I am faling to connect to gmail. Not sure what that bind error means.
iqbala@ghar:~$ sudo stunnel4
2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes
from /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes
to /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims
sufficient entropy for the PRNG
2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for
service ssmtp
2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on
i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007
2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD
SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be
changed with 'ulimit -n')
2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE
limit for file descriptors
2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on
accept socket
2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to
74.125.93.111:587
2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign
requested address (99)
Here is how my conf file looks like
iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$"
cert = /etc/stunnel/stunnel.pem
foreground = yes
sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
pid = /stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel4/stunnel.log
client = yes
[ssmtp]
accept = smtp.gmail.com:587
connect = 25
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
5
9
Hi all,
To make "Stunnel 5.31" work with Gmail, I have to go in security settings
of Gmail and "allow less secure apps to access my account".
Is it mandatory ?
Is it possible to set Stunnel to access Gmail without lowering it security
level ?
How ?
I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider
it as a "less secure app." !
Regards,
Steve
2
1
Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 21 Dec '16
by Dmitry Bakshaev 21 Dec '16
21 Dec '16
2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>:
> Did not have a look at the code yet, but should it be possible to replace
> envvars usage by some keys in the registry on windows platform and/or
> %userprofile%/config-file ?
>
> Anyway, my opinion on the patch is that there is no real interest for
> "generic/self-expanding" config file , and it is even dangerous :
> I would not trust stunnel if, at run time, its config could be modified by
> USER envvars...
>
which difference between %userprofile%/config-file and USER envvars?
both are USER owned and USER controlled.
certificate and keys also USER private data.
and stunnel started by USER owned by USER.
if stunnel started by SYSTEM/ADMIN he uses SYSTEM/ADMIN envvars (if
needed), certs, keys, etc.
global "generic/self-expanding" config file is ADMIN owned.
USER has permissions to substitute some values, restricted by ADMIN.
2
10
Is there any way to configure a Stunnel server so that it doesn’t require a cert at all?
I implement peer authentication using other means; I just want session encryption from Stunnel.
Ideally, I’d like keys to be generated on-the-fly for each new connection. I don’t mind if this takes a few seconds…
Thanks, Dave.
1
0
Hi Guys,
To me this looks like a cipher issue.
There are a few options that you can try to resolve this if it is.
I would try adding the following lines into your STunnel Configuration file:
delay = yes
options = NO_SSLv2
options = NO_SSLv3
options = NO_TLSv1
options = CIPHER_SERVER_PREFERENCE
options = DONT_INSERT_EMPTY_FRAGMENTS
Delay will delay and DNS lookups that maybe actioned by the request (not
normally needed but I always include if for sanity sake)
The three 'options' sections turn off all the known problematic cipher
lists if you need a key that is in one of these block feel free to remove
that directive but I think a good start would be to leave the 'NO_SSLv3'
option in place
The 'CIPHER_SERVER_PREFERENCE' option will make set whether the client is
allowed to renegotiat the ciphers that are to be used between the client
and the server process.
And finally 'DONT_INSERT_EMPTY_FRAGMENTS' will mitigate an issue in the CBC
ciphers that was in the SSLv3 and TLS1.0 cipher lists again I only include
it for sanity sake now but its better to have than to go without.
--
With Kind Regards.
Scott McKeown
Loadbalancer.org
http://www.loadbalancer.org
Tel (UK) - +44 (0) 3303801064 (24x7)
Tel (US) - +1 888.867.9504 (Toll Free)(24x7)
2
1
Can I be please removed from the mailing list?
Sent from my iPhone
> On Sep 16, 2016, at 12:14 PM, stunnel-users-request(a)stunnel.org wrote:
>
> Send stunnel-users mailing list submissions to
> stunnel-users(a)stunnel.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
> or, via email, send a message with subject or body 'help' to
> stunnel-users-request(a)stunnel.org
>
> You can reach the person managing the list at
> stunnel-users-owner(a)stunnel.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of stunnel-users digest..."
