stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

REMOVE
by Bruce Edwards 22 Aug '13

22 Aug '13

Please remove me from your list server R. Bruce Edwards Communications Manager 1018 Pretlow St Franklin, VA 23851 bedwards(a)franklinpolice.org Office: 757-562-8696 Cell: 757-621-5295

1 0

Build failure for ARM32 with Yocto
by Laszlo Papp 22 Aug '13

22 Aug '13

Hi, if I build stunnel manually on my desktop machine (Archlinux), it works fine. However, when I am trying to use a Yocto/OE recipe for building it for my arm32 target, I am facing the issue below. Anyone any hint? Cheers, L. | /usr//include/linux/sysctl.h:836:20: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:849:12: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:892:31: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:897:32: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:912:26: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:917:32: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:928:20: warning: comma at end of enumerator list [-pedantic] | In file included from /usr//include/linux/netfilter_ipv4.h:8:0, | from common.h:383, | from network.c:38: | /usr//include/linux/netfilter.h:58:18: warning: comma at end of enumerator list [-pedantic] | In file included from common.h:383:0, | from network.c:38: | /usr//include/linux/netfilter_ipv4.h:68:26: warning: comma at end of enumerator list [-pedantic] | make[2]: *** [stunnel-str.o] Error 1 | make[2]: *** Waiting for unfinished jobs.... | make[2]: *** [stunnel-network.o] Error 1 | make[2]: *** [stunnel-resolver.o] Error 1 | make[2]: *** [stunnel-protocol.o] Error 1 | make[2]: *** [stunnel-log.o] Error 1 | make[2]: *** [stunnel-file.o] Error 1 | make[2]: *** [stunnel-options.o] Error 1 | make[2]: *** [stunnel-client.o] Error 1 | make[2]: Leaving directory `/home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/work/armv5te-linux-gnueabi/stunnel/4.56-r0/stunnel-4.56/src' | make[1]: *** [all] Error 2 | make[1]: Leaving directory `/home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/work/armv5te-linux-gnueabi/stunnel/4.56-r0/stunnel-4.56/src' | make: *** [all-recursive] Error 1 | ERROR: oe_runmake failed | ERROR: Function failed: do_compile (see /home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/work/armv5te-linux-gnueabi/stunnel/4.56-r0/temp/log.do_compile.10590 for further information) ERROR: Task 6 (/home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/../meta-networking/recipes-support/stunnel/ stunnel_4.56.bb, do_compile) failed with exit code '1' NOTE: Tasks Summary: Attempted 561 tasks of which 559 didn't need to be rerun and 1 failed. No currently running tasks (561 of 568) Summary: 1 task failed: /home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/../meta-networking/recipes-support/stunnel/ stunnel_4.56.bb, do_compile Summary: There was 1 ERROR message shown, returning a non-zero exit code.

2 3

Problem Selecting Only Ecliptic Curve Ciphers
by Carter Browne 07 Aug '13

07 Aug '13

I'm using stunnel 4.56 on Windows 7. When I use the following cipher list: ciphers = ECDHE-ECDSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-ECDSA-AES128-SHA to establish a connection, I get a "no shared cipher" response. The following set of ciphers does work: ciphers = ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA Other relevant settings: options = NO_SSLv2 sslVersion = all fips = no verify = 2 If I take out the first ECDHE-RSA-ASE256-SHA cipher from the list, the ECDHE-RSA-AES128-SHA cipher is selected. What am I doing wrong? Thanks. -- Carter Browne cbrowne(a)cbcs-usa.com

