11 Apr '12
Are there any potential known issues with stunnel being compiled using openssl 1.0.1 build and leaving the local system binaries at 0.9.8k
Do you know of any way to test this for any incompatibilities? This was not my design, Im just being asked to support it and Im looking to make sure this method is not going to cause anything unusual.
2
1
Hi,
I’m trying to setup stunnel listening to multiple ports.
The PPID of processes created are always root.
Can we change that to the right PPID?
Here I can see all the processes by killing 10764 and I expect this is the PPID. But all the children PPID are still 1;
UID PID PPID C STIME TTY TIME CMD
philwong 10759 1 0 16:27 pts/78 00:00:00 stunnel self.conf
philwong 10760 1 0 16:27 pts/78 00:00:00 stunnel self.conf
philwong 10761 1 0 16:27 pts/78 00:00:00 stunnel self.conf
philwong 10762 1 0 16:27 pts/78 00:00:00 stunnel self.conf
philwong 10763 1 0 16:27 pts/78 00:00:00 stunnel self.conf
philwong 10764 1 0 16:27 ? 00:00:00 stunnel self.conf
Regards,
Philip
3
6
the connection had to be retried using SSL 3.0. This typically means that the server is using very old software and may have other security issues :(
by Thomas Manson 10 Apr '12
by Thomas Manson 10 Apr '12
10 Apr '12
Hi,
while I'm trying to get stunnel working for more than a few hours, I've
also notice this warning in google chrome :
the connection had to be retried using SSL 3.0. This typically means that
> the server is using very old software and may have other security issues.
[image: Inline image 1]
gmail for example has AES_128_CBC for crypting, can we get that without
much effort?
What should be set to get rid of this warning ?
I thought SSL v3 was the best (quickly pick acrross several example on the
net)
what is the best setting for this ?
Thanks for your help,
Thomas.
My config :
debug = 7
output = /var/log/stunnel4/extranet.service.com_stunnel.log
setuid = stunnel4
setgid = stunnel4
pid = /var/run/stunnel4/extranet.service.com.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
[extranet.service.com]
key = /etc/stunnel/sites/extranet.service.com/extranet.service.com.key
cert = /etc/stunnel/sites/extranet.service.com/extranet.service.com.crt
accept = 8.90.17.4:443
connect = 127.0.0.1:82
sslVersion = SSLv3
TIMEOUTclose = 0
3
4
[Stunnel Guru needed] stunnel running, but no longer serve connection after a while ("Dispatching signals from the signal pipe" in logs ==> all stops)
by Thomas Manson 09 Apr '12
by Thomas Manson 09 Apr '12
09 Apr '12
Hi All,
I'm really struggling to make stunnel working for more than a few hours.
(and the client is yelling hard...) (I solved some other issue : logging
per website and making more than one stunnel works)
To put it in a nutshell :
- stunnel is running and working correctly (I can reach the website in
https correctly)
- after some hours I get the following situation :
- stunnel is still running on linux
- trying to connect to a website result in the connection taking very
long time and then fails : "*The connection to *
extranet.serviceplus-hse.com <http://extranet.website.com>* was
interrupted. Error 101 (net::ERR_CONNECTION_RESET): The connection was
reset.*" (Chrome)
Same symptoms on IE9, Firefox & Lynx (on the server that runs
stunnel) (see logs below)
- The following logs are the last one seen in the log file :
- 2012.04.03 23:33:28 LOG5[24792:140152610346752]: Service
extranet.serviceplus-hse.com connected remote server from
127.0.0.1:36256
- 2012.04.03 23:33:28 LOG7[24792:140152610346752]: Remote FD=1
initialized
- 2012.04.03 23:33:28 LOG7[24792:140152610346752]: Option TCP_NODELAY
set on remote socket
- 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Socket closed on
read
- 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Sending SSL write
shutdown
- 2012.04.03 23:33:41 LOG7[24792:140152610346752]: SSL alert (write):
warning: close notify
- 2012.04.03 23:33:41 LOG6[24792:140152610346752]: SSL_shutdown
successfully sent close_notify
- 2012.04.03 23:33:41 LOG3[24792:140152610346752]: transfer:
s_poll_wait: TIMEOUTclose exceeded: closing
- 2012.04.03 23:33:41 LOG5[24792:140152610346752]: Connection closed:
186584 bytes sent to SSL, 3275 bytes sent to socket
- 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Service
extranet.serviceplus-hse.com finished (0 left)
- 2012.04.04 06:25:04 LOG7[24792:140152610629408]: *Dispatching
signals from the signal pipe
*
stopping the firewall & fail2ban do not change anything.
