3/rw/live pty = yes retry = no session = 3 #TIMEOUTclose = 0 #TIMEOUTbusy = 5 #TIMEOUTidle = 5 After starting the stunnel daemon, I can perform *one* normal connection: > # openssl s_client -CAfile [...CA...].pem -showcerts \ > > -connect [...SERVER...]:[...PORT...] -cert [...CLIENT...].cert \ > > -key [...CLIENT...].key -state > CONNECTED(00000003) > SSL_connect:before/connect initialization > SSL_connect:SSLv2/v3 write client hello A > SSL_connect:SSLv3 read server hello A [...] > SSL handshake has read 1743 bytes and written 1933 bytes > --- > New, TLSv1/SSLv3, Cipher is AES256-SHA > Server public key is 1024 bit > Compression: NONE > Expansion: NONE > SSL-Session: > Protocol : TLSv1 > Cipher : AES256-SHA > Session-ID: 1B4221E2917E3BD49AA2102C2CCE60A624DB256D6B4D61F9D0D77EA843DC31BC > Session-ID-ctx: > Master-Key: 57E6DF8E7E0A741B718E356467450DD00969465295A9C6FE03416ED16E74AF93058EC168EF6DF1B9F3F637F505FF6EF4 > Key-Arg : None > Start Time: 1298390481 > Timeout : 300 (sec) > Verify return code: 0 (ok) > --- At that point, I can type in one request, then unixcat terminates, stunnel closes the connection and s_client (?) reports: > read:errno=104 Typical log output on the server side: > LOG5[30042:139819109037792]: Reading configuration from file /etc/stunnel/livestatus.conf > LOG5[30042:139819109037792]: Peer certificate location [...TempStagingDirectory...] > LOG5[30042:139819109037792]: Configuration successful > LOG5[30042:139819109037792]: No limit detected for the number of clients > LOG5[30043:139819109037792]: stunnel 4.35 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 > LOG5[30043:139819109037792]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 [...] > LOG5[30043:1075198288]: Service livestatus accepted connection from [...CLIENT...]:39287 > LOG5[30043:1075198288]: Certificate accepted: depth=1, [...CA...] > LOG5[30043:1075198288]: Certificate accepted: depth=0, [...CLIENT...] > LOG3[30043:1075198288]: readsocket: Input/output error (5) > LOG5[30043:1075198288]: Connection reset: 2293 bytes sent to SSL, 33 bytes sent to socket Rerunning the exact same command stops dead after the > CONNECTED(00000003) and manually "telnet"ing to the port from a different host doesn't behave in a normal way (closing the connection after I type the first line of non-SSL stuff) anymore, either. Running the unixcat command from a local command line, however, still works normally. I tried running stunnel off inetd, which seems to work, so I'd guess it's the server-side SSL session cacheing which interferes. However, I don't see any related stunnel config keywords in the manpage, and stunnel offering a cached session to a connection *from a different client host* sound odd to me, too ... ? Kind regards, J. Bern -- Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

1 0

New and Utterly Confused on Ubuntu Linux
by Traps 20 Feb '11

20 Feb '11

I am totally new to stunnel and am quite confused. I use Ubuntu 10.04 and have installed the stunnel4 deb package. I need to do a couple of things. At boot up I need to accept ssl connections on an inbound port and forward it to a non-ssl compliant app listening on another port. The second thing I need to do is make an ssl required connection to a pop server on another host out of a non-ssl mail client on the local machine. I have no problem with the ports, port forwarding, etc. I just do not know how to set up stunnel to accomplish this. Let's just use this as an example: 1. I need to accept inbound ssl connections on 995 (port 995 is open) and send them to the local machine non-ssl client listening on 2995. 2. I need to ssl connect to pop.gmail.com:995 via a non-ssl mail client on the local machine and I want the mail client to connect to stunnel on port 3995. 3. I need both of these scenarios to start at boot up. I don't even know where to start with stunnel4 to do this. Actually I can set up stunnel.conf for either but one's a server operation and the other is a client operation and can't get them both to work simultaneously. To start stunnel at boot up I simply edited /etc/default/stunnel and /etc/init.d/stunnel4 and changed ENABLED=0 to ENABLED=1 in both files. Something tells me this is entirely the wrong way to do what I want to do. It works for either the client task or the server task, depending on which one I have enabled in stunnel.conf but I just know this is not how I am suppose to be doing it. Will someone help? -- View this message in context: http://old.nabble.com/New-and-Utterly-Confused-on-Ubuntu-Linux-tp30970693p3… Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 1

