- stunnel-users - stunnel.org

keepalive and stunnel
by David H. Durgee 23 Jul '13

23 Jul '13

I am attempting to use stunnel to provide secure telnet access to a server on my system. As it is possible that a user may be idle for long period I have attempted to enable keepalive with stunnel. My stunnel conf files contain: socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 on both the server and client side. But wireshark shows no keepalive packets being exchanged. I am using socat to provide a service on the LAN and connections using socat do show keepalive packets. But to get this working with socat I had to use the following: socat -d -d -L/var/lock/Port$PORT - TCP:127.0.0.1:$PORT,keepalive,keepcnt=10,keepidle=3,keepintvl=1 I had originally tried it with only the keepalive option, but it took adding the other three options for it to work. Perhaps this is particular to my linux mint 13 maya x64 system and keepalive works by itself on windows? Are the other three options supported in stunnel? Dave

2 1

What do I need to provide an SSL service and verify individual clients?
by John Long 22 Jul '13

22 Jul '13

Hi, I want to set up a service using stunnel as a server. I want only specific clients to be able to connect. Each client will have an SSL-enabled client app. I understand the part about needing to create a self-signed cert for the stunnel server. I don't understand what Stunnel will require from each client. Do I have to create CSRs for each client and sign them with my self-signed cert, or will the keys from additional standalone self-signed certs for each client be good enough on the client side as long as I have a cert that for each key in the certificate path of the server? Is it correct that verify=3 will make sure only clients that have keys matching the certs in the server cert path can connect? If a client with a key that I have no cert for tries to connect, what should happen? Will it time out or will there be an error that the key isn't valid? Thanks, /jl

1 0

Stunnel log file limit
by mehmet ozisik 18 Jul '13

18 Jul '13

Hi, I would like to ask some questions regarding stunnel logging which I could not find answer with googling. 1) what is the limit of stunnel log file (can we define this)? 2) If there is a limit, when the limit is reached does it remove the filled file and starts with the same name an empty log file? Regards Mehmet

3 5

Feature requests
by Death Master 17 Jul '13

17 Jul '13

Can you implement some features? 1) Load balancing leastconn (like leastconn in haproxy) 2) UDT transport between stunnel instances(with several congestion controls which are already implemented for UDT) 3) SCTP transport between stunnel instances (if can be done in userspace) P.S. I'm using 400mbit WAN with 55-90ms latency+0-10%packet loss and on one end I can't control TCP settings at all (remote end is on OpenVZ VPS).

2 1

Line 51: "[pop3s]": Failed to initialize SSL
by Laura Fried 15 Jul '13

15 Jul '13

Beginning with Stunnel version 4.55 and continuing with 4.56 I can configure, make and make install without issue. But as soon as I try to start stunnel with the following command: /usr/local/bin/stunnel /usr/local/etc/stunnel/stunnel.conf I get the folllowing error message: Clients allowed=500 stunnel 4.56 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1 14 Mar 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported Line 51: "[pop3s]": Failed to initialize SSL str_stats: 9 block(s), 163 data byte(s), 522 control byte(s) Any insight into this issue would be greatly appreciated. -- Laura J. Fried

3 5

is verify level 4 working?
by dansmith 12 Jul '13

12 Jul '13

I would expect that level 4 only compares locally installed certificates, however I get the same behaviour as with level 3, stunnel expects a CA cert. Here'e the relevant log when on level 4 Jul 6 23:46:31 mmm stunnel: LOG7[7870:140491349628672]: Starting certificate verification: depth=0, /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: CERT: Verification error: unable to get local issuer certificate Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: Certificate check failed: depth=0, /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd Jul 6 23:46:31 mmm stunnel: LOG7[7872:140080853112576]: SSL alert (read): fatal: unknown CA What am I missing in understanding verify's level 4 ?

