August 2011 - stunnel-users

Stunnel and CryptoAPI
by ratmahat＠hush.ai 15 Aug '11

15 Aug '11

Hello everyone! I have an interesting question, which i didn't find any answer to after several searches. 1. What if I want to enable client verification with client certificate provided by smart card? Is it possible? 2. Does stunnel has the capability to access Windows certificate store in order to verificate the client certificate with the CA in the store? If anyone ever dealt with this, I'd really appreciate this. Thanks, Rat.

1 0

Odd stunnel problem
by Tristan Schmelcher 09 Aug '11

09 Aug '11

My company uses stunnel on a telecom product and we have run into a strange problem. One of our customers sees an issue every couple weeks where the stunnel process becomes busted. Attempts to establish a connection through stunnel to any host hang indefinitely. Interface stats indicate that stunnel sends and receives a flurry of packets--as if a TLS connection was successfully established--but the local plaintext socket connection to stunnel never passes data. For example, if attempting to run telnet over stunnel, the telnet client just sits there and doesn't write anything to the terminal. During this time the network is otherwise functioning fine. Unfortunately nothing is logged by stunnel when this happens and we haven't been able to reproduce the problem in a controlled environment. Does anyone have any ideas what might be happening? We currently use stunnel 4.35 with debug = warning, sslVersion = TLSv1, and verify = 2.

2 2

stunnel for android
by dddfr 09 Aug '11

09 Aug '11

Hi, I want to use stunnel server in Android Phone ,I don't know how to use it,can you tell me? Thanks! 2011-08-10 dddfr

1 0

doubts with stunnel.conf
by Gabriel Monnerat 09 Aug '11

09 Aug '11

Hello, I am noob in stunnel and I trying configure my environment but I have one problem. My stunnel.conf is: foreground = yes output = /srv/slapgrid/slappart1/var/log/stunnel.log pid = /srv/slapgrid/slappart1/var/run/stunnel.pid syslog = no debug = 7 foreground = yes delay = yes client = yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 key = /srv/slapgrid/slappart1/srv/ca/private/mykey.key cert = /srv/slapgrid/slappart1/srv/ca/certs/mycert.crt [varnish_SOFTINST-51] accept = 10.0.235.44:26012 connect = [2a01:e34:ec03:*:*:*:*:*]:15000 In the stunnel compilation the option "--enable-ipv6" was used. And ipv6 address is one zope server to connect using https I have this traceback: 2011.08.09 00:19:51 LOG7[12724:140272018274048]: local socket: FD=7 allocated (non-blocking mode) 2011.08.09 00:19:51 LOG7[12724:140272018274048]: Service varnish_SOFTINST-51 accepted FD=7 from 10.0.235.44:39673 2011.08.09 00:19:51 LOG7[12724:140272018409232]: Service varnish_SOFTINST-51 started 2011.08.09 00:19:51 LOG7[12724:140272018409232]: Option TCP_NODELAY set on local socket 2011.08.09 00:19:51 LOG5[12724:140272018409232]: Service varnish_SOFTINST-51 accepted connection from 10.0.235.44:39673 2011.08.09 00:19:59 LOG3[12724:140272018409232]: Error resolving '[2a01:e34:ec03:*:*:*:*:*]': Neither nodename nor servname known (EAI_NONAME) 2011.08.09 00:19:59 LOG3[12724:140272018409232]: No host resolved 2011.08.09 00:19:59 LOG5[12724:140272018409232]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.08.09 00:19:59 LOG7[12724:140272018409232]: Service varnish_SOFTINST-51 finished (0 left) 2011.08.09 00:19:59 LOG7[12724:140272018409232]: str_stats: 0 block(s), 0 byte(s) 2011.08.09 00:20:09 LOG7[12724:140272018274048]: local socket: FD=7 allocated (non-blocking mode) 2011.08.09 00:20:09 LOG7[12724:140272018274048]: Service varnish_SOFTINST-51 accepted FD=7 from 10.0.235.44:39675 2011.08.09 00:20:09 LOG7[12724:140272018409232]: Service varnish_SOFTINST-51 started 2011.08.09 00:20:09 LOG7[12724:140272018409232]: Option TCP_NODELAY set on local socket 2011.08.09 00:20:09 LOG5[12724:140272018409232]: Service varnish_SOFTINST-51 accepted connection from 10.0.235.44:39675 2011.08.09 00:20:14 LOG7[12724:140272018274048]: Dispatching signals from the signal pipe 2011.08.09 00:20:14 LOG5[12724:140272018274048]: Received signal 15; terminating 2011.08.09 00:20:14 LOG7[12724:140272018274048]: str_stats: 0 block(s), 0 byte(s) 2011.08.09 00:20:14 LOG7[12724:140272018274048]: removing pid file /srv/slapgrid/slappart1/var/run/stunnel.pid Please, someone can help me? maybe I am doing stupid things.. thanks in advance -- Gabriel M. Monnerat