2 1

Unable to make SSL connexion work
by OLIVER Patrice 07 Aug '13

07 Aug '13

Hi, Since our company had to migrate to Orange Office365 platform, we cannot send simple SMTP message using smtp.office365.com We have to use SMTP over TLS. While I have to use some applications which cannot use SMTP, I installed and setup STunnel. When I try to send a simple mail like this : telnet myserver 25 ehlo ch-lepuy.fr mail from: toto(a)ch-lepuy.fr I cannot continue with rcpt to syntax and I have the following message : rcpt to:530 5.7.1 Client was not authenticated In the STunnel log file, I can see that : 2013.08.06 19:20:49 LOG7[1352:2832]: SSL state (connect): before/connect initialization 2013.08.06 19:20:49 LOG7[1352:2832]: SSL state (connect): SSLv3 write client hello A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server hello A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server certificate A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server key exchange A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server certificate request A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server done A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write client certificate A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write client key exchange A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write certificate verify A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write change cipher spec A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write finished A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 flush data 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read finished A 2013.08.06 19:20:50 LOG7[1352:2832]: 1 items in the session cache 2013.08.06 19:20:50 LOG7[1352:2832]: 1 client connects (SSL_connect()) 2013.08.06 19:20:50 LOG7[1352:2832]: 1 client connects that finished 2013.08.06 19:20:50 LOG7[1352:2832]: 0 client renegotiations requested 2013.08.06 19:20:50 LOG7[1352:2832]: 0 server connects (SSL_accept()) 2013.08.06 19:20:50 LOG7[1352:2832]: 0 server connects that finished 2013.08.06 19:20:50 LOG7[1352:2832]: 0 server renegotiations requested 2013.08.06 19:20:50 LOG7[1352:2832]: 0 session cache hits 2013.08.06 19:20:50 LOG7[1352:2832]: 0 external session cache hits 2013.08.06 19:20:50 LOG7[1352:2832]: 0 session cache misses 2013.08.06 19:20:50 LOG7[1352:2832]: 0 session cache timeouts 2013.08.06 19:20:50 LOG7[1352:2832]: Peer certificate was cached (6184 bytes) 2013.08.06 19:20:50 LOG6[1352:2832]: SSL connected: new session negotiated 2013.08.06 19:20:50 LOG6[1352:2832]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES256-SHA (256-bit encryption) 2013.08.06 19:20:50 LOG6[1352:2832]: Compression: null, expansion: null 2013.08.06 19:21:13 LOG3[1352:2832]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2013.08.06 19:21:13 LOG5[1352:2832]: Connection reset: 65 byte(s) sent to SSL, 231 byte(s) sent to socket 2013.08.06 19:21:13 LOG7[1352:2832]: Remote socket (FD=316) closed 2013.08.06 19:21:13 LOG7[1352:2832]: Local socket (FD=244) closed 2013.08.06 19:21:13 LOG7[1352:2832]: Service [SMTP Outgoing] finished (0 left) Here is my STunnel setup : client = yes output = stunnel-log.txt debug = 7 taskbar = yes ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [SMTP Outgoing] protocol = smtp accept = 25 connect = smtp.office365.com:587 Does anyone have an idea ? Regards? Patrice Oliver | Centre Hospitalier Emile Roux Responsable Informatique T. 04 71 04 38 30 12 Bd Andr? Chantemesse - 43012 LE PUY EN VELAY Cedex http://www.ch-lepuy.fr

3 3

Disable SSL session ticket
by dansmith 06 Aug '13

06 Aug '13

Hi, when connecting a stunnel client to a stunnel server, is it possible to disable the use of SSL session tickets? I need to be able to decrypt the stunnel traffic in wireshark. Unfortunately, wireshark still doesn't support SSL session tickets.