(the last line is logged by this function : *static void
signal_pipe_empty(void) )
*
the base stunnel.log has the same ending :
- 2012.04.03 21:10:42 LOG7[24778:139641780209408]: Service
https-123monsite.com permitted by libwrap from 212.162.10.34:3244
- 2012.04.03 21:10:42 LOG5[24778:139641780209408]: Service
https-123monsite.com accepted connection from 212.162.10.34:3244
- 2012.04.03 21:10:42 LOG7[24778:139641780209408]: SSL state
(accept): before/accept initialization
- 2012.04.03 21:10:42 LOG3[24778:139641780209408]: SSL_accept:
1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong
version number
- 2012.04.03 21:10:42 LOG5[24778:139641780209408]: Connection reset:
0 bytes sent to SSL, 0 bytes sent to socket
- 2012.04.03 21:10:42 LOG7[24778:139641780209408]: Service
https-123monsite.com finished (0 left)
- 2012.04.04 06:25:04 LOG7[24778:139641780213536]: Dispatching
signals from the signal pipe
-
and at the same time (2012.04.04 06:25:04) all logs file stops :
- root@ns0:/var/log/stunnel4# ll
- total 128
- drwxr-xr-x 2 stunnel4 stunnel4 4096 2012-04-04 12:10 .
- drwxr-xr-x 14 root root 4096 2012-04-04 06:25 ..
- -rw-r----- 1 stunnel4 stunnel4 98084 2012-04-04
*06:25*extranet.serviceplus-hse.com_stunnel.log
- -rw-r----- 1 stunnel4 stunnel4 4491 2012-04-04 06:25
mansonthomas.com_stunnel.log
- -rw-r----- 1 stunnel4 stunnel4 0 2012-04-04 06:25 stunnel.log
- -rw-r----- 1 stunnel4 stunnel4 11058 2012-04-04 06:25 stunnel.log.1
-
I've seen some message about the same behavior but after an upgrade
on freebsd and didn't find any solution...
- Restarting stunnel restore the service immediately.
below some information about my configuration... ask for more if needed.
Thanks for any helps,
Regards,
Thomas.
Distribution & Pachage info (x64 system)
######################################################################
root@ns0:/var/log/stunnel4# cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=11.10
DISTRIB_CODENAME=oneiric
DISTRIB_DESCRIPTION="Ubuntu 11.10"
root@ns0:/var/log/stunnel4# aptitude show stunnel4
Package: stunnel4
New: yes
State: installed
Automatically installed: no
Version: 3:*4.35-2build1*
######################################################################
lynx try :
######################################################################
root@ns0:/var/log/stunnel4# lynx https://extranet.serviceplus-hse.com
Looking up extranet.serviceplus-hse.com
Making HTTPS connection to extranet.serviceplus-hse.com
Retrying connection without TLS.
Looking up extranet.serviceplus-hse.com
Making HTTPS connection to extranet.serviceplus-hse.com
Alert!: Unable to make secure connection to remote host.
lynx: Can't access startfile https://extranet.serviceplus-hse.com/
######################################################################
ps -edf :
######################################################################
1 24773 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/base.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 PWD=/
1 24774 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/base.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 PWD=/
1 24775 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/base.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 PWD=/
1 24776 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/base.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 PWD=/
1 24777 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/base.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 PWD=/
1 24778 24778 24778 ? -1 Ss 109 0:00 /usr/bin/stunnel4
/etc/stunnel/base.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 PWD=/
1 24787 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 P
1 24788 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 P
1 24789 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 P
1 24790 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 P
1 24791 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 P
1 24792 24792 24792 ? -1 Ss 109 0:00 /usr/bin/stunnel4
/etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 P
1 24801 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/mansonthomas.com.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 PWD=/
1 24802 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/mansonthomas.com.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 PWD=/
1 24803 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/mansonthomas.com.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 PWD=/
1 24804 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/mansonthomas.com.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 PWD=/
1 24805 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/mansonthomas.com.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 PWD=/
1 24806 24806 24806 ? -1 Ss 109 0:00 /usr/bin/stunnel4
/etc/stunnel/mansonthomas.com.conf TERM=screen-bce
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
LANG=en_US.UTF-8 PWD=/
