April 2014 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

behavior change after enabling proxy protocol
by Philippe Anctil 05 Jun '14

05 Jun '14

Hello, We use stunnel to secure a proprietary tcp/ip protocol over the internet. More specifially we have - 1 balancer - 2 stunnel boxes - 1 app server The load balancer 'pings' stunnel boxes regularly to know if one is down. Recently, we have added support for the proxy protocol in our app and turned it on in our stunnel config. It works great except for one small new behavior: upon receiving a load balancer ping, stunnel performs a connection on our app (and sends the proxy header). I ran a tcpdump for a telnet on the stunnel port (8000). With proxy protocol disabled, stunnel does nothing while it waits for the certificate. The connection ended at my request. 17:33:08.537385 IP 127.0.0.1.6015 > 127.0.0.1.8000: S 356922015:356922015(0) win 32792 <mss 16396,sackOK,timestamp 1085620573 0,nop,wscale 7> 17:33:08.537386 IP 127.0.0.1.8000 > 127.0.0.1.6015: S 1525966521:1525966521(0) ack 356922016 win 32768 <mss 16396,sackOK,timestamp 1085620573 1085620573,nop,wscale 7> 17:33:08.537393 IP 127.0.0.1.6015 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085620573 1085620573> 17:33:19.750431 IP 127.0.0.1.6015 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085631785 1085620573> 17:33:19.751065 IP 127.0.0.1.8000 > 127.0.0.1.6015: . ack 2 win 256 <nop,nop,timestamp 1085631786 1085631785> 17:33:19.751794 IP 127.0.0.1.8000 > 127.0.0.1.6015: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085631787 1085631785> With proxy protocol enabled, stunnel establishes a connection to my app and sends the proxy protocol before even receiving the certificate. 17:34:35.370462 IP 127.0.0.1.6026 > 127.0.0.1.8000: S 2949098861:2949098861(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.370475 IP 127.0.0.1.8000 > 127.0.0.1.6026: S 1044893129:1044893129(0) ack 2949098862 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.370481 IP 127.0.0.1.6026 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371035 IP 127.0.0.1.37654 > 127.0.0.1.9000: S 801705083:801705083(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.371046 IP 127.0.0.1.9000 > 127.0.0.1.37654: S 4068822820:4068822820(0) ack 801705084 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.371052 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371583 IP 127.0.0.1.37654 > 127.0.0.1.9000: P 1:44(43) ack 1 win 257 <nop,nop,timestamp 1085707403 1085707402> 17:34:35.371595 IP 127.0.0.1.9000 > 127.0.0.1.37654: . ack 44 win 256 <nop,nop,timestamp 1085707403 1085707403> 17:34:50.484991 IP 127.0.0.1.9000 > 127.0.0.1.37654: F 1:1(0) ack 44 win 256 <nop,nop,timestamp 1085722515 1085707403> 17:34:50.485892 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 2 win 257 <nop,nop,timestamp 1085722516 1085722515> 17:35:08.824661 IP 127.0.0.1.6026 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085740854 1085707402> 17:35:08.824906 IP 127.0.0.1.8000 > 127.0.0.1.6026: . ack 2 win 256 <nop,nop,timestamp 1085740854 1085740854> 17:35:08.824972 IP 127.0.0.1.37654 > 127.0.0.1.9000: R 44:44(0) ack 2 win 257 <nop,nop,timestamp 1085740854 1085722515> 17:35:08.825013 IP 127.0.0.1.8000 > 127.0.0.1.6026: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085740855 1085740854> Note I used 'tcpdump -i lo -nn port 8000 or port 9000' for both traces. I see no good reason to connect to the application before the ssl session is established. Thank you for reading! -- Philippe Anctil

2 2

New stunnel how-to
by Patrick J. 30 Apr '14

30 Apr '14

Hi all, I've spent some time to write a new stunnel how-to. - Install and configure stunnel on a Raspberry Pi - Run stunnel in a chroot jail - Limit allowed ciphers and force Forward Secrecy - Restrict access to the stunnel server (verify = 3) - Disguise SSH as HTTPS traffic http://stunnel.qnea.net/ Regards from Germany, Patrick

