stunnel-users

3306 discussions

No cert?
by Dave Gradwell 27 Sep '16

27 Sep '16

Is there any way to configure a Stunnel server so that it doesn’t require a cert at all? I implement peer authentication using other means; I just want session encryption from Stunnel. Ideally, I’d like keys to be generated on-the-fly for each new connection. I don’t mind if this takes a few seconds… Thanks, Dave.

1 0

Re: [stunnel-users] Hangs when connecting -- advice pls
by Scott McKeown 21 Sep '16

21 Sep '16

Hi Guys, To me this looks like a cipher issue. There are a few options that you can try to resolve this if it is. I would try adding the following lines into your STunnel Configuration file: delay = yes options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = CIPHER_SERVER_PREFERENCE options = DONT_INSERT_EMPTY_FRAGMENTS Delay will delay and DNS lookups that maybe actioned by the request (not normally needed but I always include if for sanity sake) The three 'options' sections turn off all the known problematic cipher lists if you need a key that is in one of these block feel free to remove that directive but I think a good start would be to leave the 'NO_SSLv3' option in place The 'CIPHER_SERVER_PREFERENCE' option will make set whether the client is allowed to renegotiat the ciphers that are to be used between the client and the server process. And finally 'DONT_INSERT_EMPTY_FRAGMENTS' will mitigate an issue in the CBC ciphers that was in the SSLv3 and TLS1.0 cipher lists again I only include it for sanity sake now but its better to have than to go without. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 (24x7) Tel (US) - +1 888.867.9504 (Toll Free)(24x7)

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 146, Issue 10
by Hon Quach 16 Sep '16

