stunnel-users June 2016

stunnel-users@stunnel.org

14 participants
20 discussions

FW: FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 20 Jun '16

20 Jun '16

From: J. Michael Drew [mailto:jmichaeldrew@hotmail.com] Sent: Monday, June 20, 2016 2:01 PM To: 'Jose Alf.' Subject: RE: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Hi Jose, I made the changes you suggested, but I am still getting the same behavior. My external address is: https://website.company.com/website I am not adding any ports to the address. Thanks so much for your help! Michael From: Jose Alf. [mailto:josealf@rocketmail.com] Sent: Monday, June 20, 2016 12:10 PM To: J. Michael Drew; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, I guess what you want to do is to be able to connect to your internal Webserver via your Win2012 stunnel proxy using a URL like: https://yourwin2012dnsname:9001/ <https://yourwin2012dnsname:9009/> if that is correct, I suggest to adjust your configuration as follows: 1. Your stunnel mode must be server, not client. So adjust your service stanza as follows: [CLI9F529A0A] accept=9001 connect=10.xxx.xxx.xxx:9009 client=no 2. In your current configuration stunnel is listening only in the localhost ipv4 address (127.0.0.1). Therefore, you can only connect when you are logged on the server, you can't connect from a remote client. Hope this helps you clarify what's going on. Regards, Jose From: J. Michael Drew [mailto:jmichaeldrew@hotmail.com] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:josealf@rocketmail.com] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel connection host address not appearing in sent message.
by Donald F. Coffin 20 Jun '16

20 Jun '16

I am using stunnel to enable SoapUI Mock Servers to support SSL connections. I am attempting to send the following SSL message: https://services.greenbuttondata.org/oauth/token?grant_type=client_credentia ls <https://services.greenbuttondata.org/oauth/token?grant_type=client_credenti als&scope=FB=39_40> &scope=FB=39_40 Using Wireshark, it appears the message being sent is POST /oauth/token?grant_type=client_credentials&scope=FB=39_40 which is receiving the following response: Error 404 (Not Found) The contents of the stunnel.conf file is: ; ***************************************************************** : * Service definitions (at least one service has to be defined) * ; ***************************************************************** ; ***************************************************************** ; * Resource Server * ; ***************************************************************** [resourceServer] accept=localhost:8080 connect=services.greenbuttondata.org:443 ciphers=AES128-SHA client=yes cert=/etc/stunnel/stunnel.pem verify=0 ; ***************************************************************** ; * Authorization Server * ; ***************************************************************** [authorizationServer] accept=localhost:8082 connect=services.greenbuttondata.org:443 ciphers=AES128-SHA client=yes cert=/etc/stunnel/stunnel.pem verify=0 [tpserver] accept=localhost:8444 connect=localhost:8081 cert=/etc/stunnel/stunnel.pem ciphers=AES128-SHA client=no verify=0 The HTTP log from SoapUI shows the following: "POST /oauth/token?grant_type=client_credentials&scope=FB=36_40 HTTP/1.1" "Accept-Encoding: gzip.deflate" "Content-Type: application/json" "Authorization: Basic UkVHSV... " (not shown for security) "Content-Length: 0" "Host: localhost:8082" "Connection: Keep-Alive" "User-Agent: Apache-HttpClient/4.1.1 (java 1.5)" "HTTP/1.1 404 Not Found" "Content-Type: text/html: charset=UTF-8" "Server: ghs" "Content-Length: 1623" "X-XSS-Protection: 1; mode=block" "X-Frame-Options: SAMEORIGIN" Through experimentation, the request only fails when using the stunnel proxy server, but works when sent directly to the targeted endpoint. Any assistance would be greatly appreciated. Best regards, Don Donald F. Coffin Technical Manager Green Button Alliance 2335 Dunwoody Crossing Suite E Dunwoody, GA 30338-8221 http://www.greenbuttonalliance.org <http://www.greenbuttonalliance.org/> (949) 636-8571 Mobile

1 0

FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 20 Jun '16

20 Jun '16

From: J. Michael Drew [mailto:jmichaeldrew@hotmail.com] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:josealf@rocketmail.com] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 20 Jun '16

20 Jun '16

1 0

Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 20 Jun '16

20 Jun '16

Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a "service is unavailable". Can someone help me? Sincere thanks, Michael

2 1

Compiling for Windows CE
by Bart de Waal 15 Jun '16

15 Jun '16

Hello, Are there more up to date instructions for compiling on Windows CE? I found the version here that works but is old and missing one of the features I need to connect to the server: http://www.usenix.org.uk/mirrors/stunnel/wce/ The instructions for building say you need evt2002web_min.exe, which as far as I can tell is no longer available. I can't get the newer version (evc4.exe) to work on a modern windows system (or under linux using wine) either. I think the CE version is still being used, as I saw references to it in the latest changelog. If someone has a more modern guide to building it I would appreciate it. Thanks, Bart de Waal