######################################################################
/etc/stunnel/base.conf
######################################################################
debug = 7
sslVersion = SSLv3
cert=/etc/stunnel/sites/123monsite.com/123monsite.com.crt
key=/etc/stunnel/sites/123monsite.com/123monsite.com.key
; security enhancements for UNIX systems
; for chroot a copy of some devices and files is needed within the jail
;chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
; PID is created inside the chroot jail
pid = /var/run/stunnel4/stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
output = /var/log/stunnel4/stunnel.log
[https-123monsite.com]
accept=88.190.17.222:443
connect=127.0.0.1:82
######################################################################
/etc/stunnel/extranet.serviceplus-hse.com.conf
######################################################################
debug = 7
output = /var/log/stunnel4/extranet.serviceplus-hse.com_stunnel.log
setuid = stunnel4
setgid = stunnel4
pid = /var/run/stunnel4/extranet.serviceplus-hse.com.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
[extranet.serviceplus-hse.com]
key = /etc/stunnel/sites/
extranet.serviceplus-hse.com/extranet.serviceplus-hse.com.key
cert = /etc/stunnel/sites/
extranet.serviceplus-hse.com/extranet.serviceplus-hse.com.crt
accept = 88.190.217.54:443
connect = 127.0.0.1:82
sslVersion = SSLv3
TIMEOUTclose = 0
######################################################################
Last logs : /var/log/stunnel4/extranet.serviceplus-hse.com_stunnel.log
######################################################################
2012.04.03 23:02:47 LOG6[24792:140152610346752]: SSL accepted: previous
session reused
2012.04.03 23:02:47 LOG7[24792:140152610346752]: remote socket: FD=1
allocated (non-blocking mode)
2012.04.03 23:02:47 LOG6[24792:140152610346752]: connect_blocking:
connecting 127.0.0.1:82
2012.04.03 23:02:47 LOG7[24792:140152610346752]: connect_blocking:
s_poll_wait 127.0.0.1:82: waiting 10 seconds
2012.04.03 23:02:47 LOG5[24792:140152610346752]: connect_blocking:
connected 127.0.0.1:82
2012.04.03 23:02:47 LOG5[24792:140152610346752]: Service
extranet.serviceplus-hse.com connected remote server from 127.0.0.1:60624
2012.04.03 23:02:47 LOG7[24792:140152610346752]: Remote FD=1 initialized
2012.04.03 23:02:47 LOG7[24792:140152610346752]: Option TCP_NODELAY set on
remote socket
2012.04.03 23:02:58 LOG7[24792:140152610346752]: Socket closed on read
2012.04.03 23:02:58 LOG7[24792:140152610346752]: Sending SSL write shutdown
2012.04.03 23:02:58 LOG7[24792:140152610346752]: SSL alert (write):
warning: close notify
2012.04.03 23:02:58 LOG6[24792:140152610346752]: SSL_shutdown successfully
sent close_notify
2012.04.03 23:02:58 LOG3[24792:140152610346752]: transfer: s_poll_wait:
TIMEOUTclose exceeded: closing
2012.04.03 23:02:58 LOG5[24792:140152610346752]: Connection closed: 167313
bytes sent to SSL, 1871 bytes sent to socket
2012.04.03 23:02:58 LOG7[24792:140152610346752]: Service
extranet.serviceplus-hse.com finished (0 left)
2012.04.03 23:33:20 LOG7[24792:140152610629408]: local socket: FD=0
allocated (non-blocking mode)
2012.04.03 23:33:20 LOG7[24792:140152610629408]: Service
extranet.serviceplus-hse.com accepted FD=0 from 82.224.128.241:52114
2012.04.03 23:33:20 LOG7[24792:140152610346752]: Service
extranet.serviceplus-hse.com started
2012.04.03 23:33:20 LOG7[24792:140152610346752]: Option TCP_NODELAY set on
local socket
2012.04.03 23:33:20 LOG7[24792:140152610346752]: Waiting for a libwrap
process
2012.04.03 23:33:20 LOG7[24792:140152610346752]: Acquired libwrap process #0
2012.04.03 23:33:20 LOG7[24792:140152610346752]: Releasing libwrap process
#0
2012.04.03 23:33:20 LOG7[24792:140152610346752]: Released libwrap process #0
2012.04.03 23:33:20 LOG7[24792:140152610346752]: Service
extranet.serviceplus-hse.com permitted by libwrap from 82.224.128.241:52114
2012.04.03 23:33:20 LOG5[24792:140152610346752]: Service
extranet.serviceplus-hse.com accepted connection from 82.224.128.241:52114
2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept):
before/accept initialization
2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
read client hello B
2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
write server hello A
2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
write certificate A
2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
write key exchange A
2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
write server done A
2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
flush data
2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
read client key exchange A
2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
read finished A
2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
write change cipher spec A
2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
write finished A
2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
