December 2006 - stunnel-users

Problem with certificates using smtp /pop
by Klaas 29 Dec '06

29 Dec '06

Hello, I have installed stunnel 4.20 on Windows2003 server and have created my private key as follow: openssl req -new -days 365 -nodes -config stunnel.cnf -out certreq.pem -keyout stunnel.pem After that I have send certreq.pem to my own CA and have received a certnew.cer file. But what I have to do next because I still receive the message that the CN-name of the certificate is not the same with the given name. I append this certificate (certnew.cer) to my stunnel.pem file like: -----BEGIN RSA PRIVATE KEY----- data here -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- data here -----END CERTIFICATE----- But this doesn't work. Still receive the message that I also read on the stunnel.conf must I config something here? cert = stunnel.pem key = stunnel.pem ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem Can anyone tell me what certificate I place where and how config the stunnel.conf so I get this working?

1 0

Avira Anti-Vir Detects stunnel as virus
by Daniel Tschinder 26 Dec '06

26 Dec '06

I'm using Avira AntiVir (www.free-av.de) and it detects stunnel 4.20 as virus APPL/Stunnel.A . I do not know what to do against it... as you can see in this list, stunnel was added to the signatures Database of AntiVir: http://www.avira.de/en/threats/section/vdfhistory/vdf_no/6.37.00.53/6.37.00… Maybe one of the devs can check back with avira.... best regards, daniel

2 1

Benchmarks
by Michal Trojnara 17 Dec '06

17 Dec '06

Dear Users, I have updated stunnel performance benchmarks: http://stunnel.mirt.net/perf.html I hope you'll find them useful. The funny thing I currently have 2 hardware accelerator cards, but none of them works: - one of them is too obsolete and its proprietary drivers are no longer available; - the other one is too modern and its PCI-X slot does not work with my ASUS P5WDG2 WS Professional motherboard. I'm pretty sure most users won't even be able to utilize the performance provided by software implementation. The bottleneck will most likely be network connection or the destination server performance. Best regards, Mike

1 0

service reconfiguration by SIGHUP
by Matthew Eaton 14 Dec '06

14 Dec '06

Hi, I've created a patch to Stunnel that reloads all accepting connections from the config file. This will not work for privileged ports in the current implementation. Test at your own risk :) Feedback welcome. Best regards, Matthew diff -urb stunnel-orig/stunnel-4.20/src/stunnel.c stunnel-4.20/src/stunnel.c --- stunnel-orig/stunnel-4.20/src/stunnel.c 2006-11-30 15:47:45.000000000 -0500 +++ stunnel-4.20/src/stunnel.c 2006-12-12 03:34:36.000000000 -0500 @@ -53,12 +53,12 @@ #endif int volatile num_clients=0; /* Current number of clients */ +int volatile conf_updated=0; /* Conf updated ? */ /* Functions */ #ifndef USE_WIN32 int main(int argc, char* argv[]) { /* execution begins here 8-) */ - main_initialize(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL); signal(SIGPIPE, SIG_IGN); /* avoid 'broken pipe' signal */ @@ -78,12 +78,17 @@ } #endif +char *cfg_arg1 = NULL; +char *cfg_arg2 = NULL; + void main_initialize(char *arg1, char *arg2) { ssl_init(); /* initialize SSL library */ sthreads_init(); /* initialize critical sections & SSL callbacks */ parse_config(arg1, arg2); log_open(); stunnel_info(0); + cfg_arg1 = arg1; + cfg_arg2 = arg2; } void main_execute(void) { @@ -105,6 +110,7 @@ SOCKADDR_UNION addr; s_poll_set fds; LOCAL_OPTIONS *opt; + int i; get_limits(); s_poll_zero(&fds); #if !defined(USE_WIN32) && !defined(USE_OS2) @@ -173,6 +179,42 @@ accept_connection(opt); } + if(conf_updated) { + for(i=0; i<fds.nfds; i++) + close(fds.ufds[i].fd); + + /* re-bind local ports */ + for(opt=local_options.next; opt; opt=opt->next) { + if(!opt->option.accept) /* no need to bind this service */ + continue; + memcpy(&addr, &opt->local_addr.addr[0], sizeof(SOCKADDR_UNION)); + if((opt->fd=socket(addr.sa.sa_family, SOCK_STREAM, 0))<0) { + sockerror("local socket"); + exit(1); + } + if(alloc_fd(opt->fd)) + exit(1); + if(set_socket_options(opt->fd, 0)<0) + exit(1); + s_ntop(opt->local_address, &addr); + if(bind(opt->fd, &addr.sa, addr_len(addr))) { + s_log(LOG_ERR, "Error binding %s to %s", + opt->servname, opt->local_address); + sockerror("bind"); + exit(1); + } + s_log(LOG_DEBUG, "%s bound to %s", opt->servname, opt->local_address); + if(listen(opt->fd, 5)) { + sockerror("listen"); + exit(1); + } +#ifdef FD_CLOEXEC + fcntl(opt->fd, F_SETFD, FD_CLOEXEC); /* close socket in child execvp */ +#endif + s_poll_add(&fds, opt->fd, 1, 0); + } + conf_updated = 0; + } } s_log(LOG_ERR, "INTERNAL ERROR: End of infinite loop 8-)"); } @@ -413,9 +455,16 @@ } static void signal_handler(int sig) { /* signal handler */ + if((sig==SIGHUP) && local_options.next) { /* only in service mode */ + s_log(LOG_NOTICE, "Re-reading configuration"); + parse_config(cfg_arg1, cfg_arg2); + conf_updated = 1; + } + else { s_log(sig==SIGTERM ? LOG_NOTICE : LOG_ERR, "Received signal %d; terminating", sig); exit(3); + } } #endif /* !defined USE_WIN32 */

