September 2013 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Hostname verification, support for, and patches
by fslama＠comcast.net 06 Dec '13

06 Dec '13

After scouring the net I've found several isolated discussions regarding stunnel hostname validation. And also some patches that seem to implement hostname validation: https://www.stunnel.org/pipermail/stunnel-users/2010-March/002613.html I have a requirement to have stunnel (4.56) validate client certificates and their identity by comparing the its CNAME against the source address. I recall reading one response (which I can't find at the moment) from Marzena Trojnara indicating that this feature won't be supported. If so, can you explain the rational? Are there sanctioned patches out there today? Regards, -Fred

4 3

Stunnel North American FTP Down?
by Thomas Eifert 07 Oct '13

07 Oct '13

This evening, I'm unable to access the North American Stunnel FTP site. If I go in with Filezilla in passive mode, I can do a directory listing, but the directory is empty. If I use the browser by clicking on the FTP link on the stunnel web page, I get an error 550 Failed to change directory. I was able to access the European site, however. Enjoy the day. -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 2

Issue with TCPmon and Stunnel
by Odays 01 Oct '13

01 Oct '13

Hi all. I need to configure TCPMon+Stunnel to capture the request/response message in the communication with a web services using https. So I download stunnel-4.56-installer.exe and install it. In TCPMon I put that it listen in port 7777 and redirect to port 1234. In Stunnel I put this configuration: client=yes verify=0 [my-https] accept = 127.0.0.1:1234 connect = webservices_server:443 TIMEOUTclose = 0 When i run the scenario I see this log: 2013.09.30 16:12:57 LOG7[8612:6032]: Service [my-https] started 2013.09.30 16:12:57 LOG5[8612:6032]: Service [my-https] accepted connection from 127.0.0.1:51759 2013.09.30 16:12:57 LOG7[8612:6032]: SSL state (accept): before/accept initialization *2013.09.30 16:12:57 LOG3[8612:6032]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request* 2013.09.30 16:12:57 LOG5[8612:6032]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.09.30 16:12:57 LOG7[8612:6032]: Local socket (FD=448) closed 2013.09.30 16:12:57 LOG7[8612:6032]: Service [my-https] finished (0 left) Any idea about this error? Thanks. -- Este mensaje le ha llegado mediante el servicio de correo electronico que ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema Nacional de Salud. La persona que envia este correo asume el compromiso de usar el servicio a tales fines y cumplir con las regulaciones establecidas Infomed: http://www.sld.cu/

3 2

Generic/general mechanism to forward mail servername, login, port from client to stunnel
by Ben Stover 27 Sep '13

27 Sep '13

Refering to my last posting I want to ask a related question: I read in the past somewhere that I can access stunnel from my local email client in more generic way: At first: stunnel always listens AUTOMATICALLY by default on port 127.0.0.1:9999 für incoming request and forwards the prepared/modified request to the outside world. The core parameter are NOT specified in the .conf file but by the User ID which is passed by the local client to local stunnel service. The syntax is as follows: userid=<servername>/<remotes-ssl-tls-port>/<loginname> Example: userid=pop.mail.yahoo.com/995/myname123 So as soon as stunnel receives at 127.0.0.1:9999 an incoming local connect he accepts the following userid string and tokenize it into the three parts. Given these three tokens stunnel is able to connect in the second step the remote mail server WITHOUT any further need of specification in the .conf file. Do I remember this correct? Is this mechanism described somewhere in detail? Thank you Ben

1 0

PATCH: multiple SNI options per slave section
by David Owen 27 Sep '13

27 Sep '13

Hello and thank you for stunnel! After switching from my web-server's built-in SSL support, I now have a much more secure system and SNI, too! In stunnel(8), I read this about the sni option: "sni option can also be specified more than once within a single slave service." However, I couldn't get it to work, and reading the source code verified that only one sni option is tracked per section. So, I present my patch to allow multiple sni options. It enables configurations like these: [https] ... [group1] sni = https:a.example.org sni = https:b.example.org ... [group2] sni = https:c.example.org sni = https:d.example.org ... If you have a naming scheme that doesn't lend itself to the wildcard matching already supported, this can cut your config size quite a bit. DETAILS The sni option for any section was originally tracked in the section->sni member (a string). Now, a linked-list of sni options is added to the section structure, with every sni option being appended to the end. For server setup, each slave section walks over its list, splitting each sni option and adding that slave section to the master's slave list. Splitting options and adding slaves to masters works as before, but now the slave section iterates over a list instead of referencing a single string. For client setup, each slave section checks that it has either no sni options, or exactly one. Multiple sni options results in an error. If exactly one option is found, it is copied to the old sni field of the section struct. The old sni field has been renamed to servername_to_request, as it is now used only in client mode, and this makes its purpose more clear. When no sni option is found, servername_to_request is initialized from the protocolHost or connect options, as before. I hope this patch is useful to others. Please let me know how I can make it acceptable for inclusing in the stunnel distribution. Thanks, David

1 0

Proxy HTTPS via stunnel without any certificates on proxy/stunnel box
by Gary Chodos 25 Sep '13

25 Sep '13

Greetings, We are trying to decide between SNIProxy and stunnel for the following task: - Client browser hits https://foo.bar.org, which resolves to an IP that corresponds to the stunnel machine listening on 443. - stunnel "forwards" (sorry if this is not the correct technical term) the connection to a different machine, specified by a different IP address, which is also configured to believe it is foo.bar.org and actually has a web server listening on 443 and houses the SSL key/cert. - when stunnel hits the end server, the latter sees the stunnel IP address as source, not the original user's (who initiated the web request for https://foo.bar.org) I believe this is default behavior, but just noting it for completeness. Is it possible to accomplish this (stunnel listening on and connecting to https endpoints) without housing any certs/keys on the stunnel machine itself, because we want the second server to deal with all that and we do not have access to those keys anyway. And of course, the users which go to the https://foo.bar.org should not see any cert mismatches as a result of loading https://foo.bar.org which, for the user, will resolve to the stunnel/proxy IP, rather than the end server which actually had a running web server and keys/cert. Sorry if the above detail is insufficient; do let me know. Thanks for your help. Gary

2 2

Port assignment in .conf file for local email client unique?
by Ben Stover 25 Sep '13

25 Sep '13

Assume I want to connect from my local email client to two (!) remote email servers The corresponding instructions in .conf file looks like (my guess): [smtps-firstacct] accept = 127.0.0.1:259 connect = smtps.myisp1.com:465 [smtps-secondacct] accept = 127.0.0.1:259 connect = smtps.myisp2.com:465 Questions: 1.) a configuration like above with the same "accept" port 259 is NOT possible because stunnel does not know to which remote email server he has to connect. To distinguish two different remote email server I always have to select TWO different accept-ports like [smtps-firstacct] accept = 127.0.0.1:259 connect = smtps.myisp1.com:465 [smtps-secondacct] accept = 127.0.0.1:258 connect = smtps.myisp2.com:465 Correct? 2.) Can I use arbitrary accept-ports like 1242 or 23199 or is there a port range from I have to select one? 3.) Moreover assume I want to make the SSL connection transparent can I select an accept-port 25? 4.) I read somewhere that I have always to specify in email client for POP3/SMTP an address 127.0.0.1:9999 and NOT 127.0.0.1:259 in order to connect to local stunnel service. Because local stunnel service is always listening on port 9999. Is this correct? Thank you Ben

2 2