- stunnel-users - stunnel.org

Re: [stunnel-users] OpenSSL Vulnerabilities
by Cal Webster 09 Apr '09

09 Apr '09

Thank you Guy! I'll try the Win32 binaries and SSL libraries on a test machine. Do these SSL libraries still require "MSVCR90.dll" from the "Visual C++ Redistributables"? I appreciate the swift response. :-) ./Cal On Tue, 2009-04-07 at 19:34 -0500, Guy wrote: > Cal Webster wrote: > > > To update the OpenSSL libraries you must download and... > > > > > Find OpenSSL v.0.9.8k bins and stunnel-4.27b2-installer > (which includes OpenSSL v.0.9.8k DLLs) at: > > <ftp://stunnel.mirt.net/stunnel> >

1 0

OpenSSL Vulnerabilities
by Cal Webster 07 Apr '09

07 Apr '09

Will there be a security update of stunnel to address vulnerabilities outlined in CVE-2009-0590, CVE-2009-0591, and CVE-2009-0789? Alternatively, will stunnel use updated OpenSSL libraries on the host? It appears that this is true on Fedora RPM packages. For Example: ldd stunnel: ------------ libssl.so.7 => /lib64/libssl.so.7 (0x0000000006a3c000) libcrypto.so.7 => /lib64/libcrypto.so.7 (0x0000000007954000) ------------ rpm -q --requires stunnel ----------------------------------------- ... libcrypto.so.7 ... libssl.so.7 ... ----------------------------------------- rpm -ql openssl | egrep 'libcrypto.so.7|libssl.so.7' ----------------------------------------- /lib/libcrypto.so.7 /lib/libssl.so.7 ----------------------------------------- However, I don't know how to determine whether the same dependency works with Win32 dll's. For example, could we install "Win32 OpenSSL v0.9.8k Light" from the below link to resolve the vulnerabilities? http://www.slproweb.com/download/Win32OpenSSL_Light-0_9_8k.exe The description says that it "Installs the most commonly used essentials of Win32 OpenSSL v0.9.8k" but it doesn't say exactly what. Thanks for any insights or suggestions. Cal Webster

2 2

Re: [stunnel-users] Problem with name resolving when using delay option
by Michal Trojnara 06 Apr '09

06 Apr '09

Maksymilian Kowalik wrote: > So the workaround was as simple as creating etc directory inside chroot > and putting resolv.conf there. But still don't know whose bug it is > glibc's or stunnel's? It's not really a bug. It's rather an inherent property of chrooted environments. They often require some files and/or devices to work properly. Pozdrowienia z Polski, Mike

1 0

Re: [stunnel-users] Problem with name resolving when using delay option
by Aron Griffis 06 Apr '09

06 Apr '09

Maksymilian Kowalik wrote: [Mon Apr 06 2009, 08:56:02AM EDT] > So the workaround was as simple as creating etc directory > inside chroot and putting resolv.conf there. But still don't > know whose bug it is glibc's or stunnel's? Neither, it's your bug. :-) As you discovered, you need resolv.conf in the chroot. Aron

1 0

Updating OpenSSL used by stunnel
by Peter Droop 06 Apr '09

06 Apr '09

Hi, I am running stunnel 4.25 with openssl 0.9.8h on Windows 2003 Server. There are some security updates out for openssl, that are not available on stunnel.org. Can I update openssl by just replacing libeay32.dll and libssl32.dll in the stunnel installation directory? I downloaded the dlls from http://www.slproweb.com/products/Win32OpenSSL.html. Thanks, Peter

1 0

GPL patches
by Michal Trojnara 01 Apr '09

01 Apr '09

Dear Users, I've just uploaded some patches sent to stunnel-users list over the years to ftp://stunnel.mirt.net/stunnel/contrib/. Please remember my policy is *not* to include any GPL code into the official stunnel distribution. If you're brave you're free to apply the patches yourself, or even create a fork of stunnel with some additional functionality. Just be aware there were already some security vulnerabilities (including remote code execution) discovered in the 3rd party stunnel patches. For this reason I also don't recommend stunnel package/port maintainers to include any 3rd party code with stunnel. Best regards, Mike

1 0

Can't get NTLM authentication to work with proxy connect.
by Rudy Ghani 01 Apr '09

