- stunnel-users - stunnel.org

Problem using stunnel on Windows 7
by Hal Hovland 18 Nov '12

18 Nov '12

I've spent days googling this and read everything relevant in the archives. I'm developing a Windows 7 program that connects to a financial trading exchange that expects all communication to be SSL'd. Everything I read said that stunnel is the answer because of ease of installation and use. After a day of abortive attempts to link to the exchange, I decided to create a much simpler test environment involving two Windows 7 computers next to each other here. One, let's call it Riven-II (192.168.1.9), is set up with a simple Listener program that listens on port 8000. From stunnel's viewpoint this will be a server. The second machine, Lightning (192.168.1.158), has a simple Sender program that sends a text message via port 7999 to Riven-II (192.168.1.9:8000) - this will be the Client. In the absence of stunnel, all messages sent from Lightning/Sender appears on the window of Listener. So far so good. I've downloaded and installed the very latest version (4.54) of stunnel on both machines. On installation I entered the same responses to the certificate generating process. On the Server machine, hard wired to a Broadband Router, I configured stunnel.conf as (removing comments for simplicity) debug = 7 output = stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = stunnel.pem key = stunnel.pem options = NO_SSLv2 taskbar=yes [Listener] connect=8000 accept=8001 On the Client machine, connected to the router via wi-fi, we have in stunnel.conf debug = 7 output = stunnel.log cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 fips=no options = NO_SSLv2 delay=yes taskbar=yes client=yes [sender] accept = 0.0.0.0:7999 (I've tried just 7999 and 192.168.1.158:7999, here. Makes no difference) connect = 192.168.1.9:8001 I've tried many variations with the same result, but the above is where they have ended up. My understanding of this is that stunnel both ends will be intercepting port 8000 on the Server and port 7999 on the Client and presenting/receiving SSL encoded messages across the wire on port 8001. Starting stunnel in the Server (not as a Windows service, although I did try that as well) the following log appears: 2012.11.16 22:34:08 LOG7[3484:6184]: No limit detected for the number of clients 2012.11.16 22:34:08 LOG5[3484:6184]: stunnel 4.54 on x86-pc-msvc-1500 platform 2012.11.16 22:34:08 LOG5[3484:6184]: Compiled/running with OpenSSL 1.0.1c-fips 10 May 2012 2012.11.16 22:34:08 LOG5[3484:6184]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.11.16 22:34:08 LOG5[3484:6184]: Reading configuration from file stunnel.conf 2012.11.16 22:34:08 LOG5[3484:6184]: FIPS mode is enabled 2012.11.16 22:34:08 LOG7[3484:6184]: Compression not enabled 2012.11.16 22:34:08 LOG7[3484:6184]: Snagged 64 random bytes from C:/.rnd 2012.11.16 22:34:08 LOG7[3484:6184]: Wrote 1024 new random bytes to C:/.rnd 2012.11.16 22:34:08 LOG7[3484:6184]: PRNG seeded successfully 2012.11.16 22:34:08 LOG6[3484:6184]: Initializing service [Listener] 2012.11.16 22:34:08 LOG7[3484:6184]: Certificate: stunnel.pem 2012.11.16 22:34:08 LOG7[3484:6184]: Certificate loaded 2012.11.16 22:34:08 LOG7[3484:6184]: Key file: stunnel.pem 2012.11.16 22:34:08 LOG7[3484:6184]: Private key loaded 2012.11.16 22:34:08 LOG7[3484:6184]: Could not load DH parameters from stunnel.pem 2012.11.16 22:34:08 LOG7[3484:6184]: Using hardcoded DH parameters 2012.11.16 22:34:08 LOG7[3484:6184]: DH initialized with 2048-bit key 2012.11.16 22:34:08 LOG7[3484:6184]: ECDH initialized with curve prime256v1 2012.11.16 22:34:08 LOG7[3484:6184]: SSL options set: 0x01000004 2012.11.16 22:34:08 LOG5[3484:6184]: Configuration successful 2012.11.16 22:34:08 LOG7[3484:6184]: Service [Listener] (FD=272) bound to 0.0.0.0:8001 On the Client, the log shows: 2012.11.16 22:25:53 LOG7[4184:4948]: No limit detected for the number of clients 2012.11.16 22:25:53 LOG5[4184:4948]: stunnel 4.54 on x86-pc-msvc-1500 platform 2012.11.16 22:25:53 LOG5[4184:4948]: Compiled/running with OpenSSL 1.0.1c-fips 10 May 2012 2012.11.16 22:25:53 LOG5[4184:4948]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.11.16 22:25:53 LOG5[4184:4948]: Reading configuration from file stunnel.conf 2012.11.16 22:25:53 LOG5[4184:4948]: FIPS mode is disabled 2012.11.16 22:25:53 LOG7[4184:4948]: Compression not enabled 2012.11.16 22:25:53 LOG7[4184:4948]: Snagged 64 random bytes from C:/.rnd 2012.11.16 22:25:53 LOG7[4184:4948]: Wrote 1024 new random bytes to C:/.rnd 2012.11.16 22:25:53 LOG7[4184:4948]: PRNG seeded successfully 2012.11.16 22:25:53 LOG6[4184:4948]: Initializing service [sender] 2012.11.16 22:25:53 LOG7[4184:4948]: Certificate: stunnel.pem 2012.11.16 22:25:53 LOG7[4184:4948]: Certificate loaded 2012.11.16 22:25:53 LOG7[4184:4948]: Key file: stunnel.pem 2012.11.16 22:25:53 LOG7[4184:4948]: Private key loaded 2012.11.16 22:25:53 LOG7[4184:4948]: SSL options set: 0x01000004 2012.11.16 22:25:53 LOG5[4184:4948]: Configuration successful 2012.11.16 22:25:53 LOG7[4184:4948]: Service [sender] (FD=224) bound to 0.0.0.0:7999 Running the Listener on the Server and Sender on the Client adds nothing to the log, and port sniffers on both machines show traffic between 7999 and 8000 (exactly the same as when stunnel is not running). No sign of the use of port 8001. I'd appreciate any input on this. I'm sure I must be doing something stupid, but I've watched hours of YouTube videos, read many hundreds of web pages, and been through the documentation quite a few times, to no avail. I have a Java based version, running in a JVM in the same Windows machines, that talks perfectly to the exchange using some inbuilt SSL capabilities of an included library, so that should probably eliminate any hardware/router issues? Regards, Hal

