October 2010 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

patch for using stunnel as client with pkcs11-engine and opensc smartcard
by Märt Laak 30 Jan '12

30 Jan '12

Dear stunnel managers, I would like to inform you that there exist some incompatibility with stunnel and openssl pkcs11-engine with external PIN entry device (like RSA smartcard using opensc) in Linux. We use this config to load openssl engine stunnel.conf: --- engine=dynamic engineCtrl=SO_PATH:/usr/lib/engines/engine_pkcs11.so engineCtrl=ID:pkcs11 engineCtrl=LIST_ADD:1 engineCtrl=LOAD engineCtrl=MODULE_PATH:/usr/lib/opensc-pkcs11.so engineCtrl=INIT --- Problem is, with this setup stunnel does not allow user to enter PIN for the secret key. Instead it tries to get secret key without PIN, 3 times (and then therefore usually blocks card PIN) and retires: ---- Initializing engine 1 Engine 1 initialized PRNG seeded successfully Certificate: mart.pem Certificate loaded Key file: id_01 error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect Wrong PIN: retrying error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect Wrong PIN: retrying error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key ENGINE_load_private_key: 800050A0: error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect ---- I discovered workaround that is valid form version 4.26 till current 4.34, as follows, NULL-ing the ui_data.method property in ctx.c: --- diff -cr stunnel-4.34/src/ctx.c stunnel-4.34-patched/src/ctx.c *** stunnel-4.34/src/ctx.c 2010-09-14 18:08:43.000000000 +0300 --- stunnel-4.34-patched/src/ctx.c 2010-09-28 21:56:36.219081931 +0300 *************** *** 304,309 **** --- 304,310 ---- UI_method_set_reader(ui_method, pin_cb); #else /* USE_WIN32 */ ui_method=UI_OpenSSL(); + ui_data.section = NULL; #endif /* USE_WIN32 */ if(section->engine) for(i=1; i<=3; i++) { --- After that patch private key loads correctly: --- Initializing engine 1 Engine 1 initialized PRNG seeded successfully Certificate: mart.pem Certificate loaded Key file: id_01 private key loaded --- It would be nice if: * somebody investigates more precisely why the OpenSSL PIN entry is not showing with unpached stunnel * include my or better patch for this situation Thank you very much for excellent piece of software! With best regards, Märt Laak

2 2

Re: [stunnel-users] Stunnel on the same machine
by subrata＠indiatimes.com 01 Aug '11

01 Aug '11

The configuration files are : pid = /var/stunnel.pid ;chroot = /var/lib/stunnel setuid = nobody setgid = nobody foreground =yes ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept = 3307 connect = 192.168.1.6:3307 On 192.168.1.6 ---------------------- pid = /var/stunnel.pid setuid =nobody setgid = nobody foreground = yes client = no ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept =3307 connect =3306 connecting like /usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307 Enter password: On entring password the following lines appear : ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 Subrata ----- Original Message ----- From: Brian Hatch <bri(a)stunnel.org> To: subrata(a)indiatimes.com Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST) Subject: Re: [stunnel-users] Stunnel on the same machine Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted: > After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there. What do your stunnel configuration files look like? Other problem: mysql client may decide to use a local domain socket when connecting to localhost, thwarting your attempts to go via Stunnel. You might want to 'strace mysql ...' and look for the connect() lines. -- Brian Hatch Time flies like an Systems and arrow. Fruit flies Security Engineer like a banana. http://www.ifokr.org/bri/ Every message PGP signed -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

Stunnel 4.33 released
by Michal Trojnara 22 Apr '11

22 Apr '11

The ChangeLog entry: Version 4.33, 2010.04.05, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 1.0.0. This library requires to c_rehash CApath/CRLpath directories on upgrade. - Win32 DLLs for zlib 1.2.4. - Experimental support for local mode on WIN32 platform. Try "exec = c:\windows\system32\cmd.exe". * Bugfixes - Inetd mode fixed SHA-1 value for stunnel-4.33.tar.gz: 695c7ef834952cb8ddbc790e10b6e32798fc2767 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

4 6

SMPP Protocol and STunnel
by Pathak, Apurva (Apu) 23 Nov '10

23 Nov '10

Hello, I would like to find out if I can use STunnel as follows: I have a stand alone C# executable program that uses a third party SDK that implements SMPP protocol and sends SMS text messages with wireless carriers. Recently, one of the wireless carriers wants us to implement SSL Client Authentication and wants SMPP messages that are exchanged with them to be encrypted after the client authentication is done. I want to find out if I can use STunnel running so that STunnel can encrypt and decrypt the messages exchanged between my program and the carrier's SMS server. (1) Is this possible with STunnel? (2) What are the steps involved? I am on the Windows Server 2003 platform. I would really appreciate a reply. Thanks, Apu

