- stunnel-users - stunnel.org

Stunnel 4.28 released
by Michal Trojnara 08 Nov '09

08 Nov '09

The ChangeLog entry: Version 4.28, 2009.11.08, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8l. - Transparent proxy support on Linux kernels >=2.6.28. See the manual for details. - New socket options to control TCP keepalive on Linux: TCP_KEEPCNT, TCP_KEEPIDLE, TCP_KEEPINTVL. - SSL options updated for the recent version of OpenSSL library. * Bugfixes - A serious bug in asynchronous shutdown code fixed. - Data alignment updated in libwrap.c. - Polish manual encoding fixed. - Notes on compression implementation in OpenSSL added to the manual. SHA-1 value for stunnel-4.28.tar.gz: 868cba9ec56ed6a02c8ecfa2a87614b4d433611b Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

Update docs to remove RLE as compression choice
by Joe Kemp 06 Nov '09

06 Nov '09

I just confirmed that RLE compression is not truly implemented in OpenSSL. It would be helpful to remove it from the stunnel docs so people don't think it's an option to compress data. ZLIB is it. And yes I spent a good bit of time last year with Wireshark to determine RLE vs ZLIB compression ratios in stunnel. Shockingly ZLIB was always better... One other note that may be important for some people is that 0.9.7 openssl is not compatible with 0.9.8 with respect to zlib compression. Joe A. Kemp CapWIN Senior Systems Architect (O) 301-614-3727 (C) 301-502-1281

2 1

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 05 Nov '09

05 Nov '09

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. _________________________________________________________________ Windows Live: Gör det enklare för dina vänner att se vad du håller på med på Facebook. http://www.microsoft.com/sverige/windows/windowslive/see-it-in-action/socia…

1 0

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 05 Nov '09

05 Nov '09

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. Another question is that if there is no support for PSK, how much work is it to download the source and add support for it given that I know C++/C. _________________________________________________________________ Hitta hetaste singlarna på MSN Dejting! http://dejting.se.msn.com/channel/index.aspx?trackingid=1002952

1 0

Tunneling udp over stunnel
by D-503 03 Nov '09

03 Nov '09

Hi, I'm trying to setup some kind of DNS-encryption with the usage of stunnel: https://www.privacyfoundation.de/wiki/HTTPS-DNS/TLS-DNS . This setup is working but pretty pretty slow. One DNS-request takes really long, about 5-6 seconds! I'm wondering why this happens. On the server is running stunnel 4.22 and on the client stunnel 4.25. The config is as described in the link above. What happens in the logs when I do one dns-request, you can see in the attachments of this mail. Something interesting is, if I do a: dig @localhost google.com it takes 5-6 seconds to finish. But if I execute it, abort it directly and execute it again, I get immediatly an answer! This works reproducably. Have you any idea? Could the error be with open/closed connections or some timeouts in stunnel? greetings D-503