3 6

Creating a Centralized Secure Log Server with syslog-ng and Stunnel
by Szajt, Pablo 10 Jul '13

10 Jul '13

Hi guys, I have the task to install a secure syslog server using syslog-ng and stunnel. The Syslog server is a Solaris 10 and Syslog clients are HP-UX 11.31. I've spent already so many hours and I cannot make it run properly. I know syslog-ng works well without stunnel. I'm pretty sure someone is already using it. I'd like to have step by step installation process. I have no issue if I have to start from scratch. Thanks for your help, Pablo Pablo Szajt

2 1

Stunnel 4.56 and FIPS
by Ondrej Hrebicek 09 Jul '13

09 Jul '13

Hello stunnel users, I'm trying to compile stunnel 4.56 with FIPS support on Ubuntu 12.04. Always end up with the infamous "fingerprint does not match" error. I can't figure out what I'm doing wrong. 1. Download openssl-fips-2.0.2.tar.gz, unpack, ./config, make, and sudo make install (as specified in http://www.openssl.org/docs/fips/UserGuide-2.0.pdf) 2. Download openssl-1.0.1e.tar.gz, unpack, ./config fips --with-fipslibdir=/usr/local/ssl/fips-2.0/lib/ --with-fipsdir=/usr/local/ssl/fips-2.0/, make depend, make, and sudo make install 3. At this point, openssl is working in FIPS mode: > OPENSSL_FIPS=1 /usr/local/ssl/bin/openssl version OpenSSL 1.0.1e-fips 11 Feb 2013 > OPENSSL_FIPS=1 /usr/local/ssl/bin/openssl sha1 c_rehash SHA1(c_rehash)= 5af9e1479950bbbd9d3304c181b3f802c54f64fd > OPENSSL_FIPS=1 /usr/local/ssl/bin/openssl md5 c_rehash Error setting digest md5 139806582736544:error:060A80A3:digital envelope routines:FIPS_DIGESTINIT:disabled for fips:fips_md.c:180: 4. Download stunnel-4.56.tar.gz, unpack, ./configure --enable-fips --with-ssl=/usr/local/ssl, make, and sudo make install 5. While configuring and building stunnel completes as expected, the following does appear in ./configure's output: checking whether to enable FIPS mode support... yes configure: **************************************** SSL checking for SSL directory... /usr/local/ssl checking /usr/local/ssl/include/openssl/engine.h usability... yes checking /usr/local/ssl/include/openssl/engine.h presence... yes checking for /usr/local/ssl/include/openssl/engine.h... yes checking /usr/local/ssl/include/openssl/ocsp.h usability... yes checking /usr/local/ssl/include/openssl/ocsp.h presence... yes checking for /usr/local/ssl/include/openssl/ocsp.h... yes checking /usr/local/ssl/include/openssl/fips.h usability... no checking /usr/local/ssl/include/openssl/fips.h presence... no checking for /usr/local/ssl/include/openssl/fips.h... no configure: WARNING: OpenSSL fips header not found This is not entirely unexpected as fips.h only exists in /usr/local/ssl/fips-2.0/include/openssl. 6. Running stunnel however fails: > /usr/local/bin/stunnel Clients allowed=500 stunnel 4.56 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06B06F: error:2D06B06F:FIPS routines:FIPS_check_incore_fingerprint:fingerprint does not match Line 61: "[pop3s]": Failed to initialize SSL str_stats: 5 block(s), 120 data byte(s), 290 control byte(s) I can't figure out what's causing this, hoping someone on the list may have a couple suggestions. Thanks in advance!

