sorry to bother,
im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites.
i heard stunnel cant be configured to always forward to the current
site address dynamically, thats why i would use privoxy.
the browser is configured to send to:
127.0.0.1 443
stunnel config has this at the end:
[Tunnel_in]
client = yes
accept = 127.0.0.1:443
connect = 127.0.0.1:8118
verifyChain = yes
CAfile = ca-certs.pem
checkHost = localhost
127.0.0.1:8118 is the privoxy address.
this is what stunnel writes:
LOG5[main]: Configuration successful
LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261
LOG5[0]: s_connect: connected 127.0.0.1:8118
LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262
and the browser infinitely loads, and never loads anything or leaves the page.
if i remove the last 3 lines, its the same just with this line added:
LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks
but it doesnt give an error or anything.
with a configuration like:
[Tunnel_out]
client = no
accept = 127.0.0.1:443
connect = 127.0.0.1:8118
cert = stunnel.pem
this is what it gives:
LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294
LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL
routines:SSL23_GET_CLIENT_HELLO:https proxy request
LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
and browser gives a server not found error immediately. im not even
sure if i should use client or server configuration in a case like
this, but none of them works anyway. all i would need is for my
browser to get the pages decrypted, or at least in less than TLS1.1.
like how on newipnow.com i can access sites with any encryption, since
they are sent to the browser without encryption. the browser just
gives an "unencrypted tunnel" warning, which is how i found stunnel,
and which is exactly what i need, just locally.
8
41
Hi,
Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS.
Thanks for your help in advance!
Here is my configuration so far without TPM:
debug = debug
output = /tmp/stunnel.log
foreground = yes
[mtls_client]
client = yes
accept = 127.0.0.1:12019
sni = server-with-mtls.example.com
checkHost = server-with-mtls.example.com
connect = 1.2.3.4:443
verifyChain = yes
CApath = /etc/ssl/certs/
cert = client.crt
key = client.key
Thanks & br,
Gábor Nyíri,
2
1
I am faling to connect to gmail. Not sure what that bind error means.
iqbala@ghar:~$ sudo stunnel4
2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes
from /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes
to /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims
sufficient entropy for the PRNG
2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for
service ssmtp
2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on
i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007
2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD
SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be
changed with 'ulimit -n')
2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE
limit for file descriptors
2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on
accept socket
2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to
74.125.93.111:587
2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign
requested address (99)
Here is how my conf file looks like
iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$"
cert = /etc/stunnel/stunnel.pem
foreground = yes
sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
pid = /stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel4/stunnel.log
client = yes
[ssmtp]
accept = smtp.gmail.com:587
connect = 25
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
5
9
Hi all,
To make "Stunnel 5.31" work with Gmail, I have to go in security settings
of Gmail and "allow less secure apps to access my account".
Is it mandatory ?
Is it possible to set Stunnel to access Gmail without lowering it security
level ?
How ?
I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider
it as a "less secure app." !
Regards,
Steve
2
1
28 May '20
I'm still tinkering here, trying to get Yahoo+stunnel working to help out Joe Slaven. I still can't get it to work.
Yahoo userid is y_phsiii. I manually logged into Yahoo and verified that I have the right password.
The config section:
--
[Yahoo]
client = yes
accept = localhost:1234
connect = pop.mail.yahoo.com:995
sslVersion = TLSv1.2
--
Eudora has
--
POPPort=1234
--
for that personality.
Log:
--
2020.05.27 11:36:48 LOG5[29]: Service [Yahoo] accepted connection from 127.0.0.1:50287
2020.05.27 11:36:48 LOG6[29]: failover: priority, starting at entry #0
2020.05.27 11:36:48 LOG6[29]: s_connect: connecting 98.137.157.46:995
2020.05.27 11:36:48 LOG5[29]: s_connect: connected 98.137.157.46:995
2020.05.27 11:36:48 LOG5[29]: Service [Yahoo] connected remote server from 192.168.1.4:50288
2020.05.27 11:36:48 LOG6[29]: SNI: sending servername: pop.mail.yahoo.com
2020.05.27 11:36:48 LOG6[29]: Peer certificate not required
2020.05.27 11:36:48 LOG6[29]: Certificate verification disabled
2020.05.27 11:36:48 LOG6[29]: Certificate verification disabled
2020.05.27 11:36:48 LOG6[29]: Client certificate not requested
2020.05.27 11:36:48 LOG6[29]: Session id: F26CEF81143B96B8BD0D2C504CBB534082242BF337D3D29DE911CD5AC05B6DE0
2020.05.27 11:36:48 LOG6[29]: TLS connected: new session negotiated
2020.05.27 11:36:48 LOG6[29]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption)
2020.05.27 11:37:48 LOG6[29]: TLS socket closed (SSL_read)
2020.05.27 11:37:48 LOG5[29]: Connection closed: 38 byte(s) sent to TLS, 130 byte(s) sent to socket
--
Eudora error (Personality is named just "y" since it's just a test):
--
y, Logging into POP Server, PASS [11:33:29 AM]
There has been an error transferring your mail. I said: PASS <shhhh! Don't tell anyone.> and then the POP server (y_phsiii(a)127.0.0.1) said: ERR [SYS/TEMP] Server error - Please try again later.
