stunnel-users

1 participants
3311 discussions

HTTPS support for the webserver using STUNNEL
by Siva Kumar 13 Jan '15

13 Jan '15

Hi All, I am fairly new to stunnel and also to the networking concepts. Currently we are working on a surveillance device running on monta vista linux on the ARM11 architecture. We have crossed compiled and deployed a THTTPD server which is working fine. Once you connect to the device using any of the web client (from a windows PC), it will take you to a web page where you can select and stream live video's from all the camera's connected to the device. So far everything is working fine now.. Now the real problem is that we need to support https as well along with http. Since THTTPD web server doesn't support secure connection we thought we would accomplish that using the stunnel application. We were able to download and cross compile the stunnel application for the device. Now the doubts I have here is:- 1) Do we need a stunnel server application running on the windows PC from where we will be using the web browser to connect to the client? 2) Where should be the stunnel server and stunnel client be running. I mean should the linux device be running the stunnel client and the windows PC be running the stunnel server? In that case what should be the correct accept and connect parameters in the stunnel.conf file in both the device and the windows PC? 3) Since the device and the machine can have any random IP and port, so is it feasible to dynamically set the accept and connect parameters in the stunnel.conf file? 4) Can the stunnel be considered as a solution to the problem which I have reported here. The point 3 above makes me thing otherwise. I have tried all combinations mentioned in the point 1 and 2 without success. In none of the case my web browser was able to talk to the device using HTTPS (ie https://my_device_ip). I could see a "client hello" request from the browser to which the client sends an ACK and RST. In some combination an HTTPS request from the browser only triggered a TCP connection request for which the client responded with ACK and RST. Sorry for the long mail. Any inputs would be deeply appreciated. Regards, Siva

2 2

Using stunnel to secure clients instead of servers
by Leon Smith 07 Jan '15

07 Jan '15

Hi, this may be a slightly unusual request, but I was curious if stunnel could be used for securing clients that do not support TLS, to connect to services that optionally support TLS. So, really, stunnel already does almost everything that would be needed; except that in this use case, it would be listening for incoming unencrypted connections, and then serve as a proxy to an encrypted connection to the actual service. While it might be nice to offer certificate-based authentication options in this scenario, it wouldn't be necessary for my intended use case, so stunnel wouldn't need access to any private certificates. However, certificate pinning would be pretty essential to what I have in mind. Best, Leon.

2 5

stunnel 5.09 released
by Michal Trojnara 02 Jan '15

02 Jan '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.09 of stunnel. The ChangeLog entry: Version 5.09, 2015.01.02, urgency: LOW: * New features - Added PSK authentication with two new service-level configuration file options "PSKsecrets" and "PSKidentity". - Added additional security checks to the OpenSSL memory management functions. - Added support for the OPENSSL_NO_OCSP and OPENSSL_NO_ENGINE OpenSSL configuration flags. - Added compatibility with the current OpenSSL 1.1.0-dev tree. * Bugfixes - Removed defective s_poll_error() code occasionally causing connections to be prematurely closed (truncated). This bug was introduced in stunnel 4.34. - Fixed ./configure systemd detection (thx to Kip Walraven). - Fixed ./configure sysroot detection (thx to Kip Walraven). - Fixed compilation against old versions of OpenSSL. - Removed outdated French manual page. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 87b34a74061861d1edd2ab238c73eb989b3d0a17e44574b7b6ead1a16aae38c8 stunnel-5.09.tar.gz 4abbddf3c1dbedf54b14fa5a18ead11e4df6387f13189b665c2ec5759c4afd30 stunnel-5.09-installer.exe 23c33dc46cc1bfb1df77c88d3c48901822bc113dd1e67d138bcf5fb1bb3d4197 stunnel-5.09-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlSmt98ACgkQ/NU+nXTHMtGZowCfTspj4OZn8DRBUboG2S+1Qy2A ocoAoLdZpjJU7BjERXqQakhNIPOXFojN =/MD9 -----END PGP SIGNATURE-----

1 0

help with xforwarded-for
by Senthil Naidu 30 Dec '14

30 Dec '14

Hi, I am trying to use stunnel 5.08 can we enable xforwarded-for option using some patches , the last patch I see is in haproxy website for version stunnel version 4.32 Regards Senthil