>
>
> Today's Topics:
>
> 1. Re: compilation error with stunnel-5.35 (Josealf.rm)
> 2. Re: compilation error with stunnel-5.35 (Viorel Panaite)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Fri, 16 Sep 2016 13:04:09 -0500
> From: "Josealf.rm" <josealf(a)rocketmail.com>
> To: Viorel Panaite <Viorel.Panaite(a)tecsys.com>
> Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org>
> Subject: Re: [stunnel-users] compilation error with stunnel-5.35
> Message-ID: <6CE9A3F0-EE74-4CF0-ACCE-C5941B6B40A2(a)rocketmail.com>
> Content-Type: text/plain; charset="utf-8"
>
>
> Visorel,
>
> Did you compile OpenSSL yourself? Did you enable shared library support?
> Maybe you system is picking system installed OpenSSL headers (0.9.8) instead of the new ones.
>
> Regards
> Jose
>
>
> Enviado desde mi iPhone
>> El 16/09/2016, a las 9:39 a.m., Viorel Panaite <Viorel.Panaite(a)tecsys.com> escribió:
>>
>> I downloaded stunnel-5.35 and I’m trying to compile using openssl-1.0.2h on RedHat EL linux 5.4
>>
>> I get this error when I’m trying to compile them together,
>>
>> Configure log
>> ./configure --prefix=/apps/stunnel/535 --with-ssl=/apps/openssl/1.0.2h/
>> …………………….
>> hecking for broken poll() implementation... no
>> checking for pipe2... no
>> checking for accept4... no
>> configure: **************************************** optional features
>> checking whether to enable IPv6 support... yes (default)
>> checking whether to enable FIPS support... autodetecting
>> checking whether to enable systemd socket activation support... autodetecting
>> checking for library containing sd_listen_fds... no
>> configure: systemd library not found
>> checking whether to enable TCP wrappers support... autodetecting
>> checking for hosts_access in -lwrap... yes
>> configure: libwrap support enabled
>> configure: **************************************** SSL
>> checking for compiler sysroot... /
>> checking for SSL directory... /apps/openssl/1.0.2h/
>> checking for FIPS_mode_set... yes
>> configure: FIPS support enabled
>> configure: **************************************** write the results
>> checking that generated files are newer than configure... done
>> configure: creating ./config.status
>> config.status: creating Makefile
>> config.status: creating src/Makefile
>> config.status: creating doc/Makefile
>> config.status: creating tools/Makefile
>> config.status: creating src/config.h
>> config.status: src/config.h is unchanged
>> config.status: executing depfiles commands
>> config.status: executing libtool commands
>> configure: **************************************** success
>>
>> make log
>>
>> [root@mybox stunnel-5.35]# make
>> Making all in src
>> make[1]: Entering directory `/apps/stunnel/stunnel-5.35/src'
>> make all-am
>> make[2]: Entering directory `/apps/stunnel/stunnel-5.35/src'
>> CCLD stunnel
>> /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libssl.a when searching for -lssl
>> /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libcrypto.a when searching for -lcrypto
>> stunnel-client.o: In function `client_run':
>> /apps/stunnel/stunnel-5.35/src/client.c:201: undefined reference to `ERR_remove_thread_state'
>> stunnel-options.o: In function `parse_service_option':
>> /apps/stunnel/stunnel-5.35/src/options.c:2669: undefined reference to `TLSv1_2_client_method'
>> /apps/stunnel/stunnel-5.35/src/options.c:2670: undefined reference to `TLSv1_2_server_method'
>> /apps/stunnel/stunnel-5.35/src/options.c:2662: undefined reference to `TLSv1_1_client_method'
>> /apps/stunnel/stunnel-5.35/src/options.c:2663: undefined reference to `TLSv1_1_server_method'
>> stunnel-ctx.o: In function `auth_init':
>> /apps/stunnel/stunnel-5.35/src/ctx.c:442: undefined reference to `SSL_CTX_set_psk_server_callback'
>> stunnel-ctx.o: In function `context_init':