16 Sep '16

Can I be please removed from the mailing list? Sent from my iPhone > On Sep 16, 2016, at 12:14 PM, stunnel-users-request(a)stunnel.org wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: compilation error with stunnel-5.35 (Josealf.rm) > 2. Re: compilation error with stunnel-5.35 (Viorel Panaite) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 16 Sep 2016 13:04:09 -0500 > From: "Josealf.rm" <josealf(a)rocketmail.com> > To: Viorel Panaite <Viorel.Panaite(a)tecsys.com> > Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> > Subject: Re: [stunnel-users] compilation error with stunnel-5.35 > Message-ID: <6CE9A3F0-EE74-4CF0-ACCE-C5941B6B40A2(a)rocketmail.com> > Content-Type: text/plain; charset="utf-8" > > > Visorel, > > Did you compile OpenSSL yourself? Did you enable shared library support? > Maybe you system is picking system installed OpenSSL headers (0.9.8) instead of the new ones. > > Regards > Jose > > > Enviado desde mi iPhone >> El 16/09/2016, a las 9:39 a.m., Viorel Panaite <Viorel.Panaite(a)tecsys.com> escribió: >> >> I downloaded stunnel-5.35 and I’m trying to compile using openssl-1.0.2h on RedHat EL linux 5.4 >> >> I get this error when I’m trying to compile them together, >> >> Configure log >> ./configure --prefix=/apps/stunnel/535 --with-ssl=/apps/openssl/1.0.2h/ >> ……………………. >> hecking for broken poll() implementation... no >> checking for pipe2... no >> checking for accept4... no >> configure: **************************************** optional features >> checking whether to enable IPv6 support... yes (default) >> checking whether to enable FIPS support... autodetecting >> checking whether to enable systemd socket activation support... autodetecting >> checking for library containing sd_listen_fds... no >> configure: systemd library not found >> checking whether to enable TCP wrappers support... autodetecting >> checking for hosts_access in -lwrap... yes >> configure: libwrap support enabled >> configure: **************************************** SSL >> checking for compiler sysroot... / >> checking for SSL directory... /apps/openssl/1.0.2h/ >> checking for FIPS_mode_set... yes >> configure: FIPS support enabled >> configure: **************************************** write the results >> checking that generated files are newer than configure... done >> configure: creating ./config.status >> config.status: creating Makefile >> config.status: creating src/Makefile >> config.status: creating doc/Makefile >> config.status: creating tools/Makefile >> config.status: creating src/config.h >> config.status: src/config.h is unchanged >> config.status: executing depfiles commands >> config.status: executing libtool commands >> configure: **************************************** success >> >> make log >> >> [root@mybox stunnel-5.35]# make >> Making all in src >> make[1]: Entering directory `/apps/stunnel/stunnel-5.35/src' >> make all-am >> make[2]: Entering directory `/apps/stunnel/stunnel-5.35/src' >> CCLD stunnel >> /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libssl.a when searching for -lssl >> /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libcrypto.a when searching for -lcrypto >> stunnel-client.o: In function `client_run': >> /apps/stunnel/stunnel-5.35/src/client.c:201: undefined reference to `ERR_remove_thread_state' >> stunnel-options.o: In function `parse_service_option': >> /apps/stunnel/stunnel-5.35/src/options.c:2669: undefined reference to `TLSv1_2_client_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2670: undefined reference to `TLSv1_2_server_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2662: undefined reference to `TLSv1_1_client_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2663: undefined reference to `TLSv1_1_server_method' >> stunnel-ctx.o: In function `auth_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:442: undefined reference to `SSL_CTX_set_psk_server_callback' >> stunnel-ctx.o: In function `context_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:133: undefined reference to `SSL_CTX_set_client_cert_engine' >> stunnel-ctx.o: In function `auth_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:440: undefined reference to `SSL_CTX_set_psk_client_callback' >> stunnel-ctx.o: In function `conf_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:376: undefined reference to `SSL_CONF_CTX_new' >> /apps/stunnel/stunnel-5.35/src/ctx.c:381: undefined reference to `SSL_CONF_CTX_set_ssl_ctx' >> /apps/stunnel/stunnel-5.35/src/ctx.c:382: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:383: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:385: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:392: undefined reference to `SSL_CONF_cmd' >> /apps/stunnel/stunnel-5.35/src/ctx.c:420: undefined reference to `SSL_CONF_CTX_finish' >> /apps/stunnel/stunnel-5.35/src/ctx.c:422: undefined reference to `SSL_CONF_CTX_free' >> stunnel-ctx.o: In function `ecdh_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:351: undefined reference to `EC_KEY_new_by_curve_name' >> /apps/stunnel/stunnel-5.35/src/ctx.c:359: undefined reference to `EC_KEY_free' >> stunnel-ctx.o: In function `conf_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:414: undefined reference to `SSL_CONF_CTX_free' >> /apps/stunnel/stunnel-5.35/src/ctx.c:409: undefined reference to `SSL_CONF_CTX_free' >> /apps/stunnel/stunnel-5.35/src/ctx.c:425: undefined reference to `SSL_CONF_CTX_free' >> stunnel-ctx.o: In function `servername_cb': >> /apps/stunnel/stunnel-5.35/src/ctx.c:229: undefined reference to `SSL_get_servername' >> /apps/stunnel/stunnel-5.35/src/ctx.c:253: undefined reference to `SSL_set_SSL_CTX' >> stunnel-verify.o: In function `ocsp_request': >> /apps/stunnel/stunnel-5.35/src/verify.c:499: undefined reference to `OCSP_CERTID_dup' >> stunnel-verify.o: In function `ocsp_get_response': >> /apps/stunnel/stunnel-5.35/src/verify.c:614: undefined reference to `OCSP_sendreq_new' >> /apps/stunnel/stunnel-5.35/src/verify.c:625: undefined reference to `OCSP_REQ_CTX_add1_header' >> /apps/stunnel/stunnel-5.35/src/verify.c:629: undefined reference to `OCSP_REQ_CTX_add1_header' >> /apps/stunnel/stunnel-5.35/src/verify.c:634: undefined reference to `OCSP_REQ_CTX_set1_req' >> /apps/stunnel/stunnel-5.35/src/verify.c:641: undefined reference to `OCSP_sendreq_nbio' >> /apps/stunnel/stunnel-5.35/src/verify.c:668: undefined reference to `OCSP_REQ_CTX_free' >> stunnel-verify.o: In function `cert_check_subject': >> /apps/stunnel/stunnel-5.35/src/verify.c:299: undefined reference to `X509_check_host' >> stunnel-verify.o: In function `ocsp_check': >> /apps/stunnel/stunnel-5.35/src/verify.c:457: undefined reference to `X509_get1_ocsp' >> stunnel-verify.o: In function `cert_check_subject': >> /apps/stunnel/stunnel-5.35/src/verify.c:312: undefined reference to `X509_check_email' >> /apps/stunnel/stunnel-5.35/src/verify.c:323: undefined reference to `X509_check_ip_asc' >> stunnel-verify.o: In function `cert_check_local': >> /apps/stunnel/stunnel-5.35/src/verify.c:356: undefined reference to `X509_STORE_get1_certs' >> stunnel-sthreads.o: In function `sthreads_init': >> /apps/stunnel/stunnel-5.35/src/sthreads.c:287: undefined reference to `CRYPTO_THREADID_set_callback' >> stunnel-sthreads.o: In function `threadid_func': >> /apps/stunnel/stunnel-5.35/src/sthreads.c:268: undefined reference to `CRYPTO_THREADID_set_numeric' >> collect2: ld returned 1 exit status >> make[2]: *** [stunnel] Error 1 >> make[2]: Leaving directory `/apps/stunnel/stunnel-5.35/src' >> make[1]: *** [all] Error 2 >> make[1]: Leaving directory `/apps/stunnel/stunnel-5.35/src' >> make: *** [all-recursive] Error 1 >> >> Thanks for your help. >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

