March 2008 - stunnel-users

unknown protocol error (140770FC) with xinetd
by Ian Pilcher 10 Mar '08

10 Mar '08

I am trying to set up rsync over SSL with stunnel. I've got things working when I run stunnel standalone on both systems, but I have been unable to get things working when I run stunnel via xinetd on the server (haven't tried using xinet on the client yet). Here is the (standalone) server configuration that works: cert = /etc/stunnel/rsyncs_cert.pem key = /etc/stunnel/private/rsyncs_key.pem client = no pid = /var/run/stunnel.pid RNDfile = /var/run/stunnel/random_seed foreground = yes debug = debug ;output = /var/run/stunnel/stunnel.log [rsyncs] accept = 2873 exec = /usr/bin/rsync execargs = rsync --daemon Here is the (non-working) server-side xinetd configuration: # default: off # description: rsync tunneled over SSL (stunnel) service rsyncs { disable = no flags = IPv4 socket_type = stream wait = no user = root server = /usr/sbin/stunnel } ... and the (non-working) server-side stunnel configuration: cert = /etc/stunnel/rsyncs_cert.pem key = /etc/stunnel/private/rsyncs_key.pem client = no pid = /var/run/stunnel.pid RNDfile = /var/run/stunnel/random_seed foreground = yes debug = debug output = /var/run/stunnel/stunnel.log exec = /usr/bin/rsync execargs = rsync --daemon Trying to connect to the non-working configuration with openssl s_client, I get: CONNECTED(00000003) write to 0x9b9e938 [0x9b9f068] (133 bytes => 133 (0x85)) 0000 - 80 83 01 03 01 00 5a 00-00 00 20 00 00 39 00 00 ......Z... ..9.. 0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............ 0020 - 00 00 33 00 00 32 00 00-2f 03 00 80 00 00 66 00 ..3..2../.....f. 0030 - 00 05 00 00 04 01 00 80-00 00 63 00 00 62 00 00 ..........c..b.. 0040 - 15 00 00 12 00 00 09 06-00 40 00 00 65 00 00 64 [email protected] 0050 - 00 00 14 00 00 11 00 00-08 00 00 06 04 00 80 00 ................ 0060 - 00 03 02 00 80 3e b4 89-34 c1 e6 93 97 2d 8d ca .....>..4....-.. 0070 - 90 e1 4c 51 e1 71 c7 54-ed 52 0c 6e 2e 47 90 9b ..LQ.q.T.R.n.G.. 0080 - 8e c6 73 3d d8 ..s=. read from 0x9b9e938 [0x9ba45c8] (7 bytes => 7 (0x7)) 0000 - 32 30 30 38 2e 30 33 2008.03 18523:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:567: The server log shows: 2008.03.10 11:32:23 LOG5[18563:3086215456]: stunnel 4.20 on i386-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2008.03.10 11:32:23 LOG5[18563:3086215456]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.03.10 11:32:23 LOG7[18563:3086215456]: stunnel started 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 0 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 1 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 4 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 5 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: Connection from 127.0.0.1:38481 permitted by libwrap 2008.03.10 11:32:23 LOG5[18563:3086215456]: stunnel accepted connection from 127.0.0.1:38481 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): before/accept initialization 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 read client hello A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write server hello A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write certificate A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write server done A 2008.03.10 11:32:23 LOG3[18563:3086215456]: SSL_accept: Peer suddenly disconnected 2008.03.10 11:32:23 LOG5[18563:3086215456]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.03.10 11:32:23 LOG7[18563:3086215456]: stunnel finished (0 left) Anyone have any ideas? Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

1 0

Windows FIPS compile
by Joe Kemp 10 Mar '08

10 Mar '08

I am trying to get stunnel to compile against a fips openssl. I read in install.fips that it is not yet supported. Is anyone currently working on this? If so I would love to join forces or any info on the specific issues would help get me started. Thanks. -Joe