flush data
2012.04.03 23:33:20 LOG7[24792:140152610346752]: 7 items in the session
cache
2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 client connects
(SSL_connect())
2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 client connects that
finished
2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 client renegotiations
requested
2012.04.03 23:33:20 LOG7[24792:140152610346752]: 21 server connects
(SSL_accept())
2012.04.03 23:33:20 LOG7[24792:140152610346752]: 20 server connects that
finished
2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 server renegotiations
requested
2012.04.03 23:33:20 LOG7[24792:140152610346752]: 9 session cache hits
2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 external session
cache hits
2012.04.03 23:33:20 LOG7[24792:140152610346752]: 7 session cache misses
2012.04.03 23:33:20 LOG7[24792:140152610346752]: 4 session cache timeouts
2012.04.03 23:33:20 LOG6[24792:140152610346752]: SSL accepted: new session
negotiated
2012.04.03 23:33:20 LOG6[24792:140152610346752]: Negotiated ciphers:
DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1
2012.04.03 23:33:20 LOG7[24792:140152610346752]: remote socket: FD=1
allocated (non-blocking mode)
2012.04.03 23:33:20 LOG6[24792:140152610346752]: connect_blocking:
connecting 127.0.0.1:82
2012.04.03 23:33:20 LOG7[24792:140152610346752]: connect_blocking:
s_poll_wait 127.0.0.1:82: waiting 10 seconds
2012.04.03 23:33:20 LOG5[24792:140152610346752]: connect_blocking:
connected 127.0.0.1:82
2012.04.03 23:33:20 LOG5[24792:140152610346752]: Service
extranet.serviceplus-hse.com connected remote server from 127.0.0.1:36240
2012.04.03 23:33:20 LOG7[24792:140152610346752]: Remote FD=1 initialized
2012.04.03 23:33:20 LOG7[24792:140152610346752]: Option TCP_NODELAY set on
remote socket
2012.04.03 23:33:27 LOG7[24792:140152610346752]: Socket closed on read
2012.04.03 23:33:27 LOG7[24792:140152610346752]: Sending SSL write shutdown
2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL alert (write):
warning: close notify
2012.04.03 23:33:27 LOG6[24792:140152610346752]: SSL_shutdown successfully
sent close_notify
2012.04.03 23:33:27 LOG3[24792:140152610346752]: transfer: s_poll_wait:
TIMEOUTclose exceeded: closing
2012.04.03 23:33:27 LOG5[24792:140152610346752]: Connection closed: 537
bytes sent to SSL, 620 bytes sent to socket
2012.04.03 23:33:27 LOG7[24792:140152610346752]: Service
extranet.serviceplus-hse.com finished (0 left)
2012.04.03 23:33:27 LOG7[24792:140152610629408]: local socket: FD=0
allocated (non-blocking mode)
2012.04.03 23:33:27 LOG7[24792:140152610629408]: Service
extranet.serviceplus-hse.com accepted FD=0 from 82.224.128.241:52123
2012.04.03 23:33:27 LOG7[24792:140152610346752]: Service
extranet.serviceplus-hse.com started
2012.04.03 23:33:27 LOG7[24792:140152610346752]: Option TCP_NODELAY set on
local socket
2012.04.03 23:33:27 LOG7[24792:140152610346752]: Waiting for a libwrap
process
2012.04.03 23:33:27 LOG7[24792:140152610346752]: Acquired libwrap process #0
2012.04.03 23:33:27 LOG7[24792:140152610346752]: Releasing libwrap process
#0
2012.04.03 23:33:27 LOG7[24792:140152610346752]: Released libwrap process #0
2012.04.03 23:33:27 LOG7[24792:140152610346752]: Service
extranet.serviceplus-hse.com permitted by libwrap from 82.224.128.241:52123
2012.04.03 23:33:27 LOG5[24792:140152610346752]: Service
extranet.serviceplus-hse.com accepted connection from 82.224.128.241:52123
2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept):
before/accept initialization
2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
read client hello B
2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
write server hello A
2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
write change cipher spec A
2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
write finished A
2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
flush data
2012.04.03 23:33:28 LOG7[24792:140152610346752]: SSL state (accept): SSLv3
read finished A
2012.04.03 23:33:28 LOG7[24792:140152610346752]: 7 items in the session
cache
2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 client connects
(SSL_connect())
2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 client connects that
finished
2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 client renegotiations
requested
2012.04.03 23:33:28 LOG7[24792:140152610346752]: 22 server connects
(SSL_accept())
2012.04.03 23:33:28 LOG7[24792:140152610346752]: 21 server connects that
finished
2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 server renegotiations
requested
2012.04.03 23:33:28 LOG7[24792:140152610346752]: 10 session cache hits
2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 external session
cache hits
2012.04.03 23:33:28 LOG7[24792:140152610346752]: 7 session cache misses
2012.04.03 23:33:28 LOG7[24792:140152610346752]: 4 session cache timeouts
2012.04.03 23:33:28 LOG6[24792:140152610346752]: SSL accepted: previous
