- stunnel-users - stunnel.org

Re: [stunnel-users] Interoperability problems with .net client software
by josealf＠rocketmail.com 29 Jun '12

29 Jun '12

Not as far as I know. You need to check with the client application developers. Maybe they can use a debugger to trace the program flow and see where and why it fails (assuming they understand the protocols and the tools). The application must be coded to present the certificate, and my guess (just a guess), is that it isn't or is blocking before getting to that point. -----Original Message----- From: ProPharma Systems AG - Gregor Bürgisser <g.buergisser(a)propharma.ch> Date: Fri, 29 Jun 2012 06:59:14 To: <josealf(a)rocketmail.com> Subject: Re: [stunnel-users] Interoperability problems with .net client software Yes I did. Also the CA used to sign the server cert. All to no avail. Do you know if there are any (known) interoperability issues between stunnel and .net applications? On 06/28/2012 02:05 PM, josealf(a)rocketmail.com wrote: > Looks like your client is not presenting the certificate to the stunnel server. Maybe because it does not trust the server certificate? Did you import your stunnel server cert into windows certificate store? > > > -----Original Message----- > From: ProPharma Systems AG - Gregor Bürgisser > <g.buergisser(a)propharma.ch> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Thu, 28 Jun 2012 12:48:53 > To:<stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Interoperability problems with .net client software > > Hi all, > > I'm using stunnel 4.53 under Linux to secure a service. There are two > different clients connecting to this service: My own client, also Linux > based and using libcurl and another (third party!) client being > developed using Microsoft .net stuff. > > Of course with my own client all works well. But we are not able to get > the Microsoft client running. stunnel keeps on telling: > > SSL_accept: 140890C7: error:140890C7:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate > > We have tried diffierent things... I will outline them here if you think > it is helpful (in short: tried using certificates generated on the > Microsoft side, then tried using certificates created on the Linux side). > If "verify" ist set to 0 or 1 it works (of course) but with a higher > value the above message is logged. > > Are there any known pitfalls, problems or whatsoever when using stunnel > with a .net client? > Any advice would be appreciated! > > Regards, > Gregor > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

clean installation on Windows
by John 28 Jun '12

28 Jun '12

Hello. I would like to install stunnel on 64-bit Win7, and I would like to know whether it is possible to do so by just unzipping the downloaded files into one folder and then clicking on the main executable, that is, to avoid making registry entries, etc. I would like to have a minimal impact to whatever extent is possible. Can it be done in this way, or does it need the whole shebang installer procedure to be run?

4 5

Stunnel, Pan and the SSL23_GET_SERVER_HELLO:unknown protocol
by mike 28 Jun '12

28 Jun '12

Hello All, Running Debian 6.0, stunnel4 and Pan 0.133 I have set up Pan and installed stunnel so that I can use ssl with nntp. Installing Pan and stunnel was easy. I've edited Pan to use localhost:119 and edited my config file in stunnel to point to my nntp server. I have allowed nntp in my hosts.allow for ALL:ALL. The problem I am running into is that Pan does not connect. I get the following error: Error reading from localhost. Connection reset by peer Checking with the following openssl command produced this error: root@triglav:/etc/stunnel# openssl s_client -ssl3 -connect localhost:119 CONNECTED(00000003) write:errno=104 Looking at the logs for stunnel I see many repetitions of this message: 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp started 2012.06.25 14:18:26 LOG7[16355:3074153328]: FD 13 in non-blocking mode 2012.06.25 14:18:26 LOG7[16355:3074153328]: TCP_NODELAY option set on local socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: Waiting for a libwrap process 2012.06.25 14:18:26 LOG7[16355:3074153328]: Acquired libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: Releasing libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: Released libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp permitted by libwrap from 127.0.0.1:59451 2012.06.25 14:18:26 LOG5[16355:3074153328]: nntp accepted connection from 127.0.0.1:59451 2012.06.25 14:18:26 LOG7[16355:3074153328]: FD 14 in non-blocking mode 2012.06.25 14:18:26 LOG6[16355:3074153328]: connect_blocking: connecting 209.197.15.238:119 2012.06.25 14:18:26 LOG7[16355:3074153328]: connect_blocking: s_poll_wait 209.197.15.238:119: waiting 10 seconds 2012.06.25 14:18:26 LOG5[16355:3074153328]: connect_blocking: connected 209.197.15.238:119 2012.06.25 14:18:26 LOG5[16355:3074153328]: nntp connected remote server from 192.168.2.56:51455 2012.06.25 14:18:26 LOG7[16355:3074153328]: Remote FD=14 initialized 2012.06.25 14:18:26 LOG7[16355:3074153328]: TCP_NODELAY option set on remote socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: SSL state (connect): before/connect initialization 2012.06.25 14:18:26 LOG7[16355:3074153328]: SSL state (connect): SSLv2/v3 write client hello A 2012.06.25 14:18:26 LOG3[16355:3074153328]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2012.06.25 14:18:26 LOG5[16355:3074153328]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp finished (0 left) Anyone know what is missing? It almost looks like it cant talk in either SSLv2 or v3 which makes no sense. Here is my stunnel config: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /var/log/stunnel4/stunnel.log foreground = no ; Use it for client mode client = yes ; Service-level configuration [nntp] accept = localhost:119 connect = news.aliant.net:119 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

