July 2016 - stunnel-users

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Stunnel & Gmail security
by BOXI31 TEST 16 Oct '20

16 Oct '20

Hi all, To make "Stunnel 5.31" work with Gmail, I have to go in security settings of Gmail and "allow less secure apps to access my account". Is it mandatory ? Is it possible to set Stunnel to access Gmail without lowering it security level ? How ? I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider it as a "less secure app." ! Regards, Steve

2 1

Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 21 Dec '16

21 Dec '16

2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>: > Did not have a look at the code yet, but should it be possible to replace > envvars usage by some keys in the registry on windows platform and/or > %userprofile%/config-file ? > > Anyway, my opinion on the patch is that there is no real interest for > "generic/self-expanding" config file , and it is even dangerous : > I would not trust stunnel if, at run time, its config could be modified by > USER envvars... > which difference between %userprofile%/config-file and USER envvars? both are USER owned and USER controlled. certificate and keys also USER private data. and stunnel started by USER owned by USER. if stunnel started by SYSTEM/ADMIN he uses SYSTEM/ADMIN envvars (if needed), certs, keys, etc. global "generic/self-expanding" config file is ADMIN owned. USER has permissions to substitute some values, restricted by ADMIN.

2 10

stunnel only sends some emails, not all, and only on second attempt
by Martin Jaquess 28 Jul '16