session reused
2012.04.03 23:33:28 LOG7[24792:140152610346752]: remote socket: FD=1
allocated (non-blocking mode)
2012.04.03 23:33:28 LOG6[24792:140152610346752]: connect_blocking:
connecting 127.0.0.1:82
2012.04.03 23:33:28 LOG7[24792:140152610346752]: connect_blocking:
s_poll_wait 127.0.0.1:82: waiting 10 seconds
2012.04.03 23:33:28 LOG5[24792:140152610346752]: connect_blocking:
connected 127.0.0.1:82
2012.04.03 23:33:28 LOG5[24792:140152610346752]: Service
extranet.serviceplus-hse.com connected remote server from 127.0.0.1:36256
2012.04.03 23:33:28 LOG7[24792:140152610346752]: Remote FD=1 initialized
2012.04.03 23:33:28 LOG7[24792:140152610346752]: Option TCP_NODELAY set on
remote socket
2012.04.03 23:33:41 LOG7[24792:140152610346752]: Socket closed on read
2012.04.03 23:33:41 LOG7[24792:140152610346752]: Sending SSL write shutdown
2012.04.03 23:33:41 LOG7[24792:140152610346752]: SSL alert (write):
warning: close notify
2012.04.03 23:33:41 LOG6[24792:140152610346752]: SSL_shutdown successfully
sent close_notify
2012.04.03 23:33:41 LOG3[24792:140152610346752]: transfer: s_poll_wait:
TIMEOUTclose exceeded: closing
2012.04.03 23:33:41 LOG5[24792:140152610346752]: Connection closed: 186584
bytes sent to SSL, 3275 bytes sent to socket
2012.04.03 23:33:41 LOG7[24792:140152610346752]: Service
extranet.serviceplus-hse.com finished (0 left)
2012.04.04 06:25:04 LOG7[24792:140152610629408]: Dispatching signals from
the signal pipe
######################################################################
2
6
Ubuntu version of stunnel : multiple process shown by a ps -edf, compiled from sources : one process
by Thomas Manson 08 Apr '12
by Thomas Manson 08 Apr '12
08 Apr '12
Hi,
To get around a bug of stunnel present in the package of Ubuntu 11.10
(that has been corrected in v4.38),
I've compiled from sources (v4.53).
It went well, but I did notice a change in the processes :
from compiled sources, I can see only on process per conf file
######################################################################
1 21402 21402 21402 ? -1 Ss 109 0:00
/usr/local/bin/stunnel4 /etc/stunnel/base.conf
1 21411 21411 21411 ? -1 Ss 109 0:00
/usr/local/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf
1 21420 21420 21420 ? -1 Ss 109 0:00
/usr/local/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf
######################################################################
while on the ubuntu version, I've multiple process per conf file.
ps -edf from ubuntu distrib
######################################################################
1 24773 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/base.conf
1 24774 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/base.conf
1 24775 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/base.conf
1 24776 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/base.conf
1 24777 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/base.conf
1 24778 24778 24778 ? -1 Ss 109 0:00 /usr/bin/stunnel4
/etc/stunnel/base.conf
1 24787 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/extranet.serviceplus-hse.com.conf
1 24788 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/extranet.serviceplus-hse.com.conf
1 24789 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/extranet.serviceplus-hse.com.conf
1 24790 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/extranet.serviceplus-hse.com.conf
1 24791 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/extranet.serviceplus-hse.com.conf
1 24792 24792 24792 ? -1 Ss 109 0:00 /usr/bin/stunnel4
/etc/stunnel/extranet.serviceplus-hse.com.conf
1 24801 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/mansonthomas.com.conf
1 24802 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/mansonthomas.com.conf
1 24803 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/mansonthomas.com.conf
1 24804 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/mansonthomas.com.conf
1 24805 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4
/etc/stunnel/mansonthomas.com.conf
1 24806 24806 24806 ? -1 Ss 109 0:00 /usr/bin/stunnel4
/etc/stunnel/mansonthomas.com.conf
######################################################################
I'm using the exact same version of conf file for both setup...
any idea why this change ?
is one better than another ?
Regards,
Thomas.
1
0
Hi All,
I've been playing with this for a little while now and before the all in
front of me and my head meet I was wondering if someone else could shed
some light on this for me please.
First off let me give you a over view of the network setup:
My Virtual Machine has two interfaces eth0 has two addresses 192.168.82.9/18and
192.168.82.10/18. 192.168.82.9 is going to be for the management of the
server and 192.168.82.10 is what the website will respond too. eth1 has a
network of its own 10.0.0.0/24 and I have two Debian Apache web servers
that are connected to this network 10.0.0.10 and 10.0.0.20.
