- stunnel-users - stunnel.org

Graceful config reload when -fd option was used
by z a 09 May '17

09 May '17

Hi, Since version 4.30, sending a HUP signal to a running stunnel process will cause it to gracefully reload with the given config file. Is there a way to accomplish this when the running stunnel process was started with the "-fd" flag as in the example below? cat foo.conf | stunnel-fd 0 I tried writing to /proc/$pid/fd/0 but that didn't work. I'm hoping someone here has overcome this issue and might be able to whisper a hint in my direction. I am on Centos 7.2. Thanks

1 0

Trouble with stunnel.conf (version 5.41)
by Mark Garciano 02 May '17

02 May '17

Hi Stunnel users, Any ideas why I get a "server down" message"? Below is the conf file: ;--------------------------------------------------------------------------- ; ************************************************************************** ; * Global options * ; ************************************************************************** ; ; Debugging stuff (may useful for troubleshooting) debug = 7 output = stunnel.log ;Disable FIPS mode to allow non-approved protocols and algorithms fips = no ;************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 key = stunnel.pem cert = stunnel.pem client = yes accept = 5001 connect = XXXXXXXXXXX.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 ;--------------------------------------------------------------------------- HERE IS THE LOG WINDOW MESSAGE: [!] Server is down [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing inetd mode configuration [!] Service [(null)]: 'accept' option is only allowed in a [section] Mark Garciano Systems Programmer II USC Libraries Integrated Library Systems 213-740-3568

2 1

Re: [stunnel-users] Help in setting stunnel in client mode to connect webservice in mutual authentication
by Chokkalingam, Jothish 28 Apr '17

28 Apr '17

Hi Can you help in sorting it out below scenario We have a URL whose TLS is 1.0 and now it is being upgraded to 1.2. Since the current application doesn't support V1.0 I am planning to use stunnel in between to fix the gap. Can you help if my below config is correct or not. The communication between client and server is MASSL(mutual authentication SSL) [Billpay46200] client = yes CApath = /apps/bss/CCBTrustStore-->trust store where the remote webservice certificates are stored in cert format accept = 46200-->port configured from client machine to connect using http connect = xxx.in.xxx.com.au:46200-->port where the incoming http request need to be changed from http to https cert = /stunnel/bin/client.pem-->identity certificate used for client key = /stunnel/bin/key.pem-->corresponding key for the above identity certificate. While hitting using the URL http://localhost:46200 it is shown in stunnel log as below 2017.04.28 17:17:51 LOG5[2627:3]: Billpay46200 accepted connection from 127.0.0.1:58382 2017.04.28 17:17:51 LOG5[2627:3]: Billpay46200 connected remote server from 10.116.194.24:58383 2017.04.28 17:17:51 LOG3[2627:3]: SSL_connect: Peer suddenly disconnected 2017.04.28 17:17:51 LOG5[2627:3]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

1 0

Remove session callback
by Florian Gossin 19 Apr '17

19 Apr '17

Hi, I have updated to the latest 5.41 version. I was troubleshooting another problem and I discovered dozens of lines in the log file with "Remove session callback, Deallocating application specific data for session connect address": 2017.04.19 14:49:49 LOG7[17483]: Service [pgbouncer-client] started 2017.04.19 14:49:49 LOG7[17483]: Option TCP_NODELAY set on local socket 2017.04.19 14:49:49 LOG5[17483]: Service [pgbouncer-client] accepted connection from x.x.x.x:36018 2017.04.19 14:49:49 LOG6[17483]: Peer certificate required 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): before/accept initialization 2017.04.19 14:49:49 LOG7[17483]: SNI: no virtual services defined 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 read client hello A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write server hello A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write change cipher spec A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write finished A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 flush data 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 read finished A 2017.04.19 14:49:49 LOG7[17483]: Remove session callback 2017.04.19 14:49:49 LOG7[17483]: Deallocating application specific data for session connect address 2017.04.19 14:49:49 LOG7[17483]: Remove session callback 2017.04.19 14:49:49 LOG7[17483]: Deallocating application specific data for session connect address ... Can anyone explain me what it is about ? Thank you, Florian

1 0

Windows Server 2012 stunnel service
by Adam Shackleton 18 Apr '17

18 Apr '17

Hi All I'm running stunnel on Windows Server 2012 R2 with the following config: [test-qa] client = yes accept = 127.0.0.1:8080 connect = webaddress.com:443 cert = API-q-response.pfx CAfile = ca-certs.pem OCSPaia = yes When I start the GUI I'm prompted for the certificate password then and then stunnel works fine, but I need it to run as a service. I've tried using the start menu stunnel Service Install button, I've also tried opening a command prompt in C:\Program Files (x86)\stunnel\config and running C:\Program Files (x86)\stunnel\bin\stunnel.exe -install, and I've also tried moving the config file and certs to the \bin directory and running stunnel -install there as well. In all case the service installs ok, and when you run it, it starts (I can see it in the services tool), you can click the stunnel Configuration File Reload button in the start menu and it says the configuration was successfully reloaded, but it doesn't work when I try to use it. I've noticed two things that might be relevant: 1. At no point does it prompt me for the certificate password like it does when I load the GUI 2. The dialog boxes that open when the service is installed or started say "stunnel 5.40 on Win32 (not configured) [cid:[email protected]] If anyone has any advice that would be greatly appreciated. Thanks Adam

2 1

SOCKS connection to the IPv4 loopback rejected.
by Robert de Bath 15 Apr '17

15 Apr '17

Hi everyone, How do I get rid of this message? I have a stunnel server setup on a remote machine using the socks protocol. I use two keys plus the certificates and a private CA to protect the SSL link. On a local machine I have an stunnel client running without a protocol option set. If I try to make a socks connection to an interface IP of the remote server it works perfectly, bypassing the intervening firewalls through the protected tunnel. But the interface IP changes and I only want to allow connections to the remote server through the tunnel. I could setup traditional tunnels, but while one of the services (remote desktop to the Windows server) is constant the others are dynamically configurable. I have even considered using SNI to distinguish the incoming connections to the various services but while this allows there to be just one tunnel port it will still need a remote reconfiguration of stunnel every time a service port is added or removed. The best way to express this limit is that the socks server should ONLY connect to localhost; but it's "rejected". In actual operation I will probably need to allow the local network too which will probably be an rfc1597 address. Looking at the source it appears that this condition is hard coded into the "validate" function so my question becomes: can you please remove this or add a flag to turn it off? -- Robert de Bath robert(a)tvisiontech.co.uk

1 0

Configure Error
by Kenway Ng 12 Apr '17

12 Apr '17

Hi I am running into an issue when I go into the src directory and I run the configure command, I get configure: error: Could not find your TLS library installation dir Use --with-ssl option to fix this problem I am trying to upgrade our version of stunnel. Our SME left and now I am trying to upgrade stunnel to fix a vulnerability . I am being told to use TLS1.1 or higher Here is our current version of stunnel $ ./stunnel -version stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Any help would be appreciated. Kenway

1 0

PSK, verifying the client
by Mike 05 Apr '17

05 Apr '17

Is it possible to verify the client using PSK? On the stunnel server I specify a PSKsecrets file with two lines in it, one for client01 and one for client02. The secret is about 36 characters long. On a client, I have a similar PSKsecrets file, but only containing the client01 line. Now, if I try to connect with, say, a client03, i.e., any client that does not have a matching line in the server's PSKsecrets file, how can I assure that the client connection will be rejected? What I'd like to see would be the following: any client that tries to connect, and does not present a PSK that is present in the server's PSKsecrets file, then that client's connection request is rejected, with an appropriate message logged. Can I do that with the current stunnel? thx.

1 0

Scan to email failure: RapbianPi3 to Office365
by Graeme Ellisson 03 Apr '17

03 Apr '17

Hi. I recently bought a Pi3 and have loaded Raspbian with Doobs (Previously I had this running faultlessly under a Windows Server for my Canon multi function printer that does not support SSL/TLS but only authentication). After about 8 attempts to get Stunnel4 working (there doesn't seem to be a later version to install via the command line) I eventually found that Stunnel4 works fine as long as one doesn't update Dabian from the initial Doobs install. So, I now have the service running and listening on port 25 with the following config file: debug=7 output=/etc/stunnel/stunnel.log client=yes options=NO_SSLv2 (I added this last night after reading a blog) [SMTP OUT] sslVersion=TLSv1 (I added this last night after reading a blog) protocol=smtp accept=25 connect=smtp.office365.com:587 On restarting the service I see the following which looks okay to my untrained eye: 2017.04.03 09:42:09 LOG7[3570]: Dispatching signals from the signal pipe 2017.04.03 09:42:09 LOG7[3570]: Processing SIGNAL_TERMINATE 2017.04.03 09:42:09 LOG5[3570]: Terminated 2017.04.03 09:42:09 LOG7[3570]: Closing service [SMTP OUT] 2017.04.03 09:42:09 LOG7[3570]: Service [SMTP OUT] closed (FD=7) 2017.04.03 09:42:09 LOG7[3570]: Service [SMTP OUT] closed 2017.04.03 09:42:09 LOG7[3570]: removing pid file /var/run/stunnel4.pid 2017.04.03 09:42:09 LOG7[3926]: Clients allowed=500 2017.04.03 09:42:09 LOG5[3926]: stunnel 5.06 on arm-unknown-linux-gnueabihf platform 2017.04.03 09:42:09 LOG5[3926]: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2017.04.03 09:42:09 LOG5[3926]: Running with OpenSSL 1.0.1t 3 May 2016 2017.04.03 09:42:09 LOG5[3926]: Update OpenSSL shared libraries or rebuild stunnel 2017.04.03 09:42:09 LOG5[3926]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD SSL:ENGINE,OCSP,FIPS Auth:LIB$ 2017.04.03 09:42:09 LOG7[3926]: errno: (*__errno_location ()) 2017.04.03 09:42:09 LOG5[3926]: Reading configuration from file /etc/stunnel/stunnel4.conf 2017.04.03 09:42:09 LOG5[3926]: FIPS mode disabled 2017.04.03 09:42:09 LOG7[3926]: Compression disabled 2017.04.03 09:42:09 LOG7[3926]: Snagged 64 random bytes from /dev/urandom 2017.04.03 09:42:09 LOG7[3926]: PRNG seeded successfully 2017.04.03 09:42:09 LOG6[3926]: Initializing service [SMTP OUT] 2017.04.03 09:42:09 LOG7[3926]: No private key specified 2017.04.03 09:42:09 LOG7[3926]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2017.04.03 09:42:09 LOG5[3926]: Configuration successful 2017.04.03 09:42:09 LOG7[3926]: Listening file descriptor created (FD=7) 2017.04.03 09:42:09 LOG7[3926]: Service [SMTP OUT] (FD=7) bound to 0.0.0.0:25 2017.04.03 09:42:09 LOG7[3927]: Created pid file /var/run/stunnel4.pid When sending a scan from the printer to an email address I see the following in the log file: 2017.04.03 10:00:05 LOG7[3927]: Service [SMTP OUT] accepted (FD=3) from 192.168.8.99:1085 2017.04.03 10:00:05 LOG7[3960]: Service [SMTP OUT] started 2017.04.03 10:00:05 LOG5[3960]: Service [SMTP OUT] accepted connection from 192.168.8.99:1085 2017.04.03 10:00:05 LOG6[3960]: s_connect: connecting 40.101.73.162:587 2017.04.03 10:00:05 LOG7[3960]: s_connect: s_poll_wait 40.101.73.162:587: waiting 10 seconds 2017.04.03 10:00:05 LOG5[3960]: s_connect: connected 40.101.73.162:587 2017.04.03 10:00:05 LOG5[3960]: Service [SMTP OUT] connected remote server from 192.168.8.33:59792 2017.04.03 10:00:05 LOG7[3960]: Remote socket (FD=9) initialized 2017.04.03 10:00:05 LOG7[3960]: <- 220 DB6PR07CA0179.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:05 LOG7[3960]: -> 220 DB6PR07CA0179.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:05 LOG7[3960]: -> EHLO localhost 2017.04.03 10:00:05 LOG7[3960]: <- 250-DB6PR07CA0179.outlook.office365.com Hello [46.208.253.189] 2017.04.03 10:00:05 LOG7[3960]: <- 250-SIZE 157286400 2017.04.03 10:00:05 LOG7[3960]: <- 250-PIPELINING 2017.04.03 10:00:05 LOG7[3960]: <- 250-DSN 2017.04.03 10:00:05 LOG7[3960]: <- 250-ENHANCEDSTATUSCODES 2017.04.03 10:00:05 LOG7[3960]: <- 250-STARTTLS 2017.04.03 10:00:05 LOG7[3960]: <- 250-8BITMIME 2017.04.03 10:00:05 LOG7[3960]: <- 250-BINARYMIME 2017.04.03 10:00:05 LOG7[3960]: <- 250-CHUNKING 2017.04.03 10:00:05 LOG7[3960]: <- 250 SMTPUTF8 2017.04.03 10:00:05 LOG7[3960]: -> STARTTLS 2017.04.03 10:00:05 LOG7[3960]: <- 220 2.0.0 SMTP server ready 2017.04.03 10:00:05 LOG6[3960]: SNI: sending servername: outlook.office365.com 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): before/connect initialization 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: 0 items in the session cache 2017.04.03 10:00:05 LOG7[3960]: 2 client connects (SSL_connect()) 2017.04.03 10:00:05 LOG7[3960]: 2 client connects that finished 2017.04.03 10:00:05 LOG7[3960]: 0 client renegotiations requested 2017.04.03 10:00:05 LOG7[3960]: 0 server connects (SSL_accept()) 2017.04.03 10:00:05 LOG7[3960]: 0 server connects that finished 2017.04.03 10:00:05 LOG7[3960]: 0 server renegotiations requested 2017.04.03 10:00:05 LOG7[3960]: 0 session cache hits 2017.04.03 10:00:05 LOG7[3960]: 0 external session cache hits 2017.04.03 10:00:05 LOG7[3960]: 0 session cache misses 2017.04.03 10:00:05 LOG7[3960]: 0 session cache timeouts 2017.04.03 10:00:05 LOG6[3960]: SSL connected: new session negotiated 2017.04.03 10:00:05 LOG6[3960]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES128-SHA (128-bit encryption) 2017.04.03 10:00:05 LOG6[3960]: Compression: null, expansion: null 2017.04.03 10:00:10 LOG6[3960]: SSL socket closed (SSL_read) 2017.04.03 10:00:10 LOG7[3960]: Sent socket write shutdown 2017.04.03 10:00:10 LOG5[3960]: Connection closed: 23 byte(s) sent to SSL, 79 byte(s) sent to socket 2017.04.03 10:00:10 LOG7[3960]: Remote socket (FD=9) closed 2017.04.03 10:00:10 LOG7[3960]: Local socket (FD=3) closed 2017.04.03 10:00:10 LOG7[3960]: Service [SMTP OUT] finished (0 left) 2017.04.03 10:00:20 LOG7[3927]: Service [SMTP OUT] accepted (FD=3) from 192.168.8.99:1086 2017.04.03 10:00:20 LOG7[3961]: Service [SMTP OUT] started 2017.04.03 10:00:20 LOG5[3961]: Service [SMTP OUT] accepted connection from 192.168.8.99:1086 2017.04.03 10:00:20 LOG6[3961]: s_connect: connecting 40.101.72.194:587 2017.04.03 10:00:20 LOG7[3961]: s_connect: s_poll_wait 40.101.72.194:587: waiting 10 seconds 2017.04.03 10:00:20 LOG5[3961]: s_connect: connected 40.101.72.194:587 2017.04.03 10:00:20 LOG5[3961]: Service [SMTP OUT] connected remote serve from 192.168.8.33:57422 2017.04.03 10:00:20 LOG7[3961]: Remote socket (FD=9) initialized 2017.04.03 10:00:21 LOG7[3961]: <- 220 DB6PR07CA0014.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:21 LOG7[3961]: -> 220 DB6PR07CA0014.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:21 LOG7[3961]: -> EHLO localhost 2017.04.03 10:00:21 LOG7[3961]: <- 250-DB6PR07CA0014.outlook.office365.com Hello [46.208.253.189] 2017.04.03 10:00:21 LOG7[3961]: <- 250-SIZE 157286400 2017.04.03 10:00:21 LOG7[3961]: <- 250-PIPELINING 2017.04.03 10:00:21 LOG7[3961]: <- 250-DSN 2017.04.03 10:00:21 LOG7[3961]: <- 250-ENHANCEDSTATUSCODES 2017.04.03 10:00:21 LOG7[3961]: <- 250-STARTTLS 2017.04.03 10:00:21 LOG7[3961]: <- 250-8BITMIME 2017.04.03 10:00:21 LOG7[3961]: <- 250-BINARYMIME 2017.04.03 10:00:21 LOG7[3961]: <- 250-CHUNKING 2017.04.03 10:00:21 LOG7[3961]: <- 250 SMTPUTF8 2017.04.03 10:00:21 LOG7[3961]: -> STARTTLS 2017.04.03 10:00:21 LOG7[3961]: <- 220 2.0.0 SMTP server ready 2017.04.03 10:00:21 LOG6[3961]: SNI: sending servername: outlook.office365.com 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): before/connect initialization 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: 0 items in the session cache 2017.04.03 10:00:21 LOG7[3961]: 3 client connects (SSL_connect()) 2017.04.03 10:00:21 LOG7[3961]: 3 client connects that finished 2017.04.03 10:00:21 LOG7[3961]: 0 client renegotiations requested 2017.04.03 10:00:21 LOG7[3961]: 0 server connects (SSL_accept()) 2017.04.03 10:00:21 LOG7[3961]: 0 server connects that finished 2017.04.03 10:00:21 LOG7[3961]: 0 server renegotiations requested 2017.04.03 10:00:21 LOG7[3961]: 0 session cache hits 2017.04.03 10:00:21 LOG7[3961]: 0 external session cache hits 2017.04.03 10:00:21 LOG7[3961]: 0 session cache misses 2017.04.03 10:00:21 LOG7[3961]: 0 session cache timeouts 2017.04.03 10:00:21 LOG6[3961]: SSL connected: new session negotiated 2017.04.03 10:00:21 LOG6[3961]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES128-SHA (128-bit encryption) 2017.04.03 10:00:21 LOG6[3961]: Compression: null, expansion: null 2017.04.03 10:00:26 LOG6[3961]: SSL socket closed (SSL_read) 2017.04.03 10:00:26 LOG7[3961]: Sent socket write shutdown 2017.04.03 10:00:26 LOG5[3961]: Connection closed: 23 byte(s) sent to SSL, 79 byte(s) sent to socket 2017.04.03 10:00:26 LOG7[3961]: Remote socket (FD=9) closed 2017.04.03 10:00:26 LOG7[3961]: Local socket (FD=3) closed 2017.04.03 10:00:26 LOG7[3961]: Service [SMTP OUT] finished (0 left) At the end of this, no email is received. I can't tell from the above if the document is not being received by Stunnel from the printer or if Stunnel can not pass the document to Office365. It looks like TLSv1 is being negotiated and some data is being sent but then it closes the connection. Any help would be much appreciated. Regards, Graeme

