- stunnel-users - stunnel.org

"bind: Address already in use (48)"
by Dino Buzzetti 12 Apr '10

12 Apr '10

Please pardon me if this is an improper question to the list. But I am a freshman who uses stunnel to connect to his university library proxy from abroad. I had stunnel installed and it worked properly, but after an upgrade of all old ports, solicited by the installation process of a new application requiring MacPorts, stunnel doesn't work anymore. I have tried to re-install it, but I still get the same error message > Error binding squidssl to ::1:8095 > bind: Address already in use (48) Any clue as to what might have engaged the 8095 address and on how I might try to solve the problem? Best, -dino buzzetti

3 2

Stunnel doesn't work at all since 4.30
by Denis Solovyov 05 Apr '10

05 Apr '10

Dear friends, I use stunnel for a long time to provide pop3s connections inside a local network. It is quite an old linux server under 2.4 kernel. Stunnel is started from xinetd. xinetd.conf: service pop3s { socket_type = stream wait = no user = root server = /usr/local/bin/stunnel server_args = /usr/local/etc/stunnel/pop3s.conf bind = [ip_address] } /usr/local/etc/stunnel/pop3s.conf: cert = /usr/local/etc/stunnel/mail.pem debug = debug exec = /usr/local/sbin/popa3d execargs = popa3d Everything worked perfectly before 4.30, but when I installed 4.30 pop3s connections just stopped. There is absolutely nothing in logs, just start and stop; example: Mar 24 20:29:51 aldema xinetd[2235]: START: pop3s pid=19123 from=[ip] Mar 24 20:29:51 aldema xinetd[2235]: EXIT: pop3s status=1 pid=19123 duration=0(sec) It is "all.log", i.e. syslog puts everything (*.*) into this file. If starting xinetd with '-v' option, nothing interesting is shown in its own verbose output. When I use 4.29 all.log looks like (with debug = info): Mar 21 09:40:04 aldema xinetd[2235]: START: pop3s pid=32516 from=[ip] Mar 21 09:40:04 aldema stunnel: LOG5[32516:16384]: stunnel 4.29 on i686-pc-linux-gnu with OpenSSL 0.9.7e Mar 21 09:40:04 aldema stunnel: LOG5[32516:16384]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Mar 21 09:40:04 aldema stunnel: LOG5[32516:16384]: stunnel accepted connection from[ip]:4020 Mar 21 09:40:04 aldema stunnel: LOG6[32516:16384]: SSL accepted: new session negotiated Mar 21 09:40:04 aldema stunnel: LOG6[32516:16384]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 Mar 21 09:40:04 aldema stunnel: LOG6[32516:16384]: Local mode child started (PID=32517) Mar 21 09:40:05 aldema popa3d[32517]: Authentication passed for [username] from 127.0.0.1 Mar 21 09:40:05 aldema popa3d[32517]: 0 messages (0 bytes) loaded Mar 21 09:40:05 aldema popa3d[32517]: 0 (0) deleted, 0 (0) left Mar 21 09:40:05 aldema stunnel: LOG6[32516:16384]: SSL_shutdown successfully sent close_notify Mar 21 09:40:05 aldema stunnel: LOG5[32516:16384]: Connection closed: 29 bytes sent to SSL, 48 bytes sent to socket Mar 21 09:40:05 aldema xinetd[2235]: EXIT: pop3s status=0 pid=32516 duration=1(sec) When 4.30 was released I thought it may be buggy because it was marked "experimental", but now I see 4.32 and the same behaviour. Actually, I don't know what to do... nothing in logs really confuses me. Does it mean stunnel crashes at startup (running "stunnel -version" is OK)? Any ideas? Thank you. With the best regards, Denis Solovyov

1 1

Openssl-1.0.0 incompatibility
by Carter Browne 02 Apr '10

02 Apr '10

Is there any update on the compatibility issues between openssl-0.9.8n and openssl-1.0.0? The same configuration file was used in both cases. Linux CentOS 5.4 and SuSE 11.1. Stunnel and openssl both built from sources. I have a number of self-signed certificates in a sub-directory. With openssl-1.0.0, the error is: VERIFY ERROR: depth=0, error= self signed certificate:... SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned With openssl-0.9.8n VERIFY OK: depth=0, ... I have compiled and linked a version of openssh-5.4p1 from sources with openssl-1.0.0 and it works correctly. Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

Re: [stunnel-users] stunnel sends empty list of trusted CAs
by Sebastian Bork 01 Apr '10

01 Apr '10

2010/3/31 Michal Trojnara <Michal.Trojnara(a)mirt.net> > You should have implemented it the other way around: The "cert" option should contain the complete certificate chain of stunnel, > and "CApath"/"CAfile" should only contain the trusted CA certificate for "verify > = 2", and the trusted peer certificate for "verify = 3". Hi, thank you for your quick reply! Alas, I think we started with a misunderstanding. I know how the own certificate and the partner certificates are configured, and the instance with verify=3 works for some thirty partners. All client certificates are validated just as they should be. The file I set in "cert" contains the three certificates in the server certificate chain for stunnel, in the correct order. "CApath" is set to a directory that has all the symlinks with md5 hashes for the client certificates (the certificates themselves are all in their own subdirectories, with another set of symlinks, so I can use the subdirectory for an stunnel client process, and the directory at the top for the server). So when I wrote I put the whole certificate chain for each partner in the CA path, I meant in the directory there is the partner certificate as well as the certificate(s) of the CA that they got their certificate from. With "openssl verify -CApath . partner.crt" I check if everything is complete. Maybe this is overkill, if I do not really need a self-signed certificate at the top, but it shouldn't hurt either. The problem is this: their SAP software (I think they use the Business Connector, but it might be their PI directly, as indicated by the "XI" at the end of the capture file - I am no SAP guru) does not send a partner certificate. The partner claims this is because the "Distinguished Names" list is empty. In this list the server is supposed to send all the CAs it accepts, so the client can then chose one of the certificates it has installed to present it to the server. Since the list is empty, no certificate is found. So I need to find a way to send back a list of accepted root CA certificates. What I tried, and described in the mail, was this: I set up a second stunnel with verify=2. For this, I use the same file in "cert", but a new directory for CApath. In this directory, I have put the symlink for the CA certificate of the partner (their own company-wide CA) , in the hope that this is not only used to verify their client certificate when they present it, but also sent in the Distinguished Names list of accepted CAs. Unfortunately, this did not work, that list is still empty. I have attached the data of the connection attempt, including a screenshot the partner sent us, which shows the field they are talking about with a size of "0", Is there any way, regardless of how complex, to send the DNs? I'll gladly patch the source and compile instead of using a binary package, as long as it helps.

1 0

More Issues with Openssl 1.0.0
by Carter Browne 31 Mar '10

31 Mar '10

My standard configurations of stunnel use the verify=2 option. With recent versions of stunnel and openssl-0.9.8 for Linux systems, I have capath = /capath and stunnel searches directory /capath relative to chroot for the certificates. Using the same configuration file and openssl-1.0.0, this directory is no longer being searched. Any ideas about how to specify the location of capath with openssl-1.0.0? Thanks, Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

stunnel sends empty list of trusted CAs
by Sebastian Bork 31 Mar '10

31 Mar '10

Hi, I have a problem which Google did not help me with. A communications partner of one of our customers wants to connect their SAP Business Connector to our platform using HTTPS. Our software does not have SSL/TLS implemented, we rather use stunnel for all communications links, inbound or outbound, where the customer or partner wants to use HTTPS with client authentication. The normal setup is "verify = 3" and the complete certificate chain for each partner is put into the CA path. In most cases, this works without problems. However, in the handshake, after the server certificate is sent and stunnel asks the client to send a client certificate, stunnel sends an empty list of triusted CAs. SAP BC expects the list of supported CAs to contain certificates, instead of being empty. My hope was that using "verify = 2" might help, so I have configured a new server instance of stunnel, and have copied the certificate of the partner's own CA into the CA path. Unfortunately, the partner says it still does not work, and the log file shows they still do not send their certificate when the server asks for a client cert. It seems that stunnel still returns an empty list of trusted CAs, which causes SAP BC to find no certificate to send. Is there any way I can configure stunnel to send back either every certificate found in a path or file, or at least to send back some fixed value for the trusted CAs?

2 1

Problem with openssl-1.0.0
by Carter Browne 30 Mar '10

30 Mar '10

For the Windows version of stunnel-4.31 and 4.32 I tried running stunnel with openssl-1.0.0 compiled for Windows and ssleay32.dll renamed to libssl32.dll. When I make a connection using using stunnel, I get a invalid memory reference to location 0 in libeay32.dll. I have had no problem with this approach with many versions of openssl up through and including openssl-0.9.8n. Any ideas? Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

error:1408F10B
by Greg Groth 29 Mar '10

29 Mar '10

I'm having similar issues recently on two separate machines that are producing similar errors. In both instances, /var/log/messages starts filling up with lines similar to the following: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I can give further details on both systems, as well as the exact issue, if warranted. First off, can anyone explain what a 1408F10B error is? My gut feeling is that in both instances something changed on the client end (in both instances the client is a version of outlook). Any help would be greatly appreciated. Greg Groth

1 0

Re: [stunnel-users] GNU (clarification)
by tony westenhofer 27 Mar '10

27 Mar '10

Mr. Trojnara, That is what I was after: > Please simply include stunnel source (stunnel-4.xx.tar.gz) on whatever media > (e.g. CD, DVD, web page, etc.) you use to distribute your product together > with stunnel binary. Thank you again for such a wonderful piece of work-- And supporting it!!!!! Best Regards Tony > From: stunnel-users-request(a)mirt.net > Subject: stunnel-users Digest, Vol 68, Issue 9 > To: stunnel-users(a)mirt.net > Date: Sat, 27 Mar 2010 12:00:02 +0100 > > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: GNU (Michal Trojnara) > 2. Re: auto-disconnecting people when CRL updated (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 26 Mar 2010 22:27:51 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > Subject: Re: [stunnel-users] GNU > To: stunnel-users(a)mirt.net > Message-ID: <201003262228.10766.Michal.Trojnara(a)mirt.net> > Content-Type: text/plain; charset="utf-8" > > tony westenhofer wrote: > > I am using stunnel (no code modifications) to encrypt communications > > for some applications to eventually be sold. First off outstanding work, > > stunnel saved hours of work having to figure out how to add the security > > desired. > > Thank you. That's exactly why I wrote it. 8-) > > > Now I am wanting to make sure to comply with licensing. > > Can someone be specific and help on this? > > As the author of stunnel I'll be glad to help. > > > I know we have to post a few things on the website for the > > product. (what? a link, an actually dl > > for stunnel...) > > Please simply include stunnel source (stunnel-4.xx.tar.gz) on whatever media > (e.g. CD, DVD, web page, etc.) you use to distribute your product together > with stunnel binary. > > > What about paper distribution for the product, what > > about stunnel must be included? > > I'm not sure I understand your question. > Do you distribute your software on paper? > > Do you mean any advertisement or documentation for your product? > The license does not require that you do anything about it, but it would be > nice of you to mention my name. > > Best regards, > Michal Trojnara > the author of stunnel >