compilation error with stunnel-5.35
by Viorel Panaite 16 Sep '16

16 Sep '16

I downloaded stunnel-5.35 and I'm trying to compile using openssl-1.0.2h on RedHat EL linux 5.4 I get this error when I'm trying to compile them together, Configure log ./configure --prefix=/apps/stunnel/535 --with-ssl=/apps/openssl/1.0.2h/ ......................... hecking for broken poll() implementation... no checking for pipe2... no checking for accept4... no configure: **************************************** optional features checking whether to enable IPv6 support... yes (default) checking whether to enable FIPS support... autodetecting checking whether to enable systemd socket activation support... autodetecting checking for library containing sd_listen_fds... no configure: systemd library not found checking whether to enable TCP wrappers support... autodetecting checking for hosts_access in -lwrap... yes configure: libwrap support enabled configure: **************************************** SSL checking for compiler sysroot... / checking for SSL directory... /apps/openssl/1.0.2h/ checking for FIPS_mode_set... yes configure: FIPS support enabled configure: **************************************** write the results checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating src/config.h config.status: src/config.h is unchanged config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success make log [root@mybox stunnel-5.35]# make Making all in src make[1]: Entering directory `/apps/stunnel/stunnel-5.35/src' make all-am make[2]: Entering directory `/apps/stunnel/stunnel-5.35/src' CCLD stunnel /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libssl.a when searching for -lssl /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libcrypto.a when searching for -lcrypto stunnel-client.o: In function `client_run': /apps/stunnel/stunnel-5.35/src/client.c:201: undefined reference to `ERR_remove_thread_state' stunnel-options.o: In function `parse_service_option': /apps/stunnel/stunnel-5.35/src/options.c:2669: undefined reference to `TLSv1_2_client_method' /apps/stunnel/stunnel-5.35/src/options.c:2670: undefined reference to `TLSv1_2_server_method' /apps/stunnel/stunnel-5.35/src/options.c:2662: undefined reference to `TLSv1_1_client_method' /apps/stunnel/stunnel-5.35/src/options.c:2663: undefined reference to `TLSv1_1_server_method' stunnel-ctx.o: In function `auth_init': /apps/stunnel/stunnel-5.35/src/ctx.c:442: undefined reference to `SSL_CTX_set_psk_server_callback' stunnel-ctx.o: In function `context_init': /apps/stunnel/stunnel-5.35/src/ctx.c:133: undefined reference to `SSL_CTX_set_client_cert_engine' stunnel-ctx.o: In function `auth_init': /apps/stunnel/stunnel-5.35/src/ctx.c:440: undefined reference to `SSL_CTX_set_psk_client_callback' stunnel-ctx.o: In function `conf_init': /apps/stunnel/stunnel-5.35/src/ctx.c:376: undefined reference to `SSL_CONF_CTX_new' /apps/stunnel/stunnel-5.35/src/ctx.c:381: undefined reference to `SSL_CONF_CTX_set_ssl_ctx' /apps/stunnel/stunnel-5.35/src/ctx.c:382: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:383: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:385: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:392: undefined reference to `SSL_CONF_cmd' /apps/stunnel/stunnel-5.35/src/ctx.c:420: undefined reference to `SSL_CONF_CTX_finish' /apps/stunnel/stunnel-5.35/src/ctx.c:422: undefined reference to `SSL_CONF_CTX_free' stunnel-ctx.o: In function `ecdh_init': /apps/stunnel/stunnel-5.35/src/ctx.c:351: undefined reference to `EC_KEY_new_by_curve_name' /apps/stunnel/stunnel-5.35/src/ctx.c:359: undefined reference to `EC_KEY_free' stunnel-ctx.o: In function `conf_init': /apps/stunnel/stunnel-5.35/src/ctx.c:414: undefined reference to `SSL_CONF_CTX_free' /apps/stunnel/stunnel-5.35/src/ctx.c:409: undefined reference to `SSL_CONF_CTX_free' /apps/stunnel/stunnel-5.35/src/ctx.c:425: undefined reference to `SSL_CONF_CTX_free' stunnel-ctx.o: In function `servername_cb': /apps/stunnel/stunnel-5.35/src/ctx.c:229: undefined reference to `SSL_get_servername' /apps/stunnel/stunnel-5.35/src/ctx.c:253: undefined reference to `SSL_set_SSL_CTX' stunnel-verify.o: In function `ocsp_request': /apps/stunnel/stunnel-5.35/src/verify.c:499: undefined reference to `OCSP_CERTID_dup' stunnel-verify.o: In function `ocsp_get_response': /apps/stunnel/stunnel-5.35/src/verify.c:614: undefined reference to `OCSP_sendreq_new' /apps/stunnel/stunnel-5.35/src/verify.c:625: undefined reference to `OCSP_REQ_CTX_add1_header' /apps/stunnel/stunnel-5.35/src/verify.c:629: undefined reference to `OCSP_REQ_CTX_add1_header' /apps/stunnel/stunnel-5.35/src/verify.c:634: undefined reference to `OCSP_REQ_CTX_set1_req' /apps/stunnel/stunnel-5.35/src/verify.c:641: undefined reference to `OCSP_sendreq_nbio' /apps/stunnel/stunnel-5.35/src/verify.c:668: undefined reference to `OCSP_REQ_CTX_free' stunnel-verify.o: In function `cert_check_subject': /apps/stunnel/stunnel-5.35/src/verify.c:299: undefined reference to `X509_check_host' stunnel-verify.o: In function `ocsp_check': /apps/stunnel/stunnel-5.35/src/verify.c:457: undefined reference to `X509_get1_ocsp' stunnel-verify.o: In function `cert_check_subject': /apps/stunnel/stunnel-5.35/src/verify.c:312: undefined reference to `X509_check_email' /apps/stunnel/stunnel-5.35/src/verify.c:323: undefined reference to `X509_check_ip_asc' stunnel-verify.o: In function `cert_check_local': /apps/stunnel/stunnel-5.35/src/verify.c:356: undefined reference to `X509_STORE_get1_certs' stunnel-sthreads.o: In function `sthreads_init': /apps/stunnel/stunnel-5.35/src/sthreads.c:287: undefined reference to `CRYPTO_THREADID_set_callback' stunnel-sthreads.o: In function `threadid_func': /apps/stunnel/stunnel-5.35/src/sthreads.c:268: undefined reference to `CRYPTO_THREADID_set_numeric' collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/apps/stunnel/stunnel-5.35/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/apps/stunnel/stunnel-5.35/src' make: *** [all-recursive] Error 1 Thanks for your help.