2 1

Stunnel Version Vulnerability-Currently using 5.04
by Tracy Drake - IQGC-C 28 Mar '17

28 Mar '17

Hello Stunnel Users Forum! I wonder if anyone may have suggestions of what, if anything can be done to surmount a reported vulnerability for Stunnel versions prior to 5.34. I have limited savvy in this arena so please excuse this "Stunnel for Dummies" question. The following statements surfaced in a "security vulnerabilities" report... The version of stunnel installed on the remote host is 4.46 or later but prior to 5.34. It is, therefore, affected by a security bypass vulnerability related to the validation of level 4 peer certificates. An unauthenticated, remote attacker can exploit this to have an impact on confidentiality, integrity, and/or availability. No other details are available. I am of the mind that perhaps an entry in Stunnel.conf until we can deploy an upgrade? Thanks in advance for any feedback! Upgrade to stunnel version 5.34 or later. -- Tracy Drake CSM Senior Consultant GSA-FAS CAMEO Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

1 0

Multi source VPN connectivity
by Aykut SAY 24 Mar '17

24 Mar '17

Hi, We are working on a integration project and we need to connect our application to three different sources. These three sources have their own VPN. Can stunnel connect to three different vpn from one server? If yes, which version of stunnel we need to install to our server? Thanks, Aykut

1 0

stunnel public private key authentication like ssh
by Michael Power 23 Mar '17

23 Mar '17

Is there a way to configure stunnel just to check the public key of the provided certificate? I want authentication between the server and the client to take place by public key only, no PKI just like ssh. Is this possible? Is this verify level 4, or does that still check the CN against the host that I am connecting to? Michael Power

1 0

update stunnel with engine pkcs11
by Heinsbroek, Peter 20 Mar '17

20 Mar '17

Hallo, I’m a newbee in C programming. I have to upgrade stunnel 5.31 with engine_pkcs11 (0.1.8) for windows to the latest versions. (5.40 & 0.2.2) My engine_pkcs.c contains an subroutine my_get_pin (see attachment line 707) that reads a pin from a file in the windows folder. After reading it ,it transforms the pin to hexadecimal, if not already done, and writes it back in the file. After adjusting the new source it compiles without errors, but when executing it doesn’t work anymore. I also attached the old engine_pkcs11.c as we used it. Can someone help me with this problem. After compairing the old and new source I noticed that there have been major improvements to the source With regards, Peter Heinsbroek Application manager NT / SQL20xx Tel. +31 (0)88 265 9869 Mob. +31 6 5375 3244 Werner von Siemensstraat 3 2712 PN Zoetermeer, Nederland Org. unit PS Central Fin Services Unit 02 SI NL Email peter.heinsbroek(a)atos.net<mailto:[email protected]> Web www.nl.atos.net<UrlBlockedError.aspx> Atos IT Solutions and Services B.V. Comm. Register The Hague no. 27380688 This e-mail is intended exclusively for the addressee(s), and may not be forwarded or made available for use to any person other than the addressee(s). If you are not the intended recipient, please notify the sender thereof and destroy/delete the message. The sender disclaims any liability as regards (the content of) this e-mail. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Fwd: Stunnel Performance strangeness
by Scott McKeown 10 Mar '17

10 Mar '17

Hi All, We have been doing some throughput testing and are wondering of you can help explain some of the results we have been getting. We are trying to establish the maximum number of handshakes per second our appliances can do when using Stunnel. Our tests have been done on a 4 core Intel(R) Xeon(R) CPU E3-1230 v5 @ 3.40GHz machine with 8Gb ram. Using stunnel 5.33 openssl 1.0.2j (We use stunnel 5.33 here, but this was also tested with stunnel 5.40 and we got the same issue) Stunnel was compiled with - ./configure --enable-fips --enable-ipv6 --with-threads=pthread --sysconfdir=/etc --with-ssl=/usr/src/built/OpenSSL_1_0_2j-no_march/usr/local/ --disable-libwrap --disable-systemd I was using a python script of my own design for load testing when I noticed the problem we then switched to an open source package called vegeta https://github.com/tsenart/vegeta the command I was using to run it was - echo "GET https://10.10.10.10:443" | ./vegeta attack -workers=30 -rate=3000 -duration=300s -insecure > test.out We are essentially seeing a degradation in throughput at a fixed point in time. I am seeing the problem when using 3000 transactions per second. We are doing https gets through stunnel to a http backend, 1 transaction is an ssl handshake the http get and waiting for the response. Interestingly if I try 5.06 it works fine I get a smooth constant loading. Please take a look at 30worker3000rate5.33-300s.png where you can see after about 55 seconds there is a jump in latency. I get the same issue if I run the test with 2000 transactions. Please see 30worker20005.33-700s.png but with the lower transaction rate the issue takes longer to rear its head. The issue doesnt happen if I run the test with 3000 transaction using 5.06. Please see 30worker3000rate5.06-300s.png >From looking at the graphs our thoughts were that we were hitting some sort of cache limit and used that as a starting point. We have taken a look at the code changes between versions we know were working and the problematic version and the main thing that stands out is the changes to the leak detection. Previously this was partially based on the number of clients but has been changed to use the sections. This led to the decision to try a different limit value and found the number of connections we saw before seeing an issue corresponds to the change of the limit value. We think we have identified the code that is causing the problem/doing something funny it was added in 5.33 NOEXPORT long leak_threshold() { long limit; limit=10000*((int)number_of_sections+1); #ifndef USE_FORK limit+=100*num_clients; #endif return limit; } its src/str.c when increasing the limit number so limit=10000*((int)number_of_sections+1) to limit=20000*((int)number_of_sections+1) This still results in an increase in response time but at a later time in the test, please see 30worker3000rate5.33-ben-highlimit.png Interestingly once I end up in this state I am stuck with high latencies until I restart stunnel. (The box I am testing on was left over night to make sure its not any hanging tcp connections or anything like that) I must admit we are at the limit of our C understanding and your imput would be welcomed. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 <0330%20380%201064> (24x7) Tel (US) - +1 888.867.9504 <+1%20888-867-9504> (Toll Free)(24x7)

