January 2014 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

behavior change after enabling proxy protocol
by Philippe Anctil 05 Jun '14

05 Jun '14

Hello, We use stunnel to secure a proprietary tcp/ip protocol over the internet. More specifially we have - 1 balancer - 2 stunnel boxes - 1 app server The load balancer 'pings' stunnel boxes regularly to know if one is down. Recently, we have added support for the proxy protocol in our app and turned it on in our stunnel config. It works great except for one small new behavior: upon receiving a load balancer ping, stunnel performs a connection on our app (and sends the proxy header). I ran a tcpdump for a telnet on the stunnel port (8000). With proxy protocol disabled, stunnel does nothing while it waits for the certificate. The connection ended at my request. 17:33:08.537385 IP 127.0.0.1.6015 > 127.0.0.1.8000: S 356922015:356922015(0) win 32792 <mss 16396,sackOK,timestamp 1085620573 0,nop,wscale 7> 17:33:08.537386 IP 127.0.0.1.8000 > 127.0.0.1.6015: S 1525966521:1525966521(0) ack 356922016 win 32768 <mss 16396,sackOK,timestamp 1085620573 1085620573,nop,wscale 7> 17:33:08.537393 IP 127.0.0.1.6015 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085620573 1085620573> 17:33:19.750431 IP 127.0.0.1.6015 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085631785 1085620573> 17:33:19.751065 IP 127.0.0.1.8000 > 127.0.0.1.6015: . ack 2 win 256 <nop,nop,timestamp 1085631786 1085631785> 17:33:19.751794 IP 127.0.0.1.8000 > 127.0.0.1.6015: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085631787 1085631785> With proxy protocol enabled, stunnel establishes a connection to my app and sends the proxy protocol before even receiving the certificate. 17:34:35.370462 IP 127.0.0.1.6026 > 127.0.0.1.8000: S 2949098861:2949098861(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.370475 IP 127.0.0.1.8000 > 127.0.0.1.6026: S 1044893129:1044893129(0) ack 2949098862 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.370481 IP 127.0.0.1.6026 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371035 IP 127.0.0.1.37654 > 127.0.0.1.9000: S 801705083:801705083(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.371046 IP 127.0.0.1.9000 > 127.0.0.1.37654: S 4068822820:4068822820(0) ack 801705084 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.371052 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371583 IP 127.0.0.1.37654 > 127.0.0.1.9000: P 1:44(43) ack 1 win 257 <nop,nop,timestamp 1085707403 1085707402> 17:34:35.371595 IP 127.0.0.1.9000 > 127.0.0.1.37654: . ack 44 win 256 <nop,nop,timestamp 1085707403 1085707403> 17:34:50.484991 IP 127.0.0.1.9000 > 127.0.0.1.37654: F 1:1(0) ack 44 win 256 <nop,nop,timestamp 1085722515 1085707403> 17:34:50.485892 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 2 win 257 <nop,nop,timestamp 1085722516 1085722515> 17:35:08.824661 IP 127.0.0.1.6026 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085740854 1085707402> 17:35:08.824906 IP 127.0.0.1.8000 > 127.0.0.1.6026: . ack 2 win 256 <nop,nop,timestamp 1085740854 1085740854> 17:35:08.824972 IP 127.0.0.1.37654 > 127.0.0.1.9000: R 44:44(0) ack 2 win 257 <nop,nop,timestamp 1085740854 1085722515> 17:35:08.825013 IP 127.0.0.1.8000 > 127.0.0.1.6026: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085740855 1085740854> Note I used 'tcpdump -i lo -nn port 8000 or port 9000' for both traces. I see no good reason to connect to the application before the ssl session is established. Thank you for reading! -- Philippe Anctil

2 2

Connect to Outlook.com SMTP with stunnel
by Tenhult Server 30 Jan '14

30 Jan '14

Hi, i'm trying to send mail with the help of stunnel but i get STARTTLS expected, what is wrong with my setup? File: stunnel.conf [outlook-smtp] protocol = smtp accept = 127.0.0.1:25 connect = smtp-mail.outlook.com:587 Log 2014.01.26 13:59:03 LOG5[1536]: stunnel 5.00 on x86-pc-msvc-1500 platform 2014.01.26 13:59:03 LOG5[1536]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 ... ... 2014.01.26 13:59:16 LOG6[2428]: Server-mode smtp protocol negotiations started 2014.01.26 13:59:16 LOG7[2428]: RFC 2487 detected 2014.01.26 13:59:16 LOG7[2428]: <- 220 BLU0-SMTP180.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Sun, 26 Jan 2014 04:59:07 -0800 2014.01.26 13:59:16 LOG7[2428]: -> 220 BLU0-SMTP180.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Sun, 26 Jan 2014 04:59:07 -0800 + stunnel 2014.01.26 13:59:16 LOG7[2428]: <- EHLO Fredrik-Laptop 2014.01.26 13:59:16 LOG7[2428]: -> 250-EHLO Fredrik-Laptop Welcome 2014.01.26 13:59:16 LOG7[2428]: -> 250 STARTTLS 2014.01.26 13:59:16 LOG7[2428]: <- MAIL FROM: <mymail(a)live.com> 2014.01.26 13:59:16 LOG3[2428]: STARTTLS expected 2014.01.26 13:59:16 LOG5[2428]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.01.26 13:59:16 LOG7[2428]: Remote socket (FD=520) closed 2014.01.26 13:59:16 LOG7[2428]: Local socket (FD=540) closed 2014.01.26 13:59:16 LOG7[2428]: Service [outlook-smtp] finished (0 left) Fredrik

