stunnel-users September 2019

12 participants
21 discussions

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 11
by Brent Kimberley 25 Sep '19

25 Sep '19

>>We are running stunnel-5.49-1.ppc on AIX 7100-05-03-1846. >>It will stay up awhile and our connection tests work, but it core dumps. Here’s the message in the log file. Thoughts? >>INTERNAL ERROR: Out of memory at s3_both.c, line 626 Hi Gerald. You may have found a memory leak. Try looking at: 1) line 626 of OpenSSL::s3_booth.c https://github.com/openssl/openssl/blob/OpenSSL_1_0_2-stable/ssl/s3_both.c 2) line 296 of stunnel::str.c ; and/or https://github.com/mtrojnar/stunnel/blob/stunnel-5.49/src/str.c 3) dbx, truss, or probevue - in an offline dev environment. http://archive.ibmsystemsmag.com/aix/administrator/performance/debugging-me…

1 0

AIX:stunnel core dumping
by Gerald Shaw 24 Sep '19

24 Sep '19

Hello, We are running stunnel-5.49-1.ppc on AIX 7100-05-03-1846. It will stay up awhile and our connection tests work, but it core dumps. Here’s the message in the log file. Thoughts? INTERNAL ERROR: Out of memory at s3_both.c, line 626 Best, Gerald Shaw

1 0

Cannot create .crt file
by John Khoo 24 Sep '19

24 Sep '19

Hi, I am new to STunnel. I come to know STunnel thru this link: http://www.ibphoenix.com/downloads/Secure_connections_to_Firebird_with_Stun… Based on the instruction, I tried create a certificate using this line below: openssl ca -config "C:\Program Files (x86)\stunnel\config\openssl.conf" -policy policy_anything -notext -in C:\CA\temp\vnc_server\server.req -out C:\CA\temp\vnc_server\server.crt However, no crt file is created and no error is prompted. I hope that someone can help me. Thanks.

1 0

Stunnel and Sophos UTM
by James Brown 21 Sep '19

21 Sep '19

Has anybody been able to use stunnel to update the Sophos UTM’s firewall? I know it has a Restful API , but do not know how to use this with stunnel. https://www.sophos.com/en-us/medialibrary/PDFs/documentation/UTMonAWS/Sopho… <https://www.sophos.com/en-us/medialibrary/PDFs/documentation/UTMonAWS/Sopho…> Any experiences or suggestions? Thanks, James.

2 1

Re: [stunnel-users] Stunnel help and guidance request
by Noonan, M.P. (Mike) 19 Sep '19

