- stunnel-users - stunnel.org

Re: [stunnel-users] Understanding communication
by josealf＠rocketmail.com 16 Apr '15

16 Apr '15

Claudia, Yes, to create a tunnel you need to configure stunnel on both sides, except in those cases when one of the extremes already supports TLS. Looks like yours is not one of those cases. Regards, Jose -----Original Message----- From: "Claudia Porta" <claudia.porta(a)bancaakros.it> Sender: "stunnel-users" <stunnel-users-bounces(a)stunnel.org> Date: Wed, 15 Apr 2015 14:51:07 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Understanding communication _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Verifying TLS authentication via stunnel logs
by shanmuganathan sedukumar 16 Apr '15

16 Apr '15

We have a requirement to send emails via a SMTP server which requires TLS authentication. Going through some logs we tried changing the parameter "SSLversion = TLSv1", but still getting authentication failure. So, we would like to verify if stunnel is trying to sending request via TLS method before looking for any issues at SMTP end. Is there a way we can verify from stunnel logs if the request is sent via TLS? Thanks & Regards,Shanmu

1 0

Session is active but I cannot connect
by daninho dj 09 Apr '15

09 Apr '15

Hi guys, I am struggling with a problem for some time. I searched about this problem in the stunnel mails archives and also on Google but couldn't find a solution and I ran out of ideas so I was thinking to write you about it. I am using Eclipse to access and manipulate the data from a linux server. I want to use stunnel when I connect to the server via Eclipse, so I installed and configured everything as it follows: The server I am using is SuSE Linux and the stunnel version which I installed is this one: *stunnel 4.27 on x86_64-suse-linux-gnu with OpenSSL 0.9.8j-fips 07 Jan 2009* The stunnel version on Windows 7 is: *stunnel version 5.10* In the conf file from linux (server) I have the following configuration for stunnel.conf: *client = no* *chroot = /var/lib/stunnel/* *setuid = root* *setgid = root* *pid = /var/run/stunnel.pid* *debug = 7* *output = /var/log/stunnel/stunnel.log* *cert = /etc/ssl/certs/stunnel.pem* *sslVersion = SSLv3* *[test]* *accept = 2404* *connect = 2406* In the conf file from windows (client) I have the following configuration in stunnel.conf: *debug = 7* *output = C:\Program Files (x86)\stunnel\stunnel.log* *cert = C:\Program Files (x86)\stunnel\stunnel.pem* *sslVersion = SSLv3* *[test]* *client = yes* *accept = 127.0.0.1:2404 <http://127.0.0.1:2404>* *connect = xx.xxx.xxx.xxx:2406* In the log I have this: 2015.04.09 13:48:04 LOG5[11060]: Configuration successful 2015.04.09 13:48:04 LOG7[11060]: Listening file descriptor created (FD=452) 2015.04.09 13:48:04 LOG7[11060]: Service [test] (FD=452) bound to 127.0.0.1:2404 2015.04.09 13:48:07 LOG7[11060]: Service [test] accepted (FD=496) from 127.0.0.1:56675 2015.04.09 13:48:07 LOG7[11060]: Creating a new thread 2015.04.09 13:48:07 LOG7[11060]: New thread created 2015.04.09 13:48:07 LOG7[2088]: Service [test] started 2015.04.09 13:48:07 LOG5[2088]: Service [test] accepted connection from 127.0.0.1:56675 2015.04.09 13:48:07 LOG6[2088]: s_connect: connecting xx.xxx.xxx.xxx:2406 2015.04.09 13:48:07 LOG7[2088]: s_connect: s_poll_wait xx.xxx.xxx.xxx:2406: waiting 10 seconds 2015.04.09 13:48:07 LOG5[2088]: s_connect: connected xx.xxx.xxx.xxx:2406 2015.04.09 13:48:07 LOG5[2088]: Service [test] connected remote server from 127.0.0.1:56676 2015.04.09 13:48:07 LOG7[2088]: Remote socket (FD=516) initialized 2015.04.09 13:48:07 LOG6[2088]: SNI: sending servername: *my_server_name* 2015.04.09 13:48:07 LOG7[2088]: SSL state (connect): before/connect initialization 2015.04.09 13:48:07 LOG7[2088]: SSL state (connect): SSLv3 write client hello A 2015.04.09 13:48:08 LOG3[2088]: SSL_connect: Peer suddenly disconnected 2015.04.09 13:48:08 LOG5[2088]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.04.09 13:48:08 LOG7[2088]: Remote socket (FD=516) closed 2015.04.09 13:48:08 LOG7[2088]: Local socket (FD=496) closed 2015.04.09 13:48:08 LOG7[2088]: Service [test] finished (0 left) Although in the stunnel log it's showing *s_connect: connected* I cannot connect at all. When I try to connect via port 2406, the stunnel icon shows that the server is idle and I have nothing in the log about it. When I try to connect via port 2404, the stunnel icon shows that the there are 2 active sessions but I cannot connect to the server. I tried switching the ports (2404 with 2406 and 2406 with 2404 in the stunnel.conf file) but stunnel doesn't even open in that case. Do you have any idea what might could be the problem and how could I solve it? Thanks in advance! Best Regards, Daninho --

