August 2018 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Stunnel & Gmail security
by BOXI31 TEST 16 Oct '20

16 Oct '20

Hi all, To make "Stunnel 5.31" work with Gmail, I have to go in security settings of Gmail and "allow less secure apps to access my account". Is it mandatory ? Is it possible to set Stunnel to access Gmail without lowering it security level ? How ? I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider it as a "less secure app." ! Regards, Steve

2 1

OpenSSL 1.1.1 secure level and also an old problem rearing up
by Peter Pentchev 26 Aug '18

26 Aug '18

Hi, Sorry to be the bearer of a "those OS vendors did something again and now we have to catch up with them... again..." type of news, but, well, the maintainers of the Debian package of OpenSSL upgraded it to a prerelease 1.1.1 version and, in the process, changed the default cipher selection in the openssl.cnf file to 'SECLEVEL=2'. Unfortunately, this means that the server certificate used in the stunnel test suite is not considered strong enough, so the test suite is failing. More details may be found in the description of the Debian bug https://bugs.debian.org/906981 and the error message itself is at https://ci.debian.net/data/autopkgtest/testing/amd64/s/stunnel4/865956/log.… (look for all the lines containing "SSL_CTX_use_certificate:ca md too weak") So my first reaction was to stop running the stunnel test suite and only leave my functional test script; however, I then had another idea and tried to get the stunnel test suite to explicitly specify SECLEVEL=1 using the attached patch. This actually helped a bit - it made most of the tests pass - but then I hit a problem with e.g. 037_failover_prio1: if there is a "ciphers" option in the config file, stunnel eventually dies with an error that I seem to remember having seen before; take a look at this gdb backtrace from stunnel 5.48: (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007f0a349882f1 in __GI_abort () at abort.c:79 #2 0x000055b1aa3ad645 in fatal_debug (txt=0x55b1aa3c503c "Bad magic", file=0x55b1aa3ca6dd "ssl.c", line=118) at log.c:379 #3 0x000055b1aa3ae066 in get_alloc_list_ptr (ptr=0x7f0a24014520, file=0x55b1aa3ca6dd "ssl.c", line=118) at str.c:429 #4 0x000055b1aa3ae229 in str_detach_debug (ptr=ptr@entry=0x7f0a24014520, file=file@entry=0x55b1aa3ca6dd "ssl.c", line=line@entry=118) at str.c:378 #5 0x000055b1aa3ae884 in str_detach_debug (line=118, file=0x55b1aa3ca6dd "ssl.c", ptr=0x7f0a24014520) at str.c:413 #6 str_free_debug (ptr=0x7f0a24014520, file=0x55b1aa3ca6dd "ssl.c", line=118) at str.c:413 #7 0x00007f0a34f7661a in CRYPTO_free_ex_data () from /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 #8 0x00007f0a35112a98 in SSL_SESSION_free () from /usr/lib/x86_64-linux-gnu/libssl.so.1.1 #9 0x00007f0a34f7a1bc in OPENSSL_LH_doall_arg () from /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 #10 0x00007f0a35114177 in SSL_CTX_flush_sessions () from /usr/lib/x86_64-linux-gnu/libssl.so.1.1 #11 0x000055b1aa3c3701 in unbind_ports () at stunnel.c:439 #12 0x000055b1aa3c3799 in main_cleanup () at stunnel.c:224 #13 0x000055b1aa3ad720 in main (argc=<optimized out>, argv=<optimized out>) at ui_unix.c:79 (gdb) (the line numbers may be a bit off from the stock stunnel source, since I also added a setrlimit(RLIMIT_CORE, infinity) patch) So, yeah, what would be the best way forward here? I guess I might create a new certificate specifically for the Debian package's test suite, but I think the double-free problem may also need to be fixed. Let me know if you need any more information about reproducing it or any more data in case it doesn't happen on your end. Thanks for everything you're doing for stunnel, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

2 2

Log to syslog without process name, after reloading the configuration (sighup)
by Reschke, Sven (VWIF G-TS/P) 22 Aug '18