--
3
3
Dear stunnel users,
please advise how to solve the following:
- an Application connects to stunnel-client (installed at the same machine);
- stunnel-client tries to connect to stunnel-server (remote), fails and
sends RST to the App;
- but the App has already sent some datagrams to stunnel-client during
TIMEOUTconnect period and they aren't transferred to stunnel-server.
Is there any way to make stunnel-client delay its ACK to the App until the
connection to stunnel-server is established?
Thanks!
1
0
Below are the contents of my config file:
Question 1. Is the output statement correct? I cannot find the log file. I expected it to be in the stunnel folder in the Program (x86) folders
Question 2. Is it permissable to install code for all three email servers, using the same ports and settings in Eudora?
Question 3. All three have error messages in Eudora ie none of them work via stunnel. Can anyone please show me where I am going wrong? I have listed the error message for Gmail below. There is no log file that I can find.
Bigpond error message:
There has been an error transferring your mail
POP server [JoeS4814(a)127.0.0.1 ] said
ERR[AUTH] Username and Password not accepted
thanks for helping out,
Joe
;***************************************************************
; STUNNEL LOG
output = stunnel.log
;
;*****************************************************************
;*******************************************************
;Yahoo connection
;*******************************************************
[yahoo-pop3]
client = yes
accept = 127.0.0.1:110
connect = pop.mail.yahoo.com:995
verify = 2
CAfile = ca-certs.pem
checkHost = pop.mail.yahoo.com
OCSPaia = yes
[yahoo-smtp]
client = yes
accept = 127.0.0.1:25
connect = smtp.mail.yahoo.com:465
verify = 2
CAfile = ca-certs.pem
checkHost = smtp.mail.yahoo.com
OCSPaia = yes
;
;*******************************************************
;Bigpond connection
;*****************************************************
[bigpond-pop3]
client = yes
accept = 127.0.0.1:110
connect = pop.bigpond.com:995
verify = 2
CAfile = ca-certs.pem
checkHost = pop.bigpond.com
OCSPaia = yes
[bigpond-smtp]
client = yes
accept = 127.0.0.1:25
connect = smtp.bigpond.com:465
verify = 2
CAfile = ca-certs.pem
checkHost = smtp.bigpond.com
OCSPaia = yes
;*************************************
;Gmail connection
;********************************************
[gmail-pop3]
client = yes
accept = 127.0.0.1:110
connect = pop.gmail.com:995
verifyChain = yes
CAfile = ca-certs.pem
checkHost = pop.gmail.com
OCSPaia = yes
[gmail-smtp]
client = yes
accept = 127.0.0.1:25
connect = smtp.gmail.com:465
verifyChain = yes
CAfile = ca-certs.pem
checkHost = smtp.gmail.com
OCSPaia = yes
3
7
[PATCH] Use libcap to keep CAP_NET_RAW so that IP_TRANSPARENT works after setuid
by Simon Arlott 26 May '20
by Simon Arlott 26 May '20
26 May '20
Use libcap to keep CAP_NET_RAW so that IP_TRANSPARENT works after setuid
I'd like to be able to use "transparent = source" and "setuid" to drop
full root privileges.
It is possible to do this by keeping either the CAP_NET_ADMIN or
CAP_NET_RAW capability.
This is based on https://github.com/dlundquist/sniproxy/commit/0ab83f8f45f73ba18ea5f84ccccd9…
The capability will not be inherited if "exec" is used:
Name: stunnel
Uid: 996 996 996 996
Gid: 988 988 988 988
...