If this was a real world setup I might have put the management address
(192.168.82.9) on a different port but I didn't think of that at the time
of setting this up but I may do that later.
Second what have I done!
Well this is a brand new install of Centos6.2 minimal fully patched and
both HAProxy and STunnel downloaded and installed. I'm using the devel
version of HAProxy but thats a different story and version 4.53 of STunnel.
Now the problem.
Both seem to work perfectly as-long as I don't want to know who is
accessing my site which make it next to useless. However, I can get HAProxy
to report the IP Address of the visitor as long as you visit the HTTP page
on port 80 as per my configuration file. I can also get STunnel to work
with HAProxy but as soon as I enable 'protocol = proxy' the HTTPS side
breaks and all I get in my browser is '400 Bad Request Your browser sent an
invalid request'. I've played with everything I can thing of and I still
cant get a Transparent STunnel>HAProxy solution working correctly.
Config Files:
stunnel.conf
======================================
chroot = /usr/local/var/lib/stunnel/
#setuid = nobody
setgid = nobody
pid = /stunnel.pid
cert = /usr/local/etc/stunnel/stunnel.pem
key = /usr/local/etc/stunnel/stunnel.pem
options = NO_SSLv2
debug = 7
#fips = no
[https]
accept = 192.168.82.10:443
connect = 192.168.82.10:80
protocol = proxy
haproxy.cfg
======================================
global
daemon
log /dev/log local4
maxconn 40000
ulimit-n 81000
defaults
log global
mode http
contimeout 4000
clitimeout 42000
srvtimeout 43000
listen http1
bind 192.168.82.10:80
mode http
option http-server-close
option forwardfor
source 0.0.0.0 usesrc clientip
balance roundrobin
server http1_1 10.0.0.10:80 cookie http1_1 check inter 2000 rise 2
fall 3
server http1_1 10.0.0.20:80 cookie http1_1 check inter 2000 rise 2
fall 3
Log file
======================================
Apr 5 12:37:32 lbmaster haproxy[1351]: Proxy http1 started.
Apr 5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: stunnel 4.53
on x86_64-unknown-linux-gnu platform
Apr 5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]:
Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010
Apr 5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]:
Threading:PTHREAD SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:POLL+IPv6
Apr 5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: Reading
configuration from file /usr/local/etc/stunnel/stunnel.conf
Apr 5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: FIPS mode is
enabled
Apr 5 12:37:33 lbmaster stunnel: LOG6[1353:140163149080512]: Initializing
service section [https]
Apr 5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: Configuration
successful
Apr 5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: Service
[https] accepted connection from 192.168.64.10:53149
Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]:
connect_blocking: connecting 192.168.82.10:80
Apr 5 12:37:41 lbmaster haproxy[1352]: Connect from 192.168.82.10:47570 to
192.168.82.10:80 (http1/HTTP)
Apr 5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]:
connect_blocking: connected 192.168.82.10:80
Apr 5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: Service
[https] connected remote server from 192.168.82.10:47570
Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: Server-mode
proxy protocol negotiations started
Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: Server-mode
proxy protocol negotiations succeeded
Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: SSL accepted:
new session negotiated
Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: Negotiated
TLSv1/SSLv3 ciphersuite: DHE-RSA-AES256-SHA (256-bit encryption)
Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: Compression:
null, expansion: null
Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: SSL_shutdown
successfully sent close_notify alert
Apr 5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: Error
detected on socket (read) file descriptor: Broken pipe (32)
Apr 5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: Connection
reset: 187 byte(s) sent to SSL, 1 byte(s) sent to socket
Any help would be most gracefully received and welcome.
~Yours,
Scott
2
1
On Sat, Apr 7, 2012 at 8:00 PM, <stunnel-users-request(a)stunnel.org> wrote:
> Send stunnel-users mailing list submissions to
> stunnel-users(a)stunnel.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> http://stunnel.mirt.net/mailman/listinfo/stunnel-users
> or, via email, send a message with subject or body 'help' to
> stunnel-users-request(a)stunnel.org
>
> You can reach the person managing the list at
> stunnel-users-owner(a)stunnel.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of stunnel-users digest..."
