September 2014 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

No Taskbar Icon
by Carter Browne 26 Sep '14

26 Sep '14

I have updated stunnel to version 5.04 on Windows 7 32 & 64 bit, Windows Server 2008R2, Windows Server 2012 and Windows Server 2012R2 and in no case does the icon appear. I explicitly set taskbar = yes in the configuration file. -- Carter Browne cbrowne(a)cbcs-usa.com

5 13

"Socket operation on non-socket" when trying to pass the configuration file as a file descriptor on OSX
by Guylhem 24 Sep '14

24 Sep '14

Hello I'm trying to pass the configuration file with option fd. However, I get the following errors when I do : echo my configuration | stunnel -fd 0 This is not related to echo since I get the same errors with: cat conf | stunnel -fd 0 stunnel is just filling my logs with : 2014-07-13 6:48:46.675 PM stunnel[1959]: LOG3[140735238959888]: local socket: Socket operation on non-socket (38) 2014-07-13 6:48:46.676 PM stunnel[1959]: LOG3[140735238959888]: local socket: Socket operation on non-socket (38) (...) stunnel ./conf works fine I found a reference to a bug that caused this same error message on OSX when run in inetd mode, but nothing else. Any help is appreciated I'm using stunnel 5.02 on x86_64-apple-darwin13.2.0 platform with the following in -sockets: Socket option defaults: Option Name | Accept | Local | Remote |OS default ----------------+----------+----------+----------+---------- SO_DEBUG | -- | -- | -- | no SO_DONTROUTE | -- | -- | -- | no SO_KEEPALIVE | -- | -- | -- | no SO_LINGER | -- | -- | -- | 0:0 SO_OOBINLINE | -- | -- | -- | no SO_RCVBUF | -- | -- | -- | 131072 SO_SNDBUF | -- | -- | -- | 131072 SO_RCVLOWAT | -- | -- | -- | 1 SO_SNDLOWAT | -- | -- | -- | 2048 SO_RCVTIMEO | -- | -- | -- | 0:0 SO_SNDTIMEO | -- | -- | -- | 0:0 SO_REUSEADDR | yes| -- | -- | no TCP_KEEPCNT | -- | -- | -- |write-only TCP_KEEPINTVL | -- | -- | -- |write-only IP_TOS | -- | -- | -- | 0 IP_TTL | -- | -- | -- | 64 TCP_NODELAY | -- | yes| yes| no My configuration is quite simple : I just echo CAfile=/path/to/file.pem verify = 3 fips = no options = NO_SSLv2 debug = 7 [test] client = yes accept = 127.0.0.1:4443 connect = remoteip:443

2 1

Stunnel as windows service doesn't start on restart.
by John Smith 24 Sep '14

24 Sep '14

Running stunnel 5.03 on Windows 2008 R2. Everything is installed and working fine. I can even start/stop the service no problem... (Pretty sure the service is set to start Automatically) When I reboot my server stunnel service shows as started but nothing gets logged and none of my connections work. Once I restart the service through service manager, everything works. So on startup it doesn't seem to run... This only happens if i reboot the machine. I also asked the same question here: http://serverfault.com/questions/627932/stunnel-as-windows-service-doesnt-s… Output of my logs proving it works. 2014.09.11 15:57:48 LOG5[1612]: stunnel 5.03 on x86-pc-msvc-1500 platform 2014.09.11 15:57:48 LOG5[1612]: Compiled/running with OpenSSL 1.0.1i-fips 6 Aug 2014 2014.09.11 15:57:48 LOG5[1612]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2014.09.11 15:57:48 LOG5[1612]: Reading configuration from file stunnel.conf 2014.09.11 15:57:48 LOG5[1612]: FIPS mode disabled 2014.09.11 15:57:49 LOG5[1612]: Configuration successful

8 27

Possible problem found in init script with 'dirty' config file
by F. J. Blanco 23 Sep '14

23 Sep '14

Hi there. Perhaps this is a foolishness, but it happens to me, triggering a great headache. I'm Debian (Wheezy) user, using stunnel 4.53-1.1. I copied the stunnel configuration from another machine for a simple LAN SMTP relay. When I tried to reload the script, I got this: # /etc/init.d/stunnel4 start > Reloading configuration SSL tunnels: /etc/init.d/stunnel4: 34: test: /var/lib/stunnel4/: unexpected operator A few hours laters, I discovered the problem was in config file, in the chroot parameter: chroot = /var/lib/stunnel4 Specifically, with a hide space at the end of the line: chroot = /var/lib/stunnel4[ ] In the init script, in the function get_pids(), this mistake caused that this checkout fails: --- if test -f $CHROOT/$PIDFILE; then cat $CHROOT/$PIDFILE fi --- 'cat /var/lib/stunnel4///stunnel.pid' is not the same as 'cat /var/lib/stunnel4/[ ]//stunnel.pid' Perhaps a suggestion, a little change here: CHROOT=`grep "^chroot" $file|sed "s;.*= *;;"` Adding a space filter: CHROOT=`grep "^chroot" $file|sed "s;.*= *;;" | tr -d " "` Regards.