1 0

Help with basic stunnel configuration
by Craig Watkinson 30 Oct '09

30 Oct '09

Hello, I have been trying to enable stunnel on a HPUX server, and whilst I thought it was going to be simple, I have not been able to make it work so far. We have a webserver and due to some pages being hardcoded to port 8080 it can't support SSL without a lot of code changes. As a short term workaround I am trying to use stunnel in server mode to provide a HTTPS interface. I expected this to be a very simple matter of accepting connections on port 443 and connecting to port 8080, but it's not working. We're using an old version of stunnel (4.04) however this is the version bundled with the HPUX OS we have. When stunnel is started there are no errors (log file output below) and netstat shows that a process is listening on port 443, however a browser (tried IE6 and Firefox) doesn't display anything. Connecting to port 8080 shows the application as expected. I have run a wireshark trace at the client end, and it seems that the stunnel server is not responding to the initial "Client Hello" message. Only 3 packets are seen: C->S SYN S->C SYN,ACK C->S SSL Client Hello My guess is that the ssl server is not starting up correctly, however everything looks ok in the logfile, although it might not be completing. Nothing is displayed in the log when I try to connect to port 443. Any help would be much appreciated as I am stuck! Thanks Craig Server eSM_CoE# uname -a HP-UX eSM_CoE B.11.23 U ia64 1107767544 unlimited-user license Stunnel Version eSM_CoE# ./sbin/stunnel -version stunnel 4.04 on ia64-hp-hpux11.23 PTHREAD with OpenSSL 0.9.8d 28 Sep 2006 Global options cert = /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem pid = /opt/hpws/apache32/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds Conf file eSM_CoE# cat stunnel.conf # Sample stunnel configuration file RNDfile=/opt/hpws/apache32/stunnel/.stunnel.rnd # Chroot #chroot = /var/chroot/stunnel/ # PID is created inside chroot jail pid = /opt/hpws/apache32/logs/stunnel.pid # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Client Authentication #verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: #CAfile = /opt/hpws/apache32/conf/certs.pem # Some debugging stuff debug = 7 output = /opt/hpws/apache32/logs/stunnel.log # Use in client mode client = no # Run in the background foreground = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 delay=yes # Service-level configuration [https] accept = 172.20.167.74:443 connect = localhost:8080 TIMEOUTclose = 10 Log file output 2009.10.30 14:32:41 LOG5[4172:1]: stunnel 4.04 on ia64-hp-hpux11.23 PTHREAD with OpenSSL 0.9.8d 28 Sep 2006 2009.10.30 14:32:41 LOG7[4172:1]: Snagged 64 random bytes from /opt/hpws/apache32/stunnel/.stunnel.rnd 2009.10.30 14:32:41 LOG7[4172:1]: Wrote 1024 new random bytes to /opt/hpws/apache32/stunnel/.stunnel.rnd 2009.10.30 14:32:41 LOG7[4172:1]: RAND_status claims sufficient entropy for the PRNG 2009.10.30 14:32:41 LOG6[4172:1]: PRNG seeded successfully 2009.10.30 14:32:41 LOG7[4172:1]: Certificate: /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem 2009.10.30 14:32:41 LOG7[4172:1]: Key file: /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem 2009.10.30 14:32:41 LOG5[4172:1]: FD_SETSIZE=60000, file ulimit=4096 -> 2000 clients allowed 2009.10.30 14:32:41 LOG7[4172:1]: FD 5 in non-blocking mode 2009.10.30 14:32:41 LOG7[4172:1]: SO_REUSEADDR option set on accept socket 2009.10.30 14:32:41 LOG7[4172:1]: https bound to 172.20.167.74:443 _________________________________________________________________ New Windows 7: Find the right PC for you. Learn more. http://www.microsoft.com/uk/windows/buy/

1 0

stunnel compatibility problems between Windows & Linux ?
by Ewald 30 Oct '09

30 Oct '09

I am running an stunnel in chroot setup on a Red Hat Enterprise Linux Server (v3) : stunnel 4.27 on x86_64-unknown-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 And i want to connect from a Windows 2003 system (als version 4.27) When i try to do a basic connect from the Windows stunnel to the Linux stunnel, the connection gets reset each time, ssldump shows: New TCP connection #1: hans13(1363) <-> nada(25000) 1 1 0.0000 (0.0000) C>S Handshake ClientHello Version 3.0 cipher suites Unknown value 0x39 Unknown value 0x38 Unknown value 0x35 SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA Unknown value 0x33 Unknown value 0x32 Unknown value 0x2f SSL_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA SSL_RSA_WITH_DES_CBC_SHA SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA SSL_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 SSL_RSA_EXPORT_WITH_RC4_40_MD5 compression methods unknown value NULL 1 2 0.0000 (0.0000) S>C Alert level fatal value handshake_failure 1 0.0000 (0.0000) S>C TCP RST Stunnel logging shows: 2009.10.26 10:37:25 LOG7[29959:1073879408]: xxx started 2009.10.26 10:37:25 LOG7[29959:1073879408]: FD 7 in non-blocking mode 2009.10.26 10:37:25 LOG5[29959:1073879408]: tfe accepted connection from 10.10.10.10:1250 2009.10.26 10:37:25 LOG7[29959:1073879408]: SSL state (accept): before/accept initialization 2009.10.26 10:37:25 LOG7[29959:1073879408]: SSL alert (write): fatal: handshake failure 2009.10.26 10:37:25 LOG3[29959:1073879408]: SSL_accept: 1408A09F: error:1408A09F:SSL routines:SSL3_GET_CLIENT_HELLO:length mismatch 2009.10.26 10:37:25 LOG5[29959:1073879408]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.10.26 10:37:25 LOG7[29959:1073879408]: xxx finished (-1 left) When i explicitly configure the Windows stunnel to use: sslVersion = SSLv2 or sslVersion = TLSv1 (see ssldump logging below) everything works fine. Is this a known bug or an undocumented feature? Ewald... New TCP connection #3: hans13.amc.nl(1367) <-> nada.amc.nl(25000) 3 1 0.0000 (0.0000) C>S Handshake ClientHello Version 3.1 resume [32]= b8 a1 d2 93 6a ae 4a 0d 49 04 cd 88 92 75 f1 6d d7 65 88 c3 01 51 bf eb d4 44 ce b7 fd 75 32 64 cipher suites Unknown value 0x39 Unknown value 0x38 Unknown value 0x35 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA Unknown value 0x33 Unknown value 0x32 Unknown value 0x2f TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_RC4_128_MD5 TLS_DHE_RSA_WITH_DES_CBC_SHA TLS_DHE_DSS_WITH_DES_CBC_SHA TLS_RSA_WITH_DES_CBC_SHA TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA TLS_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 TLS_RSA_EXPORT_WITH_RC4_40_MD5 compression methods unknown value NULL 3 2 0.0000 (0.0000) S>C Handshake ServerHello Version 3.1 session_id[32]= b8 a1 d2 93 6a ae 4a 0d 49 04 cd 88 92 75 f1 6d d7 65 88 c3 01 51 bf eb d4 44 ce b7 fd 75 32 64 cipherSuite Unknown value 0x35 compressionMethod NULL etc...

