I am faling to connect to gmail. Not sure what that bind error means.
iqbala@ghar:~$ sudo stunnel4
2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes
from /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes
to /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims
sufficient entropy for the PRNG
2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for
service ssmtp
2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on
i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007
2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD
SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be
changed with 'ulimit -n')
2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE
limit for file descriptors
2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on
accept socket
2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to
74.125.93.111:587
2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign
requested address (99)
Here is how my conf file looks like
iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$"
cert = /etc/stunnel/stunnel.pem
foreground = yes
sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
pid = /stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel4/stunnel.log
client = yes
[ssmtp]
accept = smtp.gmail.com:587
connect = 25
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
5
9
Hi all,
To make "Stunnel 5.31" work with Gmail, I have to go in security settings
of Gmail and "allow less secure apps to access my account".
Is it mandatory ?
Is it possible to set Stunnel to access Gmail without lowering it security
level ?
How ?
I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider
it as a "less secure app." !
Regards,
Steve
2
1
Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 21 Dec '16
by Dmitry Bakshaev 21 Dec '16
21 Dec '16
2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>:
> Did not have a look at the code yet, but should it be possible to replace
> envvars usage by some keys in the registry on windows platform and/or
> %userprofile%/config-file ?
>
> Anyway, my opinion on the patch is that there is no real interest for
> "generic/self-expanding" config file , and it is even dangerous :
> I would not trust stunnel if, at run time, its config could be modified by
> USER envvars...
>
which difference between %userprofile%/config-file and USER envvars?
both are USER owned and USER controlled.
certificate and keys also USER private data.
and stunnel started by USER owned by USER.
if stunnel started by SYSTEM/ADMIN he uses SYSTEM/ADMIN envvars (if
needed), certs, keys, etc.
global "generic/self-expanding" config file is ADMIN owned.
USER has permissions to substitute some values, restricted by ADMIN.
2
10
08 Dec '16
Hi, there.
Base server details:
- Using the latest stunnel 5.37
- Ubuntu Trusty
- The computers communicating with each other use bridged interface addresses that are configured by the clustering software (i.e. to ensure that at least one of the nodes is master and host to some common addresses)
- For discussion purposes, let's say that each server has an eth0 and eth1, and that the master node has two additional bridged address (ie. eth0:shared-ip1, eth1:shared-ip2)
- The slave nodes will try to connect to eth0:shared-ip1:20001 and eth1:shared-ip2:20001 that are hosted on the master
- The master node will also try to connect to these as well, while listening on port 20001
- Not running in a chroot and am running stunnel as stunnel4 user
- I have created a working solution using 4 services in the stunnel config and using hard-coded destinations in the iptables rules and the stunnel config. I want to create something more dynamic and versatile.
I am trying to insert a stunnel instance between my server application that attempts to connect to its twin on another server, using the bridging addresses. I am trying to avoid hard-coding destination IP addresses in my stunnel configuration file and the iptables rules. I also don't want to have separate rules for each interface.
For example, from server A's perspective (i.e. the master node), the desirable sequence of events are:
- Attempt to connect to port 20001 using the bridge addresses as destinations (in this case, they would be local interfaces).
- Intercept the requests to port 20001 on server A and divert them to port 40000 for encryption (i.e. the local stunnel instance).
- Send unencrypted data from stunnel directly to local 20001.
At the same time, server B is doing the same, except that the bridge addresses reside on server A and are not local. So, server A would also need to do this:
- Intercept external request for port 20001 and send it to stunnel port 40000 for encryption
- Send decrypted packets to local port 20001
This same type of sequence would also be happening
My stunnel configuration looks like this:
fips=yes
pid=/var/run/stunnel4/testsrv.pid
debug=7
output=/var/log/stunnel4/testsrv.log
sslVersion = TLSv1.2
key = <private-key-location>
cert = <cert-location>
CAfile = <ca-file-location>
ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:AES256-GCM-SHA384:AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:AES128-GCM-SHA256:AES128-SHA256
[test-srv]
client=yes
accept=40000
transparent=destination
My iptables rules, base on what I read in the man page, are this:
STUNNEL_UID=$(id -u stunnel4)
# Redirect any incoming requests to port 20001
iptables -t nat -A PREROUTING -p tcp --dport 20001 ! -i lo -j DNAT --to-destination 127.0.0.1:40000
iptables -A INPUT -p tcp --dport 40000 -j ACCEPT
# Redirect any outgoing locally generated requests for 20001 to stunnel port 40000
iptables -t nat -A OUTPUT -p tcp --dport 20001 -m owner ! --uid-owner $STUNNEL_UID -j DNAT --to-destination 127.0.0.1:40000
# Redirect the output of stunnel to the local 20001 port
iptables -t nat -A OUTPUT -p tcp --dport 20001 -m owner --uid-owner $STUNNEL_UID -j REDIRECT --to-ports 20001
iptables -t nat -A INPUT -p tcp -d 127.0.0.1 --dport 20001 -j ACCEPT
These rules are not completely adequate. For now, I'm just trying to get server A's connection to port 20001 working without having to worry about incoming from server B.