>> /apps/stunnel/stunnel-5.35/src/ctx.c:133: undefined reference to `SSL_CTX_set_client_cert_engine'
>> stunnel-ctx.o: In function `auth_init':
>> /apps/stunnel/stunnel-5.35/src/ctx.c:440: undefined reference to `SSL_CTX_set_psk_client_callback'
>> stunnel-ctx.o: In function `conf_init':
>> /apps/stunnel/stunnel-5.35/src/ctx.c:376: undefined reference to `SSL_CONF_CTX_new'
>> /apps/stunnel/stunnel-5.35/src/ctx.c:381: undefined reference to `SSL_CONF_CTX_set_ssl_ctx'
>> /apps/stunnel/stunnel-5.35/src/ctx.c:382: undefined reference to `SSL_CONF_CTX_set_flags'
>> /apps/stunnel/stunnel-5.35/src/ctx.c:383: undefined reference to `SSL_CONF_CTX_set_flags'
>> /apps/stunnel/stunnel-5.35/src/ctx.c:385: undefined reference to `SSL_CONF_CTX_set_flags'
>> /apps/stunnel/stunnel-5.35/src/ctx.c:392: undefined reference to `SSL_CONF_cmd'
>> /apps/stunnel/stunnel-5.35/src/ctx.c:420: undefined reference to `SSL_CONF_CTX_finish'
>> /apps/stunnel/stunnel-5.35/src/ctx.c:422: undefined reference to `SSL_CONF_CTX_free'
>> stunnel-ctx.o: In function `ecdh_init':
>> /apps/stunnel/stunnel-5.35/src/ctx.c:351: undefined reference to `EC_KEY_new_by_curve_name'
>> /apps/stunnel/stunnel-5.35/src/ctx.c:359: undefined reference to `EC_KEY_free'
>> stunnel-ctx.o: In function `conf_init':
>> /apps/stunnel/stunnel-5.35/src/ctx.c:414: undefined reference to `SSL_CONF_CTX_free'
>> /apps/stunnel/stunnel-5.35/src/ctx.c:409: undefined reference to `SSL_CONF_CTX_free'
>> /apps/stunnel/stunnel-5.35/src/ctx.c:425: undefined reference to `SSL_CONF_CTX_free'
>> stunnel-ctx.o: In function `servername_cb':
>> /apps/stunnel/stunnel-5.35/src/ctx.c:229: undefined reference to `SSL_get_servername'
>> /apps/stunnel/stunnel-5.35/src/ctx.c:253: undefined reference to `SSL_set_SSL_CTX'
>> stunnel-verify.o: In function `ocsp_request':
>> /apps/stunnel/stunnel-5.35/src/verify.c:499: undefined reference to `OCSP_CERTID_dup'
>> stunnel-verify.o: In function `ocsp_get_response':
>> /apps/stunnel/stunnel-5.35/src/verify.c:614: undefined reference to `OCSP_sendreq_new'
>> /apps/stunnel/stunnel-5.35/src/verify.c:625: undefined reference to `OCSP_REQ_CTX_add1_header'
>> /apps/stunnel/stunnel-5.35/src/verify.c:629: undefined reference to `OCSP_REQ_CTX_add1_header'
>> /apps/stunnel/stunnel-5.35/src/verify.c:634: undefined reference to `OCSP_REQ_CTX_set1_req'
>> /apps/stunnel/stunnel-5.35/src/verify.c:641: undefined reference to `OCSP_sendreq_nbio'
>> /apps/stunnel/stunnel-5.35/src/verify.c:668: undefined reference to `OCSP_REQ_CTX_free'
>> stunnel-verify.o: In function `cert_check_subject':
>> /apps/stunnel/stunnel-5.35/src/verify.c:299: undefined reference to `X509_check_host'
>> stunnel-verify.o: In function `ocsp_check':
>> /apps/stunnel/stunnel-5.35/src/verify.c:457: undefined reference to `X509_get1_ocsp'
>> stunnel-verify.o: In function `cert_check_subject':
>> /apps/stunnel/stunnel-5.35/src/verify.c:312: undefined reference to `X509_check_email'
>> /apps/stunnel/stunnel-5.35/src/verify.c:323: undefined reference to `X509_check_ip_asc'
>> stunnel-verify.o: In function `cert_check_local':
>> /apps/stunnel/stunnel-5.35/src/verify.c:356: undefined reference to `X509_STORE_get1_certs'
>> stunnel-sthreads.o: In function `sthreads_init':
>> /apps/stunnel/stunnel-5.35/src/sthreads.c:287: undefined reference to `CRYPTO_THREADID_set_callback'
>> stunnel-sthreads.o: In function `threadid_func':
>> /apps/stunnel/stunnel-5.35/src/sthreads.c:268: undefined reference to `CRYPTO_THREADID_set_numeric'
>> collect2: ld returned 1 exit status
>> make[2]: *** [stunnel] Error 1
>> make[2]: Leaving directory `/apps/stunnel/stunnel-5.35/src'
>> make[1]: *** [all] Error 2
>> make[1]: Leaving directory `/apps/stunnel/stunnel-5.35/src'
>> make: *** [all-recursive] Error 1
>>
>> Thanks for your help.