2 4

Interoperability problems with .net client software
by ProPharma Systems AG - Gregor Bürgisser 28 Jun '12

28 Jun '12

Hi all, I'm using stunnel 4.53 under Linux to secure a service. There are two different clients connecting to this service: My own client, also Linux based and using libcurl and another (third party!) client being developed using Microsoft .net stuff. Of course with my own client all works well. But we are not able to get the Microsoft client running. stunnel keeps on telling: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate We have tried diffierent things... I will outline them here if you think it is helpful (in short: tried using certificates generated on the Microsoft side, then tried using certificates created on the Linux side). If "verify" ist set to 0 or 1 it works (of course) but with a higher value the above message is logged. Are there any known pitfalls, problems or whatsoever when using stunnel with a .net client? Any advice would be appreciated! Regards, Gregor

2 1

Accept on same port to ethernet aliases
by John Morrison 27 Jun '12

27 Jun '12

Hi, Is it possible to configure stunnel to use the same port on different IP addresses that are Ethernet aliases? I have successfully set up a configuration file accepting SSL connections. Firstly I did this on all IP addresses by using the following configuration lines: accept = 443 connect = 80 This worked correctly. I then attempted to setup a second configuration file on an aliased Ethernet address. The configuration file settings are: test1.conf accept = 10.168.1.132:443 connect = 10.168.1.132:80 test2.conf accept = 10.168.1.133:443 connect = 10.168.1.133:80 Stunnel is able to start the first configuration file, but not the second. The error message I can see when I run the second configuration file in the foreground is: accept socket: FD=11 allocated (non-blocking mode) Option SO_REUSEADDR set on accept socket Error binding https to 10.168.1.133:443 bind: Address already in use (98) and if I telnet to 10.168.1.133 on port 443 the connection is accepted. I have attempted to use the binding socket options in the configuration files as described in the manual: socket = a:SO_BINDTODEVICE=eth0:0 and socket = a:SO_BINDTODEVICE=eth0:1 However in this case stunnel will not start either configuration file. The error message I receive is: Option SO_REUSEADDR set on accept socket SO_BINDTODEVICE: No such device (19) Is there a different way to configure stunnel to allow this to work? My ipconfig settings are below. I am running the ubuntu 10.04 version of stunnel. The version output is: stunnel 4.35 on x86_64-pc-linux-gnu with OpenSSL 1.0.0e 6 Sep 2011 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Thanks, John eth0:0 Link encap:Ethernet HWaddr 3c:4a:92:6d:0b:08 inet addr:10.168.1.132 Bcast:10.168.1.132 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:16 Memory:f4000000-f4012800 eth0:1 Link encap:Ethernet HWaddr 3c:4a:92:6d:0b:08 inet addr:10.168.1.133 Bcast:10.168.1.133 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:16 Memory:f4000000-f4012800