CapInh: 0000000000000000
CapPrm: 0000000000002000
CapEff: 0000000000002000
---
It would be possible to keep CAP_NET_BIND_SERVICE too, to allow
reloading a configuration that binds to ports below 1024. I don't think
stunnel should keep this capability unless a service needs it at startup.
CREDITS.md | 25 ++++++++++
configure.ac | 33 ++++++++++++++
doc/stunnel.8.in | 2 +-
doc/stunnel.html.in | 2 +-
doc/stunnel.pod.in | 2 +-
src/stunnel.c | 109 ++++++++++++++++++++++++++++++++++++++++++++
6 files changed, 170 insertions(+), 3 deletions(-)
diff --git a/CREDITS.md b/CREDITS.md
index 6567392..5f12f92 100644
--- a/CREDITS.md
+++ b/CREDITS.md
@@ -27,6 +27,31 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
+libcap usage in version 5.57 (from sniproxy):
+Copyright 2017 Dustin Lundquist <dustin(a)null-ptr.net>
+Copyright 2020 Simon Arlott
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE HOLDERS OR
+CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
Several bugfixes and improvements mostly in versions 3.xx:
* Brian Hatch <bri(a)stunnel.org>
diff --git a/configure.ac b/configure.ac
index 9c2b2b6..f454710 100644
--- a/configure.ac
+++ b/configure.ac
@@ -352,6 +352,39 @@ AC_ARG_ENABLE(systemd,
]
)
+# Disable POSIX capabilities support
+AC_MSG_CHECKING([whether to enable POSIX capabilities support])
+AC_ARG_ENABLE(libcap,
+[ --disable-libcap disable POSIX capabilities support],
+ [
+ case "$enableval" in
+ yes) AC_MSG_RESULT([yes])
+ AC_SEARCH_LIBS([cap_get_proc], [cap])
+ AC_DEFINE([USE_LIBCAP], [1],
+ [Define to 1 to enable POSIX capabilities])
+ ;;
+ no) AC_MSG_RESULT([no])
+ ;;
+ *) AC_MSG_RESULT([error])
+ AC_MSG_ERROR([Bad value \"${enableval}\"])
+ ;;
+ esac
+ ],
+ [
+ AC_MSG_RESULT([autodetecting])
+ AC_SEARCH_LIBS([cap_get_proc], [cap],
+ [ AC_CHECK_HEADERS([sys/capability.h], [
+ AC_DEFINE([USE_LIBCAP], [1],
+ [Define to 1 to enable POSIX capabilities])
+ AC_MSG_NOTICE([libcap support enabled])
+ ], [
+ AC_MSG_NOTICE([libcap header not found])
+ ]) ], [
+ AC_MSG_NOTICE([libcap library not found])
+ ])
+ ]
+)
+
# Disable use of libwrap (TCP wrappers)
# it should be the last check!
AC_MSG_CHECKING([whether to enable TCP wrappers support])
diff --git a/doc/stunnel.8.in b/doc/stunnel.8.in
index b3df016..4b121bc 100644
--- a/doc/stunnel.8.in
+++ b/doc/stunnel.8.in
@@ -1251,7 +1251,7 @@ setuid
.RS 4
.Sp
The use of the 'setuid' option will also prevent \fBstunnel\fR from binding to privileged
-(<1024) ports during configuration reloading.
+(<1024) ports during configuration reloading or enabling of 'transparent = source'.
.Sp
When the 'chroot' option is used, \fBstunnel\fR will look for all its files (including
the configuration file, certificates, the log file and the pid file) within the chroot
diff --git a/doc/stunnel.html.in b/doc/stunnel.html.in
index ee9e5d9..95a1b51 100644
--- a/doc/stunnel.html.in
+++ b/doc/stunnel.html.in
@@ -1506,7 +1506,7 @@
</li>
</ul>
-<p>The use of the 'setuid' option will also prevent <b>stunnel</b> from binding to privileged (<1024) ports during configuration reloading.</p>
+<p>The use of the 'setuid' option will also prevent <b>stunnel</b> from binding to privileged (<1024) ports during configuration reloading or enabling of 'transparent = source'.</p>
<p>When the 'chroot' option is used, <b>stunnel</b> will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot jail.</p>
diff --git a/doc/stunnel.pod.in b/doc/stunnel.pod.in
index e9abd4f..8f14fd9 100644
--- a/doc/stunnel.pod.in
+++ b/doc/stunnel.pod.in
@@ -1360,7 +1360,7 @@ setuid
=back
The use of the 'setuid' option will also prevent B<stunnel> from binding to privileged
-(<1024) ports during configuration reloading.