1 0

Segfault after connecting
by Andrew Culver 23 Feb '17

23 Feb '17

I had my stunnel instance working as expected last week. Since then I've moved the server behind a load balancer, which is doing regular health checks (opens a tcp connection, then disconnects) to see that stunnel is up. I don't believe the health checks are a problem, but they're the only change I've made since I had stunnel working. I can see the health checks connecting and disconnecting. However when I open a new connection, either by telnet or by: openssl s_client -connect mtar.uwo.ca:587 -starttls smtp ... stunnel says it fails to verify the server certificate, then seg faults. I'm running stunnel 5.40 and I'm having the same problem on 2 different servers running openssl 1.1.0d and 1.1.0e. Here's my config: [root@mtar1 stunnel]# egrep -v '^;|^ *$' stunnel.conf ; Sample stunnel configuration file for Unix by Michal Trojnara 2002-2017 setuid = stunnel setgid = stunnel pid = /usr/local/var/run/stunnel/stunnel.pid foreground = yes debug = debug [uwo2local] accept = 587 cert = /usr/local/etc/stunnel/mtar-withprivatekey.pem connect = 20587 protocol = smtp [local2o365] client = yes accept = 127.0.0.1:20587 connect = smtp.office365.com:587 checkHost = smtp.office365.com verifyChain = yes CApath = /etc/ssl/certs OCSPaia = yes protocol = smtp Here's my debug log: The health checks are from 172.18.58.5 and my test connection which leads to the seg fault is from 129.100.6.17. [root@mtar1 stunnel]# /usr/local/bin/stunnel /usr/local/etc/stunnel/stunnel.conf 2017.02.23 11:28:48 LOG7[ui]: Clients allowed=500 2017.02.23 11:28:48 LOG5[ui]: stunnel 5.40 on x86_64-unknown-linux-gnu platform 2017.02.23 11:28:48 LOG5[ui]: Compiled/running with OpenSSL 1.1.0d 26 Jan 2017 2017.02.23 11:28:48 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.02.23 11:28:48 LOG7[ui]: errno: (*__errno_location ()) 2017.02.23 11:28:48 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2017.02.23 11:28:48 LOG5[ui]: UTF-8 byte order mark detected 2017.02.23 11:28:48 LOG5[ui]: FIPS mode disabled 2017.02.23 11:28:48 LOG7[ui]: Compression disabled 2017.02.23 11:28:48 LOG7[ui]: PRNG seeded successfully 2017.02.23 11:28:48 LOG7[cron]: Cron thread initialized 2017.02.23 11:28:48 LOG6[ui]: Initializing service [uwo2local] 2017.02.23 11:28:48 LOG7[ui]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.02.23 11:28:48 LOG7[ui]: TLS options: 0x02020004 (+0x02000000, -0x00000000) 2017.02.23 11:28:48 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG7[ui]: Private key check succeeded 2017.02.23 11:28:48 LOG7[ui]: DH initialization 2017.02.23 11:28:48 LOG7[ui]: Could not load DH parameters from /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Using dynamic DH parameters 2017.02.23 11:28:48 LOG7[ui]: ECDH initialization 2017.02.23 11:28:48 LOG7[ui]: ECDH initialized with curve prime256v1 2017.02.23 11:28:48 LOG6[ui]: Initializing service [local2o365] 2017.02.23 11:28:48 LOG7[ui]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.02.23 11:28:48 LOG7[ui]: TLS options: 0x02020004 (+0x02000000, -0x00000000) 2017.02.23 11:28:48 LOG7[ui]: No certificate or private key specified 2017.02.23 11:28:48 LOG5[ui]: Configuration successful 2017.02.23 11:28:48 LOG7[ui]: Listening file descriptor created (FD=7) 2017.02.23 11:28:48 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2017.02.23 11:28:48 LOG7[ui]: Service [uwo2local] (FD=7) bound to 0.0.0.0:587 2017.02.23 11:28:48 LOG7[ui]: Listening file descriptor created (FD=8) 2017.02.23 11:28:48 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2017.02.23 11:28:48 LOG7[ui]: Service [local2o365] (FD=8) bound to 127.0.0.1:20587 2017.02.23 11:28:48 LOG6[cron]: Executing cron jobs 2017.02.23 11:28:48 LOG5[cron]: Updating DH parameters 2017.02.23 11:28:48 LOG7[ui]: Created pid file /usr/local/var/run/stunnel/stunnel.pid 2017.02.23 11:28:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:28:51 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:40161 2017.02.23 11:28:51 LOG7[0]: Service [uwo2local] started 2017.02.23 11:28:51 LOG7[0]: Option TCP_NODELAY set on local socket 2017.02.23 11:28:51 LOG5[0]: Service [uwo2local] accepted connection from 172.18.58.5:40161 2017.02.23 11:28:51 LOG6[0]: failover: round-robin, starting at entry #0 2017.02.23 11:28:51 LOG6[0]: s_connect: connecting ::1:20587 2017.02.23 11:28:51 LOG7[0]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:28:51 LOG3[0]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:28:51 LOG6[0]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:28:51 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:28:51 LOG5[0]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:28:51 LOG5[0]: Service [uwo2local] connected remote server from 127.0.0.1:33132 2017.02.23 11:28:51 LOG7[0]: Option TCP_NODELAY set on remote socket 2017.02.23 11:28:51 LOG7[0]: Remote descriptor (FD=9) initialized 2017.02.23 11:28:51 LOG7[0]: RFC 2487 not detected 2017.02.23 11:28:51 LOG6[0]: Peer certificate not required 2017.02.23 11:28:51 LOG7[0]: TLS state (accept): before SSL initialization 2017.02.23 11:28:51 LOG3[0]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:28:51 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:51 LOG7[0]: Remote descriptor (FD=9) closed 2017.02.23 11:28:51 LOG7[0]: Local descriptor (FD=3) closed 2017.02.23 11:28:51 LOG7[0]: Service [uwo2local] finished (0 left) 2017.02.23 11:28:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:28:51 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33132 2017.02.23 11:28:51 LOG7[1]: Service [local2o365] started 2017.02.23 11:28:51 LOG3[1]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:28:51 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:51 LOG7[1]: Local descriptor (FD=3) closed 2017.02.23 11:28:51 LOG7[1]: Service [local2o365] finished (0 left) 2017.02.23 11:28:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:28:56 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:19333 2017.02.23 11:28:56 LOG7[2]: Service [uwo2local] started 2017.02.23 11:28:56 LOG7[2]: Option TCP_NODELAY set on local socket 2017.02.23 11:28:56 LOG5[2]: Service [uwo2local] accepted connection from 172.18.58.5:19333 2017.02.23 11:28:56 LOG6[2]: failover: round-robin, starting at entry #1 2017.02.23 11:28:56 LOG6[2]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:28:56 LOG7[2]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:28:56 LOG5[2]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:28:56 LOG5[2]: Service [uwo2local] connected remote server from 127.0.0.1:33134 2017.02.23 11:28:56 LOG7[2]: Option TCP_NODELAY set on remote socket 2017.02.23 11:28:56 LOG7[2]: Remote descriptor (FD=9) initialized 2017.02.23 11:28:56 LOG7[2]: RFC 2487 not detected 2017.02.23 11:28:56 LOG6[2]: Peer certificate not required 2017.02.23 11:28:56 LOG7[2]: TLS state (accept): before SSL initialization 2017.02.23 11:28:56 LOG3[2]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:28:56 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:56 LOG7[2]: Remote descriptor (FD=9) closed 2017.02.23 11:28:56 LOG7[2]: Local descriptor (FD=3) closed 2017.02.23 11:28:56 LOG7[2]: Service [uwo2local] finished (0 left) 2017.02.23 11:28:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:28:56 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33134 2017.02.23 11:28:56 LOG7[3]: Service [local2o365] started 2017.02.23 11:28:56 LOG3[3]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:28:56 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:56 LOG7[3]: Local descriptor (FD=3) closed 2017.02.23 11:28:56 LOG7[3]: Service [local2o365] finished (0 left) 2017.02.23 11:29:01 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:01 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:01 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:46315 2017.02.23 11:29:01 LOG7[4]: Service [uwo2local] started 2017.02.23 11:29:01 LOG7[4]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:01 LOG5[4]: Service [uwo2local] accepted connection from 172.18.58.5:46315 2017.02.23 11:29:01 LOG6[4]: failover: round-robin, starting at entry #0 2017.02.23 11:29:01 LOG6[4]: s_connect: connecting ::1:20587 2017.02.23 11:29:01 LOG7[4]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:01 LOG3[4]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:01 LOG6[4]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:01 LOG7[4]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:01 LOG5[4]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:01 LOG5[4]: Service [uwo2local] connected remote server from 127.0.0.1:33138 2017.02.23 11:29:01 LOG7[4]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:01 LOG7[4]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:01 LOG7[4]: RFC 2487 not detected 2017.02.23 11:29:01 LOG6[4]: Peer certificate not required 2017.02.23 11:29:01 LOG7[4]: TLS state (accept): before SSL initialization 2017.02.23 11:29:01 LOG3[4]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:01 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:01 LOG7[4]: Remote descriptor (FD=9) closed 2017.02.23 11:29:01 LOG7[4]: Local descriptor (FD=3) closed 2017.02.23 11:29:01 LOG7[4]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:01 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:01 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:01 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33138 2017.02.23 11:29:01 LOG7[5]: Service [local2o365] started 2017.02.23 11:29:01 LOG3[5]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:01 LOG5[5]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:01 LOG7[5]: Local descriptor (FD=3) closed 2017.02.23 11:29:01 LOG7[5]: Service [local2o365] finished (0 left) 2017.02.23 11:29:06 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:06 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:06 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:55003 2017.02.23 11:29:06 LOG7[6]: Service [uwo2local] started 2017.02.23 11:29:06 LOG7[6]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:06 LOG5[6]: Service [uwo2local] accepted connection from 172.18.58.5:55003 2017.02.23 11:29:06 LOG6[6]: failover: round-robin, starting at entry #1 2017.02.23 11:29:06 LOG6[6]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:06 LOG7[6]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:06 LOG5[6]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:06 LOG5[6]: Service [uwo2local] connected remote server from 127.0.0.1:33140 2017.02.23 11:29:06 LOG7[6]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:06 LOG7[6]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:06 LOG7[6]: RFC 2487 not detected 2017.02.23 11:29:06 LOG6[6]: Peer certificate not required 2017.02.23 11:29:06 LOG7[6]: TLS state (accept): before SSL initialization 2017.02.23 11:29:06 LOG3[6]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:06 LOG5[6]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:06 LOG7[6]: Remote descriptor (FD=9) closed 2017.02.23 11:29:06 LOG7[6]: Local descriptor (FD=3) closed 2017.02.23 11:29:06 LOG7[6]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:06 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:06 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:06 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33140 2017.02.23 11:29:06 LOG7[7]: Service [local2o365] started 2017.02.23 11:29:06 LOG3[7]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:06 LOG5[7]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:06 LOG7[7]: Local descriptor (FD=3) closed 2017.02.23 11:29:06 LOG7[7]: Service [local2o365] finished (0 left) 2017.02.23 11:29:11 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:11 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:11 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:52586 2017.02.23 11:29:11 LOG7[8]: Service [uwo2local] started 2017.02.23 11:29:11 LOG7[8]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:11 LOG5[8]: Service [uwo2local] accepted connection from 172.18.58.5:52586 2017.02.23 11:29:11 LOG6[8]: failover: round-robin, starting at entry #0 2017.02.23 11:29:11 LOG6[8]: s_connect: connecting ::1:20587 2017.02.23 11:29:11 LOG7[8]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:11 LOG3[8]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:11 LOG6[8]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:11 LOG7[8]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:11 LOG5[8]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:11 LOG5[8]: Service [uwo2local] connected remote server from 127.0.0.1:33144 2017.02.23 11:29:11 LOG7[8]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:11 LOG7[8]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:11 LOG7[8]: RFC 2487 not detected 2017.02.23 11:29:11 LOG6[8]: Peer certificate not required 2017.02.23 11:29:11 LOG7[8]: TLS state (accept): before SSL initialization 2017.02.23 11:29:11 LOG3[8]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:11 LOG5[8]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:11 LOG7[8]: Remote descriptor (FD=9) closed 2017.02.23 11:29:11 LOG7[8]: Local descriptor (FD=3) closed 2017.02.23 11:29:11 LOG7[8]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:11 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:11 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:11 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33144 2017.02.23 11:29:11 LOG7[9]: Service [local2o365] started 2017.02.23 11:29:11 LOG3[9]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:11 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:11 LOG7[9]: Local descriptor (FD=3) closed 2017.02.23 11:29:11 LOG7[9]: Service [local2o365] finished (0 left) 2017.02.23 11:29:16 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:16 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:16 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:60425 2017.02.23 11:29:16 LOG7[10]: Service [uwo2local] started 2017.02.23 11:29:16 LOG7[10]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:16 LOG5[10]: Service [uwo2local] accepted connection from 172.18.58.5:60425 2017.02.23 11:29:16 LOG6[10]: failover: round-robin, starting at entry #1 2017.02.23 11:29:16 LOG6[10]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:16 LOG7[10]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:16 LOG5[10]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:16 LOG5[10]: Service [uwo2local] connected remote server from 127.0.0.1:33146 2017.02.23 11:29:16 LOG7[10]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:16 LOG7[10]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:16 LOG7[10]: RFC 2487 not detected 2017.02.23 11:29:16 LOG6[10]: Peer certificate not required 2017.02.23 11:29:16 LOG7[10]: TLS state (accept): before SSL initialization 2017.02.23 11:29:16 LOG3[10]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:16 LOG5[10]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:16 LOG7[10]: Remote descriptor (FD=9) closed 2017.02.23 11:29:16 LOG7[10]: Local descriptor (FD=3) closed 2017.02.23 11:29:16 LOG7[10]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:16 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:16 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:16 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33146 2017.02.23 11:29:16 LOG7[11]: Service [local2o365] started 2017.02.23 11:29:16 LOG3[11]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:16 LOG5[11]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:16 LOG7[11]: Local descriptor (FD=3) closed 2017.02.23 11:29:16 LOG7[11]: Service [local2o365] finished (0 left) 2017.02.23 11:29:21 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:21 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:21 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:50381 2017.02.23 11:29:21 LOG7[12]: Service [uwo2local] started 2017.02.23 11:29:21 LOG7[12]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:21 LOG5[12]: Service [uwo2local] accepted connection from 172.18.58.5:50381 2017.02.23 11:29:21 LOG6[12]: failover: round-robin, starting at entry #0 2017.02.23 11:29:21 LOG6[12]: s_connect: connecting ::1:20587 2017.02.23 11:29:21 LOG7[12]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:21 LOG3[12]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:21 LOG6[12]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:21 LOG7[12]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:21 LOG5[12]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:21 LOG5[12]: Service [uwo2local] connected remote server from 127.0.0.1:33150 2017.02.23 11:29:21 LOG7[12]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:21 LOG7[12]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:21 LOG7[12]: RFC 2487 not detected 2017.02.23 11:29:21 LOG6[12]: Peer certificate not required 2017.02.23 11:29:21 LOG7[12]: TLS state (accept): before SSL initialization 2017.02.23 11:29:21 LOG3[12]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:21 LOG5[12]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:21 LOG7[12]: Remote descriptor (FD=9) closed 2017.02.23 11:29:21 LOG7[12]: Local descriptor (FD=3) closed 2017.02.23 11:29:21 LOG7[12]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:21 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:21 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:21 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33150 2017.02.23 11:29:21 LOG7[13]: Service [local2o365] started 2017.02.23 11:29:21 LOG3[13]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:21 LOG5[13]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:21 LOG7[13]: Local descriptor (FD=3) closed 2017.02.23 11:29:21 LOG7[13]: Service [local2o365] finished (0 left) 2017.02.23 11:29:26 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:26 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:26 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:7384 2017.02.23 11:29:26 LOG7[14]: Service [uwo2local] started 2017.02.23 11:29:26 LOG7[14]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:26 LOG5[14]: Service [uwo2local] accepted connection from 172.18.58.5:7384 2017.02.23 11:29:26 LOG6[14]: failover: round-robin, starting at entry #1 2017.02.23 11:29:26 LOG6[14]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:26 LOG7[14]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:26 LOG5[14]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:26 