July 2013 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 06 Jul '16

06 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Library for iOS
by ios dev 30 Jul '13

30 Jul '13

Hi. I have to build static library for using in iOS application. Did anybody already built it? How can I do it? Thanks.

1 0

Reverse DNS lookup in stunnel log possible?
by mkanet＠yahoo.com 28 Jul '13

28 Jul '13

I currently have stunnel strip SSL from incoming https connections; which then passes the connections to a proxy before ultimately reaching my web server. So, the only easy way to see where incoming connections are coming from are in the stunnel log. Below, is a small example of what my stunnel log looks like (no, those arent the real IPs ). The information below would be much more useful to me if it included the DNS names in addition to their numeric IP. I currently have the latest Windows version of stunnel installed. It would be great to know how to get it to resolve DNS names as well in the log file; preferably without impeding general stunnel performance. I tried several debug levels; but none them did reverse DNS lookup. Hopefully someone know how to do this on a Windows stunnel setup. 2013.07.23 10:16:00 LOG5[10152:15136]: Service [stunnel-sslh] connected remote server from 24.12.152.129:58773 2013.07.23 10:16:00 LOG3[10152:15136]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2013.07.23 10:16:00 LOG5[10152:15136]: Connection reset: 272 byte(s) sent to SSL, 96 byte(s) sent to socket 2013.07.23 10:17:53 LOG5[10152:4000]: Service [stunnel-sslh] accepted connection from 71.194.51.232:5535 2013.07.23 10:17:53 LOG5[10152:4000]: connect_blocking: connected 24.12.152.129:7777 2013.07.23 10:17:53 LOG5[10152:4000]: Service [stunnel-sslh] connected remote server from 24.12.152.129:58799 2013.07.23 10:17:53 LOG5[10152:13212]: Service [stunnel-sslh] accepted connection from 71.194.51.232:5508 2013.07.23 10:17:53 LOG5[10152:3348]: Service [stunnel-sslh] accepted connection from 71.194.51.232:5509 2013.07.23 10:17:53 LOG5[10152:2884]: Service [stunnel-sslh] accepted connection from 71.194.51.232:5519

4 9

Re: [stunnel-users] Server down
by Ludolf Holzheid 25 Jul '13

25 Jul '13

On Wed, 2013-07-24 13:22:26 -0400, Walter Hankins wrote: > Hi Ludoff, > > I am new to stunnel. I trying to configure. > > Stunnel.conf: > socket = l: TCP_NODELAY = 1 > socket = r: TCP_NODELAY = 1 > > debug = 7 > output = stunnel.log Hi Walter, Always reply to the list, so others can comment. Your log says `Cannot open log file: stunnel.log´. I don't how you invoke stunnel, so I don't know if the directory it's working in is writable, but you may try to specify an output file in a writable directory with an absolute path, e.g. output=C:/stunnel.log if C:\ is writable on your box. HTH, Ludolf -- Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:lholzheid@bihl-wiedemann.de http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Server down
by Walter Hankins 25 Jul '13

25 Jul '13

Server is down Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from C:/.rnd Wrote 0 new random bytes to C:/.rnd PRNG seeded successfully Initializing service [Ssmtp] Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded SSL options set: 0x01000004 Configuration successful Service [Ssmtp] (FD=672) bound to 127.0.0.1:25 Cannot open log file: stunnel.log Closing service [Ssmtp] Service [Ssmtp] closed (FD=672) Sessions cached before flush: 0 Sessions cached after flush: 0 Service [Ssmtp] closed Server is down

2 1

Re: [stunnel-users] stunnel and keepalive
by David H. Durgee 24 Jul '13

24 Jul '13

> `stunnel -sockets´ should show the available socket options and their > default values. > > For the box I'm writing this mail from, the default for TCP_KEEPIDLE > is 7200 and for TCP_KEEPINTVL 75 (both in seconds). You'll have to be > quite patient if you want to watch keepalive packets in wireshark > without tweaking the defaults ... > > HTH, > > Ludolf You hit the nail on the head. I set the parameters to something more reasonable and I now see the keepalive packets. Thank you for your speedy response. Dave

1 0

keepalive and stunnel
by David H. Durgee 24 Jul '13

24 Jul '13

I am attempting to use stunnel to provide secure telnet access to a server on my system. As it is possible that a user may be idle for long period I have attempted to enable keepalive with stunnel. My stunnel conf files contain: socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 on both the server and client side. But wireshark shows no keepalive packets being exchanged. I am using socat to provide a service on the LAN and connections using socat do show keepalive packets. But to get this working with socat I had to use the following: socat -d -d -L/var/lock/Port$PORT - TCP:127.0.0.1:$PORT,keepalive,keepcnt=10,keepidle=3,keepintvl=1 I had originally tried it with only the keepalive option, but it took adding the other three options for it to work. Perhaps this is particular to my linux mint 13 maya x64 system and keepalive works by itself on windows? Are the other three options supported in stunnel? Dave

2 1

What do I need to provide an SSL service and verify individual clients?
by John Long 22 Jul '13

22 Jul '13

Hi, I want to set up a service using stunnel as a server. I want only specific clients to be able to connect. Each client will have an SSL-enabled client app. I understand the part about needing to create a self-signed cert for the stunnel server. I don't understand what Stunnel will require from each client. Do I have to create CSRs for each client and sign them with my self-signed cert, or will the keys from additional standalone self-signed certs for each client be good enough on the client side as long as I have a cert that for each key in the certificate path of the server? Is it correct that verify=3 will make sure only clients that have keys matching the certs in the server cert path can connect? If a client with a key that I have no cert for tries to connect, what should happen? Will it time out or will there be an error that the key isn't valid? Thanks, /jl

1 0