stunnel-users October 2014

28 participants
28 discussions

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 06 Jul '16

06 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Help needed to load hierarchical chain of certificates
by Rejuan Masud Masud 31 Oct '14

31 Oct '14

Help needed to load hierarchical chain of certificates(Root, CA) when stunnel running in server mode. We are trying to load. but only server signed certificate is loading which is assigned in cert as below, CAfile=/u01/stunnel/AMEX_all/CA.PEM cert=/u01/stunnel/AMEX_all/cert.pem HOW TO LOAD HIERARCHICAL CHAIN OF CERTIFICATES?

2 1

special characters in output path -> error
by "Dirk Löning [CSB-Bruns&Börjes GmbH ]" 31 Oct '14

31 Oct '14

It's seems to be a problem in the new stunnel version 5.06 When I use the USERPROFILE directory, which contains special characters like "ö", i get an error: *[!] Cannot open log file: C:\Users\Bl?d\CSB\SSL\SmtpLog(0).txt* Is this a bug or must i change something ? The configuration file " SmtpConfig(0).txt" : ; Configuration file output = C:\Users\Blöd\CSB\SSL\SmtpLog(0).txt taskbar = yes cert = C:\Users\Blöd\CSB\SSL\stunnel.pem client = yes [ssmtp] accept = 8801 connect = smtp.1und1.de:465 The log says: [ ] No limit detected for the number of clients [.] stunnel 5.06 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.1j-fips 15 Oct 2014 [.] Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS [ ] errno: (*_errno()) [.] Reading configuration from file C:\Users\Blöd\CSB\SSL\SmtpConfig(0).txt [.] FIPS mode disabled [ ] Compression disabled [ ] GUI message loop initialized [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 0 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [ssmtp] [ ] Loading cert from file: C:\Users\Bl?d\CSB\SSL\stunnel.pem [ ] Loading key from file: C:\Users\Bl?d\CSB\SSL\stunnel.pem [ ] Private key check succeeded [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=456) [ ] Service [ssmtp] (FD=456) bound to 0.0.0.0:8801 *[!] Cannot open log file: C:\Users\Bl?d\CSB\SSL\SmtpLog(0).txt* [ ] Closing service [ssmtp] [ ] Service [ssmtp] closed (FD=456) [ ] Service [ssmtp] closed [!] Server is down greetings dirk

1 0

Re: [stunnel-users] Exchange Online - SSLv3 and Sophos UTM 120 firewall update
by Michal Trojnara 31 Oct '14

31 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Stephen Hogan wrote: > 2014.10.28 14:35:55 LOG7[4156]: SSL state (connect): SSLv3 write > client hello A [cut] > I have a basic (shaky) understanding that the "handshake" for TLS > does downgrade to SSLv3 if newer versions of TLS fail, but I am > wondering if I apply the update recommended on the firewall, will > this cut the communication for the SMTP relay, the way I am using > it? The debug messages produced by stunnel can sometimes be confusing. They are intended to be helpful to developers, and not end-users. OpenSSL implements the SSL/TLS/DTLS protocols with three separate finite state machines: SSLv2, SSLv3, and DTLS1. http://en.wikipedia.org/wiki/Automata-based_programming All TLS protocols use the SSLv3 state machine, thus the state name does not reflect the actual protocol being negotiated. See the source for details: https://github.com/openssl/openssl/blob/master/ssl/ssl_stat.c Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRREk8ACgkQ/NU+nXTHMtGLPwCgiA1tfq7LhNC600d5eVbWugLk coUAn1mGA4mWBAchUu5+d6nYfxe0isgr =p4hH -----END PGP SIGNATURE-----

2 1

Configuring Stunnel 4.1 to use TLS
by Deepak Subbanarasimha 31 Oct '14

31 Oct '14

Hello, I had some questions on Stunnel version for Windows. 1. Does Stunnel 4.1 support TLS? 2. If yes, what version of TLS does it support(TLS1.0, TLS1,1 or TLS 1.2 ) 3. How can I tell if an Stunnel instance is using SSL or TLS 4. Does anyone have instructions to configure Stunnel 4.1 to use TLS 5. Can you share an example of stunnel.conf with TLS turned on Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:[email protected]> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

