September 2018 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Stunnel & Gmail security
by BOXI31 TEST 17 Oct '20

17 Oct '20

Hi all, To make "Stunnel 5.31" work with Gmail, I have to go in security settings of Gmail and "allow less secure apps to access my account". Is it mandatory ? Is it possible to set Stunnel to access Gmail without lowering it security level ? How ? I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider it as a "less secure app." ! Regards, Steve

2 1

Re: [stunnel-users] stunnel log rolling
by Eric Eberhard 17 Sep '18

17 Sep '18

Most O/S will either prevent renaming a file that is in use (or deleting it). Some will – but they will actually continue to write to the old file (and if that file was deleted then it writes to a file you can nexer see). Since I generally use AIX it is the second feature I see. We have systems with over 500 connections via stunnel – it never rests, and rolling the log file is not easy. I can easily provide a code fix for stunnel that we use in out software. It allows daily logs, sized logs, etc. And it rolls properly. The downside is we open the log, write to it, and close it – each time – which is not efficient. Given modern computers I have come to not care. So the open routine either opens (append) a daily file or it looks up the file and gets the size and decides to move it (or not). The second is not perfect … if three other processes have it open at the moment they will finish writing to that log. Who cares? As long as the logging is always opening and closing the “bleed over” is minimized. If people want me to do this, I will – if they can tell me the log routines it would speed me some, preventing from having to search for them. We like and prefer the daily logs – it is clean as you get one per day. As long as one day is never too huge it is great and we have daemons that remove logs over xx number of days (although I could add a simple parameter for that as well and simply kill those files). This is an annoying problem – especially for multi-O/S software – but one I am good at. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Daniel Trickett Sent: Wednesday, September 12, 2018 11:16 AM To: Tom Hood <tom.w.hood(a)gmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel log rolling Hi Tom, Is what you refer to? I think the open and re-open only happen when the service is stopped and restarted. It hasn’t rolled over like Apache in my short experience. log = append | overwrite log file handling This option allows you to choose whether the log file (specified with the output option) is appended or overwritten when opened or re-opened. default: append Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence – MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email <mailto:[email protected]> daniel.trickett(a)emdmillipore.com From: Tom Hood <tom.w.hood(a)gmail.com <mailto:[email protected]> > Sent: Wednesday, September 12, 2018 1:10 PM To: Daniel Trickett <daniel.trickett(a)emdmillipore.com <mailto:[email protected]> > Cc: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: Re: [stunnel-users] stunnel log rolling Hi Daniel, The trick is how to roll the logs without an interruption of service (i.e. without a stunnel restart). I believe stunnel claims to support this, but I think the feature might be broken in 5.49 Thanks, -- Tom On Wed, Sep 12, 2018 at 5:43 AM Daniel Trickett <daniel.trickett(a)emdmillipore.com <mailto:[email protected]> > wrote: Tom, Kill the stunnel process. Then mv the log. This will allow stunnel to right to a new log file. Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence – MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email <mailto:[email protected]> daniel.trickett(a)emdmillipore.com From: stunnel-users <stunnel-users-bounces(a)stunnel.org <mailto:[email protected]> > On Behalf Of Tom Hood Sent: Tuesday, September 11, 2018 5:02 PM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] stunnel log rolling Hi, I'm new to stunnel and it isn't clear to me how the log rolling feature works. I built stunnel 5.49 with gcc 4.2.0 on Solaris 10. I'm running it on Solaris 11.3 SPARC. Using openssl 1.0.2p The config file has disabled syslog and is logging to stunnel.log. Command line is: stunnel stunnel.conf where stunnel.conf contains the following: syslog = no output = stunnel.log debug = 7 [service-exterior] client = no options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = -NO_TLSv1.2 cert = /path/to/stunnel.pem curve = zzz accept = testhost:32100 connect = 127.0.0.1:32200 <http://127.0.0.1:32200> [service-interior] client = yes options = NO_SSLv2 options = NO_SSLv3 accept = 127.0.0.1:32200 <http://127.0.0.1:32200> connect = 127.0.0.1:32100 <http://127.0.0.1:32100> sslVersion = TLSv1 ciphers = zzz TIMEOUTconnect = 60 The log rollowing steps I tried that don't work are: mv stunnel.log stunnel.log.1 kill -USR1 <stunnelpid> The log message "LOG7[main]: Processing SIGNAL_REOPEN_LOG" shows up in stunnel.log.1. However, new client connections to host:32100 do not trigger creation of a new stunnel.log file. In fact, logging stops to stunnel.log.1 as soon as the USR1 is processed. The new client connections work as before, but there isn't any logging. I restarted stunnel and tried the test again with these steps: mv stunnel.log stunnel.log.1 touch stunnel.log kill -USR1 <stunnelpid> That also doesn't work. Please let me know the correct sequence of steps to roll the stunnel.log Thank you, -- Tom This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer. This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

