April 2012 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 06 Jul '16

06 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

stunnel 4.53 released
by Michal Trojnara 04 Jun '12

04 Jun '12

Dear Users, I have released version 4.53 of stunnel. This is major a bugfix release. Upgrade is highly recommended. The ChangeLog entry: Version 4.53, 2012.03.19, urgency: MEDIUM: * New features - Added client-mode "sni" option to directly control the value of TLS Server Name Indication (RFC 3546) extension. - Added support for IP_FREEBIND socket option with a pached Linux kernel. - Glibc-specific dynamic allocation tuning was applied to help unused memory deallocation. - Non-blocking OCSP implementation. * Bugfixes - Compilation fixes for old versions of OpenSSL (tested against 0.9.6). - Usage of uninitialized variables fixed in exec+connect services. - Occasional logging subsystem crash with exec+connect services. - OpenBSD compilation fix (thx to Michele Orru'). - Session id context initialized with session name rather than a constant. - Fixed handling of a rare inetd mode use case, where either stdin or stdout is a socket, but not both of them at the same time. - Fixed missing OPENSSL_Applink http://www.openssl.org/support/faq.html#PROG2 - Fixed crash on termination with FORK threading model. - Fixed dead canary after configuration reload with open connections. - Fixed missing file descriptors passed to local mode processes. - Fixed required jmp_buf alignment on Itanium platform. - Removed creating /dev/zero in the chroot jail on Solaris platform. - Fixed detection of WSAECONNREFUSED Winsock error. - Missing Microsoft.VC90.CRT.manifest added to Windows installer. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.53.tar.gz: 3e640aa4c96861d10addba758b66e99e7c5aec8697764f2a59ca2268901b8e57 Best regards, Mike

3 2

Getting Stunnel to Work Under Windows 7 64-bit
by Thomas Eifert 03 May '12

03 May '12

For the benefit of the group, I thought I'd share some experiences I had when attempting to get Stunnel to run under Windows 7 SP1 64-bit. I initially installed Stunnel version 4.53 to the default location, which in Windows 7 64-bit is: C:\Program Files (x86)\stunnel\ I installed the service from the start menu option, then rebooted my machine. I have administrator rights, and User Account Control is disabled. My observations included the following: 1. The Stunnel status window displayed only configuration loads. No output from any active connection was ever displayed, despite the fact that Stunnel was passing traffic to/from SSL-enabled servers. 2. Stunnel would not write to the log file. The error message indicated that Stunnel was unable to open stunnel.log. Initially, I thought this might be a factor in the lack of status window connection output, so I commented the log statement out to eliminate it. I then reloaded the configuration. The issue of not seeing any connection info was unaffected. 3. The notification area icon would not appear on Stunnel service load. It would mysteriously appear, then disappear, at seemingly random times. 4. Once the service was installed, it was not possible to stop it or uninstall it from the provided start menu shortcuts. Whenever I attempted to do so, the Stunnel status window would appear. However, I was able to perform these actions successfully by opening a command prompt, then issuing the commands from there. In an effort to unravel these issues, I tried the following workarounds: 1. I re-installed stunnel to a non-system controlled directory. In my case, it was C:\Apps\stunnel\. 2. I attempted to run stunnel in compatibility mode, set for Windows XP SP3. 3. I tried installing 2 previous versions of Stunnel. All combinations produced exactly the same undesired result. Finally, I stopped and uninstalled the service. Instead of using that method, I created a shortcut to stunnel.exe, and placed it in the start menu's startup folder, then rebooted. Stunnel started at boot time, and all of the above issues were resolved. As such, it seems like Stunnel just doesn't like to be run as a service on a Windows 7 64-bit machine; at least not on the one I own. If you're encountering any stability issues with the Stunnel service in the Windows 7 64-bit environment, try my method. It works. I'd like to extend a special thank you to Carter Browne, who provided valuable input throughout the course of my testing. Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 2

ssl3 handshake error
by Colin Chalmers 28 Apr '12

28 Apr '12

Hi all, I'm pretty new to stunnel but did get this config to work on a linux box - now I am trying the same/similiar config on a win7 box but keep getting the handshake error below. I am using the latest version of stunnel and have tried searching for an answer via google, making the proposed changes as described No matter what settings I use it always seems to use the sslv3 handshake which then goes wrong :-( I'd appreciate any help on this Colin My config is as follows: ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may useful for troubleshooting) ; Some debugging stuff useful for troubleshooting debug = 7 output = c:\temp\stunnel.log ; Use it for client mode client = yes rndbytes = 256 rndfile = c:\temp\randseed.bin ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Disable FIPS mode to allow non-approved protocols and algorithms fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = CT_20110324.pem ; Disable support for insecure SSLv2 protocol sslVersion = TLSv1 options = NO_SSLv2 options = NO_SSLv3 [CT] ; incoming connection from the client application accept = 444 ; outgoing connection connect = remote.server.com:443 TIMEOUTclose = 0 Error in log file 2012.04.11 18:33:54 LOG7[3684:3640]: Remote socket (FD=440) initialized 2012.04.11 18:33:54 LOG3[3684:3640]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2012.04.11 18:33:54 LOG5[3684:3640]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.04.11 18:33:54 LOG7[3684:3640]: Remote socket (FD=440) closed 2012.04.11 18:33:54 LOG7[3684:3640]: Local socket (FD=408) closed 2012.04.11 18:33:54 LOG7[3684:3640]: Service [CT] finished (0 left)