3 12

public domain [PATCH] to stunnel 4.34 for Windows CE / Windows Mobile, "no service" CRITICAL bug and unicode bugs fixed
by Pierre DELAAGE 18 Nov '10

18 Nov '10

Dear All, Please find enclosed a patch in "diff -cr orig patched" format, applying to stunnel4.34 as found here ftp://stunnel.mirt.net/stunnel/. This patch mainly addresses compilation and unicode issues for Windows CE targets + ONE critical issue preventing stunnel to service anything (!). I use MS EVC 4sp2 compiler with WCE 420 SDK, on a vista host platform. Once debugged the code works fine on WM6 HTC smartphones. Should work on WM5. It needs a windows CE openssl lib (I recompiled MY patched version of openssl 1.0.0a successfully: I will have to log a patch to those gentlemen, hoping that they are open to integrate it, something not so obvious in the past). I will later post here a link to my patch for openssl 100a pointing to the openssl mailing list. THIS OPENSSL PATCH IS ESSENTIAL : with my older version of openssl 098pre_j for wce, stunnel does not work anymore (it crashes after first cnx). The present stunnel patch addresses the following issues : ************* I] COMPILATION FAILURES 1/ on common.h "EINVAL redefinition" : in fact the compile options WX (see evc.mak) does not tolerate any warning : The MS evc420 compiler ALWAYS issues a warning on this symbol redefinition. Michal and I are dealing with it since month... But, considering that NEITHER Exxx error codes are used in stunnel, I suggest that in fact ALL these redef should be suppressed. TODO: In the future a proper rewrite of code in log.c, where hardcoded values of WSA error codes are used instead of symbolic constant, will have to be done. 2/ client.c CreateProcess is a UNICODE function: code was ascii only. Code has been adapted to work in unicode. 3/ evc.mak path to new openssl lib has been redefined. proper location for the libs in openssl tree has been set in the make-install block (although this block is presently USELESS and needs a complete rewrite). 4/ gui.c All code using hmainmenu is OFF under winCE. So some new lines involving it were not compiling. 5/ options.c linger_val.l_linger and linger_val.l_onoff require ushort values. Strict type checking of the compiler required a proper cast to ushort of the r-values. stralloc uses "strdup": on Win32 and winCE strdup is _strdup (!). 6/ prototypes.h : _beginthread was defined as returning an int, an a long in sthread.c. After some checking in various documentations, long is the correct type, in particular because _beginthread can return the special error value "-1L". So that unsigned types are illogical. This simplifies the code in some locations, by saving some -now useless- casts. 7/ sthread.c create_client: suppressed some useless cast to (long) for beginthread. ************* II] OPERATIONAL ERRORS (at run-time) This is a reminder of previous notification to the mailing list : due to beginthread improper code and/or use, It is presently IMPOSSIBLE for stunnel 434 to be used in production on WCE: it is just unable to service any...service. Nothing happens if, for example, you use it to connect to an https server. No log either ! I corrected the code with both Michal patch to gui.c and mine to sthread.c: gui.c (Michal patch) : _beginthread was called with 0 as stacksize which, cumulated to an improper coding of sthread/beginthread, led to FAILURE of service thread creation. sthread.c: _beginthread : now supports "0" stacksize value, leading to default linker stack size (1MB by default unless specified differently on the linker command line, something we do not yet perform but could). ************* III] MINOR IMPROVMENT _beginthread: added a log on critical event of "failure" to create a service thread. because I think it is a critical event, isn't it? I hope you will find this patch useful. Thank you for your excellent work, Yours sincerely, Pierre Delaage Note : I use stunnel to establish a simple "vpn" between smartphones and a corporate linux server mainly for HTTPS/POPS/SMTPS support. Stunnel is very relevant in that matter, over solutions based on SSH (although we use also ssh), from a communication cost point of view : ssh establishes permanent socket between client and server, so that the communication is charged by the mobile network provider : and these charges are very expensive. On the contrary stunnel only establishes ssl sockets on demand so that financial charges are limited to strict necessary. Please note that stunnel brings "client based certificate authentication" to POP/SMTP mobile mail user agents which only BASICALLY supports SSL with server authentication, but NO client authentication, such as M$ Outlook for Mobile (unless you pay for an exchange server and exchange client licence). Here again stunnel is very relevant. Note 2 : the strdup and unicode bug fixes should benefit also to the win32 (for PC) stunnel version for PC.