2 2

Confused about stunnel + haproxy
by Robin Lee Powell 27 Jun '12

27 Jun '12

I've set up stunnel + haproxy using the "protocol = proxy" method, but stunnel doesn't seem to pass to haproxy any information about the source IP of the original connection, which I thought was the point of using this method? Can someone tell me what I'm missng? I just want to have haproxy with SSL support without losing the client IP information completely. -Robin -- http://singinst.org/ : Our last, best hope for a fantastic future. .i ko na cpedu lo nu stidi vau loi jbopre .i danfu lu na go'i li'u .e lu go'i li'u .i ji'a go'i lu na'e go'i li'u .e lu go'i na'i li'u .e lu no'e go'i li'u .e lu to'e go'i li'u .e lu lo mamta be do cu sofybakni li'u

1 1

socket status
by Dee Ayy 20 Jun '12

20 Jun '12

My socket in Eiffel will report that it is connected, but when it tries to write to the socket, it will fail and report Connection reset by peer I/O error The syslog shows 1) ... accepted connection from 127.0.0.1:.. 2) connect_blocking: getsockopt A_REMOTE_IP:A_REMOTE_PORT: Connection refused (111) 3) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket I believe that my socket is connecting locally fine 127.0.0.1:.. in step 1, and then the remote connection via stunnel is failing in step 2, but I have tried to write to the socket in between steps 1 and 2. Is this proper behavior? How can I know the status of the remote connection? Wait a while and then test? Is the socket state really just the state of the local stunnel connection? Should stunnel report a different state (as seen by my socket) until it determines the remote socket state?

1 0

What version of stunnel am I using?
by Dee Ayy 20 Jun '12

20 Jun '12

I don't see a version here stunnel -version 2012.06.20 16:44:05 LOG7[25078:3074172608]: RAND_status claims sufficient entropy for the PRNG 2012.06.20 16:44:05 LOG7[25078:3074172608]: PRNG seeded successfully 2012.06.20 16:44:05 LOG3[25078:3074172608]: /etc/stunnel/stunnel.pem: No such file or directory (2) apt-cache search stunnel on Ubuntu has stunnel4

1 0

Error connecting through IE6
by Karl Kloppenborg 14 Jun '12

14 Jun '12

Hey Stunnel guys! I've got a bit of an issue in which users on ie6 cannot connect through HTTPs to my haproxy cluster, they get a 404 page cannot be displayed. Works fine in all other browsers ;) The logs from Stunnel are: 2012.06.13 01:06:09 LOG7[28347:47884616028640]: local socket: FD=14 allocated (non-blocking mode) 2012.06.13 01:06:09 LOG7[28347:47884616028640]: Service incoming-https accepted FD=14 from [ClientIP]:1208 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https started 2012.06.13 01:06:09 LOG7[28347:1078843712]: Option TCP_NODELAY set on local socket 2012.06.13 01:06:09 LOG7[28347:1078843712]: Waiting for a libwrap process 2012.06.13 01:06:09 LOG7[28347:1078843712]: Acquired libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Releasing libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Released libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https permitted by libwrap from [ClientIP]:1208 2012.06.13 01:06:09 LOG5[28347:1078843712]: Service incoming-https accepted connection from [ClientIP]:1208 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): before/accept initialization 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read client hello A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write server hello A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write certificate A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write server done A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 flush data 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read client key exchange A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read finished A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write change cipher spec A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write finished A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 flush data 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 items in the session cache 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client connects (SSL_connect()) 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client connects that finished 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client renegotiations requested 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 server connects (SSL_accept()) 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 server connects that finished 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 server renegotiations requested 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 session cache hits 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 external session cache hits 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 session cache misses 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 session cache timeouts 2012.06.13 01:06:09 LOG6[28347:1078843712]: SSL accepted: new session negotiated 2012.06.13 01:06:09 LOG6[28347:1078843712]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2012.06.13 01:06:09 LOG7[28347:1078843712]: remote socket: FD=15 allocated (non-blocking mode) 2012.06.13 01:06:09 LOG6[28347:1078843712]: connect_blocking: connecting [HAPROXY IP]:81 2012.06.13 01:06:09 LOG7[28347:1078843712]: connect_blocking: s_poll_wait [HAPROXY IP]:81: waiting 10 seconds 2012.06.13 01:06:09 LOG5[28347:1078843712]: connect_blocking: connected [HAPROXY IP]:81 2012.06.13 01:06:09 LOG5[28347:1078843712]: Service incoming-https connected remote server from [HAPROXY IP]:55823 2012.06.13 01:06:09 LOG7[28347:1078843712]: Remote FD=15 initialized 2012.06.13 01:06:09 LOG7[28347:1078843712]: Option TCP_NODELAY set on remote socket 2012.06.13 01:06:09 LOG5[28347:1078843712]: Error detected on SSL (read) file descriptor: Connection reset by peer (104) 2012.06.13 01:06:09 LOG5[28347:1078843712]: Connection reset: 0 bytes sent to SSL, 320 bytes sent to socket 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https finished (0 left) 2012.06.13 01:06:09 LOG7[28347:1078843712]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) Could stunnel be at play here or am I looking at the wrong thing? Thanks! Karl. Karl Kloppenborg Programming Ninja Crucial Paradigm Pty Ltd Suite 1 Level 3 104-106 Commonwealth St Surry Hills NSW 2010 Australia 1300 884 839 - Sales & Support (AU Only) <https://support.crucialp.com/> Click here for the Support Desk d: 02 8202 9994 f: 02 92818261 m: 0416 236 908 e: <mailto:[email protected]> karl(a)crucial.com.au Crucial Paradigm is a leading Web Hosting provider that specialises in Cloud solutions. We are commited to keeping our planet green, please reduce, reuse and recycle your office paper. Description: crucial_2012

