stunnel-users

3306 discussions

RHEL6 Update stunnel-4.29-3.el6_6.1 breaks functionality?
by H.U.Flück 21 Dec '14

21 Dec '14

Hello I realized that the latest RHEL6 updates including stunnel-4.29-3.el6_6.1 break our Stunnel connections! We are forced to go back to previous version stunnel-4.29-3.el6_4 in order to have the systems running again, and blocking Stunnel updates in /etc/yum.conf for the moment. Our typical client config and server configs are as follows: Client (5.08): ********** client = yes compression = zlib sslversion = TLSv1 delay = yes debug = 7 taskbar = yes cert = my.pem [abas_ssh] accept = 127.0.30.10:5303 connect = firewall.client.dom:5303 Server, xinetd.d: ************* service stunnel_ssh { disable = no socket_type = stream instances = UNLIMITED per_source = UNLIMITED wait = no user = root server = /usr/bin/stunnel server_args = /etc/stunnel/stunnel_ssh.conf log_on_success += HOST DURATION log_on_failure += HOST } Server, stunnel_ssh.conf **************** cert = /support/stunnel/cert/server.pem CApath = / support /stunnel/hash/ verify = 3 debug = 7 connect = 192.168.1.100:22 The error thrown is something like: Dec 17 17:30:23 srvabas stunnel: LOG3[3385:140171595282368]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol What are we missing? Do we need to change the configuration? Any help is highly appreciated. Kind regards H.U.Flueck

4 3

Ordinal not found error on new Stunnel install
by Tracy Drake - IQ-C 15 Dec '14

15 Dec '14

Hello Michal! We have just pushed/began to push Stunnel version 5.04 to our user community. This version was extensively tested, pushed/installed on a number of machines both with an older version of Stunnel and no Stunnel at all. We are having a barrage of users encountering the below error. [image: Inline image 1] Can you offer insight/a quick resolution? Bear in mind that although I support the apps that require Stunnel I know very little about the ins and outs of Stunnel. I did google this error and found something to the effect that a newer version of the LIBEAY32.dll is required. Does this perhaps mean that this file did not get replaced on these machines. We were previously running quite an older version - 4.27. Please advise asap! -- Tracy Drake CSM Senior Consultant GSA-FAS CAMEO Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

2 1

building stunnel in FreeBSD
by Mirimir 12 Dec '14

12 Dec '14

In building the stunnel package from the port in FreeBSD 10.1, is it more secure to enable SSL_PORT? In particular, will that ensure that stunnel is using the latest openssl release? And if that is so, why is that build option disabled by default?

1 0

Stunnel PSK authentication
by Michal Trojnara 11 Dec '14

11 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Starting with stunnel-5.09b1 it is now possible to use stunnel without certificates. https://www.stunnel.org/downloads.html Example server configuration is: [PSK server] accept = <stunnel_port> connect = <dst_port> PSKsecrets = psk.txt , where the psk.txt may contain the following lines: test1:oaP4EishaeSaishei6rio6xeeph3az test2:yah5uS4aijooxilier8iaphuwah1Lo Example client configuration: [PSK client 1] client = yes accept = 127.0.0.1:<src_port> connect = <stunnel_ip>:<stunnel_port> PSKsecrets = psk1.txt PSKidentity = test1 The psk1.txt file only needs to contain: test1:oaP4EishaeSaishei6rio6xeeph3az Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlSKHNMACgkQ/NU+nXTHMtE72wCg/EZp4NdVnkrQFffGVWZO65lE QucAn3ddp+yTDruP+gNkevf///0olb1+ =o0k3 -----END PGP SIGNATURE-----

1 0

configure.ac patch
by Kip Walraven 11 Dec '14

11 Dec '14

In case others are struggling with CentOS 6.5 configure issues that I had, I'm providing the following unified diff patch -Kip #============================================== --- ../stunnel-5.08/configure.ac 2014-12-03 05:35:16.000000000 -0500 +++ ./configure.ac 2014-12-11 10:32:47.000000000 -0500 @@ -402,13 +402,13 @@ AC_MSG_RESULT([autodetecting]) # the library name has changed to -lsystemd in systemd 209 AC_SEARCH_LIBS([sd_listen_fds], [systemd systemd-daemon], - AC_CHECK_HEADERS([systemd/sd-daemon.h], [ + [ AC_CHECK_HEADERS([systemd/sd-daemon.h], [ AC_DEFINE([USE_SYSTEMD], [1], [Define to 1 to enable systemd socket activation]) AC_MSG_NOTICE([systemd support enabled]) ], [ AC_MSG_NOTICE([systemd header not found]) - ]), [ + ]) ], [ AC_MSG_NOTICE([systemd library not found]) ]) ] @@ -462,7 +462,8 @@ AC_MSG_CHECKING([for compiler sysroot]) if test "$GCC" = yes; then SYSROOT=`$CC --print-sysroot 2>/dev/null` -else +fi +if test -z "$SYSROOT" ; then SYSROOT="/" fi AC_MSG_RESULT([$SYSROOT]) #==============================================