28 Jul '16

Hi I'm using the latest Stunnel (5.35), running under Windows Server 2000, to download emails from Outlook(Office365)/Outlook 2016 to another email client called OfficeTalk which only supports unencrypted POP3, so it can't access Outlook directly. First problem is that although most emails are downloaded without problem, some stubbornly and consistently refuse to be downloaded. This omission doesn't seem related to attachments, encoding, size, date, or anything else that I can see. Has anyone else experienced this or have any idea why it might be happening?? Second problem is that the first download doesn't produce anything, but if I run the request again, it works - the only difference in the log files is the IP addresses I'd greatly appreciate any advice on this - I've checked the threads but can't find anything similar. Many thanks in advance Martin Config file for all attempts is:debug=7 output = c:\program files\stunnel\stunnel.log [outlook-pop3] client = yes accept = 127.0.0.1:110 connect = outlook.office365.com:995 Logfile for successful download of one email is:12:49:50 LOG7[cron]: Cronthread initialized12:49:50 LOG7[main]: Runningon Windows 5.012:49:50 LOG7[main]: No limitdetected for the number of clients12:49:50 LOG5[main]: stunnel5.35 on x86-pc-msvc-1500 platform12:49:50 LOG5[main]:Compiled/running with OpenSSL 1.0.2h-fips 3 May 201612:49:50 LOG5[main]:Threading:WIN32 Sockets:SELECT,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI12:49:50 LOG7[main]: errno:(*_errno())12:49:50 LOG7[ui]: GUImessage loop initialized12:49:50 LOG7[main]: Runningon Windows 5.012:49:50 LOG5[main]: Reading configurationfrom file stunnel.conf12:49:50 LOG5[main]: UTF-8byte order mark detected12:49:50 LOG5[main]: FIPSmode disabled12:49:50 LOG7[main]:Compression disabled12:49:50 LOG7[main]: Snagged64 random bytes from C:/.rnd12:49:50 LOG7[main]: Wrote1024 new random bytes to C:/.rnd12:49:50 LOG7[main]: PRNGseeded successfully12:49:50 LOG6[main]:Initializing service [outlook-pop3]12:49:50 LOG7[main]: Nocertificate or private key specified12:49:50 LOG4[main]: Service[outlook-pop3] needs authentication to prevent MITM attacks12:49:50 LOG7[main]: SSLoptions: 0x03000004 (+0x03000000, -0x00000000)12:49:50 LOG5[main]:Configuration successful12:49:50 LOG7[main]:Listening file descriptor created (FD=344)12:49:50 LOG7[main]: Service[outlook-pop3] (FD=344) bound to 127.0.0.1:11012:49:53 LOG7[main]: Found 1ready file descriptor(s)12:49:53 LOG7[main]: FD=204ifds=r-x ofds=---12:49:53 LOG7[main]: Service[outlook-pop3] accepted (FD=356) from 127.0.0.1:380112:49:53 LOG7[main]: Creatinga new thread12:49:53 LOG7[main]: Newthread created12:49:53 LOG7[0]: Service[outlook-pop3] started12:49:53 LOG7[0]: OptionTCP_NODELAY set on local socket12:49:53 LOG5[0]: Service[outlook-pop3] accepted connection from 127.0.0.1:380112:49:53 LOG6[0]: failover:round-robin, starting at entry #112:49:53 LOG6[0]: s_connect:connecting 132.245.224.162:99512:49:53 LOG7[0]: s_connect:s_poll_wait 132.245.224.162:995: waiting 10 seconds12:49:53 LOG5[0]: s_connect:connected 132.245.224.162:99512:49:53 LOG5[0]: Service[outlook-pop3] connected remote server from 192.168.15.102:380212:49:53 LOG7[0]: OptionTCP_NODELAY set on remote socket12:49:53 LOG7[0]: Remotedescriptor (FD=380) initialized12:49:53 LOG6[0]: SNI:sending servername: outlook.office365.com12:49:53 LOG6[0]: Peercertificate not required12:49:53 LOG7[0]: SSL state(connect): before/connect initialization12:49:53 LOG7[0]: SSL state(connect): SSLv2/v3 write client hello A12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server hello A12:49:53 LOG6[0]: Certificateverification disabled12:49:53 LOG6[0]: Certificateverification disabled12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server certificate A12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server key exchange A12:49:53 LOG6[0]: Clientcertificate not requested12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server done A12:49:53 LOG7[0]: SSL state(connect): SSLv3 write client key exchange A12:49:53 LOG7[0]: SSL