stunnel-users

3306 discussions

Stunnel, Pan and the SSL23_GET_SERVER_HELLO:unknown protocol
by mike 28 Jun '12

28 Jun '12

Hello All, Running Debian 6.0, stunnel4 and Pan 0.133 I have set up Pan and installed stunnel so that I can use ssl with nntp. Installing Pan and stunnel was easy. I've edited Pan to use localhost:119 and edited my config file in stunnel to point to my nntp server. I have allowed nntp in my hosts.allow for ALL:ALL. The problem I am running into is that Pan does not connect. I get the following error: Error reading from localhost. Connection reset by peer Checking with the following openssl command produced this error: root@triglav:/etc/stunnel# openssl s_client -ssl3 -connect localhost:119 CONNECTED(00000003) write:errno=104 Looking at the logs for stunnel I see many repetitions of this message: 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp started 2012.06.25 14:18:26 LOG7[16355:3074153328]: FD 13 in non-blocking mode 2012.06.25 14:18:26 LOG7[16355:3074153328]: TCP_NODELAY option set on local socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: Waiting for a libwrap process 2012.06.25 14:18:26 LOG7[16355:3074153328]: Acquired libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: Releasing libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: Released libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp permitted by libwrap from 127.0.0.1:59451 2012.06.25 14:18:26 LOG5[16355:3074153328]: nntp accepted connection from 127.0.0.1:59451 2012.06.25 14:18:26 LOG7[16355:3074153328]: FD 14 in non-blocking mode 2012.06.25 14:18:26 LOG6[16355:3074153328]: connect_blocking: connecting 209.197.15.238:119 2012.06.25 14:18:26 LOG7[16355:3074153328]: connect_blocking: s_poll_wait 209.197.15.238:119: waiting 10 seconds 2012.06.25 14:18:26 LOG5[16355:3074153328]: connect_blocking: connected 209.197.15.238:119 2012.06.25 14:18:26 LOG5[16355:3074153328]: nntp connected remote server from 192.168.2.56:51455 2012.06.25 14:18:26 LOG7[16355:3074153328]: Remote FD=14 initialized 2012.06.25 14:18:26 LOG7[16355:3074153328]: TCP_NODELAY option set on remote socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: SSL state (connect): before/connect initialization 2012.06.25 14:18:26 LOG7[16355:3074153328]: SSL state (connect): SSLv2/v3 write client hello A 2012.06.25 14:18:26 LOG3[16355:3074153328]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2012.06.25 14:18:26 LOG5[16355:3074153328]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp finished (0 left) Anyone know what is missing? It almost looks like it cant talk in either SSLv2 or v3 which makes no sense. Here is my stunnel config: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /var/log/stunnel4/stunnel.log foreground = no ; Use it for client mode client = yes ; Service-level configuration [nntp] accept = localhost:119 connect = news.aliant.net:119 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

2 4

Interoperability problems with .net client software
by ProPharma Systems AG - Gregor Bürgisser 28 Jun '12

28 Jun '12

Hi all, I'm using stunnel 4.53 under Linux to secure a service. There are two different clients connecting to this service: My own client, also Linux based and using libcurl and another (third party!) client being developed using Microsoft .net stuff. Of course with my own client all works well. But we are not able to get the Microsoft client running. stunnel keeps on telling: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate We have tried diffierent things... I will outline them here if you think it is helpful (in short: tried using certificates generated on the Microsoft side, then tried using certificates created on the Linux side). If "verify" ist set to 0 or 1 it works (of course) but with a higher value the above message is logged. Are there any known pitfalls, problems or whatsoever when using stunnel with a .net client? Any advice would be appreciated! Regards, Gregor