2 3

Stunnel 4.41 dies after a while
by René Plattner 08 Aug '11

08 Aug '11

Hi, I have compiled version 4.41 with xforwarded-for patch successfully for our webmail system (Stunnel <-> Haproxy <-> Horde Webmail). After a while the stunnel daemon dies and following message appears in log: Aug 8 12:05:06 vlb2 [local3.err] stunnel: LOG3[3231:3085343632]: SSL_accept: 140760FC: error:140760FC:SSL routines: SSL23_GET_CLIENT_HELLO:unknown protocol Any ideas/suggestions? OS: Centos 5.5 openssl: 0.9.8e-12.el5_5.7 Configuration: ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Disable SSLv2 options = NO_SSLv2 ; List of allowed Ciphers ciphers = ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH ; Disable FIPS fips = no ; Some security enhancements for UNIX systems - comment them out on Win32 setuid = nobody setgid = nobody chroot = /usr/local/var/lib/stunnel/ ; PID is created inside chroot jail pid = /stunnel-webmail.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Option for Dummy MSIE TIMEOUTclose=0 ; Option for errorness SSL implementation options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = local3.4 ; Run as Daemon foreground = no ; Service-level configuration [https] cert = z1.pem accept = ip1:443 connect = p1 xforwardedfor = yes [https] cert = z2.pem accept = ip2:443 connect = p2 xforwardedfor = yes [wmt] cert = z3.pem accept = ip3:443 connect = p3 xforwardedfor = yes regards René Plattner

1 0

Tray icon options
by Sebastian Rose-Indorf 08 Aug '11

08 Aug '11

Hello, many thanks for the new Stunnel versions! I have installed 4.42b3 manually (Vista SP2 64 bit). The tray icon options "Edit stunnel.conf" and "Reload stunnel.conf" do not find the conf file, and the option "Manual" has no effect. At program start Stunnel finds the Conf file without problems (start link: "drive1/path1/stunnel.exe drive2/path2/stunnel.conf"). Greetings seb

1 0

Re: [stunnel-users] webmail compose page get expire and logout
by jayesh.shinde 08 Aug '11

08 Aug '11

Hi Ludolf , Sorry for my previous typing mistake , There is *no* firewall rules between any of my 3 servers My problem is when I open webmail with https:// and compose any email and click on send button then page is getting expire and I am getting logout. Kindly note that my other webmail pages with https:// are working properly. Where as with http:// the compose email and send works properly without any problem. That is if I open the webmail vai stunnel https config then only problem comes. So I am searching solution and config option with the same. Let me know if any config info require from my end. I am checking out with the option which you have suggested and will reply you shortly. Regards Jayesh Shinde On 08/08/2011 01:02 PM, Ludolf Holzheid wrote: > On Mon, 2011-08-08 12:30:03 +0530, jayesh.shinde wrote: >> > >> > [..] >> > >> > I checked by defining the TIMEOUTs but I am not able to figure out why >> > the page is getting expire and I am getting logout ? >> > There is firewall rule between any servers. > I didn't fully understand your problem, but if your secured tunnel > crosses a stateful firewall (e.g. a NAT router), you might try to > switch on TCP keepalive: > > socket = l:SO_KEEPALIVE=1 > > You might also play with the TCP_KEEP* socket options. > > HTH, > > Ludolf > > -- --------------------------------------------------------------- > Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 > 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 > Mannheim, Germany > ---------------------------------------------------------------