LOG5[14]: Service [uwo2local] connected remote server from 127.0.0.1:33152 2017.02.23 11:29:26 LOG7[14]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:26 LOG7[14]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:26 LOG7[14]: RFC 2487 not detected 2017.02.23 11:29:26 LOG6[14]: Peer certificate not required 2017.02.23 11:29:26 LOG7[14]: TLS state (accept): before SSL initialization 2017.02.23 11:29:26 LOG3[14]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:26 LOG5[14]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:26 LOG7[14]: Remote descriptor (FD=9) closed 2017.02.23 11:29:26 LOG7[14]: Local descriptor (FD=3) closed 2017.02.23 11:29:26 LOG7[14]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:26 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:26 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:26 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33152 2017.02.23 11:29:26 LOG7[15]: Service [local2o365] started 2017.02.23 11:29:26 LOG3[15]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:26 LOG5[15]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:26 LOG7[15]: Local descriptor (FD=3) closed 2017.02.23 11:29:26 LOG7[15]: Service [local2o365] finished (0 left) 2017.02.23 11:29:31 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:31 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:31 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:40920 2017.02.23 11:29:31 LOG7[16]: Service [uwo2local] started 2017.02.23 11:29:31 LOG7[16]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:31 LOG5[16]: Service [uwo2local] accepted connection from 172.18.58.5:40920 2017.02.23 11:29:31 LOG6[16]: failover: round-robin, starting at entry #0 2017.02.23 11:29:31 LOG6[16]: s_connect: connecting ::1:20587 2017.02.23 11:29:31 LOG7[16]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:31 LOG3[16]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:31 LOG6[16]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:31 LOG7[16]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:31 LOG5[16]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:31 LOG5[16]: Service [uwo2local] connected remote server from 127.0.0.1:33156 2017.02.23 11:29:31 LOG7[16]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:31 LOG7[16]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:31 LOG7[16]: RFC 2487 not detected 2017.02.23 11:29:31 LOG6[16]: Peer certificate not required 2017.02.23 11:29:31 LOG7[16]: TLS state (accept): before SSL initialization 2017.02.23 11:29:31 LOG3[16]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:31 LOG5[16]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:31 LOG7[16]: Remote descriptor (FD=9) closed 2017.02.23 11:29:31 LOG7[16]: Local descriptor (FD=3) closed 2017.02.23 11:29:31 LOG7[16]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:31 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:31 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:31 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33156 2017.02.23 11:29:31 LOG7[17]: Service [local2o365] started 2017.02.23 11:29:31 LOG3[17]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:31 LOG5[17]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:31 LOG7[17]: Local descriptor (FD=3) closed 2017.02.23 11:29:31 LOG7[17]: Service [local2o365] finished (0 left) 2017.02.23 11:29:36 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:36 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:36 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:23632 2017.02.23 11:29:36 LOG7[18]: Service [uwo2local] started 2017.02.23 11:29:36 LOG7[18]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:36 LOG5[18]: Service [uwo2local] accepted connection from 172.18.58.5:23632 2017.02.23 11:29:36 LOG6[18]: failover: round-robin, starting at entry #1 2017.02.23 11:29:36 LOG6[18]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:36 LOG7[18]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:36 LOG5[18]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:36 LOG5[18]: Service [uwo2local] connected remote server from 127.0.0.1:33158 2017.02.23 11:29:36 LOG7[18]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:36 LOG7[18]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:36 LOG7[18]: RFC 2487 not detected 2017.02.23 11:29:36 LOG6[18]: Peer certificate not required 2017.02.23 11:29:36 LOG7[18]: TLS state (accept): before SSL initialization 2017.02.23 11:29:36 LOG3[18]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:36 LOG5[18]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:36 LOG7[18]: Remote descriptor (FD=9) closed 2017.02.23 11:29:36 LOG7[18]: Local descriptor (FD=3) closed 2017.02.23 11:29:36 LOG7[18]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:36 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:36 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:36 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33158 2017.02.23 11:29:36 LOG7[19]: Service [local2o365] started 2017.02.23 11:29:36 LOG3[19]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:36 LOG5[19]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:36 LOG7[19]: Local descriptor (FD=3) closed 2017.02.23 11:29:36 LOG7[19]: Service [local2o365] finished (0 left) 2017.02.23 11:29:41 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:41 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:41 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:2134 2017.02.23 11:29:41 LOG7[20]: Service [uwo2local] started 2017.02.23 11:29:41 LOG7[20]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:41 LOG5[20]: Service [uwo2local] accepted connection from 172.18.58.5:2134 2017.02.23 11:29:41 LOG6[20]: failover: round-robin, starting at entry #0 2017.02.23 11:29:41 LOG6[20]: s_connect: connecting ::1:20587 2017.02.23 11:29:41 LOG7[20]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:41 LOG3[20]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:41 LOG6[20]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:41 LOG7[20]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:41 LOG5[20]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:41 LOG5[20]: Service [uwo2local] connected remote server from 127.0.0.1:33162 2017.02.23 11:29:41 LOG7[20]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:41 LOG7[20]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:41 LOG7[20]: RFC 2487 not detected 2017.02.23 11:29:41 LOG6[20]: Peer certificate not required 2017.02.23 11:29:41 LOG7[20]: TLS state (accept): before SSL initialization 2017.02.23 11:29:41 LOG3[20]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:41 LOG5[20]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:41 LOG7[20]: Remote descriptor (FD=9) closed 2017.02.23 11:29:41 LOG7[20]: Local descriptor (FD=3) closed 2017.02.23 11:29:41 LOG7[20]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:41 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:41 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:41 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33162 2017.02.23 11:29:41 LOG7[21]: Service [local2o365] started 2017.02.23 11:29:41 LOG3[21]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:41 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:41 LOG7[21]: Local descriptor (FD=3) closed 2017.02.23 11:29:41 LOG7[21]: Service [local2o365] finished (0 left) 2017.02.23 11:29:46 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:46 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:46 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:4464 2017.02.23 11:29:46 LOG7[22]: Service [uwo2local] started 2017.02.23 11:29:46 LOG7[22]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:46 LOG5[22]: Service [uwo2local] accepted connection from 172.18.58.5:4464 2017.02.23 11:29:46 LOG6[22]: failover: round-robin, starting at entry #1 2017.02.23 11:29:46 LOG6[22]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:46 LOG7[22]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:46 LOG5[22]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:46 LOG5[22]: Service [uwo2local] connected remote server from 127.0.0.1:33164 2017.02.23 11:29:46 LOG7[22]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:46 LOG7[22]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:46 LOG7[22]: RFC 2487 not detected 2017.02.23 11:29:46 LOG6[22]: Peer certificate not required 2017.02.23 11:29:46 LOG7[22]: TLS state (accept): before SSL initialization 2017.02.23 11:29:46 LOG3[22]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:46 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:46 LOG7[22]: Remote descriptor (FD=9) closed 2017.02.23 11:29:46 LOG7[22]: Local descriptor (FD=3) closed 2017.02.23 11:29:46 LOG7[22]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:46 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:46 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:46 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33164 2017.02.23 11:29:46 LOG7[23]: Service [local2o365] started 2017.02.23 11:29:46 LOG3[23]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:46 LOG5[23]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:46 LOG7[23]: Local descriptor (FD=3) closed 2017.02.23 11:29:46 LOG7[23]: Service [local2o365] finished (0 left) 2017.02.23 11:29:51 LOG5[cron]: DH parameters updated 2017.02.23 11:29:51 LOG6[cron]: Cron jobs completed in 63 seconds 2017.02.23 11:29:51 LOG7[cron]: Waiting 86337 seconds 2017.02.23 11:29:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:51 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:28318 2017.02.23 11:29:51 LOG7[24]: Service [uwo2local] started 2017.02.23 11:29:51 LOG7[24]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:51 LOG5[24]: Service [uwo2local] accepted connection from 172.18.58.5:28318 2017.02.23 11:29:51 LOG6[24]: failover: round-robin, starting at entry #0 2017.02.23 11:29:51 LOG6[24]: s_connect: connecting ::1:20587 2017.02.23 11:29:51 LOG7[24]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:51 LOG3[24]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:51 LOG6[24]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:51 LOG7[24]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:51 LOG5[24]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:51 LOG5[24]: Service [uwo2local] connected remote server from 127.0.0.1:33168 2017.02.23 11:29:51 LOG7[24]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:51 LOG7[24]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:51 LOG7[24]: RFC 2487 not detected 2017.02.23 11:29:51 LOG6[24]: Peer certificate not required 2017.02.23 11:29:51 LOG7[24]: TLS state (accept): before SSL initialization 2017.02.23 11:29:51 LOG3[24]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:51 LOG5[24]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:51 LOG7[24]: Remote descriptor (FD=9) closed 2017.02.23 11:29:51 LOG7[24]: Local descriptor (FD=3) closed 2017.02.23 11:29:51 LOG7[24]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:51 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33168 2017.02.23 11:29:51 LOG7[25]: Service [local2o365] started 2017.02.23 11:29:51 LOG3[25]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:51 LOG5[25]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:51 LOG7[25]: Local descriptor (FD=3) closed 2017.02.23 11:29:51 LOG7[25]: Service [local2o365] finished (0 left) 2017.02.23 11:29:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:56 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:32441 2017.02.23 11:29:56 LOG7[26]: Service [uwo2local] started 2017.02.23 11:29:56 LOG7[26]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:56 LOG5[26]: Service [uwo2local] accepted connection from 172.18.58.5:32441 2017.02.23 11:29:56 LOG6[26]: failover: round-robin, starting at entry #1 2017.02.23 11:29:56 LOG6[26]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:56 LOG7[26]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:56 LOG5[26]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:56 LOG5[26]: Service [uwo2local] connected remote server from 127.0.0.1:33170 2017.02.23 11:29:56 LOG7[26]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:56 LOG7[26]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:56 LOG7[26]: RFC 2487 not detected 2017.02.23 11:29:56 LOG6[26]: Peer certificate not required 2017.02.23 11:29:56 LOG7[26]: TLS state (accept): before SSL initialization 2017.02.23 11:29:56 LOG3[26]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:56 LOG5[26]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:56 LOG7[26]: Remote descriptor (FD=9) closed 2017.02.23 11:29:56 LOG7[26]: Local descriptor (FD=3) closed 2017.02.23 11:29:56 LOG7[26]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:56 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33170 2017.02.23 11:29:56 LOG7[27]: Service [local2o365] started 2017.02.23 11:29:56 LOG3[27]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:56 LOG5[27]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:56 LOG7[27]: Local descriptor (FD=3) closed 2017.02.23 11:29:56 LOG7[27]: Service [local2o365] finished (0 left) 2017.02.23 11:30:00 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:30:00 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:30:00 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 129.100.6.17:16594 2017.02.23 11:30:00 LOG7[28]: Service [uwo2local] started 2017.02.23 11:30:00 LOG7[28]: Option TCP_NODELAY set on local socket 2017.02.23 11:30:00 LOG5[28]: Service [uwo2local] accepted connection from 129.100.6.17:16594 2017.02.23 11:30:00 LOG6[28]: failover: round-robin, starting at entry #0 2017.02.23 11:30:00 LOG6[28]: s_connect: connecting ::1:20587 2017.02.23 11:30:00 LOG7[28]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:30:00 LOG3[28]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:30:00 LOG6[28]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:30:00 LOG7[28]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:30:00 LOG5[28]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:30:00 LOG5[28]: Service [uwo2local] connected remote server from 127.0.0.1:33176 2017.02.23 11:30:00 LOG7[28]: Option TCP_NODELAY set on remote socket 2017.02.23 11:30:00 LOG7[28]: Remote descriptor (FD=9) initialized 2017.02.23 11:30:00 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:30:00 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:30:00 LOG7[ui]: Service [local2o365] accepted (FD=10) from 127.0.0.1:33176 2017.02.23 11:30:00 LOG7[29]: Service [local2o365] started 2017.02.23 11:30:00 LOG7[29]: Option TCP_NODELAY set on local socket 2017.02.23 11:30:00 LOG5[29]: Service [local2o365] accepted connection from 127.0.0.1:33176 2017.02.23 11:30:00 LOG6[29]: failover: round-robin, starting at entry #13 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 2603:1036:405:4a::2:587 2017.02.23 11:30:00 LOG3[29]: s_connect: connect 2603:1036:405:4a::2:587: Network is unreachable (101) 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 2603:1036:3:11e::2:587 2017.02.23 11:30:00 LOG3[29]: s_connect: connect 2603:1036:3:11e::2:587: Network is unreachable (101) 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 2603:1036:404:56::2:587 2017.02.23 11:30:00 LOG3[29]: s_connect: connect 2603:1036:404:56::2:587: Network is unreachable (101) 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 40.97.132.210:587 2017.02.23 11:30:00 LOG7[29]: s_connect: s_poll_wait 40.97.132.210:587: waiting 10 seconds 2017.02.23 11:30:00 LOG5[29]: s_connect: connected 40.97.132.210:587 2017.02.23 11:30:00 LOG5[29]: Service [local2o365] connected remote server from 172.18.58.248:52538 2017.02.23 11:30:00 LOG7[29]: Option TCP_NODELAY set on remote socket 2017.02.23 11:30:00 LOG7[29]: Remote descriptor (FD=11) initialized 2017.02.23 11:30:00 LOG7[29]: <- 220 MWHPR2001CA0006.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[29]: -> 220 MWHPR2001CA0006.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[29]: -> EHLO localhost 2017.02.23 11:30:00 LOG7[28]: RFC 2487 detected 2017.02.23 11:30:00 LOG7[28]: <- 220 MWHPR2001CA0006.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[28]: -> 220 MWHPR2001CA0006.outlook.office365.com stunnel for Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[29]: <- 250-MWHPR2001CA0006.outlook.office365.com Hello [129.100.1.192] 2017.02.23 11:30:00 LOG7[29]: <- 250-SIZE 157286400 2017.02.23 11:30:00 LOG7[29]: <- 250-PIPELINING 2017.02.23 11:30:00 LOG7[29]: <- 250-DSN 2017.02.23 11:30:00 LOG7[29]: <- 250-ENHANCEDSTATUSCODES 2017.02.23 11:30:00 LOG7[29]: <- 250-STARTTLS 2017.02.23 11:30:00 LOG7[29]: <- 250-8BITMIME 2017.02.23 11:30:00 LOG7[29]: <- 250-BINARYMIME 2017.02.23 11:30:00 LOG7[29]: <- 250-CHUNKING 2017.02.23 11:30:00 LOG7[29]: <- 250 SMTPUTF8 2017.02.23 11:30:00 LOG7[29]: -> STARTTLS 2017.02.23 11:30:00 LOG7[29]: <- 220 2.0.0 SMTP server ready 2017.02.23 11:30:00 LOG6[29]: SNI: sending servername: smtp.office365.com 2017.02.23 11:30:00 LOG6[29]: Peer certificate required 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): before SSL initialization 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): SSLv3/TLS write client hello 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): SSLv3/TLS write client hello 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): SSLv3/TLS read server hello 2017.02.23 11:30:00 LOG7[29]: Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2017.02.23 11:30:00 LOG4[29]: CERT: Pre-verification error: unable to get local issuer certificate 2017.02.23 11:30:00 LOG4[29]: Rejected by CERT at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2017.02.23 11:30:00 LOG7[29]: Remove session callback 2017.02.23 11:30:00 LOG7[29]: Deallocating application specific data for addr index 2017.02.23 11:30:00 LOG7[29]: TLS alert (write): fatal: unknown CA 2017.02.23 11:30:00 LOG3[29]: SSL_connect: 1416F086: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed 2017.02.23 11:30:00 LOG5[29]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:30:00 LOG7[29]: Deallocating application specific data for addr index Segmentation fault [root@mtar1 stunnel]# *Andrew Culver* System Administrator Information Technology Services <https://www.uwo.ca/its> University of Western Ontario <https://www.uwo.ca> e: aculver(a)uwo.ca p: 519-661-2111 x80265 <15196612111,80265> cal: html <http://goo.gl/wVoDlo> | ics <http://goo.gl/ncUjV0>