1 0

auto-disconnecting people when CRL updated
by David van Zijl 26 Mar '10

26 Mar '10

Hello Is it possible to get stunnel to disconnect people on a graceful restart when a certificate has expired? Stunnel version 4.30 added the graceful reload option which is great because it will allow us to reload the CRLs, keep everybody connected and prevent new people connecting when their certs have expired (tested and working) - however existing connections are not terminated even though they have just expired... I'm not sure if we've missed a configuration option or if this is just not possible. A little background: We host an IRC server listening on localhost:6667, on top of that we have stunnel listening on the external interface port 6697 We're using the CAfile and CRLpath options to ensure that people are connecting with a valid certificate. Every hour a job runs to download the latest CRL files, if there is a change it restarts stunnel and kicks everybody off (we'd like to use a graceful restart instead) We are running stunnel on Red Hat Linux using the following line inside an init script to run it as a daemon: daemon /usr/local/bin/stunnel /etc/stunnel/stunnel.conf Excerpt from stunnel.conf: setuid = daemon setgid = daemon ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [irc-in] CAfile = /etc/ca/our-chains.pem CRLpath = /etc/crl accept = 192.168.0.1:6697setuid = daemon setgid = daemon connect = localhost:6667 verify = 2 Running stunnel -version tells me: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Kind Regards Dave

2 1

GNU
by tony westenhofer 26 Mar '10

26 Mar '10

Hello, I am using stunnel (no code modifications) to encrypt communications for some applications to eventually be sold. First off outstanding work, stunnel saved hours of work having to figure out how to add the security desired. Now I am wanting to make sure to comply with licensing. Can someone be specific and help on this? I know we have to post a few things on the website for the product. (what? a link, an actually dl for stunnel...) What about paper distribution for the product, what about stunnel must be included? Please be as specific as you can or better yet point me to an example of someone else already giving proper credit where due. Again thank you for your hard work (all involved). Second question, any recommendations for securing the stunnel folder without interfering with its functionality on Windows systems. Have not had time to try locking down different ntfs setting yet. Thanks in advance and I do apologies if my questions have already been covered in the past. If so please provide url. Tony _________________________________________________________________ Hotmail is redefining busy with tools for the New Busy. Get more from your inbox. http://www.windowslive.com/campaign/thenewbusy?ocid=PID27925::T:WLMTAGL:ON:…

2 1

Re: [stunnel-users] Stunnel 4.32 released
by Jose Alf. 26 Mar '10

26 Mar '10

Hi Michal, Thanks for the new 4.32 version. I tested beta 1 and 2 and everything worked fine on my side. Should have been released a day after because OpenSSL released a new version (0.9.8n) the same day. I compiled mine against it on Windows and it works. regards, Jose.

1 0

Still not working with client certificates
by Ron Cordell 24 Mar '10

24 Mar '10

Hello, I'm hoping that someone can give me a hint of where to look at this issue because I'm totally stuck and have been for a few days. When I attempt to use sTunnel in client mode with client certificates, the SSL seems to negotiate the certs and ciphers and then nothing else happens; the services hang. I'm hoping that someone has some insights about something that I haven't looked at, yet. My setup: Server: Windows Server, IIS 7 running SOAP services set for SSL Required, Client Certificate required (transport level client certificate, not SOAP message level). client: Windows machine, simple web application acting as a test client for the SOAP service. In between: sTunnel v4.32 Testing Scenario #1 -- Client configured to use client certificates directly against the IIS 7 service instance. This works as expected. Testing Scenario #2 -- Server configured to not require client certificates, but require SSL. sTunnel configured to listen on local port 8090 and forward to the IIS 7 server. This works as expected. Testing Scenario #3 -- Server configured to require client certificates. sTunnel configured to use client certificate as issued by a local CA in addition to the setup as before. This does not work, but hangs. sTunnel.conf: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = C:\certs\client-cert-for-internal-environments.pem ;key = c:\certs\test_cert.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = c:\temp\stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [http] accept = 8090 ;connect = 10.12.32.164:443 connect = 10.12.32.68:1443 TIMEOUTclose = 0 ; vim:ft=dosini sTunnel log: 2010.03.24 11:54:31 LOG5[5616:5992]: Reading configuration from file stunnel.conf 2010.03.24 11:54:31 LOG7[5616:5992]: RAND_status claims sufficient entropy for the PRNG 2010.03.24 11:54:31 LOG7[5616:5992]: PRNG seeded successfully 2010.03.24 11:54:31 LOG7[5616:5992]: Certificate: C:\certs\client-cert-for-internal-environments.pem 2010.03.24 11:54:31 LOG7[5616:5992]: Certificate loaded 2010.03.24 11:54:31 LOG7[5616:5992]: Key file: C:\certs\client-cert-for-internal-environments.pem 2010.03.24 11:54:38 LOG7[5616:5992]: Private key loaded 2010.03.24 11:54:38 LOG7[5616:5992]: SSL context initialized for service http 2010.03.24 11:54:38 LOG5[5616:5992]: Configuration successful 2010.03.24 11:54:38 LOG5[5616:5992]: No limit detected for the number of clients 2010.03.24 11:54:38 LOG7[5616:5992]: FD=176 in non-blocking mode 2010.03.24 11:54:38 LOG7[5616:5992]: Option SO_REUSEADDR set on accept socket 2010.03.24 11:54:38 LOG7[5616:5992]: Service http bound to 0.0.0.0:8090 2010.03.24 11:54:38 LOG7[5616:5992]: Service http opened FD=176 2010.03.24 11:54:38 LOG3[5616:5992]: c:\temp\stunnel.log: Input/output error (5) 2010.03.24 11:54:38 LOG3[5616:5992]: Unable to open output file: c:\temp\stunnel.log 2010.03.24 11:54:38 LOG5[5616:5992]: stunnel 4.32 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.03.24 11:54:38 LOG5[5616:5992]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.03.24 11:54:54 LOG7[5616:6192]: Service http accepted FD=436 from 127.0.0.1:56102 2010.03.24 11:54:54 LOG7[5616:6192]: Creating a new thread 2010.03.24 11:54:54 LOG7[5616:6192]: New thread created 2010.03.24 11:54:54 LOG7[5616:6696]: Service http started 2010.03.24 11:54:54 LOG7[5616:6696]: FD=436 in non-blocking mode 2010.03.24 11:54:54 LOG7[5616:6696]: Option TCP_NODELAY set on local socket 2010.03.24 11:54:54 LOG5[5616:6696]: Service http accepted connection from 127.0.0.1:56102 2010.03.24 11:54:54 LOG7[5616:6696]: FD=456 in non-blocking mode 2010.03.24 11:54:54 LOG6[5616:6696]: connect_blocking: connecting 10.12.32.68:1443 2010.03.24 11:54:54 LOG7[5616:6696]: connect_blocking: s_poll_wait 10.12.32.68:1443: waiting 10 seconds 2010.03.24 11:54:54 LOG5[5616:6696]: connect_blocking: connected 10.12.32.68:1443 2010.03.24 11:54:54 LOG5[5616:6696]: Service http connected remote server from 10.12.47.109:56103 2010.03.24 11:54:54 LOG7[5616:6696]: Remote FD=456 initialized 2010.03.24 11:54:54 LOG7[5616:6696]: Option TCP_NODELAY set on remote socket 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): before/connect initialization 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 write client hello A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 read server hello A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 read server certificate A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 read server done A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 write client key exchange A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 write change cipher spec A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 write finished A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 flush data 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 read finished A 2010.03.24 11:54:54 LOG7[5616:6696]: 1 items in the session cache 2010.03.24 11:54:54 LOG7[5616:6696]: 1 client connects (SSL_connect()) 2010.03.24 11:54:54 LOG7[5616:6696]: 1 client connects that finished 2010.03.24 11:54:54 LOG7[5616:6696]: 0 client renegotiations requested 2010.03.24 11:54:54 LOG7[5616:6696]: 0 server connects (SSL_accept()) 2010.03.24 11:54:54 LOG7[5616:6696]: 0 server connects that finished 2010.03.24 11:54:54 LOG7[5616:6696]: 0 server renegotiations requested 2010.03.24 11:54:54 LOG7[5616:6696]: 0 session cache hits 2010.03.24 11:54:54 LOG7[5616:6696]: 0 external session cache hits 2010.03.24 11:54:54 LOG7[5616:6696]: 0 session cache misses 2010.03.24 11:54:54 LOG7[5616:6696]: 0 session cache timeouts 2010.03.24 11:54:54 LOG6[5616:6696]: SSL connected: new session negotiated 2010.03.24 11:54:54 LOG6[5616:6696]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 This is where things time out; nothing happens beyond this point.

1 0

Stunnel 4.32 released
by Michal Trojnara 24 Mar '10

24 Mar '10

Dear Users, I'm glad to announce a new version of stunnel. The ChangeLog entry: Version 4.32, 2010.03.24, urgency: MEDIUM: * New features - New service-level "libwrap" option for run-time control whether /etc/hosts.allow and /etc/hosts.deny are used for access control. Disabling libwrap significantly increases performance of stunnel. - Win32 DLLs for OpenSSL 0.9.8m. * Bugfixes - Fixed a transfer() loop issue with SSLv2 connections. - Fixed a "setsockopt IP_TRANSPARENT" warning with "local" option. - Logging subsystem bugfixes and cleanup. - Installer bugfixes for Vista and later versions of Windows. - FIPS mode can be enabled/disabled at runtime. SHA-1 value for stunnel-4.32.tar.gz: e9be8b9150d1c901a7c37b58494e351815147a79 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

Trying to use client certificates but no success so far
by Ron Cordell 19 Mar '10