3 6

Stunnel 5.0x compile issues
by Michael Curran 06 Apr '15

06 Apr '15

Hello -- I am running the following commands to compile openssl (with FIPS support) and stunnel * Base config for FIPS cd openssl-fips-2.0.9 echo "./config" ./config * OpenSSL with shared and custom install location cd openssl-1.0.1m echo "./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib" ./config fips shared --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib/ * Stunnel with FIPs (autodetect is working , I just added it to force it) cd stunnel-5.09 echo "make clean" make clean echo "./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips" ./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips You can see that my custom OpenSSL is reporting that it is built with -fips root@host:/var/tmp# /usr/local/openssl-100/bin/openssl version OpenSSL 1.0.1m-fips 19 Mar 2015 But when I'm done with all the compile options -- I only see the base version of OpenSSL 1.0.1m , and this same script with Stunnel 4.53 shows OpenSSL 1.0.1m-fips Is there something I am missing during the configure for Stunnel that is causing it to NOT see openssl is compiled with FIPs? root@host:/var/tmp# stunnel -version stunnel 5.09 on x86_64-unknown-linux-gnu platform Compiled with OpenSSL 1.0.1m 19 Mar 2015 Running with OpenSSL 1.0.1 14 Mar 2012 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

Disconnect immediately after sending a message successfully
by Swallow 02 Apr '15

02 Apr '15

Hi, Can you give me a hand? We sent messages to a server over SSL. But stunnel showed disconnect from remote server as soon as we sent out logon message correctly. We close down the fire wall. Dose we misunderstand the mechanism of stunnel? Could someone help me? Thank you very much. Regards, Yan

1 0

Log rotation for Windows
by John Smith 31 Mar '15

31 Mar '15

Hi I came across this thread, I know it's old... http://mailing.unix.stunnel-users.narkive.com/QOEx4XQz/stunnel-users-log-ro… And it says that's it's on the todo list, though I don't see anything indicating this on the list. So is log rotation implemented for Windows and if so what is the config parameter? Thanks