fips=no
by dominic.schweizer＠zkb.ch 18 Feb '11

18 Feb '11

Hi All, I have the problem that when I start Stunnel, the following error pops up: FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match I now added in my config file: fips=no and it works. My question is now, what is the difference between with fips and without fips? stunnel version 4.34 openssl 0.9.8 redhat 5 Thanks in advance for the answer Regards Dominic Freundliche Grüsse Dominic Schweizer Zürcher Kantonalbank Unix System Engineer, LIOEU Neue Hard 9, 8005 Zürich Telefon 044 292 83 52, Fax 044 292 80 34 Briefadresse: Postfach 8010 Zürich, http://www.zkb.ch Sie drucken dieses E-Mail nicht aus? Die Umwelt dankt! ___________________________________________________________________ Disclaimer : Diese Mitteilung ist nur fuer die Empfaengerin / den Empfaenger bestimmt. Fuer den Fall, dass sie von nichtberechtigten Personen empfangen wird, bitten wir diese hoeflich, die Mitteilung an die ZKB zurueckzusenden und anschliessend die Mitteilung mit allen Anhaengen sowie allfaellige Kopien zu vernichten bzw. zu loeschen. Der Gebrauch der Information ist verboten. This message is intended only for the named recipient and may contain confidential or privileged information. If you have received it in error, please advise the sender by return e-mail and delete this message and any attachments. Any unauthorised use or dissemination of this information is strictly prohibited.

2 1

openvpn with stunnel
by Guy Sapir 17 Feb '11

17 Feb '11

Hi all, Is it possible to use openvpn on port 80 or 443 using stunnel so the packets on openvpn will be wrapped as http or https pure packets. What should I do in the config file. Guy Sapir

2 1

Wireshark didn't show TLSv1 traffic?
by Bao, Robert 17 Feb '11

17 Feb '11

Hi, I have "ciphers = AES256-SHA" option in stunnel.conf file. And when the server/client established the connection, I see this line in the log file: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 However when I use Wireshark to sniff the traffic, I only see "TCP" in the <Protocol> column for the traffics between the server and the client. Is this normal? What did I do wrong? Thanks. Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

2 2

key+cert+dh risks
by Jean-Yves F. Barbier 15 Feb '11

15 Feb '11

Hi list, I'm using stunnel between two machines only, so is there a risk to reuse the server stunnel.pem on the client? (and if it's risky, why?) JY -- Have a coke and a smile! -- John DeLorean

3 6

Confusion regarding part of stunnel.conf
by Dave 12 Feb '11

12 Feb '11

I've set up a test of stunnel with the latest stunnel and latest openssl, and if I set "verify=0" or "verify=1" I can get it to work (I'm tunneling a pop3 session), but if I set it any higher (to 2 or 3) it won't work for me. Now, I'm not sure which level is "necessary" because in stunnel.conf I read: ------------------------- ; authentication stuff needs to be configured to prevent MITM attacks ; it is not enabled by default! ;verify = 2 ------------------------- ... which sounds like verify defaults to 0. But is a verify level of 1 enough to solve the man-in-the-middle problem? It seems like it would not be (since level 1 will allow absence of a certificate), but I am not sure. I guess my questions boil down to: 1) What are the necessary settings for "authentication stuff" to prevent the MITM attack vector mentioned in stunnel.conf? 2) What is the proper way to set up (self-signed) certs to prevent such an attack? Can a self-signed cert be used at a verify level of 2 or 3? Dave