19 Sep '19

Hi Gerald, I assume you got stunnel from the oss4aix.org site. We don't use the freeware openssl, but instead the IBM one: [root@duist:/data/O01] lslpp -l | grep openssl openssl.base 1.0.2.1801 COMMITTED Open Secure Socket Layer openssl.license 1.0.2.1801 COMMITTED Open Secure Socket License openssl.man.en_US 1.0.2.1801 COMMITTED Open Secure Socket Layer openssl.base 1.0.2.1801 COMMITTED Open Secure Socket Layer I installed stunnel-5.29 on one of our lpars which I forced with -nodeps: rpm -Uhv --nodeps stunnel-5.29-1.aix5.2.ppc.rpm It picked up the IBM libs, but had the same problem... [root@duist:/data/O01] ldd /usr/bin/stunnel /usr/bin/stunnel needs: /usr/lib/threads/libc.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libpthreads.a(shr_xpg5.o) /usr/lib/libcrypto.a(libcrypto.so.1.0.2) /usr/lib/libssl.a(libssl.so.1.0.2) /unix /usr/lib/libcrypt.a(shr.o) [root@duist:/data/O01] /usr/bin/stunnel Could not load program /usr/bin/stunnel: Symbol resolution failed for stunnel because: Symbol strcmp (number 112) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol memmove (number 137) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol strncpy (number 142) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol strcpy (number 169) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol bcopy (number 245) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). I then downloaded and installed stunnel-5.49 from oss4aix.org and installed that version which worked fine.. [root@duist:/data/O01] /usr/bin/stunnel [ ] Clients allowed=31999 [.] stunnel 5.49 on powerpc-ibm-aix5.2.0.0 platform [.] Compiled with OpenSSL 1.0.2p 14 Aug 2018 [.] Running with OpenSSL 1.0.2r 26 Feb 2019 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_Errno()) [!] Invalid configuration file name "/opt/freeware/etc/stunnel/stunnel.conf" [!] realpath: No such file or directory (2) [ ] Deallocating section defaults I expect that if you upgrade your freeware openssl to at least 1,0,2r and upgrade stunnel to 5.49 your problem should be solved. Met vriendelijke groet, Mike Noonan From: stunnel-users <mailto:[email protected]> On Behalf Of Gerald Shaw Sent: Wednesday, September 18, 2019 11:18 PM To: mailto:[email protected] Subject: [stunnel-users] Stunnel help and guidance request Hello all, I'm new to the mailing list. I'm trying to run stunnel-5.29-1.ppc, and I'm having issues. I'd appreciate your help (or point me to the solution in the archives). OS - AIX 7100-05-03-1846 /home/shawg# rpm -qa|grep -i openssl openssl-1.0.2n-1.ppc /home/shawg# ldd `which stunnel` /usr/bin/stunnel needs: /usr/lib/libc.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libpthreads.a(shr_xpg5.o) /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2) /opt/freeware/lib/libssl.a(libssl.so.1.0.2) /unix /usr/lib/libcrypt.a(shr.o) ** ERROR MESSAGE_- /home/shawg# /usr/bin/stunnel exec(): 0509-036 Cannot load program /usr/bin/stunnel because of the following errors: 0509-130 Symbol resolution failed for stunnel because: 0509-136 Symbol strcmp (number 112) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol memmove (number 137) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strncpy (number 142) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strcpy (number 169) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol bcopy (number 245) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-192 Examine .loader section symbols with the 'dump -Tv' command. *** echo $LIBPATH /opt/freeware/lib:/usr/lib ________________________________ Dit e-mailbericht is alleen bestemd voor de geadresseerden. Indien dit bericht niet voor u is bedoeld, wordt u verzocht de afzender hiervan op de hoogte te stellen door het bericht te retourneren en de inhoud niet te gebruiken. This e-mail message is intended to be exclusively for the addressee. If you are not the intended recipient you are kindly requested not to make any use whatsoever of the contents and to notify the sender immediately by returning this e-mail message.

2 1

Stunnel help and guidance request
by Gerald Shaw 18 Sep '19

18 Sep '19

Hello all, I’m new to the mailing list. I’m trying to run stunnel-5.29-1.ppc, and I’m having issues. I’d appreciate your help (or point me to the solution in the archives). OS - AIX 7100-05-03-1846 /home/shawg# rpm -qa|grep -i openssl openssl-1.0.2n-1.ppc /home/shawg# ldd `which stunnel` /usr/bin/stunnel needs: /usr/lib/libc.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libpthreads.a(shr_xpg5.o) /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2) /opt/freeware/lib/libssl.a(libssl.so.1.0.2) /unix /usr/lib/libcrypt.a(shr.o) ** ERROR MESSAGE_- /home/shawg# /usr/bin/stunnel exec(): 0509-036 Cannot load program /usr/bin/stunnel because of the following errors: 0509-130 Symbol resolution failed for stunnel because: 0509-136 Symbol strcmp (number 112) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol memmove (number 137) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strncpy (number 142) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strcpy (number 169) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol bcopy (number 245) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-192 Examine .loader section symbols with the 'dump -Tv' command. *** echo $LIBPATH /opt/freeware/lib:/usr/lib ** I’d appreciate any help or guidance. Thanks in advance. R, G. Shaw

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 7
by Brent Kimberley 18 Sep '19