19 Mar '10

Hello, I'm trying to set up sTunnel to use client certificates in the following arrangement: Client Java Server (HTTP) --> sTunnel (HTTPS w/client cert) --> Windows IIS SOAP service, requires client cert The client certificate was generated from a MS CA cert generation tool, one we use for our internal certificates and our internal CA. The client cert was generated as a .pfx file and I used OpenSSL to convert it to a .pem file with the -nodes option. Testing without the client certificates shows that if the IIS hosted SOAP service is set to not require a client certificate, the sTunnel configuration works and we're able to communicate between the HTTP only client and the HTTPS IIS hosted service. However, once we add the certificate, the communication stops at the handshake. I'm wondering if I need to change the client .pem cert to have the private key (don't use the -nodes option when converting using OpenSSL). Here is the contents of the .conf file: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = user_cert.pem key = user_cert.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = c:\temp\stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [http] accept = 8090 connect = 10.12.32.164:443 TIMEOUTclose = 0 ; vim:ft=dosini Here is the output from the log file showing two attempts to hit the service with the client cert, one from a browser and one from a bit of client code: 2010.03.19 09:58:27 LOG5[5864:4032]: Reading configuration from file stunnel.conf 2010.03.19 09:58:27 LOG7[5864:4032]: RAND_status claims sufficient entropy for the PRNG 2010.03.19 09:58:27 LOG7[5864:4032]: PRNG seeded successfully 2010.03.19 09:58:27 LOG7[5864:4032]: Certificate: user_cert.pem 2010.03.19 09:58:27 LOG7[5864:4032]: Certificate loaded 2010.03.19 09:58:27 LOG7[5864:4032]: Key file: user_cert.pem 2010.03.19 09:58:27 LOG7[5864:4032]: Private key loaded 2010.03.19 09:58:27 LOG7[5864:4032]: SSL context initialized for service http 2010.03.19 09:58:27 LOG5[5864:4032]: Configuration successful 2010.03.19 09:58:27 LOG5[5864:4032]: No limit detected for the number of clients 2010.03.19 09:58:27 LOG7[5864:4032]: FD=176 in non-blocking mode 2010.03.19 09:58:27 LOG7[5864:4032]: Option SO_REUSEADDR set on accept socket 2010.03.19 09:58:27 LOG7[5864:4032]: Service http bound to 0.0.0.0:8090 2010.03.19 09:58:27 LOG7[5864:4032]: Service http opened FD=176 2010.03.19 09:58:27 LOG5[5864:4032]: stunnel 4.31 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.03.19 09:58:27 LOG5[5864:4032]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.03.19 09:59:42 LOG7[5864:3864]: Service http accepted FD=440 from 127.0.0.1:49886 2010.03.19 09:59:42 LOG7[5864:3864]: Creating a new thread 2010.03.19 09:59:42 LOG7[5864:3864]: New thread created 2010.03.19 09:59:42 LOG7[5864:4328]: Service http started 2010.03.19 09:59:42 LOG7[5864:4328]: FD=440 in non-blocking mode 2010.03.19 09:59:42 LOG7[5864:4328]: Option TCP_NODELAY set on local socket 2010.03.19 09:59:42 LOG5[5864:4328]: Service http accepted connection from 127.0.0.1:49886 2010.03.19 09:59:42 LOG7[5864:4328]: FD=460 in non-blocking mode 2010.03.19 09:59:42 LOG6[5864:4328]: connect_blocking: connecting 10.12.32.164:443 2010.03.19 09:59:42 LOG7[5864:4328]: connect_blocking: s_poll_wait 10.12.32.164:443: waiting 10 seconds 2010.03.19 09:59:42 LOG5[5864:4328]: connect_blocking: connected 10.12.32.164:443 2010.03.19 09:59:42 LOG5[5864:4328]: Service http connected remote server from 10.12.47.109:49887 2010.03.19 09:59:42 LOG7[5864:4328]: Remote FD=460 initialized 2010.03.19 09:59:42 LOG7[5864:4328]: Option TCP_NODELAY set on remote socket 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): before/connect initialization 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write client hello A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read server hello A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read server certificate A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read server done A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write client key exchange A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write change cipher spec A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write finished A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 flush data 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read finished A 2010.03.19 09:59:42 LOG7[5864:4328]: 1 items in the session cache 2010.03.19 09:59:42 LOG7[5864:4328]: 1 client connects (SSL_connect()) 2010.03.19 09:59:42 LOG7[5864:4328]: 1 client connects that finished 2010.03.19 09:59:42 LOG7[5864:4328]: 0 client renegotiations requested 2010.03.19 09:59:42 LOG7[5864:4328]: 0 server connects (SSL_accept()) 2010.03.19 09:59:42 LOG7[5864:4328]: 0 server connects that finished 2010.03.19 09:59:42 LOG7[5864:4328]: 0 server renegotiations requested 2010.03.19 09:59:42 LOG7[5864:4328]: 0 session cache hits 2010.03.19 09:59:42 LOG7[5864:4328]: 0 external session cache hits 2010.03.19 09:59:42 LOG7[5864:4328]: 0 session cache misses 2010.03.19 09:59:42 LOG7[5864:4328]: 0 session cache timeouts 2010.03.19 09:59:42 LOG6[5864:4328]: SSL connected: new session negotiated 2010.03.19 09:59:42 LOG6[5864:4328]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2010.03.19 10:01:54 LOG3[5864:4328]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2010.03.19 10:01:54 LOG5[5864:4328]: Connection reset: 568 bytes sent to SSL, 0 bytes sent to socket 2010.03.19 10:01:54 LOG7[5864:4328]: Service http finished (0 left) 2010.03.19 10:03:28 LOG7[5864:3864]: Service http accepted FD=476 from 127.0.0.1:50155 2010.03.19 10:03:28 LOG7[5864:3864]: Creating a new thread 2010.03.19 10:03:28 LOG7[5864:3864]: New thread created 2010.03.19 10:03:28 LOG7[5864:1216]: Service http started 2010.03.19 10:03:28 LOG7[5864:1216]: FD=476 in non-blocking mode 2010.03.19 10:03:28 LOG7[5864:1216]: Option TCP_NODELAY set on local socket 2010.03.19 10:03:28 LOG5[5864:1216]: Service http accepted connection from 127.0.0.1:50155 2010.03.19 10:03:28 LOG7[5864:1216]: FD=440 in non-blocking mode 2010.03.19 10:03:28 LOG6[5864:1216]: connect_blocking: connecting 10.12.32.164:443 2010.03.19 10:03:28 LOG7[5864:1216]: connect_blocking: s_poll_wait 10.12.32.164:443: waiting 10 seconds 2010.03.19 10:03:28 LOG5[5864:1216]: connect_blocking: connected 10.12.32.164:443 2010.03.19 10:03:28 LOG5[5864:1216]: Service http connected remote server from 10.12.47.109:50156 2010.03.19 10:03:28 LOG7[5864:1216]: Remote FD=440 initialized 2010.03.19 10:03:28 LOG7[5864:1216]: Option TCP_NODELAY set on remote socket 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): before/connect initialization 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 write client hello A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 read server hello A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 read finished A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 write change cipher spec A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 write finished A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 flush data 2010.03.19 10:03:28 LOG7[5864:1216]: 1 items in the session cache 2010.03.19 10:03:28 LOG7[5864:1216]: 2 client connects (SSL_connect()) 2010.03.19 10:03:28 LOG7[5864:1216]: 2 client connects that finished 2010.03.19 10:03:28 LOG7[5864:1216]: 0 client renegotiations requested 2010.03.19 10:03:28 LOG7[5864:1216]: 0 server connects (SSL_accept()) 2010.03.19 10:03:28 LOG7[5864:1216]: 0 server connects that finished 2010.03.19 10:03:29 LOG7[5864:1216]: 0 server renegotiations requested 2010.03.19 10:03:29 LOG7[5864:1216]: 1 session cache hits 2010.03.19 10:03:29 LOG7[5864:1216]: 0 external session cache hits 2010.03.19 10:03:29 LOG7[5864:1216]: 0 session cache misses 2010.03.19 10:03:29 LOG7[5864:1216]: 0 session cache timeouts 2010.03.19 10:03:29 LOG6[5864:1216]: SSL connected: previous session reused 2010.03.19 10:04:28 LOG7[5864:1216]: Socket closed on read 2010.03.19 10:04:28 LOG7[5864:1216]: SSL write shutdown 2010.03.19 10:04:28 LOG7[5864:1216]: SSL alert (write): warning: close notify 2010.03.19 10:04:28 LOG6[5864:1216]: SSL_shutdown successfully sent close_notify 2010.03.19 10:04:28 LOG6[5864:1216]: s_poll_wait timeout: connection close 2010.03.19 10:04:28 LOG5[5864:1216]: Connection closed: 1541 bytes sent to SSL, 25 bytes sent to socket 2010.03.19 10:04:28 LOG7[5864:1216]: Service http finished (0 left) Any hints would be appreciated!

1 0

How to have multiple HTTPS connection with different PEM file
by Andrew Culross 18 Mar '10

18 Mar '10

We are running sTunnel 4.2 and want to have two HTTPS connection that use different PEM certs and are having difficulty doing this - how do you set this up? We have something like ---- Cert = cert1.pem [https] connect = xxx.xxx.xxx.xxx:442 connect = yyy.yyy.yyy.yyy:443 accept = 9876 ------ and we need something like this? -------- [https] connect = xxx.xxx.xxx.xxx:442 cert = cert1.pem accept = 9876 [https] connect = yyy.yyy.yyy.yyy:443 cert = cert2.pem accept = 9877 ----- Can we do that in the config file? If not, how does one specify ? Thanks! Andrew Culross TwoFour Systems 445 Hamilton Ave White Plains, NY 10601 Direct +1 (914) 220-8849 Main +1 (914) 220-8800 Fax +1 (914) 220-8899 <http://www.twofour.com/> www.TwoFour.com <http://www.twofour.com/emaildisclaimer.aspx> http://www.twofour.com/emaildisclaimer.aspx

2 1

Stunnel server with access from Firefox
by Ricky I 16 Mar '10

16 Mar '10

Hi, I am trying to use Stunnel to provide HTTPS access to a web site (my router configurations). That is, stunnel is used to accept HTTPS connection and it forwards the request using HTTP to the web site. The problem seems to be that one connection is opened and it performs an HTTP GET. Afterwards Stunnel does not accept any more connections and I have to restart. I'm not sure what I'm doing wrong. The strange thing I notice is that service router is finished with -1. What does minus one mean? I am using Firefox as the client. What I see is that Firefox is trying to load the page. Using wireshark, I was able to see that all the HTML data from the web page was loaded but Firefox was having trouble performing HTTP GET for the images on the site. I need to restart Stunnel in order to have another connection open. This is confirmed where I made a test by restarting Stunnel and then I tried to just load images from the Web site: e.g. https://192.168.1.88:8880/image1.jpg and https://192.168.1.88:8880/image2.jpg. I get image1.jpg but Firefox can't access image2.jpg, unless I restart then get image2. Here's the logs showing that I am able to make one access to the site. 2010.03.16 00:47:41 LOG5[3266:1024]: stunnel 4.31 on armv5tejl-unknown-linux-gnu with OpenSSL 0.9.8k 25 Mar 2009 2010.03.16 00:47:41 LOG5[3266:1024]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 2010.03.16 00:47:41 LOG7[3266:1024]: Cleaning up the signal pipe 2010.03.16 00:47:41 LOG7[3266:1024]: Signal pipe is empty 2010.03.16 00:47:46 LOG7[3266:1024]: Service router accepted FD=0 from 192.168.1.80:2821 2010.03.16 00:47:46 LOG7[3268:1026]: Service router started 2010.03.16 00:47:46 LOG7[3268:1026]: FD=0 in non-blocking mode 2010.03.16 00:47:46 LOG7[3268:1026]: Option TCP_NODELAY set on local socket 2010.03.16 00:47:46 LOG5[3268:1026]: Service router accepted connection from 192.168.1.80:2821 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): before/accept initialization 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 read client hello A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 write server hello A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 write certificate A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 write server done A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 flush data 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 read client key exchange A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 read finished A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 write change cipher spec A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 write finished A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 flush data 2010.03.16 00:47:46 LOG7[3268:1026]: 1 items in the session cache 2010.03.16 00:47:46 LOG7[3268:1026]: 0 client connects (SSL_connect()) 2010.03.16 00:47:46 LOG7[3268:1026]: 0 client connects that finished 2010.03.16 00:47:46 LOG7[3268:1026]: 0 client renegotiations requested 2010.03.16 00:47:46 LOG7[3268:1026]: 1 server connects (SSL_accept()) 2010.03.16 00:47:46 LOG7[3268:1026]: 1 server connects that finished 2010.03.16 00:47:46 LOG7[3268:1026]: 0 server renegotiations requested 2010.03.16 00:47:46 LOG7[3268:1026]: 0 session cache hits 2010.03.16 00:47:46 LOG7[3268:1026]: 0 external session cache hits 2010.03.16 00:47:46 LOG7[3268:1026]: 1 session cache misses 2010.03.16 00:47:46 LOG7[3268:1026]: 0 session cache timeouts 2010.03.16 00:47:46 LOG6[3268:1026]: SSL accepted: new session negotiated 2010.03.16 00:47:46 LOG6[3268:1026]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2010.03.16 00:47:46 LOG7[3268:1026]: FD=9 in non-blocking mode 2010.03.16 00:47:46 LOG6[3268:1026]: connect_blocking: connecting 192.168.1.1:80 2010.03.16 00:47:46 LOG7[3268:1026]: connect_blocking: s_poll_wait 192.168.1.1:80: waiting 10 seconds 2010.03.16 00:47:46 LOG5[3268:1026]: connect_blocking: connected 192.168.1.1:80 2010.03.16 00:47:46 LOG5[3268:1026]: Service router connected remote server from 192.168.1.88:1133 2010.03.16 00:47:46 LOG7[3268:1026]: Remote FD=9 initialized 2010.03.16 00:47:46 LOG7[3268:1026]: Option TCP_NODELAY set on remote socket 2010.03.16 00:47:46 LOG7[3268:1026]: Socket closed on read 2010.03.16 00:47:46 LOG7[3268:1026]: SSL write shutdown 2010.03.16 00:47:46 LOG7[3268:1026]: SSL alert (write): warning: close notify 2010.03.16 00:47:46 LOG6[3268:1026]: SSL_shutdown successfully sent close_notify 2010.03.16 00:47:46 LOG6[3268:1026]: s_poll_wait timeout: connection close 2010.03.16 00:47:46 LOG5[3268:1026]: Connection closed: 4675 bytes sent to SSL, 445 bytes sent to socket 2010.03.16 00:47:46 LOG7[3268:1026]: Service router finished (-1 left) ============ Finally here's my stunnel.conf: cert = /mnt/HD_a2/ffp/etc/stunnel/stunnel.pem sslVersion = SSLv3 pid = /stunnel.pid ; performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; debugging stuff (may useful for troubleshooting) debug = 7 output = /ffp/etc/stunnel/stunnel.log ; service-level configuration [router] accept = 8880 connect = 192.168.1.1:80 TIMEOUTclose = 0 Thank you very much for any help you can provide. Rick _________________________________________________________________ Check your Hotmail from your phone. http://go.microsoft.com/?linkid=9712957