2 11

[patch] Unix socket support for Stunnel
by Stefan Behte 11 Feb '11

11 Feb '11

Hi, yet another request for a patch inclusion... Quoting from http://haproxy.1wt.eu/#down : "This patch contributed by Exceliance adds to stunnel the ability to connect to haproxy over a UNIX stream socket instead of using TCP. Sometimes this can be more convenient and/or more secure. " I think it would be nice to have it upstream. And I hope I am not bothering Michals yet. ;) Best regards, Stefan Behte

1 0

Security Problems with 4.35
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, in the announcement of 4.35, I saw: "CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments." I searched a bit, but did not find an exploit or more information on the severity of this issue. Could someone elaborate the problem a bit? I could diff to the previous version and have a look, but that will take quite some time, and my C is weak... Best regards, Stefan Behte

2 1

use somaxconn in stunnel
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, attached you will find a patch from Thomas Franco to honor SOMAXCONN. It defaults to 128, which is not enough for some setups. It defines the maximum number of requests that can be queued to a listening socket and can be changed with sysctl via net.core.somaxconn. I think it would be nice to have it in stunnel-4.36 to make it usable in bigger installations. It's available online here: https://github.com/op4g/stunnel/commit/e200bebaf92c068aa319c43fdd50cddd6816… Best regards, Stefan Behte

2 4

publish/subscribe with stunnel
by Dam Dam 10 Feb '11

10 Feb '11

Hello, I am having a problem to configure stunnel in a publish/subscribe architecture. Basically, I have a publisher service configured with stunnel as a server. Its configuration is close to: [publisher] accept = p1 connect = 127.0.0.1:p2 This service publishes data to a subscriber. As far I as understood, the subscriber should be configured as a client with stunnel with a configuration close to this: [subscriber] accept = p3 connect = remote:p1 client = yes Now, my problem is that the subscriber does not listen on any port. So p3 does not actually exist. When the subscriber starts, it automatically connects and subscribes to the publisher and waits for data from the publisher service. I would like to secure the connection between the publisher and the subscriber but I am stuck with the configuration. Any ideas? Regards, Damien

2 1

stunnel, haproxy and ssl cert
by Amol 10 Feb '11

10 Feb '11

i got the SSL setup done with the stunnel, but when i connect from the url i always see this entry in my stunnel.log 2011.02.09 14:52:34 LOG3[2433:139832543721216]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing my stunnel config is cert=/etc/stunnel/ssl/group-cert.pem key = /etc/stunnel/ssl/l.key ;setuid = nobody ;setgid = nogroup pid = /etc/stunnel/stunnel.pid debug = 3 output = /etc/stunnel/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=443 connect=80 TIMEOUTclose=0 xforwardedfor=yes i have just got familiar to stunnel to not sure i that error is ok?

2 3

Help with stunnel configuration
by Rohler, Brian L 09 Feb '11

09 Feb '11

I'm looking to see if the windows version of stunnel (4.34) can be executed from a command line and have it configured to connect and accept on different ports?

1 0

X-Forwarded-For / X-Forwarded-Proto
by Stefan Behte 09 Feb '11

09 Feb '11

Hello Michal, I've read that you prefer not to support X-Forwarded-For because an old code had a buffer overflow and did not support keep-alive functions of HTTP/1.1. I believe the overflow was fixed in the newer version of the patch I've attached. IMHO the patch will still be very useful, even if it does not support keep-alive: often in high-performence setups keep-alive is not even desired because it fills up ressources needlessly. Even if this does not provide all features, a lot of people would be satisfied with it. There is a great desire for this patch, if one searches for "stunnel x-forwarded-for" on google, you will find more than 60 pages and not only a few dozens of blogs/mailing lists that discuss applying the patch and getting it to work as an SSL terminator for loadbalancing software. And last, I know that the patch (the one Willy Tarreau is hosting on haproxy.1wt.eu and is attached) is in use at several high-traffic websites and runs stable. ;) If it's too much of a hassle for you to review and/or integrate the patch, I can understand that very well, I'd just like to open a discussion and would like to know if you have concerns regarding the patch quality, even if you do not want to include the patch at this time. :) Best regards, Stefan Behte