4 10

log rotation
by Michael Curran 11 Nov '12

11 Nov '12

Are there any built in stunnel.conf parameters for log rotation? Im looking for windows based -- not logrotate on unix -- thats simple Do I need to use windows third party logrotate tools to make this happen instead?

2 1

High memory usage problem.
by Jeremy Frady 11 Nov '12

11 Nov '12

Thanks for taking the time to read this. We're operating on a low spec system that can not be modified at this point. stunnel was introduced at the last minute, without consideration to resource requirements and now consumes enough ram to cause the kernel to issue OOM exceptions. So in short, we are trying to trade increased CPU usage for less memory usage and have tried setting “sessions” to 3600 to reduce memory pressure, but unfortunately it doesn't last. Our current solution is to cron a restart of stunnel on a regular basis, but would prefer to limit number of threads or number of cache entries or something else altogether similarly gentler. Thanks again for your consideration and assistance in this! If there's any specific information I can give, please let me know. Regards, Jeremy

2 1

How do I re-encrypt ssl traffic with stunel?
by Arsen Zahray 11 Nov '12

11 Nov '12

I'm trying to set up wireshark debugging of ssl traffic by following this article: http://www.webos-internals.org/wiki/Decrypt_SSL_(trusted_man-in-the-middle_t echnique) It lists following stunnel commands to do the job: Listen on local IP and de-SSL traffic to localhost:8080 sudo stunnel -p ps.pem -d 443 -r 8080 Listen on 8080, re-SSL to remote server on 443 sudo stunnel -c -d 8080 -r ps.palmws.com:443 The article seems outdated, and stunnel does not react on these commands anymore. Can anyone provide me with a proper configuration file to do the same?

