November 2006 - stunnel-users

Problem in Stunnel with too many connections
by ~ Kunal Sharma ~ 30 Nov '06

30 Nov '06

Hi Friends, I've just joined this group. I would take this as an oppurtunity to discuss a problem I've been facing in using Stunnel. I've been using Stunnel for quite some time now. It has worked very well all this while. Recently, I had to shift our webserver onto the Internet and Stunnel accepts the https connections on the server's behalf. The problem is there are about 4.5 million clients out there in the field and there's a client coming up to the server atleast every second, if not less. Stunnel accepts the connections and after a while (like an hour) it just dies ! I see that at a point there are about 950 active connections and thats the maximum I could see before it dies. Could someone help me diagnose the problem (or better to fix it) - Is there any performance related issue thats a known problem and I don't know of ? - What I can look at to see what could be the possible cause ? - I haven't had a chance to look at the logs yet. Probably they might tell me something. - Any other pointers / inputs / suggestions would be heartily welcome. I've not been to my office so I won't be able to attach the necessary information like the version of stunnel, the logs, configuration options etc. But promise to send them as soon as I'm back on Monday after Thanksgiving. Thanks and Regards, Kunal

4 8

stunnel 4.20 released
by Michal Trojnara 30 Nov '06

30 Nov '06

Dear Users, I have just released a new version of stunnel. Here is the ChangeLog entry: Version 4.20, 2006.11.30, urgency: MEDIUM: * Release notes - The new transfer() function has been well tested. I recommend upgrading any previous version with this one. * Bugfixes - Fixed support for encrypted passphases (broken in 4.19). - Reduced amount of debug logs. - A minor man page update. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.20.tar.gz fie: a9a449b28a4f34ab22f6b4bfaa81c1904a5883c4 Best regards, Mike

1 0

Adding header to SMTP msgs
by Eric B. 26 Nov '06

26 Nov '06

Hi, I am looking at stunnel as a way to add SSL/TLS to an SMTP server, but my issue is that the SMTP server must be able to determine the address of the incoming connection to perform RBL checks, reverse MX record checks, PTR checks, etc. From what I can understand, however, the SMTP server will only see the client side of the pipe (localhost) as the originating address, instead of the originating machine IP. Is there any way to get the SMTP server to see that original IP address? Or baring that, is there anyway that stunnel can insert a header into the mail indicating the original IP address? Thanks! Eric

2 4

must restart stunnel to add a new cert before it recognized it...
by Rami Michael 21 Nov '06

21 Nov '06

Hello everyone, My stunnel setup is working fine, got mysql being hit from a couple of boxes but my question is this... I have stunnel setup so i copy the cert created from the remote client over to the local server so remote connections are authenticated. Now that works fine and dandy, the issue is, if i am adding a new remote client, i add the cert from the client to my certs.pem locally but i need to restart the stunnel process before stunnel will "read in" the new cert. I know this does not sound like a big deal, but if i have 20 machines connected through stunnel to this local box and i need to restart stunnel whenever i need to add a new box or take off an old one, i don't think its good. I use stunnel for mysql so i got these guys doing inserts and a broken connection would really mess things up for me... i think maybe there is a flag i can set? or maybe send the process some type of command to reload the certs? Any help would be appreciated... all relevant info included below. All requested info for posts to the group are found below Here is my stunnel.conf verify = 3 CAfile = /etc/stunnel/certs.pem cert = /etc/stunnel/stunnel.pem setuid = nobody setgid = nobody pid = /tmp/stunnel.pid debug = 7 output = /var/log/stunnel.log client = no [mysqls] accept = 3309 connect = 3306 Some output from the stunnel.log at high debug level 2006.11.13 23:03:10 LOG5[32244:3086689984]: stunnel 4.05 on i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.11.13 23:03:10 LOG7[32244:3086689984]: Snagged 64 random bytes from /dev/urandom 2006.11.13 23:03:10 LOG7[32244:3086689984]: RAND_status claims sufficient entropy for the PRNG 2006.11.13 23:03:10 LOG6[32244:3086689984]: PRNG seeded successfully 2006.11.13 23:03:10 LOG7[32244:3086689984]: Certificate: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Key file: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Loaded verify certificates from /etc/stunnel/certs.pem 2006.11.13 23:03:10 LOG5[32244:3086689984]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 4 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: SO_REUSEADDR option set on accept socket 2006.11.13 23:03:10 LOG7[32244:3086689984]: mysqls bound to 0.0.0.0:3309 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 5 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 6 in non-blocking mode 2006.11.13 23:03:10 LOG7[32245:3086689984]: Created pid file /tmp/stunnel.pid stunnel -V 2006.11.13 23:03:14 LOG3[32248:3086505664]: -V: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options uname -a Linux ramison 2.6.9-42.0.3.EL #1 Fri Oct 6 05:59:54 CDT 2006 i686 i686 i386 GNU/Linux gcc -v Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.6/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux Thread model: posix gcc version 3.4.6 20060404 (Red Hat 3.4.6-3) openssl version OpenSSL 0.9.7a Feb 19 2003