2 2

help
by Paque Alexandre 10 Mar '08

10 Mar '08

Hi, I am writing you because I haven’t found solution on the web. In order to secure a connection between servers (1 client and 1 server stunnel), I chose the stunnel tool. However, I have an issue when I unplugged the network cable. If I unplug the network cable on the remote side, Stunnel will detect the cutting only on the local side. In fact, I would like to configure stunnel client in order to detect the unplugged network cable on server side. I tried many configurations but without success: socket = l:TCP_NODELAY=1 socket = l:SO_LINGER=1:1 socket = l:SO_KEEPALIVE=1 socket = l:SO_REUSEADDR=1 socket = r:TCP_NODELAY=1 socket = r:SO_LINGER=1:1 socket = r:SO_KEEPALIVE=1 socket = r:SO_REUSEADDR=1 Could you help me? Thanks you in advance, Alex _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

ssl mutual authentication
by Simon Santoro 09 Mar '08

09 Mar '08

Hello all. I am sure I am missing something really obvious here, but I can't get this to work. HTTP client (localhost) -> stunnel (localhost) -> HTTPS server (remote host) I'd like to user stunnel as proxy for my HTTP requests that go to a HTTPS server (apache if that makes any difference) on a remote host (fresh) that uses a cert to authenticate the request. I wrote this little ruby script[2] to test the request, and it works, so i am sure that on the server/client/cert end there is no problem. Now I'd like to use a simple wget or w3m to get the file from the remote server trough stunnel, but I keep getting SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed The only difference between the ruby script and the stunnel setup is that in the ruby script i have two different files for the crt and the key, and with stunnel I joined those files together with cat s2(a)magnesium.key s2(a)magnesium.crt >s2(a)magnesium.pam on localhost i run: $ stunnel -r fresh:443 -d localhost:11443 -c -f -D 7 -c -S 0 -p certs/s2(a)magnesium.pem -a certs/ -A certs/freshCA.crt -v 3 -P none 2008.03.09 21:21:38 LOG5[9026:3082811056]: Using 'fresh.443' as tcpwrapper service name 2008.03.09 21:21:38 LOG7[9026:3082811056]: RAND_status claims sufficient entropy for the PRNG 2008.03.09 21:21:38 LOG6[9026:3082811056]: PRNG seeded successfully 2008.03.09 21:21:38 LOG7[9026:3082811056]: Certificate: certs/s2(a)magnesium.pem Enter PEM pass phrase: 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_defaults is 0 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_dir is certs/ 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_file is certs/freshCA.crt 2008.03.09 21:21:40 LOG7[9026:3082811056]: Loaded verify certificates from certs/freshCA.crt 2008.03.09 21:21:40 LOG7[9026:3082811056]: Set verify directory to certs/ 2008.03.09 21:21:40 LOG5[9026:3082811056]: Peer certificate location certs/ 2008.03.09 21:21:40 LOG5[9026:3082811056]: stunnel 3.26 on i486-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.8e 23 Feb 2007 2008.03.09 21:21:40 LOG7[9026:3082811056]: No pid file being created 2008.03.09 21:21:40 LOG5[9026:3082811056]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2008.03.09 21:21:40 LOG7[9026:3082811056]: SO_REUSEADDR option set on accept socket 2008.03.09 21:21:40 LOG7[9026:3082811056]: fresh.443 bound to 127.0.0.1:11443 then, I try to connect to localhost:11443 with w3m, in the hope that my HTTP request is encrypted and send to fresh:443, and stunnel should check if the PEER certificate is correct, but all I get is: 2008.03.09 21:26:44 LOG7[9214:3082585776]: fresh.443 accepted FD=6 from 127.0.0.1:43888 2008.03.09 21:26:44 LOG7[9214:3082423184]: fresh.443 started 2008.03.09 21:26:44 LOG5[9214:3082423184]: fresh.443 connected from 127.0.0.1:43888 2008.03.09 21:26:44 LOG7[9214:3082423184]: fresh.443 connecting 192.168.0.2:443 2008.03.09 21:26:44 LOG7[9214:3082423184]: Remote FD=7 initialized 2008.03.09 21:26:44 LOG7[9214:3082423184]: Relying on OpenSSL RSA Blinding. 2008.03.09 21:26:44 LOG7[9214:3082423184]: SSL state (connect): before/connect initialization 2008.03.09 21:26:44 LOG7[9214:3082423184]: SSL state (connect): SSLv3 write client hello A 2008.03.09 21:26:45 LOG7[9214:3082423184]: SSL state (connect): SSLv3 read server hello A 2008.03.09 21:26:45 LOG5[9214:3082423184]: VERIFY OK: depth=1, /C=IT/O=S2 corp./CN=S2/emailAddress=s2@fresh 2008.03.09 21:26:45 LOG4[9214:3082423184]: VERIFY ERROR ONLY MY: no cert for /C=IT/O=S2 corp./CN=fresh 2008.03.09 21:26:45 LOG7[9214:3082423184]: SSL alert (write): fatal: certificate unknown 2008.03.09 21:26:45 LOG3[9214:3082423184]: SSL_connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2008.03.09 21:26:45 LOG7[9214:3082423184]: fresh.443 finished (0 left) Did I something wrong? What am I missing? Please help me, it would save me really a lot of work on the client side if I could get this going. Thanks! Simon [1] ---------------------------------------------------- #!/usr/bin/ruby SERVER_CERT_FILE = "certs/freshCA.crt" CERT_FILE = "certs/s2(a)magnesium.crt" CERT_FILE_KEY = "certs/s2(a)magnesium.key" require 'net/https' https = Net::HTTP.new('fresh', 443) https.use_ssl = true #client certificates https.cert = OpenSSL::X509::Certificate.new( File.read(CERT_FILE) ) https.key = OpenSSL::PKey::RSA.new( File.read(CERT_FILE_KEY), 'panza') #server certificate https.ca_file = SERVER_CERT_FILE https.verify_mode = OpenSSL::SSL::VERIFY_PEER #VERIFY_NONE https.read_timeout = 120 https.start do |https| request = Net::HTTP::Get.new('/notes/test_auth') # request.basic_auth 's', 'x' response = https.request(request) response.value puts response.body end ----------------------------------------------------

