stunnel-users November 2014

stunnel-users@stunnel.org

15 participants
16 discussions

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 06 Jul '16

06 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Memory leak on reconfiguration
by Alexander Paramonov 21 Nov '14

21 Nov '14

Hello, colleagues! I suppose there is a memory leak on stunnel reconfiguration when it receives the SIGHUP signal. Here is my experiment with stunnel 5.05 on linux: ~/busybox $ cat /home/posdebug/stunnel.cfg debug=6 options=NO_SSLv2 pid=/tmp/stunnel.pid [57797] accept = 127.0.0.1:57797 connect = 80.90.125.219:64141 key = /usr/unsign/key.pem cert = /usr/unsign/cert.pem CAfile = /usr/unsign/cert.pem verify = 2 ciphers = AES128-SHA:AES256-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:EDH-RSA-DES-CBC3-SHA sslVersion = all TIMEOUTbusy = 100 TIMEOUTconnect = 100 client = yes ~/busybox $ /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ top | grep stunnel 986 1 posdebug S *3592* 5.7 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ top | grep stunnel 986 1 posdebug S *3720* 5.9 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ top | grep stunnel 986 1 posdebug S *3848* 6.2 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg As i noticed, there are a lot of allocs on reconfiguration and only a few free() calls. Why? RAM is not unlimited, as far as i know. Any comments would be highly appreciated. -- Best regards Alexander Paramonov Software Engineer Terminal Technologies

2 4

Errors after upgrading to 5.07
by Mikhail Idris 17 Nov '14

17 Nov '14

Hello, I have recently upgraded to 5.07. But now, the console is spamming with messages such as: SSL_read returned WANT_READ: retrying Is this a critical error? Will it have any impact of any services that are currently using stunnel? Thank you. Regards, Mikhail

2 3

SSLscan does not display a certificate when connecting to stunnel
by Swonk, Glenn 15 Nov '14

15 Nov '14

When I open a connection to display the certificate, it works from openssl. openssl s_client -connect x58.swonk.com:444 However, when I use SSLScan, it only displays the supported server ciphers. SSLScan.exe --no-failed --sslv3 x58.swonk.com:444 I am troubleshooting a problem with a device which cannot connect directly to my https server and am trying to use stunnel to either forward the connection or help understand why it isn't working. The strange thing is that the 'Charles Proxy' (http://www.charlesproxy.com/) seems to forward the requests properly. Can anyone download a copy of SSLscan and test it against their connection? Any other ideas what may be the issue? thanks, glenn ___ ___| |___ ___ __ _ _ __ / __/ __| / __|/ __/ _` | '_ \ \__ \__ \ \__ \ (_| (_| | | | | |___/___/_|___/\___\__,_|_| |_| Version 1.8.2-win http://www.titania.co.uk Copyright Ian Ventura-Whiting 2009 Compiled against OpenSSL 0.9.8m 25 Feb 2010 esting SSL server x58.swonk.com on port 444 Supported Server Cipher(s): Accepted TLSv1 256 bits DHE-RSA-AES256-SHA Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 128 bits DHE-RSA-AES128-SHA Accepted TLSv1 128 bits AES128-SHA Accepted TLSv1 168 bits EDH-RSA-DES-CBC3-SHA Accepted TLSv1 56 bits EDH-RSA-DES-CBC-SHA Accepted TLSv1 168 bits DES-CBC3-SHA Accepted TLSv1 56 bits DES-CBC-SHA Accepted TLSv1 128 bits IDEA-CBC-SHA Accepted TLSv1 128 bits RC4-SHA Accepted TLSv1 128 bits RC4-MD5 Prefered Server Cipher(s): TLSv1 256 bits DHE-RSA-AES256-SHA ________________________________ This message may contain confidential information. If you are not the intended recipient of this e-mail, do not disseminate, distribute or copy this e-mail and delete this e-mail from your system.

