- stunnel-users - stunnel.org

SSL VPN configuration confusion
by TJ 28 Mar '13

28 Mar '13

I'm using stunnel v4.56 on Linux (Ubuntu) and trying to configure a routed tunnel in conjunction with pppd. I could do with some help to figure it out - my biggest problem is not knowing what a good connection configuration or log looks like. I've read lots of (old) patchy articles on how it is done but the instructions are either hopelessly out of date, or plain wrong. During extensive trial and error I found what appeared to be bugs in the Ubuntu distro-packaged v4.42 but as I don't yet know what a successful connection log looks like they may have been red herrings. The main issue I was trying to build out of was (on the server): SSL accepted: new session negotiated Negotiated ciphers: ECDHE-RSA-RC4-SHA SSLv3 Kx=ECDH Au=RSA Enc=RC4(128) Mac=SHA1 TTY=/dev/pts/4 allocated Local mode child started (PID=17247) Remote FD=1 initialized TCP_NODELAY: Socket operation on non-socket (88) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket linger (remote): Socket operation on non-socket (88) Service vpn finished (0 left) At this point there would be no pppX interfaces. I created an up-to-date Debian/Ubuntu package for v4.56 which has been more successful. Both ends of the link have the same x86 (i386) package installed. On the server again: stunnel: LOG6[23986:3073268544]: SSL accepted: new session negotiated stunnel: LOG6[23986:3073268544]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-RC4-SHA (128-bit encryption) stunnel: LOG6[23986:3073268544]: Compression: null, expansion: null stunnel: LOG7[23986:3073268544]: TTY=/dev/pts/5 allocated stunnel: LOG6[23986:3073268544]: Local mode child started (PID=23989) stunnel: LOG7[23986:3073268544]: Remote socket (FD=14) initialized stunnel: LOG3[23986:3073268544]: TCP_NODELAY: Socket operation on non-socket (88) stunnel: LOG4[23986:3073268544]: Failed to set remote socket options pppd[23989]: pppd options in effect: pppd[23989]: debug^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: updetach^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: linkname pella^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: ktune^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: unit 3^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: dump^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: nomp^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noauth^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: ^I^I# (from /etc/ppp/options) pppd[23989]: notty^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: crtscts^I^I# (from /etc/ppp/options) pppd[23989]: local^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noaccomp^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: asyncmap 0^I^I# (from /etc/ppp/options) pppd[23989]: nopcomp^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: silent^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: lcp-echo-failure 4^I^I# (from /etc/ppp/options) pppd[23989]: lcp-echo-interval 30^I^I# (from /etc/ppp/options) pppd[23989]: hide-password^I^I# (from /etc/ppp/options) pppd[23989]: novj^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noipdefault^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noccp^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noipx^I^I# (from /etc/ppp/options) pppd[23989]: pppd 2.4.5 started by root, uid 0 pppd[23989]: using channel 19 udevd[2122]: device 0xb7b0a6e8 has devpath '/devices/virtual/net/ppp3' udevd[2122]: created empty file '/run/udev/data/n27' for '/devices/virtual/net/ppp3' pppd[23989]: Using interface ppp3 pppd[23989]: Connect: ppp3 <--> /dev/pts/6 Both ends of the link have ppp interfaces but neither have IP addresses. The server configuration is: ----- /etc/stunnel/pella-vpn.conf ----- CAfile = /etc/stunnel/vpn.pem cert = /etc/stunnel/vpn.pem key = /etc/stunnel/vpn.pem output = /var/log/stunnel-vpn.log #verify = 2 debug = 7 client = no foreground = no [vpn] accept = 109.74.x.y:9876 exec = /usr/sbin/pppd execargs = pppd call pella-vpn 10.254.241.1:10.254.241.2 pty = yes ---------- ----- /etc/ppp/peers/pella-vpn ----- unit 3 notty ktune local noipdefault noccp noauth novj nomp nopcomp noaccomp silent updetach linkname pella debug dump ---------- # ifconfig ppp3 ppp3 Link encap:Point-to-Point Protocol POINTOPOINT NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:3 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) The client configuration is: ---- /etc/network/interfaces ----- # SSL VPN to Pella iface ppp3 inet ppp unit 3 provider pella-vpn pre-up /sbin/ifconfig ppp0 up ---------- ----- /etc/ppp/peers/pella-vpn ----- # ensure we use ppp3 (ppp0-2 are already in use) unit 3 ktune local noipdefault noccp noauth novj nomp nopcomp noaccomp silent updetach logfd 2 linkname pella pty "/usr/bin/stunnel4 /etc/stunnel/pella.conf.vpn" user "tj" # debugging debug dump ---------- ----- /etc/stunnel/pella.conf.vpn ----- pid = /var/run/stunnel4/pella.pid debug = debug output = /var/log/stunnel-pella.log foreground = no client=yes connect = 109.74.x.y:9876 CAfile = /etc/stunnel/vpn.pem # verify the peer's certificate verify = 2 ---------- # ifup ppp3 pppd options in effect: debug # (from /etc/ppp/peers/pella-vpn) updetach # (from command line) logfd 2 # (from /etc/ppp/peers/pella-vpn) linkname pella # (from /etc/ppp/peers/pella-vpn) ktune # (from /etc/ppp/peers/pella-vpn) unit 3 # (from command line) dump # (from /etc/ppp/peers/pella-vpn) nomp # (from /etc/ppp/peers/pella-vpn) noauth # (from /etc/ppp/peers/pella-vpn) user tj # (from /etc/ppp/peers/pella-vpn) # (from /etc/ppp/options) pty /usr/bin/stunnel4 /etc/stunnel/pella.conf.vpn # (from /etc/ppp/peers/pella-vpn) crtscts # (from /etc/ppp/options) local # (from /etc/ppp/peers/pella-vpn) noaccomp # (from /etc/ppp/peers/pella-vpn) asyncmap 0 # (from /etc/ppp/options) nopcomp # (from /etc/ppp/peers/pella-vpn) silent # (from /etc/ppp/peers/pella-vpn) lcp-echo-failure 4 # (from /etc/ppp/options) lcp-echo-interval 30 # (from /etc/ppp/options) hide-password # (from /etc/ppp/options) novj # (from /etc/ppp/peers/pella-vpn) noipdefault # (from /etc/ppp/peers/pella-vpn) noccp # (from /etc/ppp/peers/pella-vpn) noipx # (from /etc/ppp/options) using channel 43 Using interface ppp3 Connect: ppp3 <--> /dev/pts/5 # ifconfig ppp3 ppp3 Link encap:Point-to-Point Protocol POINTOPOINT NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:3 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) # netstat -natp | grep stun tcp 0 0 82.71.a.b:34437 109.74.x.y:9876 ESTABLISHED 24105/stunnel4