2 5

Stunnel not receiving connections on ports 465 & 587
by James Brown 31 Mar '15

31 Mar '15

I am running Stunnel 5.14 on my Mac mail server (OS X 10.7.5), but trying to send emails using ports 465 & 587 does not work: Mail.app says: Mail was unable to connect to server “mail.bordo.com.au <http://mail.bordo.com.au/>” using SSL on port 587. Verify that this server supports SSL and that your account settings are correct. Log from Stunnel is: 2015.03.31 09:27:56 LOG7[ui]: Clients allowed=500 2015.03.31 09:27:56 LOG5[ui]: stunnel 5.14 on x86_64-apple-darwin11.4.2 platform 2015.03.31 09:27:56 LOG5[ui]: Compiled/running with OpenSSL 1.0.2a 19 Mar 2015 2015.03.31 09:27:56 LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2015.03.31 09:27:56 LOG7[ui]: errno: (*__error()) 2015.03.31 09:27:56 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2015.03.31 09:27:56 LOG5[ui]: UTF-8 byte order mark not detected 2015.03.31 09:27:56 LOG5[ui]: FIPS mode disabled 2015.03.31 09:27:56 LOG7[ui]: Compression disabled 2015.03.31 09:27:56 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2015.03.31 09:27:56 LOG7[ui]: PRNG seeded successfully 2015.03.31 09:27:56 LOG6[ui]: Initializing service [ssmtp] 2015.03.31 09:27:56 LOG6[ui]: Loading certificate from file: /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG6[ui]: Loading key from file: /usr/local/etc/postfix/smtpd.key 2015.03.31 09:27:56 LOG7[ui]: Private key check succeeded 2015.03.31 09:27:56 LOG7[ui]: DH initialization 2015.03.31 09:27:56 LOG7[ui]: Using DH parameters from /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG7[ui]: DH initialized with 2048-bit key 2015.03.31 09:27:56 LOG7[ui]: ECDH initialization 2015.03.31 09:27:56 LOG7[ui]: ECDH initialized with curve prime256v1 2015.03.31 09:27:56 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.03.31 09:27:56 LOG6[ui]: Initializing service [ssmtp2] 2015.03.31 09:27:56 LOG6[ui]: Loading certificate from file: /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG6[ui]: Loading key from file: /usr/local/etc/postfix/smtpd.key 2015.03.31 09:27:56 LOG7[ui]: Private key check succeeded 2015.03.31 09:27:56 LOG7[ui]: DH initialization 2015.03.31 09:27:56 LOG7[ui]: Using DH parameters from /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG7[ui]: DH initialized with 2048-bit key 2015.03.31 09:27:56 LOG7[ui]: ECDH initialization 2015.03.31 09:27:56 LOG7[ui]: ECDH initialized with curve prime256v1 2015.03.31 09:27:56 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.03.31 09:27:56 LOG5[ui]: Configuration successful 2015.03.31 09:27:56 LOG7[ui]: Listening file descriptor created (FD=6) 2015.03.31 09:27:56 LOG7[ui]: Service [ssmtp] (FD=6) bound to 0.0.0.0:465 2015.03.31 09:27:56 LOG7[ui]: Listening file descriptor created (FD=7) 2015.03.31 09:27:56 LOG7[ui]: Service [ssmtp2] (FD=7) bound to 0.0.0.0:587 /usr/local/etc/stunnel/stunnel.conf has: [ssmtp] client = no accept = 465 connect = 127.0.0.1:25 [ssmtp2] client = no accept = 587 connect = 127.0.0.1:25 The mail server is running on the same machine. I can send emails using port 25 with no SSL. (I have to have the ‘Allow insecure authentication’ ticked). When I try to send using ports 587 or 465 there is nothing logged by stunnel (or anywhere else that I can see). Firewall is not blocking anything: sudo ipfw list 65535 allow ip from any to any Postfix is the SMTP server, Dovecot for IMAP. Any suggestions? Thanks, James.

2 2

5.xx Windows binaries - FIPS compliant?
by Rob Lockhart 30 Mar '15

30 Mar '15

I apologize if this was asked in the past. I couldn't find any references to my question in the lists except this (related but not answering the question): http://www.stunnel.org/pipermail/stunnel-users/2014-July/004673.html http://www.stunnel.org/pipermail/stunnel-users/2012-November/003963.html I understand how to compile Stunnel from source, and the FIPS canister for OpenSSL, then build OpenSSL with this FIPS canister, then build Stunnel using that OpenSSL. My question is for the Windows version with filename "stunnel-5.13-installer.exe". That compiled version doesn't seem to be built with FIPS canister, as the log shows: "Compiled/running with OpenSSL 1.0.2a 19 Mar 2015" without a "-fips" appendage after the OpenSSL version. In other words, if it was built as FIPS-compliant, it would show: "Compiled/running with OpenSSL 1.0.2a-fips 19 Mar 2015" It may support the FIPS options (in the config file) but it's not FIPS-compliant. I also assume that this doesn't preclude the FIPS options in the config file from working. Specifically, FIPS-compliant does NOT imply that FIPS mode cannot be enabled. Am I understanding this correctly? Thanks, -Rob