2 2

Hangs when connecting -- advice pls
by Dave Gradwell 14 Sep '16

14 Sep '16

My Stunnel client gets to this point, then hangs indefinitely: SSL state (connect): SSLv2/v3 write client hello A Is this a fault with Stunnel or is it something I’m doing wrong Full client-side output: """"""""""""""""""" Last login: Wed Sep 14 06:50:40 on ttys004 Daves-MBP-2016:~ dave$ /Users/dave/Desktop/stunnel-test/stunnel /Users/dave/Desktop/stunnel-test/stunnel-sender.conf 2016.09.14 06:54:35 LOG7[ui]: Clients allowed=125 2016.09.14 06:54:35 LOG7[cron]: Cron thread initialized 2016.09.14 06:54:35 LOG5[ui]: stunnel 5.35 on x86_64-apple-darwin15.4.0 platform 2016.09.14 06:54:35 LOG5[ui]: Compiled with OpenSSL 0.9.8zd 8 Jan 2015 2016.09.14 06:54:35 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016 2016.09.14 06:54:35 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2016.09.14 06:54:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI 2016.09.14 06:54:35 LOG7[ui]: errno: (*__error()) 2016.09.14 06:54:35 LOG5[ui]: Reading configuration from file /Users/dave/Desktop/stunnel-test/stunnel-sender.conf 2016.09.14 06:54:35 LOG5[ui]: UTF-8 byte order mark not detected 2016.09.14 06:54:35 LOG7[ui]: Compression disabled 2016.09.14 06:54:35 LOG7[ui]: Snagged 64 random bytes from /Users/dave/.rnd 2016.09.14 06:54:35 LOG7[ui]: Wrote 1024 new random bytes to /Users/dave/.rnd 2016.09.14 06:54:35 LOG7[ui]: PRNG seeded successfully 2016.09.14 06:54:35 LOG6[ui]: Initializing inetd mode configuration 2016.09.14 06:54:35 LOG6[ui]: Loading certificate from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Certificate loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Loading private key from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG4[ui]: Insecure file permissions on /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Private key loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG7[ui]: Private key check succeeded 2016.09.14 06:54:35 LOG4[ui]: Service [stunnel] needs authentication to prevent MITM attacks 2016.09.14 06:54:35 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.09.14 06:54:35 LOG5[ui]: Configuration successful 2016.09.14 06:54:35 LOG7[ui]: Service [stunnel] started 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] accepted connection 2016.09.14 06:54:35 LOG6[ui]: failover: round-robin, starting at entry #0 2016.09.14 06:54:35 LOG6[ui]: s_connect: connecting ::1:874 2016.09.14 06:54:35 LOG7[ui]: s_connect: s_poll_wait ::1:874: waiting 10 seconds 2016.09.14 06:54:35 LOG5[ui]: s_connect: connected ::1:874 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] connected remote server from ::1:51362 2016.09.14 06:54:35 LOG7[ui]: Option TCP_NODELAY set on remote socket 2016.09.14 06:54:35 LOG7[ui]: Remote descriptor (FD=3) initialized 2016.09.14 06:54:35 LOG6[ui]: SNI: sending servername: localhost 2016.09.14 06:54:35 LOG6[ui]: Peer certificate not required 2016.09.14 06:54:35 LOG7[ui]: SSL state (connect): before/connect initialization 2016.09.14 06:54:35 LOG7[ui]: SSL state (connect): SSLv2/v3 write client hello A ^C Daves-MBP-2016:~ dave$ """"""""""""""""""" My stunnel-sender.conf: """"""""""""""""""" debug = 7 output = /Users/dave/Desktop/stunnel-test/sender-stunnel-output.log foreground = yes client = yes connect = localhost:874 cert = /Users/dave/Desktop/stunnel-test/cert.pem verify = 0 """"""""""""""""""" My stunnel-receiver.conf: """"""""""""""""""" debug = 7 output = /Users/dave/Desktop/stunnel-test/receiver-stunnels-output.log pid = /Users/dave/Desktop/stunnel-test/stunnel-rsyncd-stunnels.pid cert = /Users/dave/Desktop/stunnel-test/cert.pem verify = 0 delay = yes exec = /Users/dave/Desktop/stunnel-test/rsync execArgs = -vvvv --daemon --server --config=/Users/dave/Desktop/stunnel-test/stunnel-rsyncd.conf . foreground = yes client = no """"""""""""""""""" My receiver-error.log: """"""""""""""""""" 2016.09.14 06:54:35 LOG7[ui]: Clients allowed=125 2016.09.14 06:54:35 LOG7[cron]: Cron thread initialized 2016.09.14 06:54:35 LOG5[ui]: stunnel 5.35 on