- stunnel-users - stunnel.org

stunnel & HAProxy : patch still required ?
by Thomas Manson 24 Nov '11

24 Nov '11

Hi, I'm willing to use this kind of configuration : https client -->stunnel --> haproxy --> 2 web servers in http (or more) I've understand that haproxy can't handle the ssl part, that's why stunnel is needed. I've read that a Patch is required for stunnel to work with haproxy in this kind of confirmation "I run stunnel 4.32 with patch from http://haproxy.1wt.eu/download/patches/ on port 443 and forward it to port 81 on the same machine which is bound to haproxy." Can anyone tell me if this patch is now included in stunnel, in particular, does Ubuntu 11.10 include it ? I really would rather stay with package provided by ubuntu in order to have easy upgrade/security fix. I've experiences the work overload of manually compiling everything in Apache for instance ;) Any advices on this kind of setup ? documentation pointers? best practices ? Regards, Thomas. here is the current package version on ubuntu 11.10 thomas@daisybox:~/Documents$ aptitude show stunnel4 Package: stunnel4 New: yes State: not installed Version: 3:4.35-2build1 Priority: optional Section: universe/net Maintainer: Ubuntu Developers <ubuntu-devel-discuss(a)lists.ubuntu.com> Uncompressed Size: 541 k Depends: libc6 (>= 2.11), libssl1.0.0 (>= 1.0.0), libwrap0 (>= 7.6-4~), openssl, netbase, perl-modules PreDepends: adduser Suggests: logcheck-database Conflicts: stunnel4 Breaks: stunnel (< 3:4.20-3), stunnel (< 3:4.20-3) Replaces: stunnel, stunnel Provides: stunnel Description: Universal SSL tunnel for network daemons The stunnel program is designed to work as SSL encryption wrapper between remote client and local (inetd-startable) or remote server. The concept is that having non-SSL aware daemons running on your system you can easily setup them to communicate with clients over secure SSL channel. stunnel can be used to add SSL functionality to commonly used inetd daemons like POP-2, POP-3 and IMAP servers without any changes in the programs' code. This package contains a wrapper script for compatibility with stunnel 3.x Homepage: http://www.stunnel.org/ thomas@daisybox:~/Documents$ aptitude show stunnel No current or candidate version found for stunnel Package: stunnel State: not a real package Provided by: stunnel4

2 1

Patch: Include source IP in connection failure log lines
by Alex Gottschalk 23 Nov '11

23 Nov '11

I'm setting up an internet-facing server that will be running a service wrapped with stunnel. Given that, it made sense to me to use fail2ban to block repeat connection attempts from clients who don't have the right certificate (the system is using client-certificate authentication). Unfortunately, stunnel4 doesn't put the client source IP in connection failure log lines, so I made this quick patch to enable that. ---cut here---- --- src/client.c.orig 2011-10-05 16:47:48.000000000 -0700 +++ src/client.c 2011-10-05 16:50:37.000000000 -0700 @@ -358,10 +358,13 @@ continue; } } - if(c->opt->option.client) + if(c->opt->option.client) { sslerror("SSL_connect"); - else - sslerror("SSL_accept"); + } else { + char buf[255]; + sprintf(buf, "SSL_accept from %s ", c->accepted_address); + sslerror(buf); + } longjmp(c->err, 1); } if(SSL_session_reused(c->ssl)) { ----cut here----

1 0

Getting Stunnel to work
by Brian Miller 21 Nov '11

21 Nov '11

Hello, I recently moved my Homeseer software from web server 08 to server 08. I had stunnel working on there properly to send out e mails using a hotmail account. I downloaded the new verison of Stunnel and tried to use the same config but Stunnel was crashing. Both versions web server 08 and server 08 are 64bit. Below is the original stunnel config file that I used on web server 08, this is cashing stunnel to crash when I run it. Using the default settings works, but I need to edit the config. I'm not to smart in the whole stunnel / Homeseer side of things. I was told by the Homeseer community that I need this to use my hotmail e mail to send e mails. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 110 connect = pop3.live.com:995 [imaps] accept = 993 connect = 143 [ssmtp] accept = 25 connect = smtp.live.com:587 protocol = smtp ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

1 0

stunnel 4.47 released
by Michal Trojnara 20 Nov '11

20 Nov '11

Dear Users, I have released version 4.47 of stunnel. This version includes a number of important bugfixes. The ChangeLog entry: Version 4.47, 2011.11.21, urgency: MEDIUM: * Internal improvements - CVE-2010-3864 workaround improved to check runtime version of OpenSSL rather than compiled version, and to allow OpenSSL 0.x.x >= 0.9.8p. - Encoding of man page sources changed to UTF-8. * Bugfixes - Handling of socket/SSL close in transfer() function was fixed. - Logging was modified to save and restore system error codes. - Option "service" was restricted to Unix, as since stunnel 4.42 it wasn't doing anything useful on Windows platform. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.47.tar.gz: 0b70f8bad8b6963e6154606571a83a3f0e0dea88d7dbd7e3b83cde5a07dd95ae Best regards, Mike