2 1

Accept on same port to ethernet aliases
by John Morrison 27 Jun '12

27 Jun '12

Hi, Is it possible to configure stunnel to use the same port on different IP addresses that are Ethernet aliases? I have successfully set up a configuration file accepting SSL connections. Firstly I did this on all IP addresses by using the following configuration lines: accept = 443 connect = 80 This worked correctly. I then attempted to setup a second configuration file on an aliased Ethernet address. The configuration file settings are: test1.conf accept = 10.168.1.132:443 connect = 10.168.1.132:80 test2.conf accept = 10.168.1.133:443 connect = 10.168.1.133:80 Stunnel is able to start the first configuration file, but not the second. The error message I can see when I run the second configuration file in the foreground is: accept socket: FD=11 allocated (non-blocking mode) Option SO_REUSEADDR set on accept socket Error binding https to 10.168.1.133:443 bind: Address already in use (98) and if I telnet to 10.168.1.133 on port 443 the connection is accepted. I have attempted to use the binding socket options in the configuration files as described in the manual: socket = a:SO_BINDTODEVICE=eth0:0 and socket = a:SO_BINDTODEVICE=eth0:1 However in this case stunnel will not start either configuration file. The error message I receive is: Option SO_REUSEADDR set on accept socket SO_BINDTODEVICE: No such device (19) Is there a different way to configure stunnel to allow this to work? My ipconfig settings are below. I am running the ubuntu 10.04 version of stunnel. The version output is: stunnel 4.35 on x86_64-pc-linux-gnu with OpenSSL 1.0.0e 6 Sep 2011 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Thanks, John eth0:0 Link encap:Ethernet HWaddr 3c:4a:92:6d:0b:08 inet addr:10.168.1.132 Bcast:10.168.1.132 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:16 Memory:f4000000-f4012800 eth0:1 Link encap:Ethernet HWaddr 3c:4a:92:6d:0b:08 inet addr:10.168.1.133 Bcast:10.168.1.133 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:16 Memory:f4000000-f4012800

2 2

Confused about stunnel + haproxy
by Robin Lee Powell 27 Jun '12

27 Jun '12

I've set up stunnel + haproxy using the "protocol = proxy" method, but stunnel doesn't seem to pass to haproxy any information about the source IP of the original connection, which I thought was the point of using this method? Can someone tell me what I'm missng? I just want to have haproxy with SSL support without losing the client IP information completely. -Robin -- http://singinst.org/ : Our last, best hope for a fantastic future. .i ko na cpedu lo nu stidi vau loi jbopre .i danfu lu na go'i li'u .e lu go'i li'u .i ji'a go'i lu na'e go'i li'u .e lu go'i na'i li'u .e lu no'e go'i li'u .e lu to'e go'i li'u .e lu lo mamta be do cu sofybakni li'u

1 1

socket status
by Dee Ayy 20 Jun '12

20 Jun '12

My socket in Eiffel will report that it is connected, but when it tries to write to the socket, it will fail and report Connection reset by peer I/O error The syslog shows 1) ... accepted connection from 127.0.0.1:.. 2) connect_blocking: getsockopt A_REMOTE_IP:A_REMOTE_PORT: Connection refused (111) 3) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket I believe that my socket is connecting locally fine 127.0.0.1:.. in step 1, and then the remote connection via stunnel is failing in step 2, but I have tried to write to the socket in between steps 1 and 2. Is this proper behavior? How can I know the status of the remote connection? Wait a while and then test? Is the socket state really just the state of the local stunnel connection? Should stunnel report a different state (as seen by my socket) until it determines the remote socket state?

1 0

What version of stunnel am I using?
by Dee Ayy 20 Jun '12

20 Jun '12

I don't see a version here stunnel -version 2012.06.20 16:44:05 LOG7[25078:3074172608]: RAND_status claims sufficient entropy for the PRNG 2012.06.20 16:44:05 LOG7[25078:3074172608]: PRNG seeded successfully 2012.06.20 16:44:05 LOG3[25078:3074172608]: /etc/stunnel/stunnel.pem: No such file or directory (2) apt-cache search stunnel on Ubuntu has stunnel4