x86_64-apple-darwin15.4.0 platform 2016.09.14 06:54:35 LOG5[ui]: Compiled with OpenSSL 0.9.8zd 8 Jan 2015 2016.09.14 06:54:35 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016 2016.09.14 06:54:35 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2016.09.14 06:54:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI 2016.09.14 06:54:35 LOG7[ui]: errno: (*__error()) 2016.09.14 06:54:35 LOG5[ui]: Reading configuration from file /Users/dave/Desktop/stunnel-test/stunnel-receiver.conf 2016.09.14 06:54:35 LOG5[ui]: UTF-8 byte order mark not detected 2016.09.14 06:54:35 LOG7[ui]: Compression disabled 2016.09.14 06:54:35 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2016.09.14 06:54:35 LOG7[ui]: PRNG seeded successfully 2016.09.14 06:54:35 LOG6[ui]: Initializing inetd mode configuration 2016.09.14 06:54:35 LOG6[ui]: Loading certificate from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Certificate loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Loading private key from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG4[ui]: Insecure file permissions on /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Private key loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG7[ui]: Private key check succeeded 2016.09.14 06:54:35 LOG7[ui]: DH initialization 2016.09.14 06:54:35 LOG7[ui]: Using DH parameters from /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: 2048-bit DH parameters loaded 2016.09.14 06:54:35 LOG7[ui]: ECDH initialization 2016.09.14 06:54:35 LOG7[ui]: ECDH initialized with curve prime256v1 2016.09.14 06:54:35 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.09.14 06:54:35 LOG5[ui]: Configuration successful 2016.09.14 06:54:35 LOG7[ui]: Service [stunnel] started 2016.09.14 06:54:35 LOG7[ui]: Option TCP_NODELAY set on local socket 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] accepted connection from ::1:51362 2016.09.14 06:54:35 LOG6[ui]: Peer certificate not required 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): before/accept initialization 2016.09.14 06:54:35 LOG7[ui]: SNI: no virtual services defined 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 read client hello A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write server hello A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write certificate A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write certificate request A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 flush data 2016.09.14 06:54:40 LOG3[ui]: SSL_accept: Peer suddenly disconnected 2016.09.14 06:54:40 LOG5[ui]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.14 06:54:40 LOG7[ui]: Deallocating application specific data for addr index 2016.09.14 06:54:40 LOG7[ui]: Service [stunnel] finished (0 left) """"""""""""""""""" The server-side-Stunnel is invoked via launchd using this LaunchDaemon (but this seems to be working okay — I think): """"""""""""""""""" <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Disabled</key> <false/> <key>StandardErrorPath</key> <string>/Users/dave/Desktop/stunnel-test/receiver-error.log</string> <key>StandardOutPath</key> <string>/Users/dave/Desktop/stunnel-test/receiver-out.log</string> <key>Label</key> <string>com.stunnel.test</string> <key>ProgramArguments</key> <array> <string>/Users/dave/Desktop/stunnel-test/stunnel</string> <string>/Users/dave/Desktop/stunnel-test/stunnel-receiver.conf</string> </array> <key>inetdCompatibility</key> <dict> <key>Wait</key> <false/> </dict> <key>Sockets</key> <dict> <key>Listeners</key> <dict> <key>SockServiceName</key> <string>874</string> <key>SockType</key> <string>stream</string> </dict> </dict> </dict> </plist> """"""""""""""""""" I’ve looked at the output of bash-3.2# tcpdump -i all -XX -xx -vv port 874 but this didn’t give me any obvious clues. I can send it if it’s useful but I’ve omitted it for now as it’s long. I’ve reproduced the same hang on Mac OS X 10.11 and 10.6. I’ve recompiled Stunnel in 10.11 and 10.9 environments but still get this same hang. Any advice appreciated.. — Dave.