>>
>>
>> _______________________________________________
>> stunnel-users mailing list
>> stunnel-users(a)stunnel.org
>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
>
2
1
I downloaded stunnel-5.35 and I'm trying to compile using openssl-1.0.2h on RedHat EL linux 5.4
I get this error when I'm trying to compile them together,
Configure log
./configure --prefix=/apps/stunnel/535 --with-ssl=/apps/openssl/1.0.2h/
.........................
hecking for broken poll() implementation... no
checking for pipe2... no
checking for accept4... no
configure: **************************************** optional features
checking whether to enable IPv6 support... yes (default)
checking whether to enable FIPS support... autodetecting
checking whether to enable systemd socket activation support... autodetecting
checking for library containing sd_listen_fds... no
configure: systemd library not found
checking whether to enable TCP wrappers support... autodetecting
checking for hosts_access in -lwrap... yes
configure: libwrap support enabled
configure: **************************************** SSL
checking for compiler sysroot... /
checking for SSL directory... /apps/openssl/1.0.2h/
checking for FIPS_mode_set... yes
configure: FIPS support enabled
configure: **************************************** write the results
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating src/Makefile
config.status: creating doc/Makefile
config.status: creating tools/Makefile
config.status: creating src/config.h
config.status: src/config.h is unchanged
config.status: executing depfiles commands
config.status: executing libtool commands
configure: **************************************** success
make log
[root@mybox stunnel-5.35]# make
Making all in src
make[1]: Entering directory `/apps/stunnel/stunnel-5.35/src'
make all-am
make[2]: Entering directory `/apps/stunnel/stunnel-5.35/src'
CCLD stunnel
/usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libssl.a when searching for -lssl
/usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libcrypto.a when searching for -lcrypto
stunnel-client.o: In function `client_run':
/apps/stunnel/stunnel-5.35/src/client.c:201: undefined reference to `ERR_remove_thread_state'
stunnel-options.o: In function `parse_service_option':
/apps/stunnel/stunnel-5.35/src/options.c:2669: undefined reference to `TLSv1_2_client_method'
/apps/stunnel/stunnel-5.35/src/options.c:2670: undefined reference to `TLSv1_2_server_method'
/apps/stunnel/stunnel-5.35/src/options.c:2662: undefined reference to `TLSv1_1_client_method'
/apps/stunnel/stunnel-5.35/src/options.c:2663: undefined reference to `TLSv1_1_server_method'
stunnel-ctx.o: In function `auth_init':
/apps/stunnel/stunnel-5.35/src/ctx.c:442: undefined reference to `SSL_CTX_set_psk_server_callback'
stunnel-ctx.o: In function `context_init':
/apps/stunnel/stunnel-5.35/src/ctx.c:133: undefined reference to `SSL_CTX_set_client_cert_engine'
stunnel-ctx.o: In function `auth_init':
/apps/stunnel/stunnel-5.35/src/ctx.c:440: undefined reference to `SSL_CTX_set_psk_client_callback'
stunnel-ctx.o: In function `conf_init':
/apps/stunnel/stunnel-5.35/src/ctx.c:376: undefined reference to `SSL_CONF_CTX_new'