01 Apr '09

Hi there, My stunnel client is on an Active Directory-authenticated XP workstation, which needs to connect via a web proxy that authenticates using NTLM. I populated my login details in protocolUsername and protocolPassword, but the connection just dies when it reaches the proxy server. Looking at the log, I get the following:- 2009.04.01 08:20:39 LOG6[2140:2892]: SSL connected: new session negotiated 2009.04.01 08:20:39 LOG6[2140:2892]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.04.01 15:34:09 LOG7[2140:2708]: ssh3 accepted FD=356 from 127.0.0.1:1026 2009.04.01 15:34:09 LOG7[2140:2708]: Creating a new thread 2009.04.01 15:34:09 LOG7[2140:2708]: New thread created 2009.04.01 15:34:09 LOG7[2140:3896]: ssh3 started 2009.04.01 15:34:09 LOG7[2140:3896]: FD 356 in non-blocking mode 2009.04.01 15:34:09 LOG7[2140:3896]: TCP_NODELAY option set on local socket 2009.04.01 15:34:09 LOG5[2140:3896]: ssh3 accepted connection from 127.0.0.1:1026 2009.04.01 15:34:09 LOG7[2140:3896]: FD 472 in non-blocking mode 2009.04.01 15:34:09 LOG7[2140:3896]: ssh3 connecting 129.32.20.14:8080 2009.04.01 15:34:09 LOG7[2140:3896]: connect_wait: waiting 10 seconds 2009.04.01 15:34:09 LOG7[2140:3896]: connect_wait: connected 2009.04.01 15:34:09 LOG5[2140:3896]: ssh3 connected remote server from 130.32.82.203:1027 2009.04.01 15:34:09 LOG7[2140:3896]: Remote FD=472 initialized 2009.04.01 15:34:09 LOG7[2140:3896]: TCP_NODELAY option set on remote socket 2009.04.01 15:34:09 LOG5[2140:3896]: Negotiations for connect (client side) started 2009.04.01 15:34:09 LOG7[2140:3896]: -> CONNECT xxxx.ath.cx:443 HTTP/1.1 2009.04.01 15:34:09 LOG7[2140:3896]: -> Host: xxxx.ath.cx:443 2009.04.01 15:34:09 LOG7[2140:3896]: -> Proxy-Connection: keep-alive 2009.04.01 15:34:09 LOG7[2140:3896]: -> Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAA== 2009.04.01 15:34:09 LOG7[2140:3896]: -> 2009.04.01 15:34:09 LOG3[2140:3896]: Unexpected socket close (fdgetline) 2009.04.01 15:34:09 LOG5[2140:3896]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.04.01 15:34:09 LOG7[2140:3896]: ssh3 finished (1 left) If I decode the NTLM auth string, I only get the NTLMSSP header, which seems to be incomplete. If I recall correctly the domain and workstation info should be passed on as well. So question is, how do I get this to work? Is there any specific format that I need to use when using the protocol* settings for NTLM? Thanks and regards.

1 0

SSL CTX use RSA Private Key error
by G K 27 Mar '09

27 Mar '09

Hello all. I am trying to set up stunnel for use on my machine. I shouldn't have a problem with iptables. But I do run tor/privoxy on a regular basis if that matters. I also have set up my gpg keys too. The following is the error I get. I did do some Googling but I'm not quite understanding what I'm looking for to change or modify. I know the error is the SSL CTX RSA private key. Wed Mar 25, 19:39 # /etc/rc.d/stunnel start :: Starting stunnel [BUSY] 2009.03.25 19:39:21 LOG7[7490:3082353408]: Snagged 64 random bytes from /root/.rnd 2009.03.25 19:39:21 LOG7[7490:3082353408]: Wrote 1024 new random bytes to /root/.rnd 2009.03.25 19:39:21 LOG7[7490:3082353408]: RAND_status claims sufficient entropy for the PRNG 2009.03.25 19:39:21 LOG7[7490:3082353408]: PRNG seeded successfully 2009.03.25 19:39:21 LOG7[7490:3082353408]: Certificate: /etc/stunnel/mail.pem 2009.03.25 19:39:21 LOG7[7490:3082353408]: Certificate loaded 2009.03.25 19:39:21 LOG7[7490:3082353408]: Key file: /etc/stunnel/mail.pem 2009.03.25 19:39:21 LOG3[7490:3082353408]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2009.03.25 19:39:21 LOG3[7490:3082353408]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line stunnel 4.25-1 Linux vampypengy 2.6.28-ARCH #1 SMP PREEMPT Tue Mar 17 06:42:43 UTC 2009 i686 Genuine Intel(R) CPU T2060 @ 1.60GHz GenuineIntel GNU/Linux glibc 2.9-4 Using built-in specs. Target: i686-pc-linux-gnu Configured with: ../configure --prefix=/usr --enable-shared --enable-languages=c,c++,fortran,objc,obj-c++,treelang --enable-threads=posix --mandir=/usr/share/man --infodir=/usr/share/info --enable-__cxa_atexit --disable-multilib --libdir=/usr/lib --libexecdir=/usr/lib --enable-clocale=gnu --disable-libstdcxx-pch --with-tune=generic Thread model: posix gcc version 4.3.3 (GCC) OpenSSL 0.9.8j 07 Jan 2009 perl-net-ssleay 1.30-2