1 0

DSA server certificate
by Carl 15 Mar '10

15 Mar '10

Hi, Does stunnel support server certificate with a DSA private key? When I try to use a self generated one, stunnel responds with: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key Is this bug report relevant? http://www.mail-archive.com/[email protected]/msg43770.ht… Thanks, Carl

1 0

How do you configure Stunnel Ver 4.31 for TLSv1 - More Info
by David M. Douglass 11 Mar '10

11 Mar '10

Reference: Stunnel Ver 4.31 Windows Binaries This is the actual configuration file I am using. There is not too much to it. As shown below, this WORKS for Gmail's SSL port.. Port 465. Notice that the sslVersion statement is remarked "out". +++++++++++++++++++++++++++ output = STUNNEL.log taskbar = NO cert = stunnel.pem client = yes [SSMTP] accept=DADSXPPRO:8025 connect=smtp.gmail.com:465 ;sslVersion = TLSv1 ++++++++++++++++++++++++++++ In theory (as I have read it...), to change this to TLS, I enable the sslVersion line, And change the port (for Gmail) to 587. Port 587 and TLS for Gmail have been tested and verified via Microsoft Outlook testing. But when I do so, I cannot even log onto the Gmail server. I get the error message referenced in the first message: 2010.02.25 10:35:44 LOG3[2696:2740]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number It occurs to me that I am only using the "stunnel.pem" file, as supplied by the installer program. Do I have a certificate issue? David M. Douglass david(a)az-douglass.net Home (480) 839-2629 Cell (602) 908-9092

4 5

Problem with openssl engine
by Nick Sayer 27 Feb '10

27 Feb '10

I'm trying to use a smart card to hold on to the private key for my server. Since access to the smart card is restricted to one process at a time (not sure why it can't be shared, but that's a whole separate discussion), I'd like to use stunnel as the machine-wide SSL proxy. The problem is that with the pkcs11 engine configuration set up, it fails. 2010.02.27 00:15:03 LOG5[91580:0]: imaps accepted connection from 71.141.64.2:32934 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): before/accept initialization 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 read client hello A 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 write server hello A 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 write certificate A 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 write server done A 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 flush data 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 read client key exchange A 2010.02.27 00:15:03 LOG7[91580:0]: SSL alert (write): fatal: bad record mac 2010.02.27 00:15:03 LOG3[91580:0]: SSL_accept: 1408F119: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2010.02.27 00:15:03 LOG5[91580:0]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.02.27 00:15:03 LOG7[91576:0]: Cleaning up the signal pipe 2010.02.27 00:15:03 LOG7[91576:0]: Process 91580 finished with code 0 (0 left) ^C2010.02.27 00:15:42 LOG3[91576:0]: Received signal 2; terminating This happens *whether or not* I use the private key on the smart card itself. If I load the private key from a disk file, it still happens - even if there is no engineNum statement in the service configuration block. The only way to make it not happen is to comment out the engineCtrl lines. engine=dynamic engineCtrl=SO_PATH:/usr/local/lib/engines/engine_pkcs11.so engineCtrl=ID:pkcs11 engineCtrl=LIST_ADD:1 engineCtrl=LOAD engineCtrl=MODULE_PATH:/usr/local/lib/pkcs11/opensc-pkcs11.so engineCtrl=INIT engineCtrl=PIN:12345678 [imaps] accept = 4993 connect = 143 engineNum = 1 key = id_10 ;cert = id_10 cert = /www.crt It's also worth noting that stunnel seems unable to pull the cert out of the card - that cert=id_10 line should work (works with openssl s_server). This stunnel was compiled last night from the FreeBSD ports tree with WITH_STUNNEL_SSL_ENGINE turned on. stunnel 4.29 on i386-portbld-freebsd8.0 with OpenSSL 0.9.8k 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = 5 pid = /var/tmp/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Note that the same card in the same system can successfully provide ssl server sockets with Java using the Sun PKCS11 JCE provider configured to talk to the opensc PKCS11 module. So there's nothing wrong with the card.

1 0

stunnel-4.15-2.el5.1 zombie when xinetd
by tatiana philippova 25 Feb '10

25 Feb '10

Hi All, I have a problem with stunnel in xinetd mode. It cannot connect to specified localhost:port - always getting child stunnel defunct as a result.. 4789 ? Ss 0:00 \_ stunnel /etc/stunnel/stunnel.conf 4790 ? Z 0:00 \_ [stunnel] <defunct> I'm trying use rsync via stunnel (!ssh for rsync does not suits me in this particular case, but I need encrypt backup traffic anyway.. so have chosen stunnel) client config: cert = /etc/stunnel/stunnel_client_cert.pem client = yes pid = /var/run/stunnel.pid debug = 7 output = /var/log/stunnel.log sslVersion = SSLv2 [ssync] accept = 873 connect = myhost.somewhere.net:273 server config: cert = /etc/stunnel/certs/host.pem key = /etc/stunnel/certs/private/cakey.pem client = no pid = /var/run/stunnel.pid debug = 7 #foreground = yes output = /var/log/stunel.log connect = 873 xinetd config: # default: off # description: SSL wrapper for rsyncd service ssync { disable = no socket_type = stream wait = no user = root server = /usr/sbin/stunnel server_args = /etc/stunnel/stunnel.conf log_on_success += HOST DURATION log_on_failure += HOST only_from = 192.168.5.15 127.0.0.1 } on server side /etc/services: ssync 273/tcp # rsync over stunnel # ps axf | grep rsyn 15637 ? S 0:00 /usr/bin/rsync -4 --daemon --no-detach # netstat -an --program | grep 273 tcp 0 0 0.0.0.0:273 0.0.0.0:* LISTEN 4751/xinetd # netstat -an --program | grep 873 tcp 0 0 127.0.0.1:873 0.0.0.0:* LISTEN 15637/rsync In case of server stunnel running as standalone - everything works perfectly well, but I need it working as xinetd service rather than standalone Could somebody kindly advise what I'm doing wrong? soft on server side: stunnel-4.15-2.el5.1, openssl-0.9.8e-7.el5 OS CentOS release 5.3 (Final), kernel 2.6.18-128.1.6.el5 on client side: stunnel-4.30-1.i386.rpm (compiled as rpmbuild -ta stunnel-4.30.tar.gz) openssl-0.9.8g-9.14.fc9.i686 OS Fedora release 9 (Sulphur) kernel 2.6.28 Many thanks in advance Taphy

1 0

How do you configure Stunnel Ver 4.31 for TLSv1
by David M. Douglass 25 Feb '10

25 Feb '10

I am using the Windows Binary of Version 4.31, and an external email utility that sends SMTP outgoing email. I can configure for specific ports (no problem). and I can send SSMTP SSLv3 with success. That is GOOD ! I am trying to configure Stunnel for sending TLSv1 without success. I understand (via the Version command and screen) that Stunnel defaults to SSLv3. How do I change that to TLSv1 ?? I found the parameter : sslVersion = version select version of SSL protocol Allowed options: all, SSLv2, SSLv3, TLSv1 This appears to be a "SERVICE LEVEL" option, and I have tried to use the line: sslVersion = TLSv1 in the [SSMTP] group of options (along with accept = and connect = ), but get an error message in the log file, which is shown next: 2010.02.25 10:35:44 LOG3[2696:2740]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I have also tried to put the sslVersion = line in the general configuration area, but generate the same error message. The outbound email does, in fact, fail. Can anyone suggest what I am doing wrong ?? Or offer a solution for configuring Stunnel (V4.31) for TLSv1 ?? David M. Douglass david(a)az-douglass.net Home (480) 839-2629 Cell (602) 908-9092

1 0

How to use stunnel
by Gabriel kamega 24 Feb '10

24 Feb '10

Hello sir, Thank you for my subscription. This is the issue: I want to sent automaticly email via smtp.gmail.com server, And I think I need stunnel program. My questions are : *How to use stunnel ?* ; *How to configure the stunnel.conf file ?* I have dowloaded stunnel.exe version 431, but I can't download the * stunnel.pem* file. on the net I see that I have to install with this command : stunnel -install is that all ? on WXP Professionnel SP2 Regards merci