/apps/stunnel/stunnel-5.35/src/ctx.c:381: undefined reference to `SSL_CONF_CTX_set_ssl_ctx'
/apps/stunnel/stunnel-5.35/src/ctx.c:382: undefined reference to `SSL_CONF_CTX_set_flags'
/apps/stunnel/stunnel-5.35/src/ctx.c:383: undefined reference to `SSL_CONF_CTX_set_flags'
/apps/stunnel/stunnel-5.35/src/ctx.c:385: undefined reference to `SSL_CONF_CTX_set_flags'
/apps/stunnel/stunnel-5.35/src/ctx.c:392: undefined reference to `SSL_CONF_cmd'
/apps/stunnel/stunnel-5.35/src/ctx.c:420: undefined reference to `SSL_CONF_CTX_finish'
/apps/stunnel/stunnel-5.35/src/ctx.c:422: undefined reference to `SSL_CONF_CTX_free'
stunnel-ctx.o: In function `ecdh_init':
/apps/stunnel/stunnel-5.35/src/ctx.c:351: undefined reference to `EC_KEY_new_by_curve_name'
/apps/stunnel/stunnel-5.35/src/ctx.c:359: undefined reference to `EC_KEY_free'
stunnel-ctx.o: In function `conf_init':
/apps/stunnel/stunnel-5.35/src/ctx.c:414: undefined reference to `SSL_CONF_CTX_free'
/apps/stunnel/stunnel-5.35/src/ctx.c:409: undefined reference to `SSL_CONF_CTX_free'
/apps/stunnel/stunnel-5.35/src/ctx.c:425: undefined reference to `SSL_CONF_CTX_free'
stunnel-ctx.o: In function `servername_cb':
/apps/stunnel/stunnel-5.35/src/ctx.c:229: undefined reference to `SSL_get_servername'
/apps/stunnel/stunnel-5.35/src/ctx.c:253: undefined reference to `SSL_set_SSL_CTX'
stunnel-verify.o: In function `ocsp_request':
/apps/stunnel/stunnel-5.35/src/verify.c:499: undefined reference to `OCSP_CERTID_dup'
stunnel-verify.o: In function `ocsp_get_response':
/apps/stunnel/stunnel-5.35/src/verify.c:614: undefined reference to `OCSP_sendreq_new'
/apps/stunnel/stunnel-5.35/src/verify.c:625: undefined reference to `OCSP_REQ_CTX_add1_header'
/apps/stunnel/stunnel-5.35/src/verify.c:629: undefined reference to `OCSP_REQ_CTX_add1_header'
/apps/stunnel/stunnel-5.35/src/verify.c:634: undefined reference to `OCSP_REQ_CTX_set1_req'
/apps/stunnel/stunnel-5.35/src/verify.c:641: undefined reference to `OCSP_sendreq_nbio'
/apps/stunnel/stunnel-5.35/src/verify.c:668: undefined reference to `OCSP_REQ_CTX_free'
stunnel-verify.o: In function `cert_check_subject':
/apps/stunnel/stunnel-5.35/src/verify.c:299: undefined reference to `X509_check_host'
stunnel-verify.o: In function `ocsp_check':
/apps/stunnel/stunnel-5.35/src/verify.c:457: undefined reference to `X509_get1_ocsp'
stunnel-verify.o: In function `cert_check_subject':
/apps/stunnel/stunnel-5.35/src/verify.c:312: undefined reference to `X509_check_email'
/apps/stunnel/stunnel-5.35/src/verify.c:323: undefined reference to `X509_check_ip_asc'
stunnel-verify.o: In function `cert_check_local':
/apps/stunnel/stunnel-5.35/src/verify.c:356: undefined reference to `X509_STORE_get1_certs'
stunnel-sthreads.o: In function `sthreads_init':
/apps/stunnel/stunnel-5.35/src/sthreads.c:287: undefined reference to `CRYPTO_THREADID_set_callback'
stunnel-sthreads.o: In function `threadid_func':
/apps/stunnel/stunnel-5.35/src/sthreads.c:268: undefined reference to `CRYPTO_THREADID_set_numeric'
collect2: ld returned 1 exit status
make[2]: *** [stunnel] Error 1
make[2]: Leaving directory `/apps/stunnel/stunnel-5.35/src'
make[1]: *** [all] Error 2
make[1]: Leaving directory `/apps/stunnel/stunnel-5.35/src'
make: *** [all-recursive] Error 1
Thanks for your help.
