May 2010 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 10 Dec '20

10 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Re: [stunnel-users] Stunnel on the same machine
by subrata＠indiatimes.com 31 Jul '11

31 Jul '11

The configuration files are : pid = /var/stunnel.pid ;chroot = /var/lib/stunnel setuid = nobody setgid = nobody foreground =yes ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept = 3307 connect = 192.168.1.6:3307 On 192.168.1.6 ---------------------- pid = /var/stunnel.pid setuid =nobody setgid = nobody foreground = yes client = no ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept =3307 connect =3306 connecting like /usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307 Enter password: On entring password the following lines appear : ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 Subrata ----- Original Message ----- From: Brian Hatch <bri(a)stunnel.org> To: subrata(a)indiatimes.com Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST) Subject: Re: [stunnel-users] Stunnel on the same machine Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted: > After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there. What do your stunnel configuration files look like? Other problem: mysql client may decide to use a local domain socket when connecting to localhost, thwarting your attempts to go via Stunnel. You might want to 'strace mysql ...' and look for the connect() lines. -- Brian Hatch Time flies like an Systems and arrow. Fruit flies Security Engineer like a banana. http://www.ifokr.org/bri/ Every message PGP signed -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

Stunnel 4.33 released
by Michal Trojnara 22 Apr '11

22 Apr '11

The ChangeLog entry: Version 4.33, 2010.04.05, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 1.0.0. This library requires to c_rehash CApath/CRLpath directories on upgrade. - Win32 DLLs for zlib 1.2.4. - Experimental support for local mode on WIN32 platform. Try "exec = c:\windows\system32\cmd.exe". * Bugfixes - Inetd mode fixed SHA-1 value for stunnel-4.33.tar.gz: 695c7ef834952cb8ddbc790e10b6e32798fc2767 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

4 6

"choose a digital certificate" pop-up in IE
by KumpelJ 21 Jun '10

21 Jun '10

Hello I have browsed the archives but have not found the answer to this question... I have stunnel set up to handle https connections. It sits on a Debian server alongside HAProxy and works fine with every browser except for Internet Explorer. When I connect with Internet Explorer, I get a blank "Please choose a digital certificate" pop-up. How do we turn off the request for the client certificate in IE? Here are my details....thanks in advance. #vi /etc/stunnel/stunnel.conf verify=0 CAfile=/etc/ssl/certs/chain.pem cert=/etc/ssl/certs/multidomain.pem CApath=/etc/ssl/certs/ pid = /etc/stunnel/stunnel.pid debug = 3 output = /etc/stunnel/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 client=no [https] accept=192.168.11.32:443 connect=localhost:444 TIMEOUTclose=0 xforwardedfor=yes #usr/local/bin/stunnel -version stunnel 4.32 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- View this message in context: http://old.nabble.com/%22choose-a-digital-certificate%22-pop-up-in-IE-tp286… Sent from the Stunnel - Users mailing list archive at Nabble.com.

4 8

stunnel 4.33 stops (crashes?) after undetermined running time
by Markus Borst 07 Jun '10

07 Jun '10

Hi, I have a strange problem with current stunnel (4.33): It just crashes after some time. The time is variable, I suspect it stops after a number of connections. System: - Windows Server 2003 SP2 (also happens on Windows Server 2008R2) - stunnel runs as service - stunnel is configured to run as ssl server for imap and pop3 with our certificate (including key-chain) stunnel was running fine for years on the Windows Server 2003. After upgrade to stunnel 4.33, the stunnel service process first worked fine, the just stopped working after some time: - The windows service "stunnel" was stopped - the stunnel.log (standard debug level) showed not error or other entry at the time of the stop. - The windows eventlog shows: ====== Event 7034, Service Control Manager The stunnel service terminated unexpectedly. It has done this 1 time(s). ====== (I'm not 100% sure, whether this event log message corresponds to the stunnel crash I described or to another crash.) I have downgrade to version 4.32, the stunnel service now runs uninterrupted as before. Since the time of crash varies somewhat, seemingly with the current load of the server, I suspect that stunnel crashes after a certain amount of ssl connections, but I'm not sure. This has happened on two different servers (Windows Server 2003 SP2 and Windows Server 2008 R2). Is this a known problem? I'd love to do some further tests, but since this is a production system, I cannot test it in our normal environment. A program to generate random ssl connections would come handy to further analyze the problem. Greetings Markus Borst -- TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst Adresse: Petersentrasse 30, 64287 Darmstadt, Germany Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

2 2

Three patches: DNS CommonName verification support, separated stderr/foreground options, and support for minimal ssl libs
by Tristan Schmelcher 07 Jun '10