1 0

SSL Error
by Randall LeJeune 14 Jun '16

14 Jun '16

Hello. I am getting the following error when I try to run stunnel: [root@doadmzqas stunnel]# stunnel [ ] Clients allowed=31999 [.] stunnel 5.17 on powerpc-ibm-aix5.2.0.0 platform [.] Compiled/running with OpenSSL 1.0.1s 1 Mar 2016 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_Errno()) [.] Reading configuration from file /opt/freeware/etc/stunnel/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from /home/root/.rnd [ ] Wrote 1024 new random bytes to /home/root/.rnd [ ] PRNG seeded successfully [ ] Initializing service [sapdp3202] [ ] Loading certificate from file: /opt/freeware/etc/stunnel/stunnel.pem [!] error queue: 140DC002: error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib [!] error queue: 20074002: error:20074002:BIO routines:FILE_CTRL:system lib [!] SSL_CTX_use_certificate_chain_file: 2001002: error:02001002:system library:fopen:No such file or directory [!] Service [sapdp3202]: Failed to initialize SSL context The version is 5.17 as you can see above. My config file looks like this: ; Log file (enable for troubleshooting) output = /var/log/stunnel.log ; SSL Certificate and key files cert = /opt/freeware/etc/stunnel/stunnel.pem key = /opt/freeware/etc/stunnel/stunnel.key ; Restrict to FIPS compliant ciphers only ciphers = FIPS ; Force the SSL version to TLSv1 only sslVersion = TLSv1 ; The cipher list and SSL version restrictions above should make us ; _de_facto_ FIPS compliant; our OpenSSL library is *not* FIPS ; compliant, so this cannot be set to 'yes' fips = no [sapdp3202] client = yes accept = 127.0.0.1:3202 connect = doaprdssl.dot.com.gov:4709 The OS is AIX version 7. Does anybody have any idea what this means? Thanks in advance.

1 0

HTTP Strict Transport Security (HSTS) header
by Andrey 06 Jun '16

06 Jun '16

Hi! How I can enable HTTP Strict Transport Security (HSTS) header on stunnel ? Thank you Best regards, Andrey

2 1

openssl warning
by Vpn Bekhar 06 Jun '16

06 Jun '16

Hi, When I install stunnel on my windows server i see this error: stunnel warning can't open config file: /devel/win32/openssl/openssl.cnf please help me thank you so much best regards,

1 0

Broadband and stunnel weird behavior
by Javier 04 Jun '16

04 Jun '16

Hi, I was in doubt if post this or not because I couldn't replicate with enough similarities. But as it may be worth, if it is an actual bug, or help others... why not? Here I have to say that it is more noticeable under Windows 2000. That doesn’t mean doesn’t happen on higher OSs, but, from XP, it isn’t as noticeable. So, please, don’t stop reading here. But, hey, I know it is obsolete, and I know this is long and I’ll understand if you don’t want to read this. I tend to make a lot of “speed tests” because ISPs in my country… well, if you have luck, great, if not, brace yourself with the fights. Maybe as other countries :/ About February my download broadband was enhanced from 30Mb to 50Mb. This is important because is when it started all. With only 30Mb I didn’t notice any problem. “Speed tests“ were fine with “only” 30Mb and all matched the contracted speed and even a bit more. But when I had 50Mb I started to see some annoyances that sometimes was over 50Mb and others... if I had the luck to have 30Mb, it was a miracle. It wasn’t the test used. It was any test, with any technology (flash, html5, java, etc). The difference was just a couple of Mb. But all reflected the problems. They were so random, but something in common is that the tests didn’t show the correct speed at the end of my PC usage day. So I thought, something in memory, maybe, was causing it. But, also, it didn’t happen all days. At the end of the day, sometimes, I topped the 50Mb. And here starts the discarding process. I have a humble Pentium 4 and, even it is not powerful, one of the things I do (that I won’t explain why) is to throttle it (decrease speed). It is one of the first things I discarded, because as higher the broadband, the CPU load at full speed is higher as well. I only noticed a little improvement. This wasn’t the problem. Even I uninstalled the filter driver. So, if the CPU wasn’t the problem, programs should be. And I started with everything. And I left Stunnel as one of the latest. And there was the problem. When Stunnel is open, the speed cuts at about 30Mb. Yeah, I couldn’t believe myself either. After several tests, I discovered that Stunnel isn’t either the problem itself. The problem comes from the amount of services in .conf file. The more you have, the more speed problems you’ll have. I discovered this with the second instance of Stunnel I use for servers, which only has 7 services (3 SNI). I mainly use Stunnel as client for non-SSL aware programs and I have set 16 services. The options of .conf file, or services options, seems to don’t have much effect on speed tests. At the end, one way or another, the result is that if I open Stunnel, I can’t top full speed. I close it and voilà!, even during the same speed test. What is causing it? Probably just Windows 2000, or maybe not. Windows 2000 doesn’t have a connection limit as XP, one of the things I thought about. Anyway, I just wanted to shared this with you, just in case helps or anything. Regards. System specifications: Windows 2000 SP4 // XP SP2 (testing purposes) P4 2.8Ghz RAM 2GB RTL8139 Fast Ethernet Full Duplex

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users June 2016