2 1

stunnel HUP bug
by Stefan Behte 09 Feb '11

09 Feb '11

Hi, kill -HUP does not seem to work for me with 4.35, I always get: 2011.02.07 17:51:25 LOG5[14988:139705784043264]: Received signal 15; terminating Best regards, Stefan Behte Babiel GmbH Moskauer Str. 27 D-40227 Düsseldorf Tel: 0211-179349 0 Fax: 0211-179349 29 E-Mail: S.Behte(a)babiel.com Internet: http://www.babiel.com

2 6

stunnel libwrap/tcpwrapper bug (patch included)
by Stefan Behte 09 Feb '11

09 Feb '11

Hi, I stumbled upon a really old bug in stunnel: ./configure --enable-libwrap && make [...] mv -f .deps/pty.Tpo .deps/pty.Po gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.35\" -DPACKAGE_STRING=\"stunnel\ 4.35\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.35\" -D_GNU_SOURCE=1 -DHOST=\"i686-pc-linux-gnu\" -DCPU_I686=1 -DVENDOR_PC=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_TCPD_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LINUX_NETFILTER_IPV4_H=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_PIPE2=1 -DHAVE_ACCEPT4=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -DHAVE_LIBWRAP=1 -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wextra -pedantic -Wno-long-long -I/usr/include -MT libwrap.o -MD -MP -MF .deps/libwrap.Tpo -c -o libwrap.o libwrap.c libwrap.c: In function 'libwrap_init': libwrap.c:91: warning: ignoring return value of 'write', declared with attribute warn_unused_result mv -f .deps/libwrap.Tpo .deps/libwrap.Po /bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wextra -pedantic -Wno-long-long -I/usr/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lutil -lnsl -lpthread -L/usr/lib64 -L/usr/lib -lssl -lcrypto /bin/sh: warning: setlocale: LC_ALL: cannot change locale (c) libtool: link: gcc -g -O2 -Wall -Wextra -pedantic -Wno-long-long -I/usr/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lutil -lnsl -lpthread -L/usr/lib64 -L/usr/lib -lssl -lcrypto libwrap.o: In function `check': /usr/portage/distfiles/stunnel-4.35/src/libwrap.c:194: undefined reference to `request_init' /usr/portage/distfiles/stunnel-4.35/src/libwrap.c:195: undefined reference to `sock_host' /usr/portage/distfiles/stunnel-4.35/src/libwrap.c:196: undefined reference to `hosts_access' collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make[1]: Leaving directory `/usr/portage/distfiles/stunnel-4.35/src' make: *** [all-recursive] Error 1 The attached patch solves the problem; it would be cool, if you could include it in the next release. Best regards Stefan Behte Babiel GmbH Moskauer Strasse 27 D-40227 Düsseldorf Tel: 0211-179349 0 Fax: 0211-179349 29 E-Mail: S.Behte(a)babiel.com Internet: http://www.babiel.com Geschäftsführer: Georg Babiel, Dr. Rainer Babiel, Harald Babiel Amtsgericht Düsseldorf HRB 38633 ~~~~~~~~~~~~~~ DISCLAIMER ~~~~~~~~~~~~~~~ The information transmitted in this electronic mail message may contain confidential and or privileged materials. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you receive such e-mails in error, please contact the sender and delete the material from any computer.

2 2

Using CA intyermediate on stunnel problem
by Abdelkarim Mateos Sanchez 08 Feb '11