1 2

Fw: High memory usage problem.
by mkanet＠yahoo.com 27 Mar '13

27 Mar '13

Jeremy, I know there's an android build of stunnel. Im not trying to be funny, but are you running stunnel on your mobile phone? :) The latest android mobile phones include quadcore CPU's with 2GB's of RAM It would be interesting to see how much of a load a mobile phone can handle with a USB to RJ45 Ethernet interface. Edit: I tried sending this earlier, but it doesn't look like it went through. My apologies in case this is a duplicate. ------------------------ Thanks for taking the time to read this. We're operating on a low spec system that can not be modified at this point. stunnel was introduced at the last minute, without consideration to resource requirements and now consumes enough ram to cause the kernel to issue OOM exceptions. So in short, we are trying to trade increased CPU usage for less memory usage and have tried setting “sessions” to 3600 to reduce memory pressure, but unfortunately it doesn't last. Our current solution is to cron a restart of stunnel on a regular basis, but would prefer to limit number of threads or number of cache entries or something else altogether similarly gentler. Thanks again for your consideration and assistance in this! If there's any specific information I can give, please let me know. Regards, Jeremy

3 7

environment/user variable
by Sebastian Rose-Indorf 26 Mar '13

26 Mar '13

Hello, Stunnel is a very helpful tool. But I miss the support of a environment/user variable to reference the configuration file or the folder of the configuration file: such as %GNUPGHOME% in GnuPG or %OPENSSL_CONF% in OpenSSL. Sebastian

1 0

the range of stunnel functionality
by John A. Wallace 26 Mar '13

26 Mar '13

Where can I find more information about the use and functionality of "tstunnel.exe"? Maybe I am going quite blind, but I looked around unsuccessfully. Thanks. John A. Wallace The pen is mightier than the sword, but only if you get in the first stroke.