2
2
My Stunnel client gets to this point, then hangs indefinitely:
SSL state (connect): SSLv2/v3 write client hello A
Is this a fault with Stunnel or is it something I’m doing wrong
Full client-side output:
"""""""""""""""""""
Last login: Wed Sep 14 06:50:40 on ttys004
Daves-MBP-2016:~ dave$ /Users/dave/Desktop/stunnel-test/stunnel /Users/dave/Desktop/stunnel-test/stunnel-sender.conf
2016.09.14 06:54:35 LOG7[ui]: Clients allowed=125
2016.09.14 06:54:35 LOG7[cron]: Cron thread initialized
2016.09.14 06:54:35 LOG5[ui]: stunnel 5.35 on x86_64-apple-darwin15.4.0 platform
2016.09.14 06:54:35 LOG5[ui]: Compiled with OpenSSL 0.9.8zd 8 Jan 2015
2016.09.14 06:54:35 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016
2016.09.14 06:54:35 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel
2016.09.14 06:54:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI
2016.09.14 06:54:35 LOG7[ui]: errno: (*__error())
2016.09.14 06:54:35 LOG5[ui]: Reading configuration from file /Users/dave/Desktop/stunnel-test/stunnel-sender.conf
2016.09.14 06:54:35 LOG5[ui]: UTF-8 byte order mark not detected
2016.09.14 06:54:35 LOG7[ui]: Compression disabled
2016.09.14 06:54:35 LOG7[ui]: Snagged 64 random bytes from /Users/dave/.rnd
2016.09.14 06:54:35 LOG7[ui]: Wrote 1024 new random bytes to /Users/dave/.rnd
2016.09.14 06:54:35 LOG7[ui]: PRNG seeded successfully
2016.09.14 06:54:35 LOG6[ui]: Initializing inetd mode configuration
2016.09.14 06:54:35 LOG6[ui]: Loading certificate from file: /Users/dave/Desktop/stunnel-test/cert.pem
2016.09.14 06:54:35 LOG6[ui]: Certificate loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem
2016.09.14 06:54:35 LOG6[ui]: Loading private key from file: /Users/dave/Desktop/stunnel-test/cert.pem
2016.09.14 06:54:35 LOG4[ui]: Insecure file permissions on /Users/dave/Desktop/stunnel-test/cert.pem
2016.09.14 06:54:35 LOG6[ui]: Private key loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem
2016.09.14 06:54:35 LOG7[ui]: Private key check succeeded
2016.09.14 06:54:35 LOG4[ui]: Service [stunnel] needs authentication to prevent MITM attacks
2016.09.14 06:54:35 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000)
2016.09.14 06:54:35 LOG5[ui]: Configuration successful
2016.09.14 06:54:35 LOG7[ui]: Service [stunnel] started
2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] accepted connection
2016.09.14 06:54:35 LOG6[ui]: failover: round-robin, starting at entry #0
2016.09.14 06:54:35 LOG6[ui]: s_connect: connecting ::1:874
2016.09.14 06:54:35 LOG7[ui]: s_connect: s_poll_wait ::1:874: waiting 10 seconds
2016.09.14 06:54:35 LOG5[ui]: s_connect: connected ::1:874
2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] connected remote server from ::1:51362
2016.09.14 06:54:35 LOG7[ui]: Option TCP_NODELAY set on remote socket
2016.09.14 06:54:35 LOG7[ui]: Remote descriptor (FD=3) initialized
2016.09.14 06:54:35 LOG6[ui]: SNI: sending servername: localhost
2016.09.14 06:54:35 LOG6[ui]: Peer certificate not required
2016.09.14 06:54:35 LOG7[ui]: SSL state (connect): before/connect initialization
2016.09.14 06:54:35 LOG7[ui]: SSL state (connect): SSLv2/v3 write client hello A
^C
Daves-MBP-2016:~ dave$
"""""""""""""""""""
My stunnel-sender.conf:
"""""""""""""""""""
debug = 7
output = /Users/dave/Desktop/stunnel-test/sender-stunnel-output.log
foreground = yes
client = yes
connect = localhost:874
cert = /Users/dave/Desktop/stunnel-test/cert.pem
verify = 0
"""""""""""""""""""
My stunnel-receiver.conf:
"""""""""""""""""""
debug = 7
output = /Users/dave/Desktop/stunnel-test/receiver-stunnels-output.log
pid = /Users/dave/Desktop/stunnel-test/stunnel-rsyncd-stunnels.pid
cert = /Users/dave/Desktop/stunnel-test/cert.pem
verify = 0
delay = yes
exec = /Users/dave/Desktop/stunnel-test/rsync
execArgs = -vvvv --daemon --server --config=/Users/dave/Desktop/stunnel-test/stunnel-rsyncd.conf .