3 2

FIPS enablement
by Michael Curran 06 Nov '12

06 Nov '12

Hello I think there is a bit of confusion within my company on what stunnel can do in regards to FIPS 140-2 out of the box. I know there are configuration options that can enable or disable FIPS 140-2 mode, but as the man page indicates fips = yes | no Enable or disable FIPS 140-2 mode. This option allows to disable entering FIPS mode if stunnel was compiled with FIPS 140-2 support. default: yesWhich to me says I have to compile stunnel on my own using openssl with fips libraries to build a Stunnel binary that can support FIPS 140-2 compliance -- if I download just the windows or unix binaries and install them -- then I am not going to be 140-2 compliant where I set the config file to yes or no , since the FIPS modules wont be compiled into the binary. I'm just looking for confirmation before I take this back to the rest of my group. Thanks!! Michael Curran

3 2

Re: [stunnel-users] Fw: Using stunnel to add https to a webserver that doesn't have ssl setup
by mkanet＠yahoo.com 02 Nov '12

02 Nov '12

Thanks for the reply. Lots of friendly people on here. I should have probably posted my solution when I figured it out. I was already using a server-based method to handle redirection. However, what I didn't consider is adding a one line exception that distinguishes incoming requests from stunnel on 127.0.0.1 in order to prevent an endless loop. I did this by modifying my IIS URL Rewrite module rule to look like below. URL Rewrite module 2.0 is highly optimized; and is ideal for this kind of thing; works perfect under any circumstance; so long as webpages contain relative elements. Works like a charm. <rewrite> <rules> <rule name="HTTP to HTTPS redirect" stopProcessing="true"> <match url="(.*)" /> <conditions logicalGrouping="MatchAll"> <add input="{HTTPS}" pattern="off" ignoreCase="true" /> <add input="{REMOTE_ADDR}" pattern="127.0.0.1" negate="true" /> </conditions> <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" /> </rule> </rules> </rewrite> ----- Forwarded Message ----- On Tue, 30 Oct 2012 15:05:54 -0700 (PDT) <mkanet(a)yahoo.com> wrote: > Thanks. I typically let my webserver handle SSL whenever I can since > it's much easier that way; especially since I know how to handle > http->https urlrewrites that way already; and, plenty of examples on > the web for IIS. The reasons for adding stunnel into the mix in this > scenerio completely outweight not having it at all. I couldn't find > any examples anywhere showing how to handle a simple http to https URL redirect if stunnel is involved; not even in javascript. > Hopefully someone here has the expertise to offer a solution at least in html. The easiest way is to use a server side language as PHP and ASP or CGI/perl (if ISS is capable, that I don't know). If you relay on client (javascript, meta refresh) you can't control the behavior of the client (javascript disabled by user or meta redirects). ISS is capable of PHP and, if you are using it, because you didn't tell, is easy (easy, but I haven't done as I don't know much of PHP (I just played a couple of times with it following tutorials)). With ASP, I don't know, but should be possible too. Here you have an example with PHP: http://www.iis-aid.com/articles/how_to_guides/three_methods_redirect_http_h… or this one: http://stackoverflow.com/questions/5106313/redirecting-from-http-to-https-w… (second message). As I said, you have to do it transparent to the user without relying on them.