3 3

stunnel 4.56 released
by Michal Trojnara 23 Mar '13

23 Mar '13

Dear Users, I have released version 4.56 of stunnel. The ChangeLog entry: Version 4.56, 2013.03.22, urgency: HIGH: * New features - Win32 installer automatically configures firewall exceptions. - Win32 installer configures administrative shortcuts to invoke UAC. - Improved Win32 GUI shutdown time. * Bugfixes - Fixed a regression bug introduced in version 4.55 causing random crashes on several platforms, including Windows 7. - Fixed startup crashes on some Win32 systems. - Fixed incorrect "stunnel -exit" process synchronisation. - Fixed FIPS detection with new versions of the OpenSSL library. - Failure to open the log file at startup is no longer ignored. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-4.56.tar.gz: 9cae2cfbe26d87443398ce50d7d5db54e5ea363889d5d2ec8d2778a01c871293 Best regards, Mike

2 2

4.56 FIPS startup issue
by Ian Donaldson 23 Mar '13

23 Mar '13

Hi, I've been using stunnel for years and tried to upgrade to 4.56 today and it fails to start with this error: Clients allowed=125 stunnel 4.56 on i386-pc-solaris2.9 platform Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file /opt/local/etc/stunnel.conf FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported Line 36: "[pop3s]": Failed to initialize SSL str_stats: 5 block(s), 118 data byte(s), 210 control byte(s) I note some mention of FIPS in today's release. 4.55 started ok though with the same version of openssl (and crashed a few hours later), so we're back to 4.54 again. Ian D

1 1

stunnel craches in windows 7 x64
by Mosy Mosy 15 Mar '13

15 Mar '13

I have been facing with a strange bug in stunnel 4.55 (and also in tstunnel) in Windows 7 x64 and also in Windows Server 2003 R2 x86. I redirect TCP connections from a win7 client to a win2k3 server. Stunnel works fine when accepting connections and transferring data. But suddenly crashes when the client program (in the client side) closes the connection (maybe the several connections simultaneously). It happens on the server side too. Because of this problem I have to load a little program to relaunch stunnel whenever it is crashed. What I mean by 'crash' is that the windows shows the "stunnel stops working" and giving the choices to restart,stop, or debug the program. If you need more details I will be pleased to help you in this case. Thank you :) PS: I just have downloaded "stunnel-4.56b1" and I'm using it right now. I see no sign of crashing and instability until this moment :) it seems the bug is eliminated :)

1 0

4.55 is unstable
by Death Master 14 Mar '13

14 Mar '13

Windows build of 4.55, 2013.03.03 crashes every 20-60sec under load. OS:Win7 x64 (with all updates) This bug affects both stunnel and tstunnel. Please fix it soon ;)

5 6

stunnel: SSL routinesdecryption failed or bad record mac
by Kishore Paul 13 Mar '13

13 Mar '13

Hello Everyone, I updated to the latest version of stunnel and openssl and am still getting a lot of decryption fails. stunnel: SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac and a few times it just segfaults: [937987.314573] stunnel: segfault at 7f6164025000 ip 00007f616d8b5adc sp 00007f616e6a9af0 error 4 in libcrypto.so.1.0.0[7f616d84a000+19f000] stunnel 4.54 on x86_64-unknown-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1 14 Mar 2012 Is there any way to avoid these errors? I limited my cipher set to just RC4-SHA after seeing that there is an issue even in openssl 1.01e-1 for e_aes_cbc_hmac_sha1.c http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678353 Appreciate your help. Thanks, Kishore

1 0

Need help to configure STUNNEL using proxy socks v5 to send file to a server
by laurent.uk＠bnpparibas.com 11 Mar '13