1 0

Bad Magic
by Melzer, Jacob 21 Feb '17

21 Feb '17

I'm trying to do a proof of concept using Stunnel on AIX 6.1. Without stunnel I'd have: Telnet session -> listening service With stunnel, I want: telnet session -> stunnel client -[secure connection]--> Stunnel server -->listening service. The stunnel client seems to be working fine, but the stunnel server abends as soon as it receives a secure connection. Client: Accepts non-secure on port 33342. Forwards to secure socket 33343 stunnel stunnel.conf.2 2017.02.21 09:31:35 LOG5[ui]: stunnel 5.40 on powerpc-ibm-aix6.1.0.0 platform 2017.02.21 09:31:35 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j 26 Sep 2016 2017.02.21 09:31:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.02.21 09:31:35 LOG5[ui]: Reading configuration from file /bmo/stunnel/bin/stunnel.conf.2 2017.02.21 09:31:35 LOG5[ui]: UTF-8 byte order mark detected 2017.02.21 09:31:35 LOG5[ui]: FIPS mode disabled 2017.02.21 09:31:35 LOG6[ui]: Initializing service [hif] 2017.02.21 09:31:35 LOG6[ui]: Loading certificate from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG6[ui]: Certificate loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG6[ui]: Loading private key from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG4[ui]: Insecure file permissions on /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG6[ui]: Private key loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG4[ui]: Service [hif] needs authentication to prevent MITM attacks 2017.02.21 09:31:35 LOG5[ui]: Configuration successful 2017.02.21 09:31:38 LOG5[0]: Service [hif] accepted connection from 127.0.0.1:34749 2017.02.21 09:31:38 LOG6[0]: s_connect: connecting 127.0.0.1:33343 2017.02.21 09:31:38 LOG6[0]: s_connect: connected 127.0.0.1:33343 2017.02.21 09:31:38 LOG5[0]: Service [hif] connected remote server from 127.0.0.1:34750 2017.02.21 09:31:38 LOG6[0]: SNI: sending servername: localhost 2017.02.21 09:31:38 LOG6[0]: Peer certificate not required 2017.02.21 09:31:38 LOG3[0]: SSL_connect: Peer suddenly disconnected 2017.02.21 09:31:38 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Server Accepts SSL connections on port 33343, connects to a non-secure service. stunnel stunnel.conf.1 2017.02.21 09:31:25 LOG5[ui]: stunnel 5.40 on powerpc-ibm-aix6.1.0.0 platform 2017.02.21 09:31:25 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j 26 Sep 2016 2017.02.21 09:31:25 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.02.21 09:31:25 LOG5[ui]: Reading configuration from file /bmo/stunnel/bin/stunnel.conf.1 2017.02.21 09:31:25 LOG5[ui]: UTF-8 byte order mark detected 2017.02.21 09:31:25 LOG5[ui]: FIPS mode disabled 2017.02.21 09:31:25 LOG6[ui]: Initializing service [hif] 2017.02.21 09:31:25 LOG6[ui]: Loading certificate from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG6[ui]: Certificate loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG6[ui]: Loading private key from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG4[ui]: Insecure file permissions on /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG6[ui]: Private key loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG5[ui]: Configuration successful 2017.02.21 09:31:38 LOG5[0]: Service [hif] accepted connection from 127.0.0.1:34750 2017.02.21 09:31:38 LOG6[0]: Peer certificate not required INTERNAL ERROR: Bad magic at OpenSSL, line 0 (this is an abend - core file gets created). log file exactly matches the standard output. Any idea what's going wrong here? dbx of the core file: tbs@netcbccadvwvr01 /bmo/hif/stunnel-5.40/src>dbx /bmo/stunnel/bin/stunnel core Type 'help' for help. [using memory image in core] reading symbolic information ... IOT/Abort trap in abort at 0xd01af1f8 ($t3) 0xd01af1f8 (abort+0xf8) 80410014 lwz r2,0x14(r1) (dbx) where abort() at 0xd01af1f8 fatal_debug(txt = "Bad magic", file = "OpenSSL", line = 0), line 359 in "log.c" get_alloc_list_ptr(ptr = 0x2007e1c8, file = "OpenSSL", line = 0), line 399 in "str.c" str_detach_debug(ptr = 0x2007e1c8, file = "OpenSSL", line = 0), line 348 in "str.c" str_free_debug(ptr = 0x2007e1c8, file = "OpenSSL", line = 0), line 383 in "str.c" free_function(ptr = 0x2007e1c8), line 191 in "tls.c" mem.CRYPTO_free() at 0xd97dd8d8 bn_lib.bn_expand2@AF37_5() at 0xd97e8da4 bn_mont.BN_mod_mul_montgomery() at 0xd981e150 ecp_mont.ec_GFp_mont_field_mul() at 0xd9837a18 ecp_smpl.ec_GFp_simple_point_get_affine_coordinates() at 0xd9839890 ec_lib.EC_POINT_get_affine_coordinates_GFp() at 0xd9a81dfc ecp_oct.ec_GFp_simple_point2oct() at 0xd9acc0d4 ec_oct.EC_POINT_point2oct() at 0xd9acb754 ssl3_send_server_key_exchange() at 0xd99e7c28 ssl3_accept() at 0xd99e9950 SSL_accept() at 0xd99c0b98 ssl23_get_client_hello() at 0xd9a003f4 ssl23_accept() at 0xd9a00c5c SSL_accept() at 0xd99c0b98 ssl_start(c = 0x20084cb8), line 431 in "client.c" client_try(c = 0x20084cb8), line 273 in "client.c" client_run(c = 0x20084cb8), line 181 in "client.c" client_main(c = 0x20084cb8), line 140 in "client.c" client_thread(arg = 0x20084cb8), line 99 in "client.c" (dbx) thread thread state-k wchan state-u k-tid mode held scope function $t1 run running 26279997 u no sys __fd_poll $t2 run running 45088879 u no sys _p_nsleep >$t3 run running 19070997 k no sys abort (dbx) list free_function 186 187 #if OPENSSL_VERSION_NUMBER<0x10100000L 188 NOEXPORT void free_function(void *ptr) { 189 /* CRYPTO_set_mem_ex_functions() needs a function rather than a macro */ 190 /* unfortunately, OpenSSL provides no file:line information here */ 191 str_free_debug(ptr, "OpenSSL", 0); 192 } 193 #endif 194 195 /* end of tls.c */ Should I be concerned that it looks like it is executing "free_function" from within an if statement "if OPENSSL_VERSION_NUMBER<0x1010000L but my openssl version is 2017.02.21 09:31:35 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j 26 Sep 2016 Troubleshooting so far: - I had the same problem with earlier versions of openssl. - I've tried this with 5.37 as well (based on Brian McGinity's post from a few days ago), but get the same error. Jacob

1 0

stunnel on Windows Client: Changing active network interface (wired, wireless)
by b.koch.kemper 17 Feb '17

17 Feb '17

Dear stunnel community, we are running an application on our windows clients. The application needs a remote connection to our server (linux) for remote function calls. We could successfully secure this connection via stunnel. However, when our windows users change their network connection (e.g. they disconnect their notebook from the docking station to our corporate wifi) the connection and hence the whole application breaks. The users actually have to restart stunnel to make the application work again, which is really inconvenient. As the application on the notebook is always using the same port, is it somehow possible to make stunnel establish a new connection using the new active network interface? Kind regards, Bernhard

1 0

RSA too big problem
by Vikrant Agarwal 16 Feb '17

16 Feb '17

Hi, I upgraded my Stunnel server machine to CentOS 6.8 and post upgrade , the stunnel too got upgraded to stunnel 4.29 on x86_64-redhat-linux-gnu with OpenSSL 1.0.1e-fips 11 Feb 2013 . Now since then many of the stunnel client using newer stunnel client (those uses TLSv1.2 for Negotiation) are not able to connect . I get below error on the server in logs RSA_sign:digest too big for rsa key:rsa_sign’ How to fix this please? Regards, Vikrant

1 0

Re: [stunnel-users] Problem with 5.40 and Peer suddenly disconnected
by Brian McGinity 08 Feb '17

08 Feb '17

I found the archives and downgraded to 5.37 and this fixed the problem. Before going this route I tried 5.40 and 5.41 beta and both had the same issues with 'Peer suddenly disconnected'. Strange that it this was only happening for one particular connection (1 out of 7). It would happen with every test. If you would like for me to beta test another version, I would be happy to try. Bran

1 0

Problem with 5.40 and Peer suddenly disconnected
by Brian McGinity 07 Feb '17

07 Feb '17

After updating to stunnel 5.40 on x86-pc-msvc-1500 platform, I am getting a Peer suddenly disconnected each time I post data to a particular url. [VISION_WEB] client = yes accept = 127.0.0.1:1935 connect = xx.xx.web.com:443 sslVersion = TLSv1 2017.02.07 16:30:08 LOG5[160]: Service [XX_WEB] accepted connection from 192.168.100.21:53507 2017.02.07 16:30:08 LOG5[160]: s_connect: connected 11.11.111.36:443 2017.02.07 16:30:08 LOG5[160]: Service [XX_WEB] connected remote server from 192.168.100.21:53508 2017.02.07 16:30:08 LOG3[160]: SSL_connect: Peer suddenly disconnected 2017.02.07 16:30:08 LOG5[160]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket This is a production issue and is causing a lot of problems for a lot of people and I need to do something quickly. Is it possible to download stunnel 5.37 installed to see if going back to this version will fix this issue? Where is it? Or does anyone possibly know why this might be happening? Thank you for your help. Brian

1 0

Default passthrough to different destination?
by Mark Boyce 03 Feb '17

03 Feb '17

Hi All Wondering if there’s a way to pass an unencrypted connections traffic to an alternative location if a client does not SSL/TLS with the stunnel server? So considering stunnel running as a server to wrap an unencrypted SMTP server. If the SMTP client/server talks SSL/TLS all is good and as expected. If the client tries to talk without encryption it gets disconnect. Is there any way to send this traffic elsewhere rather than disconnecting the client? So that stunnel is adding an SSL/TLS option to a service rather than enforcing it. Splitting the traffic to destination servers based on if the client was encrypted or not. Thoughts? Thanks Mark

2 3

Mixed cert/PSKsecrets & TLS/SSL before proxy
by Varda Zklir 02 Feb '17

02 Feb '17

Hello Gentlemen. Needs help in configuration or negative clarifications on two issues. 1) First question whether is mixed use of cert/PSKsecrets auth possible? The same method (ether cert or PSKsecrets explicitly) serverside trough the parent [TLS] and inherited services works properly. But mixed cert/PSKsecrets like in config snippet below doesn't work. [TLS] client = no accept = 0.0.0.0:https connect = localhost:http cert = /etc/opt/stunnel/stunnel.pem [ssh] client = no sni = TLS:ssh connect = localhost:ssh [socks] client = no sni = TLS:socks protocol = socks PSKsecrets = /etc/opt/stunnel/auth/passwd The idea is to pass insensibly all incorrect or non-SNI aware requests to main http server and hide other multiplexed services. And at the same time to establish encryption and password access control to [socks] service. 2) And the second question is it possible proxy CONNECT after establishing SSL/TLS encryption? The configuration section: [ssh] accept = 22222 protocol = connect protocolHost = server.tld:443 protocolUsername = usernamehere protocolPassword = passwordhere connect = proxy.tld:8080 Say to establish unencrypted connection with proxy, pass username and password, tell proxy to establish CONNECT to target 443 and then transmit SSL/TLS to it. Goal is if I have SSL/TLS termination server/proxy on port 443 so we at first speak SSL/TLS with proxy and only then proceed to proxy requests phase. Thanks for future explanations.

1 0

installation problems
by HOFFMAN, GEOFFREY 30 Jan '17

30 Jan '17

I am having trouble installing stunnel on CentOS 7.3. I was given a directive to "use the latest OpenSSL" so on one target machine, it has 1.0.2k built from source. On the machine with OpenSSL 1.0.2k, when attempting to install stunnel, when I run ./configure, it passes with this info: configure: FIPS support not found Then make fails with: /usr/bin/ld: /usr/local/ssl/lib/libssl.a(s3_srvr.o): relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC On another target machine, it has 1.0.1e-fips, installed via yum package. On the machine with OpenSSL 1.0.1e-fips, ./configure fails with: checking for TLS directory... not found configure: error: Could not find your TLS library installation dir Advice on installing with the latest OpenSSL (1.0.2k) would be much appreciated. This e-mail, including any attachments, is meant only for the intended recipient of the transmission, and may be a confidential communication or a communication privileged by law. If you received this e-mail in error, any review, use, dissemination, distribution, or copying of this e-mail is strictly prohibited. Please notify us immediately of the error by return e-mail and please delete this message from your system. Thank you in advance for your cooperation.

1 0

Life cycle information
by Ben Harper 30 Jan '17

30 Jan '17

Greetings, I am trying to confirm some life cycle information, mainly supported version(s) and what versions do not insure backwards compatibility. It would appear that only the latest version is supported, per the first item under 'Before you send your question to stunnel-users' on the Mailing Lists page[0]. Does this project use semantic versioning? Will incompatibilities only come when a 6.x.x version is released? It seems at one point this was the case per the 'Upgrading to stunnel 4' link on the Documentation page[1]. Are my assumptions correct? Thanks, Ben [0]: https://www.stunnel.org/lists.html [1]: https://www.stunnel.org/docs.html

1 0

Proxy one site to HTTPS?
by Jeffrey Walton 30 Jan '17

30 Jan '17

Hi Everyone, I'm having trouble setting up a proxy for one site. The client is MacPorts on OS X 10.5. It makes some requests for files over port 80, but they apparently need to be made over port 443. Also see https://trac.macports.org/ticket/53423 and https://trac.macports.org/ticket/53347. My first question is, is it possible to proxy one site to HTTPS? My second question is, how does one do so if it is possible? The concrete example from the 53423 bug report is, I need to proxy requests from http://distfiles.macports.org/... to https://distfiles.macports.org/... I also need the opposite on the responses. Thanks in advance, Jeff

1 0

Client certificate using CAPI
by stunnel.org＠pepak.net 29 Jan '17

29 Jan '17

Hi! I am trying to use stunnel to connect to my own server using both a server and a client certificate. I got the tunnel to work, provided that the client uses a PEM certificate stored in a file. However, I would like to use CAPI, because that would allow me to use a smart card, which I finally got Windows to recognize (a nightmare of its own). Unfortunately, it seems that the client-side stunnel won't send a client certificate because the server-side stunnel will always close the connection with: SSL_accept: 140890C7: error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certificate My client-side stunnel log shows that server sent some kind of identification of all the supported client certificates to the client, but that's all - the client stunnel fails to follow through: TLS state (connect): SSLv3 read server key exchange A Client CA: emailAddress=some(a)email.com, O=Some name, CN=Pepak Yubico 4 White Client CA: emailAddress=root(a)email.com, CN=Pepak (root CA) TLS state (connect): SSLv3 read server certificate request A TLS state (connect): SSLv3 read server done A TLS state (connect): SSLv3 write client certificate A TLS state (connect): SSLv3 write client key exchange A TLS state (connect): SSLv3 write change cipher spec A TLS state (connect): SSLv3 write finished A TLS state (connect): SSLv3 flush data SSL_connect: Peer suddenly disconnected As far as I can tell, the CN=Pepak Yubico 4 White matches what my Windows show as the name of the certificate on the smartcard. Following up on https://www.stunnel.org/pipermail/stunnel-users/2016-February/005393.html, I tried to add a "key = Pepak Yubico 4 White" line to the client-side stunnel's config, but it doesn't seem to have any effect. What could be the problem? The client-side config file is: compression = deflate debug = debug fips = no taskbar = no options = NO_SSLv2 engine = capi [echo-client] client = yes accept = 3000 connect = 10.0.0.1:30000 requireCert = yes verifyChain = yes verifyPeer = yes CAfile = desktop.pem engineId = capi key = Pepak Yubico 4 White The only suspicious thing that I see is that my client certificate says that its only purpose is to verify the identity of the remote computer. Could that be the reason the handshake fails? Thanks for any help. Pepak

1 0

SSL errors do not trigger failover?
by Richard Monk 27 Jan '17

27 Jan '17

Hello! We are using stunnel to work around an SSL issue in another service, and set stunnel.conf up to do prio failover. We noticed something unusual. If the TCP session connects, but the SSL negotiation fails, it doesn't fail over to the next server on the list. I looked at the code for the latest version and this doesn't seem to be caught anywhere. What I saw in client.c shows that it only checks failover after trying to establish the TCP session, but then the SSL session happens later and doesn't give any info back to the failover code should something go wrong. Is this expected behavior, or should I look into a bug report / patch? I was thinking maybe a configurable option to allow SSL errors to trigger failover just like TCP errors. -- Richard Monk (rmonk(a)redhat.com) - Senior Principal Security Analyst Red Hat Inc. - Raleigh NC GPG Key ID: 0x942CDB25

1 0

Please Help to configure Stunnel for SHOUTcast
by Frans Rehl 24 Jan '17

24 Jan '17

Hello Stunnel Members I am wondering if any of you can help me to configure stunnel for shoutcast. I have a VPS with Windows Server 2012 R2 and I cannot find the correct configuration for windows server. Can someone help me please? My shoutcast is currently streaming on port 8000 however, I don't understand some part of the configuration, such as; cert -pem and ca-pem Could someone guide me? Best