2 1

Connections begin resetted
by Roman Medina-Heigl Hernandez 26 Oct '09

26 Oct '09

Hello, Till some recent time, I was using "socat" (http://www.dest-unreach.org/socat/) to create a SSL-wrapper (in a way similar to what "stunnel" does). I was using: === socat -ly -d -d openssl-listen:443,bind=X.X.X.X,fork,reuseaddr,cipher=HIGH:3DES:MD5,cert=server-cert.pem,key=server-key.pem,verify=0 tcp4:Y.Y.Y.Y:P === It was working pretty well, without interruptions, although it got some estability problems when passing 1-2 months (server apparently get stuck). So I decided to give a try to "stunnel". I switched to "stunnel" and problems arise... I'm experimenting *very* frequent connection cuts. If I examine daemon.log (I'm using Debian 5), I have: Oct 20 12:06:36 hetzner stunnel: LOG3[3677:3083029392]: SSL_read: 140EC071: error:140EC071:SSL routines:SSL2_READ_INTERNAL:bad mac decode Oct 20 12:06:36 hetzner stunnel: LOG5[3677:3083029392]: Connection reset: 315484 bytes sent to SSL, 50471 bytes sent to socket So it seems stunnel is closing the connection due to a "bad mac decode" error. My environment (client and server) have not changed, I only switched "the transport" (socat -> stunnel). Any idea why is it failing now? Moreover, if I switch back to socat, cuts disappear. Is stunnel buggy? Am I missing some config/tunning at the SSL/socket level? My current config is: roman@hetzner:~$ stunnel4 -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 root@hetzner:~# stunnel4 -version stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none My stunnel.conf is very simple. Apart from cert setup, the tunnel is something like: === [tunelserv] accept = X.X.X:X:443 connect = X.X.X.X:P === Any idea? Thank you in advance. Cheers, -Roman

2 2

Re: [stunnel-users] multiple domain certificates
by Ludolf Holzheid 23 Oct '09

23 Oct '09

On Fri, 2009-10-23 15:04:14 -0400, Al Gonzalez wrote: > I apologize for a potentially silly question, but is there any way to > determine if my question made it to the user's group. I sent in a > question (I think last Friday), and other than a auto-reply to myself, I > don't know if anyone really received it. I'm in a bit of a pickle, and > could sure use some help. Thanks. If you are worried about your message may not make it to a mailing list, check the list archive at the URL given in the "List-Archive:" header included in the mails sent from the list server. In case of stunnel-users this is http://stunnel.mirt.net/pipermail/stunnel-users. And yes, your mail from October 20th can be found there. Regarding your problem, I'm afraid I can't help as I use stunnel for 'secure tunnels' only, i.e. I have stunnel on both ends of the connection and I don't have to care about the protocols tunneled through. Sorry, Ludolf. -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

multiple domain certificates
by Andrew Farmer 23 Oct '09

23 Oct '09

Does stunnel support multiple domain certificates? I am trying to get stunnel to work with multiple domains on a machine that can have only one IP address. (It is an amazon EC2 instance - they do not support multiple IPs per instance) It seems to me that the only way to get this to work is with a multiple domain certificate, which I believe is called a "Unified Communications Certificate". Does stunnel support these? Thank you so much, Andrew -- View this message in context: http://www.nabble.com/multiple-domain-certificates-tp25897355p25897355.html Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 2

