August 2014 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

"Socket operation on non-socket" when trying to pass the configuration file as a file descriptor on OSX
by Guylhem 24 Sep '14

24 Sep '14

Hello I'm trying to pass the configuration file with option fd. However, I get the following errors when I do : echo my configuration | stunnel -fd 0 This is not related to echo since I get the same errors with: cat conf | stunnel -fd 0 stunnel is just filling my logs with : 2014-07-13 6:48:46.675 PM stunnel[1959]: LOG3[140735238959888]: local socket: Socket operation on non-socket (38) 2014-07-13 6:48:46.676 PM stunnel[1959]: LOG3[140735238959888]: local socket: Socket operation on non-socket (38) (...) stunnel ./conf works fine I found a reference to a bug that caused this same error message on OSX when run in inetd mode, but nothing else. Any help is appreciated I'm using stunnel 5.02 on x86_64-apple-darwin13.2.0 platform with the following in -sockets: Socket option defaults: Option Name | Accept | Local | Remote |OS default ----------------+----------+----------+----------+---------- SO_DEBUG | -- | -- | -- | no SO_DONTROUTE | -- | -- | -- | no SO_KEEPALIVE | -- | -- | -- | no SO_LINGER | -- | -- | -- | 0:0 SO_OOBINLINE | -- | -- | -- | no SO_RCVBUF | -- | -- | -- | 131072 SO_SNDBUF | -- | -- | -- | 131072 SO_RCVLOWAT | -- | -- | -- | 1 SO_SNDLOWAT | -- | -- | -- | 2048 SO_RCVTIMEO | -- | -- | -- | 0:0 SO_SNDTIMEO | -- | -- | -- | 0:0 SO_REUSEADDR | yes| -- | -- | no TCP_KEEPCNT | -- | -- | -- |write-only TCP_KEEPINTVL | -- | -- | -- |write-only IP_TOS | -- | -- | -- | 0 IP_TTL | -- | -- | -- | 64 TCP_NODELAY | -- | yes| yes| no My configuration is quite simple : I just echo CAfile=/path/to/file.pem verify = 3 fips = no options = NO_SSLv2 debug = 7 [test] client = yes accept = 127.0.0.1:4443 connect = remoteip:443

2 1

Possible problem found in init script with 'dirty' config file
by F. J. Blanco 23 Sep '14

23 Sep '14

Hi there. Perhaps this is a foolishness, but it happens to me, triggering a great headache. I'm Debian (Wheezy) user, using stunnel 4.53-1.1. I copied the stunnel configuration from another machine for a simple LAN SMTP relay. When I tried to reload the script, I got this: # /etc/init.d/stunnel4 start > Reloading configuration SSL tunnels: /etc/init.d/stunnel4: 34: test: /var/lib/stunnel4/: unexpected operator A few hours laters, I discovered the problem was in config file, in the chroot parameter: chroot = /var/lib/stunnel4 Specifically, with a hide space at the end of the line: chroot = /var/lib/stunnel4[ ] In the init script, in the function get_pids(), this mistake caused that this checkout fails: --- if test -f $CHROOT/$PIDFILE; then cat $CHROOT/$PIDFILE fi --- 'cat /var/lib/stunnel4///stunnel.pid' is not the same as 'cat /var/lib/stunnel4/[ ]//stunnel.pid' Perhaps a suggestion, a little change here: CHROOT=`grep "^chroot" $file|sed "s;.*= *;;"` Adding a space filter: CHROOT=`grep "^chroot" $file|sed "s;.*= *;;" | tr -d " "` Regards.

4 10

Stunnel Windows Server 2008 R2
by 541401＠gmail.com 29 Aug '14

29 Aug '14

I have installed stunnel 5.03 on Windows Server 2008 R2 X64. When I run it as an application it works perfectly. When I install and run the service, it starts but the start notice window, title bar, says Stunnel 5.03 win32 (not configured). It appears that the stunnel service is not reading the stunnel.conf. If anyone has any suggestions how I can successfully run stunnel as a service, I would be very appreciative. Thank you!