When I do this and start stunnel and my process, server A's stuff appears to loop endlessly. I think this is happening because the packets that come out of stunnel, due to the transparency configuration, look exactly the same as the original. If I log stuff using iptables, I see repeat entries like this:
nat-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=150.150.242.27 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=20001 WINDOW=43690 RES=0x00 SYN URGP=0
filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0
nat-POSTROUTING: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0
filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0
filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30542 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0
filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30542 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0
nat-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=150.150.242.27 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=20001 WINDOW=43690 RES=0x00 SYN URGP=0
filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0
nat-POSTROUTING: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0
filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0
filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=48828 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0
filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=48828 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0
filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=269 TOS=0x00 PREC=0x00 TTL=64 ID=48829 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK PSH URGP=0
filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=269 TOS=0x00 PREC=0x00 TTL=64 ID=48829 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK PSH URGP=0
...
As can be seen, line 1 and line 7 are virtually identical.
In the stunnel log, I can see that stunnel is receiving multiple requests for port 20001 in rapid succession but is not actually receiving any reply from the final destination.
So, if anyone has any ideas, tweaks or suggestions for how to solve this problem or where I am going wrong, I would appreciate it. I can use a static configuration with hard-coded destination IP's but if there is an alternative, I would like to know. I have tried for several days to figure this out and have searched Google extensively, including stunnel-users postings, to figure out how to do this without success.
Thanks,
Rodney Lott
1
1
Hi there.
Dumb error I just found. Dumb because I just found it and maybe it
was earlier among us. Or maybe it is "a feature". But I'd swear it
worked as expected in the past.
Testing the new SNI option I made a mistake and I had to edit and
reload the configuration file. Nothing strange until here.
The problem is comming because I load a custom .conf file as
"stunnel.exe file.conf" for the server mode, so when a parsing error
is found, Stunnel lose the track of the custom .conf file and when
you reload the corrected configuration through the "Reload
configuration" menu option, it doesn't load the custom .conf but the
default stunnel.conf.
But before reloading, the "Edit configuration" menu option points
correctly to the correct configuration file and opens it to edit.
Only "Reload configuration" lose the track of the file.
This is happening in the windows environment (just if it wasn't clear
enough by the .exe extension ;) ). Windows 2000 (yet). I can't
tested versions beyond.
Regards.
1
0
Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility
by Jose Alf. 25 Nov '16
by Jose Alf. 25 Nov '16
25 Nov '16
Jothish,
1. You are using a very outdated version of OpenSSL (openssl 0.9.8 is EOL). I suggest you use a newer, supported version.
2. On a DOS Window, try this:openssl dhparam -rand randfile1;randfile2;randfile3 1024
where randfile1,randfile2.... are existing files or directories to use as entrophy sources. If you're on Linux you can use dd if=/dev/urandom count=2 | openssl dhparam -rand - 1024
This will print something like this:WARNING: can't open config file: c:\openssl-vc/ssl/openssl.cnf
Loading 'screen' into random state - done
0 semi-random bytes loaded
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
..+.. bla, bla....++*
unable to write 'random state'
-----BEGIN DH PARAMETERS-----
MIGHAoGBAJJ+QAYkKQd0pG1lxZKDYVZaURkTINQho8CWCUYOMp2ZEwZeMrEv+kjd
PVb4Ilnah1TmZQOxu1v8HtSWmKpclhlTDKjmDbhznUFkQhmRGjxXDCfrhnvNI4hV
kOB/3lGcWo50ttf+ZqNaXd0lKf9YfnjkRUSUtrHiMRL9CdecxQXbAgEC
-----END DH PARAMETERS-----
Now, cut from ---BEGIN... all the way to PARAMETERS--- and add it to your cert PEM file.
