August 2007 - stunnel-users

Problem with stunnel 4.20 on Fedora 7
by Andrew M Dunn 29 Aug '07

29 Aug '07

I can't get stunnel to run on a freshly-installed Fedora 7 system. It fails with "Error resolving '0.0.0.0': servname is not supported for ai_socktype" but the usual other causes of that error (ie. ports not defined in /etc/services, bad settings in /etc/nsswitch.conf) are not the culprit this time. COMMAND LINE: /usr/sbin/stunnel /home/amdunn/security/stunnel.conf COMMAND OUTPUT: 2007.08.29 11:44:12 LOG3[13614:3086243520]: Error resolving '0.0.0.0': servname is not supported for ai_socktype (EAI_SERVICE) file /home/amdunn/security/stunnel.conf line 10: Failed to resolve accepting address STUNNEL.CONF FILE: ; ; stunnel file for testing 443 access to local http server ; cert=/home/amdunn/security/xxxxxxx key=/home/amdunn/security/yyyyyyy foreground=yes ; ; [sweb] accept=443 ; https port connect=80 ; standard httpd listening port TIMEOUTclose=0 ; must set this or IE waits 60sec on page end client=no STUNNEL -VERSION OUTPUT: stunnel 4.20 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- Andrew M. Dunn VE3XAD Managing Director, Axis Computing Technologies Vice-President, South Simcoe Railway www.AndyDunn.CA

1 0

Mac stunnel not attempting to connect to host
by Michael Kreykenbohm 28 Aug '07

28 Aug '07

I'v used FreeBsd with stunnel without problem, so I'm a little stumped that it doesn't work properly on darwin for Mac. I recall that it might get hung up in the ssl certificates, but I can't find where to look and openssl -connect works perfectly. Any help, appreciated. Symptom: The stunnel is running in debug mode, the client makes a connection to stunnel, stunnel reports the connection stunnel does not attempt to connect to the host (the connect string) No messages suggest it is trying, no network logic show it is connecting. (Since I am using it for email, I can not copy and paste from the orginal to send this email) openssl connects fine to the server and get the correct results Any ideas how/ where to find out what is wrong with the Mac. Thanks stunnel 4.20 on i686-apple-darwin8.10.1 with OpenSSL 0.9.7l 28 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /opt/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /opt/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /opt/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none 2007.08.26 20:28:51 LOG7[207:2684407808]: RAND_status claims sufficient entropy for the PRNG 2007.08.26 20:28:51 LOG7[207:2684407808]: PRNG seeded successfully 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: Key file: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Private key loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: SSL context initialized for service pop3s 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: Key file: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Private key loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: SSL context initialized for service smtps 2007.08.26 20:28:51 LOG5[207:2684407808]: stunnel 4.20 on i686-apple-darwin8.10.1 with OpenSSL 0.9.7l 28 Sep 2006 2007.08.26 20:28:51 LOG5[207:2684407808]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2007.08.26 20:28:51 LOG6[207:2684407808]: file ulimit = 256 (can be changed with 'ulimit -n') 2007.08.26 20:28:51 LOG6[207:2684407808]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2007.08.26 20:28:51 LOG5[207:2684407808]: 125 clients allowed 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 4 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 6 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 7 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: SO_REUSEADDR option set on accept socket 2007.08.26 20:28:51 LOG7[207:2684407808]: pop3s bound to 0.0.0.0:995 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 8 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: SO_REUSEADDR option set on accept socket 2007.08.26 20:28:51 LOG7[207:2684407808]: smtps bound to 0.0.0.0:5526 2007.08.26 20:28:51 LOG7[207:2684407808]: Created pid file /tmp/stunnel.pid 2007.08.26 20:29:04 LOG7[207:2684407808]: pop3s accepted FD=9 from 127.0.0.1:49162 2007.08.26 20:29:04 LOG7[207:25185792]: pop3s started 2007.08.26 20:29:04 LOG7[207:25185792]: FD 9 in non-blocking mode 2007.08.26 20:29:04 LOG7[207:25185792]: FD 10 in non-blocking mode 2007.08.26 20:29:04 LOG7[207:25185792]: FD 11 in non-blocking mode 2007.08.26 20:29:04 LOG7[207:25185792]: Connection from 127.0.0.1:49162 permitted by libwrap 2007.08.26 20:29:04 LOG5[207:25185792]: pop3s accepted connection from 127.0.0.1:49162 2007.08.26 20:29:04 LOG7[207:25185792]: SSL state (accept): before/accept initialization 2007.08.26 20:29:04 LOG7[207:2684407808]: Cleaning up the signal pipe 2007.08.26 20:29:04 LOG6[207:2684407808]: Child process 212 finished with code 0 <<-- at this point I have done nothing but connect to the stunnel, so I don;t know why it should finished with code 0 yet, and has not closed the connect on the other side.