18 Sep '19

>> 2019.09.16 13:36:28 LOG6[3]: PSK identity not found (session resumption?)Try dumping the symbols for ctx.c::psk_find(), ssl_lib.c::SSL_get_ex_data(), and ctx.c:: psk_server_callback(). Date: Tue, 17 Sep 2019 18:18:13 +0200 From: Hannah Koperberg <hannah.koperberg(a)gmail.com> Subject: [stunnel-users] Problems when using PSK between a version of stunnel usingopenssl 1.0 and a version of stunnel using openssl 1.1.1 We encounter problems when using PSK between a version of stunnel using openssl 1.0 and a version of stunnel using openssl 1.1.1 The problem being the following: 2019.09.16 13:36:28 LOG6[3]: PSK identity not found (session resumption?) 2019.09.16 13:36:28 LOG7[3]: TLS alert (write): fatal: unknown PSK identity 2019.09.16 13:36:28 LOG3[3]: SSL_accept: s3_srvr.c:2845: error:1408B0DF:SSL routines:ssl3_get_client_key_exchange:psk identity not found No problems are encountered when using certificates or when the same versions of stunnel and openssl are used. In the latter case neither certificates nor PSK give any problems connecting. Kind regards, Hannah Koperberg, de Volksbank in the Netherlands

1 1

openssl inquiry
by Brent Kimberley 16 Sep '19

16 Sep '19

Can someone please walk me through how to replace 1.1.1c with 1.1.1d ? For example: 1. Download from SLP https://github.com/slproweb/opensslhashes/ 2. Extract & overwrite

1 0

TR: using sTunnel with Chrome (Pierre DUPONT)
by Brent Kimberley 06 Sep '19

06 Sep '19

Dump your stunnel.crt file. <stunnel_home>/bin/openssl x509 -in stunnel.crt -noout -text And, compare with * section 4 of https://tools.ietf.org/html/rfc5280 * Peer-reviewed public sites. https://www.ssllabs.com/ssltest/ Dump your stunnel.cnf file. And, compare with stunnel_home>/config/openssl.cnf file https://access.redhat.com/solutions/28965 https://www.openssl.org/docs/manmaster/man5/x509v3_config.html ---------------------------------------------------------------------- From: Pierre DUPONT <pierre.dupont(a)nedap.fr> De : Pierre DUPONT Envoy? : jeudi 5 septembre 2019 16:55 Cc : _sav.bibli <sav.bibli(a)nedap.fr>; Philippe ANQUETIN <philippe.anquetin(a)nedap.fr> Objet : using sTunnel with Chrome Good day to all. So far, I can't succeed to use Chrome with sTunnel. Here is my configuration for sTunnel.... However, I cannot connect on https I tried several things found browsing the list, like building a certificate with openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.crt -keyout stunnel.crt No result so the only solution I see now is to call you for some help... With kind regards, Cordiales salutations de Pierre Dupont Support S.A.V. & D?veloppement Biblioth?ques Courriel S.A.V. : sav.bibli(a)nedap.fr<mailto:[email protected]> 06 13 99 69 38 - 01.61.03.03 18 8/10 Chemin d'Andr?sy 95610 Eragny sur Oise NEDAP LOGO

1 0

TR: using sTunnel with Chrome
by Pierre DUPONT 06 Sep '19

06 Sep '19

De : Pierre DUPONT Envoyé : jeudi 5 septembre 2019 16:55 À : 'stunnel-users(a)stunnel.org' <stunnel-users(a)stunnel.org> Cc : _sav.bibli <sav.bibli(a)nedap.fr>; Philippe ANQUETIN <philippe.anquetin(a)nedap.fr> Objet : using sTunnel with Chrome Good day to all. So far, I can't succeed to use Chrome with sTunnel. I use these versions sTunnel : 5.55 (downloaded today...) Chrome is 76.0.3809 132 [cid:[email protected]] Here is my configuration for sTunnel : ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2019 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) ;debug = info ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; e.g. softhsm2.dll or opensc-pkcs11.so ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server [https] accept = 443 connect = 81 cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini The 81 connect port is used by our local webservice : http://localhost:81/nedaprfidwebservice.asmx which runs OK [cid:[email protected]] The problem is when I try to import the certificate. It looks OK giving these informations [cid:[email protected]] [cid:[email protected]] However, I cannot connect on https [cid:[email protected]] I tried several things found browsing the list, like building a certificate with openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.crt -keyout stunnel.crt No result so the only solution I see now is to call you for some help... With kind regards, Cordiales salutations de Pierre Dupont Support S.A.V. & Développement Bibliothèques Courriel S.A.V. : sav.bibli(a)nedap.fr<mailto:[email protected]> Téléphone : 06 13 99 69 38 - 01.61.03.03 18 8/10 Chemin d'Andrésy 95610 Eragny sur Oise [NEDAP LOGO - INLINE - RGB]

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users September 2019