1 0

Re: [stunnel-users] stunnel 5.x no answer in server mode?
by Ulli Horlacher 14 Sep '16

14 Sep '16

On Tue 2016-09-13 (22:25), Micha?? Trojnara wrote: > On 13.09.2016 20:35, Ulli Horlacher wrote: > >> It is impossible to say anything without analysis of the executed fexsrv > >> program. > > > > The problem cannot be in fexsrv, because it works with stunnel 4.27 > > What is the point of sending an email to the mailing list when you > ignore our effort to help you? Where do I ignore help? > fexsrv terminates immediately with exit code 1. No. It does not start at all, so it does not terminate. fexsrv logs everything and when running with stunnel 5.x the log file is empty. But meanwhile I found the error: stunnel 5.x needs the a full path for the exec statement: exec = /usr/bin/perl For stunnel 4.x it was sufficent to use: exec = perl -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<45835cd9-b239-d80c-38a0-3f978132e40e(a)stunnel.org>

2 1

Errors in log
by Mark Hannig 13 Sep '16

13 Sep '16

Can you please help me. Stunnel has been working fine for months and I just started getting these errors in the last day or two. Thank you: 2016.09.11 13:43:38 LOG5[10]: Service [ssmtp] accepted connection from 46.101.193.127:33818 2016.09.11 13:43:40 LOG3[10]: SSL_accept: Peer suddenly disconnected 2016.09.11 13:43:40 LOG5[10]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 13:43:40 LOG5[11]: Service [ssmtp] accepted connection from 46.101.193.127:34154 2016.09.11 13:43:40 LOG3[11]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:ssl3_get_client_hello:wrong version number 2016.09.11 13:43:40 LOG5[11]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 13:43:40 LOG5[12]: Service [ssmtp] accepted connection from 46.101.193.127:34254 2016.09.11 13:43:42 LOG3[12]: s_connect: connect 127.0.0.1:25: Connection refused (WSAECONNREFUSED) (10061) 2016.09.11 13:43:42 LOG5[12]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 17:22:39 LOG5[13]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:58020 2016.09.11 17:22:39 LOG5[13]: s_connect: connected 52.35.228.26:465 2016.09.11 17:22:39 LOG5[13]: Service [smtp-tls-wrapper] connected remote server from 172.31.10.223:58021 2016.09.11 17:22:40 LOG5[13]: Connection closed: 7072 byte(s) sent to SSL, 369 byte(s) sent to socket 2016.09.11 17:22:40 LOG5[14]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:58022 2016.09.11 17:22:40 LOG5[14]: s_connect: connected 52.35.58.187:465 2016.09.11 17:22:40 LOG5[14]: Service [smtp-tls-wrapper] connected remote server from 172.31.10.223:58023 2016.09.11 17:22:40 LOG5[14]: Connection closed: 7302 byte(s) sent to SSL, 361 byte(s) sent to socket -- Mark F. Hannig mhannig(a)gmail.com

