September 2015 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 10 Dec '20

10 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Windows Mobile 6.5
by Jeffrey McCain 19 Oct '15

19 Oct '15

Hello, Does Anyone know if the makece.bat for ARM actually functions anymore? I'd like to build the latest possible version of stunnel for a client that uses Window Mobile 6.5, but not if I have to go back to stunnel version 4.15, which appears to be the last time someone built binaries for it... Thanks! Jeff.

4 7

Log File Not Appending
by K Monz 06 Oct '15

06 Oct '15

Hi, I am a new STUNNEL user, so I apologize if this is a ridiculously simple and insignificant problem. I have STUNNEL running in a Windows 7 (32 bit) environment, and have the following in stunnel.conf: output = C:\STUNNEL\stunnel.log log = append The log file is placed where I've asked, but the contents represent only the most current STUNNEL execution. I am trying to have a running log in this file. STUNNEL is, of course, doing what it is supposed to do, it is only the logging that has me puzzled. Thanks, in advance.

2 1

Support for DTLS
by Kanungo, Rajesh 25 Sep '15

25 Sep '15

Hi, I am looking for support for a DTLS proxy. Does Stunnel support DTLS and, if yes, how do I configure it? Here is the scenario: 1. Remote Server supports DTLS. 2. My client does not support DTLS (yet). Support all our platforms is a pretty arduous task. Possible solutions: 1. Ask customer to use Stunnel, drop DTLS and use plain UDP, and use Stunnel/TCP. Other clients support only DTLS so this does not work. 2. Use VPN. Requires customer configuration. Less painful than 1. 3. Use a UDP-DTLS proxy. Regards Rajesh Kanungo North America Security CTO Department, Itron, Inc. (408) 431-3035 Rajesh.kanungo(a)itron.com

1 0

Missing pid from log file since ~5.19
by Philippe Anctil 17 Sep '15

17 Sep '15

Hi, After upgrading to stunnel 5.19 I noticed the log file no long reports the pid of stunnel processes. Instead I find the constant string [0]. Sep 14 12:15:30 hostname stunnel: LOG6[0]: SSL closed (SSL_read) This information is very useful to isolate individual connections. Do later stunnel versions report the pid correctly? I am using fork mode. My syslog is defined as local6.debug and stunnel.conf contains debug=local6.info. Thank you. -- Philippe Anctil

2 3

How to install CA at client side?
by MingHeng Wang 15 Sep '15

15 Sep '15

Hello Stunnel maintainers, I try to use real certificates of my web server for stunnel. I combine private key, my site's cert, and ca-bundle into a pem file, and it works fine when the client doesn't verify any certificate. Then I specify CAfile which is the ca bundle file from my registrar, at client side and turn on verification and always get errors below, whatever level 2 or 3: Sep 15 14:53:28 y400 stunnel[11666]: LOG5[11]: Service [http-proxy3] connected remote server from 192.168.1.104:45746 Sep 15 14:53:28 y400 stunnel[11666]: LOG4[11]: CERT: Pre-verification error: unable to get issuer certificate Sep 15 14:53:28 y400 stunnel[11666]: LOG4[11]: Rejected by CERT at depth=2: However, level 4 works. I want to prevent man-in-middle-attack, so can level 4 achieve that regarding to my current setup? Both server and client side use stunnel 5.17 which are fairly recent.

2 1

Windows 2012 R2 Error on startup
by Han-Earl Guhm 12 Sep '15

12 Sep '15

I installed the latest version of stunnel and am having problems starting it up. I have attached an error log and my config file. I tested on Windows 7 and it worked with no problems, but I would really like it to work on my Windows 2012 server. Thank you, Han-Earl Guhm Coventry Christian Schools hanguhm(a)educatingforlife.com