5 12

SSL Server Allows Anonymous Authentication Vulnerability
by Michael Curran 25 Aug '14

25 Aug '14

I am looking at this vulnerability reported from McAfee -- but we use stunnel to secure our communications and not the application directly. Are these settings that I can make within the stunnel config -- or something comparable? SSLProtocol -ALL +SSLv3 +TLSv1 SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

2 2

Odd complication between VM clients, same host
by afpteam＠sbcglobal.net 24 Aug '14

24 Aug '14

Hi, Much appreciation to Stunnel and OpenSSL for a long, successful provision. I can't be sure yet if the concern below is Stunnel or OpenSSL related. I've surfed Google and found nothing similar. Stunnel package with integral OpenSSL is current release. I recently had to secure and connect two public facing client machines on the same Citrix Xen 6.2 release, running Server 2003 x 64 bit. I typically use Stunnel with self generated Pem, for securing short term TightVNC sessions. The config is always fairly generic, loopback allowed, securing across 127.0.0.1 Typically I don't make name references in the .conf profile, just accept / connect on related ports. This is the first time I recall ever pointing two VM's at each other. I have tried both service and gui on both Stunnel and VNC. Tried both application listing and discrete port listing in the server's windows firewall. I have tried updating security to the Admin account as owner or Administrators, in general. I have tried launching either or both as Administrator. When VNC client viewer calls to Server, Stunnel sees the connect, succeeds the Pem and stops. If I restart the stunnel service at the server, the viewer auth dialog suddenly succeeds. I question if this remains secured but clearly isn't practical for application. Both VM's are connected to me via RDP at the time, if this might relate to an Auth violation. I tried multiple VMs to eliminate anything related to a bungled VM config. I'm guessing there is some kind of circular routing restriction possibly. Citrix does use an X-window console to each VM on the control path, but in other instances there's never been any conflict. Not sure how to determine if the issue is config, Stunnel or OpenSSL or how to resolve it. Any suggestions would be appreciated. Regards and thank you again, Mike

1 0

Server side SNI and Windows problem
by Slava 17 Aug '14

17 Aug '14

I'm trying use SNI on Windows (server 2003 R2 or XP) stunnel 5.01 on x86-pc-msvc-1500 platform Compiled/running with OpenSSL 1.0.1g-fips 7 Apr 2014 stunnel.config ... [main] accept = 60000 connect = 10.0.21.1:80 [ssh] connect = 10.0.21.1:22 sni=main:ssh Client has line sni=ssh, but server not see this and attempt connect to :80. I'm try connect from linux and windows, same result For server on linux all work fine. ?

3 4

verify=4
by oweijr oweirj 12 Aug '14

12 Aug '14

Hello, In the stunnel documentation, I see the following: level 4 Ignore CA chain and only verify peer certificate. My interpretation of level 4 was that only the server certificate had to be installed on the client in order for the cert verification to pass. No issuer/CA certificates were needed. However, when I do this, the connection fails. I see this following in the logs with verify=4: 2014.08.12 21:17:57 LOG7[26768]: Starting certificate verification: depth=0, subject=/C=US/CN=a.b.com 2014.08.12 21:17:57 LOG4[26768]: CERT: Verification error: unable to get local issuer certificate 2014.08.12 21:17:57 LOG4[26768]: Certificate check failed: depth=0, subject=/C=US/CN=a.b.com 2014.08.12 21:17:57 LOG7[26768]: SSL alert (write): fatal: unknown CA 2014.08.12 21:17:57 LOG3[26768]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed My config file contains the following: verify = 4 CAfile = /opt/stunnel/certs/clients.pem chroot = /opt/stunnel setuid = stunnel setgid = stunnel pid = /run/stunnel.pid debug = 7 output = stunnel.log options = NO_SSLv2 cert = /opt/stunnel/certs/server.pem key = /opt/stunnel/certs/server.pem If I append the issuer certificate to the CAfile, after the peer certificate, then the connection is successful with verify=4. Is this expected behavior? Is there a verify level that works as I described above: only the peer certificate needs to be present, no CA/issuer certificates at all? Thank you for your help.

1 0