stunnel-users

3 participants
3308 discussions

fips=no
by dominic.schweizer＠zkb.ch 18 Feb '11

18 Feb '11

Hi All, I have the problem that when I start Stunnel, the following error pops up: FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match I now added in my config file: fips=no and it works. My question is now, what is the difference between with fips and without fips? stunnel version 4.34 openssl 0.9.8 redhat 5 Thanks in advance for the answer Regards Dominic Freundliche Grüsse Dominic Schweizer Zürcher Kantonalbank Unix System Engineer, LIOEU Neue Hard 9, 8005 Zürich Telefon 044 292 83 52, Fax 044 292 80 34 Briefadresse: Postfach 8010 Zürich, http://www.zkb.ch Sie drucken dieses E-Mail nicht aus? Die Umwelt dankt! ___________________________________________________________________ Disclaimer : Diese Mitteilung ist nur fuer die Empfaengerin / den Empfaenger bestimmt. Fuer den Fall, dass sie von nichtberechtigten Personen empfangen wird, bitten wir diese hoeflich, die Mitteilung an die ZKB zurueckzusenden und anschliessend die Mitteilung mit allen Anhaengen sowie allfaellige Kopien zu vernichten bzw. zu loeschen. Der Gebrauch der Information ist verboten. This message is intended only for the named recipient and may contain confidential or privileged information. If you have received it in error, please advise the sender by return e-mail and delete this message and any attachments. Any unauthorised use or dissemination of this information is strictly prohibited.

2 1

openvpn with stunnel
by Guy Sapir 17 Feb '11

17 Feb '11

Hi all, Is it possible to use openvpn on port 80 or 443 using stunnel so the packets on openvpn will be wrapped as http or https pure packets. What should I do in the config file. Guy Sapir

2 1

Wireshark didn't show TLSv1 traffic?
by Bao, Robert 17 Feb '11

17 Feb '11

Hi, I have "ciphers = AES256-SHA" option in stunnel.conf file. And when the server/client established the connection, I see this line in the log file: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 However when I use Wireshark to sniff the traffic, I only see "TCP" in the <Protocol> column for the traffics between the server and the client. Is this normal? What did I do wrong? Thanks. Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

2 2

key+cert+dh risks
by Jean-Yves F. Barbier 15 Feb '11

15 Feb '11

Hi list, I'm using stunnel between two machines only, so is there a risk to reuse the server stunnel.pem on the client? (and if it's risky, why?) JY -- Have a coke and a smile! -- John DeLorean

3 6

Confusion regarding part of stunnel.conf
by Dave 12 Feb '11

12 Feb '11

I've set up a test of stunnel with the latest stunnel and latest openssl, and if I set "verify=0" or "verify=1" I can get it to work (I'm tunneling a pop3 session), but if I set it any higher (to 2 or 3) it won't work for me. Now, I'm not sure which level is "necessary" because in stunnel.conf I read: ------------------------- ; authentication stuff needs to be configured to prevent MITM attacks ; it is not enabled by default! ;verify = 2 ------------------------- ... which sounds like verify defaults to 0. But is a verify level of 1 enough to solve the man-in-the-middle problem? It seems like it would not be (since level 1 will allow absence of a certificate), but I am not sure. I guess my questions boil down to: 1) What are the necessary settings for "authentication stuff" to prevent the MITM attack vector mentioned in stunnel.conf? 2) What is the proper way to set up (self-signed) certs to prevent such an attack? Can a self-signed cert be used at a verify level of 2 or 3? Dave

2 11

[patch] Unix socket support for Stunnel
by Stefan Behte 11 Feb '11

11 Feb '11

Hi, yet another request for a patch inclusion... Quoting from http://haproxy.1wt.eu/#down : "This patch contributed by Exceliance adds to stunnel the ability to connect to haproxy over a UNIX stream socket instead of using TCP. Sometimes this can be more convenient and/or more secure. " I think it would be nice to have it upstream. And I hope I am not bothering Michals yet. ;) Best regards, Stefan Behte

1 0

Security Problems with 4.35
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, in the announcement of 4.35, I saw: "CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments." I searched a bit, but did not find an exploit or more information on the severity of this issue. Could someone elaborate the problem a bit? I could diff to the previous version and have a look, but that will take quite some time, and my C is weak... Best regards, Stefan Behte

2 1

use somaxconn in stunnel
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, attached you will find a patch from Thomas Franco to honor SOMAXCONN. It defaults to 128, which is not enough for some setups. It defines the maximum number of requests that can be queued to a listening socket and can be changed with sysctl via net.core.somaxconn. I think it would be nice to have it in stunnel-4.36 to make it usable in bigger installations. It's available online here: https://github.com/op4g/stunnel/commit/e200bebaf92c068aa319c43fdd50cddd6816… Best regards, Stefan Behte

2 4

publish/subscribe with stunnel
by Dam Dam 10 Feb '11

10 Feb '11

Hello, I am having a problem to configure stunnel in a publish/subscribe architecture. Basically, I have a publisher service configured with stunnel as a server. Its configuration is close to: [publisher] accept = p1 connect = 127.0.0.1:p2 This service publishes data to a subscriber. As far I as understood, the subscriber should be configured as a client with stunnel with a configuration close to this: [subscriber] accept = p3 connect = remote:p1 client = yes Now, my problem is that the subscriber does not listen on any port. So p3 does not actually exist. When the subscriber starts, it automatically connects and subscribes to the publisher and waits for data from the publisher service. I would like to secure the connection between the publisher and the subscriber but I am stuck with the configuration. Any ideas? Regards, Damien

2 1

stunnel, haproxy and ssl cert
by Amol 10 Feb '11

10 Feb '11

i got the SSL setup done with the stunnel, but when i connect from the url i always see this entry in my stunnel.log 2011.02.09 14:52:34 LOG3[2433:139832543721216]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing my stunnel config is cert=/etc/stunnel/ssl/group-cert.pem key = /etc/stunnel/ssl/l.key ;setuid = nobody ;setgid = nogroup pid = /etc/stunnel/stunnel.pid debug = 3 output = /etc/stunnel/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=443 connect=80 TIMEOUTclose=0 xforwardedfor=yes i have just got familiar to stunnel to not sure i that error is ok?

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users