1 1

webmail compose page get expire and logout
by jayesh.shinde 08 Aug '11

08 Aug '11

Dear All , I am trying to setup a load balancing under webmail on my test servers. Here is my setup details :-- Total server are 3 servers. i.e ( 2 backend webmail server and 1 front server ) On one server I have installed haproxy-1.4.15.tar.gz + stunnel-4.41.tar.gz with http:// and https:// Another two servers are installed with squirrelmail . my problem:-- ========== 1) When I access the webmail by https://webmail.domain.com and compose any email and click on send button , the page is getting expire and I am getting log out from webmail. In Firefox there is no error on browser , where as in internet explorer I am getting below error with popup window :-- *Error Popup* :-- ============ "do you want to view only the webpage content that was deliver securely. This webpage contain the content that will not be delivered using the secure HTTPS connection, which could compromise the security of entire webpage." Where as if I check with http://webmail.domain.com , then the mail compose and send work properly. Here is the stunnel.conf :-- =================== [root@jayesh ~]# cat /etc/stunnel/stunnel.conf cert=/opt/ssl/ssl.key/mail_domain_com.crt key=/opt/ssl/ssl.key/domain.key setuid=stunnel setgid=stunnel pid=/var/run/stunnel/stunnel.pid output = /var/log/stunnel.log debug = 7 socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=192.168.30.200:443 connect=192.168.30.200:81 TIMEOUTclose = 0 session = 600 TIMEOUTbusy = 600 TIMEOUTclose = 300 TIMEOUTconnect = 600 I checked by defining the TIMEOUTs but I am not able to figure out why the page is getting expire and I am getting logout ? There is firewall rule between any servers. Please suggest me and guide on this issue. I am stuck here. Regards Jayesh Shinde

1 0

anyone got a port for android?
by Jason Haar 05 Aug '11

05 Aug '11

Hi there Exchange email doesn't work on Android for us because we have a requirement for using client certs to protect the ActiveSync over HTTPS transactions. If I had stunnel, I could sync with localhost and stunnel could do the client cert-foo.... So does anyone know of a working stunnel implementation for Android (or even something else that does the same job?) Thanks -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

3 2

FreeBSD upgrading to 4.41 (Dispatching signals from the signal pipe)
by Nicolas de Bari Embriz Garcia Rojas 04 Aug '11