4 7

s_poll_wait timeout errors
by James Brown 16 Nov '06

16 Nov '06

I'm trying to set up an SSL connection from stunnel to Postfix, but can not get it to work. stunnel log says: 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp started 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 9 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: TCP_NODELAY option set on local socket 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 10 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 11 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: Connection from 192.168.1.12:51469 permitted by libwrap 2006.11.16 11:35:31 LOG5[5240:25188864]: ssmtp connected from 192.168.1.12:51469 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 10 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp connecting 127.0.0.1:25 2006.11.16 11:35:31 LOG7[5240:25188864]: connect_wait: waiting 10 seconds 2006.11.16 11:35:31 LOG7[5240:25188864]: connect_wait: connected 2006.11.16 11:35:31 LOG7[5240:25188864]: Remote FD=10 initialized 2006.11.16 11:35:31 LOG7[5240:25188864]: TCP_NODELAY option set on remote socket 2006.11.16 11:35:31 LOG5[5240:25188864]: Negotiations for smtp (client side) started 2006.11.16 11:35:31 LOG7[5240:2684415368]: Cleaning up the signal pipe 2006.11.16 11:35:31 LOG6[5240:2684415368]: Child process 5251 finished with code 0 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 220 mail3.bordo.com.au ESMTP Postfix 2006.11.16 11:35:31 LOG7[5240:25188864]: -> 220 mail3.bordo.com.au ESMTP Postfix 2006.11.16 11:35:31 LOG7[5240:25188864]: -> EHLO localhost 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-mail3.bordo.com.au 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-SIZE 10240000 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-ETRN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-AUTH PLAIN LOGIN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-AUTH=PLAIN LOGIN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-XFORWARD NAME ADDR PROTO HELO SOURCE 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-ENHANCEDSTATUSCODES 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-8BITMIME 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250 DSN 2006.11.16 11:35:31 LOG7[5240:25188864]: -> STARTTLS 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 220 2.0.0 Ready to start TLS 2006.11.16 11:35:31 LOG5[5240:25188864]: Protocol negotiations succeded 2006.11.16 11:35:31 LOG7[5240:25188864]: SSL state (connect): before/ connect initialization 2006.11.16 11:35:31 LOG7[5240:25188864]: SSL state (connect): SSLv2/ v3 write client hello A 2006.11.16 11:40:31 LOG6[5240:25188864]: init_ssl: s_poll_wait timeout 2006.11.16 11:40:31 LOG5[5240:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.11.16 11:40:31 LOG7[5240:25188864]: ssmtp finished (0 left) 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp started Postfix's log shows: Nov 16 11:35:31 Fax-Machine postfix/smtpd[5252]: connect from localhost[127.0.0.1] Nov 16 11:35:31 Fax-Machine postfix/smtpd[5252]: setting up TLS connection from localhost[127.0.0.1] Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: SSL_accept error from localhost[127.0.0.1]: -1 Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: lost connection after STARTTLS from localhost[127.0.0.1] Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: disconnect from localhost[127.0.0.1] stunnel.conf is: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = /etc/postfix/smtpd.cert key = /etc/postfix/smtpd.key debug=7 output=/dev/stdout ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration protocol = smtp sslVersion = all ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] client = yes accept = 465 connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Does anyone have any idea where I am going wrong? Thanks, James.

3 4

stunnel : remote connection refused
by Arunkumar Arumugam 16 Nov '06

16 Nov '06

Hi I am using stunnel 3.26 on i386 redhat -linux-gnu with PTHREAD+LIBWRAP with openssl 0.9.6b engine I am getting the following error when try to use stunnel to a remote ipadress on specific port Lets say the remote ip address be a.b.c.d and port P1 and local ipaddess e.f.g.h and port P2 e.f.g.h:P2 ------> a.b.c.d:P1 my logs say that a.b.c.d:p1 started a.b.c.d:p1 connected from 127.0.0.1:xxxxx a.b.c.d:p1 connecting a.b.c.d:p1 remote connect: connection refused (111) failed to initialize remote desccriptor abcd:p1 finished (0 left) I do not understand why after connecting from local host to a.b.c.d , a.b.c.d tries to reconnect to itself. I have the same setup in another server, it works fine. This one was working fine, until i rebooted the machine. Regards Arun A -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

1 0

Testing stunnel 4.19
by Michal Trojnara 15 Nov '06

15 Nov '06

Dear Users, Please test stunnel 4.19 in you environments and post any problem to the list, so I can fix it in stunnel 4.20 (to be released soon). I expect stunnel 4.20 to be the recommended stable release for quite a long time. 8-) Best regards, Mike

1 0

Re: [stunnel-users] No way to keep the key encrypted?
by Michal Trojnara 15 Nov '06

15 Nov '06

On Wednesday 15 November 2006 16:30, joe(a)strout.net wrote: > That's good news! ...But, how do I use it (in daemon mode)? I tried > launching stunnel with an encrypted key, and it simply failed saying > that the pass phrase was wrong. But it never asked me for a pass > phrase. How do I make it do so? I confirm it's broken in stunnel 4.19. I'll fix it in 4.20. 4.18 works fine. Best regards, Mike

1 1

Re: [stunnel-users] No way to keep the key encrypted?
by Hans Werner Strube 15 Nov '06

15 Nov '06

Michal Trojnara wrote: > Obviously private key encryption should not be used in inetd mode. It > works fine in daemon mode and on Win32 platform. Yes, but only when stunnel is started manually. When started automatically on system boot, there is usually nobody present to enter the password of the encrypted private key (except when the key is stored somewhere and its input provided by some script or program - again a security hole). This is not a special problem of stunnel but of all SSL-using servers.

1 0

Re: [stunnel-users] No way to keep the key encrypted?
by Michal Trojnara 15 Nov '06

15 Nov '06

Joe Strout wrote: > The private key cannot be encrypted [cut] > This seems very dangerous to me; This paragraph of the manual was obsolete so I've removed it. Obviously private key encryption should not be used in inetd mode. It works fine in daemon mode and on Win32 platform. Best regards, Mike

1 0