stunnel-users

4 participants
3309 discussions

CPU 100%
by Murrey, Brian J. 17 Oct '18

17 Oct '18

We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure ________________________________ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 2

stunnel 5.49 on Win32 (invalid configuration file)
by Hardik Mehta 10 Oct '18

10 Oct '18

Hi, can you please help, I was able to send a mail using blat, stunnel and gmail and then i tried adding Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name: Stunnel Type: REG_SZ Value: "c:\Program Files (x86)\stunnel\bin\stunnel.exe" to run on windows startup, but as soon as i restarted the system gave me following message stunnel 5.49 on Win32 (invalid configuration file) Stunnel server is down due to an error. you need to exit and correct the problem. click of to see the error lg window this is the log that i'm getting on stunnel [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [SMTP Gmail] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [SMTP Gmail] needs authentication to prevent MITM attacks [ ] Initializing service [POP3 Gmail] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [POP3 Gmail] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [SMTP Gmail] [ ] Listening file descriptor created (FD=1800) [ ] Setting accept socket options (FD=1800) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [SMTP Gmail] (FD=1800) bound to ::1:1099 [ ] Listening file descriptor created (FD=1516) [ ] Setting accept socket options (FD=1516) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [SMTP Gmail] to 127.0.0.1:1099: Address already in use (WSAEADDRINUSE) (10048) [ ] Binding service [POP3 Gmail] [ ] Listening file descriptor created (FD=1516) [ ] Setting accept socket options (FD=1516) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [POP3 Gmail] to 127.0.0.1:1109: Address already in use (WSAEADDRINUSE) (10048) [!] Binding service [POP3 Gmail] failed [ ] Deallocating section defaults [ ] Unbinding service [SMTP Gmail] [ ] Service [SMTP Gmail] closed (FD=1800) [ ] Service [SMTP Gmail] closed [ ] Deallocating section [SMTP Gmail] [ ] Unbinding service [POP3 Gmail] [ ] Service [POP3 Gmail] closed [ ] Deallocating section [POP3 Gmail] [!] Server is down I also tried changing 1099 to some other random ports but nothing works tried stopping gui, service & service uninstall, then service reinstall, service start & open gui, but the same log appears an early help will be highly appreciated. -- Regards Quick Support <https://get.teamviewer.com/66sdg3u>, Buy Tally Online <http://experts.tallysolutions.com/tallyweb/modules/sd/docmgmt/COnlineOrderE…> , Buy Addons Online <http://www.tallysolutions.com/tallyweb/modules/sd/docmgmt/CMktPlaceHomepage…> , Tally Solutions Website <http://www.tallysolutions.com>, Hardik Printers Youtube Channel <https://www.youtube.com/user/hardikcomp>, Twitter Handle <https://twitter.com/hardikcomp>, Quora Answers <https://www.quora.com/profile/Hardik-N-Mehta-Vadalia> Legal Disclaimer The information contained in this electronic communication is intended solely for the individual(s) or entity to which it is addressed. It may contain proprietary, confidential and/or legally privileged information. Any review, retransmission, dissemination, printing, copying or other use of, or taking any action in reliance on the contents of this information by person(s) or entities other than the intended recipient is strictly prohibited and may be unlawful. If you are not the addressee, or person responsible for delivering it to the addressee, you should not copy or deliver this to anyone else. If you receive this message by mistake, please notify us by responding to this email or telephone and immediately and permanently delete all copies of this message and any attachments from your system(s). We appreciate your assistance in preserving the confidentiality of our correspondence. Any information in this message that does not relate to the official business of the organization shall be understood as neither given nor endorsed by it. The contents of this message do not necessarily represent the views or policies of the Hardik Printers. Computer viruses can be transmitted via email. Hardik Printers attempts to sweep e-mails and attachments for viruses, it does not guarantee that either are virus free. The recipient should check this email and any attachments for the presence of viruses. Hardik Printers shall neither be liable for security of any information transmitted electronically nor be liable or responsible for the proper, timely and complete transmission thereof.