+(<1024) ports during configuration reloading or enabling of 'transparent = source'.
When the 'chroot' option is used, B<stunnel> will look for all its files (including
the configuration file, certificates, the log file and the pid file) within the chroot
diff --git a/src/stunnel.c b/src/stunnel.c
index 8121e0c..b84ce72 100644
--- a/src/stunnel.c
+++ b/src/stunnel.c
@@ -58,6 +58,11 @@
#endif /* USE_WIN32 */
+#ifdef USE_LIBCAP
+#include <sys/prctl.h>
+#include <sys/capability.h>
+#endif
+
/**************************************** prototypes */
#ifdef __INNOTEK_LIBC__
@@ -191,6 +196,59 @@ int drop_privileges(int critical) {
#ifdef HAVE_SETGROUPS
gid_t gr_list[1];
#endif
+#ifdef USE_LIBCAP
+ SERVICE_OPTIONS *opt;
+ int need_caps = 0;
+ cap_t caps;
+ cap_value_t cap_list[1];
+ int keepcaps = 0;
+#endif
+
+#ifdef USE_LIBCAP
+ for (opt = service_options.next; opt; opt = opt->next) {
+ if (opt->option.transparent_src) { /* transparent_src is enabled for this service */
+ need_caps = 1;
+ break;
+ }
+ }
+
+ /* add permitted flag to capability needed for IP_TRANSPARENT */
+ if (CAP_IS_SUPPORTED(CAP_NET_RAW) && need_caps) {
+ const char *cap_failed = NULL;
+
+ caps = cap_get_proc();
+ if (caps != NULL) {
+ cap_list[0] = CAP_NET_RAW;
+ if (cap_set_flag(caps, CAP_PERMITTED, 1, cap_list, CAP_SET) == -1) {
+ cap_failed = "cap_set_flags[before]";
+ goto cap_cleanup_before;
+ }
+
+ if (cap_set_proc(caps) == -1) {
+ cap_failed = "cap_set_proc[before]";
+ goto cap_cleanup_before;
+ }
+
+ /* keep capabilities after setuid */
+ if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) {
+ cap_failed = "prctl[before]";
+ goto cap_cleanup_before;
+ } else {
+ keepcaps = 1;
+ }
+
+cap_cleanup_before:
+ cap_free(caps);
+ if (cap_failed != NULL && critical) {
+ sockerror(cap_failed);
+ return 1;
+ }
+ } else if (critical) {
+ sockerror("cap_get_proc[before]");
+ return 1;
+ }
+ }
+#endif
/* set uid and gid */
if(service_options.gid) {
@@ -212,6 +270,57 @@ int drop_privileges(int critical) {
return 1;
}
}
+
+#ifdef USE_LIBCAP
+ /* enable capability needed for IP_TRANSPARENT */
+ if (CAP_IS_SUPPORTED(CAP_NET_RAW) && need_caps) {
+ const char *cap_failed = NULL;
+
+ caps = cap_get_proc();
+ if (caps != NULL) {
+ /* remove every capability from the list */
+ cap_clear(caps);
+ cap_list[0] = CAP_NET_RAW;
+
+ /* take back capability */
+ if (cap_set_flag(caps, CAP_PERMITTED, 1, cap_list, CAP_SET) == -1) {
+ cap_failed = "cap_set_flag[after]";
+ goto cap_cleanup_after;
+ }
+
+ if (cap_set_flag(caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET) == -1) {
+ cap_failed = "cap_set_flag[after]";
+ goto cap_cleanup_after;
+ }
+
+ if (cap_set_proc(caps) == -1) {
+ cap_failed = "cap_set_proc[after]";
+ goto cap_cleanup_after;
+ }
+ /* from now on it the new capability list is active,
+ * no other capabilities may be enabled */
+
+cap_cleanup_after:
+ cap_free(caps);
+ if (cap_failed != NULL && critical) {
+ sockerror(cap_failed);
+ return 1;
+ }
+ } else if (critical) {
+ sockerror("cap_get_proc[after]");
+ return 1;
+ }
+ }
+
+ /* disable keeping capabilities across setuid */
+ if (keepcaps && prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) == -1) {
+ if (critical) {
+ sockerror("prctl");
+ return 1;
+ }
+ }
+#endif
+
#endif /* standard Unix */
return 0;
}
--
2.17.1
--
Simon Arlott
1
0
25 May '20
Try:
* Verifying the openssl version(s)
* Verifying the 192.168.1.96:51400 port (nmap, netstat, etc.)