1 0

Access control/TCP wrappers
by Craig Watkinson 23 Feb '10

23 Feb '10

Hi, We're using stunnel to provide a secure interface to an old server that doesn't support HTTPS natively. I'd like to implement some access control so that connections are only supported from specific IP addresses. I am using v4.27 of stunnel that I downloaded from HPs website, and am running it from inittab to ensure it is always running. Unfortunately I don't think it's compiled with libwrap. Should I see libwrap listed when I run ldd against the binary (see below for output)? I think it's possible to run stunnel from inetd. Could I wrapper it here? Is the following entry correct? stunnel stream tcp nowait root /usr/lbin/tcpd /opt/iexpress/stunnel/bin/stunnel stunnel I think this would work, but I'm concerned that if stunnel was to crash or be killed that there would be nothing restarting it if we ran it from inetd. Any advice much appreciated Craig ------------------------------------- # ./stunnel -version stunnel 4.27 on ia64-hp-hpux11.23 with OpenSSL 0.9.7m 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = 5 pid = /opt/iexpress/stunnel/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL+RC4:@STRENGTH key = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # ldd ./stunnel libdl.so.1 => /usr/lib/hpux32/libdl.so.1 libnsl.so.1 => /usr/lib/hpux32/libnsl.so.1 libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1 libunwind.so.1 => /usr/lib/hpux32/libunwind.so.1 libc.so.1 => /usr/lib/hpux32/libc.so.1 libxti.so.1 => /usr/lib/hpux32/libxti.so.1 libuca.so.1 => /usr/lib/hpux32/libuca.so.1 libdl.so.1 => /usr/lib/hpux32/libdl.so.1 _________________________________________________________________ Do you have a story that started on Hotmail? Tell us now http://clk.atdmt.com/UKM/go/195013117/direct/01/

2 2

4.26 and commercial certificate - Now working.
by Editor (Kevin) 20 Feb '10

20 Feb '10

Hi: Thanks. Everything is working now. > Message: 1 > Date: Wed, 17 Feb 2010 07:11:16 -0800 (PST) > From: Leandro Avila <leandro.avila(a)ymail.com> > Subject: Re: [stunnel-users] Small challenge with version 4.26 and a > commercial certificate > To: stunnel-users(a)mirt.net > Message-ID: <544640.49520.qm(a)web111011.mail.gq1.yahoo.com> > Content-Type: text/plain; charset=us-ascii > > Hi Kevin, > > I think there is ambiguous information about this. > The man page states that the private key should be unencrypted > However, the changelog states that the support for pass phrases was fixed in v4.20 > > I'll do some testing see what I can find. Or maybe someone can shed some light on the issue. > > Best regards > > ----------------- > Leandro Avila

1 0

Re: [stunnel-users] Make reports an error on Aix with stunnel-4.30
by Michal Trojnara 19 Feb '10

19 Feb '10

Derek Nicholls wrote: > gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith > -I/opt/freeware/include -o stunnel file.o client.o log.o options.o > protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o > pty.o libwrap.o -lz -ldl -L/opt/freeware/lib -lssl -lcrypto > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_set_info_callback > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_new_cb > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_get_cb > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_remove_cb > ld: 0711-317 ERROR: Undefined symbol: .BIO_set_flags > ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more > information. > collect2: ld returned 8 exit status > make: 1254-004 The error code from the last command is 1. What it means is that the linker has found on its path another version of libssl, older than your headers in /opt/freeware/include. Mike

1 0

Cert Chain Question
by Craig Kelley 18 Feb '10

18 Feb '10

I've been attempting to include an intermediate chain for my stunnel setup. First, I previously used an entrust-signed certificate with stunnel just fine, but now I've purchased one from godaddy ($190 for 3 certs for 5 years!). The only problem is that the server has multiple certificates to install. Under Apache, I solved it with this: SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key SSLCertificateChainFile /etc/httpd/conf/ssl.crt/godaddy.crt Which works just fine. With stunnel I attempted this configuration: cert = /etc/stunnel/server.crt key = /etc/stunnel/server.key CAfile = /etc/stunnel/godaddy.crt All those files are identical to the Apache configuration. Stunnel starts up, but clients loudly complain that the certificate is not valid. If I examine the certificate in Thunderbird (I use stunnel for IMAPS and POP3S), it correctly identifies the cert as being from GoDaddy and that it will expire in 2015. But for some reason, the chain to its root server is broken. What am I doing wrong? -- Craig Kelley http://inconnu.islug.org/~ink finger same server for PGP block

2 2

Small challenge with version 4.26 and a commercial certificate
by editor 17 Feb '10

17 Feb '10

Hi: I decided to spend the money and get a commercial certificate from Thawte. It was not a bad price. I have installed in the Sun host and while it works perfectly for Apache but I can not get the file to work for stunnel. The idea is to allow mobile users to access their mail without annoying certificate warnings. This is what happens: # /usr/local/bin/stunnel & [1] 13704 # Enter PEM pass phrase: 2010.02.14 05:32:46 LOG7[13704:1]: Snagged 64 random bytes from /export/home/kgreene/.rnd 2010.02.14 05:32:46 LOG7[13704:1]: Wrote 1024 new random bytes to /export/home/kgreene/.rnd 2010.02.14 05:32:46 LOG7[13704:1]: RAND_status claims sufficient entropy for the PRNG 2010.02.14 05:32:46 LOG7[13704:1]: PRNG seeded successfully 2010.02.14 05:32:46 LOG7[13704:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2010.02.14 05:32:46 LOG7[13704:1]: Certificate loaded 2010.02.14 05:32:46 LOG7[13704:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2010.02.14 05:32:46 LOG3[13704:1]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2010.02.14 05:32:46 LOG3[13704:1]: error stack: 906A068 : error:0906A068:PEM routines:PEM_do_header:bad password read 2010.02.14 05:32:46 LOG3[13704:1]: SSL_CTX_use_RSAPrivateKey_file: 906406D: error:0906406D:PEM routines:PEM_def_callback:problems getting password [1]+ Exit 1 /usr/local/bin/stunnel # It never pauses to let me enter the PEM pass phase. As in instructed in the man pages, I created the pem file by merging the private key and the certificate from Thawte. This is the version statement: # /usr/local/bin/stunnel -version stunnel 4.26 on sparc-sun-solaris2.9 with OpenSSL 0.9.8l 5 Nov 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------- Any ideas would be great. Thanks. Kevin

3 2

nessus crashes stunnel
by Roger Cruz 12 Feb '10

12 Feb '10

We ran Nessus on a Linux system and found that stunnel crashes when the weak certificate suite is enabled. GDB shows the stack trace below and it appears to be in the SSL library. My search on this mailing list led me to this message that appears to report a similar problem http://mirt.net/pipermail/stunnel-users/2008-January/001830.html Am I to understand that the problem is really with OpenSSL and that's what needs to be upgraded? If so, do we know what version will have the fixed problem? I'm going to post in the OpenSSL forum as well, but I wanted to start here since from our perspective, Stunnel is the one crashing. Thank you Roger Cruz 2010.02.05 12:49:11 LOG7[13524:3086718672]: Cleaning up the signal pipe 2010.02.05 12:49:11 LOG6[13524:3086718672]: Child process 13575 finished with code 0 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb7fa7b90 (LWP 13574)] 0x007b24a7 in krb5_is_referral_realm () from /usr/lib/libkrb5.so.3 (gdb) bt #0 0x007b24a7 in krb5_is_referral_realm () from /usr/lib/libkrb5.so.3 #1 0x0089d338 in kssl_keytab_is_available () from /lib/libssl.so.6 #2 0x008803b1 in ssl3_choose_cipher () from /lib/libssl.so.6 #3 0x0087b2a2 in ssl3_get_client_hello () from /lib/libssl.so.6 #4 0x0087bc85 in ssl3_accept () from /lib/libssl.so.6 #5 0x0089109a in SSL_accept () from /lib/libssl.so.6 #6 0x00884d0d in ssl23_get_client_hello () from /lib/libssl.so.6 #7 0x0088554b in ssl23_accept () from /lib/libssl.so.6 #8 0x0089109a in SSL_accept () from /lib/libssl.so.6 #9 0x003628e2 in ?? () from /usr/sbin/stunnel #10 0x00363acd in ?? () from /usr/sbin/stunnel #11 0x003645ba in ?? () from /usr/sbin/stunnel #12 0x003646a8 in client () from /usr/sbin/stunnel #13 0x0025f45b in start_thread () from /lib/libpthread.so.0 #14 0x00448e5e in clone () from /lib/libc.so.6 (gdb) quit [root@p20xen1 current_hq]# stunnel -version stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

using ECDH with stunnel
by Carl 11 Feb '10

11 Feb '10

Is is possible to use ECDH with stunnel? When using s_server and specifying the cipher I can establish a connection. But when using stunnel and specifing the same cipher, the connection is rejected with "no shared cipher". e.g. openssl s_server -cert server.pem -cipher DHE-RSA-AES256-SHA It appears the difference is that s_server uses "default temp ECDH parameters" while stunnel doesn't have a default nor is there a way to specify the ECDH parameters. >From what I understand the ECDH parameters cannot be included with the certificate, unlike DH parameters. Is my understanding correct? Thanks, Carl

2 2

SSL connection through Proxy server with authentication
by Girish Kolari 09 Feb '10

09 Feb '10

Hi I am trying to create a SSL connection through Proxy server with authentication. my stunnel.conf file ----- part of the conf file connect = <Proxy server IP: Port number> protocol=connect protocolHost=<Destination server:Port number> protocolUsername = useme protocolPassword = test ----- but it fails to establish connection. Log details: ----- part of log generated 2010.02.09 16:07:49 LOG5[14506:2952859648]: Negotiations for connect (client side) started 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> CONNECT <Destination server:Port number> HTTP/1.1 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> Host: 6<Destination server:Port number> 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> Proxy-Authorization: basic dXNlbWU6dGVzdA== 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> 2010.02.09 16:07:49 LOG3[14506:2952859648]: Unexpected socket close (fdgetline) 2010.02.09 16:07:49 LOG5[14506:2952859648]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.02.09 16:07:49 LOG7[14506:2952859648]: Service IDrive finished (0 left) ----- I tried with proxy server without authentication it works great, but not sure why Proxy server with authentication is not working. Is it I am missing some thing or am I doing something wrong? I appreciate all suggestion and help on this. Thanks & Regards Girish Kolari

1 0

Stunnel and multiple endpoints.
by Richard Harvey 08 Feb '10

08 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi guys, I'm new to stunnel and I'm looking for a way to run stunnel on a single port. Then based on the client certificate, proxy that connection (in clear) to a different IP:port. If this something I can do with stunnel or am i barking up the wrong tree so to speak. Any help would be a appreciated guys. Cheers Ric - -- Richard Harvey European Linux Administrator Core Systems Ticketmaster +44 (0)207 9804328 80228 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAktv5ZIACgkQlh7dZJ0PyjcfxQCfWA5PO0d/uDf/Mqq2BrFsu5wf xBYAoKmKW8760P91JR3oeviKwjd/1o/A =o+/U -----END PGP SIGNATURE-----