2 1

SSL alert (read): warning: close notify
by Jinming Shao 22 Dec '14

22 Dec '14

I am trying to use stunnel to turn ws into wss. Stunnel is running in client mode. It always got disconnected from remote server. my stunnel configuration: [websocket] client = yes accept = localhost:8676 connect = echo.websocket.org:443 Then I use wsdump.py(https://github.com/liris/websocket-client) to connect it: $ wsdump.py ws://localhost:8676 Handshake status 40 Does anyone know what's wrong? The log file: 2014.12.22 23:13:01 LOG7[4445147136]: Service [websocket] started 2014.12.22 23:13:01 LOG5[4445147136]: Service [websocket] accepted connection from ::1:52132 2014.12.22 23:13:01 LOG6[4445147136]: s_connect: connecting 174.129.224.73:443 2014.12.22 23:13:01 LOG7[4445147136]: s_connect: s_poll_wait 174.129.224.73:443: waiting 10 seconds 2014.12.22 23:13:02 LOG5[4445147136]: s_connect: connected 174.129.224.73:443 2014.12.22 23:13:02 LOG5[4445147136]: Service [websocket] connected remote server from 192.168.1.100:52133 2014.12.22 23:13:02 LOG7[4445147136]: Remote socket (FD=10) initialized 2014.12.22 23:13:02 LOG6[4445147136]: SNI: sending servername: echo.websocket.org 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): before/connect initialization 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write client hello A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read server hello A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read server certificate A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read server done A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write client key exchange A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write change cipher spec A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write finished A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 flush data 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read finished A 2014.12.22 23:13:02 LOG7[4445147136]: 1 items in the session cache 2014.12.22 23:13:02 LOG7[4445147136]: 1 client connects (SSL_connect()) 2014.12.22 23:13:02 LOG7[4445147136]: 1 client connects that finished 2014.12.22 23:13:02 LOG7[4445147136]: 0 client renegotiations requested 2014.12.22 23:13:02 LOG7[4445147136]: 0 server connects (SSL_accept()) 2014.12.22 23:13:02 LOG7[4445147136]: 0 server connects that finished 2014.12.22 23:13:02 LOG7[4445147136]: 0 server renegotiations requested 2014.12.22 23:13:02 LOG7[4445147136]: 0 session cache hits 2014.12.22 23:13:02 LOG7[4445147136]: 0 external session cache hits 2014.12.22 23:13:02 LOG7[4445147136]: 0 session cache misses 2014.12.22 23:13:02 LOG7[4445147136]: 0 session cache timeouts 2014.12.22 23:13:02 LOG7[4445147136]: Peer certificate was cached (6641 bytes) 2014.12.22 23:13:02 LOG6[4445147136]: SSL connected: new session negotiated 2014.12.22 23:13:02 LOG6[4445147136]: Negotiated TLSv1/SSLv3 ciphersuite: RC4-SHA (128-bit encryption) 2014.12.22 23:13:02 LOG6[4445147136]: Compression: null, expansion: null 2014.12.22 23:13:03 LOG7[4445147136]: SSL alert (read): warning: close notify 2014.12.22 23:13:03 LOG6[4445147136]: SSL closed (SSL_read) 2014.12.22 23:13:03 LOG7[4445147136]: Sent socket write shutdown 2014.12.22 23:13:03 LOG6[4445147136]: Read socket closed (readsocket) 2014.12.22 23:13:03 LOG7[4445147136]: Sending close_notify alert 2014.12.22 23:13:03 LOG7[4445147136]: SSL alert (write): warning: close notify 2014.12.22 23:13:03 LOG6[4445147136]: SSL_shutdown successfully sent close_notify alert 2014.12.22 23:13:03 LOG5[4445147136]: Connection closed: 184 byte(s) sent to SSL, 132 byte(s) sent to socket 2014.12.22 23:13:03 LOG7[4445147136]: Remote socket (FD=10) closed 2014.12.22 23:13:03 LOG7[4445147136]: Local socket (FD=3) closed 2014.12.22 23:13:03 LOG7[4445147136]: Service [websocket] finished (0 left) 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 3 block(s), 18446744073709549504 data byte(s), 222 control byte(s) 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 128 byte(s) at network.c:413 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 128 byte(s) at network.c:412 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 128 byte(s) at network.c:41

1 0

RHEL6 Update stunnel-4.29-3.el6_6.1 breaks functionality?
by H.U.Flück 21 Dec '14

