February 2011 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 10 Dec '20

10 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

patch for using stunnel as client with pkcs11-engine and opensc smartcard
by Märt Laak 29 Jan '12

29 Jan '12

Dear stunnel managers, I would like to inform you that there exist some incompatibility with stunnel and openssl pkcs11-engine with external PIN entry device (like RSA smartcard using opensc) in Linux. We use this config to load openssl engine stunnel.conf: --- engine=dynamic engineCtrl=SO_PATH:/usr/lib/engines/engine_pkcs11.so engineCtrl=ID:pkcs11 engineCtrl=LIST_ADD:1 engineCtrl=LOAD engineCtrl=MODULE_PATH:/usr/lib/opensc-pkcs11.so engineCtrl=INIT --- Problem is, with this setup stunnel does not allow user to enter PIN for the secret key. Instead it tries to get secret key without PIN, 3 times (and then therefore usually blocks card PIN) and retires: ---- Initializing engine 1 Engine 1 initialized PRNG seeded successfully Certificate: mart.pem Certificate loaded Key file: id_01 error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect Wrong PIN: retrying error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect Wrong PIN: retrying error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key ENGINE_load_private_key: 800050A0: error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect ---- I discovered workaround that is valid form version 4.26 till current 4.34, as follows, NULL-ing the ui_data.method property in ctx.c: --- diff -cr stunnel-4.34/src/ctx.c stunnel-4.34-patched/src/ctx.c *** stunnel-4.34/src/ctx.c 2010-09-14 18:08:43.000000000 +0300 --- stunnel-4.34-patched/src/ctx.c 2010-09-28 21:56:36.219081931 +0300 *************** *** 304,309 **** --- 304,310 ---- UI_method_set_reader(ui_method, pin_cb); #else /* USE_WIN32 */ ui_method=UI_OpenSSL(); + ui_data.section = NULL; #endif /* USE_WIN32 */ if(section->engine) for(i=1; i<=3; i++) { --- After that patch private key loads correctly: --- Initializing engine 1 Engine 1 initialized PRNG seeded successfully Certificate: mart.pem Certificate loaded Key file: id_01 private key loaded --- It would be nice if: * somebody investigates more precisely why the OpenSSL PIN entry is not showing with unpached stunnel * include my or better patch for this situation Thank you very much for excellent piece of software! With best regards, Märt Laak

2 2

Re: [stunnel-users] Stunnel on the same machine
by subrata＠indiatimes.com 31 Jul '11

31 Jul '11

The configuration files are : pid = /var/stunnel.pid ;chroot = /var/lib/stunnel setuid = nobody setgid = nobody foreground =yes ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept = 3307 connect = 192.168.1.6:3307 On 192.168.1.6 ---------------------- pid = /var/stunnel.pid setuid =nobody setgid = nobody foreground = yes client = no ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept =3307 connect =3306 connecting like /usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307 Enter password: On entring password the following lines appear : ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 Subrata ----- Original Message ----- From: Brian Hatch <bri(a)stunnel.org> To: subrata(a)indiatimes.com Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST) Subject: Re: [stunnel-users] Stunnel on the same machine Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted: > After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there. What do your stunnel configuration files look like? Other problem: mysql client may decide to use a local domain socket when connecting to localhost, thwarting your attempts to go via Stunnel. You might want to 'strace mysql ...' and look for the connect() lines. -- Brian Hatch Time flies like an Systems and arrow. Fruit flies Security Engineer like a banana. http://www.ifokr.org/bri/ Every message PGP signed -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

Stunnel 4.33 released
by Michal Trojnara 22 Apr '11

22 Apr '11

The ChangeLog entry: Version 4.33, 2010.04.05, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 1.0.0. This library requires to c_rehash CApath/CRLpath directories on upgrade. - Win32 DLLs for zlib 1.2.4. - Experimental support for local mode on WIN32 platform. Try "exec = c:\windows\system32\cmd.exe". * Bugfixes - Inetd mode fixed SHA-1 value for stunnel-4.33.tar.gz: 695c7ef834952cb8ddbc790e10b6e32798fc2767 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

4 6

The verify=3 option in client mode
by Philipp Hartwig 09 Apr '11

09 Apr '11

Hello, I'm using stunnel in client mode to provide an SSL connection for offlineimap[1] which does not support verification of SSL certificates. As I've read stunnel does not compare the name of the server offering the certificate to the server name mentioned in the certificate (in the CN field for example). So if I used the following section in my stunnel.conf client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile = /usr/share/ca-certificates/mozilla/Equifax_Secure_CA.crt verify = 2 stunnel would happily accept any certificate signed by Equifax for an arbitrary website. Is this correct? So I've switched to using the verify=3 option and I just want to make sure I configured it correctly. I'm now using the following section client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile= /home/ph/.certs/imaps.pem verify = 3 imaps.pem is a file containing two certificates, namely the first and the last certificate in the certificate chain of imap.gmail.com, that is the Equifax CA certificate and the server certificate itself. I then use offlineimap to establish an unencrypted connection to 127.0.0.1:4322. My understanding is that stunnel will now exclusively accept the server certificate stored in the imaps.pem file rendering all MITM attacks impossible. I'd be grateful if someone could confirm that this setup makes sense. Is this the way the verify=3 option is supposed to use? First I thought that it should be enough to just provide the server certificate in the imaps.pem file, but then openssl would complain about a self-signed certificate, so I included the CA certificate as well. Regards, Philipp [1] https://github.com/jgoerzen/offlineimap/wiki/