>
>
> Today's Topics:
>
> 1. Re: [Stunnel Guru needed] stunnel running, but no longer
> serve connection after a while ("Dispatching signals from the
> signal pipe" in logs ==> all stops) (Thomas Manson)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Sat, 7 Apr 2012 08:24:46 +0200
> From: Thomas Manson <dev.mansonthomas(a)gmail.com>
> To: Scott Gifford <sgifford(a)suspectclass.com>
> Cc: stunnel-users(a)stunnel.org
> Subject: Re: [stunnel-users] [Stunnel Guru needed] stunnel running,
> but no longer serve connection after a while ("Dispatching signals
> from the signal pipe" in logs ==> all stops)
> Message-ID:
> <CA+PenvGYr+tTiKsavOgyaLOtoRxUo0nfxuRVDEzdvGDrFpefLg(a)mail.gmail.com
> >
> Content-Type: text/plain; charset="utf-8"
>
> This bug has been corrected in
>
> Version 4.38, 2011.06.28, urgency: MEDIUM:
>
> - New features
> - Server-side SNI implemented (RFC 3546 section 3.1) with a new
> service-level option "nsi".
> - "socket" option also accepts "yes" and "no" for flags.
> - Nagle's algorithm is now disabled by default for improved
> interactivity.
> - Bugfixes
> - A compilation fix was added for OpenSSL version < 1.0.0.
> - Signal pipe set to non-blocking mode. This bug caused hangs of
> stunnel features based on signals, e.g. local mode, FORK threading, or
> configuration file reload on Unix. Win32 platform was not affected.
>
>
> however it don't precise from which version it affects stunnel... so my try
> with 11.04 is a bit risky, even if 4.29 is quite far from 4.38.
>
> Maybe upgrading to 12.04 could solve the issue, but I don't like to upgrade
> right away (I had some bad surpise ;))
>
> so compiling from source seems to be the safest option.
>
> Thomas.
>
> On Sat, Apr 7, 2012 at 07:58, Thomas Manson <dev.mansonthomas(a)gmail.com
> >wrote:
>
> > i've just checked my setup right now and the funny thing is that I think
> > it stopped working exactly at the same second of the same hour & minute
> of
> > the day :
> >
> >
> > root@ns0:/var/log/stunnel4# ll
> > total 940
> > drwxr-xr-x 2 stunnel4 stunnel4 4096 2012-04-07 06:25 .
> > drwxr-xr-x 14 root root 4096 2012-04-07 06:25 ..
> > -rw-r----- 1 stunnel4 stunnel4 0 2012-04-07 06:25
> > extranet.serviceplus-hse.com_stunnel.log
> > -rw-r----- 1 stunnel4 stunnel4 926267 2012-04-07 06:25
> > extranet.serviceplus-hse.com_stunnel.log.1
> > -rw-r----- 1 stunnel4 stunnel4 0 2012-04-07 06:25
> > mansonthomas.com_stunnel.log
> > -rw-r----- 1 stunnel4 stunnel4 5804 2012-04-07 06:25
> > mansonthomas.com_stunnel.log.1
> > -rw-r----- 1 stunnel4 stunnel4 0 2012-04-07 06:25 stunnel.log
> > -rw-r----- 1 stunnel4 stunnel4 11710 2012-04-07 06:25 stunnel.log.1
> > root@ns0:/var/log/stunnel4# ll
> > total 940
> > drwxr-xr-x 2 stunnel4 stunnel4 4096 2012-04-07 06:25 .
> > drwxr-xr-x 14 root root 4096 2012-04-07 06:25 ..
> > -rw-r----- 1 stunnel4 stunnel4 0 2012-04-07 06:25
> > extranet.serviceplus-hse.com_stunnel.log
> > -rw-r----- 1 stunnel4 stunnel4 926267 2012-04-07 06:25
> > extranet.serviceplus-hse.com_stunnel.log.1
> > -rw-r----- 1 stunnel4 stunnel4 0 2012-04-07 06:25
> > mansonthomas.com_stunnel.log
> > -rw-r----- 1 stunnel4 stunnel4 5804 2012-04-07 06:25
> > mansonthomas.com_stunnel.log.1
> > -rw-r----- 1 stunnel4 stunnel4 0 2012-04-07 06:25 stunnel.log
> > -rw-r----- 1 stunnel4 stunnel4 11710 2012-04-07 06:25 stunnel.log.1
> > root@ns0:/var/log/stunnel4# tail stunnel.log.1
> > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: Option TCP_NODELAY set
> on
> > remote socket
> > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: Socket closed on read
> > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: Sending SSL write
> shutdown
> > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: SSL alert (write):
> > warning: close notify
> > 2012.04.06 22:21:19 LOG6[4745:139677248579328]: SSL_shutdown
> successfully
> > sent close_notify
> > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: SSL socket closed on
> > SSL_read
> > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: Sending socket write
> > shutdown
> > 2012.04.06 22:21:19 LOG5[4745:139677248579328]: Connection closed: 206
> > bytes sent to SSL, 139 bytes sent to socket
> > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: Service
> > https-123monsite.com finished (0 left)
> > 2012.04.07 06:25:04 LOG7[4745:139677248583456]: Dispatching signals from
> > the signal pipe
> > root@ns0:/var/log/stunnel4#
> >
> > compared to my first post... :
> >
> >
> >
> >
> > - 2012.04.04 06:25:04 LOG7[24778:139641780213536]: Dispatching
> signals
> > from the signal pipe
> > -
> > and at the same time (2012.04.04 06:25:04) all logs file stops :
> >
> >
> > - root@ns0:/var/log/stunnel4# ll
> > - total 128
> > - drwxr-xr-x 2 stunnel4 stunnel4 4096 2012-04-04 12:10 .
