March 2015 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Log rotation for Windows
by John Smith 31 Mar '15

31 Mar '15

Hi I came across this thread, I know it's old... http://mailing.unix.stunnel-users.narkive.com/QOEx4XQz/stunnel-users-log-ro… And it says that's it's on the todo list, though I don't see anything indicating this on the list. So is log rotation implemented for Windows and if so what is the config parameter? Thanks

2 5

Stunnel not receiving connections on ports 465 & 587
by James Brown 31 Mar '15

31 Mar '15

I am running Stunnel 5.14 on my Mac mail server (OS X 10.7.5), but trying to send emails using ports 465 & 587 does not work: Mail.app says: Mail was unable to connect to server “mail.bordo.com.au <http://mail.bordo.com.au/>” using SSL on port 587. Verify that this server supports SSL and that your account settings are correct. Log from Stunnel is: 2015.03.31 09:27:56 LOG7[ui]: Clients allowed=500 2015.03.31 09:27:56 LOG5[ui]: stunnel 5.14 on x86_64-apple-darwin11.4.2 platform 2015.03.31 09:27:56 LOG5[ui]: Compiled/running with OpenSSL 1.0.2a 19 Mar 2015 2015.03.31 09:27:56 LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2015.03.31 09:27:56 LOG7[ui]: errno: (*__error()) 2015.03.31 09:27:56 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2015.03.31 09:27:56 LOG5[ui]: UTF-8 byte order mark not detected 2015.03.31 09:27:56 LOG5[ui]: FIPS mode disabled 2015.03.31 09:27:56 LOG7[ui]: Compression disabled 2015.03.31 09:27:56 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2015.03.31 09:27:56 LOG7[ui]: PRNG seeded successfully 2015.03.31 09:27:56 LOG6[ui]: Initializing service [ssmtp] 2015.03.31 09:27:56 LOG6[ui]: Loading certificate from file: /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG6[ui]: Loading key from file: /usr/local/etc/postfix/smtpd.key 2015.03.31 09:27:56 LOG7[ui]: Private key check succeeded 2015.03.31 09:27:56 LOG7[ui]: DH initialization 2015.03.31 09:27:56 LOG7[ui]: Using DH parameters from /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG7[ui]: DH initialized with 2048-bit key 2015.03.31 09:27:56 LOG7[ui]: ECDH initialization 2015.03.31 09:27:56 LOG7[ui]: ECDH initialized with curve prime256v1 2015.03.31 09:27:56 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.03.31 09:27:56 LOG6[ui]: Initializing service [ssmtp2] 2015.03.31 09:27:56 LOG6[ui]: Loading certificate from file: /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG6[ui]: Loading key from file: /usr/local/etc/postfix/smtpd.key 2015.03.31 09:27:56 LOG7[ui]: Private key check succeeded 2015.03.31 09:27:56 LOG7[ui]: DH initialization 2015.03.31 09:27:56 LOG7[ui]: Using DH parameters from /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG7[ui]: DH initialized with 2048-bit key 2015.03.31 09:27:56 LOG7[ui]: ECDH initialization 2015.03.31 09:27:56 LOG7[ui]: ECDH initialized with curve prime256v1 2015.03.31 09:27:56 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.03.31 09:27:56 LOG5[ui]: Configuration successful 2015.03.31 09:27:56 LOG7[ui]: Listening file descriptor created (FD=6) 2015.03.31 09:27:56 LOG7[ui]: Service [ssmtp] (FD=6) bound to 0.0.0.0:465 2015.03.31 09:27:56 LOG7[ui]: Listening file descriptor created (FD=7) 2015.03.31 09:27:56 LOG7[ui]: Service [ssmtp2] (FD=7) bound to 0.0.0.0:587 /usr/local/etc/stunnel/stunnel.conf has: [ssmtp] client = no accept = 465 connect = 127.0.0.1:25 [ssmtp2] client = no accept = 587 connect = 127.0.0.1:25 The mail server is running on the same machine. I can send emails using port 25 with no SSL. (I have to have the ‘Allow insecure authentication’ ticked). When I try to send using ports 587 or 465 there is nothing logged by stunnel (or anywhere else that I can see). Firewall is not blocking anything: sudo ipfw list 65535 allow ip from any to any Postfix is the SMTP server, Dovecot for IMAP. Any suggestions? Thanks, James.

2 2

5.xx Windows binaries - FIPS compliant?
by Rob Lockhart 30 Mar '15

30 Mar '15

I apologize if this was asked in the past. I couldn't find any references to my question in the lists except this (related but not answering the question): http://www.stunnel.org/pipermail/stunnel-users/2014-July/004673.html http://www.stunnel.org/pipermail/stunnel-users/2012-November/003963.html I understand how to compile Stunnel from source, and the FIPS canister for OpenSSL, then build OpenSSL with this FIPS canister, then build Stunnel using that OpenSSL. My question is for the Windows version with filename "stunnel-5.13-installer.exe". That compiled version doesn't seem to be built with FIPS canister, as the log shows: "Compiled/running with OpenSSL 1.0.2a 19 Mar 2015" without a "-fips" appendage after the OpenSSL version. In other words, if it was built as FIPS-compliant, it would show: "Compiled/running with OpenSSL 1.0.2a-fips 19 Mar 2015" It may support the FIPS options (in the config file) but it's not FIPS-compliant. I also assume that this doesn't preclude the FIPS options in the config file from working. Specifically, FIPS-compliant does NOT imply that FIPS mode cannot be enabled. Am I understanding this correctly? Thanks, -Rob