2 3

forcing my untangle server to scan my https traffic
by Bing H Bang 01 Mar '11

01 Mar '11

I'm so close to making this work, I can taste it. I also need some suggestions on how to fix the last hurdle. My setup 10.0.0.10 ip of my webserver 24.159.165.122 static ip of my untangle server (router mode) untangle server port forwards 443 to 10.0.0.10:10443 80 to 10.0.0.10:80 (web server only listens on 443) stunnel config file on the web server [https-terminate] client = no cert = /var/lib/stroot/cypherdog.com.pem accept = 10.0.0.10:10443 connect = 24.159.165.122:80 [https-re-engage] client = yes accept = 10.0.0.10:80 connect = 10.0.0.10:443 What I'm trying to do is accept https traffic, decrypt it, pass it through untangle, then encrypt it back as it gets delivered to the https port of the web server. This setup works in that I can point my browser at the https port of my untangle server and the web pages work properly. What doesn't work is the untangle server shows no scanning activity when I access the web pages. I think the path webserver->untangle->webserver does not trigger the scanning in untangle because the traffic it sees is from an internal ip going to the same internal ip. Is there a way to fix this, anyone?

3 3

Upgrade of evil.patch for version 4.35
by Jeremie Le Hen 22 Feb '11

22 Feb '11

Hi Michal, One of my former coworker and now friend undertook the upgrade of contrib/misc/evil.patch against the latest stunnel version. Would you mine putting this new version on your FTP site please? Thanks a lot. Regards, -- Jeremie Le Hen Humans are born free and equal. But some are more equal than others. Coluche

1 0

Problems SSLifying an "exec" Service without KeepAlive
by Jochen Bern 22 Feb '11

22 Feb '11

Hello everyone, today I tried to set up network access to a service using stunnel 4.35. The underlying service, by default, exits after every request+reply. When running stunnel in daemon mode, this seems to upset things such that subsequent connections hang. I cannot quite pinpoint whether it's a config problem, design (of my setup) problem, or bug, so any help's welcome ... More info: The underlying service accesses a Nagios' livestatus interface > http://mathias-kettner.de/checkmk_livestatus.html#H1:Remote%20access%20to%2… using the "unixcat" tool provided. Unless you specifically request connection keepalives, unixcat will close/exit after answering one request, *or* timing out waiting for one. That "exit procedure", AFAICT, isn't different from what the imapd or pppd in the stunnel(8) manpage's EXAMPLES section do ... I need to secure access to the service, so I'm throwing client cert verification and libwrap at the connections. The current daemon mode configuration (with several commented-out attempts) reads, slightly anonymized: client=no verify=3 pid=/var/run/stunnel/livestatus.pid #setuid=stunnel #socket = a:SO_REUSEADDR=0 #foreground= yes [livestatus] accept = [...PORT...] cert = [...SERVER...].pem key = [...SERVER...].key CAfile = [...CA...].pem CApath = [...TempStagingDirectory...] exec = /usr/local/bin/unixcat execargs = unixcat /var/lib/nagios3/rw/live pty = yes retry = no session = 3 #TIMEOUTclose = 0 #TIMEOUTbusy = 5 #TIMEOUTidle = 5 After starting the stunnel daemon, I can perform *one* normal connection: > # openssl s_client -CAfile [...CA...].pem -showcerts \ > > -connect [...SERVER...]:[...PORT...] -cert [...CLIENT...].cert \ > > -key [...CLIENT...].key -state > CONNECTED(00000003) > SSL_connect:before/connect initialization > SSL_connect:SSLv2/v3 write client hello A > SSL_connect:SSLv3 read server hello A [...] > SSL handshake has read 1743 bytes and written 1933 bytes > --- > New, TLSv1/SSLv3, Cipher is AES256-SHA > Server public key is 1024 bit > Compression: NONE > Expansion: NONE > SSL-Session: > Protocol : TLSv1 > Cipher : AES256-SHA > Session-ID: 1B4221E2917E3BD49AA2102C2CCE60A624DB256D6B4D61F9D0D77EA843DC31BC > Session-ID-ctx: > Master-Key: 57E6DF8E7E0A741B718E356467450DD00969465295A9C6FE03416ED16E74AF93058EC168EF6DF1B9F3F637F505FF6EF4 > Key-Arg : None > Start Time: 1298390481 > Timeout : 300 (sec) > Verify return code: 0 (ok) > --- At that point, I can type in one request, then unixcat terminates, stunnel closes the connection and s_client (?) reports: > read:errno=104 Typical log output on the server side: > LOG5[30042:139819109037792]: Reading configuration from file /etc/stunnel/livestatus.conf > LOG5[30042:139819109037792]: Peer certificate location [...TempStagingDirectory...] > LOG5[30042:139819109037792]: Configuration successful > LOG5[30042:139819109037792]: No limit detected for the number of clients > LOG5[30043:139819109037792]: stunnel 4.35 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 > LOG5[30043:139819109037792]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 [...] > LOG5[30043:1075198288]: Service livestatus accepted connection from [...CLIENT...]:39287 > LOG5[30043:1075198288]: Certificate accepted: depth=1, [...CA...] > LOG5[30043:1075198288]: Certificate accepted: depth=0, [...CLIENT...] > LOG3[30043:1075198288]: readsocket: Input/output error (5) > LOG5[30043:1075198288]: Connection reset: 2293 bytes sent to SSL, 33 bytes sent to socket Rerunning the exact same command stops dead after the > CONNECTED(00000003) and manually "telnet"ing to the port from a different host doesn't behave in a normal way (closing the connection after I type the first line of non-SSL stuff) anymore, either. Running the unixcat command from a local command line, however, still works normally. I tried running stunnel off inetd, which seems to work, so I'd guess it's the server-side SSL session cacheing which interferes. However, I don't see any related stunnel config keywords in the manpage, and stunnel offering a cached session to a connection *from a different client host* sound odd to me, too ... ? Kind regards, J. Bern -- Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