https problems over TLSv1
by Al Gonzalez 20 Oct '09

20 Oct '09

Thank you in advance for any assistance you can provide... I am trying to talk to a UHF radio (from a PC) over a secure channel, but having some difficulties. Please let me provide just a little background so you know why I’m doing what I’m doing. In the existing system, Internet Explorer (IE) is the client that talks to this radio. When the radio boots up, it sends a webpage over Ethernet to IE and (after the user login), a secure link is established, and the radio can be controlled from IE – the various webpages change as the user maneuvers through the various dropdowns, etc. We’ve been asked to automate this interface now for a production environment. The client is going to be replaced with a PC connected to a great deal of test equipment, and the server will now send XML instead of html to the client. The client is being developed in LabVIEW (from National Instruments) – this has made this task even more challenging. As all of this secure stuff is new to me, I spent many hours just trying to understand the problem(s) and the lingo. As LabVIEW has some limitations in this area, I found that Stunnel was my best option. Using TCP/IP and sending http to the radio (shown below), I’ve been able (in a non-secure mode, without Stunnel) to communicate and get the opening screen (html) to be returned to me (the XML server output is currently being developed) and displayed in a LabVIEW window. GET / HTTP/1.1 Host: 10.4.32.1 Connection: Keep-Alive Authorization: Basic YWRtaW46UgEkJHdvtmQx Credentials: admin:Password I downloaded the binary version of Stunnel.exe (version 4.27 with OpenSSL 0.9.8k dated Mar 2009), then modified the LabVIEW code to call (using a command line approach) Stunnel. In this way, I can’t provide any (dash) options, so it’s completely dependent on the stunnel.conf file. After a number of attempts, I was able to get the client to bind to the server (I think), but I see nothing being returned to me (no html). I must use TLSv1, and ciphers = DES-CBC3-SHA. I’ve seen examples on stunnel.org that show a great deal more handshaking information than I’m seeing, so I’m wondering if I’m missing some detail in my conf file. For example, my log file ends like this 2009.10.16 13:18:49 LOG7[4812:4776]: FD 208 in non-blocking mode 2009.10.16 13:18:49 LOG7[4812:4776]: SO_REUSEADDR option set on accept socket 2009.10.16 13:18:49 LOG7[4812:4776]: https bound to 10.4.1.8:443 But the example I mentioned goes on after the “https bound” and adds things like … 2009.08.04 12:15:55 LOG7[16648:22996]: proxy accepted FD=320 from 127.0.0.1:48086 2009.08.04 12:15:55 LOG7[16648:22996]: Creating a new thread 2009.08.04 12:15:55 LOG7[16648:22996]: New thread created 2009.08.04 12:15:55 LOG7[16648:8540]: proxy started 2009.08.04 12:15:55 LOG7[16648:8540]: FD 320 in non-blocking mode 2009.08.04 12:15:55 LOG7[16648:8540]: TCP_NODELAY option set on local socket 2009.08.04 12:15:55 LOG5[16648:8540]: proxy accepted connection from 127.0.0.1:48086 2009.08.04 12:15:55 LOG7[16648:8540]: FD 340 in non-blocking mode 2009.08.04 12:15:55 LOG7[16648:8540]: proxy connecting 89.149.253.125:8080 2009.08.04 12:15:55 LOG7[16648:8540]: connect_wait: waiting 10 seconds 2009.08.04 12:15:56 LOG7[16648:8540]: connect_wait: connected 2009.08.04 12:15:56 LOG5[16648:8540]: proxy connected remote server from 192.168.2.3:48088 2009.08.04 12:15:56 LOG7[16648:8540]: Remote FD=340 initialized 2009.08.04 12:15:56 LOG7[16648:8540]: TCP_NODELAY option set on remote socket 2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): before/connect initialization 2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): SSLv3 write client hello A 2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): SSLv3 read server hello A . . . 2009.08.04 12:15:57 LOG6[16648:8540]: SSL connected: new session negotiated 2009.08.04 12:15:57 LOG6[16648:8540]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 That make’s me think that I’m not quite there yet. I’ve attached my stunnel.conf, my log file, and the http request I’m making (above). I’m hoping you can find some flaws in my conf file that will get me closer. Other than receiving html, I’m not sure how to know that I truly have a secure connection. I’m thinking I should see a little more in my log file, but I’m not sure. The other thing I’m not sure about (as I’ve heard differing thoughts) is whether I have to Encrypt my http commands, or does stunnel take care of that somehow? If I have to encypt, how would I go about doing this? Also, (and I’m getting ahead of myself) do I have to open and close a session every time I want to talk, or do I somehow leave the channel open? I’ve read about Session Resumption, but I’m not sure if that is something I need to setup in the conf file, or if that can even be controlled by Stunnel. Al Gonzalez Principal Software Engineer Compass Call Programs Offensive Information Warfare Raytheon Company 260.429.4354 260.429.5829 fax Al_Gonzalez(a)raytheon.com