08 Feb '11

Hi. We are using RapidSSL certificate for my hosts. We are using stunnel for ASSP (AntiSpam Proxy System) We are trying use this certificate but get some errors. We are looking for solution but problem persist, cert = /etc/stunnel/cpanel.pem chroot = /usr/local/cpanel/var/run/stunnel-assp/ pid = /stunnel.pid setuid = stunnel setgid = stunnel output = /var/log/stunnel.log [ssmtp] accept = 465 connect = 127.0.0.2:26 #CAfile = /etc/stunnel/cpanel.cabundle #CApath = /etc/stunnel/rapidssl/ When try connect get this error depth=0 /serialNumber=cso/HwRW/nTj87jIivvttDvfpI7rUt2c/C=ES/O=genesis.islaserver.com/OU=GT15685418/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=genesis.islaserver.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /serialNumber=cso/HwRW/nTj87jIivvttDvfpI7rUt2c/C=ES/O=genesis.islaserver.com/OU=GT15685418/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=genesis.islaserver.com verify error:num=27:certificate not trusted verify return:1 depth=0 /serialNumber=cso/HwRW/nTj87jIivvttDvfpI7rUt2c/C=ES/O=genesis.islaserver.com/OU=GT15685418/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=genesis.islaserver.com verify error:num=21:unable to verify the first certificate verify return:1 Of /etc/stunnel/cpanel.pem there're KEY and CERT for host CA intermediate certificate for RapidSSL I'm lost. Apreciate help.

2 1

stunnel 4.35 released
by Michal Trojnara 05 Feb '11

05 Feb '11

Dear Users, I'm pleased to announce long-awaited version 4.35 of stunnel. The ChangeLog entry: * New features - Updated Win32 DLLs for OpenSSL 1.0.0c. - Transparent source (non-local bind) added for FreeBSD 8.x. - Transparent destination ("transparent = destination") added for Linux. * Bugfixes - Fixed reload of FIPS-enabled stunnel. - Compiler options are now auto-detected by ./configure script in order to support obsolete versions of gcc. - Async-signal-unsafe s_log() removed from SIGTERM/SIGQUIT/SIGINT handler. - CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments. - Directory lib64 included in the OpenSSL library search path. - Windows CE compilation fixes (thx to Pierre Delaage). - Deprecated RSA_generate_key() replaced with RSA_generate_key_ex(). * Domain name changes (courtesy of Bri Hatch) - http://stunnel.mirt.net/ --> http://www.stunnel.org/ - ftp://stunnel.mirt.net/ --> http://ftp.stunnel.org/ - stunnel.mirt.net::stunnel --> rsync.stunnel.org::stunnel - stunnel-users(a)mirt.net --> stunnel-users(a)stunnel.org - stunnel-announce(a)mirt.net --> stunnel-announce(a)stunnel.org Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.35.tar.gz: a810e220498239483e14fae24eeb2a188a6167e9118958b903f8793768c4460f Best regards, Mike

1 0

Compiling with ./configure --enable-fips option
by Lewis, Joseph E Sr Mr CTR USA USA 01 Feb '11

01 Feb '11

I am having a problem with compiling with fips enable mode on. The default is suppose to fips enabled but when the configure runs with no options it states that fips is not enabled and the make runs successfully. When I use the –enable-fips option, the configure runs just fine but the make fails with : In file included from common.h:374, from file.c:38: /usr/include/openssl/fips.h:69:2: error: #error FIPS is disabled. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. IBM support assures me that FIPS is enabled. At this point I am stuck and do not know what to do next. Can anyone offer any suggestions? My system, oslevel, ssl level, etc… are as follows: $ uname -a AIX velssi02 3 5 00C866124C00 $oslevel –s AIX 5300-12-02-1036 $ lslpp -l | grep libc bos.rte.libc 5.3.12.2 COMMITTED libc Library bos.rte.libcfg 5.3.12.1 COMMITTED libcfg Library bos.rte.libcur 5.3.11.0 COMMITTED libcurses Library $ gcc -v Using built-in specs. Target: powerpc-ibm-aix5.3.0.0 Configured with: ../configure --with-as=/usr/bin/as --with-ld=/usr/bin/ld --enable-languages=c,c++,java --prefix=/opt/freeware --enable-threads --enable-version-specific-runtime-libs --host=powerpc-ibm-aix5.3.0.0 --target=powerpc-ibm-aix5.3.0.0 --build=powerpc-ibm-aix5.3.0.0 --disable-libjava-multilib Thread model: aix gcc version 4.2.0 $ ssh –V OpenSSH_5.2p1, OpenSSL 0.9.8k-fips 25 Mar 2009 stunnel-4.34 $ /usr/local/bin/stunnel/stunnel -version stunnel 4.32 on powerpc-ibm-aix5.3.0.0 with OpenSSL 0.9.8k-fips 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