3 2

Using Stunnel client but not Stunnel server with Apache mod_ssl
by Lilienberg, Daniel () 27 Apr '12

27 Apr '12

Hi, My supplier is using a somewhat strange setup looking like this: CLIENT: Stunnel running in client mode accepting incoming requests on port 8080. It will forward it to port to a server, port 443. SERVER: NOT running Stunnel at all, but running Apache with mod_ssl. It also acts as a proxy server, proxying all requests. Can this work, if so, how do I set it up ? [http://www.volvocars.net/support/IT/Services/IT_workplace/Email/outlook/sig…] Daniel Lilienberg Architect Connectivity Foundation Volvo Car Corporation Dept. 61630/PV2A Göteborg Sweden Telephone +46-31-3542317 dlilien2(a)volvocars.com<mailto:dlilien2@volvocars.com> www.volvocars.com<http://www.volvocars.com/> Registered Office Göteborg, Sweden Registration No. 556074-3089

1 0

Windows 7 64-Bit
by Thomas Eifert 23 Apr '12

23 Apr '12

Has anyone attempted to install and run Stunnel on Windows 7 64-bit? If so, which version did you use, and were any issues experienced? Regards. Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

Possible error in stunnel 4.20
by Andreea Ion 20 Apr '12

20 Apr '12

Hi, I am running stunnel 4.2 on windows and I get the following log. I don't know if it's ok, if the problem is at the stunnel lovel or at the application level. SSL state (connect): before/connect initialization 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 write client hello A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 read server hello A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 read finished A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 write change cipher spec A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 write finished A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 flush data 2012.04.20 11:46:09 LOG7[5684:4492]: 2 items in the session cache 2012.04.20 11:46:09 LOG7[5684:4492]: 5 client connects (SSL_connect()) 2012.04.20 11:46:09 LOG7[5684:4492]: 5 client connects that finished 2012.04.20 11:46:09 LOG7[5684:4492]: 0 client renegotiations requested 2012.04.20 11:46:09 LOG7[5684:4492]: 0 server connects (SSL_accept()) 2012.04.20 11:46:09 LOG7[5684:4492]: 0 server connects that finished 2012.04.20 11:46:09 LOG7[5684:4492]: 0 server renegotiations requested 2012.04.20 11:46:09 LOG7[5684:4492]: 3 session cache hits 2012.04.20 11:46:09 LOG7[5684:4492]: 0 session cache misses 2012.04.20 11:46:09 LOG7[5684:4492]: 0 session cache timeouts 2012.04.20 11:46:09 LOG6[5684:4492]: SSL connected: previous session reused 2012.04.20 11:46:54 LOG3[5684:4492]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2012.04.20 11:46:54 LOG5[5684:4492]: Connection reset: 154 bytes sent to SSL, 0 bytes sent to socket 2012.04.20 11:46:54 LOG7[5684:4492]: Session finished (0 left) The last 3 lines are those that interests me most. Is this ok ? Regards, Andreea

1 0

(no subject)
by Guylhem 19 Apr '12

19 Apr '12

Hello With verify=3 and the certs loaded in the conf file with CAfile=startssl-chain.pem cert=mycert.pem, I get : CERT: Certificate not found in local repository Using the latest stunnel recompiled on a debian squeeze, the best I can get is: error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib SSL_CTX_use_PrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line However, if I put these very same pem files in a directory as a CApath option instead (c_rehash applied) everything works fine. But The pem files are identical ! I've read http://stunnel.mirt.net/pipermail/stunnel-users/2010-November/002854.html but it seems a bit different The startssl-chain.pem was created with: wget http://www.startssl.com/certs/ca.pem wget http://www.startssl.com/certs/startssl.ca.pem cat sub.class1.server.ca.pem ca.pem > startssl-chain.pem I guess that may be the cause of the problem? What should I do to pass these pem files as stunnel.conf options instead of using the CApath? Guylhem

1 0

(no subject)
by Marco Tulio Jimenez Abrego 19 Apr '12

19 Apr '12

Buenos días El mensaje de error es: Error resolving 'smtp.gmail.com': Neither nodename nor servname known (EAI_NONAME). Gracias por su atención. -- Saludos. Att. Marco T. Jiménez ================ Tel. 6619-6782

3 2