3 4

stunnel 4.26 MS SQL connetion - works on Vista, not on XP
by zervakos 25 Mar '09

25 Mar '09

Greetings, I was wondering if anyone's come across anything like this. I want to encrypt connections for MS SQL Server 2008 Express from a Windows XP client to a Windows 2003 Server. Following these instructions: http://www.securityfocus.com/infocus/1677 I was able to configure encrypted connections by pointing SQL Server Management Studio to 127.0.0.1 on _either_ XP or Vista and then that gets tunneled over to the Windows 2003 Server running SQL Server 2008 Express. I can browse the database tables, etc. Now the problem. I have users that make use of a thin client that connects directly to the SQL Server. It has one config file that I've pointed to 127.0.0.1. When I run this thin client on Vista, it works great, however, when running it on XP, stunnel tries to connect, but then gives up after several attempts. Here's what I see in the server log before connecting: 2009.03.23 12:26:59 LOG7[284564:274684]: RAND_status claims sufficient entropy for the PRNG 2009.03.23 12:26:59 LOG7[284564:274684]: PRNG seeded successfully 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service vnc 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service mssql 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service rdp 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service http 2009.03.23 12:26:59 LOG5[284564:274684]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.03.23 12:26:59 LOG5[284564:274684]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.03.23 12:26:59 LOG5[284564:289192]: No limit detected for the number of clients 2009.03.23 12:27:00 LOG7[284564:289192]: FD 268 in non-blocking mode 2009.03.23 12:27:00 LOG7[284564:289192]: SO_REUSEADDR option set on accept socket 2009.03.23 12:27:00 LOG7[284564:289192]: mssql bound to WINDOWS_SQL_SERVER:14333 2009.03.23 12:27:00 LOG7[284564:289192]: FD 292 in non-blocking mode 2009.03.23 12:27:00 LOG7[284564:289192]: SO_REUSEADDR option set on accept socket And here's what I see after trying to connect from XP (this appears 16 more times in stunnel.log until stunnel gives up): 2009.03.23 12:29:48 LOG7[284564:289192]: mssql accepted FD=308 from Windows_XP_Client:1252 2009.03.23 12:29:48 LOG7[284564:289192]: Creating a new thread 2009.03.23 12:29:48 LOG7[284564:289192]: New thread created 2009.03.23 12:29:48 LOG7[284564:348604]: mssql started 2009.03.23 12:29:48 LOG7[284564:348604]: FD 308 in non-blocking mode 2009.03.23 12:29:48 LOG5[284564:348604]: mssql accepted connection from Windows_XP_Client:1252 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): before/accept initialization 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client hello A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write server hello A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write certificate A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write certificate request A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 flush data 2009.03.23 12:29:48 LOG5[284564:348604]: CRL: verification passed 2009.03.23 12:29:48 LOG5[284564:348604]: VERIFY OK: depth=1, /C=PL/ST=Warsaw/L=Warsaw/O=Secure/OU=Secure Labs/CN=CA/emailAddress=user(a)abc.com 2009.03.23 12:29:48 LOG5[284564:348604]: CRL: verification passed 2009.03.23 12:29:48 LOG5[284564:348604]: VERIFY OK: depth=0, /C=PL/ST=Warsaw/L=Warsaw/O=Secure/OU=Secure Labs/CN=VNC Client/emailAddress=user(a)abc.com 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client certificate A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client key exchange A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read certificate verify A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read finished A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write change cipher spec A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write finished A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 flush data 2009.03.23 12:29:48 LOG7[284564:348604]: 1 items in the session cache 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client connects (SSL_connect()) 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client connects that finished 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client renegotiations requested 2009.03.23 12:29:48 LOG7[284564:348604]: 1 server connects (SSL_accept()) 2009.03.23 12:29:48 LOG7[284564:348604]: 1 server connects that finished 2009.03.23 12:29:48 LOG7[284564:348604]: 0 server renegotiations requested 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache hits 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache misses 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache timeouts 2009.03.23 12:29:48 LOG6[284564:348604]: SSL accepted: new session negotiated 2009.03.23 12:29:48 LOG6[284564:348604]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.03.23 12:29:48 LOG7[284564:348604]: FD 332 in non-blocking mode 2009.03.23 12:29:48 LOG7[284564:348604]: mssql connecting 127.0.0.1:1433 2009.03.23 12:29:48 LOG7[284564:348604]: connect_wait: waiting 10 seconds 2009.03.23 12:29:48 LOG7[284564:348604]: connect_wait: connected 2009.03.23 12:29:48 LOG5[284564:348604]: mssql connected remote server from 127.0.0.1:2001 2009.03.23 12:29:48 LOG7[284564:348604]: Remote FD=332 initialized 2009.03.23 12:29:48 LOG7[284564:348604]: SSL alert (read): warning: close notify 2009.03.23 12:29:48 LOG7[284564:348604]: SSL closed on SSL_read 2009.03.23 12:29:48 LOG7[284564:348604]: Socket write shutdown 2009.03.23 12:29:48 LOG7[284564:348604]: SSL write shutdown 2009.03.23 12:29:48 LOG7[284564:348604]: SSL alert (write): warning: close notify 2009.03.23 12:29:48 LOG6[284564:348604]: SSL_shutdown successfully sent close_notify 2009.03.23 12:29:48 LOG5[284564:348604]: Connection closed: 37 bytes sent to SSL, 52 bytes sent to socket 2009.03.23 12:29:48 LOG7[284564:348604]: mssql finished (0 left) The server's stunnel.conf: CAfile = CAcert.pem CApath = certificates cert = server.pem client = no verify = 3 debug = 7 output = stunnel.log [mssql] accept = WINDOWS_SQL_SERVER:14333 connect = 127.0.0.1:1433 The client's stunnel.conf: CAfile = CAcert.pem CApath = certificates cert = client.pem client = yes verify = 3 debug = 7 output = stunnel.log [mssql] accept = 127.0.0.1:1433 connect = WINDOWS_SQL_SERVER:14333 Things I've tried: - changed the compatibility settings of the thin client to work under ealier versions of Windows, this didn't help - regenerated certificates, no good - tried connecting without certificates, still no good I still haven't tried earlier versions of stunnel, but I figured I'd just check and see if may anyone's run across something like this before. From what I can tell, the combination of XP, the thin client and stunnel does not work. The thin client does work on XP when I do not use stunnel, but I need to have the connection encrypted. Any help greatly appreciated, thanks -- View this message in context: http://www.nabble.com/stunnel-4.26-MS-SQL-connetion---works-on-Vista%2C-not… Sent from the Stunnel - Users mailing list archive at Nabble.com.