2 2

malformed packets - follow-up
by Jean-Yves F. Barbier 01 Feb '11

01 Feb '11

Hi list, After asking a friend about these errors, it appear they come from large packets reassembly; so my questions are: does it come from stunnel or http-tunnel? & if it is stunnel, is there an easy way to fine tune the max packet size? JY -- We totally deny the allegations, and we're trying to identify the allegators.

1 0

Stunnel to IRC (quakenet)
by s 31 Jan '11

31 Jan '11

Greetings all, I'm trying to set up stunnel for use with IRC for the first time, and everything appears to work dandy until I try to connect to connect to the various servers, I which I receive errors of the following type: 2011.01.31 16:06:39 LOG5[2212:2640]: Service 6001 accepted connection from 127.0.0.1:37345 2011.01.31 16:06:39 LOG5[2212:2640]: connect_blocking: connected 213.131.156.50:6667 2011.01.31 16:06:39 LOG5[2212:2640]: Service 6001 connected remote server from 10.1.4.13:37346 2011.01.31 16:06:40 LOG3[2212:2640]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.01.31 16:06:40 LOG5[2212:2640]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Below is my stunnel.conf: cert = C:\temp\downloads\stunnel\stunnel.pem key = C:\temp\downloads\stunnel\stunnel.pem client = yes [6001] accept = 6001 connect = irc.quakenet.org:6667 [6002] accept = 6002 connect = irc.fu-berlin.de:6667 [6003] accept = 6003 connect = eu.undernet.org:6667 [6004] accept = 6004 connect = irc.servercentral.net:6667 Can anyone explain to me the significance of my error? Thank you very much, S

1 0

malformed packets
by Jean-Yves F. Barbier 31 Jan '11

31 Jan '11

server: xp sp3, 4.34, http-tunnel (192.168.1.251) client: vm virtualbox xp sp3 under Debian Linux sid, 4.34, http-tunnel purpose: secured tunneling of an RDP access =================== Hi list, As I made a wireshark packet analysis, I noticed that *every* packet coming from the server id tagged [Malformed Packet], ie: No Time Source SrcP Destination DstP Protocol 620 37.247880 192.168.1.251 443 192.168.1.26 1062 SSLv3 Info Continuation Data [Malformed Packet] The protocols analyse window says 25% packets are malformed. Could you tell me where it comes from, if it generates extra traffic and if so, how I can fix that? (this setup will be used on a laptop that connect to the internet with a cell phone, so each byte has a cost.) JY -- You will be dead within a year.

1 0

How to define stunnel.conf so openvpn packet will go thru stunnel to as HTTP?
by Guy Sapir 23 Jan '11

23 Jan '11

Hi, >From what I read the examples in stunnel site it possible to wrap VPN's using Stunnel tool. Is it possible to do it for openvpn packets? I can configure thru the openvpn configurations that it packets will go thru port 80 and use TCP but the packets are not http pure. I need to wrap this packets using the stunnel tool. The purpose is to use openvpn over http. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn if possible. Thanks

