- stunnel-users - stunnel.org

Upgrade of evil.patch for version 4.35
by Jeremie Le Hen 22 Feb '11

22 Feb '11

Hi Michal, One of my former coworker and now friend undertook the upgrade of contrib/misc/evil.patch against the latest stunnel version. Would you mine putting this new version on your FTP site please? Thanks a lot. Regards, -- Jeremie Le Hen Humans are born free and equal. But some are more equal than others. Coluche

1 0

Problems SSLifying an "exec" Service without KeepAlive
by Jochen Bern 22 Feb '11

22 Feb '11

Hello everyone, today I tried to set up network access to a service using stunnel 4.35. The underlying service, by default, exits after every request+reply. When running stunnel in daemon mode, this seems to upset things such that subsequent connections hang. I cannot quite pinpoint whether it's a config problem, design (of my setup) problem, or bug, so any help's welcome ... More info: The underlying service accesses a Nagios' livestatus interface > http://mathias-kettner.de/checkmk_livestatus.html#H1:Remote%20access%20to%2… using the "unixcat" tool provided. Unless you specifically request connection keepalives, unixcat will close/exit after answering one request, *or* timing out waiting for one. That "exit procedure", AFAICT, isn't different from what the imapd or pppd in the stunnel(8) manpage's EXAMPLES section do ... I need to secure access to the service, so I'm throwing client cert verification and libwrap at the connections. The current daemon mode configuration (with several commented-out attempts) reads, slightly anonymized: client=no verify=3 pid=/var/run/stunnel/livestatus.pid #setuid=stunnel #socket = a:SO_REUSEADDR=0 #foreground= yes [livestatus] accept = [...PORT...] cert = [...SERVER...].pem key = [...SERVER...].key CAfile = [...CA...].pem CApath = [...TempStagingDirectory...] exec = /usr/local/bin/unixcat execargs = unixcat /var/lib/nagios3/rw/live pty = yes retry = no session = 3 #TIMEOUTclose = 0 #TIMEOUTbusy = 5 #TIMEOUTidle = 5 After starting the stunnel daemon, I can perform *one* normal connection: > # openssl s_client -CAfile [...CA...].pem -showcerts \ > > -connect [...SERVER...]:[...PORT...] -cert [...CLIENT...].cert \ > > -key [...CLIENT...].key -state > CONNECTED(00000003) > SSL_connect:before/connect initialization > SSL_connect:SSLv2/v3 write client hello A > SSL_connect:SSLv3 read server hello A [...] > SSL handshake has read 1743 bytes and written 1933 bytes > --- > New, TLSv1/SSLv3, Cipher is AES256-SHA > Server public key is 1024 bit > Compression: NONE > Expansion: NONE > SSL-Session: > Protocol : TLSv1 > Cipher : AES256-SHA > Session-ID: 1B4221E2917E3BD49AA2102C2CCE60A624DB256D6B4D61F9D0D77EA843DC31BC > Session-ID-ctx: > Master-Key: 57E6DF8E7E0A741B718E356467450DD00969465295A9C6FE03416ED16E74AF93058EC168EF6DF1B9F3F637F505FF6EF4 > Key-Arg : None > Start Time: 1298390481 > Timeout : 300 (sec) > Verify return code: 0 (ok) > --- At that point, I can type in one request, then unixcat terminates, stunnel closes the connection and s_client (?) reports: > read:errno=104 Typical log output on the server side: > LOG5[30042:139819109037792]: Reading configuration from file /etc/stunnel/livestatus.conf > LOG5[30042:139819109037792]: Peer certificate location [...TempStagingDirectory...] > LOG5[30042:139819109037792]: Configuration successful > LOG5[30042:139819109037792]: No limit detected for the number of clients > LOG5[30043:139819109037792]: stunnel 4.35 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 > LOG5[30043:139819109037792]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 [...] > LOG5[30043:1075198288]: Service livestatus accepted connection from [...CLIENT...]:39287 > LOG5[30043:1075198288]: Certificate accepted: depth=1, [...CA...] > LOG5[30043:1075198288]: Certificate accepted: depth=0, [...CLIENT...] > LOG3[30043:1075198288]: readsocket: Input/output error (5) > LOG5[30043:1075198288]: Connection reset: 2293 bytes sent to SSL, 33 bytes sent to socket Rerunning the exact same command stops dead after the > CONNECTED(00000003) and manually "telnet"ing to the port from a different host doesn't behave in a normal way (closing the connection after I type the first line of non-SSL stuff) anymore, either. Running the unixcat command from a local command line, however, still works normally. I tried running stunnel off inetd, which seems to work, so I'd guess it's the server-side SSL session cacheing which interferes. However, I don't see any related stunnel config keywords in the manpage, and stunnel offering a cached session to a connection *from a different client host* sound odd to me, too ... ? Kind regards, J. Bern -- Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