2 1

Can I run stunnel on TWO computers with the same certificates?
by Ben Stover 09 Dec '14

09 Dec '14

I would like to use stunnel from my DEsktop AND my Notebook. Can I run them in parallel (with the same certificates) or do they confuse each other? Ben

1 0

stunnel 5.08 released
by Michal Trojnara 09 Dec '14

09 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.08 of stunnel. The ChangeLog entry: Version 5.08, 2014.12.09, urgency: MEDIUM: * New features - Added SOCKS4/SOCKS4a protocol support. - Added SOCKS5 protocol support. - Added SOCKS RESOLVE [F0] TOR extension support. - Updated automake to version 1.14.1. - OpenSSL directory searching is now relative to the sysroot. * Bugfixes - Fixed improper hangup condition handling. - Fixed missing -pic linker option. This is required for Android 5.0 and improves security. To setup SOCKS4 VPN configure the following client service: [socks_client] client = yes accept = 127.0.0.1:1080 connect = vpn_server:9080 verify = 4 CAfile = stunnel.pem The corresponding configuration on the vpn_server host: [socks_server] protocol = socks accept = 9080 cert = stunnel.pem key = stunnel.key SOCKS-enabled clients (e.g. web browsers) can now use stunnel client for a VPN service. Encrypted DNS resolver is supported with SOCKS4a, SOCKS5, and SOCKS RESOLVE [F0] TOR extension. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 830b21d24cd237e96f4d7993be43553d4eba4d3cfa2660faa78dec8d41d314fc stunnel-5.08.tar.gz 84c06c8a3f8b6bbb5c1a2b6e352c70bdad1c87f1d5a37476e5dee02f2d65065c stunnel-5.08-installer.exe 28750afe9e5fec4b60b98468ea834cd126e149e8d97074b813b216723a889802 stunnel-5.08-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlSGzsMACgkQ/NU+nXTHMtHQlwCgwsX66e0EU5PMxsfMCdC5sfVt Fy4AnRXe65YLabb7K1XOn6tKncEH0smR =WP5h -----END PGP SIGNATURE-----

1 0

stunnel with TLSv1.2 ciphers
by Jérémy WILLIAME 08 Dec '14

08 Dec '14

Hi, I want to use stunnel with TLSv1.2 ciphers but it doesn't work. I use stunnel 5.07 compiled from source with prefix /opt/stunnel and lastest openssl (1.0.1j) This is my main configuration file: chroot = /opt/stunnel/var/lib/stunnel/ pid = /stunnel4.pid **cert = /opt/stunnel/etc/blabla/bla.pem key = /opt/stunnel/etc/blabla/bla.key ciphers = ECDHE-ECDSA-AES256-GCM-SHA384 options = NO_SSLv2 [imaps] accept = 993 connect = 143 I had to use one of this ciphers: ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 DHE-RSA-AES256-GCM-SHA384 When i tried to use imaps connection over stunnel : root@bla: imtest -a homer -w homer -p 993 -s localhost SSL_connect error 0 SSL session removed failure: TLS negotiation failed if i use a SSLv3 cipher it works. root@bla: imtest -a homer -w homer -p 993 -s localhost verify error:num=18:self signed certificate TLS connection established: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Someone have any idea ? Thanks. Jeremy

2 1

Stunnel for android
by Neacsu Mihai Adrian 03 Dec '14

03 Dec '14

Hello everyone. I am new to Stunnel, but i would like to compile a working version for Android L. The android version on the website is not compiled with PIE support, thus it does not run on Android L. I tried to look through the source code, and add the flags, -fPie and -pie, but i did not figure out where to do that. Also, after settings 755 on build-android.sh and running it, i get Permission denied on creating folders inside the /bin/android folder, even if i am running as root user. Any help is highly appreciated and i appologize if this has been already write in the archives, but i was not able to find anything related.

2 2

Memory leak on reconfiguration
by Alexander Paramonov 21 Nov '14

21 Nov '14

Hello, colleagues! I suppose there is a memory leak on stunnel reconfiguration when it receives the SIGHUP signal. Here is my experiment with stunnel 5.05 on linux: ~/busybox $ cat /home/posdebug/stunnel.cfg debug=6 options=NO_SSLv2 pid=/tmp/stunnel.pid [57797] accept = 127.0.0.1:57797 connect = 80.90.125.219:64141 key = /usr/unsign/key.pem cert = /usr/unsign/cert.pem CAfile = /usr/unsign/cert.pem verify = 2 ciphers = AES128-SHA:AES256-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:EDH-RSA-DES-CBC3-SHA sslVersion = all TIMEOUTbusy = 100 TIMEOUTconnect = 100 client = yes ~/busybox $ /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ top | grep stunnel 986 1 posdebug S *3592* 5.7 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ top | grep stunnel 986 1 posdebug S *3720* 5.9 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ top | grep stunnel 986 1 posdebug S *3848* 6.2 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg As i noticed, there are a lot of allocs on reconfiguration and only a few free() calls. Why? RAM is not unlimited, as far as i know. Any comments would be highly appreciated. -- Best regards Alexander Paramonov Software Engineer Terminal Technologies

2 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users