2 2

Re: [stunnel-users] stunnel 5.x no answer in server mode?
by Ulli Horlacher 13 Sep '16

13 Sep '16

On Tue 2016-09-13 (12:10), Ma??gorzata Olszówka wrote: > > I use stunnel as a https proxy for my own http server (*). > > > > The server mode of stunnel 5.x does not work any more. > > It accepts the connection and then immediatelly closes it without sending > > back any data. > > stunnel 4.x is working fine (for many years!), with the same configuration. > > The client receives no data at all, the connection is closed by the server > > (stunnel). > > > > As I wrote: with stunnel 4.27 everything works as expected. Does stunnel > > 5.x need another configuration? > > The log messages show, that the child process terminated with code 1. > This is the point where you should start looking for the cause. The client fexsrv does not start at all with stunnel 5.x, whereas with stunnel 4.27 everything works fine. > It is impossible to say anything without analysis of the executed fexsrv > program. The problem cannot be in fexsrv, because it works with stunnel 4.27 -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<f0622f17-fd11-bdb8-4a82-9665463c0d64(a)olszowka.net>

1 0

Upgrade from 5.03 to 5.35
by Hon Quach 07 Sep '16

07 Sep '16

Hi, When I perform the upgrade the stunnel service won't start, it tries to load the pem files but it is failing. I noticed when I install stunnel on my test system, the conf file is different from the version 5.03. I'm looking for documentation a on how to perform a clean upgrade but I'm having difficulty finding that information. Thanks! Sent from my iPhone