4 10

Re: [stunnel-users] Stunnel as windows service doesn't start on restart.
by josealf＠rocketmail.com 22 Sep '14

22 Sep '14

John. Looks fine to me. Same configuration works in my Windows 7 64 bits. I have no access to Windows Server 2008 R2, but I would expect it to work the same. What are you securing with stunnel?... Perhaps the service you are securing is starting after stunnel? -----Original Message----- From: John Smith <java.dev.mtl(a)gmail.com> Date: Mon, 22 Sep 2014 11:09:21 To: Jose Diaz<josealf(a)rocketmail.com> Subject: Re: [stunnel-users] Stunnel as windows service doesn't start on restart. SERVICE_NAME: stunnel TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\Program Files (x86)\stunnel\stunnel.exe" -service -install LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Stunnel SSL wrapper DEPENDENCIES : TCPIP SERVICE_START_NAME : LocalSystem On 22 September 2014 11:02, John Smith <java.dev.mtl(a)gmail.com> wrote: > After reboot? > > On 22 September 2014 10:11, <josealf(a)rocketmail.com> wrote: > >> >> Interesting. Please execute >> >> sc qc stunnel >> >> And post the output. >> >> >> >> -----Original Message----- >> From: John Smith <java.dev.mtl(a)gmail.com> >> Sender: "stunnel-users" <stunnel-users-bounces(a)stunnel.org> >> Date: Mon, 22 Sep 2014 09:54:10 >> To: Michal Trojnara<Michal.Trojnara(a)mirt.net> >> Cc: <stunnel-users(a)stunnel.org> >> Subject: Re: [stunnel-users] Stunnel as windows service doesn't start on >> restart. >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> >> >> >

2 3

stunnel beta (5.04b1) is available for testing
by Michal Trojnara 22 Sep '14

22 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys, Please feel free to try the beta version I just made available for download: https://www.stunnel.org/downloads/beta/stunnel-5.04b1.tar.gz https://www.stunnel.org/downloads/beta/stunnel-5.04b1-installer.exe The list of changes includes most of the issues recently discussed on the stunnel-users mailing list and more. * New features - Support for local mode ("exec" option) on Win32. - A more explicit service description provided for the Windows SCM (thx to Pierre Delaage). - TCP/IP dependency added for NT service in order to (hopefully) prevent initialization failure at boot time. - FIPS canister updated to version 2.0.8 in the Win32 binary build. * Bugfixes - load_icon_default() modified to return copies of default icons instead of the original resources to prevent the resources from being destroyed. - Reportedly more compatible values used for the dwDesiredAccess parameter of the CreateFile() function (thx to Pierre Delaage). - Partially merged UNICODE compilation fixes (thx to Pierre Delaage). - Partially merged Windows CE patches (thx to Pierre Delaage). - Fixed typos in stunnel.init.in and vc.mak. - Fixed incorrect memory allocation statistics update in str_realloc(). - Missing REMOTE_PORT environmental variable is provided to processes spawned with "exec" on Unix platforms. - Taskbar icon is no longer disabled for NT service. Some basic examples for local mode ("exec" option) on Windows: ; Service based on a command-line tool [netstat] accept = 8015 exec = c:\windows\system32\netstat.exe execargs = netstat -a ; Remote cmd.exe protected with SSL ; Certificate-based authentication needs to be configured here! [cmd] accept = 1337 exec = c:\windows\system32\cmd.exe Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQYYkoACgkQ/NU+nXTHMtGmfwCfSdHFmK8q5IRcS/CoFmYMZ40G zUEAoNUrIp0KAJ4+0LPwx+/1lJG6q2q/ =aSXM -----END PGP SIGNATURE-----

3 11

Support for PSK
by Thomas Conté 21 Sep '14

21 Sep '14

Hello everyone, In the context of an embedded project, I have developed a lightweight, PolarSSL-based TLS-PSK client running on an Arduino board. Now I am looking for a generic server-side solution to connect the TLK-PSK client to a few Web services living in various app servers (Node.JS, IIS, and others). Since PSK support is not widespread, I am thinking about using stunnel as a generic front-end to these services. I have done a quick-and-dirty POC of adding PSK support to stunnel and it looks like this could be done with minor modifications, e.g. adding a call to SSL_CTX_set_psk_server_callback and the corresponding callback to ctx.c. Right now the psk_key and psk_identity values are hard-coded, so of course those need to be added to the configuration file. Is the community interested in further work in that area? Or is PSK support already in the stunnel roadmap? Cheers, -- Thomas Conté.

2 1