1 1

Reg:libwrap is not working with stunnel 4.34
by mohan raj 10 Nov '10

10 Nov '10

Hi, I successfully cross compiled the Stunnel version 4.34 with OpenSSL version 1.0.0a for arm-linux.i want to use this stunnel with my own application which will communicate with outer world through LAN or GPRS.currently i am testing stunnel with telnet application.Its working fine.I am able to telnet to arm board through SSL enabled telnet terminal software.Now i want restrict the access.so i used the /etc/hosts/allow and /etc/hosts.deny files with my chrroot directory as "/".but stunnel is not at all cared about libwrap service.its not checking those files.if i give libwrap=yes in stunnel.conf file its says "specified option name is not valid here".i compiled stunnel with the option --enable-libwrap and gave the libwrap lib also through LDFLAGS.here with i attached my stunnel version information file, stunnel .conf file also.i think its due to configuration???still i don`t know what to do???so please guys help me out. Thanks & Regards S.Thiyagarajan.

3 4

Many services on the same port (VirtualHost)
by Hugo 02 Nov '10

02 Nov '10

Hello all! Does anyone knows a way to make many services listening on the same port? I've got one stunnel4 server which allows me to crypt two http servers. The first service bind on port 465 and the second on 470. What I will is to let user access on the port 465 using 2 different ServerNames. Thank you in anticipation, and excuse me for my quite bad english =D

4 3

Re: [stunnel-users] stunnel-users Digest, Vol 75, Issue 13
by Hugo 31 Oct '10

31 Oct '10

It's what I wanted to do: redirect the public 443 port on the correct local stunnel "accept:" port or service. I'd set 3 services with 3 different certificates on 3 ports. By eg, my first domain is ssl.example.com and the second admin.example.com. These two records point on the same IP. Stunnel has two services on that, so it binds two ports (!=443) (eg, 7100 and 7200) Is there a way to stunnel (or another program) bind on port 443 and, if user connects on ssl.example.com, forward frames/respond using the service/port 7100, and the same for admin.example.com on 7200? https://ssl.example.com ==> https://ssl.example.com:7100 https://admin.example.com ==>https://admin.example.com:7200 ? Thanks Message: 2 Date: Sat, 30 Oct 2010 11:45:19 -0400 (EDT) From: Jon Daley <stunnel(a)jon.limedaley.com> To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Many services on the same port (VirtualHost) Message-ID: <alpine.DEB.2.00.1010301139120.19689(a)orange.limedaley.com> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed On Sat, 30 Oct 2010, Hugo wrote: > Does anyone knows a way to make many services listening on the same port? > I've got one stunnel4 server which allows me to crypt two http servers. > The first service bind on port 465 and the second on 470. > What I will is to let user access on the port 465 using 2 different > ServerNames. I am not sure what you are trying to do. You want clients to connect via https to ports 465 on two different IPs and then stunnel to forward them to the appropriate http daemon? I am not sure if stunnel works in that method - that is the reverse of what I use stunnel for - I connect via an unencrypted connection, and forward via stunnel to an encrypted daemon. And if you are talking about virtually hosting https connections, that will work, as long as the certificate contains both servernames - you can't use two different certificates, because you don't know which certificate to serve until after the connection is encrypted.

2 2

Re: [stunnel-users] Many services on the same port (VirtualHost)
by Hugo 31 Oct '10

31 Oct '10

Thanks for the answer, but it seems I haven't got access to IPTables (my stunnel is on a remote shell service) and I think using a webserver is not a good solution for that case. So does anyone knows a program able to bind on a single port, and redirect requests on another depending on the domain name? Thanks you in anticipation Hugo On 30/10/2010 17:02, Pierre DELAAGE wrote: > Hello, > The answer is simply NO in stunnel, > but yes in Apache. > If you are joining one "http server", hosting many virtual hosts, > it should be "trivial". > I recommend using IP based hosting. > > I guess you want to act as a transparent gateway/proxy to https servers : > there is another way to proceed if you have a linux PC on your network > that can act as a routing/gateway: > with iptables you can do redirection to stunnel and get what you want. > Sorry but it is a little bit complicated to develop more now. > > Hope this helps, > Pierre Delaage > > > Le 30/10/2010 17:12, Hugo a écrit : >> Hello all! >> >> Does anyone knows a way to make many services listening on the same port? >> I've got one stunnel4 server which allows me to crypt two http servers. >> The first service bind on port 465 and the second on 470. >> What I will is to let user access on the port 465 using 2 different >> ServerNames. >> >> Thank you in anticipation, and excuse me for my quite bad english =D >> >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)mirt.net >> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >

2 1