3. Try again, your check command: openssl dhparam -inform PEM -in ./training_client.pem -check -textShould print something like: DH Parameters: (1024 bit)
prime:
00:92:7e:40:06:24:29:07:74:a4:6d:65:c5:92:83:
...
31:12:fd:09:d7:9c:c5:05:db
generator: 2 (0x2)
DH parameters appear to be ok.
-----BEGIN DH PARAMETERS-----
MIGHAoGBAJJ+QAYkKQd0pG1lxZKDYVZaURkTINQho8CWCUYOMp2ZEwZeMrEv+kjd
....-----END DH PARAMETERS-----
4. Now, try connecting from SFDC to tibco and let us know.
SaludosJose
From: "jothish.chokkalingam(a)accenture.com" <jothish.chokkalingam(a)accenture.com>
To: josealf(a)rocketmail.com
Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org
Sent: Thursday, November 24, 2016 6:45 AM
Subject: RE: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility
#yiv9373448809 #yiv9373448809 -- _filtered #yiv9373448809 {font-family:Wingdings;panose-1:5 0 0 0 0 0 0 0 0 0;} _filtered #yiv9373448809 {panose-1:2 4 5 3 5 4 6 3 2 4;} _filtered #yiv9373448809 {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;} _filtered #yiv9373448809 {font-family:Consolas;panose-1:2 11 6 9 2 2 4 3 2 4;}#yiv9373448809 #yiv9373448809 p.yiv9373448809MsoNormal, #yiv9373448809 li.yiv9373448809MsoNormal, #yiv9373448809 div.yiv9373448809MsoNormal {margin:0in;margin-bottom:.0001pt;font-size:11.0pt;color:black;}#yiv9373448809 a:link, #yiv9373448809 span.yiv9373448809MsoHyperlink {color:#0563C1;text-decoration:underline;}#yiv9373448809 a:visited, #yiv9373448809 span.yiv9373448809MsoHyperlinkFollowed {color:#954F72;text-decoration:underline;}#yiv9373448809 p {margin-right:0in;margin-left:0in;font-size:11.0pt;color:black;}#yiv9373448809 pre {margin:0in;margin-bottom:.0001pt;font-size:10.0pt;color:black;}#yiv9373448809 p.yiv9373448809MsoListParagraph, #yiv9373448809 li.yiv9373448809MsoListParagraph, #yiv9373448809 div.yiv9373448809MsoListParagraph {margin-top:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;font-size:11.0pt;color:black;}#yiv9373448809 span.yiv9373448809HTMLPreformattedChar {font-family:Consolas;color:black;}#yiv9373448809 span.yiv9373448809EmailStyle20 {color:windowtext;}#yiv9373448809 span.yiv9373448809EmailStyle21 {color:#1F497D;}#yiv9373448809 span.yiv9373448809EmailStyle22 {color:#1F497D;}#yiv9373448809 span.yiv9373448809EmailStyle23 {color:#1F497D;}#yiv9373448809 .yiv9373448809MsoChpDefault {font-size:10.0pt;} _filtered #yiv9373448809 {margin:1.0in 1.0in 1.0in 1.0in;}#yiv9373448809 div.yiv9373448809WordSection1 {}#yiv9373448809 _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {}#yiv9373448809 ol {margin-bottom:0in;}#yiv9373448809 ul {margin-bottom:0in;}#yiv9373448809 Jose, For the issue as mentioned in below down mail I am following below two approaches, 1. Move the TLSv1.2 enabled traffic to an intermediate port and then to target port which has TLS1 enabled, in that ssl handshake from intermediate to target port getting below error. While triaging with openssl command, it is observed that the DH parameters are not proper. So we are trying to add the dh parameters C:\Users\robin.johnson\Documents\SSL\SSL>C:\openssl-0.9.8k_X64\bin\openssl dhparam -inform PEM -in ./training_client.pem -check -text unable to load DH parameters 1800:error:0906D06C:PEM routines:PEM_read_bio:no start line:.\crypto\pem\pem_lib.c:650:Expecting: DH PARAMETERS stunnel.logà2016.11.23 23:08:32 LOG3[131]: SSL_connect: 14082174: error:14082174:SSL routines:ssl3_check_cert_and_algorithm:dh key too small 2. Using https service in stunnel traffic is received by TLS V1.1 divert to non ssl enabled port. Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com From: Josealf.rm [mailto:[email protected]]
Sent: Thursday, November 24, 2016 4:36 PM
To: Chokkalingam, Jothish <jothish.chokkalingam(a)accenture.com>
Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org
Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility
Can you please elaborate? If you want us to help, you need to provide enough information. Regards Jose
El 24/11/2016, a las 5:03 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió:
Jose, J you are right.i was trying but I thought it will work as a client and it worked as a workaround. But will check for the dh key small error while forwarding the traffic with SSL from intermediate port to another port. Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com From: Josealf.rm [mailto:[email protected]]
Sent: Thursday, November 24, 2016 2:48 PM
To: Chokkalingam, Jothish <jothish.chokkalingam(a)accenture.com>
Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org
Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility Jothish,