2 2

Libressl with stunnel
by jungle Boogie 29 Mar '15

29 Mar '15

Hello All, It appears that stunnel still requires openssl and cannot use libressl. Have the developers considered this patch: https://github.com/sabotage-linux/sabotage/commit/9b47cbbf3ce903dee042c45c8… This is from stunnel 5.02 days but are there any issues with applying this with 5.14? -- ------- inum: 883510009027723 sip: jungleboogie(a)sip2sip.info xmpp: jungle-boogie(a)jit.si

2 2

stunnel 5.14 release
by Michal Trojnara 25 Mar '15

25 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.14 of stunnel. The ChangeLog entry: Version 5.14, 2015.03.25, urgency: HIGH: * Security bugfixes - The "redirect" option now also redirects clients on SSL session reuse. In stunnel versions 5.00 to 5.12 reused sessions were never redirected regardless of their certificate verification result. This vulnerability was reported by Johan Olofsson. * New features - Windows service is automatically restarted after upgrade. * Bugfixes - Fixed a memory allocation error during Unix daemon shutdown. - Fixed handling multiple connect/redirect destinations. - OpenSSL FIPS builds are now correctly reported on startup. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 2197b4fc1db82eba69c8baf1fac30f0767af26e9f8c7e9e1d5a4a8fbb264695a stunnel-5.14.tar.gz 29364b3f07a84245fe1b0f8373d96c9924650a8058e602670a67a2da07a801bd stunnel-5.14-installer.exe e3b48534bb4a5f8237e4ed1aa4990ed8485bdf97f6e0b8da2507dbd9b5cad34c stunnel-5.14-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVEs/mAAoJEC78f/DUFuAUNq4P/A7Ap1NkzfhZQJWJMJthar1P hoVHIzuH7dGbRt4C5s0PgbC4S9UOz8wdcKbsNcPJRQf0PXP5oVARo2bx+3dV9uAC /6GRL+a5Rj8HU5vG4UX/9D5D0pvwcyFkk7sIxUhyeKSHcEH354Vgw0AlJM6GiWKG nwE5RJ3JTdxi8A4e10p3ZKnPg4Y0eWmpkm1qkqH9RWKj9+BbLaPt7ZvRBNYNicq3 3BtVaJ5KLGvWaQRww+llhvPnR2K+h7PnJiaIKm/cIHzbP8VLjoVWy/Dk5EOku6Zg iCfz8uFzezz+9NwwjjEl2KfGUNdBaZf02R2LqN57pTZyBPZNVH9G7IE1/BGJh7Ai f440LTC29OB7qnJThDRdU16x/Iz+NTcc1QFK4x7eTD+nTouUuyZh9Md0x4DD9jwk CL3dHZ6abUO9j7V04Sb8+wfWzP/pZdilWLyY1jj8L41EPXyb0DE3ZsrHyN7lJ2Fx OihfevJhB9bzCzXiLg0oW61YRUm5prRTxMaeTAC53fITlvx0yf9pHFNy0OtoTNr+ t0Skf/LMaZnvU0rE0UBSjqQbpKNaRff5zsGrI/NLgk98X/NTdakgrgsS0jjaQgYm 7mgH4mKoI9qL2YUMw7d9eGg8j8I9qewhaQYjVz4kGoq9YOCVhh69XormcGMAXXjY gf3RNVLzQH4N19TYz5a8 =lrVy -----END PGP SIGNATURE-----

1 0

Multiple versions of TLS in config?
by Rob Lockhart 25 Mar '15

25 Mar '15

Unless I'm mistaken, stunnel version 5 currently supports the options shown below for sslVersion: all => TLS v1.0, TLS v1.1, TLS v1.2, SSLv2, SSLv3 TLSv1 => TLS v1.0 only (not TLS v1.1, TLSv1.2, SSLv2 or SSLv3) TLSv1.1 => TLS v1.1 only TLSv1.2 => TLS v1.2 only In order to support TLS v1.0, TLS v1.1 and TLS v1.2 but disable SSLv2 and SSLv3, you should have in the config file: sslVersion = all options = NO_SSLv2 options = NO_SSLv3 (those last two lines may be default in the new Stunnel). However, what if I want to just have TLSv1.1 and TLSv1.2 but NOT TLSv1.0? I last tried this with Stunnel v5.10 but nothing in the changelogs tells me that this behavior has been changed to choose a list of protocols; only one parameter is accepted. Is there a way to allow TLSv1.1 and TLSv1.2 but disallow TLSv1.0? Thanks, -Rob

2 1

Stunnel urgency: HIGH versus LOW
by Rob Lockhart 24 Mar '15

24 Mar '15

Hello, I just noticed a urgency discrepancy for Stunnel 5.12 on the website (both of these links are under the Downloads section): https://www.stunnel.org/versions.html - shows 5.12 urgency as HIGH https://www.stunnel.org/sdf_ChangeLog.html - shows 5.12 urgency as LOW I don't know if it makes a difference with 5.13 available (assuming urgency = LOW) but I think 5.12 should have urgency=HIGH. Thanks, -Rob

1 0