1 0

Stunnel server as transparent proxy
by Derek Cole 28 Oct '14

28 Oct '14

Hello, Is it possible to use stunnel server as a transparent proxy? I was digging through the manpage and I see the transparent= option. What I would like to do is have an stunnel client connect to the stunnel server, and once traffic is at the server, go to the original destination that the traffic going to the stunnel client was destined for. I.E. Can I have firefox proxy to my stunnel client, which connects to my stunnel server, and then that traffic goes to whatever website the end user was trying to hit in firefox? My Stunnel server is on a CentOS box: [root@CentOSTunTest ~]# uname -a Linux CentOSTunTest 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux And my stunnel.conf foreground = yes > debug = 7 > options = NO_SSLv2 > fips = no > output=/usr/local/etc/stunnel/stunnel.log > > > [https] > cert=/usr/local/etc/stunnel/stunnel.pem > accept = 443 > connect = 80 > > [Internet] > cert=/usr/local/etc/stunnel/stunnel.pem > sni = https:Internet > transparent=destination > So basically in the transparent option is Internet is what I am wondering if it works the way I expect. I see this in the log file: 2014.10.23 09:57:05 LOG3[11414]: setsockopt SO_ORIGINAL_DST: Protocol not available (92) 2014.10.23 09:57:05 LOG5[11414]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket I see this in the stunnel manpage: For a connect target installed on the same host: /sbin/iptables -t nat -I OUTPUT -p tcp --dport <redirected_port> \ -m ! --uid-owner <stunnel_user_id> \ -j DNAT --to-destination <local_ip>:<stunnel_port> For a connect target installed on a remote host: /sbin/iptables -I INPUT -i eth0 -p tcp --dport <stunnel_port> -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport <redirected_port> \ -i eth0 -j DNAT --to-destination <local_ip>:<stunnel_port> What does it mean "for a connect target installed on the same host" I thought transparent meant I was not using a connect target except the original destination. Does this mean I should implement the IPTables for a remote host, since I want my client to just reach the internet? Thanks for the help in advance!

2 4

VS 2010 compilation issue due to shfolder.h
by nnposter＠users.sourceforge.net 28 Oct '14

28 Oct '14

I am running into a compilation problem on MS C/C++ 16 (aka VS 2010). Specifically, I am getting the following error due to an include that has been added in 5.01: C:\Program Files (x86)\Microsoft SDKs\Windows\v7.0A\include\shfolder.h(14) : fatal error C1189: #error : shfolder.h/shfolder.lib provide platform independence with versions prior to Windows 2000. Use shlobj.h/shell32.lib if targetting Windows 2000 or higher. The following primitive patch seems to address the issue: --- common.h.orig 2014-10-02 04:12:48.000000000 -0600 +++ common.h 2014-10-27 16:02:22.536329500 -0600 @@ -228,7 +228,13 @@ #include <windows.h> #include <process.h> /* _beginthread */ + +#if defined _MSC_VER && _MSC_VER >= 1600 +#include <shlobj.h> /* SHGetFolderPath */ +#else #include <shfolder.h> /* SHGetFolderPath */ +#endif + #include <tchar.h> #include "resources.h" Cheers, nnposter

2 1

stunnel-5.06 fails to build against systemd 215
by Anthony G. Basile 24 Oct '14

24 Oct '14

Hi everyone, We hit a bug in stunnel-5.05 and it continues in 5.06. The problem comes from systemd which moved sd_listen_fds() form libsystemd-daemon.so to libsystemd.so. However, stunnel's configure.ac still has AC_SEARCH_LIBS([sd_listen_fds], [systemd-daemon]) For backwards compatibility, this should probably be AC_SEARCH_LIBS([sd_listen_fds], [systemd], [], [ AC_SEARCH_LIBS([sd_listen_fds], [systemd-daemon]) ]) or similar. Please refer to our downstream bug: https://bugs.gentoo.org/show_bug.cgi?id=525234' Thanks. -- Anthony G. Basile, Ph. D. Chair of Information Technology D'Youville College Buffalo, NY 14201 (716) 829-8197

2 5

stunnel service leaves stale connections to rsync on the server side
by Polyack, Steve 22 Oct '14