1 0

Re: [stunnel-users] expired certificate problem
by Rolf Ruediger 18 Nov '11

18 Nov '11

Yeah, great idea...now the log looks a little different: CRL: verification passed 2011.11.18 14:33:22 LOG5[2517:3077962608]: VERIFY OK: depth=2, /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only [...and so on...] But at the end, same as usual: 2011.11.18 14:33:22 LOG3[2517:3077962608]: SSL_connect: 14094415: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired 2011.11.18 14:33:22 LOG5[2517:3077962608]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Maybe there is another reason, why I cant connect? Maybe the lines 2011.11.18 14:33:22 LOG5[2517:3077962608]: connect_blocking: connected example.com:443 2011.11.18 14:33:22 LOG5[2517:3077962608]: https connected remote server from my_outsid_ip:38491 are messing something? -Rolf ________________________________ From: "josealf(a)rocketmail.com" <josealf(a)rocketmail.com> To: Rolf Ruediger <stunnel(a)ymail.com> Sent: Friday, November 18, 2011 2:18 PM Subject: Re: [stunnel-users] expired certificate problem Rolf, Try verify = 0 Regards -----Original Message----- From: Rolf Ruediger <stunnel(a)ymail.com> Sender: stunnel-users-bounces(a)stunnel.org Date: Fri, 18 Nov 2011 05:15:33 To: stunnel-users(a)stunnel.org<stunnel-users(a)stunnel.org> Reply-To: Rolf Ruediger <stunnel(a)ymail.com> Subject: Re: [stunnel-users] expired certificate problem _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

expired certificate problem
by Rolf Ruediger 18 Nov '11

18 Nov '11

Hello there! Some time ago I used stunnel to send the output of a homebrew logging script to a remote server. For a few weeks now, the sever has an expired certificate, so I get an error while connecting to it. The stunnel.log looks like that: 2011.11.18 12:23:36 LOG5[753:3078719168]: stunnel 4.29 on i486-pc-linux-gnu with OpenSSL 0.9.8o 01 Jun 2010 2011.11.18 12:23:36 LOG5[753:3078719168]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.11.18 12:23:36 LOG5[753:3078719168]: 500 clients allowed 2011.11.18 12:24:00 LOG5[759:3078716272]: https accepted connection from 127.0.0.1:40691 2011.11.18 12:24:00 LOG5[759:3078716272]: connect_blocking: connected example.com:443 2011.11.18 12:24:00 LOG5[759:3078716272]: https connected remote server from my_outside_ip:38486 2011.11.18 12:24:00 LOG3[759:3078716272]: SSL_connect: 14094415: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired 2011.11.18 12:24:00 LOG5[759:3078716272]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket This happens, when connecting manually with "nc -v 127.0.0.1 1234" to make a http-get request. To also provide the config file of my linux client: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/https.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration [https] accept = 127.0.0.1:1234 connect = example.com:443 TIMEOUTclose = 0 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 465 connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini So, the server is not under my control, where I am logging to. Is there a problem I don't see? I thought, that when I connect to localhost, the data should be forwarded to the https-server. Thanks in advance. -Rolf

2 2

[patch] x-forwarded-for patch for the new stunnel 4.46
by Michel Belleau 18 Nov '11

18 Nov '11

Hi. I use HAProxy and STunnel and I had to do a new installation lately. I took time to check the latest versions available of each product as this is a good time to test it out before production roll-out. I figured out that enough things have changed from STunnel version 4.44 to 4.46 making the X-Forwarded-For patch (that is usually used when STunnel sits in front of HAProxy) reject some parts of the latest 4.44 patch I found on the internet. Here is the patch, applying with no problems on 4.46, for anyone else interested: http://labs.malaiwah.com/stunnel-4.46-xforwarded-for.diff PS: I didn't try it yet for IPv6 connections yet. Michel Belleau

3 2

Re: [stunnel-users] FW: I can't get stunnel working : SSL3_GET_RECORD:wrong version number
by Michal Trojnara 17 Nov '11

17 Nov '11

The Guru wrote: > When I try to connect, > stunnel reports an error "wrong version number". [cut] > read from 0x4b5f98 [0x4cc0a0] (7 bytes => 7 (0x7)) > 0000 - 16 03 00 0d 01 02 ...... Your server reply protocol version is 3.0. You may wish to enable TLS on your server, or to specify: sslVersion = SSLv3 in your stunnel.conf. Best regards, Michal Trojnara

1 0

Multiple Windows Services
by John W 14 Nov '11

14 Nov '11

I upgraded from stunnel 4.34 to 4.46 (Windows) today, which took much more time than expected. First, I was surprised to see that my specified service name (via "service =" was ignored), until I eventually found the note in the 4.42 changelog about "Removed support for changing Windows Service name with "service"". This isn't the end of the world (I changed the display name using sc) but it would be very helpful -- and time saving -- if the man page was updated to reflect this change. A bigger issue I ran into is that because the service can't be renamed, I can have only one stunnel service installed. The only mention of this I found was a reply to a list question saying "Running more than one stunnel service has been obsoleted." What was the motivation behind this change? Though I can specify multiple [service] sections in stunnel.conf, I see no way to control them individually. It has been useful to have separate stunnel (Windows) services installed, which can be stopped and started independently. Thanks.

2 2

[PATCH]: Debugging output
by Andrew Watts 08 Nov '11

08 Nov '11

Hi. According to the manpage for the output=<file> configuration directive, if this is set then it should replace syslog facility logging. However, stunnel 4.45 (and ealier version) on linux send debugging information to both syslog and a logfile when output is specified. The following patch makes stunnel behave according to the manpage "append log messages to a file instead of using syslog": ==================================== --- a/src/log.c +++ b/src/log.c @@ -163,7 +163,7 @@ static void log_raw(const int level, con line=str_printf("%s %s: %s", stamp, id, text); if(level<=global_options.debug_level) { #if !defined(USE_WIN32) && !defined(__vms) - if(global_options.option.syslog) + if(global_options.option.syslog && !global_options.output_file) syslog(level, "%s: %s", id, text); #endif /* USE_WIN32, __vms */ if(outfile) ==================================== ~ Andy

2 2