* Verifying connection (openssl s_client -connect 192.168.1.96:51400) * Verifying the ciphersuite * Verifying the certificate
>>Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second? Not sure. TIMEOUTclose?
On Sunday, May 24, 2020, 6:00:07 a.m. EDT, stunnel-users-request(a)stunnel.org <stunnel-users-request(a)stunnel.org> wrote:
Send stunnel-users mailing list submissions to
stunnel-users(a)stunnel.org
To subscribe or unsubscribe via the World Wide Web, visit
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
or, via email, send a message with subject or body 'help' to
stunnel-users-request(a)stunnel.org
You can reach the person managing the list at
stunnel-users-owner(a)stunnel.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of stunnel-users digest..."
Today's Topics:
1. /var/log/syslog is filling up with stunnel errors (digitek)
2. Re: /var/log/syslog is filling up with stunnel errors
(Thomas Ward)
----------------------------------------------------------------------
Message: 1
Date: Sat, 23 May 2020 18:17:49 -0500
From: digitek <digitek(a)charter.net>
To: stunnel-users(a)stunnel.org
Subject: [stunnel-users] /var/log/syslog is filling up with stunnel
errors
Message-ID: <434e3153-d94c-bb71-fc51-1716db588290(a)charter.net>
Content-Type: text/plain; charset=windows-1252; format=flowed
Hi,
I've been running stunnel for years to shuttle my syslogs off to a syslog server. It's performed flawlessly up until a few weeks ago. Recently, rebooting my syslog server results in the clients filling up /var/log/syslog
with messages like below[1].
I'm not certain where the issue is. We've gone through some Ubuntu 16.04 > 18.04 upgrades on some hosts, as well as the syslog server. Is there a configuration item in stunnel to at least tell it to chill out a little and
not try reconnecting 1000 times a second? My config from a client is here[2]
Last time this happened (few weeks ago) I googled around and found the TIMEOUTconnect parameter to try and get stunnel to at least wait 10 seconds before attempting another connect, but guess it doesn't work that way.
Any thoughts? The stunnel client is on Ubuntu 18.04. I'd rather not compile out-of-band for the latest stunnel version unless I must. I"m assuming this is a config issue on my end. The version I'm stuck with right now is
stunnel 5.44 on x86_64-pc-linux-gnu platform
Thanks!
[1]
May 23 17:42:04 shuriken stunnel: LOG5[44922183]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55440
May 23 17:42:04 shuriken stunnel: LOG3[44922184]: s_connect: connect 192.168.1.96:51400: Connection refused (111)
May 23 17:42:04 shuriken stunnel: LOG3[44922184]: No more addresses to connect
May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
May 23 17:42:04 shuriken stunnel: LOG5[44922185]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55444
May 23 17:42:04 shuriken stunnel: LOG3[44922185]: s_connect: connect 192.168.1.96:51400: Connection refused (111)
May 23 17:42:04 shuriken stunnel: LOG3[44922185]: No more addresses to connect
[2]
client = yes
cert = /etc/stunnel/shared/stunnel.pem
pid = /var/run/stunnel4/syslog_stunnel.pid
[syslog_tunnel]
accept = 127.0.0.1:5140
connect = 192.168.1.96:51400
TIMEOUTconnect = 10
------------------------------
Message: 2
Date: Sat, 23 May 2020 20:09:48 -0400
From: Thomas Ward <teward(a)thomas-ward.net>
To: digitek <digitek(a)charter.net>, stunnel-users(a)stunnel.org
Subject: Re: [stunnel-users] /var/log/syslog is filling up with
stunnel errors
Message-ID: <49V0wH16GWz2QGD(a)mail.syn-ack.link>
Content-Type: text/plain; charset="utf-8"
This is indicative of the remote server not running on the right ports normally or actively blocking you, given the "Connection Refused" errors.? Verify your system stunnel is on actually can connect to the specified IP and port combo independently of stunnel to start with.Sent from my Sprint Samsung Galaxy Note10+.