1 0

New and Utterly Confused on Ubuntu Linux
by Traps 20 Feb '11

20 Feb '11

I am totally new to stunnel and am quite confused. I use Ubuntu 10.04 and have installed the stunnel4 deb package. I need to do a couple of things. At boot up I need to accept ssl connections on an inbound port and forward it to a non-ssl compliant app listening on another port. The second thing I need to do is make an ssl required connection to a pop server on another host out of a non-ssl mail client on the local machine. I have no problem with the ports, port forwarding, etc. I just do not know how to set up stunnel to accomplish this. Let's just use this as an example: 1. I need to accept inbound ssl connections on 995 (port 995 is open) and send them to the local machine non-ssl client listening on 2995. 2. I need to ssl connect to pop.gmail.com:995 via a non-ssl mail client on the local machine and I want the mail client to connect to stunnel on port 3995. 3. I need both of these scenarios to start at boot up. I don't even know where to start with stunnel4 to do this. Actually I can set up stunnel.conf for either but one's a server operation and the other is a client operation and can't get them both to work simultaneously. To start stunnel at boot up I simply edited /etc/default/stunnel and /etc/init.d/stunnel4 and changed ENABLED=0 to ENABLED=1 in both files. Something tells me this is entirely the wrong way to do what I want to do. It works for either the client task or the server task, depending on which one I have enabled in stunnel.conf but I just know this is not how I am suppose to be doing it. Will someone help? -- View this message in context: http://old.nabble.com/New-and-Utterly-Confused-on-Ubuntu-Linux-tp30970693p3… Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 1

fips=no
by dominic.schweizer＠zkb.ch 18 Feb '11

18 Feb '11

Hi All, I have the problem that when I start Stunnel, the following error pops up: FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match I now added in my config file: fips=no and it works. My question is now, what is the difference between with fips and without fips? stunnel version 4.34 openssl 0.9.8 redhat 5 Thanks in advance for the answer Regards Dominic Freundliche Grüsse Dominic Schweizer Zürcher Kantonalbank Unix System Engineer, LIOEU Neue Hard 9, 8005 Zürich Telefon 044 292 83 52, Fax 044 292 80 34 Briefadresse: Postfach 8010 Zürich, http://www.zkb.ch Sie drucken dieses E-Mail nicht aus? Die Umwelt dankt! ___________________________________________________________________ Disclaimer : Diese Mitteilung ist nur fuer die Empfaengerin / den Empfaenger bestimmt. Fuer den Fall, dass sie von nichtberechtigten Personen empfangen wird, bitten wir diese hoeflich, die Mitteilung an die ZKB zurueckzusenden und anschliessend die Mitteilung mit allen Anhaengen sowie allfaellige Kopien zu vernichten bzw. zu loeschen. Der Gebrauch der Information ist verboten. This message is intended only for the named recipient and may contain confidential or privileged information. If you have received it in error, please advise the sender by return e-mail and delete this message and any attachments. Any unauthorised use or dissemination of this information is strictly prohibited.

2 1

openvpn with stunnel
by Guy Sapir 17 Feb '11

17 Feb '11

Hi all, Is it possible to use openvpn on port 80 or 443 using stunnel so the packets on openvpn will be wrapped as http or https pure packets. What should I do in the config file. Guy Sapir

2 1

Wireshark didn't show TLSv1 traffic?
by Bao, Robert 17 Feb '11

17 Feb '11

Hi, I have "ciphers = AES256-SHA" option in stunnel.conf file. And when the server/client established the connection, I see this line in the log file: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 However when I use Wireshark to sniff the traffic, I only see "TCP" in the <Protocol> column for the traffics between the server and the client. Is this normal? What did I do wrong? Thanks. Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

2 2

key+cert+dh risks
by Jean-Yves F. Barbier 15 Feb '11

15 Feb '11

Hi list, I'm using stunnel between two machines only, so is there a risk to reuse the server stunnel.pem on the client? (and if it's risky, why?) JY -- Have a coke and a smile! -- John DeLorean

3 6

Confusion regarding part of stunnel.conf
by Dave 12 Feb '11

12 Feb '11

I've set up a test of stunnel with the latest stunnel and latest openssl, and if I set "verify=0" or "verify=1" I can get it to work (I'm tunneling a pop3 session), but if I set it any higher (to 2 or 3) it won't work for me. Now, I'm not sure which level is "necessary" because in stunnel.conf I read: ------------------------- ; authentication stuff needs to be configured to prevent MITM attacks ; it is not enabled by default! ;verify = 2 ------------------------- ... which sounds like verify defaults to 0. But is a verify level of 1 enough to solve the man-in-the-middle problem? It seems like it would not be (since level 1 will allow absence of a certificate), but I am not sure. I guess my questions boil down to: 1) What are the necessary settings for "authentication stuff" to prevent the MITM attack vector mentioned in stunnel.conf? 2) What is the proper way to set up (self-signed) certs to prevent such an attack? Can a self-signed cert be used at a verify level of 2 or 3? Dave

2 11

[patch] Unix socket support for Stunnel
by Stefan Behte 11 Feb '11

11 Feb '11

Hi, yet another request for a patch inclusion... Quoting from http://haproxy.1wt.eu/#down : "This patch contributed by Exceliance adds to stunnel the ability to connect to haproxy over a UNIX stream socket instead of using TCP. Sometimes this can be more convenient and/or more secure. " I think it would be nice to have it upstream. And I hope I am not bothering Michals yet. ;) Best regards, Stefan Behte

1 0

Security Problems with 4.35
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, in the announcement of 4.35, I saw: "CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments." I searched a bit, but did not find an exploit or more information on the severity of this issue. Could someone elaborate the problem a bit? I could diff to the previous version and have a look, but that will take quite some time, and my C is weak... Best regards, Stefan Behte

2 1