1 0

stunnel 5.x no answer in server mode?
by Ulli Horlacher 31 Aug '16

31 Aug '16

I use stunnel as a https proxy for my own http server (*). The server mode of stunnel 5.x does not work any more. It accepts the connection and then immediatelly closes it without sending back any data. stunnel 4.x is working fine (for many years!), with the same configuration. Here is my (test) config which shows the problem (host is Ubuntu 16.04): root@xerus:/tmp# cat stunnel.conf pid = /tmp/stunnel.pid output = /home/fex/spool/stunneld.log debug = debug fips = no foreground = yes [https] accept = 443 cert = /home/fex/etc/stunnel.pem sslVersion = all TIMEOUTclose = 1 exec = perl execargs = perl -T /home/fex/bin/fexsrv stunnel root@xerus:/tmp# /opt/stunnel-5.35/bin/stunnel stunnel.conf 2016.08.30 18:58:55 LOG7[ui]: Clients allowed=500 2016.08.30 18:58:55 LOG5[ui]: stunnel 5.35 on x86_64-unknown-linux-gnu platform 2016.08.30 18:58:55 LOG5[ui]: Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 2016.08.30 18:58:55 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.08.30 18:58:55 LOG7[ui]: errno: (*__errno_location ()) 2016.08.30 18:58:55 LOG5[ui]: Reading configuration from file /tmp/stunnel.conf 2016.08.30 18:58:55 LOG5[ui]: UTF-8 byte order mark not detected 2016.08.30 18:58:55 LOG5[ui]: FIPS mode disabled 2016.08.30 18:58:55 LOG7[ui]: Compression disabled 2016.08.30 18:58:55 LOG7[ui]: Snagged 64 random bytes from /root/.rnd 2016.08.30 18:58:55 LOG7[ui]: Wrote 1024 new random bytes to /root/.rnd 2016.08.30 18:58:55 LOG7[ui]: PRNG seeded successfully 2016.08.30 18:58:55 LOG6[ui]: Initializing service [https] 2016.08.30 18:58:55 LOG6[ui]: Loading certificate from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Certificate loaded from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Loading private key from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Private key loaded from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG7[ui]: Private key check succeeded 2016.08.30 18:58:55 LOG7[ui]: DH initialization 2016.08.30 18:58:55 LOG7[ui]: Using DH parameters from /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: 1024-bit DH parameters loaded 2016.08.30 18:58:55 LOG7[ui]: ECDH initialization 2016.08.30 18:58:55 LOG7[ui]: ECDH initialized with curve prime256v1 2016.08.30 18:58:55 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.08.30 18:58:55 LOG5[ui]: Configuration successful 2016.08.30 18:58:55 LOG7[ui]: Listening file descriptor created (FD=7) 2016.08.30 18:58:55 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2016.08.30 18:58:55 LOG7[ui]: Service [https] (FD=7) bound to 0.0.0.0:443 2016.08.30 18:58:55 LOG7[ui]: Created pid file /tmp/stunnel.pid (here comes the https client connect) 2016.08.30 18:59:20 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.30 18:59:20 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2016.08.30 18:59:20 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2016.08.30 18:59:20 LOG7[ui]: Service [https] accepted (FD=3) from 127.0.0.1:44166 2016.08.30 18:59:20 LOG7[0]: Service [https] started 2016.08.30 18:59:20 LOG7[0]: Option TCP_NODELAY set on local socket 2016.08.30 18:59:20 LOG5[0]: Service [https] accepted connection from 127.0.0.1:44166 2016.08.30 18:59:20 LOG6[0]: Peer certificate not required 2016.08.30 18:59:20 LOG7[0]: SSL state (accept): before/accept initialization 2016.08.30 18:59:20 LOG7[0]: SNI: no virtual services defined 2016.08.30 18:59:20 LOG7[0]: New session callback 2016.08.30 18:59:20 LOG7[0]: 1 server accept(s) requested 2016.08.30 18:59:20 LOG7[0]: 1 server accept(s) succeeded 2016.08.30 18:59:20 LOG7[0]: 0 server renegotiation(s) requested 2016.08.30 18:59:20 LOG7[0]: 0 session reuse(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache item(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache fill-up(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache miss(es) 2016.08.30 18:59:20 LOG7[0]: 0 external session cache hit(s) 2016.08.30 18:59:20 LOG7[0]: 0 expired session(s) retrieved 2016.08.30 18:59:20 LOG6[0]: SSL accepted: new session negotiated 2016.08.30 18:59:20 LOG6[0]: No peer certificate received 2016.08.30 18:59:20 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-SHA256 (128-bit encryption) 2016.08.30 18:59:20 LOG7[0]: Compression: null, expansion: null 2016.08.30 18:59:20 LOG6[0]: Local mode child started (PID=30833) 2016.08.30 18:59:20 LOG7[0]: Option TCP_NODELAY set on remote socket 2016.08.30 18:59:20 LOG7[0]: Remote descriptor (FD=11) initialized 2016.08.30 18:59:20 LOG6[0]: Read socket closed (readsocket) 2016.08.30 18:59:20 LOG7[0]: Sending close_notify alert 2016.08.30 18:59:20 LOG7[0]: SSL alert (write): warning: close notify 2016.08.30 18:59:20 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2016.08.30 18:59:20 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.30 18:59:20 LOG7[ui]: FD=4 events=0x2001 revents=0x1 2016.08.30 18:59:20 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2016.08.30 18:59:20 LOG7[ui]: Dispatching signals from the signal pipe 2016.08.30 18:59:20 LOG7[ui]: Processing SIGCHLD 2016.08.30 18:59:20 LOG6[ui]: Child process 30833 finished with code 1 2016.08.30 18:59:20 LOG7[ui]: Signal pipe is empty 2016.08.30 18:59:20 LOG3[0]: socket fd: Broken pipe (32) 2016.08.30 18:59:20 LOG6[0]: writesocket: Socket is closed 2016.08.30 18:59:20 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 23 byte(s) sent to socket 2016.08.30 18:59:20 LOG7[0]: Remote descriptor (FD=11) closed 2016.08.30 18:59:20 LOG7[0]: Local descriptor (FD=3) closed 2016.08.30 18:59:20 LOG7[0]: Service [https] finished (0 left) The client receives no data at all, the connection is closed by the server (stunnel). As I wrote: with stunnel 4.27 everything works as expected. Does stunnel 5.x need another configuration? (*) http://fex.rus.uni-stuttgart.de/ -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<20160831074057.GA13703(a)rus.uni-stuttgart.de>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users