2 1

Specifying a username and password
by Allen Crist 30 Jan '14

30 Jan '14

I have a scanner that only has an smtp address and port #. There is no option to specify a username and password. Is there a way to configure STunnel to assist with this? Regards, Allen -- Allen Crist, Owner A+ | Network+ | Security+ | MCITP/MCSA: Windows Server 2008 *CCW Technology Computer Repair*Serving Home & Small Business Customers since 2008 (801)410-0203 http://www.ccwtech.com http://www.facebook.com/CCWTechnology

1 0

Filename is not cached for later editing
by Javier 24 Jan '14

24 Jan '14

Hi, Scenario in Windows. I found today that, when you specify a configuration file different from the standard file name, you can't edit it through "Configuration>Edit stunnel.conf". Stunnel tries to edit stunnel.conf, and, if not found, creates a new one through notepad. This doesn't affect to the reload function, where the configuration file specified is used for reload. Also, this is not important, because in most cases is used the default file name, but maybe could be implemented the ability to change those menu options to display the current configuration file name used instead the standard. Let's say we use a configuration file named xxx.conf. The menu may change to "Edit xxx.conf" and "Reload xxx.conf" instead "Edit stunnel.conf" and "Reload stunnel.conf". This may be interesting for when we have several services installed and identify them better. Regards.

4 9

Additional certificate (like openssl s_server -dkey/-dcert)
by Lapo Luchini 24 Jan '14

24 Jan '14

Is it possible to configure STunnel to support "additional" certificate like OpenSSL s_Server's -dkey/-dcert parameters, in order to support ECDSA in addition to RSA on the same connection? -- Lapo Luchini - http://lapo.it/ “Two can keep a secret if one is dead.” (anonymous)

2 1

SSL communication is unestablishable by stunnel.
by take＠kasaneiro.jp 24 Jan '14

24 Jan '14

stunnel is used in order to use SMTPs/POPs, when using the e-mail software Mew. However, the following logs come out, emacs solidifies and communication is impossible. How is it repaired if it carries out? Please let me know if you please. Computer environment Apple MacBook Pro (Mid 2012), Mac OS X 10.9.2 GNU (Cocoa)Emacs 24.3.50.1 (x86_64-apple-darwin13.0.0, NS apple-appkit- 1265.00) Mew 6.5 Stunnel 4.56 --- <SSL/TLS: > 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Clients allowed=125 2014.01.23 23:30:26 LOG5[15311:140735163843344]: stunnel 4.56 on x86_64- apple-darwin13.0.0 platform 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Compiled/running with OpenSSL 0.9.8y 5 Feb 2013 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Threading:PTHREAD Sockets:SELECT,IPv6 SSL:ENGINE,OCSP 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Reading configuration from file /var/folders/tc/0dm70kl977x3_rcfkldrzz3h0000gn/T/take15307AeS/ mew1530708i 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Compression not enabled 2014.01.23 23:30:26 LOG7[15311:140735163843344]: PRNG seeded successfully 2014.01.23 23:30:26 LOG6[15311:140735163843344]: Initializing service [ 8840] 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Verify directory set to /Users/take/.certs 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Added /Users/take/. certs revocation lookup directory 2014.01.23 23:30:26 LOG7[15311:140735163843344]: SSL options set: 0x00000004 2014. <SSL/TLS: > 01.23 23:30:26 LOG5[15311:140735163843344]: Configuration successful 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Service [8840] (FD=7) bound to 127.0.0.1:8840 2014.01.23 23:30:26 LOG7[15311:140735163843344]: No pid file being created <SSL/TLS: > 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Service [8840] accepted (FD=3) from 127.0.0.1:56364 2014.01.23 23:30:26 LOG7[15311:4558856192]: Service [8840] started 2014.01.23 23:30:26 LOG5[15311:4558856192]: Service [8840] accepted connection from 127.0.0.1:56364 2014.01.23 23:30:26 LOG6[15311:4558856192]: connect_blocking: connecting 127.0.0.1:99 2014.01.23 23:30:26 LOG7[15311:4558856192]: connect_blocking: s_poll_ wait 127.0.0.1:995: waiting 10 seconds 2014.01.23 23:30:26 LOG3[15311:4558856192]: connect_blocking: connect 127.0.0.1:995: Connection refused (61) 2014.01.23 23:30:26 LOG5[15311:4558856192]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.01.23 23:30:26 LOG7[15311:4558856192]: Local socket (FD=3) closed 2014.01.23 23:30:26 LOG7[15311:4558856192]: Service [8840] finished (0 left)

2 1

OCSP Responders in AIA extension
by Ender Erel 22 Jan '14

22 Jan '14

Hi All, Does stunnel check the OCSP responders found in a certificate's AIA field? I am asking this because in the following e-mail from back 2008, the sender mentions a patch that implements this functionality. The patch is included with the mail but I don't think it is included in the later versions of stunnel. Does this mean OCSP responders inside a certificate are ignored? I also want to ask another thing. When using verify = 3 in client mode, which file is used to check the received certificate? Is it the CAfile? If so, would it work like this: - I manually opened a connection to a server outside stunnel, downloaded the server's certificate, and closed the connection. - I saved this certificate to a file, and wrote the path of this file in the stunnel configuration file (CAfile = /mycerts/tmpcert.pem,verify=3). - I started stunnel and initiated a connection to the server. Would the connection be successful? Would it be the right way to use verify=3? Kind Regards, Ender Erel

2 3