21 Dec '14

Hello I realized that the latest RHEL6 updates including stunnel-4.29-3.el6_6.1 break our Stunnel connections! We are forced to go back to previous version stunnel-4.29-3.el6_4 in order to have the systems running again, and blocking Stunnel updates in /etc/yum.conf for the moment. Our typical client config and server configs are as follows: Client (5.08): ********** client = yes compression = zlib sslversion = TLSv1 delay = yes debug = 7 taskbar = yes cert = my.pem [abas_ssh] accept = 127.0.30.10:5303 connect = firewall.client.dom:5303 Server, xinetd.d: ************* service stunnel_ssh { disable = no socket_type = stream instances = UNLIMITED per_source = UNLIMITED wait = no user = root server = /usr/bin/stunnel server_args = /etc/stunnel/stunnel_ssh.conf log_on_success += HOST DURATION log_on_failure += HOST } Server, stunnel_ssh.conf **************** cert = /support/stunnel/cert/server.pem CApath = / support /stunnel/hash/ verify = 3 debug = 7 connect = 192.168.1.100:22 The error thrown is something like: Dec 17 17:30:23 srvabas stunnel: LOG3[3385:140171595282368]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol What are we missing? Do we need to change the configuration? Any help is highly appreciated. Kind regards H.U.Flueck

4 3

Ordinal not found error on new Stunnel install
by Tracy Drake - IQ-C 15 Dec '14

15 Dec '14

Hello Michal! We have just pushed/began to push Stunnel version 5.04 to our user community. This version was extensively tested, pushed/installed on a number of machines both with an older version of Stunnel and no Stunnel at all. We are having a barrage of users encountering the below error. [image: Inline image 1] Can you offer insight/a quick resolution? Bear in mind that although I support the apps that require Stunnel I know very little about the ins and outs of Stunnel. I did google this error and found something to the effect that a newer version of the LIBEAY32.dll is required. Does this perhaps mean that this file did not get replaced on these machines. We were previously running quite an older version - 4.27. Please advise asap! -- Tracy Drake CSM Senior Consultant GSA-FAS CAMEO Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

2 1

building stunnel in FreeBSD
by Mirimir 12 Dec '14

12 Dec '14

In building the stunnel package from the port in FreeBSD 10.1, is it more secure to enable SSL_PORT? In particular, will that ensure that stunnel is using the latest openssl release? And if that is so, why is that build option disabled by default?

1 0

Stunnel PSK authentication
by Michal Trojnara 11 Dec '14

11 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Starting with stunnel-5.09b1 it is now possible to use stunnel without certificates. https://www.stunnel.org/downloads.html Example server configuration is: [PSK server] accept = <stunnel_port> connect = <dst_port> PSKsecrets = psk.txt , where the psk.txt may contain the following lines: test1:oaP4EishaeSaishei6rio6xeeph3az test2:yah5uS4aijooxilier8iaphuwah1Lo Example client configuration: [PSK client 1] client = yes accept = 127.0.0.1:<src_port> connect = <stunnel_ip>:<stunnel_port> PSKsecrets = psk1.txt PSKidentity = test1 The psk1.txt file only needs to contain: test1:oaP4EishaeSaishei6rio6xeeph3az Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlSKHNMACgkQ/NU+nXTHMtE72wCg/EZp4NdVnkrQFffGVWZO65lE QucAn3ddp+yTDruP+gNkevf///0olb1+ =o0k3 -----END PGP SIGNATURE-----

1 0

configure.ac patch
by Kip Walraven 11 Dec '14

11 Dec '14

In case others are struggling with CentOS 6.5 configure issues that I had, I'm providing the following unified diff patch -Kip #============================================== --- ../stunnel-5.08/configure.ac 2014-12-03 05:35:16.000000000 -0500 +++ ./configure.ac 2014-12-11 10:32:47.000000000 -0500 @@ -402,13 +402,13 @@ AC_MSG_RESULT([autodetecting]) # the library name has changed to -lsystemd in systemd 209 AC_SEARCH_LIBS([sd_listen_fds], [systemd systemd-daemon], - AC_CHECK_HEADERS([systemd/sd-daemon.h], [ + [ AC_CHECK_HEADERS([systemd/sd-daemon.h], [ AC_DEFINE([USE_SYSTEMD], [1], [Define to 1 to enable systemd socket activation]) AC_MSG_NOTICE([systemd support enabled]) ], [ AC_MSG_NOTICE([systemd header not found]) - ]), [ + ]) ], [ AC_MSG_NOTICE([systemd library not found]) ]) ] @@ -462,7 +462,8 @@ AC_MSG_CHECKING([for compiler sysroot]) if test "$GCC" = yes; then SYSROOT=`$CC --print-sysroot 2>/dev/null` -else +fi +if test -z "$SYSROOT" ; then SYSROOT="/" fi AC_MSG_RESULT([$SYSROOT]) #==============================================

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users