foreground = yes
client = no
"""""""""""""""""""
My receiver-error.log:
"""""""""""""""""""
2016.09.14 06:54:35 LOG7[ui]: Clients allowed=125
2016.09.14 06:54:35 LOG7[cron]: Cron thread initialized
2016.09.14 06:54:35 LOG5[ui]: stunnel 5.35 on x86_64-apple-darwin15.4.0 platform
2016.09.14 06:54:35 LOG5[ui]: Compiled with OpenSSL 0.9.8zd 8 Jan 2015
2016.09.14 06:54:35 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016
2016.09.14 06:54:35 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel
2016.09.14 06:54:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI
2016.09.14 06:54:35 LOG7[ui]: errno: (*__error())
2016.09.14 06:54:35 LOG5[ui]: Reading configuration from file /Users/dave/Desktop/stunnel-test/stunnel-receiver.conf
2016.09.14 06:54:35 LOG5[ui]: UTF-8 byte order mark not detected
2016.09.14 06:54:35 LOG7[ui]: Compression disabled
2016.09.14 06:54:35 LOG7[ui]: Snagged 64 random bytes from /dev/urandom
2016.09.14 06:54:35 LOG7[ui]: PRNG seeded successfully
2016.09.14 06:54:35 LOG6[ui]: Initializing inetd mode configuration
2016.09.14 06:54:35 LOG6[ui]: Loading certificate from file: /Users/dave/Desktop/stunnel-test/cert.pem
2016.09.14 06:54:35 LOG6[ui]: Certificate loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem
2016.09.14 06:54:35 LOG6[ui]: Loading private key from file: /Users/dave/Desktop/stunnel-test/cert.pem
2016.09.14 06:54:35 LOG4[ui]: Insecure file permissions on /Users/dave/Desktop/stunnel-test/cert.pem
2016.09.14 06:54:35 LOG6[ui]: Private key loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem
2016.09.14 06:54:35 LOG7[ui]: Private key check succeeded
2016.09.14 06:54:35 LOG7[ui]: DH initialization
2016.09.14 06:54:35 LOG7[ui]: Using DH parameters from /Users/dave/Desktop/stunnel-test/cert.pem
2016.09.14 06:54:35 LOG6[ui]: 2048-bit DH parameters loaded
2016.09.14 06:54:35 LOG7[ui]: ECDH initialization
2016.09.14 06:54:35 LOG7[ui]: ECDH initialized with curve prime256v1
2016.09.14 06:54:35 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000)
2016.09.14 06:54:35 LOG5[ui]: Configuration successful
2016.09.14 06:54:35 LOG7[ui]: Service [stunnel] started
2016.09.14 06:54:35 LOG7[ui]: Option TCP_NODELAY set on local socket
2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] accepted connection from ::1:51362
2016.09.14 06:54:35 LOG6[ui]: Peer certificate not required
2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): before/accept initialization
2016.09.14 06:54:35 LOG7[ui]: SNI: no virtual services defined
2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 read client hello A
2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write server hello A
2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write certificate A
2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write certificate request A
2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 flush data
2016.09.14 06:54:40 LOG3[ui]: SSL_accept: Peer suddenly disconnected
2016.09.14 06:54:40 LOG5[ui]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2016.09.14 06:54:40 LOG7[ui]: Deallocating application specific data for addr index
2016.09.14 06:54:40 LOG7[ui]: Service [stunnel] finished (0 left)
"""""""""""""""""""
The server-side-Stunnel is invoked via launchd using this LaunchDaemon (but this seems to be working okay — I think):
"""""""""""""""""""
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Disabled</key>
<false/>
<key>StandardErrorPath</key>
<string>/Users/dave/Desktop/stunnel-test/receiver-error.log</string>
<key>StandardOutPath</key>
<string>/Users/dave/Desktop/stunnel-test/receiver-out.log</string>
<key>Label</key>
<string>com.stunnel.test</string>
<key>ProgramArguments</key>
<array>
<string>/Users/dave/Desktop/stunnel-test/stunnel</string>
<string>/Users/dave/Desktop/stunnel-test/stunnel-receiver.conf</string>
</array>
<key>inetdCompatibility</key>
<dict>
<key>Wait</key>
<false/>
</dict>
<key>Sockets</key>
<dict>
<key>Listeners</key>
<dict>
<key>SockServiceName</key>
<string>874</string>
<key>SockType</key>
<string>stream</string>
</dict>
</dict>
</dict>
</plist>
"""""""""""""""""""
I’ve looked at the output of
bash-3.2# tcpdump -i all -XX -xx -vv port 874
but this didn’t give me any obvious clues.