22 Aug '18

Hi, I've upgraded my stunnel from version 5.44 to 5.45. After reloading the configuration of stunnel (via pkill -sighup stunnel) several times, I've stumbled about missing syslogs. Only the loading of the configuration file was still visible. Then I've noticed, that greping the syslog for stunnel was my mistake. Stunnel doesn't log its process name after reloading the configuration file the second time (see logs below) Can someone verify, or is it just me, or some configuration I'm missing? BTW: I've reproduced the "problem" also for the version 5.48 as you can see from the logs. With version 5.44 stunnel always logged its process name to syslog. Syslog output for greping after "stunnel": Aug 17 13:41:14 <user> stunnel: LOG5[ui]: stunnel 5.48 on armv7l-unknown-linux-gnueabihf platform Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Compiled/running with OpenSSL 1.0.2p 14 Aug 2018 Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Reading configuration from file /home/pi/stunnel.conf Aug 17 13:41:14 <user> stunnel: LOG5[ui]: UTF-8 byte order mark not detected Aug 17 13:41:14 <user> stunnel: LOG5[ui]: FIPS mode disabled Aug 17 13:41:14 <user> stunnel: LOG4[ui]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:14 <user> stunnel: LOG4[ui]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Configuration successful ---------------- Reloading the configuration the first time ----------------------- Aug 17 13:41:21 <user> stunnel: LOG5[main]: Reading configuration from file /home/pi/stunnel.conf Aug 17 13:41:21 <user> stunnel: LOG5[main]: UTF-8 byte order mark not detected Aug 17 13:41:21 <user> stunnel: LOG5[main]: FIPS mode disabled Aug 17 13:41:21 <user> stunnel: LOG4[main]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:21 <user> stunnel: LOG4[main]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:21 <user> stunnel: LOG5[main]: Configuration successful ---------------- Reloading the configuration a second time ------------------------ Aug 17 13:41:26 <user> : LOG5[main]: Reading configuration from file /home/pi/stunnel.conf My configuration file: [PSK client] client = yes accept = <listen address> connect = <remote address> PSKsecrets = /home/pi/psk.txt [PSK server] accept = <listen address> connect = <remote address> PSKsecrets = /home/pi/psk.txt Sven Reschke Embedded System SW Developer G-TS/P Volkswagen Infotainment GmbH Universitätsstr. 140 44799 Bochum Mobile +49 1525-887 2762 sven.reschke(a)volkswagen-infotainment.com<mailto:sven.reschke@volkswagen-infotainment.com> http://www.volkswagen-infotainment.com<http://www.volkswagen-infotainment.com/> Sitz der Gesellschaft: Wolfsburg Amtsgericht Braunschweig: HRB 204780 Geschäftsführung: Bernhard Krauße (Sprecher), Tobias Nadjib

2 2

OFFICE 365
by Mark Brezinski 15 Aug '18

15 Aug '18

Hello, Anyone have any luck connecting stunnel to office 365 I keep getting a socket 10061 error Mark Brezinski IT / EDI Manager [cid:image003.png@01D147BB.817FAE20]Healthcare, Inc. Proud Winner of the US National Minority Manufacturer of the Year Award 2012, MBDA, US Dept of Commerce Proud Winner of the Supplier of the Year Award 2012, Chicago Minority Supplier Development Council (Class IV >$50MM) Manufacturer of Medical Devices & Disposable Kits 5535 N. Wolcott Avenue Chicago, IL 60640 Tel : (773) 878-1100 ext.277 Fax: (773) 878-9100 mark.brezinski(a)lslhealthcare.com<mailto:mark.brezinski@lslhealthcare.com> www.LSLHealthcare.com<http://www.lslhealthcare.com/> Notice: If you are not the intended recipient, please note that any dissemination, disclosure, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately by telephone or by return e-mail and delete it from their computer. This communication may contain information that is privileged, confidential or exempt from disclosure. P LSL Healthcare, Inc.is dedicated to preserving our environment. Please join us and consider not printing this e-mail unless necessary.

1 0

x64 Installers and Upgrade HowTo
by Cynthia Davis 07 Aug '18

07 Aug '18

Two questions for the mailing list: 1. Are win64 installers available for stunnel? I only see win32 installers on the downloads page. 2. Are there formal (or informal) instructions for upgrading an existing stunnel installation? Thanks in advance, CJD

1 0

zlib1.dll not installed
by Gonzalo Costantini 01 Aug '18

01 Aug '18

Hi, The installer stunnel-5.48-win32-installer.exe do not copy zlib1.dll in any directory; this problem begins with the installer stunnel-5.44-win32-installer. Thaks. -- Luis Gonzalo Costantini Rickel Clave GPG (GPG Key): Fingerprint: 081069E0C552DFBDF53A0D2046ECD11A960D250F Key-ID.: 0x960D250F

1 0