2 1

Re: [stunnel-users] build static stunnel with openssl
by Peter Pentchev 08 Oct '18

08 Oct '18

On Mon, Oct 08, 2018 at 03:09:07PM +0800, White Little wrote: > Thanks, Eric > > But I did not put it on /usr/local/opensl or /usr/local/stunnel > > > Below is my configuration log > > > [root@Stunnel-Fedora stunnel-5.49]# ./configure --enable-static > --with-ssl=/root/stunnel/openssl-1.1.0i [snip] > configure: **************************************** TLS [snip] > checking for TLS directory... /root/stunnel/openssl-1.1.0i [snip] > > I tested on ubuntu14.04, 16.04 64bit and fedora 32bit, all of them are > them are not include opennssl. What exactly makes you think that this does not include OpenSSL support? The configure script seemed to find the include/openssl/ directory in the directory that you specified; does the build fail somehow later? If it does, show us the logs from the failed build. Or does the compiled executable does not say "Compiled with OpenSSL 1.1.0i"? If it does not, show us the full build log (maybe use a pastebin-like service somewhere, e.g. paste.debian.net).. BTW a question: is /root/stunnel/openssl-1.1.0i the place you extracted and compiled OpenSSL, or the place you installed it after building it? If you just built it there, you also need to install it somewhere and point the stunnel configure script at the directory where it is installed, not at the build tree. This might mean that you may need to rebuild it again after specifying a --prefix or something like that (I do not remember exactly how the OpenSSL build works). G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Re: [stunnel-users] build static stunnel with openssl
by Eric Eberhard 06 Oct '18

06 Oct '18

Make openssl and stunnel static. That is what I do and I consider it MUCH smarter than dynamic. I got tired of getting support calls because stunnel stopped working because the user installed a new openssl. Static will always work. Another piece of advice – do NOT put it on /usr/local/opensl or /usr/local/stunnel (or whatever the defaults are). Before building make your OWN directories. Our short name for our product is “met” so we use /usr/local/met/obj and /usr/local/met/bin for the object and binary files, respectively. This ensures nobody will install over you. This is also a real security issue mostly ignored. Most people have heard of SQL injection (where SQL is modified to do what the developer never intended). However, DLL injection (e.g. dynamic library injection) is a real problem. I could easily install an openssl DLL that does exactly what it should do … and sends the same data in clear text (or with my own encryption) to my machine. A thief could simply install one dynamic library and then OWN your data. E From: stunnel-users [mailto:[email protected]] On Behalf Of White Little Sent: Sunday, September 30, 2018 11:33 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] build static stunnel with openssl Hi All I try to build a static (portable) stunnel that contain opensll. I know there are some similar questions long ago, but I still fail on how to build it. I try to link the stunnel to latest openssl, so I download the openssl-1.0.2p and make it. And then I type ./configure --enable-static --with-ssl= openssl-1.0.2p_dir And typing make, I found there is a stunnel binary under /src folder, but it still not include the openssl. Do I miss something that I did not notice? Thanks

1 0

server mode support for both ECC and RSA server certificates
by Tom Hood 02 Oct '18

02 Oct '18

Hi, Can one stunnel service in server mode be configured with both ECDSA and RSA server certs? The stunnel man page Certificates section suggests only one can be specified along with its CA chain. Use case is some legacy clients don't support ECDSA, but it would be nice to support ECDSA when a client does support it. It appears that HAProxy supports this <https://www.haproxy.com/blog/serving-ecc-and-rsa-certificates-on-same-ip-wi…>,but I'm hoping there is an equivalent way to do this with stunnel. I'm currently testing with stunnel 5.49 with OpenSSL 1.0.2p on Solaris 11.3, but can rebuild with any version of openssl if that helps. Thanks, -- Tom

1 0

build static stunnel with openssl
by White Little 01 Oct '18

01 Oct '18

Hi All I try to build a static (portable) stunnel that contain opensll. I know there are some similar questions long ago, but I still fail on how to build it. I try to link the stunnel to latest openssl, so I download the openssl-1.0.2p and make it. And then I type *./configure --enable-static --with-ssl= openssl-1.0.2p_dir* And typing make, I found there is a stunnel binary under /src folder, but it still not include the openssl. Do I miss something that I did not notice? Thanks