I can send it if it’s useful but I’ve omitted it for now as it’s long.
I’ve reproduced the same hang on Mac OS X 10.11 and 10.6.
I’ve recompiled Stunnel in 10.11 and 10.9 environments but still get this same hang.
Any advice appreciated..
— Dave.
1
0
On Tue 2016-09-13 (22:25), Micha?? Trojnara wrote:
> On 13.09.2016 20:35, Ulli Horlacher wrote:
> >> It is impossible to say anything without analysis of the executed fexsrv
> >> program.
> >
> > The problem cannot be in fexsrv, because it works with stunnel 4.27
>
> What is the point of sending an email to the mailing list when you
> ignore our effort to help you?
Where do I ignore help?
> fexsrv terminates immediately with exit code 1.
No. It does not start at all, so it does not terminate.
fexsrv logs everything and when running with stunnel 5.x the log file is
empty.
But meanwhile I found the error:
stunnel 5.x needs the a full path for the exec statement:
exec = /usr/bin/perl
For stunnel 4.x it was sufficent to use:
exec = perl
--
Ullrich Horlacher Server und Virtualisierung
Rechenzentrum TIK
Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de
Allmandring 30a Tel: ++49-711-68565868
70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/
REF:<45835cd9-b239-d80c-38a0-3f978132e40e(a)stunnel.org>
2
1
Can you please help me. Stunnel has been working fine for months and I
just started getting these errors in the last day or two. Thank you:
2016.09.11 13:43:38 LOG5[10]: Service [ssmtp] accepted connection from
46.101.193.127:33818
2016.09.11 13:43:40 LOG3[10]: SSL_accept: Peer suddenly disconnected
2016.09.11 13:43:40 LOG5[10]: Connection reset: 0 byte(s) sent to SSL, 0
byte(s) sent to socket
2016.09.11 13:43:40 LOG5[11]: Service [ssmtp] accepted connection from
46.101.193.127:34154
2016.09.11 13:43:40 LOG3[11]: SSL_accept: 1408A10B: error:1408A10B:SSL
routines:ssl3_get_client_hello:wrong version number
2016.09.11 13:43:40 LOG5[11]: Connection reset: 0 byte(s) sent to SSL, 0
byte(s) sent to socket
2016.09.11 13:43:40 LOG5[12]: Service [ssmtp] accepted connection from
46.101.193.127:34254
2016.09.11 13:43:42 LOG3[12]: s_connect: connect 127.0.0.1:25: Connection
refused (WSAECONNREFUSED) (10061)
2016.09.11 13:43:42 LOG5[12]: Connection reset: 0 byte(s) sent to SSL, 0
byte(s) sent to socket
2016.09.11 17:22:39 LOG5[13]: Service [smtp-tls-wrapper] accepted
connection from 127.0.0.1:58020
2016.09.11 17:22:39 LOG5[13]: s_connect: connected 52.35.228.26:465
2016.09.11 17:22:39 LOG5[13]: Service [smtp-tls-wrapper] connected remote
server from 172.31.10.223:58021
2016.09.11 17:22:40 LOG5[13]: Connection closed: 7072 byte(s) sent to SSL,
369 byte(s) sent to socket
2016.09.11 17:22:40 LOG5[14]: Service [smtp-tls-wrapper] accepted
connection from 127.0.0.1:58022
2016.09.11 17:22:40 LOG5[14]: s_connect: connected 52.35.58.187:465
2016.09.11 17:22:40 LOG5[14]: Service [smtp-tls-wrapper] connected remote
server from 172.31.10.223:58023
2016.09.11 17:22:40 LOG5[14]: Connection closed: 7302 byte(s) sent to SSL,
361 byte(s) sent to socket
--
Mark F. Hannig
mhannig(a)gmail.com
2
2