3 5

Re: [stunnel-users] Memory problems
by Peter Griffin 05 Feb '10

05 Feb '10

A portion of the messages in /var/log/stunnel.log before I disabled logging as I thought it would help: 2010.02.04 22:46:28 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:46:32 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:46:55 LOG3[1615:140132734469904]: getpeerbyname: Transport endpoint is not connected (107) 2010.02.04 22:46:57 LOG3[1615:140132734400272]: SSL_read: Connection reset by peer (104) 2010.02.04 22:47:12 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:47:35 LOG3[1615:140132735235856]: SSL_read: Connection reset by peer (104) 2010.02.04 22:48:08 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:23 LOG3[1615:140132735235856]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:42 LOG3[1615:140132733982480]: transfer() loop executes not transferring any data 2010.02.04 22:48:42 LOG3[1615:140132733982480]: please report the problem to Michal.Trojnara(a)mirt.net 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket open: rd=yes wr=no, ssl open: rd=no wr=yes 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket ready: rd=no wr=no, ssl ready: rd=yes wr=no 2010.02.04 22:48:42 LOG3[1615:140132733982480]: wants: SSL_read rd=no wr=no, SSL_write rd=no wr=yes, SSL_shutdown rd=no wr=no 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket input buffer: 16384 byte(s), ssl input buffer: 0 byte(s) 2010.02.04 22:48:42 LOG3[1615:140132733982480]: check_SSL_pending=0 2010.02.04 22:48:52 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:56 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:01 LOG3[1615:140132734330640]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:03 LOG3[1615:140132734400272]: SSL socket closed on SSL_read with 7294 byte(s) in buffer 2010.02.04 22:49:05 LOG3[1615:140132734469904]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:16 LOG3[1615:140132721108752]: SSL socket closed on SSL_read with 16384 byte(s) in buffer 2010.02.04 22:49:26 LOG3[1615:140132733982480]: SSL socket closed on SSL_read with 16384 byte(s) in buffer 2010.02.04 22:49:28 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:34 LOG3[1615:140132733982480]: getpeerbyname: Transport endpoint is not connected (107) 2010.02.04 22:49:35 LOG3[1615:140132720899856]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:35 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected

1 0

Does stunnel support IPv6, and proxying from IPv4 to IPv6?
by Jeff Schmidt 05 Feb '10

05 Feb '10

Hello, I was wondering, does stunnel have IPv6 support? If so, does such support extend to the point of allowing the 'local' side of the connection (e.g. from a server process, or from a client application) to be made with IPv4, while the 'global' side is IPv6? If so, is it possible to use stunnel in an unencrypting mode (that is, not encrypting the data with SSL, but just using stunnel to proxy traffic between IPv4 and IPv6)? The reason I ask is that I am looking for a solution to allow me to IPv6-enable 'legacy' IPv4 applications. When I started thinking about this problem, I almost immediately remembered using stunnel in the past to SSL-enable IPv4 applications which didn't have built-in SSL support, and it occured to me that there was a lot of similarity between the non-SSL application problem, and the non-IPv6 application problem - that is, it seems like possibly, you could setup a sort of IPv6 tunnel using stunnel (or something similar), where the legacy application makes an local IPv4 connection to the stunnel/proxy software, and the proxy then makes an IPv6 connection, just like stunnel accepts local IPv4 connections (unecrypted) and then creates a second, proxied connection which is encrypted. Does that make any sense? (I hope so). So, can stunnel be used with both IPv4 and IPv6 simultaneously?

1 0

Memory problems
by Peter Griffin 05 Feb '10

05 Feb '10

Hi, I'm using stunnel 4.22 with OpenSSL 0.9.7m - I am using 4.22 because of the xforwarded-for patch and 4.27 is not supported. I am running stunnel in standalone mode on a P4 3.2Ghz with 1Gb of Ram. When I start haproxy & stunnel after a reboot, free memory starts at about 750Mb then slowly degrades to about 45Mb. After 8 more hours or so of operation our site was completely unbrowsable. I checked our firewall for unusual traffic, and there were none. Running top does not indicate any processes which are consuming all that memory and that is what I find weid. Only a reboot frees up the memory. Should I be running stunnel on more Ram? stunnel -v output: [root@lb1 ~]# stunnel -version stunnel 4.22 on x86_64-unknown-linux-gnu with OpenSSL 0.9.7m 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none stunnel.conf: #setuid=stunnel #setgid=proxy #debug = 3 #output = /var/log/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=10.0.1.50:443 connect=10.0.1.50:80 TIMEOUTclose=0 xforwardedfor=yes

1 0

HTTP Connect proxy patch
by Dmitry Gromov 05 Feb '10

05 Feb '10

Hi! It seems like the latest patch to support HTTP Connect proxy is for 4.05 version. Any one knows if it is compatible with the latest version? If not, is there more recent version of the patch? I also wonder why this never made to the code... Seems like a very useful feature. Thanks, Dmitry -- DG NJ

2 4

after 4.31 no more logging to syslog
by Axel Reinhold 05 Feb '10

05 Feb '10

> > with stunnel up to 4.29 i got syslog messages to /var/log/maillog. > > with stunnel 4.30 the startup was broken - some chroot-issues, > > with your patches i could get it running - with 4.31 stunnel is > > working for me but i don't get any syslogging any more - is there > > a way to get the old behaviour again? > > Please test: > ftp://stunnel.mirt.net/stunnel/stunnel-4.32b1.tar.gz > and let us know if it works for you. > > Best regards, > Mike > Dear Mike, looks very good - works for me 100%. Thanks. Cheers Axel

1 0

after 4.31 no more logging to syslog
by Axel Reinhold 04 Feb '10

04 Feb '10

with stunnel up to 4.29 i got syslog messages to /var/log/maillog. with stunnel 4.30 the startup was broken - some chroot-issues, with your patches i could get it running - with 4.31 stunnel is working for me but i don't get any syslogging any more - is there a way to get the old behaviour again? root@bongo opt]# grep stunnel /var/log/maillog Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: stunnel 4.29 on i686-pc-linux-gnu with OpenSSL 0.9.8l 5 Nov 2009 Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Jan 27 21:38:25 bongo stunnel: LOG6[31985:16384]: file ulimit = 1024 (can be changed with 'ulimit -n') Jan 27 21:38:25 bongo stunnel: LOG6[31985:16384]: poll() used - no FD_SETSIZE limit for file descriptors Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: 500 clients allowed Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 9 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 10 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 11 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: imaps bound to 0.0.0.0:993 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 12 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: pop3s bound to 0.0.0.0:995 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 13 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: arcorpop3 bound to 127.0.0.1:3003 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 14 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: bnvhpop3 bound to 127.0.0.1:3004 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 15 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: netidpop3 bound to 127.0.0.1:3005 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 16 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: icybolt bound to 127.0.0.1:3006 Jan 27 21:38:25 bongo stunnel: LOG7[31991:16384]: Created pid file /var/run/stunnel.pid Axel

2 1

Stunnel 4.31 released
by Michal Trojnara 03 Feb '10

03 Feb '10

The ChangeLog entry: Version 4.31, 2010.02.03, urgency: MEDIUM: * New features - Log file reopen on USR1 signal was added. * Bugfixes - Some regression issues introduced in 4.30 were fixed. SHA-1 value for stunnel-4.31.tar.gz: f51fc544a0554f6eee2bfca1fcb8ddcb8386ce32 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

after 4.30 no more working
by Axel Reinhold 03 Feb '10

03 Feb '10

My current compile-install-configure-run environment is broken with 4.30. Up to 4.29 stunnel is working ok for me. 4.30 compiles, installs but when running it (i simply start /opt/ssl/bin/stunnel) the behaviour is completely different. Up to version 4.29 the program simply starts and logs to syslog: root@bongo opt]# /opt/ssl/bin/stunnel root@bongo opt]# grep stunnel /var/log/maillog Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: stunnel 4.29 on i686-pc-linux-gnu with OpenSSL 0.9.8l 5 Nov 2009 Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Jan 27 21:38:25 bongo stunnel: LOG6[31985:16384]: file ulimit = 1024 (can be changed with 'ulimit -n') Jan 27 21:38:25 bongo stunnel: LOG6[31985:16384]: poll() used - no FD_SETSIZE limit for file descriptors Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: 500 clients allowed Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 9 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 10 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 11 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: imaps bound to 0.0.0.0:993 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 12 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: pop3s bound to 0.0.0.0:995 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 13 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: arcorpop3 bound to 127.0.0.1:3003 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 14 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: bnvhpop3 bound to 127.0.0.1:3004 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 15 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: netidpop3 bound to 127.0.0.1:3005 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 16 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: icybolt bound to 127.0.0.1:3006 Jan 27 21:38:25 bongo stunnel: LOG7[31991:16384]: Created pid file /var/run/stunnel.pid With 4.30 i get lots of messages to the console and stunnel does not fork into background - where is the magic to get the old behaviour with 4.30? At the end stunnel reports: daemon: No such file or directory (2) root@bongo opt]# /opt/ssl/bin/stunnel Reading configuration from file /etc/ssl/stunnel/stunnel.conf Snagged 64 random bytes from /root/.rnd Wrote 1024 new random bytes to /root/.rnd RAND_status claims sufficient entropy for the PRNG PRNG seeded successfully Certificate: /etc/ssl/stunnel/freakout.pem Certificate loaded Key file: /etc/ssl/stunnel/freakout.key Private key loaded SSL context initialized for service imaps Certificate: /etc/ssl/stunnel/freakout.pem Certificate loaded Key file: /etc/ssl/stunnel/freakout.key Private key loaded SSL context initialized for service pop3s SSL context initialized for service arcorpop3 SSL context initialized for service bnvhpop3 SSL context initialized for service netidpop3 SSL context initialized for service icybolt Configuration successful No limit detected for the number of clients FD=8 in non-blocking mode FD=9 in non-blocking mode FD=10 in non-blocking mode Option SO_REUSEADDR set on accept socket Service imaps bound to 0.0.0.0:993 Service imaps opened FD=10 FD=11 in non-blocking mode Option SO_REUSEADDR set on accept socket Service pop3s bound to 0.0.0.0:995 Service pop3s opened FD=11 FD=12 in non-blocking mode Option SO_REUSEADDR set on accept socket Service arcorpop3 bound to 127.0.0.1:3003 Service arcorpop3 opened FD=12 FD=13 in non-blocking mode Option SO_REUSEADDR set on accept socket Service bnvhpop3 bound to 127.0.0.1:3004 Service bnvhpop3 opened FD=13 FD=14 in non-blocking mode Option SO_REUSEADDR set on accept socket Service netidpop3 bound to 127.0.0.1:3005 Service netidpop3 opened FD=14 FD=15 in non-blocking mode Option SO_REUSEADDR set on accept socket Service icybolt bound to 127.0.0.1:3006 Service icybolt opened FD=15 Created pid file /var/run/stunnel.pid daemon: No such file or directory (2) removing pid file /var/run/stunnel.pid Axel

3 5

after 4.30 no more working
by Axel Reinhold 01 Feb '10

01 Feb '10

> Axel Reinhold wrote: > > root@bongo opt]# /opt/ssl/bin/stunnel > [cut] > > daemon: No such file or directory (2) > > removing pid file /var/run/stunnel.pid > > That's interesting. I couldn't reproduce it. > > Could you install strace tool and than execute: > strace -f -o /tmp/stunnel.log /opt/ssl/bin/stunnel > , and than send us the output of /tmp/stunnel.log? > > Mike Here's the strace-log.