1 0

Re: [stunnel-users] stunnel log rolling
by Eric Eberhard 17 Sep '18

17 Sep '18

Most O/S will either prevent renaming a file that is in use (or deleting it). Some will – but they will actually continue to write to the old file (and if that file was deleted then it writes to a file you can nexer see). Since I generally use AIX it is the second feature I see. We have systems with over 500 connections via stunnel – it never rests, and rolling the log file is not easy. I can easily provide a code fix for stunnel that we use in out software. It allows daily logs, sized logs, etc. And it rolls properly. The downside is we open the log, write to it, and close it – each time – which is not efficient. Given modern computers I have come to not care. So the open routine either opens (append) a daily file or it looks up the file and gets the size and decides to move it (or not). The second is not perfect … if three other processes have it open at the moment they will finish writing to that log. Who cares? As long as the logging is always opening and closing the “bleed over” is minimized. If people want me to do this, I will – if they can tell me the log routines it would speed me some, preventing from having to search for them. We like and prefer the daily logs – it is clean as you get one per day. As long as one day is never too huge it is great and we have daemons that remove logs over xx number of days (although I could add a simple parameter for that as well and simply kill those files). This is an annoying problem – especially for multi-O/S software – but one I am good at. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Daniel Trickett Sent: Wednesday, September 12, 2018 11:16 AM To: Tom Hood <tom.w.hood(a)gmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel log rolling Hi Tom, Is what you refer to? I think the open and re-open only happen when the service is stopped and restarted. It hasn’t rolled over like Apache in my short experience. log = append | overwrite log file handling This option allows you to choose whether the log file (specified with the output option) is appended or overwritten when opened or re-opened. default: append Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence – MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email <mailto:[email protected]> daniel.trickett(a)emdmillipore.com From: Tom Hood <tom.w.hood(a)gmail.com <mailto:[email protected]> > Sent: Wednesday, September 12, 2018 1:10 PM To: Daniel Trickett <daniel.trickett(a)emdmillipore.com <mailto:[email protected]> > Cc: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: Re: [stunnel-users] stunnel log rolling Hi Daniel, The trick is how to roll the logs without an interruption of service (i.e. without a stunnel restart). I believe stunnel claims to support this, but I think the feature might be broken in 5.49 Thanks, -- Tom On Wed, Sep 12, 2018 at 5:43 AM Daniel Trickett <daniel.trickett(a)emdmillipore.com <mailto:[email protected]> > wrote: Tom, Kill the stunnel process. Then mv the log. This will allow stunnel to right to a new log file. Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence – MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email <mailto:[email protected]> daniel.trickett(a)emdmillipore.com From: stunnel-users <stunnel-users-bounces(a)stunnel.org <mailto:[email protected]> > On Behalf Of Tom Hood Sent: Tuesday, September 11, 2018 5:02 PM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] stunnel log rolling Hi, I'm new to stunnel and it isn't clear to me how the log rolling feature works. I built stunnel 5.49 with gcc 4.2.0 on Solaris 10. I'm running it on Solaris 11.3 SPARC. Using openssl 1.0.2p The config file has disabled syslog and is logging to stunnel.log. Command line is: stunnel stunnel.conf where stunnel.conf contains the following: syslog = no output = stunnel.log debug = 7 [service-exterior] client = no options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = -NO_TLSv1.2 cert = /path/to/stunnel.pem curve = zzz accept = testhost:32100 connect = 127.0.0.1:32200 <http://127.0.0.1:32200> [service-interior] client = yes options = NO_SSLv2 options = NO_SSLv3 accept = 127.0.0.1:32200 <http://127.0.0.1:32200> connect = 127.0.0.1:32100 <http://127.0.0.1:32100> sslVersion = TLSv1 ciphers = zzz TIMEOUTconnect = 60 The log rollowing steps I tried that don't work are: mv stunnel.log stunnel.log.1 kill -USR1 <stunnelpid> The log message "LOG7[main]: Processing SIGNAL_REOPEN_LOG" shows up in stunnel.log.1. However, new client connections to host:32100 do not trigger creation of a new stunnel.log file. In fact, logging stops to stunnel.log.1 as soon as the USR1 is processed. The new client connections work as before, but there isn't any logging. I restarted stunnel and tried the test again with these steps: mv stunnel.log stunnel.log.1 touch stunnel.log kill -USR1 <stunnelpid> That also doesn't work. Please let me know the correct sequence of steps to roll the stunnel.log Thank you, -- Tom This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer. This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