1 0

New and Utterly Confused on Ubuntu Linux
by Traps 20 Feb '11

20 Feb '11

I am totally new to stunnel and am quite confused. I use Ubuntu 10.04 and have installed the stunnel4 deb package. I need to do a couple of things. At boot up I need to accept ssl connections on an inbound port and forward it to a non-ssl compliant app listening on another port. The second thing I need to do is make an ssl required connection to a pop server on another host out of a non-ssl mail client on the local machine. I have no problem with the ports, port forwarding, etc. I just do not know how to set up stunnel to accomplish this. Let's just use this as an example: 1. I need to accept inbound ssl connections on 995 (port 995 is open) and send them to the local machine non-ssl client listening on 2995. 2. I need to ssl connect to pop.gmail.com:995 via a non-ssl mail client on the local machine and I want the mail client to connect to stunnel on port 3995. 3. I need both of these scenarios to start at boot up. I don't even know where to start with stunnel4 to do this. Actually I can set up stunnel.conf for either but one's a server operation and the other is a client operation and can't get them both to work simultaneously. To start stunnel at boot up I simply edited /etc/default/stunnel and /etc/init.d/stunnel4 and changed ENABLED=0 to ENABLED=1 in both files. Something tells me this is entirely the wrong way to do what I want to do. It works for either the client task or the server task, depending on which one I have enabled in stunnel.conf but I just know this is not how I am suppose to be doing it. Will someone help? -- View this message in context: http://old.nabble.com/New-and-Utterly-Confused-on-Ubuntu-Linux-tp30970693p3… Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 1

fips=no
by dominic.schweizer＠zkb.ch 18 Feb '11

18 Feb '11

Hi All, I have the problem that when I start Stunnel, the following error pops up: FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match I now added in my config file: fips=no and it works. My question is now, what is the difference between with fips and without fips? stunnel version 4.34 openssl 0.9.8 redhat 5 Thanks in advance for the answer Regards Dominic Freundliche Grüsse Dominic Schweizer Zürcher Kantonalbank Unix System Engineer, LIOEU Neue Hard 9, 8005 Zürich Telefon 044 292 83 52, Fax 044 292 80 34 Briefadresse: Postfach 8010 Zürich, http://www.zkb.ch Sie drucken dieses E-Mail nicht aus? Die Umwelt dankt! ___________________________________________________________________ Disclaimer : Diese Mitteilung ist nur fuer die Empfaengerin / den Empfaenger bestimmt. Fuer den Fall, dass sie von nichtberechtigten Personen empfangen wird, bitten wir diese hoeflich, die Mitteilung an die ZKB zurueckzusenden und anschliessend die Mitteilung mit allen Anhaengen sowie allfaellige Kopien zu vernichten bzw. zu loeschen. Der Gebrauch der Information ist verboten. This message is intended only for the named recipient and may contain confidential or privileged information. If you have received it in error, please advise the sender by return e-mail and delete this message and any attachments. Any unauthorised use or dissemination of this information is strictly prohibited.

2 1