1 0

MySQL replication with stunnel, connection closed after some time
by Marcel Kirsch 16 Oct '09

16 Oct '09

Hello, I have a problem regarding stunnel and MySQL replication. I use replication to keep our database synchronous with a second database, which stands in our building. The secure connection via stunnel works and "SHOW SLAVE STATUS;" shows, that the replication is working. Because the master database is rarely used at the moment, sometimes there are no changes (insert, update or delete) made for an hour. Unfortunately it seems that stunnel disconnects the connection between the databases after some time. The client database still thinks that it is connected to the master server, because it still is connected to port 3307 (which is stunnel of course). So now the changes made in the master database are no longer replicated. Is there any way to configure stunnel to keep the connection between the to servers alive even after an hour of zero traffic? I thought that TIMEOUTidle would be the answer to my problem, but it had no effect. I really hope you can help me and thanks for your suggestions in advance. Greetings, Marcel Kirsch This is my current configuration: Client: ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle retry = yes TIMEOUTidle = 86400 ; Some debugging stuff useful for troubleshooting debug = 3 output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes [mysqls] accept = 3307 connect = 78.46.106.68:3307 Server: client = no pid = /var/run/stunnel.pid # # debugging # debug = 7 output = /etc/stunnel/stunnel.log # # Some performance tunings # # disable Nagle algorithm (a.k.a. tinygram prevention, see man 7 tcp) socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = /etc/stunnel/stunnel.pem retry = yes TIMEOUTidle = 86400 [mysqls] accept = 3307 connect = 127.0.0.1:mysql Log of client while connecting: 2009.10.09 09:28:58 LOG7[3729:3082963856]: connect_wait: connected 2009.10.09 09:28:58 LOG5[3729:3082963856]: mysqls connected remote server from 192.168.1.87:33206 2009.10.09 09:28:58 LOG7[3729:3082963856]: Remote FD=17 initialized 2009.10.09 09:28:58 LOG7[3729:3082963856]: TCP_NODELAY option set on remote socket 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): before/connect initialization 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 write client hello A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 read server hello A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 read server certificate A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 read server done A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 write client key exchange A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 write change cipher spec A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 write finished A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 flush data 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 read finished A 2009.10.09 09:28:58 LOG7[3729:3082963856]: 3 items in the session cache 2009.10.09 09:28:58 LOG7[3729:3082963856]: 3 client connects (SSL_connect()) 2009.10.09 09:28:58 LOG7[3729:3082963856]: 3 client connects that finished 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 client renegotiations requested 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 server connects (SSL_accept()) 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 server connects that finished 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 server renegotiations requested 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 session cache hits 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 session cache misses 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 session cache timeouts 2009.10.09 09:28:58 LOG6[3729:3082963856]: SSL connected: new session negotiated 2009.10.09 09:28:58 LOG6[3729:3082963856]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 Log of server while connecting: 2009.10.09 09:28:52 LOG7[31073:139652979042032]: mysqls accepted FD=14 from 212.95.118.250:60651 2009.10.09 09:28:52 LOG7[31073:1091389776]: mysqls started 2009.10.09 09:28:52 LOG7[31073:1091389776]: FD 14 in non-blocking mode 2009.10.09 09:28:52 LOG7[31073:1091389776]: TCP_NODELAY option set on local socket 2009.10.09 09:28:52 LOG7[31073:1091389776]: Waiting for a libwrap process 2009.10.09 09:28:52 LOG7[31073:1091389776]: Acquired libwrap process #0 2009.10.09 09:28:52 LOG7[31073:1091389776]: Releasing libwrap process #0 2009.10.09 09:28:52 LOG7[31073:1091389776]: Released libwrap process #0 2009.10.09 09:28:52 LOG7[31073:1091389776]: mysqls permitted by libwrap from 212.95.118.250:60651 2009.10.09 09:28:52 LOG5[31073:1091389776]: mysqls accepted connection from 212.95.118.250:60651 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): before/accept initialization 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 read client hello A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write server hello A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write certificate A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write server done A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 flush data 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 read client key exchange A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 read finished A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write change cipher spec A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write finished A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 flush data 2009.10.09 09:28:52 LOG7[31073:1091389776]: 3 items in the session cache 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 client connects (SSL_connect()) 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 client connects that finished 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 client renegotiations requested 2009.10.09 09:28:52 LOG7[31073:1091389776]: 17 server connects (SSL_accept()) 2009.10.09 09:28:52 LOG7[31073:1091389776]: 17 server connects that finished 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 server renegotiations requested 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 session cache hits 2009.10.09 09:28:52 LOG7[31073:1091389776]: 1 session cache misses 2009.10.09 09:28:52 LOG7[31073:1091389776]: 14 session cache timeouts 2009.10.09 09:28:52 LOG6[31073:1091389776]: SSL accepted: new session negotiated 2009.10.09 09:28:52 LOG6[31073:1091389776]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.10.09 09:28:52 LOG7[31073:1091389776]: FD 15 in non-blocking mode 2009.10.09 09:28:52 LOG7[31073:1091389776]: mysqls connecting 127.0.0.1:3306 2009.10.09 09:28:52 LOG7[31073:1091389776]: connect_wait: waiting 10 seconds 2009.10.09 09:28:52 LOG7[31073:1091389776]: connect_wait: connected 2009.10.09 09:28:52 LOG5[31073:1091389776]: mysqls connected remote server from 127.0.0.1:59705 2009.10.09 09:28:52 LOG7[31073:1091389776]: Remote FD=15 initialized 2009.10.09 09:28:52 LOG7[31073:1091389776]: TCP_NODELAY option set on remote socket 2009.10.09 09:28:52 LOG7[31073:1098307920]: Socket closed on read 2009.10.09 09:28:52 LOG7[31073:1098307920]: SSL write shutdown 2009.10.09 09:28:52 LOG7[31073:1098307920]: SSL alert (write): warning: close notify 2009.10.09 09:28:52 LOG6[31073:1098307920]: SSL socket closed on SSL_shutdown 2009.10.09 09:28:52 LOG7[31073:1098307920]: Socket write shutdown 2009.10.09 09:28:52 LOG5[31073:1098307920]: Connection closed: 9600 bytes sent to SSL, 185 bytes sent to socket 2009.10.09 09:28:52 LOG7[31073:1098307920]: mysqls finished (1 left) Log of server while disconnecting: 2009.10.09 09:53:48 LOG3[31073:1091389776]: SSL_read: Connection reset by peer (104) 2009.10.09 09:53:48 LOG5[31073:1091389776]: Connection reset: 1047 bytes sent to SSL, 185 bytes sent to socket 2009.10.09 09:53:48 LOG7[31073:1091389776]: mysqls finished (0 left) (There is no log of client while disconnecting)

