- stunnel-users - stunnel.org

chroot jail on debian 11 for stunnel steps?
by trashrap22＠gmail.com 11 May '23

11 May '23

Does someone have all the steps in order to setup a chroot jail on debian 11 OS - I have followed [this](https://manpages.debian.org/testing/stunnel4/stunnel.8.en.html) mostly - but think I am going to miss some differences to Debian 11 and go down a rabbit hole. Anyone have done it on Debian 11 care to share the steps?

3 3

Re: stunnel not starting
by Christopher Schultz 10 May '23

10 May '23

Hello, On 5/10/23 00:28, d3rIIIe15ter Tier wrote: > Please advise why you strongly advise running stunnel in a chroot jail? Because: 1. It's insanely easy to do (it literally IS just "chroot=/path/to/jail") and 2. If there is a problem with stunnel (e.g. security issue), the amount of damage an attacker can do is significantly limited -chris > On Tue, May 9, 2023 at 5:59 PM Christopher Schultz > <chris(a)christopherschultz.net <mailto:[email protected]>> wrote: > > Hello, > > On 5/9/23 11:13, d3rIIIe15ter Tier wrote: > > After giving access to var/log/secure/stunnel.log, I now get logs! > > > > There I get the following error: > > > > Cannot create pid file /var/run/stunnel4.pid > > create: Permission denied (13) > > What is the euid of the stunnel process? Does it have access to that > path? Are you using a chroot jail? (You should be.) Does that path > exist > in the chroot jail? Can the stunnel user write to that path? > > -chris > > > On Tue, May 9, 2023 at 4:34 PM d3rIIIe15ter Tier > <trashrap22(a)gmail.com <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>>> wrote: > > > > You are right... bad mistake. > > > > Now I get: cannot open log file - which I am sure is a > permission > > thing since I need to use sudo to be able to write to that file. > > Any ideas further? > > > > On Tue, May 9, 2023 at 4:21 PM Christopher Schultz > > <chris(a)christopherschultz.net > <mailto:[email protected]> > <mailto:[email protected] > <mailto:[email protected]>>> > > wrote: > > > > Hello, > > > > On 5/9/23 10:17, d3rIIIe15ter Tier wrote: > > > I have tried changing the location to > > > > > > var/log/stunnel4/stunnel.log > > > var/log/stunnel4/stunnelLog > > > var/log/secure/ > > > var/log/secure/stunnel.log > > > etc/stunnel/stunnel.log > > > etc/stunnel/stunnelLog > > > > > > don't know how to fix it yet... > > I don't think the *value* is the problem. The problem is that > > you have > > defined "output" somewhere that isn't valid, such as within a > > specific > > service's section instead of as a global setting. > > > > -chris > > > > > On Tue, May 9, 2023 at 3:54 PM Christopher Schultz > > > <chris(a)christopherschultz.net > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>>> wrote: > > > > > > Hello, > > > > > > On 5/9/23 09:40, trashrap22(a)gmail.com > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>>> > > > wrote: > > > > Hi, I am on Debian - when I run "sudo stunnel > > stunnel.conf" I > > > get the following output: > > > > > > > > [ ] Clients allowed=500 > > > > [.] stunnel 5.56 on x86_64-pc-linux-gnu platform > > > > [.] Compiled with OpenSSL 1.1.1k 25 Mar 2021 > > > > [.] Running with OpenSSL 1.1.1n 15 Mar 2022 > > > > [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD > > > TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP > > > > [ ] errno: (*__errno_location ()) > > > > [.] Reading configuration from file > > /etc/stunnel/stunnel.conf > > > > [.] UTF-8 byte order mark not detected > > > > [.] FIPS mode disabled > > > > [ ] Compression disabled > > > > [ ] No PRNG seeding was required > > > > [!] /etc/stunnel/stunnel.conf:24: "output = > > /tmp/stunnel.log": > > > Specified option name is not valid here > > > > [ ] Deallocating section defaults > > > > > > > > When I run "sudo netstat -tulnp | grep -i > stunnel" I > > also get no > > > output - which means that stunnel is not starting up? > > > > > > The log message seems pretty specific to me. Maybe you > > should fix that? > > > > > > -chris > > > _______________________________________________ > > > stunnel-users mailing list -- > stunnel-users(a)stunnel.org <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > To unsubscribe send an email to > > stunnel-users-leave(a)stunnel.org > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > > > _______________________________________________ > > stunnel-users mailing list -- stunnel-users(a)stunnel.org > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > To unsubscribe send an email to > stunnel-users-leave(a)stunnel.org <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > _______________________________________________ > stunnel-users mailing list -- stunnel-users(a)stunnel.org > <mailto:[email protected]> > To unsubscribe send an email to stunnel-users-leave(a)stunnel.org > <mailto:[email protected]> >

1 0

stunnel not starting
by trashrap22＠gmail.com 09 May '23

09 May '23

Hi, I am on Debian - when I run "sudo stunnel stunnel.conf" I get the following output: [ ] Clients allowed=500 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled with OpenSSL 1.1.1k 25 Mar 2021 [.] Running with OpenSSL 1.1.1n 15 Mar 2022 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [!] /etc/stunnel/stunnel.conf:24: "output = /tmp/stunnel.log": Specified option name is not valid here [ ] Deallocating section defaults When I run "sudo netstat -tulnp | grep -i stunnel" I also get no output - which means that stunnel is not starting up?

4 7

Update newest version
by sportman7＠netzero.com 05 May '23

05 May '23

Have used Stunnel for years. To update I normally download the latest version and copy the files (DLL, exe, etc.) to my client's computers. But I tried this with latest update and I must be missing something as my app is not able to use this version. Went back to previous version but really need to know how to deliver the update to a client's computer. Thanks for any ideas on this.