2 1

s_poll_wait timeout: connection reset
by manoj kumar 19 Jan '11

19 Jan '11

Hi, We have a problem in our production system. Need help to isolate the cause. Want to know whether issue is with stunnel. We are not in situation to upgrade, since we are in production. Your help is appreciated. Environment: 1) Client program(java in win desktops) connect to server (solaris) Stunnel port which is forwarded locally to an inetd program which connects to oracle database. ( 2 Tier Architecture ) 2) Setup worked for almost 2 years without any issue, suddenly since last September, we have connection reset issue on app clients intermittently. 3) almost lots of clients ( in 100's ) get reset and we find 100's of below messages in /var/adm/messages file of solaris. stunnel: [ID 821868 daemon.info] LOG6[21204:5272]: s_poll_wait timeout: connection reset stunnel: [ID 821868 daemon.notice] LOG5[21204:4804]: Connecti on reset: 1867341 bytes sent to SSL, 55211 bytes sent to socket 4) After reset, Client attempt to relogin works without any issue. there is no pattern of load, time, no of users. 5) all the database, inetd program, stunnel runs with oracle userid 6) No other OS related, resource related errors in /var/adm/messages. 7) At this point, i dont have stunnel debug log during the problem occurrence , since we have cron job that recycles logs. if required will send later. 8) Interms of change happend before the first occurance of issue, we did CPU/RAM upgrade, Oracle Database CPU Patch. But database team says no errors reported on oracle side during reset. 9) Max users on database is around 1024, which our max users is 300. ******************************************************************** Config: #/usr/local/bin/stunnel -version stunnel 4.25 on sparc-sun-solaris2.10 with OpenSSL 0.9.7d 17 Mar 2004 (+ security fixes for: CVE-2005-2969 CVE-2006-2937 CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2007-5135 CVE-2007-3108 CVE-2008-5077 CVE-2009-0590 CVE-2009-3555) Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!DHE-RSA-AES256-SHA:!DHE-DSS-AES256-SHA:!AES256-SHA:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------------------------- #uname -a SunOS xxxxxxxxxx 5.10 Generic_144488-02 sun4u sparc SUNW,SPARC-Enterprise --------------------------------------------------------------------- # gcc -v Reading specs from /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/specs Configured with: /sfw10/builds/build/sfw10-patch/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/ccs/bin/as --without-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath) ------------------------------------------------------------------------ # openssl version OpenSSL 0.9.7d 17 Mar 2004 (+ security fixes for: CVE-2005-2969 CVE-2006-2937 CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2007-5135 CVE-2007-3108 CVE-2008-5077 CVE-2009-0590 CVE-2009-3555) ----------------------------------------------------------------------------- # more avaloq.conf ( Ssl config file we use /usr/local/bin/stunnel /opt/app/ssl/stunnel.conf ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/app/ssl/cert.pem key = /opt/app/ssl/cert.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/var/lib/stunnel/ ;setuid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /opt/app/ssl/avaloq_ssl/avaloq.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /usr/local/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /db/avaloq/export/stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [application] accept =7766 connect =localhost:7767 TIMEOUTconnect = 60 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini -------------------------------------------------------------------------------- #netstat -an |grep 7766 |wc -l 249 Regards, kumar

2 5

What legal issues come up if I use GPL-incompatible libraries with GPL software?
by Michal Trojnara 17 Jan '11

17 Jan '11

Dear Users, I just noticed some people declare GPL license on stunnel patches. Since stunnel uses GPL license *with OpenSSL exception* (OpenSSL license is not GPL-compatible), it cannot be distributed if it is linked against any GPL code (patches, libraries) without this exception. It is still legal to distribute stunnel with patches that use GPL license with OpenSSL exception. Such patches constitute forks of stunnel and will *never* be accepted to my source tree. Third party patches rarely meet my quality criteria, but I occasionally accept patches released as public domain or having their copyright ownership transferred to me. Also see: http://www.gnu.org/licenses/gpl-faq.html#GPLIncompatibleLibs https://secure.wikimedia.org/wikipedia/en/wiki/Fork_%28software_development… Mike

1 0

Re: [stunnel-users] Multi Tunnel Support in STunnel
by Narendra Prasad Madanapalli 16 Jan '11