1 0

Error connecting through IE6
by Karl Kloppenborg 15 Jun '12

15 Jun '12

Hey Stunnel guys! I've got a bit of an issue in which users on ie6 cannot connect through HTTPs to my haproxy cluster, they get a 404 page cannot be displayed. Works fine in all other browsers ;) The logs from Stunnel are: 2012.06.13 01:06:09 LOG7[28347:47884616028640]: local socket: FD=14 allocated (non-blocking mode) 2012.06.13 01:06:09 LOG7[28347:47884616028640]: Service incoming-https accepted FD=14 from [ClientIP]:1208 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https started 2012.06.13 01:06:09 LOG7[28347:1078843712]: Option TCP_NODELAY set on local socket 2012.06.13 01:06:09 LOG7[28347:1078843712]: Waiting for a libwrap process 2012.06.13 01:06:09 LOG7[28347:1078843712]: Acquired libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Releasing libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Released libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https permitted by libwrap from [ClientIP]:1208 2012.06.13 01:06:09 LOG5[28347:1078843712]: Service incoming-https accepted connection from [ClientIP]:1208 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): before/accept initialization 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read client hello A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write server hello A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write certificate A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write server done A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 flush data 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read client key exchange A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read finished A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write change cipher spec A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write finished A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 flush data 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 items in the session cache 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client connects (SSL_connect()) 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client connects that finished 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client renegotiations requested 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 server connects (SSL_accept()) 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 server connects that finished 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 server renegotiations requested 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 session cache hits 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 external session cache hits 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 session cache misses 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 session cache timeouts 2012.06.13 01:06:09 LOG6[28347:1078843712]: SSL accepted: new session negotiated 2012.06.13 01:06:09 LOG6[28347:1078843712]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2012.06.13 01:06:09 LOG7[28347:1078843712]: remote socket: FD=15 allocated (non-blocking mode) 2012.06.13 01:06:09 LOG6[28347:1078843712]: connect_blocking: connecting [HAPROXY IP]:81 2012.06.13 01:06:09 LOG7[28347:1078843712]: connect_blocking: s_poll_wait [HAPROXY IP]:81: waiting 10 seconds 2012.06.13 01:06:09 LOG5[28347:1078843712]: connect_blocking: connected [HAPROXY IP]:81 2012.06.13 01:06:09 LOG5[28347:1078843712]: Service incoming-https connected remote server from [HAPROXY IP]:55823 2012.06.13 01:06:09 LOG7[28347:1078843712]: Remote FD=15 initialized 2012.06.13 01:06:09 LOG7[28347:1078843712]: Option TCP_NODELAY set on remote socket 2012.06.13 01:06:09 LOG5[28347:1078843712]: Error detected on SSL (read) file descriptor: Connection reset by peer (104) 2012.06.13 01:06:09 LOG5[28347:1078843712]: Connection reset: 0 bytes sent to SSL, 320 bytes sent to socket 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https finished (0 left) 2012.06.13 01:06:09 LOG7[28347:1078843712]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) Could stunnel be at play here or am I looking at the wrong thing? Thanks! Karl. Karl Kloppenborg Programming Ninja Crucial Paradigm Pty Ltd Suite 1 Level 3 104-106 Commonwealth St Surry Hills NSW 2010 Australia 1300 884 839 - Sales & Support (AU Only) <https://support.crucialp.com/> Click here for the Support Desk d: 02 8202 9994 f: 02 92818261 m: 0416 236 908 e: <mailto:[email protected]> karl(a)crucial.com.au Crucial Paradigm is a leading Web Hosting provider that specialises in Cloud solutions. We are commited to keeping our planet green, please reduce, reuse and recycle your office paper. Description: crucial_2012

2 3

Stunnel 4.53 for win32 - without config file
by Ivanko B 14 Jun '12

14 Jun '12

How to bypass reading any config file so that all needed options were fed from command line ? (security reasons)

5 7

Re: [stunnel-users] Getting Stunnel to Work Under Windows 7 64-bit
by Brian Wilkins 14 Jun '12

14 Jun '12

I should note that I have been running stunnel 4.45 on Windows 7 since Oct-2011 with no problems whatsoever. It has been running non-stop on Windows 7 to this date with no problems. I have not upgraded to the latest because I have not been able to have time to test the FIPS changes with my configuration yet. Brian

4 6

stunnel version 4.53 says SSL server needs a certificate on Windows 7?
by Wayne Walter 13 Jun '12

13 Jun '12

I have been using stunnel previous versions just fine. It didn't apparently have the feature of a certificate in SSL server mode. That's alright but not necessary for us as we're simply running a localhost server to tunnel to the remote server. Anyway, I have read the FAQ tutorial and such related to this and tried everything. No mater what I do with the cert or key settings it still gives this same error here's the complete output.... No limit detected for the number of clients stunnel 4.53 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from C:/.rnd Wrote 0 new random bytes to C:/.rnd PRNG seeded successfully Initializing service section [FIX] Section FIX: SSL server needs a certificate Server is down And here is the stunnel.conf file contents: ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [FIX] accept = 127.0.0.1:5679 connect = 216.52.236.112:5680 TIMEOUTconnect = 5 [FIXLIVE] accept = 127.0.0.1:5680 connect = 216.52.236.185:51581 TIMEOUTconnect = 5 Please not that stunnel came installed with an stunnel.pem file. I tried uncommenting the config line for the key. Also regenerated the key using openssh per instructions. I tried using absolute path to the cert file. Nothing makes any difference. Is this a defect in stunnel? Or am I doing something wrong?

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users