2 2

stunnel and Google LDAP
by matt.colwell＠sduhsd.net 01 May '23

01 May '23

Hi, I'm trying to setup stunnel as a proxy to Google Workplace's LDAP service. I followed the instructions located here: https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3… I've set the up on Ubuntu 22.04.2 LTS When attempting to connect I get the following error: SSL_read: ../ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading Connection reset: 217 byte(s) sent to TLS, 164 byte(s) sent to socket What might be my issue here? thanks

1 0

error starting / restarting /etc/init.d/stunnel4 on debian
by trashrap22＠gmail.com 28 Apr '23

28 Apr '23

Hi, I am not getting any stunnel logs. Though my syslog gives me the info below. The stunnel4 file in /usr/bin/ is empty? Apr 28 15:18:01 User-Linux systemd[1]: Starting LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)... Apr 28 15:18:01 User-Linux stunnel4[30850]: Starting TLS tunnels: /etc/stunnel/stunnel.conf: Apr 28 15:18:01 User-Linux stunnel4[30864]: /sbin/start-stop-daemon: unable to start /usr/bin/stunnel4 (Exec format error) Apr 28 15:18:01 User-Linux stunnel4[30850]: failed Apr 28 15:18:01 User-Linux stunnel4[30850]: You should check that you have specified the pid= in you configuration file

4 4

Is there installing instructions for Stunnel on Debian ?
by trashrap22＠gmail.com 26 Apr '23

26 Apr '23

Hi, I don't see installing instructions for Linux or rather for Debian specifically anywhere ?

4 4

FW: Help with disabling SSLv3
by Eberhard 14 Mar '23

14 Mar '23

Actually I think the SSLv3 in the log is a lie - as this is also in the log just before the below: TLS state (connect): before/connect initialization TLS state (connect): SSLv3 write client hello A TLS state (connect): SSLv3 read server hello A So I am thinking the eliptic curve stuff is more likely the issue? Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 _____________________________________________ From: Eberhard <flash(a)vicsmba.com> Sent: Tuesday, March 14, 2023 9:15 AM To: 'stunnel-users(a)stunnel.org' <stunnel-users(a)stunnel.org> Subject: Help with disabling SSLv3 Importance: High I am suddenly getting errors from Fedex: TLS state (connect): SSLv3 read server certificate A error queue: 1408D010: error:1408D010:SSL routines:ssl3_get_key_exchange:EC lib error queue: 100AE081: error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group error queue: 100AF003: error:100AF003:elliptic curve routines:EC_GROUP_NEW_FROM_DATA:BN lib SSL_connect: 3078072: error:03078072:bignum routines:BN_EXPAND_INTERNAL:bignum too long My .conf file says: output = /tmp/fedex.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ws.fedex.com:443 ;connect = gateway.fedex.com:443 ;connect = wssha1ends12172016.fedex.com:443 sslVersion = TLSv1.2 options = NO_SSLv3 sslVersionMin = TLSv1.2 CAfile = /usr/local/ssl/certs/cacert.pem It is a very old version of stunnel but I cannot upgrade as this is a 15 year old AIX (IBM) computer stunnel 5.44 on powerpc-ibm-aix4.3.3.0 platform Compiled/running with OpenSSL 1.0.2 22 Jan 2015 Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI Invalid configuration file name "--version" realpath: No such file or directory (2) Yet the log implies I am still trying SSLv3. Any ideas? Thanks in advance. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115

2 1

Help with disabling SSLv3
by Eberhard 14 Mar '23

14 Mar '23

I am suddenly getting errors from Fedex: TLS state (connect): SSLv3 read server certificate A error queue: 1408D010: error:1408D010:SSL routines:ssl3_get_key_exchange:EC lib error queue: 100AE081: error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group error queue: 100AF003: error:100AF003:elliptic curve routines:EC_GROUP_NEW_FROM_DATA:BN lib SSL_connect: 3078072: error:03078072:bignum routines:BN_EXPAND_INTERNAL:bignum too long My .conf file says: output = /tmp/fedex.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ws.fedex.com:443 ;connect = gateway.fedex.com:443 ;connect = wssha1ends12172016.fedex.com:443 sslVersion = TLSv1.2 options = NO_SSLv3 sslVersionMin = TLSv1.2 CAfile = /usr/local/ssl/certs/cacert.pem It is a very old version of stunnel but I cannot upgrade as this is a 15 year old AIX (IBM) computer stunnel 5.44 on powerpc-ibm-aix4.3.3.0 platform Compiled/running with OpenSSL 1.0.2 22 Jan 2015 Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI Invalid configuration file name "--version" realpath: No such file or directory (2) Yet the log implies I am still trying SSLv3. Any ideas? Thanks in advance. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115

1 0

Stunnel Installation.
by nathan.king＠unpredictableporridge.co.uk 12 Mar '23

12 Mar '23

Hello, New stunnel user here - or trying to ne! I manage a streaming service using both SHOUT and Icecast servers, on a Widows 10 platform. Have been hit by the update to the G/Chrome browser, and while the Website is secure, the streams are not. There is limited support for S.S.L. for Icecast, but none for SHOUTcast. Was recommended to use S.S.L., but apparently the OpenSSL library isn't downloaded for Widows, only Linux, so have tried using Debian 11, which have installed within VirtualBox. However, have had no luck making the connection. Happened to read in another tutorial that if stunnel isn't installed on the same Computer, as the Playout system and encoder - use B.U.T.T., and Sound Empire Caster - one has to have stunnel installed on both Computers? Is the above true? EIther way,, would appreciate some advice on how to resolve this issue, and am new to stunnel, and only a basic knowledge of Debian. Thanks for your help with this issue. Cheers.

3 8