3 2

Re: [stunnel-users] Using stunnel in a box having http client and http server.
by Joe Lau 23 Mar '09

23 Mar '09

So, my understanding is that I will need one stunnel for each remote web server that my http client is going to connnect to. For example if my http client want to connect to 3 remote web servers. I will need to setup the folllowing stunnels: Remote https Web Server #1 <------------- Stunnel #1 <---------- http client (http://localhost:81) (port 81) Remote https Web Server #1 <------------- Stunnel #2 <---------- http client (http://localhost:82) (port 82) Remote https Web Server #1 <------------- Stunnel #3 <---------- http client (http://localhost:83) (port 83) But I will need only one stunnel for my http server as follow: Remote https client #1 ------------+-----> Stunnel --------------- http server | (port 443) (port 80) Remote https client #2 ------------+ | ..... | | Remote https client #N-------------+ Is the following config file correct for my http server stunnel? client=no accept=443 connect=localhost:80 Thank you! -Joe -----Original Message----- From: Christophe Nanteuil [mailto:christophe.nanteuil@gmail.com] Sent: Monday, March 23, 2009 3:19 AM To: Joe Lau Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Using stunnel in a box having http client and http server. 2009/3/20 Joe Lau <Jlau(a)extremenetworks.com>: > > Hello, Hello, > I am new to this list. > > I am planning to use stunnel on my box which has a http client and http server running on it. > I will need two stunnel instances, one for the http client and one for the http server respectively. It seems good. > > For my http client, my stunnel config file looks like this: > > client=yes > accept=80 > connect=remote_web_server:443 > > For my http server, my stunnel config file looks like this: > > client=no > accept=443 > > The problem I am facing is now I have two programs (i.e. 1) stunnel for http client and 2) http server) listening to the same port 80. > How do I resolve this conflict? Who is going to connect to your http "client" ? if it is your local browser (which seems the goal of the configuration), then you can configure the client with "accept=81" and then type in your browser's address bar "https://localhost:/81" -- Christophe Nanteuil DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

2 1