2 1

The Error with Engine
by Donne, Ann 08 Sep '15

08 Sep '15

Hi all, Need your help. When I configured the Stunnel without the Engine LunaCA3 (product from SafeNet), everything worked fine. After add the global option with the engine: engine=LunaCA3 engineCtrl=SO_PATH:/usr/local/ssl/lib/engines/liblunaca3.so I got the following error. I also searched previous engine issues and saw someone else with the similar issues. Hope that the issue was resolved. The Stunnel and the open SSL info: stunnel 5.20 on x86_64 Linux. Compiled/running with OpenSSL 1.0.1i-fips. The setting is for server with sslVersion = TLSv1 and ciphers = AES128-SHA. 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read client certificate A 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A 2015.09.08 11:11:01 LOG7[0]: SSL alert (write): fatal: bad record mac 2015.09.08 11:11:01 LOG3[0]: SSL_accept: 1408F119: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2015.09.08 11:11:01 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.09.08 11:11:01 LOG7[0]: Deallocating application specific data for addr index 2015.09.08 11:11:01 LOG7[0]: Local socket (FD=3) closed Any help and info are greatly appreciated!! Thanks Ann Donne ---------------------------------------------------------------------- This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer. If you are not the intended recipient, please delete this message.

1 0

stunnel 5.23 released
by Michal Trojnara 02 Sep '15

02 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.23 of stunnel. The ChangeLog entry: Version 5.23, 2015.09.02, urgency: LOW * New features - Client-side support for the SOCKS protocol. See https://www.stunnel.org/socksvpn.html for details. - Reject SOCKS requests to connect loopback addresses. - New service-level option "OCSPnonce". The default value is "OCSPnonce = no". - Win32 directory structure rearranged. The installer script provides automatic migration for common setups. - Added Win32 installer option to install stunnel for the current user only. This feature does not deploy the NT service, but it also does not require aministrative privileges to install and configure stunnel. - stunnel.cnf was renamed to openssl.cnf in order to to prevent users from mixing it up with stunnel.conf. - Win32 desktop is automatically refreshed when the icon is created or removed. - The ca-certs.pem file is now updated on stunnel upgrade. - Inactive ports were removed from the PORTS file. - Added IPv6 support to the transparent proxy code. * Bugfixes - Compilation fix for OpenSSL version older than 1.0.0. - Compilation fix for mingw. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0fc4a702afd2e857bae8ad1f39c51546eb282c3d0ff4f4d55d62aece7328ddea stunnel-5.23.tar.gz 40739ac4124bbe5192d7f68b020758295586ae65a16c1612829bffd1d3873363 stunnel-5.23-installer.exe 001e7d0a6d53b05b64fe62b0ca0623077d89f090b473e2cabed1eafa49196725 stunnel-5.23-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJV5q76AAoJEC78f/DUFuAUG54P/2ycqSOKbP3CN1MMKJj9NxBM 1uDuv/voF9OT/Y064X2bjy6dApo5HA9a4VHr1EaF+3x+Wofemhc5puLsgbfuFJKl nogN8cNdR2sk+GLooytfKp+jRZ8NAl2Rv5lLi/YE57RsMe91wI5kRxWKpeIDeG4L y7LhsCLmHNYkffsGSeOaXfc3rBBWOY39Lc78t3kezK14jIGZiCH/V32HRHMaWGiw 9oLBIRxGOVAscKcC2+MOGtXelKeJFrnAfW+v6qcZE1/SL4JnGHz8jBxOcvFbfrko 5yJfWYpgQg7NeLNovY+o1EXVxxw4Ty9ppLob9cRTGmx1Fgb6eE1uYVSAbx53lYKF 2z0J2MkKgMj07Mao5j45DiqRqa/kWDzKIN4sTCm5atDKB2ozrcfuDLLEU3W6XKrw 7XHPSs+FdkXQXYsfK7wbftLKfNEu8ojGKyMTMuKQcX/SkxyQuV6rYXA8gBm3HJCY dNp5lU5FdoiMv9S+uQpDL2j9GjOSNAV7qPzyRk8ivl1a1LonkbjQxHApvktSwkHt Gey6xweW5vt7FsKb15mFhx6ctBldM9lR7u4EacXWy+hq5UY6/5Rr/rbyCkCvG/NU Oq5LD2bqX22Xl4XeiVCW2gpLcqPWdbREY3YklGt22ln+PdyA+iGpxbeczUHjV5qX a6P76JpGk/pL5lhWfRV4 =i2gK -----END PGP SIGNATURE-----

1 0