2 1

transparent = source, not working
by Ruben Cardenal 04 Aug '13

04 Aug '13

Hi, I'm trying to setup yet another service of this kind. I've seen this has been largely discussed several times on this list (but without valid solutions), and I'm writting this email as some kind of last resort after hours of testing and debugging. Pretty simple configuration: # cat /etc/stunnel/stunnel.conf cert = /etc/ssl/certs/stunnel4/my-cert.crt key = /etc/ssl/certs/stunnel4/my-cert.key sslVersion = SSLv3 foreground = yes pid = /tmp/stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log [service] accept = 195.78.X.X:6697 connect = 195.78.X.X:1357 transparent = source Accept and connect IP's are the same. # /usr/local/bin/stunnel -version stunnel 4.56 on i686-pc-linux-gnu platform Compiled/running with OpenSSL 0.9.8o 01 Jun 2010 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP Global options: debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # /usr/local/bin/stunnel -sockets stunnel 4.56 on i686-pc-linux-gnu platform Compiled/running with OpenSSL 0.9.8o 01 Jun 2010 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP Socket option defaults: Option Name | Accept | Local | Remote |OS default ----------------+----------+----------+----------+---------- SO_DEBUG | -- | -- | -- | no SO_DONTROUTE | -- | -- | -- | no SO_KEEPALIVE | -- | -- | -- | no SO_LINGER | -- | -- | -- | 0:0 SO_OOBINLINE | -- | -- | -- | no SO_RCVBUF | -- | -- | -- | 87380 SO_SNDBUF | -- | -- | -- | 65536 SO_RCVLOWAT | -- | -- | -- | 1 SO_SNDLOWAT | -- | -- | -- | 1 SO_RCVTIMEO | -- | -- | -- | 0:0 SO_SNDTIMEO | -- | -- | -- | 0:0 SO_REUSEADDR | yes| -- | -- | no SO_BINDTODEVICE | -- | -- | -- |write-only TCP_KEEPCNT | -- | -- | -- | 9 TCP_KEEPIDLE | -- | -- | -- | 7200 TCP_KEEPINTVL | -- | -- | -- | 75 IP_TOS | -- | -- | -- | 0 IP_TTL | -- | -- | -- | 64 TCP_NODELAY | -- | yes| yes| no IP_FREEBIND | -- | -- | -- | no And the timeout, the same I've seen suffering to other people: 2013.08.03 19:52:12 LOG7[18496:3074533056]: Service [service] accepted (FD=3) from MY_HOME_ADDRESS:34836 2013.08.03 19:52:12 LOG7[18496:3074530160]: Service [service] started 2013.08.03 19:52:12 LOG5[18496:3074530160]: Service [service] accepted connection from MY_HOME_ADDRESS:34836 (blah blah ssl stuff) 2013.08.03 19:52:12 LOG6[18496:3074530160]: Negotiated TLSv1/SSLv3 ciphersuite: DHE-RSA-AES256-SHA (256-bit encryption) 2013.08.03 19:52:12 LOG6[18496:3074530160]: Compression: null, expansion: null 2013.08.03 19:52:12 LOG6[18496:3074530160]: IP_TRANSPARENT socket option set 2013.08.03 19:52:12 LOG6[18496:3074530160]: local_bind succeeded on the original port 2013.08.03 19:52:12 LOG6[18496:3074530160]: connect_blocking: connecting 195.78.X.X:1357 2013.08.03 19:52:12 LOG7[18496:3074530160]: connect_blocking: s_poll_wait 195.78.X.X:1357: waiting 60 seconds 2013.08.03 19:52:21 LOG3[18496:3074530160]: connect_blocking: connect 195.78.X.X:1357: Connection timed out (110) 2013.08.03 19:52:21 LOG5[18496:3074530160]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket iptables stuff and that, is in place: # cat /proc/sys/net/ipv4/conf/all/rp_filter 0 # cat /proc/sys/net/ipv4/ip_forward 1 And did the iptables part: iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 Debugging the whole thing, it can be seen that stunnel tries to connect: [pid 16823] connect(9, {sa_family=AF_INET, sin_port=htons(1357), sin_addr=inet_addr("195.78.X.X")}, 16) = -1 EINPROGRESS (Operation now in progress) BUT the service running in 1357 does this: # tcpdump -i eth1 -n port 1357 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes 19:52:52.586773 IP 195.78.X.X.1357 > MY_HOME_ADDRESS.34853: Flags [S.], seq 2655966098, ack 546202865, win 5840, options [mss 1460,nop,nop,sackOK], length 0 And, according to that, it looks obvious to me that this setup will never work, since that ACK packet goes to my home box, and not to the local connection. So either I'm doing something wrong (I hope I am!!) or this thing definitely doesn't work... Any help/ideas/whatever, please? Thanks, Rubén.