22 Oct '14

Hi, We've been running a rsync service over stunnel for some time now. After upgrading our environment, which involved moving from an old version of Linux to FreeBSD 9.3, and from stunnel-4.29 to stunnel-5.06, we've had a problem pop up. Ever since switching over, we see that rsync daemon processes slowly build up over time on our server, each consuming 100% CPU. The vast majority of our clients are working just fine, and the problematic rsync processes just seem to have been dead/aborted connections from the clients (which are using wireless aircard, so connectivity can be shotty). A quick 'truss' on the process shows they are doing nothing but sitting there and read()'ing in a loop indefinitely: # truss -p 14689 | head read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) Furthermore, the connection appears to be closed: # sockstat -4 | grep 14689 root rsync 14689 3 tcp4 127.0.0.1:873 127.0.0.1:27724 netstat -an | grep 27724 netstat: kvm not available: /dev/mem: No such file or directory tcp4 0 0 127.0.0.1.873 127.0.0.1.27724 CLOSED Looking through the stunnel logs, it looks like no data was ever really passed (perhaps the client gave up?): 2014.10.22 10:45:52 LOG7[34384941056]: Service [rsync] started 2014.10.22 10:45:52 LOG5[34384941056]: Service [rsync] accepted connection from 1.1.1.1:63095 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): before/accept initialization 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read client hello A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write server hello A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write certificate A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write server done A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 flush data 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read client key exchange A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read finished A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write change cipher spec A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write finished A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 flush data 2014.10.22 10:45:52 LOG7[34384941056]: 41 items in the session cache 2014.10.22 10:45:52 LOG7[34384941056]: 0 client connects (SSL_connect()) 2014.10.22 10:45:52 LOG7[34384941056]: 0 client connects that finished 2014.10.22 10:45:52 LOG7[34384941056]: 0 client renegotiations requested 2014.10.22 10:45:52 LOG7[34384941056]: 110 server connects (SSL_accept()) 2014.10.22 10:45:52 LOG7[34384941056]: 107 server connects that finished 2014.10.22 10:45:52 LOG7[34384941056]: 0 server renegotiations requested 2014.10.22 10:45:52 LOG7[34384941056]: 66 session cache hits 2014.10.22 10:45:52 LOG7[34384941056]: 0 external session cache hits 2014.10.22 10:45:52 LOG7[34384941056]: 32 session cache misses 2014.10.22 10:45:52 LOG7[34384941056]: 0 session cache timeouts 2014.10.22 10:45:52 LOG6[34384941056]: No peer certificate received 2014.10.22 10:45:52 LOG6[34384941056]: SSL accepted: new session negotiated 2014.10.22 10:45:52 LOG6[34384941056]: Negotiated SSLv3 ciphersuite AES256-SHA (256-bit encryption) 2014.10.22 10:45:52 LOG6[34384941056]: Compression: null, expansion: null 2014.10.22 10:45:52 LOG6[34384941056]: s_connect: connecting 127.0.0.1:873 2014.10.22 10:45:52 LOG5[34384941056]: s_connect: connected 127.0.0.1:873 2014.10.22 10:45:52 LOG5[34384941056]: Service [rsync] connected remote server from 127.0.0.1:27724 2014.10.22 10:45:52 LOG7[34384941056]: Remote socket (FD=11) initialized 2014.10.22 11:01:12 LOG3[34384941056]: SSL_read: Connection reset by peer (54) 2014.10.22 11:01:12 LOG5[34384941056]: Connection reset: 56 byte(s) sent to SSL, 56 byte(s) sent to socket 2014.10.22 11:01:12 LOG7[34384941056]: Remote socket (FD=11) closed 2014.10.22 11:01:12 LOG7[34384941056]: Local socket (FD=10) closed 2014.10.22 11:01:12 LOG7[34384941056]: Service [rsync] finished (4 left) The clients are generally field units running stunnel versions in the 4.x range. Unfortunately, updating them is not an easy task and is not really under my control. Either way, this seems like a server side issue, and possibly an issue with rsync (we're running 3.1.0). Has anyone run into anything like this before? Does anyone have any suggestions for additional debugging we can do to try to pinpoint the problem? We are going to try rolling back to stunnel-4.29 to see if the problem still occurs there on the new system. Thanks, Steve

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users October 2014