state(connect): SSLv3 write change cipher spec A12:49:53 LOG7[0]: SSL state(connect): SSLv3 write finished A12:49:53 LOG7[0]: SSL state(connect): SSLv3 flush data12:49:53 LOG7[0]: SSL state(connect): SSLv3 read finished A12:49:53 LOG7[0]: 1 client connect(s) requested12:49:53 LOG7[0]: 1 client connect(s) succeeded12:49:53 LOG7[0]: 0 client renegotiation(s) requested12:49:53 LOG7[0]: 0 session reuse(s)12:49:53 LOG6[0]: SSLconnected: new session negotiated12:49:53 LOG7[0]: Peercertificate was cached (4882 bytes)12:49:53 LOG6[0]: NegotiatedTLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption)12:49:53 LOG7[0]:Compression: null, expansion: null12:49:54 LOG6[0]: Read socketclosed (readsocket)12:49:54 LOG7[0]: Sendingclose_notify alert12:49:54 LOG7[0]: SSL alert(write): warning: close notify12:49:54 LOG6[0]:SSL_shutdown successfully sent close_notify alert12:49:54 LOG7[main]: Found 1ready file descriptor(s)12:49:54 LOG7[main]: FD=204ifds=r-x ofds=---12:49:54 LOG7[main]: Service[outlook-pop3] accepted (FD=404) from 127.0.0.1:380312:49:54 LOG7[main]: Creatinga new thread12:49:54 LOG7[main]: Newthread created12:49:54 LOG7[1]: Service[outlook-pop3] started12:49:54 LOG7[1]: OptionTCP_NODELAY set on local socket12:49:54 LOG5[1]: Service[outlook-pop3] accepted connection from 127.0.0.1:380312:49:54 LOG6[1]: failover:round-robin, starting at entry #212:49:54 LOG6[1]: s_connect:connecting 132.245.212.98:99512:49:54 LOG7[1]: s_connect:s_poll_wait 132.245.212.98:995: waiting 10 seconds12:49:54 LOG6[0]: SSL socketclosed (SSL_read)12:49:54 LOG7[0]: Sent socketwrite shutdown12:49:54 LOG5[0]: Connectionclosed: 67 byte(s) sent to SSL, 11900 byte(s) sent to socket12:49:54 LOG7[0]: Remotedescriptor (FD=380) closed12:49:54 LOG7[0]: Local descriptor(FD=356) closed12:49:54 LOG7[0]: Service[outlook-pop3] finished (1 left)12:49:54 LOG5[1]: s_connect:connected 132.245.212.98:99512:49:54 LOG5[1]: Service[outlook-pop3] connected remote server from 192.168.15.102:380412:49:54 LOG7[1]: OptionTCP_NODELAY set on remote socket12:49:54 LOG7[1]: Remotedescriptor (FD=428) initialized12:49:54 LOG6[1]: SNI:sending servername: outlook.office365.com12:49:54 LOG6[1]: Peercertificate not required12:49:54 LOG7[1]: SSL state(connect): before/connect initialization12:49:54 LOG7[1]: SSL state(connect): SSLv3 write client hello A12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server hello A12:49:54 LOG6[1]: Certificateverification disabled12:49:54 LOG6[1]: Certificateverification disabled12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server certificate A12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server key exchange A12:49:54 LOG6[1]: Clientcertificate not requested12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server done A12:49:54 LOG7[1]: SSL state(connect): SSLv3 write client key exchange A12:49:54 LOG7[1]: SSL state(connect): SSLv3 write change cipher spec A12:49:54 LOG7[1]: SSL state(connect): SSLv3 write finished A12:49:54 LOG7[1]: SSL state(connect): SSLv3 flush data12:49:54 LOG7[1]: SSL state(connect): SSLv3 read finished A12:49:54 LOG7[1]: 2 client connect(s) requested12:49:54 LOG7[1]: 2 client connect(s) succeeded12:49:54 LOG7[1]: 0 client renegotiation(s) requested12:49:54 LOG7[1]: 0 session reuse(s)12:49:54 LOG6[1]: SSLconnected: new session negotiated12:49:54 LOG7[1]:Deallocating application specific data for addr index12:49:54 LOG6[1]: NegotiatedTLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption)12:49:54 LOG7[1]:Compression: null, expansion: null12:49:56 LOG6[1]: Read socketclosed (readsocket)12:49:56 LOG7[1]: Sendingclose_notify alert12:49:56 LOG7[1]: SSL alert(write): warning: close notify12:49:56 LOG6[1]:SSL_shutdown successfully sent close_notify alert12:49:56 LOG6[1]: SSL socketclosed (SSL_read)12:49:56 LOG7[1]: Sent socketwrite shutdown12:49:56 LOG5[1]: Connectionclosed: 67 byte(s) sent to SSL, 11884 byte(s) sent to socket12:49:56 LOG7[1]: Remotedescriptor (FD=428) closed12:49:56 LOG7[1]: Localdescriptor (FD=404) closed12:49:56 LOG7[1]: Service[outlook-pop3] finished (0 left)