3 3

Re: [stunnel-users] MySQL replication with stunnel, connection closed after some time
by Michal Trojnara 16 Oct '09

16 Oct '09

Marcel Kirsch wrote: > it is correct that there is a router (with NAT) between the slave server > and the internet. I tried the solution of Mike (socket = > l:SO_KEEPALIVE=1...), but it didn't work. > I googled SO_KEEPALIVE and discovered that it only sends a keep alive > packet every 2 hours by default. Unfortunately the connection is closed > after a shorter time (about 30 minutes). Do you know how it is possible > to set the keep alive time to a shorter value? On Linux you can use: echo 300 > /proc/sys/net/ipv4/tcp_keepalive_time Best regards, Mike

1 0

Re: [stunnel-users] MySQL replication with stunnel, connection closed after some time
by Michal Trojnara 15 Oct '09

15 Oct '09

Marcel Kirsch wrote: > Is there any way to > configure stunnel to keep the connection between the to servers alive > even after an hour of zero traffic? I thought that TIMEOUTidle would be > the answer to my problem, but it had no effect. [cut] > 2009.10.09 09:53:48 LOG3[31073:1091389776]: SSL_read: Connection reset > by peer (104) I'm pretty sure there is a network device (some kind of statefull firewall or NAT) between these machines. I think the timeout is caused by the TCP state expired rater than by stunnel. I think enabling TCP keepalives could be an effective workaround: socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 The trick is to generate some traffic on an idle connection to convince the network device that this TCP connection is not dead. An alternative solution would be to increase the TCP state timeout on the network device. Best regards, Mike