2 1

Stunnel 4.3 not forwarding to server socket
by Vladimir Stariradev 28 Jan '10

28 Jan '10

Dear Stunnel users, I'm running stunnel on my server which accepts connections from my mobile phone emulator (j2me) like so: midlet app -> port:5555 stunnel -> port:6666 server. My midlet, which can be treated as a java app, uses ssl://127.0.0.1:5555 to connect to stunnel. I can establish a connection between the stunnel and the app because I can get information on the certificate. The problem is that when I send data from the midlet to the server, the server doesn't accept it, nor does it signal that anything has been received even when I have double-checked that the streams are setup. I have pasted my config and log files below. Any suggestions are fully appreciated. Regards, Vladimir version: stunnel 4.30 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 stunnel.conf: cert = SecIM.pem debug = 7 ;output = stunnel.log [SecureIM] accept = 5555 connect = 6666 client = no Log file: 2010.01.28 17:51:09 LOG5[3828:1772]: Reading configuration from file stunnel.conf 2010.01.28 17:51:09 LOG7[3828:1772]: Snagged 64 random bytes from C:/.rnd 2010.01.28 17:51:09 LOG7[3828:1772]: Wrote 0 new random bytes to C:/.rnd 2010.01.28 17:51:09 LOG7[3828:1772]: RAND_status claims sufficient entropy for the PRNG 2010.01.28 17:51:09 LOG7[3828:1772]: PRNG seeded successfully 2010.01.28 17:51:09 LOG7[3828:1772]: Certificate: SecIM.pem 2010.01.28 17:51:09 LOG7[3828:1772]: Certificate loaded 2010.01.28 17:51:09 LOG7[3828:1772]: Key file: SecIM.pem 2010.01.28 17:51:11 LOG7[3828:1772]: Private key loaded 2010.01.28 17:51:11 LOG7[3828:1772]: SSL context initialized for service SecureIM 2010.01.28 17:51:11 LOG5[3828:1772]: Configuration successful 2010.01.28 17:51:11 LOG5[3828:1772]: No limit detected for the number of clients 2010.01.28 17:51:11 LOG7[3828:1772]: FD=168 in non-blocking mode 2010.01.28 17:51:11 LOG7[3828:1772]: Option SO_REUSEADDR set on accept socket 2010.01.28 17:51:11 LOG7[3828:1772]: Service SecureIM bound to 0.0.0.0:5555 2010.01.28 17:51:11 LOG7[3828:1772]: Service SecureIM opened FD=168 2010.01.28 17:51:11 LOG5[3828:1772]: stunnel 4.30 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.28 17:51:11 LOG5[3828:1772]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.28 17:52:13 LOG7[3828:2836]: Service SecureIM accepted FD=212 from 127.0.0.1:56133 2010.01.28 17:52:13 LOG7[3828:2836]: Creating a new thread 2010.01.28 17:52:13 LOG7[3828:2836]: New thread created 2010.01.28 17:52:13 LOG7[3828:3336]: Service SecureIM started 2010.01.28 17:52:13 LOG7[3828:3336]: FD=212 in non-blocking mode 2010.01.28 17:52:13 LOG7[3828:3336]: Option TCP_NODELAY set on local socket 2010.01.28 17:52:13 LOG5[3828:3336]: Service SecureIM accepted connection from 127.0.0.1:56133 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): before/accept initialization 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 read client hello A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write server hello A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write certificate A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write server done A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 flush data 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 read client key exchange A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 read finished A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write change cipher spec A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write finished A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 flush data 2010.01.28 17:52:13 LOG7[3828:3336]: 1 items in the session cache 2010.01.28 17:52:13 LOG7[3828:3336]: 0 client connects (SSL_connect()) 2010.01.28 17:52:13 LOG7[3828:3336]: 0 client connects that finished 2010.01.28 17:52:13 LOG7[3828:3336]: 0 client renegotiations requested 2010.01.28 17:52:13 LOG7[3828:3336]: 1 server connects (SSL_accept()) 2010.01.28 17:52:13 LOG7[3828:3336]: 1 server connects that finished 2010.01.28 17:52:13 LOG7[3828:3336]: 0 server renegotiations requested 2010.01.28 17:52:13 LOG7[3828:3336]: 0 session cache hits 2010.01.28 17:52:13 LOG7[3828:3336]: 0 external session cache hits 2010.01.28 17:52:13 LOG7[3828:3336]: 0 session cache misses 2010.01.28 17:52:13 LOG7[3828:3336]: 0 session cache timeouts 2010.01.28 17:52:13 LOG6[3828:3336]: SSL accepted: new session negotiated 2010.01.28 17:52:13 LOG6[3828:3336]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2010.01.28 17:52:13 LOG7[3828:3336]: FD=424 in non-blocking mode 2010.01.28 17:52:13 LOG6[3828:3336]: connect_blocking: connecting 127.0.0.1:6666 2010.01.28 17:52:13 LOG7[3828:3336]: connect_blocking: s_poll_wait 127.0.0.1:6666: waiting 10 seconds 2010.01.28 17:52:13 LOG5[3828:3336]: connect_blocking: connected 127.0.0.1:6666 2010.01.28 17:52:13 LOG5[3828:3336]: Service SecureIM connected remote server from 127.0.0.1:56134 2010.01.28 17:52:13 LOG7[3828:3336]: Remote FD=424 initialized 2010.01.28 17:52:13 LOG7[3828:3336]: Option TCP_NODELAY set on remote socket 2010.01.28 17:54:02 LOG3[3828:3336]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2010.01.28 17:54:02 LOG5[3828:3336]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.01.28 17:54:02 LOG7[3828:3336]: Service SecureIM finished (0 left)

1 1

Re: [stunnel-users] need to restart stunnel if stunnel starts before network?
by Michal Trojnara 23 Jan '10

23 Jan '10

Zhang Weiwu wrote: > For developer how do you think make stunnel resolving the domain when > establishing connection? Sure. This is already implemented and described in the manual: http://stunnel.mirt.net/static/stunnel.html The option is: delay = yes Mike

1 0

FIPS compilation patch for stunnel 4.30
by Michal Trojnara 21 Jan '10

21 Jan '10

Dear Users, Please find a tiny patch for FIPS mode of stunnel 4.30: ftp://stunnel.mirt.net/stunnel/fips.patch BTW: Please consider making a donation if you appreciate my work on configuration file reloading feature. Use PayPal Donate button on http://stunnel.mirt.net/ Mike

1 0

Stunnel 4.30 released
by Michal Trojnara 21 Jan '10

21 Jan '10

The ChangeLog entry: Version 4.30, 2010.01.21, urgency: LOW/EXPERIMENTAL: * New features - Graceful configuration reload with HUP signal on Unix and with GUI on Windows. This release involves major modifications of the code. I expect some regression issues, so please make sure to test this version well before running it on your production systems. SHA-1 value for stunnel-4.30.tar.gz: 46d21c3ad0e761d697f4de8c258ef999287f13f9 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

need to restart stunnel if stunnel starts before network?
by Zhang Weiwu 20 Jan '10

20 Jan '10

Hello. One reason to opt for stunnel instead of ssh -L to secure a local non-ssl client is, that if user use stunnel, it can work transparently, start working only when a connection is listened, so user do not have to start ssh-L before using the client and do not have to shut it down after using the client. However these days through the use of NetworkManager, the network interfaces are often not brought up when stunnel started as a system service. Instead, the network interfaces are brought up by users, in case of wifi or wan, after user typed password. I found I have to first start network interfaces, and run /etc/init.d/stunnel restart to prepare to run the insecure client. Is there a way to run in stunnel in such a way it does nothing except listening, and can recover from network restart, which happens from time to time for road warriors like me? Thanks in advance. I didn't find answer on FAQ by the way.

2 1

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 20 Jan '10

20 Jan '10

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. _________________________________________________________________ Windows Live: Gör det enklare för dina vänner att se vad du håller på med på Facebook. http://www.microsoft.com/sverige/windows/windowslive/see-it-in-action/socia…

1 0

PKI certs
by Lendl, Daniel 13 Jan '10

13 Jan '10

Will stunnel will work with PKI certs vs self-signed? Dan Lendl 919-257-3062

2 1

Stunnel and RTMPS
by Nimrod Aviram 11 Jan '10

11 Jan '10

Hi, I'm currently trying to use rtmps, with Red5 and Stunnel, and it doesn't work with properly signed certificates: When I use a self-signed test certificate, everything works just fine. But when I use a proper certificate (2048 bits from godaddy.com, if that matters), NetConnection.connect just doesn't work - the server doesn't get a connection. https stil works though, and the browser treats the certificate as valid, so it's probably not a problem with the certificate. I saw some earlier posts on this problem, does anyone have a solution? Any comments are welcome... thanks, Nimrod

