- stunnel-users - stunnel.org

Re: [stunnel-users] Certificate
by Vitic Zikica (EXT) 12 Nov '14

12 Nov '14

HI, We are using stunnel to connect to some servers. The client informed us that we have to use new 2048 bit certificate ( XXXXX.crt ) Is it supported by stunnel ? how can I install it ? Thank you . Zikica VITIC BFI-DSI-FIS-ETRADING-ARCHITECTURE 47, quai d'Austerlitz 75648 Paris Cedex 13 Phone: +(33) 1 58 55 31 84 E-mail: flux(a)natixis.com<mailto:[email protected]> L'integrite de ce message n'etant pas assuree sur internet, Natixis ne peut etre tenu responsable de son contenu. Toute utilisation ou diffusion non autorisee est interdite. Si vous n'etes pas destinataire de ce message, merci de le detruire et d'avertir l'expediteur. Ensemble, faisons un geste pour l'environnement : n'imprimons nos mails que si necessaire. The integrity of this message cannot be guaranteed on the Internet. Natixis can not therefore be considered responsible for the contents. Any unauthorized use or dissemination is prohibited. If you are not the intended recipient of this message, then please delete it and notify the sender. Let us mind the environment : let's print our mails only when necessary

1 0

Output to neither stdout nor stderr it seems
by Casper Thomsen 10 Nov '14

10 Nov '14

Hi stunnel-users I run stunnel4 in docker with the following config file: --- /etc/stunnel/stunnel.conf -------------- sslVersion = SSLv3 pid = /var/lib/stunnel4/stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 2 CApath = /etc/ssl/certs debug = notice output = /var/log/stunnel.log client = yes foreground = yes [foo] accept = 1234 connect = 127.0.0.1:2345 TIMEOUTclose = 3 --------------------------------------------------------- When I run stunnel and pipe stdout and stderr to /dev/null, I still get output: root@849b7eb3bbd0:/# /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 2>/dev/null >/dev/null stunnel: LOG5[258:140421949949696]: stunnel 4.53 on x86_64-pc-linux-gnu platform stunnel: LOG5[258:140421949949696]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 stunnel: LOG5[258:140421949949696]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 stunnel: LOG5[258:140421949949696]: Reading configuration from file /etc/stunnel/stunnel.conf stunnel: LOG5[258:140421949949696]: Configuration successful ^Cstunnel: LOG3[258:140421949949696]: Received signal 2; terminating Complete shell output is attached. Any hints on what's happening? Kindly, -- Casper Thomsen

3 4

Truncated responses with stunnel >= 5.05
by Tuomas Silen 07 Nov '14

07 Nov '14

Hi there, After upgrading to stunnel 5.07 I've seen a lot of truncated http responses. I've tested different versions and 5.04 is the last one to work fine. There seems to be fixes to a similar issue in 5.05, but at least for me the result seems to be the opposite. I'm on Ubuntu 12.04. Looking at the logs, the log entries are identical except for one part, the amount of data sent to SSL: stunnel >= 5.05, not working: LOG3[31153]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing LOG5[31153]: Connection closed: 67584 byte(s) sent to SSL, 184 byte(s) sent to socket stunnel 5.04, works: LOG3[6248]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing LOG5[6248]: Connection closed: 113051 byte(s) sent to SSL, 184 byte(s) sent to socket It's worth noting that in both cases the closing happens after TIMEOUTclose has exceeded (probably because of a missing close notify?). In any case, apparently less data is sent to SSL and that's how it seems like; the end of the http responses get truncated. If everything's very fast (e.g. localhost connections only) the problem seems not to happen, not very often at least. With connections between two servers I've been able to reproduce it pretty much every time in my setup (stunnel -> haproxy -> apache -> unicorn). Undefining the POLLRDHUP or reverting the changes in 5.05 to src/client.c seem to fix the problem for me. Any ideas what would be a proper fix? Thanks! Best regards, Tuomas Silen

3 5

[BUG] SSL directory scan breaks cross-compilation
by John Spencer 05 Nov '14

05 Nov '14

it seems between 5.02 and 5.06 a "SSL directory scan" was introduced. for main_dir in /usr/local /usr/lib /usr/pkg /opt/local /opt /usr; do for sub_dir in /ssl /openssl /; do check_ssl_dir "$main_dir$sub_dir" && break 2 this ofc breaks cross-compilation. the concept of searching for a library directory is completely broken. if just adding -lssl -lcrypto to LDFLAGS doesnt find the openssl libraries at link time, the user's compiler toolchain is wrongly set up, and its not the job of a package to work around that by searching through a number of directories. it's the user's job to fix his toolchain by supplying the right -L paths in case he's got his library installed in a non-standard location. also, there's pkg-config (which supports crosscompilation via a PKG_CONFIG_SYSROOT_DIR env var) in case a library needs elaborate CFLAGS. --JS

2 6

slight fix for tools/stunnel.conf-sample.in
by Gleydson Soares 03 Nov '14

03 Nov '14

----- Forwarded message from Gleydson Soares <gsoares(a)gmail.com> ----- Date: Mon, 3 Nov 2014 17:00:38 -0300 From: Gleydson Soares <gsoares(a)gmail.com> To: stunnel-users(a)stunnel.org Cc: Marzena.Trojnara(a)mirt.net Subject: slight fix for tools/stunnel.conf-sample.in User-Agent: Mutt/1.5.23 (2014-03-12) Hi, I noticed unexpected characters in stunnel.conf-sample.in, stunnel 5.07. following diff fix that. --, Gleydson. ----- End forwarded message -----