2 1

stunnel log rolling
by Tom Hood 12 Sep '18

12 Sep '18

Hi, I'm new to stunnel and it isn't clear to me how the log rolling feature works. I built stunnel 5.49 with gcc 4.2.0 on Solaris 10. I'm running it on Solaris 11.3 SPARC. Using openssl 1.0.2p The config file has disabled syslog and is logging to stunnel.log. Command line is: stunnel stunnel.conf where stunnel.conf contains the following: syslog = no output = stunnel.log debug = 7 [service-exterior] client = no options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = -NO_TLSv1.2 cert = /path/to/stunnel.pem curve = zzz accept = testhost:32100 connect = 127.0.0.1:32200 [service-interior] client = yes options = NO_SSLv2 options = NO_SSLv3 accept = 127.0.0.1:32200 connect = 127.0.0.1:32100 sslVersion = TLSv1 ciphers = zzz TIMEOUTconnect = 60 The log rollowing steps I tried that don't work are: mv stunnel.log stunnel.log.1 kill -USR1 <stunnelpid> The log message "LOG7[main]: Processing SIGNAL_REOPEN_LOG" shows up in stunnel.log.1. However, new client connections to host:32100 do not trigger creation of a new stunnel.log file. In fact, logging stops to stunnel.log.1 as soon as the USR1 is processed. The new client connections work as before, but there isn't any logging. I restarted stunnel and tried the test again with these steps: mv stunnel.log stunnel.log.1 touch stunnel.log kill -USR1 <stunnelpid> That also doesn't work. Please let me know the correct sequence of steps to roll the stunnel.log Thank you, -- Tom

2 4

stunnel 5.49 released
by Michal Trojnara 03 Sep '18

03 Sep '18

Dear Users, I have released version 5.49 of stunnel. Version 5.49, 2018.09.03, urgency: MEDIUM * New features - Performance optimizations. - Logging of negotiated or resumed TLS session IDs (thx to ANSSI - National Cybersecurity Agency of France). - Merged Debian 10-enabled.patch and 11-killproc.patch (thx to Peter Pentchev). - OpenSSL DLLs updated to version 1.0.2p. - PKCS#11 engine DLL updated to version 0.4.9. * Bugfixes - Fixed a crash in the session persistence implementation. - Fixed syslog identifier after configuration file reload. - Fixed non-interactive "make check" invocations. - Fixed reloading syslog configuration. - stunnel.pem created with SHA-256 instead of SHA-1. - SHA-256 "make check" certificates. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 3d6641213a82175c19f23fde1c3d1c841738385289eb7ca1554f4a58b96d955e stunnel-5.49.tar.gz 459bbb212baf0b9821c80e0664c830246ef6e97c7329fb08160e87ff11ae9692 stunnel-5.49-win32-installer.exe 72416c6664106ad815a8da67a525c6593247fc06cbca3b8918ffc87ae92595e8 stunnel-5.49-android.zip Best regards, Mike

1 0

Adding custom HTTP headers to a proxy'ed HTTP request when stunnel is used as an endpoint for a HTTP proxy
by Tony Cheneau 02 Sep '18

02 Sep '18

Good evening folks, Michal was kind enough to review and rewrite/integrate one of my patches for logging session IDs [1] and post the remaining ones on the website [2]! So, I feel I should also contribute to this list a little program I wrote. It is meant to be used with the exec= directive. It is mostly useful when stunnel is used to secure a connexion between a client and a HTTP proxy. A stunnel instance can run locally on the client while a stunnel server runs on the HTTP proxy: HTTP client (proxy'ed) <- > stunnel client <--> stunnel server <-> HTTP proxy Here, the "exec=" program will run on the stunnel server and add some extra headers to each HTTP request. One of this headers is the client's Distinguished Name (from its X.509 certificate). The HTTP proxy (squid for example) can then make some decision based on this HTTP header (authorisation, etc.). It relies heavily on PicoHTTPParser. Regards, Tony Cheneau [1]: to appear in version 5.49, see https://www.stunnel.org/sdf_ChangeLog.html [2]: patches 0002 and 0003 on https://www.stunnel.org/patches.html

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users