2 5

Library for iOS
by ios dev 29 Jul '13

29 Jul '13

Hi. I have to build static library for using in iOS application. Did anybody already built it? How can I do it? Thanks.

1 0

Reverse DNS lookup in stunnel log possible?
by mkanet＠yahoo.com 28 Jul '13

28 Jul '13

I currently have stunnel strip SSL from incoming https connections; which then passes the connections to a proxy before ultimately reaching my web server. So, the only easy way to see where incoming connections are coming from are in the stunnel log. Below, is a small example of what my stunnel log looks like (no, those arent the real IPs ). The information below would be much more useful to me if it included the DNS names in addition to their numeric IP. I currently have the latest Windows version of stunnel installed. It would be great to know how to get it to resolve DNS names as well in the log file; preferably without impeding general stunnel performance. I tried several debug levels; but none them did reverse DNS lookup. Hopefully someone know how to do this on a Windows stunnel setup. 2013.07.23 10:16:00 LOG5[10152:15136]: Service [stunnel-sslh] connected remote server from 24.12.152.129:58773 2013.07.23 10:16:00 LOG3[10152:15136]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2013.07.23 10:16:00 LOG5[10152:15136]: Connection reset: 272 byte(s) sent to SSL, 96 byte(s) sent to socket 2013.07.23 10:17:53 LOG5[10152:4000]: Service [stunnel-sslh] accepted connection from 71.194.51.232:5535 2013.07.23 10:17:53 LOG5[10152:4000]: connect_blocking: connected 24.12.152.129:7777 2013.07.23 10:17:53 LOG5[10152:4000]: Service [stunnel-sslh] connected remote server from 24.12.152.129:58799 2013.07.23 10:17:53 LOG5[10152:13212]: Service [stunnel-sslh] accepted connection from 71.194.51.232:5508 2013.07.23 10:17:53 LOG5[10152:3348]: Service [stunnel-sslh] accepted connection from 71.194.51.232:5509 2013.07.23 10:17:53 LOG5[10152:2884]: Service [stunnel-sslh] accepted connection from 71.194.51.232:5519

4 9

Re: [stunnel-users] Server down
by Ludolf Holzheid 24 Jul '13

24 Jul '13

On Wed, 2013-07-24 13:22:26 -0400, Walter Hankins wrote: > Hi Ludoff, > > I am new to stunnel. I trying to configure. > > Stunnel.conf: > socket = l: TCP_NODELAY = 1 > socket = r: TCP_NODELAY = 1 > > debug = 7 > output = stunnel.log Hi Walter, Always reply to the list, so others can comment. Your log says `Cannot open log file: stunnel.log´. I don't how you invoke stunnel, so I don't know if the directory it's working in is writable, but you may try to specify an output file in a writable directory with an absolute path, e.g. output=C:/stunnel.log if C:\ is writable on your box. HTH, Ludolf -- Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:lholzheid@bihl-wiedemann.de http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Server down
by Walter Hankins 24 Jul '13

24 Jul '13

Server is down Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from C:/.rnd Wrote 0 new random bytes to C:/.rnd PRNG seeded successfully Initializing service [Ssmtp] Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded SSL options set: 0x01000004 Configuration successful Service [Ssmtp] (FD=672) bound to 127.0.0.1:25 Cannot open log file: stunnel.log Closing service [Ssmtp] Service [Ssmtp] closed (FD=672) Sessions cached before flush: 0 Sessions cached after flush: 0 Service [Ssmtp] closed Server is down

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users