1 0

bind error when specifying hostname
by Andrew Farmer 13 Oct '09

13 Oct '09

Hi! I'm not sure if this message was sent to the mailing list the first time... I was not subscribed before but I am now. I'm trying to configure stunnel to use a different CERT depending upon the hostname that my server is accessed on. (Same server has multiple hostnames) Is this feature supported? I didn't get very far before running into issues. This configuration works: (so I know nothing else is bound on port 443) [https] accept = 443 ... etc ... This configuration fails: [https] accept = nmw3.com:443 ... etc ... with this error: 2009.10.09 14:49:18 LOG3[31137:3086100144]: Error binding https to 75.101.155.94:443 2009.10.09 14:49:18 LOG3[31137:3086100144]: bind: Cannot assign requested address (99) So I tried a simpler configuration: [https] accept = 127.0.0.1:443 ... etc ... and that fails with this error: 2009.10.09 14:56:28 LOG3[31222:3086722736]: Error binding https to 127.0.0.1:443 2009.10.09 14:56:28 LOG3[31222:3086722736]: bind: Address already in use (98) Appreciate all your help! Andrew -- View this message in context: http://www.nabble.com/bind-error-when-specifying-hostname-tp25828605p258286… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Unable to create connection on SSL with FIX Server
by ch.asad＠gmail.com 13 Oct '09

13 Oct '09

Hi, i am using Stunnel to send quickfix messages on SSL to FIX server. I am struck with some errors. In the STUNNEL log i am getting the follow error: 2009.10.13 08:57:05 LOG3[4028:2532]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_ HELLO:unknown protocol And in the Quickfix Logs are also shown below: 20091013-02:57:01 : Created session 20091013-02:57:05 : Connecting to 127.0.0.1 on port 9000 20091013-02:57:05 : Initiated logon request 20091013-02:57:05 : Socket Error: An existing connection was forcibly closed by the remote host. 20091013-02:57:05 : Disconnecting 20091013-02:57:06 : Connecting to 127.0.0.1 on port 9000 20091013-02:57:06 : Initiated logon request 20091013-02:57:06 : Socket Error: An existing connection was forcibly closed by the remote host. 20091013-02:57:06 : Disconnecting 20091013-02:57:26 : Connecting to 127.0.0.1 on port 9000 20091013-02:57:26 : Initiated logon request 20091013-02:57:26 : Socket Error: An existing connection was forcibly closed by the remote host. Can any one Guide me what is causing porblem in this?? -- View this message in context: http://www.nabble.com/Unable-to-create-connection-on-SSL-with-FIX-Server-tp… Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 1

Re: [stunnel-users] rewrite Destination: when rewriting Host:
by Brian Hatch 07 Oct '09

07 Oct '09

Sometime near 2007-11-11 00:15 -0500, Marcio Marchini shouted: > Researching online one can see that WebDAV's spec requires that they > check both src and dest URLs for protocol & port. But with some proxies or > SSL fronts like stunnel, only one of the URLs is rewritten, so one goes as > http and the other as https. Here's one person explaining it, much better > than me: http://svn.haxx.se/users/archive-2006-03/0549.shtml Stunnel doesn't currently have the ability to scan and re-write the plaintext. For HTTP redirects it could possibly be implemented (re-write only the response before ^$, and redirects aren't chunked and don't have content lengths to work with, etc) but you'd still need enough HTTP logic to handle keepalives and such. It's not trivial and not likely. Another option would be to have something already HTTP aware doing the rewriting in between stunnel and subversion. A re-writing proxy. Another option would be to use mod_rewrite in apache to rewrite the urls. But the best way would be to just use SSL inside apache and drop stunnel entirely. -- Brian Hatch The best way to accelerate Systems and a Windows machine is at Security Engineer 9.8 meters per second http://www.ifokr.org/bri/ squared. Every message PGP signed

3 2

Weird verify behaviour using intermediate CAs
by Simon Vallet 05 Oct '09

05 Oct '09

Hi, we're trying to make use of stunnel here for proxy purposes : any certificate-authenticated SSL client connection from the Internet would be forwarded to some internal server. This works fine, but I found some surprising behaviour when verifying client certificates. Consider the following setup, using an intermediate client CA : * RootCA ** UserCA1 *** UserCert1 ** UserCA2 *** UserCert2 To make this work, it seems I only have to include the Root CA certificate in either a CAfile or a directory of trusted certificates. I would have expected to have to include the intermediate CA (which is signing the user certificate), but it seems it is not the case. What worries me is that now *any* end-entity certificate which has been issued by *other* intermediate CAs is accepted as valid, i.e. UserCert2 is accepted as valid, even if I don't include UserCA2 anywhere in the configuration. Is this really the intended behaviour ? If not, what would I be missing ? Simon stunnel.conf ----------------------------------------------------------- connect = 127.0.0.1:25 CApath = /etc/stunnel/certs cert = /etc/stunnel/apollon.genoscope.cns.fr-RevChain.pem key = /etc/stunnel/apollon.genoscope.cns.fr-Key.pem verify = 2 debug = 7 ------------------------------------------------------------------------ [root@apollon certs]# ls -l /etc/stunnel/certs/ total 4 lrwxrwxrwx 1 root root 28 sep 30 11:01 9a5490ff.0 -> GenoscopeACRacine.cacert.pem -rw-r--r-- 1 root root 2269 sep 15 11:47 GenoscopeACRacine.cacert.pem [root@apollon certs]#