1 0

[RFC,PATCH] Port stunnel to NSS
by Miloslav Trmac 28 Aug '07

28 Aug '07

Hello, As a part of Fedora's atttempt to rely on a single, FIPS certified. crypto implementation[1], I have prepared a port of stunnel to NSS, activated by passing --with-nss to configure. The port relies on a currently unreleased version of nss_compat_ossl[2]. The NSS interface is rather different from OpenSSL, and many options that are configured explicitly by applications with OpenSSL are either not available to applications with NSS, or configured using external tools in a "NSS database", which stores certificates, private keys and configuration settings. In particular: - The EGD (option "EGD") is not supported. - "RSA support" (loading keys as "RSA PRIVATE KEY" instead of "ANY PRIVATE KEY") is irrelevant, keys are stored in the NSS database - DH key exchange is not supported for the server side - compression (option "compression") is not supported - OpenSSL engines (options "engine", "engineCtrl") are not supported; PKCS#11 plugins are configured in the NSS database - CRLs (options "CRLpath", "CRLfile") are not configured; all CRLs stored in the NSS database are used automatically - OCSP (options "OCSP", "OCSPflag") is not supported in the current port; NSS supports OCSP, but a CA certificate must be specified along with the OCSP URL. - OpenSSL options (option "options") are not supported - NTLM authentication for the "CONNECT" protocol is not supported because NSS currently does not implement MD4 - certificates (option "cert") are stored in the NSS database; the "cert" option contains a nickname of a certificate stored in the database - CA certificates (options "CApath", "CAfile") are stored in the NSS database - error_depth on certificate verification failure is not supported To convert an existing stunnel set up to NSS, at minimum it is necessary to: - select a NSS database directory, $SSL_DIR $ certutil -d $SSL_DIR -N - import server and CA certificates: $ certutil -d $SSL_DIR -A -n server_cert_nickname -i server_cert.pem - import server private key: $ openssl pkcs12 -export -in server_key.pem -out server_key.pfx $ pk12util -d $SSL_DIR -i server_key.pfx - modify stunnel.conf to use "server_cert_nickname" instead of path to "server_cert.pem" in "cert" - when starting stunnel, make sure $SSL_DIR is present in the environment I'm afraid the incompatibilities are large, but the current NSS design really requires a database, and it does not work well with separate files. We'd like to include this NSS port of stunnel in Fedora 8 (if it doesn't prove to be too buggy). I'll be grateful for any comments. Mirek [1] http://fedoraproject.org/wiki/FedoraCryptoConsolidation [2] http://rcritten.fedorapeople.org/nss_compat_ossl.html

1 0

RFC3280 support
by Nagasundaram, Sekhar 22 Aug '07

22 Aug '07

Hello: I have hopefully a quick question. Does Stunnel support reason codes identified in RFC 3280? Thanks all Regards Sekhar Nagasundaram <<Nagasundaram, Sekhar.vcf>>

1 0

Will stunnel service need to be restarted after the configuration changes.
by Zhijiang Lu 15 Aug '07

15 Aug '07

Hi All, After some changes being made to the stunnel configuration file, do I need to restart the stunnel service to pick up the changes? I would think it is desirable to load up the new configurations, and make runtime changes correspondingly. Restarting stunnel will disrupt the currently running sessions. Thanks, -Mark

2 1

Application level encryption or driver level encryption
by atsushi kataoka 12 Aug '07

12 Aug '07

Hi, I have to secure one of my proprietary remote connection server running on windows XP . One option is to secure using the stunnel.Other options are writing some drivers for windows. Presently we are evaluating which option is better whether to opt for application level - stunnel or go for driver - some network filter driver. Can somebody tell me what will be advantages of following application level approach. One more point what is the impact on the performance of using stunnel. Regards.