1 1

Connection Problem on Vista
by Earl Stenlund 07 Mar '08

07 Mar '08

I setup stunnel this afternoon to work with Newshosting. It was working fine but now I cannot connect using my desktop running Vista. I receive this message: SSL_connect: 14094406: error:14094406:SSL routines:SSL3_READ_BYTES:sslv3 alert decompression failure Stunnel connects fine on my laptop which is also running Vista. Help, Earl Stenlund

1 0

Username authentication
by Joe Kemp 07 Mar '08

07 Mar '08

I want to try to use stunnel as a "simple" client vpn. It solves all of my encryption issues but I would like to verify a username/password before it lets the traffic through. I didn't see any patches or hacks out there that did this. Has this been attempted before or am I on my own. I would also be interested in other solutions based on openssl that are not network device level VPNs clients. Already using client side certificates and I know that is the normal SSL authentication mechanism.... Thanks. -Joe

2 2

Send delay?
by Colin E 04 Mar '08

04 Mar '08

Please can you help a hardware engineer, who almost understands what he's doing. I'm using sTunnel 4.21 on a Windows 2000 machine, to provide a TCP program with SSL. This works very well. However the application is very time critical and must finish sending block of XML as quickly as possible. I suspect there is a delay in either sTunnel or openSSL, while it waits to see if there are any more characters before sending a packet. Is this correct? If it is, is there a work round. -- View this message in context: http://www.nabble.com/Send-delay--tp15826043p15826043.html Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 4

Newbie
by Rod Bodden 03 Mar '08

03 Mar '08

Hello to all! I'm trying to set up Stunnel for the first time. I hope to use it with HFS. I followed directions found on HFS website and ran into a problem creating a pem file. Could someone direct me to information about installing Stunnel? Or help me directly by sharing with me how to install Stunnel? I sincerely appreciate your help!!! Rod

1 0