2 2

Re: [stunnel-users] is verify level 4 working?
by Thomas Eifert 09 Jul '13

09 Jul '13

dansmith, I'd be the last to argue with you. Purely as an experiment, I tried changing the verify level from 4 to 3, but it didn't fly. I most likely missed the entirety of the signing chain, as I only added the certificate of the *issuing* CA. Regards, Thomas On 7/8/2013 7:01 PM, dansmith wrote: > Thomas, the recent exception you are describing - needing a CA > sertificate and server certificate is what verify=3 does. > So, I guess there is some regression in the code. > When I look at stunnel's verify.c code, there is only one reference to > level 4 in line 225. It seems like verify=4 functionality is missing > from the code. > > On 07/08/2013 11:44 PM, Thomas Eifert wrote: >> dansmith, >> >> It's my understanding that verify = 4 should, theoretically, look only >> for the server certificate, and this is the way I've been using it >> with great success over the past year or so. Recently, however, I ran >> into an exception to that behavior. >> >> In my case, I only had to download and install one certificate; that >> of the signing CA. I simply pasted it directly below the server >> certificate in the associated .pem file. The CA certificate wasn't >> originally in .pem format, so I converted it beforehand. OpenSSL has >> conversion capability, and there are also online certificate tools >> available. Your mileage may vary. >> >> Good luck. >> >> Thomas >> >> >> On 7/8/2013 3:01 PM, dansmith wrote: >> >>> Could you kindly break it down for me. Are you saying that I need to >>> have two CAs A & B. A signs the certificate of B and B signs the >>> certificate of my server? >>> Do I understand correctly that verify=4 is supposed to simply ignore >> any >>> CAs and only look at the actual certificate, comparing it to the >>> certificate in CAfile ? >>> >>> >>> On 07/08/2013 06:32 PM, Thomas Eifert wrote: >>>> You're not missing anything. I've experienced a similar issue. While >>>> verify = 4 generally works well in most cases and will ignore the CA >>>> chain, I've encountered a few isolated incidences in which I've had to >>>> append or "chain" the server certificate with the certificate of the >>>> CA. Give it a shot and see if it resolves your issue. >>>> >>>> Thomas >>>> >>>> On 7/8/2013 3:02 AM, dansmith wrote: >>>>> I would expect that level 4 only compares locally installed >>>>> certificates, however I get the same behaviour as with level 3, >> stunnel >>>>> expects a CA cert. >>>>> Here'e the relevant log when on level 4 >>>>> >>>>> Jul 6 23:46:31 mmm stunnel: LOG7[7870:140491349628672]: Starting >>>>> certificate verification: depth=0, >>>>> /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd >>>>> Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: CERT: >>>>> Verification error: unable to get local issuer certificate >>>>> Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: Certificate >>>>> check failed: depth=0, >> /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd >>>>> Jul 6 23:46:31 mmm stunnel: LOG7[7872:140080853112576]: SSL alert >>>>> (read): fatal: unknown CA >>>>> >>>>> What am I missing in understanding verify's level 4 ? >>>>> >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> stunnel-users mailing list >>>>> stunnel-users(a)stunnel.org >>>>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>>>> >>>> >>> >>> >> > > -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

is verify level 4 working?
by Thomas Eifert 09 Jul '13

09 Jul '13

dansmith, It's my understanding that verify = 4 should, theoretically, look only for the server certificate, and this is the way I've been using it with great success over the past year or so. Recently, however, I ran into an exception to that behavior. In my case, I only had to download and install one certificate; that of the signing CA. I simply pasted it directly below the server certificate in the associated .pem file. The CA certificate wasn't originally in .pem format, so I converted it beforehand. OpenSSL has conversion capability, and there are also online certificate tools available. Your mileage may vary. Good luck. Thomas On 7/8/2013 3:01 PM, dansmith wrote: > Could you kindly break it down for me. Are you saying that I need to > have two CAs A & B. A signs the certificate of B and B signs the > certificate of my server? > Do I understand correctly that verify=4 is supposed to simply ignore any > CAs and only look at the actual certificate, comparing it to the > certificate in CAfile ? > > > On 07/08/2013 06:32 PM, Thomas Eifert wrote: >> You're not missing anything. I've experienced a similar issue. While >> verify = 4 generally works well in most cases and will ignore the CA >> chain, I've encountered a few isolated incidences in which I've had to >> append or "chain" the server certificate with the certificate of the >> CA. Give it a shot and see if it resolves your issue. >> >> Thomas >> >> On 7/8/2013 3:02 AM, dansmith wrote: >>> I would expect that level 4 only compares locally installed >>> certificates, however I get the same behaviour as with level 3, stunnel >>> expects a CA cert. >>> Here'e the relevant log when on level 4 >>> >>> Jul 6 23:46:31 mmm stunnel: LOG7[7870:140491349628672]: Starting >>> certificate verification: depth=0, >>> /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd >>> Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: CERT: >>> Verification error: unable to get local issuer certificate >>> Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: Certificate >>> check failed: depth=0, /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd >>> Jul 6 23:46:31 mmm stunnel: LOG7[7872:140080853112576]: SSL alert >>> (read): fatal: unknown CA >>> >>> What am I missing in understanding verify's level 4 ? >>> >>> >>> >>> >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >> > > -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately. -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0