16 Jan '11

I'm sorry, if my previous mail explained the problem differently. Stunnel does load balancing when multiple connect statements are specified in a section as in the below mail. The scenario is something like http://mirt.net/pipermail/stunnel-users/2006-May/001139.html and explained below N servers each running a service of the same service-program (e.g: ip1:2345, ip2:2345, ... ipN:2345) A management server running on a different server (ipM:6789) is required to connect to all or a subset of the above servers through stunnel based on the user request. I couldn't find this feature supported by stunnel in the man page. I would appreciate if you provide any information on this. Thanks, Narendra. > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Narendra Prasad Madanapalli wrote: > > connect = ip1:5678,ip2:5678,ip3:5678,...ipn:5678 > > > > Anyone can please let me know the steps to configure the stunnel if > > the support is already in place or provide your thoughts on the new > > support? > > > Use multiple "connect" options within a single section: > connect = ip1:5678 > connect = ip2:5678 > connect = ip3:5678 > ... > connect = ipn:5678 > > Reading The Fine Manual would answer your question. It's not that > hard to read the manual for "connect" before proposing any extensions > for this option. > Thanks, Narendra.

2 1

Stunnel forwarding IP
by oscaruser＠programmer.net 15 Jan '11

15 Jan '11

Folks, For my server daemon process, I am accepting incoming requests only from pre-seeded IP addrs. Using Stunnel, I am finding connecting IPs are '127.0.0.1' or localhost. Is there any configuration or solution to represent incoming IPs for the given file descriptor belonging to their originating IP addrs? Thank you.

4 5

stunnel with FIPS and SIGHUP
by Eric Lambert 15 Jan '11

15 Jan '11

Hello, I am having difficulting when running stunnel in FIPS mode and using a SIGHUP to get stunnel to re-read it's configuration file (for instance if I've changed a port # or IP address for one of the connections). This causes stunnel to call the SSL routine FIPS_mode_set() a second time after receiving the SIGHUP, which in turn attempts to reinitialize SSL. Unfortunately, OpenSSL does not support calling FIPS_mode_set(1) more than once. The initialization of SSL becomes incomplete as a result of the 2nd call and subsequent attempts to use stunnel to establish encrypted connections fail. Does anyone have any suggestions on how I can make this work (besides killing and restarting stunnel)? If not, I have a proposed fix (and there are multiple ways that this could be addressed). Anyway, my suggestion is to add the following two lines to the ssl_configure() function (found in the file "ssl.c"), right before the current FIPS_mode_set() routine is called: FIPS_mode_set(0); RAND_set_rand_method(NULL); The function currently looks like: int ssl_configure(void) { /* configure global SSL settings */ #ifdef USE_FIPS if(!FIPS_mode_set(global_options.option.fips)) { ERR_load_crypto_strings(); sslerror("FIPS_mode_set"); return 0; } s_log(LOG_NOTICE, "FIPS mode %s", global_options.option.fips ? "enabled" : "disabled"); #endif /* USE_FIPS */ : : } With the suggested fix, it would look as follows: int ssl_configure(void) { /* configure global SSL settings */ #ifdef USE_FIPS FIPS_mode_set(0); RAND_set_rand_method(NULL); if(!FIPS_mode_set(global_options.option.fips)) { ERR_load_crypto_strings(); sslerror("FIPS_mode_set"); return 0; } s_log(LOG_NOTICE, "FIPS mode %s", global_options.option.fips ? "enabled" : "disabled"); #endif /* USE_FIPS */ : : } Does the above seem reasonable. Could this change, or some other modification which would support using SIGHUP with FIPS, be considered for a future stunnel update? Thanks for your help.

2 1

Multi Tunnel Support in STunnel
by Narendra Prasad Madanapalli 15 Jan '11

15 Jan '11

Hi, Current stunnel implementation is based on peer-to-peer communication and it cannot be used in the environment where a management server wants to talk to multi-site server (i.e. an instance of server running in different sites). Multi Tunnel support for Stunnel enables a Management Server to communicate with Multisite Server. But it requires extending Stunnel with a new protocol whereby Management Server & Client Stunnel Process communicates. 1. The new stunnel conf for multi tunnel (keeping backward compatibility) look like [singleTunnelServiceName] accept = aport connect = ip:cport [serviceName] multitunnel = yes accept = 1234 connect = ip1:5678,ip2:5678,ip3:5678,...ipn:5678 Anyone can please let me know the steps to configure the stunnel if the support is already in place or provide your thoughts on the new support? Thanks, Narendra.

2 1