-------- Original message --------From: digitek <digitek(a)charter.net> Date: 5/23/20 19:18 (GMT-05:00) To: stunnel-users(a)stunnel.org Subject: [stunnel-users] /var/log/syslog is filling up with stunnel errors Hi,I've been running stunnel for years to shuttle my syslogs off to a syslog server. It's performed flawlessly up until a few weeks ago. Recently, rebooting my syslog server results in the clients filling up /var/log/syslog with messages like below[1].I'm not certain where the issue is. We've gone through some Ubuntu 16.04 > 18.04 upgrades on some hosts, as well as the syslog server. Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second?? My config from a client is here[2]Last time this happened (few weeks ago) I googled around and found the TIMEOUTconnect parameter to try and get stunnel to at least wait 10 seconds before attempting another connect, but guess it doesn't work that way.Any thoughts? The stu
nnel client is on Ubuntu 18.04. I'd rather not compile out-of-band for the latest stunnel version unless I must. I"m assuming this is a config issue on my end.? The version I'm stuck with right now is stunnel 5.44 on x86_64-pc-linux-gnu platformThanks![1]May 23 17:42:04 shuriken stunnel: LOG5[44922183]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socketMay 23 17:42:04 shuriken stunnel: LOG5[44922184]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55440May 23 17:42:04 shuriken stunnel: LOG3[44922184]: s_connect: connect 192.168.1.96:51400: Connection refused (111)May 23 17:42:04 shuriken stunnel: LOG3[44922184]: No more addresses to connectMay 23 17:42:04 shuriken stunnel: LOG5[44922184]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socketMay 23 17:42:04 shuriken stunnel: LOG5[44922185]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55444May 23 17:42:04 shuriken stunnel: LOG3[44922185]: s_connect: connect 192.168.1.96:51400: Conn
ection refused (111)May 23 17:42:04 shuriken stunnel: LOG3[44922185]: No more addresses to connect[2]client?? = yescert???? = /etc/stunnel/shared/stunnel.pempid????? = /var/run/stunnel4/syslog_stunnel.pid[syslog_tunnel]accept?? = 127.0.0.1:5140connect? = 192.168.1.96:51400TIMEOUTconnect = 10_______________________________________________stunnel-users mailing [email protected]://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
1
0
Hi,
I've been running stunnel for years to shuttle my syslogs off to a syslog server. It's performed flawlessly up until a few weeks ago. Recently, rebooting my syslog server results in the clients filling up /var/log/syslog
with messages like below[1].
I'm not certain where the issue is. We've gone through some Ubuntu 16.04 > 18.04 upgrades on some hosts, as well as the syslog server. Is there a configuration item in stunnel to at least tell it to chill out a little and
not try reconnecting 1000 times a second? My config from a client is here[2]
Last time this happened (few weeks ago) I googled around and found the TIMEOUTconnect parameter to try and get stunnel to at least wait 10 seconds before attempting another connect, but guess it doesn't work that way.
Any thoughts? The stunnel client is on Ubuntu 18.04. I'd rather not compile out-of-band for the latest stunnel version unless I must. I"m assuming this is a config issue on my end. The version I'm stuck with right now is
stunnel 5.44 on x86_64-pc-linux-gnu platform
Thanks!
[1]
May 23 17:42:04 shuriken stunnel: LOG5[44922183]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55440
May 23 17:42:04 shuriken stunnel: LOG3[44922184]: s_connect: connect 192.168.1.96:51400: Connection refused (111)
May 23 17:42:04 shuriken stunnel: LOG3[44922184]: No more addresses to connect
May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
May 23 17:42:04 shuriken stunnel: LOG5[44922185]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55444
May 23 17:42:04 shuriken stunnel: LOG3[44922185]: s_connect: connect 192.168.1.96:51400: Connection refused (111)
May 23 17:42:04 shuriken stunnel: LOG3[44922185]: No more addresses to connect
[2]
client = yes
cert = /etc/stunnel/shared/stunnel.pem
pid = /var/run/stunnel4/syslog_stunnel.pid
[syslog_tunnel]
accept = 127.0.0.1:5140
connect = 192.168.1.96:51400
TIMEOUTconnect = 10
2
3