1 0

Stunnel writing strange timestamps into my logs
by Van 10 Aug '07

10 Aug '07

I was looking through /var/log/messages for another reason and I notice this (representitive log snippet below) It's 10:50 am and while automount is writing messages that jibe with the correct time (see line 5 for example. This part of my log is from about 90 min ago), stunnel seems to be 4 hours ahead, labelling things as happening at about 1pm while everything else is happening about 9am. Where is stunnel getting it's time from? And why a separate source? How can I correct this? - Van Aug 10 13:13:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s connected remote server from 127.0.0.1:54923 Aug 10 13:13:03 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 211 bytes sent to SSL, 56 bytes sent to socket Aug 10 13:13:34 <myserver> stunnel: LOG5[29760:3086109600]: imaps accepted connection from XX.XX.61.109:1409 Aug 10 13:13:34 <myserver> stunnel: LOG5[29760:3086109600]: imaps connected remote server from 127.0.0.1:54927 Aug 10 09:14:13 <myserver> automount[30173]: >> mount: mount to NFS server 'mgm' failed: System Error: Connection timed out. Aug 10 09:14:13 <myserver> automount[30173]: mount(nfs): nfs: mount failure mgm:/bmgm on /nfs/bmgm Aug 10 09:14:13 <myserver> automount[30173]: failed to mount /nfs/bmgm Aug 10 13:14:18 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 1013 bytes sent to SSL, 271 bytes sent to socket Aug 10 13:16:02 <myserver> stunnel: LOG5[29760:3086109600]: pop3s accepted connection from XX.XX.61.195:1057 Aug 10 13:16:02 <myserver> stunnel: LOG5[29760:3086109600]: pop3s connected remote server from 127.0.0.1:54947 Aug 10 13:16:02 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 150 bytes sent to SSL, 41 bytes sent to socket Aug 10 13:18:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s accepted connection from 71.167.170.42:60220 Aug 10 13:18:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s connected remote server from 127.0.0.1:54948 Aug 10 13:18:03 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 211 bytes sent to SSL, 56 bytes sent to socket Aug 10 13:18:39 <myserver> stunnel: LOG5[29760:3086109600]: imaps accepted connection from XX.XX.61.109:1410 Aug 10 13:18:39 <myserver> stunnel: LOG5[29760:3086109600]: imaps connected remote server from 127.0.0.1:54952 Aug 10 13:19:23 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 1013 bytes sent to SSL, 271 bytes sent to socket Aug 10 09:20:31 <myserver> automount[30282]: >> mount: mount to NFS server 'mgm' failed: System Error: Connection timed out. Aug 10 09:20:31 <myserver> automount[30282]: mount(nfs): nfs: mount failure mgm:/bmgm on /nfs/bmgm Aug 10 09:20:31 <myserver> automount[30282]: failed to mount /nfs/bmgm Aug 10 13:23:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s accepted connection from 71.167.170.42:60225

1 0

Tunneling though an Http proxy
by Honka 10 Aug '07

10 Aug '07

Hi there, i'm trying to set up stunnel on my laptop which I use at work, and i'm trying to tunnel to my home pc for remote desktop. The only open ports on the work network are 8080, 80 and 443. So I have setup the tunnel to port 8080 onto my home pc and had it working across the network at home. (via internal and external ip's) however it isn't working here. I am assuming because we have an http proxy which requires authentication. So i'm wondering, how can I make stunnel use and authenticate with this proxy so that it will work? Cheers Honka

1 0

Make Install Error
by Morris Hooten - SLS Business Infrastructure 05 Aug '07

05 Aug '07

why do i get this when running make install at the very end? i'm trying to install in a full root solaris 10 zone thanks SunOS mknod: Not owner chmod: WARNING: can't access /usr/local/var/lib/stunnel/dev/zero make[2]: *** [install-data-local] Error 1 make[2]: Leaving directory `/stunnel/stunnel-4.20/tools' make[1]: *** [install-am] Error 2 make[1]: Leaving directory `/stunnel/stunnel-4.20/tools' make: *** [install-recursive] Error 1

1 0

Make Install Error
by Morris Hooten - SLS Business Infrastructure 05 Aug '07

05 Aug '07

why do i get this when running make install at the very end? thanks SunOS mknod: Not owner chmod: WARNING: can't access /usr/local/var/lib/stunnel/dev/zero make[2]: *** [install-data-local] Error 1 make[2]: Leaving directory `/stunnel/stunnel-4.20/tools' make[1]: *** [install-am] Error 2 make[1]: Leaving directory `/stunnel/stunnel-4.20/tools' make: *** [install-recursive] Error 1

1 0