2 3

Stunnel 4.53 for win32 - without config file
by Ivanko B 14 Jun '12

14 Jun '12

How to bypass reading any config file so that all needed options were fed from command line ? (security reasons)

5 7

Re: [stunnel-users] Getting Stunnel to Work Under Windows 7 64-bit
by Brian Wilkins 14 Jun '12

14 Jun '12

I should note that I have been running stunnel 4.45 on Windows 7 since Oct-2011 with no problems whatsoever. It has been running non-stop on Windows 7 to this date with no problems. I have not upgraded to the latest because I have not been able to have time to test the FIPS changes with my configuration yet. Brian

4 6

stunnel version 4.53 says SSL server needs a certificate on Windows 7?
by Wayne Walter 13 Jun '12

13 Jun '12

I have been using stunnel previous versions just fine. It didn't apparently have the feature of a certificate in SSL server mode. That's alright but not necessary for us as we're simply running a localhost server to tunnel to the remote server. Anyway, I have read the FAQ tutorial and such related to this and tried everything. No mater what I do with the cert or key settings it still gives this same error here's the complete output.... No limit detected for the number of clients stunnel 4.53 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from C:/.rnd Wrote 0 new random bytes to C:/.rnd PRNG seeded successfully Initializing service section [FIX] Section FIX: SSL server needs a certificate Server is down And here is the stunnel.conf file contents: ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [FIX] accept = 127.0.0.1:5679 connect = 216.52.236.112:5680 TIMEOUTconnect = 5 [FIXLIVE] accept = 127.0.0.1:5680 connect = 216.52.236.185:51581 TIMEOUTconnect = 5 Please not that stunnel came installed with an stunnel.pem file. I tried uncommenting the config line for the key. Also regenerated the key using openssh per instructions. I tried using absolute path to the cert file. Nothing makes any difference. Is this a defect in stunnel? Or am I doing something wrong?

2 1

Re: [stunnel-users] Log rollover
by Michael Curran 11 Jun '12

11 Jun '12

Windows our linux? Linux just add the log file location to the file that are part of rotate.d and thats solved daily. Sent from my Verizon Wireless 4GLTE smartphone. From : Brian Wilkins Subject : [stunnel-users] Log rollover I have noticed my stunnel log has reached 100MB on an unmanned system. Is there an option to cause the stunnel log to rollover and delete the old log file after a pre-defined period of time? If not, I can try adding it to log.c. Brian -----Original Message----- From: Brian Wilkins Sent: 6/11/2012 3:48:22 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Log rollover I have noticed my stunnel log has reached 100MB on an unmanned system. Is there an option to cause the stunnel log to rollover and delete the old log file after a pre-defined period of time? If not, I can try adding it to log.c. Brian

2 1

Log rollover
by Brian Wilkins 11 Jun '12

11 Jun '12

I have noticed my stunnel log has reached 100MB on an unmanned system. Is there an option to cause the stunnel log to rollover and delete the old log file after a pre-defined period of time? If not, I can try adding it to log.c. Brian