1 0

Creating tunnel to smtp.office365.com:587
by Andrew Culver 17 Jan '17

17 Jan '17

Hello, This is my first time using stunnel so I'm still learning how it works. This may have already been asked, but I'm not sure what to search for in the archives. We have a number of hosts in private IP space that we'd like to be able to send mail to smtp.office365.com:587. I'm trying to configure stunnel for this purpose. What I'd like is to set up a stunnel instance on a server which will accept TLS connections on port 50025. Stunnel will then connect to smtp.office365.com:587 which also uses TLS. How can I do this? I am able to configure stunnel to accept my connection on 587, but the connection is immediately closed (below). If I add client = yes, then I just get: aculver stunnel # openssl s_client -starttls smtp -connect localhost:50025 CONNECTED(00000003) didn't found starttls in server response, try anyway... Here is my config: aculver stunnel # egrep -v '^;|^$' stunnel.conf ; Sample stunnel configuration file for Unix by Michal Trojnara 2002-2015 setuid = nobody setgid = nogroup pid = /usr/local/var/run/stunnel/stunnel.pid [o365-smtp] accept = 50025 cert = /usr/local/etc/stunnel/stunnel.pem connect = smtp.office365.com:587 verifyChain = yes CApath = /etc/ssl/certs protocol = smtp What am I doing wrong? Here's what I get when I don't have client = yes: aculver stunnel # openssl s_client -starttls smtp -connect localhost:50025 CONNECTED(00000003) depth=0 C = CA, ST = Ontario, L = London, O = The University of Western Ontario, OU = ITS, CN = aculver.ws.its.uwo.ca, emailAddress = aculver(a)uwo.ca verify error:num=18:self signed certificate verify return:1 depth=0 C = CA, ST = Ontario, L = London, O = The University of Western Ontario, OU = ITS, CN = aculver.ws.its.uwo.ca, emailAddress = aculver(a)uwo.ca verify return:1 139954991064736:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1263:SSL alert number 40 139954991064736:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: --- Certificate chain 0 s:/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca i:/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca --- Server certificate -----BEGIN CERTIFICATE----- MIIEJzCCAw+gAwIBAgIJAM0DgGLDIh5lMA0GCSqGSIb3DQEBCwUAMIGpMQswCQYD VQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEPMA0GA1UEBwwGTG9uZG9uMSowKAYD VQQKDCFUaGUgVW5pdmVyc2l0eSBvZiBXZXN0ZXJuIE9udGFyaW8xDDAKBgNVBAsM A0lUUzEeMBwGA1UEAwwVYWN1bHZlci53cy5pdHMudXdvLmNhMR0wGwYJKoZIhvcN AQkBFg5hY3VsdmVyQHV3by5jYTAeFw0xNzAxMTcxODAwNTdaFw0yMDAxMTcxODAw NTdaMIGpMQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEPMA0GA1UEBwwG TG9uZG9uMSowKAYDVQQKDCFUaGUgVW5pdmVyc2l0eSBvZiBXZXN0ZXJuIE9udGFy aW8xDDAKBgNVBAsMA0lUUzEeMBwGA1UEAwwVYWN1bHZlci53cy5pdHMudXdvLmNh MR0wGwYJKoZIhvcNAQkBFg5hY3VsdmVyQHV3by5jYTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAL2A3QEU7ReMc+2dTJdxVnQx33dIomQvO6QOAaFkI9pt XF/UhSBCg3ZD2yZeKe5GQ0+KqSCjuxTZE+BMTIeNUtaFEDr9bMAx0toknm29ve1B wTErWoIjE4yqQ+j/D9JLp4BzBcptz1zaEdvhzzZo2zWVpqHrUHSXzoIELD4xyZyF UgbQ057diKr1fqM7q3ozCofslFGEjWtc8SsfwgToT72g7bRhx8a6F6SSX8afcVx0 hvvC998QbTNUCpJO6GPzWWCsITc3RPMZK3OJsbI4NNBKDZ8eE2NTSkcKjnibRWFx bwCTlSZ5XABQrgXmEO51cx6DBAK/8cV8W2H/VNr9SXkCAwEAAaNQME4wHQYDVR0O BBYEFMPXcnQduKdorSNrFIR1up+a5V7RMB8GA1UdIwQYMBaAFMPXcnQduKdorSNr FIR1up+a5V7RMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAKqmaC+g RD1KEWT2yJit0FRIuwzFYmh/jgQ0ofabWQIuQtyNeqVnATU5FMOmox9MgbbsBanC SBVxuiLsWruk6VTjByHaIPAfsdWVKYMfLXO2Rku8GTp1X0B+HcNxh18tKr9s72rB AmapnD1GrYDAlBBgwQz+Ei1iRz+rqKsPvvJ/IEzZ02uhxV0ZWxBi5gTqAQc+pi3y I8DNBTxev2BMw+YCeNnrH3ryrJ8vKYlUmxE0k2POH1ihlpzdx9jtKC9TKR1kahMP 3lbldSHmW9DWeOfzQZ6NDHADSI698HaYfWQXUqbXjNJsxFb47pnjmyWgKseAT9iw w9nPDtkCmUihuBM= -----END CERTIFICATE----- subject=/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca issuer=/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca --- No client certificate CA names sent --- SSL handshake has read 1741 bytes and written 138 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: Session-ID-ctx: Master-Key: 9B6FC3BBEEADF6673416272CA03FA44A2B10BADB3B843317403C03904F0E45E922EA2581F313BF5282C0A47498E43C8D Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1484680413 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- aculver stunnel # Thanks, Andrew

1 0

Forwarding ip without HAProxy protocol
by John BYaka 06 Jan '17

06 Jan '17

Is it possible to forward real ip in special header? I know about 'protocol=proxy' but for using this i need to implement HAProxy protocol in app.

1 0

Stunnel and tokens on Windows
by stunnel.org＠pepak.net 31 Dec '16

31 Dec '16

Hi! I would very much like to switch my Stunnel setup to use hardware tokens. Stunnel apparently supports that using a PKCS11 engine, but I am having hard luck trying to figure it out for Windows, because 1) my practical experience with tokens is nonexistent at the moment, and 2) there are very few pages with a relevant information (basically, I was only able to find the very ancient http://martlaak.wikia.com/wiki/Stunnel_and_engine_pkcs11 and two russian pages http://forum.rutoken.ru/topic/1639/ and https://habrahabr.ru/post/135369/ which probably do just what I need, but I am not so sure they are applicable to my needs as I do not have a rutoken). I guess I would be satified if someone told me, "yes, these pages are applicable, just buy a xxxtoken instead of rutoken"; I would be happier with a full guide, but I can't expect anyone to write it - with the possible exception of Michal Trojnara's paid support (would that be possible?). Thanks, pepak

1 0

Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 21 Dec '16

21 Dec '16

2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>: > Did not have a look at the code yet, but should it be possible to replace > envvars usage by some keys in the registry on windows platform and/or > %userprofile%/config-file ? > > Anyway, my opinion on the patch is that there is no real interest for > "generic/self-expanding" config file , and it is even dangerous : > I would not trust stunnel if, at run time, its config could be modified by > USER envvars... > which difference between %userprofile%/config-file and USER envvars? both are USER owned and USER controlled. certificate and keys also USER private data. and stunnel started by USER owned by USER. if stunnel started by SYSTEM/ADMIN he uses SYSTEM/ADMIN envvars (if needed), certs, keys, etc. global "generic/self-expanding" config file is ADMIN owned. USER has permissions to substitute some values, restricted by ADMIN.

2 10

problem running stunnel as windows service
by Jeff Saxton 09 Dec '16

09 Dec '16

stunnel 5.38 on x86-pc-msvc-1500 platform compiled/running with OpenSSL 1.0.2j-fips 26 Sep 2016 Windows Server 2012R2 Standard When I try and start the service I get: Windows could not start the Secure Socket Tunneling Protocol Service on the Local Computer. Error: 1079: The account specified for this service is different from the account specified for other services running in the same process. So after a little reading I went into Services->Logon and checked: Allow Service to interact with desktop Same Error So I created an account in the Local Administrators group and gave it logon as a service Same thing Any ideas? -- Jeff Saxton Tanium CELL: +US 650.235.0776

1 0

Using transparent destination option with multiple network interfaces.
by Rodney Lott 08 Dec '16

08 Dec '16

Hi, there. Base server details: - Using the latest stunnel 5.37 - Ubuntu Trusty - The computers communicating with each other use bridged interface addresses that are configured by the clustering software (i.e. to ensure that at least one of the nodes is master and host to some common addresses) - For discussion purposes, let's say that each server has an eth0 and eth1, and that the master node has two additional bridged address (ie. eth0:shared-ip1, eth1:shared-ip2) - The slave nodes will try to connect to eth0:shared-ip1:20001 and eth1:shared-ip2:20001 that are hosted on the master - The master node will also try to connect to these as well, while listening on port 20001 - Not running in a chroot and am running stunnel as stunnel4 user - I have created a working solution using 4 services in the stunnel config and using hard-coded destinations in the iptables rules and the stunnel config. I want to create something more dynamic and versatile. I am trying to insert a stunnel instance between my server application that attempts to connect to its twin on another server, using the bridging addresses. I am trying to avoid hard-coding destination IP addresses in my stunnel configuration file and the iptables rules. I also don't want to have separate rules for each interface. For example, from server A's perspective (i.e. the master node), the desirable sequence of events are: - Attempt to connect to port 20001 using the bridge addresses as destinations (in this case, they would be local interfaces). - Intercept the requests to port 20001 on server A and divert them to port 40000 for encryption (i.e. the local stunnel instance). - Send unencrypted data from stunnel directly to local 20001. At the same time, server B is doing the same, except that the bridge addresses reside on server A and are not local. So, server A would also need to do this: - Intercept external request for port 20001 and send it to stunnel port 40000 for encryption - Send decrypted packets to local port 20001 This same type of sequence would also be happening My stunnel configuration looks like this: fips=yes pid=/var/run/stunnel4/testsrv.pid debug=7 output=/var/log/stunnel4/testsrv.log sslVersion = TLSv1.2 key = <private-key-location> cert = <cert-location> CAfile = <ca-file-location> ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:AES256-GCM-SHA384:AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:AES128-GCM-SHA256:AES128-SHA256 [test-srv] client=yes accept=40000 transparent=destination My iptables rules, base on what I read in the man page, are this: STUNNEL_UID=$(id -u stunnel4) # Redirect any incoming requests to port 20001 iptables -t nat -A PREROUTING -p tcp --dport 20001 ! -i lo -j DNAT --to-destination 127.0.0.1:40000 iptables -A INPUT -p tcp --dport 40000 -j ACCEPT # Redirect any outgoing locally generated requests for 20001 to stunnel port 40000 iptables -t nat -A OUTPUT -p tcp --dport 20001 -m owner ! --uid-owner $STUNNEL_UID -j DNAT --to-destination 127.0.0.1:40000 # Redirect the output of stunnel to the local 20001 port iptables -t nat -A OUTPUT -p tcp --dport 20001 -m owner --uid-owner $STUNNEL_UID -j REDIRECT --to-ports 20001 iptables -t nat -A INPUT -p tcp -d 127.0.0.1 --dport 20001 -j ACCEPT These rules are not completely adequate. For now, I'm just trying to get server A's connection to port 20001 working without having to worry about incoming from server B. When I do this and start stunnel and my process, server A's stuff appears to loop endlessly. I think this is happening because the packets that come out of stunnel, due to the transparency configuration, look exactly the same as the original. If I log stuff using iptables, I see repeat entries like this: nat-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=150.150.242.27 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=20001 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 nat-POSTROUTING: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30542 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30542 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 nat-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=150.150.242.27 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=20001 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 nat-POSTROUTING: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=48828 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=48828 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=269 TOS=0x00 PREC=0x00 TTL=64 ID=48829 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK PSH URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=269 TOS=0x00 PREC=0x00 TTL=64 ID=48829 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK PSH URGP=0 ... As can be seen, line 1 and line 7 are virtually identical. In the stunnel log, I can see that stunnel is receiving multiple requests for port 20001 in rapid succession but is not actually receiving any reply from the final destination. So, if anyone has any ideas, tweaks or suggestions for how to solve this problem or where I am going wrong, I would appreciate it. I can use a static configuration with hard-coded destination IP's but if there is an alternative, I would like to know. I have tried for several days to figure this out and have searched Google extensively, including stunnel-users postings, to figure out how to do this without success. Thanks, Rodney Lott

1 1

setgroups: notowner (1)
by Jones, Russell - NONEMP 08 Dec '16

08 Dec '16

I am working on a project where we are migrating to a new datacenter. The new datacenter will not allow compilers on their servers, so I am unable to do a new stunnel build on the new server. I am attempting to move the stunnel install/executables from the old server to the new one. I got past several errors for libraries not found, but now I am stuck. stunnel process will not start, and gets several messages "setgoups: Not owner (1)" I am not sure what I need to do with permissions, ownership, etc to make this work. log attached Thanks for your help, Russell J. This electronic message transmission contains information from CSRA that may be attorney-client privileged, proprietary or confidential. The information in this message is intended only for use by the individual(s) to whom it is addressed. If you believe you have received this message in error, please contact me immediately and be aware that any use, disclosure, copying or distribution of the contents of this message is strictly prohibited. NOTE: Regardless of content, this email shall not operate to bind CSRA to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of email for such purpose.

1 0

Stunnel in inetd mode and PID in logs
by Bruce Guenter 02 Dec '16

02 Dec '16

Hi. I am running stunnel in inetd mode (under tcpserver). Prior to version 5.12 (as far as I can tell), the logs output by stunnel would include the tag LOG#[PID]. As of version 5.12, the logs now say LOG#[main] (and later LOG#[ui]). Is there any way to get the PID back in the logs? I have tried all different choices for the logId configuration option, and it doesn't seem to make a difference there. Thanks. -- Bruce Guenter <bruce(a)untroubled.org> http://untroubled.org/

1 0

Re: [stunnel-users] stunnel 5.38 released
by Javier 26 Nov '16

26 Nov '16

Hi there. Dumb error I just found. Dumb because I just found it and maybe it was earlier among us. Or maybe it is "a feature". But I'd swear it worked as expected in the past. Testing the new SNI option I made a mistake and I had to edit and reload the configuration file. Nothing strange until here. The problem is comming because I load a custom .conf file as "stunnel.exe file.conf" for the server mode, so when a parsing error is found, Stunnel lose the track of the custom .conf file and when you reload the corrected configuration through the "Reload configuration" menu option, it doesn't load the custom .conf but the default stunnel.conf. But before reloading, the "Edit configuration" menu option points correctly to the correct configuration file and opens it to edit. Only "Reload configuration" lose the track of the file. This is happening in the windows environment (just if it wasn't clear enough by the .exe extension ;) ). Windows 2000 (yet). I can't tested versions beyond. Regards.