04 Aug '11

Hi, I just upgrade stunner on a FreeBSD server from 4.35 to 4.41 using the ports, I restarted the server and notice that stunnel was not listen to any port, I had to manually restart it so it could work again. I increased the debug to 7 and got this when booting: 2011.08.04 17:44:58 LOG7[1123:675287360]: Dispatching signals from the signal pipe 2011.08.04 17:44:58 LOG5[1123:675287360]: Received signal 15; terminating 2011.08.04 17:44:58 LOG7[1123:675287360]: str_stats: 0 block(s), 0 byte(s) 2011.08.04 17:44:58 LOG7[1123:675287360]: removing pid file /stunnel.pid 2011.08.04 17:45:29 LOG7[682:675287360]: No limit detected for the number of clients 2011.08.04 17:45:29 LOG7[682:675287360]: signal_pipe: FD=3 allocated (non-blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: signal_pipe: FD=4 allocated (non-blocking mode) 2011.08.04 17:45:29 LOG5[682:675287360]: stunnel 4.41 on i386-portbld-freebsd8.2 platform 2011.08.04 17:45:29 LOG5[682:675287360]: Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 2011.08.04 17:45:29 LOG5[682:675287360]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv4 2011.08.04 17:45:29 LOG5[682:675287360]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2011.08.04 17:45:29 LOG7[682:675287360]: PRNG seeded successfully 2011.08.04 17:45:29 LOG6[682:675287360]: Initializing SSL context for service ssmtp 2011.08.04 17:45:29 LOG7[682:675287360]: Certificate: /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Certificate loaded 2011.08.04 17:45:29 LOG7[682:675287360]: Key file: /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Private key loaded 2011.08.04 17:45:29 LOG7[682:675287360]: Could not load DH parameters from /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Using hardcoded DH parameters 2011.08.04 17:45:29 LOG7[682:675287360]: DH initialized with 2048-bit key 2011.08.04 17:45:29 LOG7[682:675287360]: ECDH initialized with curve prime256v1 2011.08.04 17:45:29 LOG7[682:675287360]: SSL options set: 0x00000004 2011.08.04 17:45:29 LOG6[682:675287360]: SSL context initialized 2011.08.04 17:45:29 LOG6[682:675287360]: Initializing SSL context for service ssmtp2 2011.08.04 17:45:29 LOG7[682:675287360]: Certificate: /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Certificate loaded 2011.08.04 17:45:29 LOG7[682:675287360]: Key file: /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Private key loaded 2011.08.04 17:45:29 LOG7[682:675287360]: Could not load DH parameters from /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Using hardcoded DH parameters 2011.08.04 17:45:29 LOG7[682:675287360]: DH initialized with 2048-bit key 2011.08.04 17:45:29 LOG7[682:675287360]: ECDH initialized with curve prime256v1 2011.08.04 17:45:29 LOG7[682:675287360]: SSL options set: 0x00000004 2011.08.04 17:45:29 LOG6[682:675287360]: SSL context initialized 2011.08.04 17:45:29 LOG5[682:675287360]: Configuration successful 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=5 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=6 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=6 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=7 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=7 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=8 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=8 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=9 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=9 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=10 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: accept socket: FD=11 allocated (non-blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: Option SO_REUSEADDR set on accept socket 2011.08.04 17:45:29 LOG7[682:675287360]: Service ssmtp bound to 0.0.0.0:465 2011.08.04 17:45:29 LOG7[682:675287360]: Service ssmtp opened FD=11 2011.08.04 17:45:29 LOG7[682:675287360]: accept socket: FD=12 allocated (non-blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: Option SO_REUSEADDR set on accept socket 2011.08.04 17:45:29 LOG7[682:675287360]: Service ssmtp2 bound to 0.0.0.0:587 2011.08.04 17:45:29 LOG7[682:675287360]: Service ssmtp2 opened FD=12 2011.08.04 17:45:29 LOG7[688:675287360]: Created pid file /stunnel.pid 2011.08.04 17:45:42 LOG7[688:675287360]: Dispatching signals from the signal pipe 2011.08.04 17:45:42 LOG7[688:675287360]: Service ssmtp closed FD=11 2011.08.04 17:45:42 LOG7[688:675287360]: Service ssmtp2 closed FD=12 This is my conf: cert = /usr/local/etc/stunnel/smtp.inbox.pem chroot = /usr/local/var/stunnel setuid = stunnel setgid = stunnel pid = /stunnel.pid debug = 7 output = /stunnel.log client = no foreground = no ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [ssmtp] accept = 465 connect = 25 [ssmtp2] accept = 587 connect = 25 Any ideas of what could it be wrong? the last 2 lines of the boot log tell me that the ports i specify are been closed but why? 2011.08.04 17:45:42 LOG7[688:675287360]: Dispatching signals from the signal pipe 2011.08.04 17:45:42 LOG7[688:675287360]: Service ssmtp closed FD=11 2011.08.04 17:45:42 LOG7[688:675287360]: Service ssmtp2 closed FD=12 thanks in advance. regards

2 1