1 2

stunnel patch to support URL lookups for parameters (take 2)
by Dan Jakubiec 13 Dec '06

13 Dec '06

Attached is a patch which extends the "connect=" and "CApath=" options to allow these parameters to be obtained dynamically at connect-time via a URL lookup, rather than statically from the stunnel configuration file. It is a generalization of an earlier patch to 4.04 submitted by Jan Piet-Mens which does something similar using LDAP lookups. Feedback is appreciated! Here is a summary of the functionality, along with some notes: 1. The patch was written to allow stunnel to dynamically route and authenticate incoming connections based on parameters found in the client's certificate. 2. Routing and authentication information is obtained by issuing a URL lookup, so the information can be obtained from a variety of local or remote sources. 3. It is particularly useful in high-volume, load-balancing scenarios where many copies of stunnel are running on multiple front-end servers. It allows the destination socket and client certificate verification info to be obtained on-the-fly from a centralized database. 4. Although primarily intended for use with HTTP, this patch uses the libcurl URL library and should work with all of its supported protocols: HTTP, HTTPS, FTP, FTPS, TFTP, DICT, TELNET, LDAP or FILE. As a brief example, an end-user might configure their stunnel as follows: cert = id.pem verify = 2 CApath = ca_dir CAlookup = http://database.stunnel.org/map_client.php?hash=%h [dynamic] accept = 50000 connect = @http://database.stunnel.org/map_client.php?common_name=%n In this scenario, an incoming stunnel connection would obtain it's connect info from database.stunnel.org by sending an HTTP request and passing the common name found in the client certificate. Similarly, the client's certificate would be verified using CA certificates obtained via HTTP lookup to the same host. Comments are appreciated. Thanks, Dan Jakubiec

1 0

stunnel patch to support URL lookups for parameters
by Dan Jakubiec 13 Dec '06

13 Dec '06

Attached is a patch which extends the "connect=" and "CApath=" options to allow these parameters to be obtained dynamically at connect-time via a URL lookup, rather than statically from the stunnel configuration file. It is a generalization of an earlier patch to 4.04 submitted by Jan Piet-Mens which does something similar using LDAP lookups. Feedback is appreciated! Here is a summary of the functionality, along with some notes: 1. The patch was written to allow stunnel to dynamically route and authenticate incoming connections based on parameters found in the client's certificate. 2. Routing and authentication information is obtained by issuing a URL lookup, so the information can be obtained from a variety of local or remote sources. 3. It is particularly useful in high-volume, load-balancing scenarios where many copies of stunnel are running on multiple front-end servers. It allows the destination socket and client certificate verification info to be obtained on-the-fly from a centralized database. 4. Although primarily intended for use with HTTP, this patch uses the libcurl URL library and should work with all of its supported protocols: HTTP, HTTPS, FTP, FTPS, TFTP, DICT, TELNET, LDAP or FILE. As a brief example, an end-user might configure their stunnel as follows: cert = id.pem verify = 2 CApath = ca_dir CAlookup = http://database.stunnel.org/map_client.php?hash=%h <http://database.stunnel.org/map_client.php?hash=%25h> [dynamic] accept = 50000 connect = @http://database.stunnel.org/map_client.php?common_name=%n<http://database.stunnel.org/map_client.php?common_name=%25n> In this scenario, an incoming stunnel connection would obtain it's connect info from database.stunnel.org by sending an HTTP request and passing the common name found in the client certificate. Similarly, the client's certificate would be verified using CA certificates obtained via HTTP lookup to the same host. Comments are appreciated. Thanks, Dan Jakubiec

1 0

Re: [stunnel-users] service reconfiguration by SIGHUP
by Hans Werner Strube 13 Dec '06

13 Dec '06

Matthew Eaton wrote: > I've created a patch to Stunnel that reloads all accepting connections > from the config file. This will not work for privileged ports in the > current implementation. Please explain why it will not work for privileged ports. Does this hold even if the master stunnel process runs as root? And what happens to active connections on SIGHUP? Are they simply broken?