Stunnel in server mode is what you need, with 99.9% confidence. When you write: [https] Accept=443 Connect=local host:80 Client=no Stunnnel will expect TLS connections on port 443 and will forward then to your normal web server running on loopback port 80. Is that clear? Regards, Jose
El 24/11/2016, a las 2:29 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió:
Is there a way to forward a Secure connection from one port to non secure port using stunnel. I am googling but unable to find. If you have can you let me know Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com From: stunnel-users [mailto:[email protected]]On Behalf Of Carter Browne
Sent: Wednesday, November 23, 2016 9:30 PM
To: stunnel-users(a)stunnel.org
Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility There are other tools for performing port forwarding with less overhead (I believe tappipe is one), although I make use stunnel to do this extensively. In order forward a secure connection from one port to another is a two step process with stunnel: A sample configuration segment would be: [SFDC reverse in] client = no accept = 8008 connect = localhost:48008
[SFDC reverse out]
client = yes
accept = localhost:48008
connect = localhost:8009 On 11/23/2016 10:18 AM, Rodney Lott wrote:
Hi, there.
I'm no stunnel expert, but here's my $0.05 (we have no pennies in Canada anymore ;-) ):
- I would try including the key as well as the cert in your stunnel config
- I would enable debug on the openssl s_client call to see if it will indicate why it is reseting. Same with your SFDC client to get more info.
- Question: is the "WARNING: can't open config file" message below indicative of a permissions or path problem?
- Question: Is the stunnel cert and key compatible with the TIBCO server's certificate? They need to be using certs generated from the same key source, don't they?
- You might want to fix the SSL version in the stunnel config file (i.e. sslVersion = TLSv1.2)
Good luck with your debugging.
Rodney On 2016-11-22 07:43 PM, jothish.chokkalingam(a)accenture.com wrote:
HI all, There is a problem we have currently connecting tibco client to SFDC sever via TLS v1.2 and that’s solved by using stunnel in client mode. And the communication from SFDC client to tibco server applications w.r.t TLS V1.2 I am unable to solve using stunnel. Below is the configuration in stunnel in server end to divert the traffic from 8008 to 8009, can you help here with the logs is the stunnel configuration is correct or there any missed/need to alter. [SFDC reverse proxy test] debug=7 ;client = yes accept = 8008àport used by sfdc client to connect to TIBCO server connect = localhost:8009 àTibco server that’s running cert = stunnel.pem 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] started 2016.11.23 08:31:56 LOG7[118]: Option TCP_NODELAY set on local socket 2016.11.23 08:31:56 LOG5[118]: Service [SFDC reverse proxy test] accepted connection from 101.167.198.14:54477 2016.11.23 08:31:56 LOG6[118]: Peer certificate not required 2016.11.23 08:31:56 LOG7[118]: SSL state (accept): before/accept initialization 2016.11.23 08:31:56 LOG3[118]: SSL_accept: Peer suddenly disconnected 2016.11.23 08:31:56 LOG5[118]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.11.23 08:31:56 LOG7[118]: Local descriptor (FD=696) closed 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] finished (0 left) PFB the openssl snap shot looks odd C:\Program Files (x86)\stunnel\bin>openssl s_client -connect localhost:8008 -prexit -showcerts WARNING: can't open config file: /devel/win32/openssl/openssl.cnf CONNECTED(0000016C) Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com
This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy.
______________________________________________________________________________________
www.accenture.com
_______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
_______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
_______________________________________________
stunnel-users mailing list
stunnel-users(a)stunnel.org
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
1
0
Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility
by Josealf.rm 24 Nov '16
by Josealf.rm 24 Nov '16
24 Nov '16
Can you please elaborate? If you want us to help, you need to provide enough information.
Regards
Jose
> El 24/11/2016, a las 5:03 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió:
>
> Jose,
> J you are right.i was trying but I thought it will work as a client and it worked as a workaround. But will check for the dh key small error while forwarding the traffic with SSL from intermediate port to another port.