2 1

stunnel log rolling
by Tom Hood 12 Sep '18

12 Sep '18

Hi, I'm new to stunnel and it isn't clear to me how the log rolling feature works. I built stunnel 5.49 with gcc 4.2.0 on Solaris 10. I'm running it on Solaris 11.3 SPARC. Using openssl 1.0.2p The config file has disabled syslog and is logging to stunnel.log. Command line is: stunnel stunnel.conf where stunnel.conf contains the following: syslog = no output = stunnel.log debug = 7 [service-exterior] client = no options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = -NO_TLSv1.2 cert = /path/to/stunnel.pem curve = zzz accept = testhost:32100 connect = 127.0.0.1:32200 [service-interior] client = yes options = NO_SSLv2 options = NO_SSLv3 accept = 127.0.0.1:32200 connect = 127.0.0.1:32100 sslVersion = TLSv1 ciphers = zzz TIMEOUTconnect = 60 The log rollowing steps I tried that don't work are: mv stunnel.log stunnel.log.1 kill -USR1 <stunnelpid> The log message "LOG7[main]: Processing SIGNAL_REOPEN_LOG" shows up in stunnel.log.1. However, new client connections to host:32100 do not trigger creation of a new stunnel.log file. In fact, logging stops to stunnel.log.1 as soon as the USR1 is processed. The new client connections work as before, but there isn't any logging. I restarted stunnel and tried the test again with these steps: mv stunnel.log stunnel.log.1 touch stunnel.log kill -USR1 <stunnelpid> That also doesn't work. Please let me know the correct sequence of steps to roll the stunnel.log Thank you, -- Tom

2 4

stunnel 5.49 released
by Michal Trojnara 03 Sep '18

03 Sep '18

Dear Users, I have released version 5.49 of stunnel. Version 5.49, 2018.09.03, urgency: MEDIUM * New features - Performance optimizations. - Logging of negotiated or resumed TLS session IDs (thx to ANSSI - National Cybersecurity Agency of France). - Merged Debian 10-enabled.patch and 11-killproc.patch (thx to Peter Pentchev). - OpenSSL DLLs updated to version 1.0.2p. - PKCS#11 engine DLL updated to version 0.4.9. * Bugfixes - Fixed a crash in the session persistence implementation. - Fixed syslog identifier after configuration file reload. - Fixed non-interactive "make check" invocations. - Fixed reloading syslog configuration. - stunnel.pem created with SHA-256 instead of SHA-1. - SHA-256 "make check" certificates. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 3d6641213a82175c19f23fde1c3d1c841738385289eb7ca1554f4a58b96d955e stunnel-5.49.tar.gz 459bbb212baf0b9821c80e0664c830246ef6e97c7329fb08160e87ff11ae9692 stunnel-5.49-win32-installer.exe 72416c6664106ad815a8da67a525c6593247fc06cbca3b8918ffc87ae92595e8 stunnel-5.49-android.zip Best regards, Mike

1 0

Adding custom HTTP headers to a proxy'ed HTTP request when stunnel is used as an endpoint for a HTTP proxy
by Tony Cheneau 03 Sep '18

03 Sep '18

Good evening folks, Michal was kind enough to review and rewrite/integrate one of my patches for logging session IDs [1] and post the remaining ones on the website [2]! So, I feel I should also contribute to this list a little program I wrote. It is meant to be used with the exec= directive. It is mostly useful when stunnel is used to secure a connexion between a client and a HTTP proxy. A stunnel instance can run locally on the client while a stunnel server runs on the HTTP proxy: HTTP client (proxy'ed) <- > stunnel client <--> stunnel server <-> HTTP proxy Here, the "exec=" program will run on the stunnel server and add some extra headers to each HTTP request. One of this headers is the client's Distinguished Name (from its X.509 certificate). The HTTP proxy (squid for example) can then make some decision based on this HTTP header (authorisation, etc.). It relies heavily on PicoHTTPParser. Regards, Tony Cheneau [1]: to appear in version 5.49, see https://www.stunnel.org/sdf_ChangeLog.html [2]: patches 0002 and 0003 on https://www.stunnel.org/patches.html

1 0