1 0

socks4 support
by Michal Trojnara 15 Nov '14

15 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Please take a look at the latest stunnel-5.08b4 available for download on https://www.stunnel.org/downloads.html It adds support for SOCKS4 and SOCKS4a protocols. The SOCKS protocol itself is encapsulated within SSL/TLS encryption layer to protect the final destination address. http://www.openssh.com/txt/socks4.protocol http://www.openssh.com/txt/socks4a.protocol The BIND command of the SOCKS protocol is not supported. The USERID parameter is ignored. To setup SOCKS4 VPN configure the following client service: [socks_client] client = yes accept = 127.0.0.1:1080 connect = vpn_server:9080 verify = 4 CAfile = stunnel.pem The corresponding configuration on the vpn_server host: [socks_server] protocol = socks accept = 9080 cert = stunnel.pem key = stunnel.key Now test your configuration on the client machine with: curl --socks4a localhost http://www.example.com/ Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRmVXgACgkQ/NU+nXTHMtHuZwCfXlH0YYTHYhThoXPrCgV4OhrE BwsAoLgIpVWDOdBbISzrP53m2H9LUR6W =9DEh -----END PGP SIGNATURE-----

1 1

External validation of client certificates
by Rene Bartsch 15 Nov '14

15 Nov '14

Hi, we're having a special use case and hope to find a solution in stunnel. In our use case clients use self-signed X.509 certificates to authenticate with our TLS-server. We don't have a CA but a database with usernames (DN) and fingerprints of the client-certificates. Is it possible with stunnel not to validate the client certificates against a CA but handover the Distinguished Name to an external application which returns the fingerprint to check the certificate against? -- Best regards, Rene Bartsch, B. Sc. Informatics Current Bitcoin Exchange Rate: https://www.bitcoin.de/de/r/mwfngu

2 1

How to enable weak ciphers in stunnel
by Swonk, Glenn 15 Nov '14

15 Nov '14

When I run stunnel, I would like to enable the weaker ciphers and protocols (SSLv3) for testing purposes. However, adding options to the stunnel.conf file doesn't seem to return new ciphers during the negotiation (using sslscan to generate the report). I have look through the documentation and it doesn't seem to address these options very well. Thanks, glenn options = SSLv2 ;;ciphers = DH+AES ;;ciphers = HIGH:LOW ;;ciphers = HIGH:MEDIUM ciphers = ALL Supported Server Cipher(s): Accepted TLSv1 256 bits DHE-RSA-AES256-SHA Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 128 bits DHE-RSA-AES128-SHA Accepted TLSv1 128 bits AES128-SHA Accepted TLSv1 168 bits EDH-RSA-DES-CBC3-SHA Accepted TLSv1 56 bits EDH-RSA-DES-CBC-SHA Accepted TLSv1 168 bits DES-CBC3-SHA Accepted TLSv1 56 bits DES-CBC-SHA Accepted TLSv1 128 bits IDEA-CBC-SHA Accepted TLSv1 128 bits RC4-SHA Accepted TLSv1 128 bits RC4-MD5 Prefered Server Cipher(s): TLSv1 256 bits DHE-RSA-AES256-SHA ________________________________ This message may contain confidential information. If you are not the intended recipient of this e-mail, do not disseminate, distribute or copy this e-mail and delete this e-mail from your system.

2 1

capi, other engines not found at runtime
by Derek Cole 14 Nov '14

14 Nov '14

Hello, I am trying to compile stunnel on windows instead of using the pre-built binaries. When I run stunnel.exe, and have engine=capi in my stunnel.conf file, i get the following [ ] Enabling support for engine 'capi' [!] error queue: 2606A074: error:2606A074:engine routines:ENGINE_by_id:no such engine [!] error queue: 260B6084: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found [!] error queue: 25070067: error:25070067:DSO support routines:DSO_load:could not load the shared library [!] ENGINE_by_id: 25078067: error:25078067:DSO support routines:WIN32_LOAD:could not load the shared library [!] Line 17: "engine = capi": Failed to open the engine Is this something wrong at link time in my compile? I used a precompiled version of OpenSSL, and modified this: SSLDIR=C:\OpenSSL-Win32 INCDIR=$(SSLDIR)\include LIBDIR=$(SSLDIR)\lib I thought that was all that would be needed, but apparently not. I then tried to go to make this modification: SSLLIBS=/LIBPATH:"$(LIBDIR)" libeay32.lib ssleay32.lib capi.lib thinking that maybe I need to explicitly add capi in, and again it compiles, but does not run. I have also tried to move the capi.dll from the LIBDIR into the same folder as the stunnel executable to make sure it was found, and I still have had no luck. Any ideas?

1 0

Building stunnel in Visual Studio
by Derek Cole 13 Nov '14

13 Nov '14

Hello, I am interested in tweaking something with stunnel for windows. I was trying to find if there were instructions for building the software on windows using Visual Studio. I found a deprecated FAQ that said that it was possible to compile with Visual C++. Can anyone give me any pointers on how to get up and going? http://www.onsight.com/faq/stunnel/stunnel-faq-3.html Thanks

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users November 2014