2 2

Libressl with stunnel
by jungle Boogie 29 Mar '15

29 Mar '15

Hello All, It appears that stunnel still requires openssl and cannot use libressl. Have the developers considered this patch: https://github.com/sabotage-linux/sabotage/commit/9b47cbbf3ce903dee042c45c8… This is from stunnel 5.02 days but are there any issues with applying this with 5.14? -- ------- inum: 883510009027723 sip: jungleboogie(a)sip2sip.info xmpp: jungle-boogie(a)jit.si

2 2

stunnel 5.14 release
by Michal Trojnara 25 Mar '15

25 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.14 of stunnel. The ChangeLog entry: Version 5.14, 2015.03.25, urgency: HIGH: * Security bugfixes - The "redirect" option now also redirects clients on SSL session reuse. In stunnel versions 5.00 to 5.12 reused sessions were never redirected regardless of their certificate verification result. This vulnerability was reported by Johan Olofsson. * New features - Windows service is automatically restarted after upgrade. * Bugfixes - Fixed a memory allocation error during Unix daemon shutdown. - Fixed handling multiple connect/redirect destinations. - OpenSSL FIPS builds are now correctly reported on startup. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 2197b4fc1db82eba69c8baf1fac30f0767af26e9f8c7e9e1d5a4a8fbb264695a stunnel-5.14.tar.gz 29364b3f07a84245fe1b0f8373d96c9924650a8058e602670a67a2da07a801bd stunnel-5.14-installer.exe e3b48534bb4a5f8237e4ed1aa4990ed8485bdf97f6e0b8da2507dbd9b5cad34c stunnel-5.14-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVEs/mAAoJEC78f/DUFuAUNq4P/A7Ap1NkzfhZQJWJMJthar1P hoVHIzuH7dGbRt4C5s0PgbC4S9UOz8wdcKbsNcPJRQf0PXP5oVARo2bx+3dV9uAC /6GRL+a5Rj8HU5vG4UX/9D5D0pvwcyFkk7sIxUhyeKSHcEH354Vgw0AlJM6GiWKG nwE5RJ3JTdxi8A4e10p3ZKnPg4Y0eWmpkm1qkqH9RWKj9+BbLaPt7ZvRBNYNicq3 3BtVaJ5KLGvWaQRww+llhvPnR2K+h7PnJiaIKm/cIHzbP8VLjoVWy/Dk5EOku6Zg iCfz8uFzezz+9NwwjjEl2KfGUNdBaZf02R2LqN57pTZyBPZNVH9G7IE1/BGJh7Ai f440LTC29OB7qnJThDRdU16x/Iz+NTcc1QFK4x7eTD+nTouUuyZh9Md0x4DD9jwk CL3dHZ6abUO9j7V04Sb8+wfWzP/pZdilWLyY1jj8L41EPXyb0DE3ZsrHyN7lJ2Fx OihfevJhB9bzCzXiLg0oW61YRUm5prRTxMaeTAC53fITlvx0yf9pHFNy0OtoTNr+ t0Skf/LMaZnvU0rE0UBSjqQbpKNaRff5zsGrI/NLgk98X/NTdakgrgsS0jjaQgYm 7mgH4mKoI9qL2YUMw7d9eGg8j8I9qewhaQYjVz4kGoq9YOCVhh69XormcGMAXXjY gf3RNVLzQH4N19TYz5a8 =lrVy -----END PGP SIGNATURE-----

1 0