07 Jun '10

Hello, Recently I started using stunnel in an embedded Linux product and I had need to add several features that I think other users would benefit from. I have attached them as separate patches against 4.33. I hereby release them into the public domain. Here is a description of each: stunnel-4.33-handle-minimal-ssl-libs.patch: Add support for building against a libssl/libcrypo that has had various non-essential features removed via the "no-<feature>" Configure options for openssl. This requires disabling non-essential Stunnel features at compile-time if they have dependencies on disabled libssl/libcrypto features. For memory-constrained embedded systems, this is a big win. With this patch I was able to cut the memory footprint of stunnel+openssl by about a third simply by disabling openssl features that I didn't need. stunnel-4.33-separate-stderr-option.patch This splits the stderr logging effect of the "foreground" option into a separate option named "stderr", so that users have the freedom to enable foreground without stderr logging, or vice versa. For backwards compatibility though, specifying foreground = yes implies stderr = yes unless followed in the config by stderr = no. This is useful on embedded Linux systems that lack an implementation of fork() (due to the processor not having an MMU), because on such systems every daemon has to be launched in a foreground mode and pre-daemonized with the simpler vfork() function, e.g. using "&" from a shell. In this mode, logging to stderr does not make sense, because in reality the process is still a daemon so the logging clutters the terminal. stunnel-4.33-dns-commonname-verify-support.patch: I saved the best for last. ;) This adds a "verify_dns" option to check the CommonName in peer certificates against their DNS name when verifying, much as web browsers do. I have seen posts from users asking for this feature in the past, so I think it's value is self-evident. I'd also like to take this opportunity to say that I'm a long-time user of Stunnel on my personal Linux desktop machine and it is a really excellent piece of software. Thank you for making it free and open source.

3 8

Default for TIMEOUTidle?
by Markus Borst 27 May '10

27 May '10

I want to modify TIMEOUTidle in our configuration. To be sure to set it to sensible values, I need to know the default value, but I can't find it in the docs. Greetings Markus Borst -- TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst Adresse: Petersentrasse 30, 64287 Darmstadt, Germany Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

1 0

Transparent mode, alternative env.c
by Hans Werner Strube 25 May '10

25 May '10

The method for passing the remote address and port to an exec'ed program through getenv() calls in the preloaded libstunnel.so fails for programs that clean the environment initially. This can be circumvented placing getenv() in an _init() function and storing the results in static variables. Here is my alternative env.c (without the copyright and license), which I have been using for more than a year: * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * /* getpeername() can't be declared in the following includes */ #define getpeername no_getpeername #include <sys/types.h> #include <sys/socket.h> /* for AF_INET */ #include <netinet/in.h> #include <arpa/inet.h> /* for inet_addr() */ #include <stdlib.h> /* for getenv() */ #ifdef __BEOS__ #include <be/bone/arpa/inet.h> /* for AF_INET */ #include <be/bone/sys/socket.h> /* for AF_INET */ #else #include <sys/socket.h> /* for AF_INET */ #endif #undef getpeername static uint32_t rem_host=0; static uint16_t rem_port=0; /* Requires shared-library linking by ld, not cc (except with gcc -nostdlib) */ void _init() { char *value; if((value=getenv("REMOTE_HOST")) && *value != '\0') rem_host = inet_addr(value); if((value=getenv("REMOTE_PORT")) && *value != '\0') rem_port = htons(atoi(value)); } int getpeername(int s, struct sockaddr_in *name, int *len) { char *value; name->sin_family = AF_INET; name->sin_addr.s_addr = rem_host; name->sin_port = rem_port; return 0; } /* End of env.c */

1 0

STRLEN in common.h may be too small
by Hans Werner Strube 25 May '10

25 May '10

In common.h of stunnel-4.x, the parameter STRLEN (used for many buffers) is set to 256. This is insufficient in some cases, e.g., the CAPABILITY response of an IMAP server or the pathname of a file may be too long, resulting in errors. If you encounter such cases (e.g., messages "Input line too long"), increase STRLEN, e.g., to 512.

1 0

Using stunnel to RDP into a SSL-enabled Windows box
by Daren Krive 11 May '10

11 May '10

Hi everyone, First of all I apologize if this has been asked before or if I am totally misunderstanding the purpose of stunnel altogether. If so please bear with my ignorance. I am an IT consultant and I manage about 20+ Windows-based servers. Some of these servers are accessible via VPN while others are accessible directly via RDP over the Internet. For those that are exposed to the net I am using the SSL certificate feature of Remote Desktop by going into “Terminal Services Configuration” and configuring the connection to use an SSL (most of the time a self-signed cert). I can connect to these machines no problem from Windows and I get a “lock” icon in my RDP client. However I cannot connect to these machines using rdestkop under Ubuntu. I have determined that if I turn off the requirement to use SSL on the server side (and instead allow the connection to use the built-in encryption of RDP) then I am able to connect with rdesktop. I would very much like to avoid rebooting just to connect to these servers. I am also not willing to remove the requirement for the SSL connection. Is there a way I can use stunnel on my Ubuntu box to first establish a secure SSL connection and then use rdesktop over that connection? I have searched high and low for info on this and found nothing. I have found instructions on how to use the Windows version of stunnel to secure RDP but that isn’t what I am trying to do. The server is already using an SSL cert to encrypt the connection (not sure how many people know Windows 2003 and up can do this). I am looking to get around the apparent lack of SSL support in rdesktop. Best regards, Daren.

3 3