2 1

server refuses connection by STARTTLS
by Tsurutani Naoki 10 Jan '10

10 Jan '10

Hi, I want to connect to SMTP server by STARTTLS, from MUA who does not support STARTTLS. However, I cannot connect to the server with recent stunnel. On Windows XP, my stunnel.conf is the following: client=yes debug=notice output=C:\logs\stunnel.log service=stunnel [smtp_server] accept=127.0.0.1:10025 connect=smtp.example.com:587 protocol=smtp stunnel version 4.27 or 4.29 is started as service, by "C:\Network\stunnel\stunnel.exe" -service -install c:\home\turutani\INI\stunnel.conf I cannot connect with OpenSSL distributed via stunnel. Then I changed the OpenSSL DLL, and found that I can connect with OpenSSL older than 0.9.8i, while that newer than 0.9.8j fails. But it works by adding "sslVersion=all" or "sslVersion=SSLv2" to configuration file. I also ran stunnel on FreeBSD, and found the same result about SSL version. Here is a debug level log, with no "sslVersion=" or "sslVersion=SSLv3": 2010.01.08 09:50:06 LOG7[2372:3760]: RAND_status claims sufficient entropy for the PRNG 2010.01.08 09:50:06 LOG7[2372:3760]: PRNG seeded successfully 2010.01.08 09:50:06 LOG7[2372:3760]: SSL context initialized for service smtp_server 2010.01.08 09:50:06 LOG5[2372:3760]: stunnel 4.28 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.08 09:50:06 LOG5[2372:3760]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.08 09:50:06 LOG5[2372:2252]: No limit detected for the number of clients 2010.01.08 09:50:06 LOG7[2372:2252]: FD 236 in non-blocking mode 2010.01.08 09:50:06 LOG7[2372:2252]: SO_REUSEADDR option set on accept socket 2010.01.08 09:50:06 LOG7[2372:2252]: smtp_server bound to 127.0.0.1:10025 2010.01.08 09:50:34 LOG7[2372:2252]: smtp_server accepted FD=244 from 127.0.0.1:1953 2010.01.08 09:50:34 LOG7[2372:2252]: Creating a new thread 2010.01.08 09:50:34 LOG7[2372:2252]: New thread created 2010.01.08 09:50:34 LOG7[2372:1036]: smtp_server started 2010.01.08 09:50:34 LOG7[2372:1036]: FD 244 in non-blocking mode 2010.01.08 09:50:34 LOG5[2372:1036]: smtp_server accepted connection from 127.0.0.1:1953 2010.01.08 09:50:34 LOG7[2372:1036]: FD 268 in non-blocking mode 2010.01.08 09:50:34 LOG6[2372:1036]: connect_blocking: connecting 133.x.y.z:587 2010.01.08 09:50:34 LOG7[2372:1036]: connect_blocking: s_poll_wait 133.x.y.z:587: waiting 10 seconds 2010.01.08 09:50:34 LOG5[2372:1036]: connect_blocking: connected 133.x.y.z:587 2010.01.08 09:50:34 LOG5[2372:1036]: smtp_server connected remote server from 192.168.3.118:1954 2010.01.08 09:50:34 LOG7[2372:1036]: Remote FD=268 initialized 2010.01.08 09:50:34 LOG5[2372:1036]: Negotiations for smtp (client side) started 2010.01.08 09:50:37 LOG7[2372:1036]: <- 220 smtp.example.com ESMTP Postfix 2010.01.08 09:50:37 LOG7[2372:1036]: -> 220 smtp.example.com ESMTP Postfix 2010.01.08 09:50:37 LOG7[2372:1036]: -> EHLO localhost 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-smtp.example.com 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-PIPELINING 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-SIZE 51200000 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-VRFY 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-ETRN 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-STARTTLS 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250 8BITMIME 2010.01.08 09:50:37 LOG7[2372:1036]: -> STARTTLS 2010.01.08 09:50:37 LOG7[2372:1036]: <- 220 Ready to start TLS 2010.01.08 09:50:37 LOG5[2372:1036]: Protocol negotiations succeeded 2010.01.08 09:50:37 LOG7[2372:1036]: SSL state (connect): before/connect initialization 2010.01.08 09:50:37 LOG7[2372:1036]: SSL state (connect): SSLv3 write client hello A 2010.01.08 09:50:40 LOG3[2372:1036]: SSL_connect: Peer suddenly disconnected 2010.01.08 09:50:40 LOG5[2372:1036]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.01.08 09:50:40 LOG7[2372:1036]: smtp_server finished (0 left) with "sslVersion=all", 2010.01.08 09:45:33 LOG7[2664:3880]: RAND_status claims sufficient entropy for the PRNG 2010.01.08 09:45:33 LOG7[2664:3880]: PRNG seeded successfully 2010.01.08 09:45:34 LOG7[2664:3880]: SSL context initialized for service smtp_server 2010.01.08 09:45:34 LOG5[2664:3880]: stunnel 4.28 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.08 09:45:34 LOG5[2664:3880]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.08 09:45:34 LOG5[2664:2408]: No limit detected for the number of clients 2010.01.08 09:45:34 LOG7[2664:2408]: FD 236 in non-blocking mode 2010.01.08 09:45:34 LOG7[2664:2408]: SO_REUSEADDR option set on accept socket 2010.01.08 09:45:34 LOG7[2664:2408]: smtp_server bound to 127.0.0.1:10025 2010.01.08 09:46:05 LOG7[2664:2408]: smtp_server accepted FD=244 from 127.0.0.1:1944 2010.01.08 09:46:05 LOG7[2664:2408]: Creating a new thread 2010.01.08 09:46:05 LOG7[2664:2408]: New thread created 2010.01.08 09:46:05 LOG7[2664:2968]: smtp_server started 2010.01.08 09:46:05 LOG7[2664:2968]: FD 244 in non-blocking mode 2010.01.08 09:46:05 LOG5[2664:2968]: smtp_server accepted connection from 127.0.0.1:1944 2010.01.08 09:46:05 LOG7[2664:2968]: FD 268 in non-blocking mode 2010.01.08 09:46:05 LOG6[2664:2968]: connect_blocking: connecting 133.x.y.z:587 2010.01.08 09:46:05 LOG7[2664:2968]: connect_blocking: s_poll_wait 133.x.y.z:587: waiting 10 seconds 2010.01.08 09:46:05 LOG5[2664:2968]: connect_blocking: connected 133.x.y.z:587 2010.01.08 09:46:05 LOG5[2664:2968]: smtp_server connected remote server from 192.168.3.118:1945 2010.01.08 09:46:05 LOG7[2664:2968]: Remote FD=268 initialized 2010.01.08 09:46:05 LOG5[2664:2968]: Negotiations for smtp (client side) started 2010.01.08 09:46:05 LOG7[2664:2968]: <- 220 smtp.example.com ESMTP Postfix 2010.01.08 09:46:05 LOG7[2664:2968]: -> 220 smtp.example.com ESMTP Postfix 2010.01.08 09:46:05 LOG7[2664:2968]: -> EHLO localhost 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-smtp.example.com 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-PIPELINING 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-SIZE 51200000 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-VRFY 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-ETRN 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-STARTTLS 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250 8BITMIME 2010.01.08 09:46:05 LOG7[2664:2968]: -> STARTTLS 2010.01.08 09:46:05 LOG7[2664:2968]: <- 220 Ready to start TLS 2010.01.08 09:46:05 LOG5[2664:2968]: Protocol negotiations succeeded 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): before/connect initialization 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv2/v3 write client hello A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read server hello A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read server certificate A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read server key exchange A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read server done A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 write client key exchange A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 write change cipher spec A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 write finished A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 flush data 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read finished A 2010.01.08 09:46:05 LOG7[2664:2968]: 1 items in the session cache 2010.01.08 09:46:05 LOG7[2664:2968]: 1 client connects (SSL_connect()) 2010.01.08 09:46:05 LOG7[2664:2968]: 1 client connects that finished 2010.01.08 09:46:05 LOG7[2664:2968]: 0 client renegotiations requested 2010.01.08 09:46:05 LOG7[2664:2968]: 0 server connects (SSL_accept()) 2010.01.08 09:46:05 LOG7[2664:2968]: 0 server connects that finished 2010.01.08 09:46:05 LOG7[2664:2968]: 0 server renegotiations requested 2010.01.08 09:46:05 LOG7[2664:2968]: 0 session cache hits 2010.01.08 09:46:05 LOG7[2664:2968]: 0 external session cache hits 2010.01.08 09:46:05 LOG7[2664:2968]: 0 session cache misses 2010.01.08 09:46:05 LOG7[2664:2968]: 0 session cache timeouts 2010.01.08 09:46:05 LOG6[2664:2968]: SSL connected: new session negotiated 2010.01.08 09:46:05 LOG6[2664:2968]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2010.01.08 09:46:05 LOG7[2664:2968]: SSL socket closed on SSL_read 2010.01.08 09:46:05 LOG7[2664:2968]: Socket write shutdown 2010.01.08 09:46:05 LOG5[2664:2968]: Connection closed: 625 bytes sent to SSL, 286 bytes sent to socket 2010.01.08 09:46:05 LOG7[2664:2968]: smtp_server finished (0 left) 2010.01.08 09:50:06 LOG7[2372:3760]: RAND_status claims sufficient entropy for the PRNG with "sslVersion=SSLv2", 2010.01.08 09:50:50 LOG7[2692:3460]: RAND_status claims sufficient entropy for the PRNG 2010.01.08 09:50:50 LOG7[2692:3460]: PRNG seeded successfully 2010.01.08 09:50:50 LOG7[2692:3460]: SSL context initialized for service smtp_server 2010.01.08 09:50:50 LOG5[2692:3460]: stunnel 4.28 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.08 09:50:50 LOG5[2692:3460]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.08 09:50:50 LOG5[2692:2496]: No limit detected for the number of clients 2010.01.08 09:50:50 LOG7[2692:2496]: FD 236 in non-blocking mode 2010.01.08 09:50:50 LOG7[2692:2496]: SO_REUSEADDR option set on accept socket 2010.01.08 09:50:50 LOG7[2692:2496]: smtp_server bound to 127.0.0.1:10025 2010.01.08 09:51:04 LOG7[2692:2496]: smtp_server accepted FD=244 from 127.0.0.1:1955 2010.01.08 09:51:04 LOG7[2692:2496]: Creating a new thread 2010.01.08 09:51:04 LOG7[2692:2496]: New thread created 2010.01.08 09:51:04 LOG7[2692:2056]: smtp_server started 2010.01.08 09:51:04 LOG7[2692:2056]: FD 244 in non-blocking mode 2010.01.08 09:51:04 LOG5[2692:2056]: smtp_server accepted connection from 127.0.0.1:1955 2010.01.08 09:51:04 LOG7[2692:2056]: FD 268 in non-blocking mode 2010.01.08 09:51:04 LOG6[2692:2056]: connect_blocking: connecting 133.x.y.z:587 2010.01.08 09:51:04 LOG7[2692:2056]: connect_blocking: s_poll_wait 133.x.y.z:587: waiting 10 seconds 2010.01.08 09:51:04 LOG5[2692:2056]: connect_blocking: connected 133.x.y.z:587 2010.01.08 09:51:04 LOG5[2692:2056]: smtp_server connected remote server from 192.168.3.118:1956 2010.01.08 09:51:04 LOG7[2692:2056]: Remote FD=268 initialized 2010.01.08 09:51:04 LOG5[2692:2056]: Negotiations for smtp (client side) started 2010.01.08 09:51:04 LOG7[2692:2056]: <- 220 smtp.example.com ESMTP Postfix 2010.01.08 09:51:04 LOG7[2692:2056]: -> 220 smtp.example.com ESMTP Postfix 2010.01.08 09:51:04 LOG7[2692:2056]: -> EHLO localhost 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-smtp.example.com 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-PIPELINING 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-SIZE 51200000 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-VRFY 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-ETRN 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-STARTTLS 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250 8BITMIME 2010.01.08 09:51:04 LOG7[2692:2056]: -> STARTTLS 2010.01.08 09:51:04 LOG7[2692:2056]: <- 220 Ready to start TLS 2010.01.08 09:51:04 LOG5[2692:2056]: Protocol negotiations succeeded 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): before/connect initialization 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 write client hello A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 read server hello A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 write client master key A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 client start encryption 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 write client finished A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 read server verify A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 read server finished A 2010.01.08 09:51:04 LOG7[2692:2056]: 1 items in the session cache 2010.01.08 09:51:04 LOG7[2692:2056]: 1 client connects (SSL_connect()) 2010.01.08 09:51:04 LOG7[2692:2056]: 1 client connects that finished 2010.01.08 09:51:04 LOG7[2692:2056]: 0 client renegotiations requested 2010.01.08 09:51:04 LOG7[2692:2056]: 0 server connects (SSL_accept()) 2010.01.08 09:51:04 LOG7[2692:2056]: 0 server connects that finished 2010.01.08 09:51:04 LOG7[2692:2056]: 0 server renegotiations requested 2010.01.08 09:51:04 LOG7[2692:2056]: 0 session cache hits 2010.01.08 09:51:04 LOG7[2692:2056]: 0 external session cache hits 2010.01.08 09:51:04 LOG7[2692:2056]: 0 session cache misses 2010.01.08 09:51:04 LOG7[2692:2056]: 0 session cache timeouts 2010.01.08 09:51:04 LOG6[2692:2056]: SSL connected: new session negotiated 2010.01.08 09:51:04 LOG6[2692:2056]: Negotiated ciphers: DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 2010.01.08 09:51:04 LOG7[2692:2056]: SSL closed on SSL_read 2010.01.08 09:51:04 LOG7[2692:2056]: Socket write shutdown 2010.01.08 09:51:04 LOG7[2692:2056]: Socket closed on read 2010.01.08 09:51:04 LOG7[2692:2056]: SSL write shutdown 2010.01.08 09:51:04 LOG5[2692:2056]: Connection closed: 626 bytes sent to SSL, 286 bytes sent to socket 2010.01.08 09:51:04 LOG7[2692:2056]: smtp_server finished (0 left) However, with OpenSSL older than 0.9.8i it can connect without "sslVersion=all" or with "sslVersion=SSLv3", and log tells SSLv3 was used. Why stunnel cannot connect with OpenSSL newer than 0.9.8j ? --- Tsurutani Naoki turutani(a)scphys.kyoto-u.ac.jp

1 0