1 1

Error 126 compiling on Mac OS X 10.7.5
by James Brown 29 Apr '14

29 Apr '14

I’ve just tried to install version 5.01 and encountered an error. I had no problems installing 5.01b1 previously. I just thought I’d install the release version. System is running Mac OS X 10.7.5. make ends with a warning, and make install fails: ld: warning: directory not found for option '-L/usr//lib64' Making all in doc make[1]: Nothing to be done for `all'. Making all in tools make[1]: Nothing to be done for `all'. make[1]: Nothing to be done for `all-am'. mail:stunnel-5.01 2 jlbrown$ sudo make install Password: Making install in src ../auto/install-sh -c -d '/usr/local/bin' /bin/sh ../libtool --mode=install /usr/bin/install -c stunnel '/usr/local/bin' libtool: install: /usr/bin/install -c stunnel /usr/local/bin/stunnel ../auto/install-sh -c -d '/usr/local/bin' /usr/bin/install -c stunnel3 '/usr/local/bin' ../auto/install-sh -c -d '/usr/local/lib/stunnel' /bin/sh ../libtool --mode=install /usr/bin/install -c libstunnel.la '/usr/local/lib/stunnel' libtool: install: /usr/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib libtool: install: /usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/libstunnel.la /Users/jlbrown/Downloads/stunnel-5.01: /Users/jlbrown/Downloads/stunnel-5.01: is a directory make[2]: *** [install-pkglibLTLIBRARIES] Error 126 make[1]: *** [install-am] Error 2 make: *** [install-recursive] Error 1 I just used ./configure with no arguments. Any suggestions? Thanks, James.

1 0

Verify=2 and Verification Depth...
by Matt Wise 28 Apr '14

28 Apr '14

It was my understanding that when you have an Stunnel Server configured with 'verify=2', that the client that connects must have a certificate signed by the same CA/SubCA combination that the server does. So for example: - My_Root_Ca (private CA) - Some_Random_Cert.pem - Stunnel_Sub_Ca: - Server.pem - Client.pem - Postgres_Sub_Ca: - Server.pem - postgres_user.pem With the above structure in place (and the stunnel server using Stunnel_Sub_Ca/Server.pem) if someone tried to connect in with the Stunnel_Sub_Ca/Client.pem cert, it would work... but if they tried to connect in with Postgres_Sub_Ca/Server.pem, it wouldn't. Unfortunately we're not seeing that behavior... we're seeing a behavior where *every* cert signed by the overall Root CA is validated. We're able to connect in using Some_Random_Cert.pem, Postgres_Sub_Ca/Server.pem and Postgres_Sub_Ca/postgres_user.pem. This feels wrong ... what am I missing? (We're using Stunnel 4.55 btw) Matt Wise Sr. Systems Architect Nextdoor.com

1 1

ephemeral port limit
by Frank Liu 28 Apr '14

28 Apr '14

Hi, I am trying to use stunnel to add ssl support to my app. My app and linux server are tuned to accept 200k+ connections without a problem. When adding stunnel on the same server, the connection stops when it reaches 64k due to stunnel uses ephemeral ports to connect to my app on the localhost. Any suggestions how to get around this limit? One thing I am thinking of is to add 10 virtual interfaces on loopback: lo0:2, lo0:3, etc with ip 127.0.0.2, 127.0.0.3 etc. Can stunnel be configured to cycle through a pool of ip for outbound connection to my app listening on 127.0.0.1? That would give 10x64k of ephemeral ports. I see stunnel has "local" to specify outgoing ip, but I am not sure if it supports a list of ip or use multiple times. If so, will it round robin the list? Thanks Frank

2 2

Syringe
by Michal Trojnara 21 Apr '14

21 Apr '14

Hi Guys, I'm glad to announce syringe, a service for testing client-side heartbleed. It allows to easily examine most of the obscure TLS clients (for example embedded devices). The service is available online at https://www.stunnel.org:4433/ Best regards, Mike

2 2

hardware random
by ios dev 20 Apr '14

20 Apr '14

Hello. I am using GOST engine and set it as default for ALL. At the same time i want to use hardware RNG from other engine. How can i do this? -- BR, Dev.

1 0