1 0

stunnel 5.07 released
by Michal Trojnara 01 Nov '14

01 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.07 of stunnel. The ChangeLog entry: Version 5.07, 2014.11.01, urgency: MEDIUM: * New features - Several SMTP server protocol negotiation improvements. - Added UTF-8 byte order marks to stunnel.conf templates. - DH parameters are no longer generated by "make cert". The hardcoded DH parameters are sufficiently secure, and modern TLS implementations will use ECDH anyway. - Updated manual for the "options" configuration file option. - Added support for systemd 209 or later. - New --disable-systemd ./configure option. - setuid/setgid commented out in stunnel.conf-sample. * Bugfixes - Added support for UTF-8 byte order mark in stunnel.conf. - Compilation fix for OpenSSL with disabled SSLv2 or SSLv3. - Non-blocking mode set on inetd and systemd descriptors. - shfolder.h replaced with shlobj.h for compatibility with modern Microsoft compilers. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 505c6c63c4a20fc0cce8c35ef1ab7626c7b01071e3fca4ac6ea417afe8065309 stunnel-5.07.tar.gz 0e8d41a8102437d2c04a347bfe38ad80408fd2eb1451c559dcc7932ff2d09bd9 stunnel-5.07-installer.exe d3ced258ad35bea656ec178644d83e7d0b9fe8a2e4b2d6511e5c898ac9e6c7fc stunnel-5.07-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRU61wACgkQ/NU+nXTHMtEwLwCdEprl4s5aleq7+MzK9JmYcnQ+ q+gAniP9aOtMuQtML9zcRPK0LY6Yb/3H =IVK/ -----END PGP SIGNATURE-----

1 0

Help needed to load hierarchical chain of certificates
by Rejuan Masud Masud 31 Oct '14

31 Oct '14

Help needed to load hierarchical chain of certificates(Root, CA) when stunnel running in server mode. We are trying to load. but only server signed certificate is loading which is assigned in cert as below, CAfile=/u01/stunnel/AMEX_all/CA.PEM cert=/u01/stunnel/AMEX_all/cert.pem HOW TO LOAD HIERARCHICAL CHAIN OF CERTIFICATES?

2 1

special characters in output path -> error
by "Dirk Löning [CSB-Bruns&Börjes GmbH ]" 31 Oct '14

31 Oct '14

It's seems to be a problem in the new stunnel version 5.06 When I use the USERPROFILE directory, which contains special characters like "ö", i get an error: *[!] Cannot open log file: C:\Users\Bl?d\CSB\SSL\SmtpLog(0).txt* Is this a bug or must i change something ? The configuration file " SmtpConfig(0).txt" : ; Configuration file output = C:\Users\Blöd\CSB\SSL\SmtpLog(0).txt taskbar = yes cert = C:\Users\Blöd\CSB\SSL\stunnel.pem client = yes [ssmtp] accept = 8801 connect = smtp.1und1.de:465 The log says: [ ] No limit detected for the number of clients [.] stunnel 5.06 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.1j-fips 15 Oct 2014 [.] Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS [ ] errno: (*_errno()) [.] Reading configuration from file C:\Users\Blöd\CSB\SSL\SmtpConfig(0).txt [.] FIPS mode disabled [ ] Compression disabled [ ] GUI message loop initialized [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 0 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [ssmtp] [ ] Loading cert from file: C:\Users\Bl?d\CSB\SSL\stunnel.pem [ ] Loading key from file: C:\Users\Bl?d\CSB\SSL\stunnel.pem [ ] Private key check succeeded [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=456) [ ] Service [ssmtp] (FD=456) bound to 0.0.0.0:8801 *[!] Cannot open log file: C:\Users\Bl?d\CSB\SSL\SmtpLog(0).txt* [ ] Closing service [ssmtp] [ ] Service [ssmtp] closed (FD=456) [ ] Service [ssmtp] closed [!] Server is down greetings dirk

1 0

Re: [stunnel-users] Exchange Online - SSLv3 and Sophos UTM 120 firewall update
by Michal Trojnara 31 Oct '14

31 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Stephen Hogan wrote: > 2014.10.28 14:35:55 LOG7[4156]: SSL state (connect): SSLv3 write > client hello A [cut] > I have a basic (shaky) understanding that the "handshake" for TLS > does downgrade to SSLv3 if newer versions of TLS fail, but I am > wondering if I apply the update recommended on the firewall, will > this cut the communication for the SMTP relay, the way I am using > it? The debug messages produced by stunnel can sometimes be confusing. They are intended to be helpful to developers, and not end-users. OpenSSL implements the SSL/TLS/DTLS protocols with three separate finite state machines: SSLv2, SSLv3, and DTLS1. http://en.wikipedia.org/wiki/Automata-based_programming All TLS protocols use the SSLv3 state machine, thus the state name does not reflect the actual protocol being negotiated. See the source for details: https://github.com/openssl/openssl/blob/master/ssl/ssl_stat.c Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRREk8ACgkQ/NU+nXTHMtGLPwCgiA1tfq7LhNC600d5eVbWugLk coUAn1mGA4mWBAchUu5+d6nYfxe0isgr =p4hH -----END PGP SIGNATURE-----

2 1

Configuring Stunnel 4.1 to use TLS
by Deepak Subbanarasimha 30 Oct '14

30 Oct '14

Hello, I had some questions on Stunnel version for Windows. 1. Does Stunnel 4.1 support TLS? 2. If yes, what version of TLS does it support(TLS1.0, TLS1,1 or TLS 1.2 ) 3. How can I tell if an Stunnel instance is using SSL or TLS 4. Does anyone have instructions to configure Stunnel 4.1 to use TLS 5. Can you share an example of stunnel.conf with TLS turned on Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:[email protected]> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

1 0