1 0

Fw: Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 02 Nov '12

02 Nov '12

Thanks. I typically let my webserver handle SSL whenever I can since it's much easier that way; especially since I know how to handle http->https urlrewrites that way already; and, plenty of examples on the web for IIS. The reasons for adding stunnel into the mix in this scenerio completely outweight not having it at all. I couldn't find any examples anywhere showing how to handle a simple http to https URL redirect if stunnel is involved; not even in javascript. Hopefully someone here has the expertise to offer a solution at least in html. On 30.10.2012 20:39, MKANET wrote > Thanks for the quick reply! So... what http code do I use to break > out the infinite loop so it loads only once? I'm afraid I can't answer that one, as you're using IIS and I'm Unices centered. FWIW, in situations where the port-80 service does *nothing but* hand out redirects to port 443, I typically let the full-blown webserver handle the HTTPS (whether natively or behind an SSL wrapper) and use a boilerplate PERL script (alas, not readily usable on Windows) for the redirecting. I've seen too many kinds of webserver doing redirections to autodetermined URLs that happen to miss some vital part of the originally requested URL, including some that *cause* the browser to drop from HTTPS back to HTTP in the first place. :-S Regards, ----- Forwarded Message ---- Thanks for the quick reply! So... what http code do I use to break out the infinite loop so it loads only once? I think the other 2 circumstances may have something similar happening to them (which are forwarded using the web server instead). If I use the webserver to rewrite the URL, the web browser tries to do something (I can't tell what), then returns the error below: The page isn't redirecting properly Firefox has detected that the server is redirecting the request for this address in a way that will never complete. > Normally, I could do this a few different ways (provided my webserver > had ssl added to it natively in a normal way) 1. webserver URL Rewrite > plugin 2. webserver redirect plugin > 3: > > For whatever reason, I'm having all sorts of weird issues when > trying the three methods above if I use stunnel for ssl instead of > using the webserver's builtin ssl. Please note that traffic coming out of the stunnel looks - and actually *is* - just as port-80-ish to the actual webserver as native HTTP requests do, so unless you take special measures to break the loop, the webserver will try to (re-)redirect *that, too*. Regards, J. Bern --

2 1

enabling https capability
by John A. Wallace 01 Nov '12

01 Nov '12

Not sure if this is the right place to ask, but I will give it a try because it seems likely that someone here can point me in the right direction if need be. I am not a programmer. I have an application that can make http connections but not https. The connections are made from a Windows command line interface, not a browser. I would like to enable it to make https connections too without having to reinvent the wheel. If there is some way to connect it to an intermediary proxy program that does have built-in support for the https protocol, that would be swell. Is such a thing possible or is there another solution I don't see? Thanks. John

2 1

Fwd: Trying to minimize memory usage for a scenario where we have several long-lived HTTPS connections.
by Jeremy Frady 31 Oct '12

31 Oct '12

Hello all, Thanks for taking the time to read this. We're operating on a low spec system that can not be modified at this point. stunnel was introduced at the last minute, without consideration to resource requirements and now consumes enough ram to cause the kernel to issue OOM exceptions. So in short, we are trying to trade increased CPU usage for less memory usage and have tried setting “sessions” to 3600 to reduce memory pressure, but unfortunately it doesn't last. Our current solution is to cron a restart of stunnel on a regular basis, but would prefer to limit number of threads or number of cache entries or something else altogether similarly gentler. Thanks again for your consideration and assistance in this! Regards, Jeremy

1 0

6 processes + out of memory issues on CentOS 6 stunnel (4.29)
by Todd Rinaldo 31 Oct '12

31 Oct '12

I'm experimenting with using the stunnel that comes with CentOS 6 (4.29). I have a config file that is successfully being used on stunnel version 4.15 on the same host without any issues. My issues: 1. starting stunnel creates 6 processes. I assume this has something to do with libwrap, but I'm not finding much discussion about it by doing a search. I'm also assuming that the binaries are forking after load, so it's not a significant memory expense to do this due to COW. Is this correct? 2. I'm getting 't of memory' (no "ou" in the error) messages from syslog when I do more than one request via chrome to port 2087. The process indicated from the message points to the stunnel process that has ownership of the open ports. A single request to this port doesn't seem to spawn the issue. Can anyone suggest what might be causing this? Upgrading to a newer version of stunnel is possible, but I would prefer to keep the version Red Hat provides so they can be on the hook for CVE issues. My config file follows: ----- cert = /var/cpanel/ssl/cpanel/cpanel.pem chroot = /usr/local/cpanel/var/run/stunnel/ # PID is created inside chroot jail pid = /stunnel.pid setuid = cpanel setgid = cpanel # Service-level configuration [cpanelhttps] accept = 2083 connect = 2082 TIMEOUTclose = 0 [whmhttps] accept = 2087 connect = 2086 TIMEOUTclose = 0 [webmailhttps] accept = 2096 connect = 2095 TIMEOUTclose = 0

1 0