stunnel-users April 2016

stunnel-users@stunnel.org

7 participants
8 discussions

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Stunnel & Gmail security
by BOXI31 TEST 17 Oct '20

17 Oct '20

Hi all, To make "Stunnel 5.31" work with Gmail, I have to go in security settings of Gmail and "allow less secure apps to access my account". Is it mandatory ? Is it possible to set Stunnel to access Gmail without lowering it security level ? How ? I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider it as a "less secure app." ! Regards, Steve

2 1

stunnel and hosts.allow
by Yousef Alhashemi 06 Jul '16

06 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Connect to web app with weak crypto
by Pete McEvoy 29 Apr '16

29 Apr '16

Hi. I have a java web app that uses weak crypto. I would like to be able to access it with a modern browser. Currently the only method that seems to work is links on freebsd 9.3, all other browsers give errors such as: Error performing TLS handshake: The Diffie-Hellman prime sent by the server is not acceptable (not long enough). Obviously it would be better if this was fixed but it is not something I have control of. Would it be possible for me to use stunnel to encapsulate the weak connection within a stronger one so the browser does not complain? I have tried this: ; TLS front-end to a web server [https] client = yes accept = 443 connect = 192.168.1.5:443 cert = /usr/local/etc/stunnel/stunnel.pem Which asks me to make an exception for the self signed cert but then proceeds to fail in same way as before. Cheers -- Pete

1 0

Memory Leak in stunnel 5.31
by Fritz Gschwendner 20 Apr '16

20 Apr '16

Thank you. I tried the new version. Between 10:15 and 10:50 stunnel private bytes grew by ~ 85 MB. Log entries regarding "possible memory leak" look like this at the beginning: 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\tasn_new.c:179: 71652 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\asn1_lib.c:412: 70978 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\a_object.c:346: 55283 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\a_object.c:315: 55283 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\asn1_lib.c:376: 56826 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\stack\stack.c:162: 13761 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\stack\stack.c:187: 11448 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\buffer\buffer.c:118: 11172 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\tasn_new.c:342: 10501 allocations ..and later like this: 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\tasn_new.c:179: 182132 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\asn1_lib.c:412: 181243 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_object.c:346: 138968 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_object.c:315: 138968 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\asn1_lib.c:376: 144407 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\stack\stack.c:162: 35294 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\stack\stack.c:187: 29760 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\buffer\buffer.c:118: 28186 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\tasn_new.c:342: 27649 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\bn\bn_lib.c:303: 27405 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\buffer\buffer.c:74: 18971 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\x_name.c:136: 18967 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\x_name.c:383: 18967 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_int.c:208: 18406 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_bitstr.c:158: 18433 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\bn\bn_lib.c:272: 13616 allocations If there is anything else I can do, please let me know. -----Ursprüngliche Nachricht----- Von: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] Im Auftrag von Michal Trojnara Gesendet: Dienstag, 19. April 2016 23:31 An: stunnel-users(a)stunnel.org Betreff: Re: [stunnel-users] Memory Leak in stunnel 5.31 On 31.03.2016 22:28, Fritz Gschwendner wrote: > we have a memory leak with stunnel 5.31 in server mode on Windows > Server 2012. Page File Bytes of the stunnel process keep growing. [cut] > I suspect it has something to do with clients not closing the > connection correctly. We have a lot of connections ending like > this: [cut] > Is my suspicion plausible? Can you recommend a change in the > configuration to avoid this issue? Anything else I can do to debug? Your suspicion looks plausible. I have added a heuristic algorithm that identifies excessive memory allocations. Please try stunnel-5.32b2: https://www.stunnel.org/downloads.html The logged warnings should allow identification of the leak source. Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel and Eudora error
by EPPack 14 Apr '16

14 Apr '16

I installed stunnel on one of my laptops a few days ago, and it installed uneventfully. I set up one of my gmail accounts in Eudora per directions I got from another Eudora user, and the account works perfectly in Eudora. However, on this machine, I got an unexpected prompt that showed up in a cmd window during the install, which did NOT show up on the other machine: WARNING: can't open config file: /devel/win32/openssl/openssl.cnf Generating a 2048 bit RSA private key ...+++ ..................+++ Writing new private key to 'C:\Program Files (x86)\stunnel\config\stunnel.pem' ---- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank for some fields there will be a default value, If you enter '.', the field will be left blank. ---- Country Name (2 letter code) [PL]: When I try for an inbound in Eudora, I get the "Error reading from network. Cause: connection aborted due to timeout or other failure (10053). Problem of course is that I'm also unsure if it installed fully/correctly. On the other machine, it installed itself uneventfully as a service, and after I started it (it came in as manual, unstarted), it was fine. This time, tho, it didn't show up in the list of services at all, even tho there was a prompt to start it, which I allowed it to do. That said, I did see it in the start menu, and was able to start it. I also rebooted, and it started up OK. However, after configuring one of my accounts the same way as on the other machine, it's not working, getting the timeout error above. Changed it back to the normal settings for GMail in Eudora, it worked fine, so it wasn't any other cause. I tried adding options = DONT_INSERT_EMPTY_FRAGMENTS to the conf, hopefully in the right place :) and also bumped the Eudora Advanced Network params as also suggested.Nada. The only difference between the two machines, both Windows 7 Pro, is that this one is a 64bit, the other not, which may well be the difference. As I'm new to stunnel, I looked for the manual, but got a 403 on the page. Thoughts? elaine ----- Elaine Pack, Web Analyst, Ivy, VA 99 programming bugs in the code 99 programming bugs Fix one bug, compile it again Now there's 100 bugs in the code! (Repeat until bugs=0)

1 0

developpement hints request
by brahim mohamed 06 Apr '16

06 Apr '16

Hello, My name is Mohamed Aymen, i'm an electronic payment engineer . I recently descovered Stunnel and i'm trying to make some developement and modifications and i need your help with points bellow: 1-steps for compilation on IBM AIX-7 plateform 2-possibility of adding a new source code file(.c) and compiling it with native stunnel files ===some clarifications about source code : 3-i would appreciate if you can indicate me : where exactly in source code i can find the code responsible for accepting buffer from client and the code responsible for accepting buffer (response) from server, also the code responsible for sending data to server and the code responsible for sending server's answer to client (all those on socket mode,on ssl mode and on tls mode) warm regards

1 0

blockscript
by Petr Hojzak 05 Apr '16

05 Apr '16

Hello. Is it possible to setup stunel in a way so it is not detected by services like blocksript? Petr Hojzak https://forpsi-vzr-s126463.mojeid.cz/

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users April 2016