2 1

Re: [stunnel-users] STunnel performance Issues
by Michal Trojnara 11 Dec '06

11 Dec '06

"Jones Scott - sjones" <Scott.Jones(a)acxiom.com> wrote: > But during load testing the system starts breaking down. It takes about > 1/5 the load to break down apache and stunnel, than directly against my > jboss node. Could you elaborate on "break down", please? Is there an error? A core dump? What is the error message? A core dump stack backtrace? First performance recommendation is to disable libwrap support: ./configure --disable-libwrap && make clean && make && make install Best regards, Mike

1 0

STunnel performance Issues
by Jones Scott - sjones 11 Dec '06

11 Dec '06

I am having problems will apache and stunnel being able to handle load. I am using stunnel to encrypt my ajp traffic from apache to jboss. This helps me bridge our internal firewall. But during load testing the system starts breaking down. It takes about 1/5 the load to break down apache and stunnel, than directly against my jboss node. Any performance tuning recommendations would be great. I am using stunnel straight out of the box. I will place the configuration file below. Thanks. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /usr/local/stunnel/etc/stunnel/mail.pem ;key = /usr/local/stunnel/etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/stunnel/var/lib/stunnel/ setuid = nobody setgid = nogroup ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = certificates ; It's often easier to use CAfile CAfile = /usr/local/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ajp] accept = 8009 connect = xxxx2:8009 [sql] accept = 1433 connect = XXXX1:443 *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

1 0

SSL_accept: Peer suddenly disconnected
by James Brown 07 Dec '06

07 Dec '06

I'm trying to send an email through stunnel (which is running on the mail server), but I keep getting an error. $ sudo /usr/local/sbin/stunnel 2006.12.07 15:35:27 LOG7[6092:2684407744]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2006.12.07 15:35:27 LOG7[6092:2684407744]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2006.12.07 15:35:27 LOG7[6092:2684407744]: RAND_status claims sufficient entropy for the PRNG 2006.12.07 15:35:27 LOG7[6092:2684407744]: PRNG seeded successfully 2006.12.07 15:35:27 LOG7[6092:2684407744]: Certificate: /etc/postfix/ smtpd.cert 2006.12.07 15:35:27 LOG7[6092:2684407744]: Certificate loaded 2006.12.07 15:35:27 LOG7[6092:2684407744]: Key file: /etc/postfix/ smtpd.key 2006.12.07 15:35:27 LOG7[6092:2684407744]: Private key loaded 2006.12.07 15:35:27 LOG7[6092:2684407744]: SSL context initialized for service ssmtp 2006.12.07 15:35:27 LOG5[6092:2684407744]: stunnel 4.19 on i686-apple- darwin8.8.1 with OpenSSL 0.9.7l 28 Sep 2006 2006.12.07 15:35:27 LOG5[6092:2684407744]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2006.12.07 15:35:27 LOG6[6092:2684407744]: file ulimit = 256 (can be changed with 'ulimit -n') 2006.12.07 15:35:27 LOG6[6092:2684407744]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2006.12.07 15:35:27 LOG5[6092:2684407744]: 125 clients allowed 2006.12.07 15:35:27 LOG7[6092:2684407744]: FD 6 in non-blocking mode 2006.12.07 15:35:27 LOG7[6092:2684407744]: FD 7 in non-blocking mode 2006.12.07 15:35:27 LOG7[6092:2684407744]: FD 8 in non-blocking mode 2006.12.07 15:35:27 LOG7[6092:2684407744]: SO_REUSEADDR option set on accept socket 2006.12.07 15:35:27 LOG7[6092:2684407744]: ssmtp bound to 0.0.0.0:465 2006.12.07 15:35:27 LOG7[6093:2684407744]: Created pid file /usr/ local/var/run/stunnel/stunnel.pid 2006.12.07 15:35:52 LOG7[6093:2684407744]: ssmtp accepted FD=9 from 192.168.1.4:62929 2006.12.07 15:35:52 LOG7[6093:25188864]: ssmtp started 2006.12.07 15:35:52 LOG7[6093:25188864]: FD 9 in non-blocking mode 2006.12.07 15:35:52 LOG7[6093:25188864]: TCP_NODELAY option set on local socket 2006.12.07 15:35:52 LOG7[6093:25188864]: FD 10 in non-blocking mode 2006.12.07 15:35:52 LOG7[6093:25188864]: FD 11 in non-blocking mode 2006.12.07 15:35:52 LOG7[6093:25188864]: Connection from 192.168.1.4:62929 permitted by libwrap 2006.12.07 15:35:52 LOG7[6093:2684407744]: Cleaning up the signal pipe 2006.12.07 15:35:52 LOG5[6093:25188864]: ssmtp accepted connection from 192.168.1.4:62929 2006.12.07 15:35:52 LOG6[6093:2684407744]: Child process 6094 finished with code 0 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): before/ accept initialization 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 read client hello A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 write server hello A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 write certificate A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 write server done A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 flush data 2006.12.07 15:35:52 LOG3[6093:25188864]: SSL_accept: Peer suddenly disconnected 2006.12.07 15:35:52 LOG5[6093:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.12.07 15:35:52 LOG7[6093:25188864]: ssmtp finished (0 left) My stunnel.conf is: cert = /etc/postfix/smtpd.cert key = /etc/postfix/smtpd.key sslVersion = all socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log [ssmtp] client = no accept = 465 connect = 25 Does this mean that the SMTP proxy listening on port 25 is not accepting the connection from stunnel? Thanks, James.

2 4