1 0

Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility
by Jose Alf. 25 Nov '16

25 Nov '16

Jothish, 1. You are using a very outdated version of OpenSSL (openssl 0.9.8 is EOL). I suggest you use a newer, supported version. 2. On a DOS Window, try this:openssl dhparam -rand randfile1;randfile2;randfile3 1024 where randfile1,randfile2.... are existing files or directories to use as entrophy sources. If you're on Linux you can use dd if=/dev/urandom count=2 | openssl dhparam -rand - 1024 This will print something like this:WARNING: can't open config file: c:\openssl-vc/ssl/openssl.cnf Loading 'screen' into random state - done 0 semi-random bytes loaded Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ..+.. bla, bla....++* unable to write 'random state' -----BEGIN DH PARAMETERS----- MIGHAoGBAJJ+QAYkKQd0pG1lxZKDYVZaURkTINQho8CWCUYOMp2ZEwZeMrEv+kjd PVb4Ilnah1TmZQOxu1v8HtSWmKpclhlTDKjmDbhznUFkQhmRGjxXDCfrhnvNI4hV kOB/3lGcWo50ttf+ZqNaXd0lKf9YfnjkRUSUtrHiMRL9CdecxQXbAgEC -----END DH PARAMETERS----- Now, cut from ---BEGIN... all the way to PARAMETERS--- and add it to your cert PEM file. 3. Try again, your check command: openssl dhparam -inform PEM -in ./training_client.pem -check -textShould print something like: DH Parameters: (1024 bit) prime: 00:92:7e:40:06:24:29:07:74:a4:6d:65:c5:92:83: ... 31:12:fd:09:d7:9c:c5:05:db generator: 2 (0x2) DH parameters appear to be ok. -----BEGIN DH PARAMETERS----- MIGHAoGBAJJ+QAYkKQd0pG1lxZKDYVZaURkTINQho8CWCUYOMp2ZEwZeMrEv+kjd ....-----END DH PARAMETERS----- 4. Now, try connecting from SFDC to tibco and let us know. SaludosJose From: "jothish.chokkalingam(a)accenture.com" <jothish.chokkalingam(a)accenture.com> To: josealf(a)rocketmail.com Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org Sent: Thursday, November 24, 2016 6:45 AM Subject: RE: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility #yiv9373448809 #yiv9373448809 -- _filtered #yiv9373448809 {font-family:Wingdings;panose-1:5 0 0 0 0 0 0 0 0 0;} _filtered #yiv9373448809 {panose-1:2 4 5 3 5 4 6 3 2 4;} _filtered #yiv9373448809 {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;} _filtered #yiv9373448809 {font-family:Consolas;panose-1:2 11 6 9 2 2 4 3 2 4;}#yiv9373448809 #yiv9373448809 p.yiv9373448809MsoNormal, #yiv9373448809 li.yiv9373448809MsoNormal, #yiv9373448809 div.yiv9373448809MsoNormal {margin:0in;margin-bottom:.0001pt;font-size:11.0pt;color:black;}#yiv9373448809 a:link, #yiv9373448809 span.yiv9373448809MsoHyperlink {color:#0563C1;text-decoration:underline;}#yiv9373448809 a:visited, #yiv9373448809 span.yiv9373448809MsoHyperlinkFollowed {color:#954F72;text-decoration:underline;}#yiv9373448809 p {margin-right:0in;margin-left:0in;font-size:11.0pt;color:black;}#yiv9373448809 pre {margin:0in;margin-bottom:.0001pt;font-size:10.0pt;color:black;}#yiv9373448809 p.yiv9373448809MsoListParagraph, #yiv9373448809 li.yiv9373448809MsoListParagraph, #yiv9373448809 div.yiv9373448809MsoListParagraph {margin-top:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;font-size:11.0pt;color:black;}#yiv9373448809 span.yiv9373448809HTMLPreformattedChar {font-family:Consolas;color:black;}#yiv9373448809 span.yiv9373448809EmailStyle20 {color:windowtext;}#yiv9373448809 span.yiv9373448809EmailStyle21 {color:#1F497D;}#yiv9373448809 span.yiv9373448809EmailStyle22 {color:#1F497D;}#yiv9373448809 span.yiv9373448809EmailStyle23 {color:#1F497D;}#yiv9373448809 .yiv9373448809MsoChpDefault {font-size:10.0pt;} _filtered #yiv9373448809 {margin:1.0in 1.0in 1.0in 1.0in;}#yiv9373448809 div.yiv9373448809WordSection1 {}#yiv9373448809 _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {}#yiv9373448809 ol {margin-bottom:0in;}#yiv9373448809 ul {margin-bottom:0in;}#yiv9373448809 Jose, For the issue as mentioned in below down mail I am following below two approaches, 1. Move the TLSv1.2 enabled traffic to an intermediate port and then to target port which has TLS1 enabled, in that ssl handshake from intermediate to target port getting below error. While triaging with openssl command, it is observed that the DH parameters are not proper. So we are trying to add the dh parameters C:\Users\robin.johnson\Documents\SSL\SSL>C:\openssl-0.9.8k_X64\bin\openssl dhparam -inform PEM -in ./training_client.pem -check -text unable to load DH parameters 1800:error:0906D06C:PEM routines:PEM_read_bio:no start line:.\crypto\pem\pem_lib.c:650:Expecting: DH PARAMETERS stunnel.logà2016.11.23 23:08:32 LOG3[131]: SSL_connect: 14082174: error:14082174:SSL routines:ssl3_check_cert_and_algorithm:dh key too small 2. Using https service in stunnel traffic is received by TLS V1.1 divert to non ssl enabled port. Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com From: Josealf.rm [mailto:[email protected]] Sent: Thursday, November 24, 2016 4:36 PM To: Chokkalingam, Jothish <jothish.chokkalingam(a)accenture.com> Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility Can you please elaborate? If you want us to help, you need to provide enough information. Regards Jose El 24/11/2016, a las 5:03 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió: Jose, J you are right.i was trying but I thought it will work as a client and it worked as a workaround. But will check for the dh key small error while forwarding the traffic with SSL from intermediate port to another port. Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com From: Josealf.rm [mailto:[email protected]] Sent: Thursday, November 24, 2016 2:48 PM To: Chokkalingam, Jothish <jothish.chokkalingam(a)accenture.com> Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility Jothish, Stunnel in server mode is what you need, with 99.9% confidence. When you write: [https] Accept=443 Connect=local host:80 Client=no Stunnnel will expect TLS connections on port 443 and will forward then to your normal web server running on loopback port 80. Is that clear? Regards, Jose El 24/11/2016, a las 2:29 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió: Is there a way to forward a Secure connection from one port to non secure port using stunnel. I am googling but unable to find. If you have can you let me know Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com From: stunnel-users [mailto:[email protected]]On Behalf Of Carter Browne Sent: Wednesday, November 23, 2016 9:30 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility There are other tools for performing port forwarding with less overhead (I believe tappipe is one), although I make use stunnel to do this extensively. In order forward a secure connection from one port to another is a two step process with stunnel: A sample configuration segment would be: [SFDC reverse in] client = no accept = 8008 connect = localhost:48008 [SFDC reverse out] client = yes accept = localhost:48008 connect = localhost:8009 On 11/23/2016 10:18 AM, Rodney Lott wrote: Hi, there. I'm no stunnel expert, but here's my $0.05 (we have no pennies in Canada anymore ;-) ): - I would try including the key as well as the cert in your stunnel config - I would enable debug on the openssl s_client call to see if it will indicate why it is reseting. Same with your SFDC client to get more info. - Question: is the "WARNING: can't open config file" message below indicative of a permissions or path problem? - Question: Is the stunnel cert and key compatible with the TIBCO server's certificate? They need to be using certs generated from the same key source, don't they? - You might want to fix the SSL version in the stunnel config file (i.e. sslVersion = TLSv1.2) Good luck with your debugging. Rodney On 2016-11-22 07:43 PM, jothish.chokkalingam(a)accenture.com wrote: HI all, There is a problem we have currently connecting tibco client to SFDC sever via TLS v1.2 and that’s solved by using stunnel in client mode. And the communication from SFDC client to tibco server applications w.r.t TLS V1.2 I am unable to solve using stunnel. Below is the configuration in stunnel in server end to divert the traffic from 8008 to 8009, can you help here with the logs is the stunnel configuration is correct or there any missed/need to alter. [SFDC reverse proxy test] debug=7 ;client = yes accept = 8008àport used by sfdc client to connect to TIBCO server connect = localhost:8009 àTibco server that’s running cert = stunnel.pem 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] started 2016.11.23 08:31:56 LOG7[118]: Option TCP_NODELAY set on local socket 2016.11.23 08:31:56 LOG5[118]: Service [SFDC reverse proxy test] accepted connection from 101.167.198.14:54477 2016.11.23 08:31:56 LOG6[118]: Peer certificate not required 2016.11.23 08:31:56 LOG7[118]: SSL state (accept): before/accept initialization 2016.11.23 08:31:56 LOG3[118]: SSL_accept: Peer suddenly disconnected 2016.11.23 08:31:56 LOG5[118]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.11.23 08:31:56 LOG7[118]: Local descriptor (FD=696) closed 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] finished (0 left) PFB the openssl snap shot looks odd C:\Program Files (x86)\stunnel\bin>openssl s_client -connect localhost:8008 -prexit -showcerts WARNING: can't open config file: /devel/win32/openssl/openssl.cnf CONNECTED(0000016C) Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility
by Josealf.rm 24 Nov '16

24 Nov '16

Can you please elaborate? If you want us to help, you need to provide enough information. Regards Jose > El 24/11/2016, a las 5:03 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió: > > Jose, > J you are right.i was trying but I thought it will work as a client and it worked as a workaround. But will check for the dh key small error while forwarding the traffic with SSL from intermediate port to another port. > > Thanks and Regards, > Jothish > TIBCO TSD > Ph. : +91 44 39263958 > Mobile : +91 9884040171 > Support : +91 9962007110 > OC : jothish.chokkalingam > Group mail:- Telstra.psm.tsd.tibco(a)accenture.com > > From: Josealf.rm [mailto:[email protected]] > Sent: Thursday, November 24, 2016 2:48 PM > To: Chokkalingam, Jothish <jothish.chokkalingam(a)accenture.com> > Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility > > Jothish, > > Stunnel in server mode is what you need, with 99.9% confidence. > > When you write: > > [https] > Accept=443 > Connect=local host:80 > Client=no > > Stunnnel will expect TLS connections on port 443 and will forward then to your normal web server running on loopback port 80. > > Is that clear? > > Regards, > Jose > > El 24/11/2016, a las 2:29 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió: > > > Is there a way to forward a Secure connection from one port to non secure port using stunnel. I am googling but unable to find. If you have can you let me know > > Thanks and Regards, > Jothish > TIBCO TSD > Ph. : +91 44 39263958 > Mobile : +91 9884040171 > Support : +91 9962007110 > OC : jothish.chokkalingam > Group mail:- Telstra.psm.tsd.tibco(a)accenture.com > > From: stunnel-users [mailto:[email protected]] On Behalf Of Carter Browne > Sent: Wednesday, November 23, 2016 9:30 PM > To: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility > > There are other tools for performing port forwarding with less overhead (I believe tappipe is one), although I make use stunnel to do this extensively. > > In order forward a secure connection from one port to another is a two step process with stunnel: > > A sample configuration segment would be: > > [SFDC reverse in] > > client = no > > accept = 8008 > > connect = localhost:48008 > > > [SFDC reverse out] > client = yes > accept = localhost:48008 > connect = localhost:8009 > > On 11/23/2016 10:18 AM, Rodney Lott wrote: > Hi, there. > > I'm no stunnel expert, but here's my $0.05 (we have no pennies in Canada anymore ;-) ): > - I would try including the key as well as the cert in your stunnel config > - I would enable debug on the openssl s_client call to see if it will indicate why it is reseting. Same with your SFDC client to get more info. > - Question: is the "WARNING: can't open config file" message below indicative of a permissions or path problem? > - Question: Is the stunnel cert and key compatible with the TIBCO server's certificate? They need to be using certs generated from the same key source, don't they? > - You might want to fix the SSL version in the stunnel config file (i.e. sslVersion = TLSv1.2) > > Good luck with your debugging. > > Rodney > > On 2016-11-22 07:43 PM, jothish.chokkalingam(a)accenture.com wrote: > HI all, > > There is a problem we have currently connecting tibco client to SFDC sever via TLS v1.2 and that’s solved by using stunnel in client mode. And the communication from SFDC client to tibco server applications w.r.t TLS V1.2 I am unable to solve using stunnel. Below is the configuration in stunnel in server end to divert the traffic from 8008 to 8009, can you help here with the logs is the stunnel configuration is correct or there any missed/need to alter. > > [SFDC reverse proxy test] > debug=7 > ;client = yes > accept = 8008àport used by sfdc client to connect to TIBCO server > connect = localhost:8009 àTibco server that’s running > cert = stunnel.pem > 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] started > 2016.11.23 08:31:56 LOG7[118]: Option TCP_NODELAY set on local socket > 2016.11.23 08:31:56 LOG5[118]: Service [SFDC reverse proxy test] accepted connection from 101.167.198.14:54477 > 2016.11.23 08:31:56 LOG6[118]: Peer certificate not required > 2016.11.23 08:31:56 LOG7[118]: SSL state (accept): before/accept initialization > 2016.11.23 08:31:56 LOG3[118]: SSL_accept: Peer suddenly disconnected > 2016.11.23 08:31:56 LOG5[118]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket > 2016.11.23 08:31:56 LOG7[118]: Local descriptor (FD=696) closed > 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] finished (0 left) > > PFB the openssl snap shot looks odd > C:\Program Files (x86)\stunnel\bin>openssl s_client -connect localhost:8008 -prexit -showcerts > WARNING: can't open config file: /devel/win32/openssl/openssl.cnf > CONNECTED(0000016C) > > Thanks and Regards, > Jothish > TIBCO TSD > Ph. : +91 44 39263958 > Mobile : +91 9884040171 > Support : +91 9962007110 > OC : jothish.chokkalingam > Group mail:- Telstra.psm.tsd.tibco(a)accenture.com > > > > This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. > ______________________________________________________________________________________ > > www.accenture.com > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Help in setting stunnel in server mode to over come TLSV2 compatibility
by jothish.chokkalingam＠accenture.com 24 Nov '16

24 Nov '16

HI all, There is a problem we have currently connecting tibco client to SFDC sever via TLS v1.2 and that's solved by using stunnel in client mode. And the communication from SFDC client to tibco server applications w.r.t TLS V1.2 I am unable to solve using stunnel. Below is the configuration in stunnel in server end to divert the traffic from 8008 to 8009, can you help here with the logs is the stunnel configuration is correct or there any missed/need to alter. [SFDC reverse proxy test] debug=7 ;client = yes accept = 8008-->port used by sfdc client to connect to TIBCO server connect = localhost:8009 -->Tibco server that's running cert = stunnel.pem 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] started 2016.11.23 08:31:56 LOG7[118]: Option TCP_NODELAY set on local socket 2016.11.23 08:31:56 LOG5[118]: Service [SFDC reverse proxy test] accepted connection from 101.167.198.14:54477 2016.11.23 08:31:56 LOG6[118]: Peer certificate not required 2016.11.23 08:31:56 LOG7[118]: SSL state (accept): before/accept initialization 2016.11.23 08:31:56 LOG3[118]: SSL_accept: Peer suddenly disconnected 2016.11.23 08:31:56 LOG5[118]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.11.23 08:31:56 LOG7[118]: Local descriptor (FD=696) closed 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] finished (0 left) PFB the openssl snap shot looks odd C:\Program Files (x86)\stunnel\bin>openssl s_client -connect localhost:8008 -prexit -showcerts WARNING: can't open config file: /devel/win32/openssl/openssl.cnf CONNECTED(0000016C) Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

4 4

uninstall.exe
by Michael Curran 22 Nov '16

22 Nov '16

With the distrubuted version of stunnel, there is an uninstall.exe Are there any options for this uninstaller, so I can automate removal and upgrade processes ? Like a /quiet or /Q ?? Which uninstaller application is this based off of?