> > - drwxr-xr-x 14 root root 4096 2012-04-04 06:25 ..
> > - -rw-r----- 1 stunnel4 stunnel4 98084 2012-04-04 *06:25*
> > extranet.serviceplus-hse.com_stunnel.log
> > - -rw-r----- 1 stunnel4 stunnel4 4491 2012-04-04 06:25
> > mansonthomas.com_stunnel.log
> > - -rw-r----- 1 stunnel4 stunnel4 0 2012-04-04 06:25 stunnel.log
> > - -rw-r----- 1 stunnel4 stunnel4 11058 2012-04-04 06:25 stunnel.log.1
> >
> >
> >
> > I could cron a restart at the appropriate time but I think I'll compile
> > from sources.
> >
> > Regards,
> > Thomas.
> >
> > On Sat, Apr 7, 2012 at 07:51, Thomas Manson <dev.mansonthomas(a)gmail.com
> >wrote:
> >
> >> Yes, it helps a lot !
> >>
> >> I've another server running a different version of Ubuntu (11.04 where
> >> stunnel version is 4.29-1 instead of 11.10 and stunnel 4.35-2build1)
> >>
> >> Do you think it can work on older version ?
> >>
> >> I was thinking to try this because I've seen some message about the same
> >> symptoms after upgrade so...
> >>
> >> but maybe the two version are too close and I will need to compile from
> >> sources...
> >>
> >> what do you think about this?
> >>
> >> Regards,
> >> Thomas.
> >>
> >>
> >> On Sat, Apr 7, 2012 at 06:56, Scott Gifford <sgifford(a)suspectclass.com
> >wrote:
> >>
> >>> On Wed, Apr 4, 2012 at 6:16 AM, Thomas Manson <
> >>> dev.mansonthomas(a)gmail.com> wrote:
> >>>
> >>>> Hi All,
> >>>>
> >>>> I'm really struggling to make stunnel working for more than a few
> >>>> hours. (and the client is yelling hard...) (I solved some other issue
> :
> >>>> logging per website and making more than one stunnel works)
> >>>>
> >>>
> >>> Hi Thomas,
> >>>
> >>> I was just troubleshooting what looks like a very similar issue. I
> >>> believe this is fixed in a later version of stunnel, which you can get
> from
> >>> stunnel.org and compile yourself from source.
> >>>
> >>> This is the ChangeLog entry that I think addresses your problem:
> >>>
> >>> - Signal pipe set to non-blocking mode. This bug caused hangs of
> >>> stunnel
> >>> features based on signals, e.g. local mode, FORK threading, or
> >>> configuration file reload on Unix. Win32 platform was not
> affected.
> >>>
> >>>
> >>> I have just updated from the official Oneiric version to this one, so I
> >>> don't yet know if it will fix the problem long-term, but I think my
> odds
> >>> are not too bad.
> >>>
> >>> Hope this helps,
> >>>
> >>> -----Scott.
> >>>
> >>>
> >>
> >
>
1
0
05 Apr '12
Hi Pieter,
What does stunnel -version show under the 'ciphers' section?
Also have you tried this with the 'options = NO_SSLv3' commented out?
~Scott
2
2
I asked before but nobody answer
Please
I read manual but it's not clear for may task
I have IP & Port with user and pass from HttpS server
I want connect to server an use for tunneling like proxy server
Please help me
How config and connect to server?
2
1
Hi,
I have a Nagios plugin using an stunnel connection to a MySQL server across
the LAN for frequent queries, where each one opens a fresh connection.
Checking ulimit on both ends shows "unlimited" (I've found old discussions
about that being a possible factor). There's nothing I've found in the logs
to show where it's going wrong. It's just that after days of running fine,
suddenly the queries start failing to connect through. Restarting stunnel on
both ends immediately resolves the problem. I suppose I can just restart
stunnel on both ends once a day from cron and be okay. But I'd rather find a
real fix, if anyone recognizes what this would be and can point me to one.
Thanks,
Whit
2
2