>
> Thanks and Regards,
> Jothish
> TIBCO TSD
> Ph. : +91 44 39263958
> Mobile : +91 9884040171
> Support : +91 9962007110
> OC : jothish.chokkalingam
> Group mail:- Telstra.psm.tsd.tibco(a)accenture.com
>
> From: Josealf.rm [mailto:[email protected]]
> Sent: Thursday, November 24, 2016 2:48 PM
> To: Chokkalingam, Jothish <jothish.chokkalingam(a)accenture.com>
> Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org
> Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility
>
> Jothish,
>
> Stunnel in server mode is what you need, with 99.9% confidence.
>
> When you write:
>
> [https]
> Accept=443
> Connect=local host:80
> Client=no
>
> Stunnnel will expect TLS connections on port 443 and will forward then to your normal web server running on loopback port 80.
>
> Is that clear?
>
> Regards,
> Jose
>
> El 24/11/2016, a las 2:29 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió:
>
>
> Is there a way to forward a Secure connection from one port to non secure port using stunnel. I am googling but unable to find. If you have can you let me know
>
> Thanks and Regards,
> Jothish
> TIBCO TSD
> Ph. : +91 44 39263958
> Mobile : +91 9884040171
> Support : +91 9962007110
> OC : jothish.chokkalingam
> Group mail:- Telstra.psm.tsd.tibco(a)accenture.com
>
> From: stunnel-users [mailto:[email protected]] On Behalf Of Carter Browne
> Sent: Wednesday, November 23, 2016 9:30 PM
> To: stunnel-users(a)stunnel.org
> Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility
>
> There are other tools for performing port forwarding with less overhead (I believe tappipe is one), although I make use stunnel to do this extensively.
>
> In order forward a secure connection from one port to another is a two step process with stunnel:
>
> A sample configuration segment would be:
>
> [SFDC reverse in]
>
> client = no
>
> accept = 8008
>
> connect = localhost:48008
>
>
> [SFDC reverse out]
> client = yes
> accept = localhost:48008
> connect = localhost:8009
>
> On 11/23/2016 10:18 AM, Rodney Lott wrote:
> Hi, there.
>
> I'm no stunnel expert, but here's my $0.05 (we have no pennies in Canada anymore ;-) ):
> - I would try including the key as well as the cert in your stunnel config
> - I would enable debug on the openssl s_client call to see if it will indicate why it is reseting. Same with your SFDC client to get more info.
> - Question: is the "WARNING: can't open config file" message below indicative of a permissions or path problem?
> - Question: Is the stunnel cert and key compatible with the TIBCO server's certificate? They need to be using certs generated from the same key source, don't they?
> - You might want to fix the SSL version in the stunnel config file (i.e. sslVersion = TLSv1.2)
>
> Good luck with your debugging.
>
> Rodney
>
> On 2016-11-22 07:43 PM, jothish.chokkalingam(a)accenture.com wrote:
> HI all,
>
> There is a problem we have currently connecting tibco client to SFDC sever via TLS v1.2 and that’s solved by using stunnel in client mode. And the communication from SFDC client to tibco server applications w.r.t TLS V1.2 I am unable to solve using stunnel. Below is the configuration in stunnel in server end to divert the traffic from 8008 to 8009, can you help here with the logs is the stunnel configuration is correct or there any missed/need to alter.
>
> [SFDC reverse proxy test]
> debug=7
> ;client = yes
> accept = 8008àport used by sfdc client to connect to TIBCO server
> connect = localhost:8009 àTibco server that’s running
> cert = stunnel.pem
> 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] started
> 2016.11.23 08:31:56 LOG7[118]: Option TCP_NODELAY set on local socket
> 2016.11.23 08:31:56 LOG5[118]: Service [SFDC reverse proxy test] accepted connection from 101.167.198.14:54477
> 2016.11.23 08:31:56 LOG6[118]: Peer certificate not required
> 2016.11.23 08:31:56 LOG7[118]: SSL state (accept): before/accept initialization
> 2016.11.23 08:31:56 LOG3[118]: SSL_accept: Peer suddenly disconnected
> 2016.11.23 08:31:56 LOG5[118]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
> 2016.11.23 08:31:56 LOG7[118]: Local descriptor (FD=696) closed
> 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] finished (0 left)
>
> PFB the openssl snap shot looks odd
> C:\Program Files (x86)\stunnel\bin>openssl s_client -connect localhost:8008 -prexit -showcerts
> WARNING: can't open config file: /devel/win32/openssl/openssl.cnf
> CONNECTED(0000016C)
>
> Thanks and Regards,
> Jothish
> TIBCO TSD
> Ph. : +91 44 39263958
> Mobile : +91 9884040171
> Support : +91 9962007110
> OC : jothish.chokkalingam
> Group mail:- Telstra.psm.tsd.tibco(a)accenture.com
>
>
>
> This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy.