11 Mar '13

Hi everyone, I need to connect to proxy socks V5 in order to send file in my server. I configure my stunnel like this : sslVersion = SSLv3 client=yes cert = /opt/freeware/etc/stunnel/ca_nopass.pem pid = /var/adm/stunnel_test.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /logs/stunnel/stunnel.log ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ protocol = connect protocolAuthentication = basic protocolHost = ***:8080 [pesit] accept = 12099 connect = ***:433 But it doesn't works! The log from my stunnel client : 2013.03.11 18:57:30 LOG5[26673178:260]: Service pesit accepted connection from ***:48549 2013.03.11 18:57:30 LOG7[26673178:260]: remote socket: FD=1 allocated (non-blocking mode) 2013.03.11 18:57:30 LOG6[26673178:260]: connect_blocking: connecting ::1:10443 2013.03.11 18:57:30 LOG3[26673178:260]: connect_blocking: connect ::1:10443: Connection refused (79) 2013.03.11 18:57:30 LOG7[26673178:260]: remote socket: FD=1 allocated (non-blocking mode) 2013.03.11 18:57:30 LOG6[26673178:260]: connect_blocking: connecting ****:10443 2013.03.11 18:57:30 LOG5[26673178:260]: connect_blocking: connected ****:10443 2013.03.11 18:57:30 LOG5[26673178:260]: Service pesit connected remote server from ****:48551 2013.03.11 18:57:30 LOG7[26673178:260]: Remote FD=1 initialized 2013.03.11 18:57:30 LOG7[26673178:260]: Option TCP_NODELAY set on remote socket 2013.03.11 18:57:30 LOG6[26673178:260]: Client-mode connect protocol negotiations started 2013.03.11 18:57:30 LOG7[26673178:260]: -> CONNECT ****:1080 HTTP/1.1 2013.03.11 18:57:30 LOG7[26673178:260]: -> Host: ****:1080 2013.03.11 18:57:30 LOG7[26673178:260]: -> 2013.03.11 18:57:30 LOG3[26673178:260]: fdgetline: readsocket: Connection reset by peer (73) 2013.03.11 18:57:30 LOG5[26673178:260]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2013.03.11 18:57:30 LOG7[26673178:260]: Service pesit finished (0 left) 2013.03.11 18:57:30 LOG7[26673178:260]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) 2013.03.11 18:57:32 LOG7[26673178:1]: local socket: FD=0 allocated (non-blocking mode) In my stunnel server, i have the following message : "SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request" 2013.03.11 18:57:30 LOG7[27525210:1]: Service pesitip accepted FD=0 from ****:48551 2013.03.11 18:57:30 LOG7[27525210:265]: Service pesitip started 2013.03.11 18:57:30 LOG7[27525210:265]: Option TCP_NODELAY set on local socket 2013.03.11 18:57:30 LOG5[27525210:265]: Service pesitip accepted connection from 159.50.49.69:48551 2013.03.11 18:57:30 LOG3[27525210:265]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request 2013.03.11 18:57:30 LOG5[27525210:265]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2013.03.11 18:57:30 LOG7[27525210:265]: Service pesitip finished (0 left) 2013.03.11 18:57:30 LOG7[27525210:265]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) 2013.03.11 18:57:32 LOG7[27525210:1]: local socket: FD=0 allocated (non-blocking mode) Can you help me to configure my stunnel please? Thanks. Regards, Laurent UK This message and any attachments (the "message") is intended solely for the intended addressees and is confidential. If you receive this message in error,or are not the intended recipient(s), please delete it and any copies from your systems and immediately notify the sender. Any unauthorized view, use that does not comply with its purpose, dissemination or disclosure, either whole or partial, is prohibited. Since the internet cannot guarantee the integrity of this message which may not be reliable, BNP PARIBAS (and its subsidiaries) shall not be liable for the message if modified, changed or falsified. Do not print this message unless it is necessary,consider the environment. ---------------------------------------------------------------------------------------------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur ou s'il ne vous est pas destine, merci de le detruire ainsi que toute copie de votre systeme et d'en avertir immediatement l'expediteur. Toute lecture non autorisee, toute utilisation de ce message qui n'est pas conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite. L'Internet ne permettant pas d'assurer l'integrite de ce message electronique susceptible d'alteration, BNP Paribas (et ses filiales) decline(nt) toute responsabilite au titre de ce message dans l'hypothese ou il aurait ete modifie, deforme ou falsifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0