1 0

Using stunnel with Brother MFC-8890
by Scott McKeown 08 Jun '12

08 Jun '12

Hi Rolando, Can you please give us a bit more detail. What have you tried doing? How is your network setup? Whats your current STunnel Configuration file settings? Hopefully with this information we should be able to assist. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

1 0

Using stunnel with Brother MFC-8890
by Rolando Pineda 07 Jun '12

07 Jun '12

Hi, Someone can help me to use stunnel and set up my Brother MFC-8890 to send email through SSL using the stunnel? Thanks in advanced. -- Saludos, _____________ Rolando Pineda

1 0

stunnel - haproxy setup with protocol = proxy
by Scott McKeown 07 Jun '12

07 Jun '12

Hi Robert, I've been doing some work on both HAProxy and STunnel myself over the last month or so. Your actual configuration files both look fine but one thing that you possibly missed is that you will have needed to have build HAProxy with the TProxy flag enabled, and I'm going to guess that you have also written and applied the Firewall rules for the transparent proxy. I've attached a DRAFT pdf of the work that I have been doing, its a very basic how-to on setting up both STunnel and HAProxy in Transparent mode on a Centos 6.2 system. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

2 4

stunnel - haproxy setup with protocol = proxy
by Robert Garcia 07 Jun '12

07 Jun '12

I am trying to setup stunnel with protocol = proxy through haproxy to my apache2 cluster. I have been using haproxy for a while, and wanted to try this before having to go to nginx, or some other proxy. My config works fine as is if I remove the "accept proxy" from the haproxy.cfg and the protocol=proxy from stunnel config, as soon as those are in, I get a 502 bad gateway. My haproxy.cfg: global log 127.0.0.1 local0 log 127.0.0.1 local1 debug #log loghost local0 info maxconn 50000 #chroot /usr/share/haproxy user haproxy group haproxy daemon #debug #quiet defaults log global mode http option httplog option dontlognull option forwardfor retries 3 option redispatch maxconn 50000 contimeout 5000 clitimeout 60000 srvtimeout 300000 stats uri /haproxy_xxxx stats realm Global\ statistics stats auth xxxxxx:xxxxxxx frontend dev-stg bind *:80 mode http timeout client 5m option forwardfor default_backend dev-www frontend dev-stg-ssl bind *:81 accept-proxy mode http option httpclose option forwardfor timeout client 5m default_backend dev-www backend dev-www mode http timeout connect 10s timeout server 600s balance roundrobin #begin_web_config server ws1 10.0.2.10 maxconn 1000 check port 80 #end_web_config stats uri /haproxy_xxxx stats realm Global\ statistics stats auth xxxxxx:xxxxxxx My stunnel config: ; ***************************************************************************** ; * Global Options * ; ***************************************************************************** ; A copy of some devices and system files is needed within the chroot jail ; Chroot conflicts with configuration file reload and many other features chroot = /var/lib/stunnel4/ ; Chroot jail can be escaped if setuid option is not used setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Debugging stuff (may useful for troubleshooting) debug = 7 output = /var/log/stunnel4/stunnel.log ; ***************************************************************************** ; * Service Defaults (may also be specified in individual service sections) * ; ***************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = /usr/local/certs/server.crt key = /usr/local/certs/server.key ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; The following options provide additional security at some performance penalty ; Default ECDH/DH parameters are strong/conservative, so it is quite safe to ; comment out these lines in order to get a performance boost ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ***************************************************************************** ; * Service Definitions (remove all services for inetd mode) * ; ***************************************************************************** ; Example SSL server mode services ; Example SSL front-end to a web server [proxy] accept = 443 connect = 127.0.0.1:81 ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL ; It does not use SSL close-notify alert designed to prevent truncation attacks TIMEOUTclose = 0 protocol = proxy ; vim:ft=dosini And here is the syslog for haproxy and stunner (ip address in log and cfgs are changed to protect the innocent ;-) ) Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193127680]: Service [proxy] accepted (FD=3) from 1.2.3.4:35045 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Service [proxy] started Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: Service [proxy] accepted connection from 1.2.3.4:35045 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: connect_blocking: connecting 127.0.0.1:81 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: connect_blocking: s_poll_wait 127.0.0.1:81: waiting 10 seconds Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: connect_blocking: connected 127.0.0.1:81 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: Service [proxy] connected remote server from 127.0.0.1:49010 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Remote socket (FD=8) initialized Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Server-mode proxy protocol negotiations started Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: -> PROXY TCP4 1.2.3.4 10.0.2.9 35045 443 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Server-mode proxy protocol negotiations succeeded Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: SSL accepted: new session negotiated Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Negotiated TLSv1/SSLv3 ciphersuite: DHE-RSA-AES256-SHA (256-bit encryption) Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Compression: null, expansion: null Jun 7 07:10:50 localhost haproxy[1710]: 1.2.3.4:35045 [07/Jun/2012:07:10:50.496] dev-stg-ssl dev-www/ws1 214/0/1/-1/216 502 754 - - PH-- 0/0/0/0/0 0/0 "GET / HTTP/1.1" Jun 7 07:10:50 localhost haproxy[1710]: 1.2.3.4:35045 [07/Jun/2012:07:10:50.496] dev-stg-ssl dev-www/ws1 214/0/1/-1/216 502 754 - - PH-- 0/0/0/0/0 0/0 "GET / HTTP/1.1" Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Socket closed on read Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Sending close_notify alert Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: SSL_shutdown successfully sent close_notify alert Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG3[1737:140557193119488]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: Connection closed: 204 byte(s) sent to SSL, 137 byte(s) sent to socket Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Remote socket (FD=8) closed Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Local socket (FD=3) closed Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Service [proxy] finished (0 left) 1.2.3.4 = my external ip I am testing with 10.0.2.9 = haproxy/stunnel server 10.0.2.10 = my apache server Any ideas greatly appreciated. -- Robert Garcia BigHead Technology 15520 Coutolenc Rd Magalia, Ca 95954 ph: 530.645.4040 x222 fax: 530.645.4040 rgarcia(a)bighead.net (mailto:[email protected]) - http://bighead.net/