1 0

HTTPS proxy tunnel. ssl handshake failure
by Kirill Franko 22 Jul '16

22 Jul '16

1 1

AiX 7.1 TL3 SP6 - Stunnel Memory Usages grows after 24 hours
by Benjamin, Earl 19 Jul '16

19 Jul '16

Hello Everyone, I am running Stunnel-5.29 in AiX 7.1 TL3 SP6. I have added the DH param to the bottom of my CERT file. After approximately 24 hours or so the Stunnel CPU usage jumps to about 50% and after a few days to about 90%. Is there a configuration setting I've missed or compile option I need to consider? Thanks for your assistance in advance. Below is a cleaned up version of my config file. -Earl ------------------------------------------------- ; Verify peer certificate verify = 2 ; Certificate/key is needed in server mode and in client mode cert = /Server-certificate-all.pem key = /Server-certificate-all.pem CAfile = /all_root_ca.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = TLSv1 ; PID path pid = /etc/oraserver_stunnel.pid ; Turn off Nagle algorithm socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Debug level debug = 2 ; Use it for client mode client = no ; Ciphers ciphers = DHE-RSA-AES256-SHA ; Service-level configuration [ oraserver_DB ] accept = 15210 connect = server:1622 [ oraserver_ASM ] accept = 15211 connect = server:1621 This message and any attachments are solely for the use of intended recipients. The information contained herein may include trade secrets, protected health or personal information, privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you are not an intended recipient, you are hereby notified that you received this email in error, and that any review, dissemination, distribution or copying of this email and any attachment is strictly prohibited. If you have received this email in error, please contact the sender and delete the message and any attachment from your system. Thank you for your cooperation

1 0

Man in the middle attack possibility
by Abhinav Srivastava 19 Jul '16

19 Jul '16

Hi, I'm trying to use stunnel to provide encryption for my application to server communication. Server is already ssl aware. I configured my app to talk to localhost:xyz, and configured stunnel in client mode to relay traffic from localhost:<xyz> to actual service. The stunnel to service ssl protocol would use the server certificate, as server is already ssl aware. For any reason if stunnel is not running it would become possible for a non-elevated attacker/malware to spin up a tcp server listening to xyz, essentially taking advantage of my re-configuration of app to talk to localhost:xyz, and spoof the actual server. Even if my app to server protocol had some anti-spoofing mechanism say e.g., reverse CHAP, the malware can easily relay the challenge and response by using the actual service. In my case the actual app is iscsi initiator software that is not in my control and cant be modified, while the server is an iscsi tcp server which I am free to modify. Are there any guidance/best practices around preventing this attack with stunnel? Thanks Abhinav

1 0

Client certificates now required by default?
by Wiest, Damian 07 Jul '16

07 Jul '16

After building stunnel 5.34 from source I noticed that my old config (5.22) was not working. [dwiest@716161-compute2 ~]$ sudo ./stunnel /etc/stunnel/stunnel.conf 2016.07.07 14:07:41 LOG5[ui]: stunnel 5.34 on x86_64-unknown-linux-gnu platform 2016.07.07 14:07:41 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 2016.07.07 14:07:41 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2016.07.07 14:07:41 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2016.07.07 14:07:41 LOG5[ui]: UTF-8 byte order mark not detected 2016.07.07 14:07:41 LOG5[ui]: FIPS mode disabled 2016.07.07 14:07:41 LOG5[ui]: Configuration successful 2016.07.07 14:07:41 LOG5[cron]: Updating DH parameters 2016.07.07 14:07:42 LOG5[0]: Service [rabbitmq] accepted connection from 192.168.237.81:49535 2016.07.07 14:07:42 LOG3[0]: SSL_accept: Peer suddenly disconnected 2016.07.07 14:07:42 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.07.07 14:07:42 LOG5[1]: Service [rabbitmq] accepted connection from 192.168.237.81:49536 2016.07.07 14:07:42 LOG3[1]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate But I haven't enabled client certificate verification! [dwiest@716161-compute2 ~]$ sudo grep verify /etc/stunnel/stunnel.conf ; verify = 2 I have to explicitly set verify to 0 or 1 in order to connect without a client cert. Is this intentional? The documentation suggests that by default no verification should be taking place. -Damian -- Confidentiality Notice: This e-mail transmission may contain confidential or legally privileged information that is intended only for the individual or entity named in the e-mail address. If you have received this communication in error, please notify me by return e-mail, and destroy this communication and all copies thereof, including any attachments. Apervita ® is a registered trademark of Apervita Inc.

1 0

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6