1 0

Connection failure on IPv4-only box with IPv6-address in RR DNS record
by Michael Weiser 18 Nov '16

18 Nov '16

Hi, the server I connect to using stunnel has just been upgraded to IPv6. In the process an AAAA record was added to its DNS entry. The box I run stunnel on is IPv4-only, meaning, the kernel does not have any IPv6 support at all. The DNS stub resolver is still looking for AAAA records though. Consequently stunnel connections now fail about half of the time with error: 2016.11.18 20:10:57 LOG3[ui]: remote socket: Address family not supported by protocol (97) >From looking at client.c I can see that stunnel supports trying all target addresses in turn but will bail if the socket cannot be created: for(ind_try=0; ind_try<c->connect_addr.num; ind_try++) { c->fd=s_socket(c->connect_addr.addr[ind_cur].sa.sa_family, SOCK_STREAM, 0, 1, "remote socket"); if(c->fd==INVALID_SOCKET) longjmp(c->err, 1); [...] if(s_connect(c, &c->connect_addr.addr[ind_cur], [...] continue; /* next IP */ } [...] return fd; /* success! */ So I guess the problem would go away if I enabled IPv6 in the kernel of my client box: s_socket() would succeed but connect() would fail with ENETUNREACH. But couldn't stunnel just continue with the next IP if s_socket() failed with EAFNOSUPPORT? -- Thanks, Michael

1 0

Deactivate expiry date check, Have CA check with verify = 3
by Mark Shine 18 Nov '16

18 Nov '16

Hello, I would like to setup stunnel but the certificate from my other tunnel is expired. How would I tell stunnel to ignore verification of expiry date of the certificate coming from stunnel client mode to the stunnel server mode? I want to be able to verify the certificate but ignore the expiry date. Not disable cert check all the way I have a stunnel setup by someone else that has done this exact thing but I have no clue how they did it. Stunnel seems to use openssl for the verification so I guess the question should be how to bypass openssl expiry check. Please see the below link for my issue on stackexchange. http://unix.stackexchange.com/questions/323997/stunnel-how-to-ignore-the-ce… [http://cdn.sstatic.net/Sites/unix/img/[email protected]?v=32fb07f7ce26…]<http://unix.stackexchange.com/questions/323997/stunnel-how-to-ignore-the-ce…> Stunnel: How to ignore the cert expiry date<http://unix.stackexchange.com/questions/323997/stunnel-how-to-ignore-the-ce…> unix.stackexchange.com I would like to setup stunnel but the certificate from my other tunnel is expired. How would I tell stunnel to ignore verification of expiry date of the certificate coming from stunnel client mode ...

1 0

Windows builds
by Michael Curran 16 Nov '16

16 Nov '16

Hello -- Are there some solid instructions for building stunnel on windows? I am using Microsoft VS 2015 and the 64-bit compilers -- This is the basic error I am running into, but could be that stunnel wont work with 64-bit? C:\stunnel_build\stunnel-5.36.tar\stunnel-5.36\src>.\makew32.bat W32 ENVIRONMENT OK Microsoft (R) Program Maintenance Utility Version 14.00.24210.0 Copyright (C) Microsoft Corporation. All rights reserved. Detected target: win64 cl /MD /W3 /O2 /nologo /I"\devel\win64\openssl\include" /DUNICODE /D_UNICODE -Fo..\obj\win64\stunnel.obj -c ..\src\stunnel.c stunnel.c c:\stunnel_build\stunnel-5.36.tar\stunnel-5.36\src\common.h(414): fatal error C1083: Cannot open include file: 'openssl/opensslconf.h': No such file or directory NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\BIN\amd64\cl.EXE"' : return code '0x2' Stop.

2 2

Stunnel-5.x on windows 10
by Michael Curran 15 Nov '16

15 Nov '16

I have a method with VS to compile Stunnel as 64-bit for use with Windows Are there any decent instructions for compiling it as 64-bit? Michael Curran | Systems Architect Office: 614-568-2285 Mobile: 614-403-6320 ConnectSolutions | 126 Post St. Ste. 400 | San Francisco, CA 94108

1 0

Assistance needed debugging Stunnel AWS EC2 Interface
by Donald F. Coffin 15 Nov '16

15 Nov '16

I am using stunnel as a proxy to support SoapUI mock services which are used to test an SSL based application. The SoapUI and stunnel proxy are running on an AWS Ubuntu 14.04 EC2 Instance communicating to a Tomcat server running on a second AWS Ubuntu 14.04 EC2 Instance. The target application uses a wildcard SSL Certificate and works successfully when accessed using a desktop browser (Chrome or Firefox). The issue I am encountering is that the stunnel connection logs a "SSL closed on SSL_read" message as soon as the cipher suite is negotiated as shown in the following stunnel.log: 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Clients allowed=2000 2016.11.14 21:34:19 LOG5[5287:140430154716992]: stunnel 4.53 on x86_64-pc-linux-gnu platform 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Compiled with OpenSSL 1.0.1e 11 Feb 2013 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Running with OpenSSL 1.0.1f 6 Jan 2014 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Update OpenSSL shared libraries or rebuild stunnel 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Reading configuration from file /etc/stunnel/stunnel.conf 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Compression not enabled 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Snagged 64 random bytes from /home/ubuntu/.rnd 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Wrote 1024 new random bytes to /home/ubuntu/.rnd 2016.11.14 21:34:19 LOG7[5287:140430154716992]: PRNG seeded successfully 2016.11.14 21:34:19 LOG6[5287:140430154716992]: Initializing service section [resourceServer] 2016.11.14 21:34:19 LOG4[5287:140430154716992]: Insecure file permissions on /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Key file: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Private key loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Verify directory set to /etc/ssl/certs 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Added /etc/ssl/certs revocation lookup directory 2016.11.14 21:34:19 LOG7[5287:140430154716992]: SSL options set: 0x00000004 2016.11.14 21:34:19 LOG6[5287:140430154716992]: Initializing service section [tpserver] 2016.11.14 21:34:19 LOG4[5287:140430154716992]: Insecure file permissions on /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Key file: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Private key loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Verify directory set to /etc/ssl/certs 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Added /etc/ssl/certs revocation lookup directory 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Could not load DH parameters from /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Using hardcoded DH parameters 2016.11.14 21:34:19 LOG7[5287:140430154716992]: DH initialized with 2048-bit key 2016.11.14 21:34:19 LOG7[5287:140430154716992]: ECDH initialized with curve prime256v1 2016.11.14 21:34:19 LOG7[5287:140430154716992]: SSL options set: 0x00000004 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Configuration successful 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Service [resourceServer] (FD=12) bound to 127.0.0.1:8080 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Service [tpserver] (FD=13) bound to 127.0.0.1:8444 2016.11.14 21:34:19 LOG7[5293:140430154716992]: Created pid file /var/run/stunnel4.pid 2016.11.14 21:34:25 LOG7[5293:140430154716992]: Service [resourceServer] accepted (FD=3) from 127.0.0.1:41256 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Service [resourceServer] started 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Waiting for a libwrap process 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Acquired libwrap process #0 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Releasing libwrap process #0 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Released libwrap process #0 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Service [resourceServer] permitted by libwrap from 127.0.0.1:41256 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Service [resourceServer] accepted connection from 127.0.0.1:41256 2016.11.14 21:34:25 LOG6[5293:140430154827520]: connect_blocking: connecting 52.43.245.161:8443 2016.11.14 21:34:25 LOG7[5293:140430154827520]: connect_blocking: s_poll_wait 52.43.245.161:8443: waiting 10 seconds 2016.11.14 21:34:25 LOG5[5293:140430154827520]: connect_blocking: connected 52.43.245.161:8443 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Service [resourceServer] connected remote server from 172.31.44.97:34077 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Remote socket (FD=15) initialized 2016.11.14 21:34:25 LOG7[5293:140430154827520]: SNI: host name: 52.43.245.161 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Starting certificate verification: depth=2, /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 2016.11.14 21:34:25 LOG6[5293:140430154827520]: CERT: Verification not enabled 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Certificate accepted: depth=2, /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Starting certificate verification: depth=1, /C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA 2016.11.14 21:34:25 LOG6[5293:140430154827520]: CERT: Verification not enabled 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Certificate accepted: depth=1, /C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Starting certificate verification: depth=0, /CN=*.greenbuttonalliance.org 2016.11.14 21:34:25 LOG6[5293:140430154827520]: CERT: Verification not enabled 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Certificate accepted: depth=0, /CN=*.greenbuttonalliance.org 2016.11.14 21:34:25 LOG6[5293:140430154827520]: SSL connected: new session negotiated 2016.11.14 21:34:25 LOG6[5293:140430154827520]: Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) 2016.11.14 21:34:25 LOG6[5293:140430154827520]: Compression: null, expansion: null 2016.11.14 21:34:45 LOG7[5293:140430154827520]: SSL closed on SSL_read 2016.11.14 21:34:45 LOG7[5293:140430154827520]: Sent socket write shutdown 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Socket closed on read 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Sending close_notify alert 2016.11.14 21:34:56 LOG6[5293:140430154827520]: SSL_shutdown successfully sent close_notify alert 2016.11.14 21:34:56 LOG5[5293:140430154827520]: Connection closed: 342 byte(s) sent to SSL, 250 byte(s) sent to socket 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Remote socket (FD=15) closed 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Local socket (FD=3) closed 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Service [resourceServer] finished (0 left) The stunnel.conf file contains the following configuration: ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** CApath = /etc/ssl/certs ; ************************************************************************** ; * Logging * ; ************************************************************************** debug = 7 output = /home/ubuntu/Git/energyos/OpenESPI-GreenButtonCMDTest/SOAPUI/stunnel.log ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ************************************************************************** ; * Resource Server * ; ************************************************************************** [resourceServer] accept=localhost:8080 connect=52.43.245.161:8443 ciphers=AES128-SHA client = yes cert=/etc/stunnel/stunnel.pem verify=0 [tpserver] accept=127.0.0.1:8444 connect=localhost:8081 cert=/etc/stunnel/stunnel.pem verify=0 client=no ciphers=AES128-SHA Are there any additional stunnel logging options or debugging techniques you can recommend to help determine why the session is being closed? Does stunnel support wildcard based certificates (i.e. *.greenbuttonalliance.org)? Best regards, Don Donald F. Coffin Technical Manager Green Button Alliance 2335 Dunwoody Crossing Suite E Dunwoody, GA 30338-8221 http://www.greenbuttonalliance.org <http://www.greenbuttonalliance.org/> (949) 636-8571 Mobile

1 0

rpmbuild errors using stunnel.spec
by Wiest, Damian 07 Nov '16

07 Nov '16

I noticed a few issues with the stunnel.spec file included with the distribution that I wanted to report. I'm building on an Amazon Linux host. There appears to be a bad date entry in the changelog section, warning: bogus date in %changelog: Sun Jun 24 2000 Brian Hatch <bri(a)stunnel.org> Sunday is the 25th? The stunnel.init and stunnel.logrotate files are being installed from the rpmbuild/SOURCES/ directory and not rpmbuild/BUILD/stunnel-5.37/tools/. Copying the files from the build area and retrying resolves this. stunnel.spec:Source1: %{name}.init stunnel.spec:Source2: %{name}.logrotate ... stunnel.spec:%{__install} -p -m0755 %{SOURCE1} $RPM_BUILD_ROOT%{_initrddir}/%{name} stunnel.spec:%{__install} -p -m0644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/%{name} + /usr/bin/install -p -m0755 /home/ec2-user/rpmbuild/SOURCES/stunnel.init /home/ec2-user/rpmbuild/BUILDROOT/stunnel-5.37-1.amzn1.x86_64/etc/rc.d/init.d/stunnel /usr/bin/install: cannot stat '/home/ec2-user/rpmbuild/SOURCES/stunnel.init': No such file or directory + /usr/bin/install -p -m0644 /home/ec2-user/rpmbuild/SOURCES/stunnel.logrotate /home/ec2-user/rpmbuild/BUILDROOT/stunnel-5.37-1.amzn1.x86_64/etc/logrotate.d/stunnel /usr/bin/install: cannot stat '/home/ec2-user/rpmbuild/SOURCES/stunnel.logrotate': No such file or directory rpmbuild also complains that the files under /usr/share/doc/stunnel/ are unpackaged. I added %{_docdir}/* at the end of the files section to correct this. -Damian -- Confidentiality Notice: This e-mail transmission may contain confidential or legally privileged information that is intended only for the individual or entity named in the e-mail address. If you have received this communication in error, please notify me by return e-mail, and destroy this communication and all copies thereof, including any attachments. Apervita ® is a registered trademark of Apervita Inc.

1 0

Bulk Requests - Stunnel throwing exceptions
by Lakshmi Narayana Lanka 03 Nov '16

03 Nov '16

Hello, I'm using Stunnel infront of a TCP/IP connection. When we receive bulk requests simultaneously it starts throwing exceptions. Is it something by design with Stunnel? -- Thanks & Regards, Lakshmi N Lanka

2 4

Use SNI
by Benjamin Hartwich 31 Oct '16

31 Oct '16

Hi, I´ve found the SNI parameter at stunnel, but it doesn´t work at my Ubuntu 16.04. My goal is, to use one dfn cert for the stunnel cert, which has 4 hostnames. This cert is on both servers. At the client server this cert works, because at the cert this is first hostname. At the second server I use the same cert, but it can´t be verified, because stunnel doesn´t recognize the correct hostname from the cert. Can anyone send me an example for a working SNI configuration? My Configs: Server one: client = yes cert = /etc/stunnel/cert.pem service = test debug = debug output = /var/log/stunnel4/stunnel.log foreground = no sslVersion = TLSv1 options = NO_SSLv3 options = NO_SSLv2 CAfile = /etc/ssl/web/chain.pem verify = 2 socket = r:TCP_NODELAY=1 [app1] accept = localhost:8090 connect = 10.1.2.1:8085´ ----- Server 2 (fails): client = no cert = /etc/stunnel/cert.pem service = test debug = debug output = /var/log/stunnel4/stunnel.log sslVersion = TLSv1 options = NO_SSLv3 options = NO_SSLv2 foreground = no CAfile = /etc/ssl/web/chain.pem verify = 2 socket = l:TCP_NODELAY=1 [ajp] accept = 8085 connect = 127.0.0.1:8009 --- Error: 2016.10.31 15:01:40 LOG7[9]: SNI: no virtual services defined 2016.10.31 15:01:40 LOG4[9]: CERT: Pre-verification error: unsupported certificate purpose Regards, Benjamin Hartwich Referat Basisdienste Zentrum für Informationstechnologie und Medienmanagement Universität Passau Innstr. 33, 94032 Passau Telefon +49 (0)851/509-3285, Telefax +49 (0)851/509-1802 E-Mail: benjamin.hartwich(a)uni-passau.de

1 0

Running Stunnel 5.23 as multiple windows services
by David Jones 25 Oct '16

25 Oct '16

Hi, I'm trying to run stunnel as a windows service. I have used the stunnel -install and one service has successfully been setup. We now have a need to run a second instance of stunnel and so that we are able to stop/start this instance and not affect the connectivity of the other one we would like to install it as a separate service. On an older version of stunnel we simply named the stunnel.exe differently and it ran both services separately. But with 5.23 it is not allowing us to do so. Coming up the error "CreateService: error 1073: The specified service already exists". I've tried adding service = into the .conf file and also using service= on the command line for the install but nothing works. So what have I missed? Thanks David Config: Service = Stunnel_TLS_Generic CApath = ./ debug=7 #debug = 1 output = TLS_Generic.log # Use it for client mode client = yes # Service-level configuration [Service_Name] options = NO_SSLv2 options = NO_SSLv3 sslVersion = TLSv1 accept = 20002 connect = URLtoserver:443

1 0