2 6

Looking for someone to install Stunnel on my server
by Nathan Mueller 02 Oct '09

02 Oct '09

I am looking to hire someone to install Stunnel (and openSSL) on my Media Temple DV account. Please send hourly rate and how long you think it would take to: nmueller(a)g.risd.edu Thank you for your time, Nate

1 0

Advanced Config Question-
by Dave Fazio 01 Oct '09

01 Oct '09

Group, Need help confirming Stunnel can be configured the following way: I have a server that has 5 local IPs, mapping to 5 public IPs on the outside. For example purposes, my local IPs are "A", "B", "C", "D", and "E"... If I connect to a stunnel port configured to "C", will Stunnel route the request outbound on "C" or will it use "A" outbound? The way I have it configured, it's using "A" apparently, no matter what local stunnel IP I bind my connection to. And help will be greatly appreciated. - Dave Windows Server 2003 64-bit Stunnel as a Service Example Config: [Connection-A] accept = 10.5.12.57:9000 connect = outbound.example.server:145 TIMEOUTidle = 4 [Connection-B] accept = 10.5.12.58:9005 connect = outbound.example.server:145 TIMEOUTidle = 4

2 2

SMTP AUTH with stunnel?
by conover＠rahul.net 30 Sep '09

30 Sep '09

Can stunnel be used for a local smtp server, that does not support upstream SMTP AUTH, to connect to an smtp server that requires it? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

2 1

Problems implementing certificate
by Marcelo Iturbe 15 Sep '09

15 Sep '09

Hello, I am using Stunnel 4.27 binary version on Windows 2003 server. In the stunnel.pam file I did the following: In the -----BEGIN RSA PRIVATE KEY----- section, I placed the same text that appeared in the -----BEGIN NEW CERTIFICATE REQUEST----- when I purchased the certificate In the -----BEGIN CERTIFICATE----- section I placed what verisign returned to me. When I try to load Stunnel I get the following error messages: : RAND_status claims sufficient entropy for the PRNG : PRNG seeded successfully : SSL context initialized for service gmail-pop3s : Certificate: stunnel.pem : Error reading certificate file: stunnel.pem : error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib : error stack: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib : error stack: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error : error stack: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error : SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag : Server is down Any thoughts as to where I went wrong? Thanks for your help

1 0

Re: [stunnel-users] Stunnel Certificate generation
by Alaric Dailey 10 Sep '09

10 Sep '09

You can modify your stunnel.conf, there are lots of examples on the web to do that. Please don't use self-signed certs, you will have no end of issues, and there is NO reason to. StartCom offers free certificates, is in most browsers now, and will be included in IE by the end of September. http://blog.startcom.org/?p=205 So why would you create the headaches of using self-signed certs? Original Message ----------------------- Hi, I would like to know whether it is possible to automate the process of generating stunnel.pem. During the make install we get questions like: Generating a 1024 bit RSA private key ..................++++++ .........++++++ writing new private key to 'stunnel.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [PL]: How Can i automate it or avoid these questions so that i don't have to provide any input during make install. Please help me if you can. Iam using Tru64 platform. Thanks & Regards, Matty _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Stunnel Certificate generation
by Matty Ronald 09 Sep '09

09 Sep '09

Hi, I would like to know whether it is possible to automate the process of generating stunnel.pem. During the make install we get questions like: Generating a 1024 bit RSA private key ..................++++++ .........++++++ writing new private key to 'stunnel.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [PL]: How Can i automate it or avoid these questions so that i don't have to provide any input during make install. Please help me if you can. Iam using Tru64 platform. Thanks & Regards, Matty

1 0

using stunnel in HP UX 11i v3
by Mostafa Arab 09 Sep '09

09 Sep '09

Hi Sorry for my question because it is too elementary but I need some help. I want to use stunnel for one of our projects on an HP Itanium server that have HP UX 11i v3 This is result for #uname –a command : HP-UX xxxxx B.11.31 U ia64 2210092972 unlimited-user license I want to start stunnel as client . I found an stunnel in ‘/opt/hpws/apache’ folder. 1- May I use this stunnel for my project? 2- If it is possible how I can start it ? I added one line to /etc/services and tried to start : stunnel –d …. (according to a document) .But it seems that this version don’t support this option. Best Regards, Mostafa

2 1