> ______________________________________________________________________________________
>
> www.accenture.com
>
>
>
>
> _______________________________________________
> stunnel-users mailing list
> stunnel-users(a)stunnel.org
> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
>
>
>
>
>
> _______________________________________________
> stunnel-users mailing list
> stunnel-users(a)stunnel.org
> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
>
> _______________________________________________
> stunnel-users mailing list
> stunnel-users(a)stunnel.org
> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
1
0
Help in setting stunnel in server mode to over come TLSV2 compatibility
by jothish.chokkalingam＠accenture.com 24 Nov '16
by jothish.chokkalingam＠accenture.com 24 Nov '16
24 Nov '16
HI all,
There is a problem we have currently connecting tibco client to SFDC sever via TLS v1.2 and that's solved by using stunnel in client mode. And the communication from SFDC client to tibco server applications w.r.t TLS V1.2 I am unable to solve using stunnel. Below is the configuration in stunnel in server end to divert the traffic from 8008 to 8009, can you help here with the logs is the stunnel configuration is correct or there any missed/need to alter.
[SFDC reverse proxy test]
debug=7
;client = yes
accept = 8008-->port used by sfdc client to connect to TIBCO server
connect = localhost:8009 -->Tibco server that's running
cert = stunnel.pem
2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] started
2016.11.23 08:31:56 LOG7[118]: Option TCP_NODELAY set on local socket
2016.11.23 08:31:56 LOG5[118]: Service [SFDC reverse proxy test] accepted connection from 101.167.198.14:54477
2016.11.23 08:31:56 LOG6[118]: Peer certificate not required
2016.11.23 08:31:56 LOG7[118]: SSL state (accept): before/accept initialization
2016.11.23 08:31:56 LOG3[118]: SSL_accept: Peer suddenly disconnected
2016.11.23 08:31:56 LOG5[118]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2016.11.23 08:31:56 LOG7[118]: Local descriptor (FD=696) closed
2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] finished (0 left)
PFB the openssl snap shot looks odd
C:\Program Files (x86)\stunnel\bin>openssl s_client -connect localhost:8008 -prexit -showcerts
WARNING: can't open config file: /devel/win32/openssl/openssl.cnf
CONNECTED(0000016C)
Thanks and Regards,
Jothish
TIBCO TSD
Ph. : +91 44 39263958
Mobile : +91 9884040171
Support : +91 9962007110
OC : jothish.chokkalingam
Group mail:- Telstra.psm.tsd.tibco(a)accenture.com
________________________________
This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy.
______________________________________________________________________________________
www.accenture.com
4
4
With the distrubuted version of stunnel, there is an uninstall.exe
Are there any options for this uninstaller, so I can automate removal and upgrade processes ? Like a /quiet or /Q ?? Which uninstaller application is this based off of?
1
0
18 Nov '16
Hi,
the server I connect to using stunnel has just been upgraded to IPv6.
In the process an AAAA record was added to its DNS entry. The box I run
stunnel on is IPv4-only, meaning, the kernel does not have any IPv6
support at all. The DNS stub resolver is still looking for AAAA records
though. Consequently stunnel connections now fail about half of the time
with error:
2016.11.18 20:10:57 LOG3[ui]: remote socket: Address family not
supported by protocol (97)
>From looking at client.c I can see that stunnel supports trying all
target addresses in turn but will bail if the socket cannot be created:
for(ind_try=0; ind_try<c->connect_addr.num; ind_try++) {
c->fd=s_socket(c->connect_addr.addr[ind_cur].sa.sa_family,
SOCK_STREAM, 0, 1, "remote socket");
if(c->fd==INVALID_SOCKET)
longjmp(c->err, 1);
[...]
if(s_connect(c, &c->connect_addr.addr[ind_cur],
[...]
continue; /* next IP */
}
[...]
return fd; /* success! */
So I guess the problem would go away if I enabled IPv6 in the kernel of
my client box: s_socket() would succeed but connect() would fail with
ENETUNREACH.
But couldn't stunnel just continue with the next IP if s_socket() failed
with EAFNOSUPPORT?
--
Thanks,
Michael
1
0