1 0

Re: [stunnel-users] Outlook and stunnel
by James Devine 05 Jun '12

05 Jun '12

I'm using stunnel as a reverse proxy. I have an smtp server smtp1 and an stunnel server proxy1. Clients connect to and negotiate ssl on proxy1 which then connects to smtp1 via a plaintext connection. stunnel does not reside on the client. If I connect the client directly to smtp1 via ssl it works fine. On Tue, Jun 5, 2012 at 12:20 PM, Pierre DELAAGE <delaage.pierre(a)free.fr>wrote: > Hmmm if you are using stunnel on client side (as suggested by your > correction) it is that YOU DO NOT WANT TO USE SSL OPTION in OUTLOOK. > > because stunnel will act as an "almost transparent' ssl tunnel. > > So in outlook : uncheck ssl option and give "localhost" as your smtp > server. > > and adapt local port according to your stunnel conf. > > Apart from that : I use stunnel on the server ONLY, with self signed > certificate coming from openssl, > and outlook configured as ssl client is working. > SSLversion = all is always GOOD > > works with stunnel 4.20 on linux mandriva 2008, outlook 2007 > > Pierre > > > > Le 05/06/2012 20:08, James Devine a écrit : > > > On Tue, Jun 5, 2012 at 10:52 AM, James Devine <fxmulder(a)gmail.com> wrote: > >> I am trying to setup stunnel to ssl proxy mail to an smtp server and this >> seems to work fine for thunderbird but when I try using outlook 2010 to >> connect via ssl I get the error: >> >> Send test e-mail message: Your server does not support the connection >> encryption type you have specified. Try changing the encryption method. >> >> For sslVersion I have the option of SSLv3 and TLSv1, all and SSLv2 do >> not seem to work so I'm not sure if that is the problem >> >> Anyone else run in to this or know what I might do to resolve it? >> > > I can get it to work if I setup ssl on the end server directly and bypass > stunnel > > > _______________________________________________ > stunnel-users mailing [email protected]://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Outlook and stunnel
by James Devine 05 Jun '12

05 Jun '12

I am trying to setup stunnel to ssl proxy mail to an smtp server and this seems to work fine for thunderbird but when I try using outlook 2010 to connect via ssl I get the error: Send test e-mail message: Your server does not support the connection encryption type you have specified. Try changing the encryption method. For sslVersion I have the option of SSLv3 and TLSv1, all and SSLv2 do not seem to work so I'm not sure if that is the problem Anyone else run in to this or know what I might do to resolve it?

1 1

stunnel 4.53 released
by Michal Trojnara 03 Jun '12

03 Jun '12

Dear Users, I have released version 4.53 of stunnel. This is major a bugfix release. Upgrade is highly recommended. The ChangeLog entry: Version 4.53, 2012.03.19, urgency: MEDIUM: * New features - Added client-mode "sni" option to directly control the value of TLS Server Name Indication (RFC 3546) extension. - Added support for IP_FREEBIND socket option with a pached Linux kernel. - Glibc-specific dynamic allocation tuning was applied to help unused memory deallocation. - Non-blocking OCSP implementation. * Bugfixes - Compilation fixes for old versions of OpenSSL (tested against 0.9.6). - Usage of uninitialized variables fixed in exec+connect services. - Occasional logging subsystem crash with exec+connect services. - OpenBSD compilation fix (thx to Michele Orru'). - Session id context initialized with session name rather than a constant. - Fixed handling of a rare inetd mode use case, where either stdin or stdout is a socket, but not both of them at the same time. - Fixed missing OPENSSL_Applink http://www.openssl.org/support/faq.html#PROG2 - Fixed crash on termination with FORK threading model. - Fixed dead canary after configuration reload with open connections. - Fixed missing file descriptors passed to local mode processes. - Fixed required jmp_buf alignment on Itanium platform. - Removed creating /dev/zero in the chroot jail on Solaris platform. - Fixed detection of WSAECONNREFUSED Winsock error. - Missing Microsoft.VC90.CRT.manifest added to Windows installer. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.53.tar.gz: 3e640aa4c96861d10addba758b66e99e7c5aec8697764f2a59ca2268901b8e57 Best regards, Mike

3 2

Re: [stunnel-users] BEAST Attack
by Scott McKeown 31 May '12

31 May '12

Hi Mike, Thank you for your input. I'll rebuild today and retest. Our company openly supports Open Source projects that we use and we will continue to do so. However, since we are still in a R&D position with STunnel at the moment I thought it would be better to continue to use the users group. I'll post again once I've rebuilt and tested, which might not be until the end of next week now as we have an nice extended weekend in the UK for the Golden Jubilee which is nice. ~Yours, Scott -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

1 0

Re: [stunnel-users] BEAST Attack
by Scott McKeown 30 May '12

30 May '12

Hi Michal, Thanks for following this up. I'm using the latest build of STunnel v4.53 as shown below (I check the site once a week just to make sure too) # stunnel -version stunnel 4.53 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:POLL+IPv6 Global options: debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") session = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none I've also included a copy of my stunnel.cfg file below: # more /etc/stunnel/stunnel.cfg # STunnel configuration file generated by loadbalancer.org appliance setgid = nobody pid = /stunnel.pid debug = 0 [S1] accept = 192.168.82.182:443 connect = 192.168.82.181:81 cert = /etc/loadbalancer.org/certs/S1.pem ciphers = RC4:HIGH:!MD5:!aNULL options = NO_SSLv2 protocol = proxy I'm looking to include the STunnel Product within our Loadbalancer Appliance in our next upcoming release but with everyone now using the SSL checker that I mentioned in one of my last e-Mails more customers are becoming concerned about MITM Attacks etc. so I would really like to get this solved before I move forward with the project. Oh, I guess I should also mention that this is running on a Centos 6.2 box. ~Yours, Scott

2 1

BEAST Attack
by Scott McKeown 29 May '12

29 May '12

Hi All, Has anyone looked at the current issue with the BEAST Attack. I'm looking at https://www.ssllabs.com/ssltest/index.html which can be used for testing SSL Certificates I also use Pound Proxy which I have now patched and this has removed the threat. However, I don't seem to be able to get the same result from a STunnel installation. If anyone can give some advice that would be great. ~Yours, Scott

3 5

limit to number of services
by Terren Suydam 24 May '12

24 May '12

Hi there, I seem to be hitting a limit on the number of stunnel services I can run simultaneously. According to the log, they appear to set up without any issues, but after 64 services they don't pass traffic. Is this something stunnel itself limits, or is it an OS limitation? I am running the latest windows build on Windows Server 2008. Either way, is there an easy way to increase the number of services? Thanks, Terren

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users