- stunnel-users - stunnel.org

behavior change after enabling proxy protocol
by Philippe Anctil 05 Jun '14

05 Jun '14

Hello, We use stunnel to secure a proprietary tcp/ip protocol over the internet. More specifially we have - 1 balancer - 2 stunnel boxes - 1 app server The load balancer 'pings' stunnel boxes regularly to know if one is down. Recently, we have added support for the proxy protocol in our app and turned it on in our stunnel config. It works great except for one small new behavior: upon receiving a load balancer ping, stunnel performs a connection on our app (and sends the proxy header). I ran a tcpdump for a telnet on the stunnel port (8000). With proxy protocol disabled, stunnel does nothing while it waits for the certificate. The connection ended at my request. 17:33:08.537385 IP 127.0.0.1.6015 > 127.0.0.1.8000: S 356922015:356922015(0) win 32792 <mss 16396,sackOK,timestamp 1085620573 0,nop,wscale 7> 17:33:08.537386 IP 127.0.0.1.8000 > 127.0.0.1.6015: S 1525966521:1525966521(0) ack 356922016 win 32768 <mss 16396,sackOK,timestamp 1085620573 1085620573,nop,wscale 7> 17:33:08.537393 IP 127.0.0.1.6015 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085620573 1085620573> 17:33:19.750431 IP 127.0.0.1.6015 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085631785 1085620573> 17:33:19.751065 IP 127.0.0.1.8000 > 127.0.0.1.6015: . ack 2 win 256 <nop,nop,timestamp 1085631786 1085631785> 17:33:19.751794 IP 127.0.0.1.8000 > 127.0.0.1.6015: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085631787 1085631785> With proxy protocol enabled, stunnel establishes a connection to my app and sends the proxy protocol before even receiving the certificate. 17:34:35.370462 IP 127.0.0.1.6026 > 127.0.0.1.8000: S 2949098861:2949098861(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.370475 IP 127.0.0.1.8000 > 127.0.0.1.6026: S 1044893129:1044893129(0) ack 2949098862 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.370481 IP 127.0.0.1.6026 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371035 IP 127.0.0.1.37654 > 127.0.0.1.9000: S 801705083:801705083(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.371046 IP 127.0.0.1.9000 > 127.0.0.1.37654: S 4068822820:4068822820(0) ack 801705084 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.371052 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371583 IP 127.0.0.1.37654 > 127.0.0.1.9000: P 1:44(43) ack 1 win 257 <nop,nop,timestamp 1085707403 1085707402> 17:34:35.371595 IP 127.0.0.1.9000 > 127.0.0.1.37654: . ack 44 win 256 <nop,nop,timestamp 1085707403 1085707403> 17:34:50.484991 IP 127.0.0.1.9000 > 127.0.0.1.37654: F 1:1(0) ack 44 win 256 <nop,nop,timestamp 1085722515 1085707403> 17:34:50.485892 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 2 win 257 <nop,nop,timestamp 1085722516 1085722515> 17:35:08.824661 IP 127.0.0.1.6026 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085740854 1085707402> 17:35:08.824906 IP 127.0.0.1.8000 > 127.0.0.1.6026: . ack 2 win 256 <nop,nop,timestamp 1085740854 1085740854> 17:35:08.824972 IP 127.0.0.1.37654 > 127.0.0.1.9000: R 44:44(0) ack 2 win 257 <nop,nop,timestamp 1085740854 1085722515> 17:35:08.825013 IP 127.0.0.1.8000 > 127.0.0.1.6026: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085740855 1085740854> Note I used 'tcpdump -i lo -nn port 8000 or port 9000' for both traces. I see no good reason to connect to the application before the ssl session is established. Thank you for reading! -- Philippe Anctil

2 2

log format
by Philippe Anctil 04 Jun '14

04 Jun '14

I have noticed stunnel 5.01 log format is different when I run it under my account vs when I run it on the system. I don't remember seeing this with stunnel 4.56 and older. Format under my account: 2014.06.02 11:38:50 LOG6[26855]: SSL accepted: new session negotiated Format on the system: Jun 4 16:27:14 hostname stunnel: LOG6[11100:0]: SSL accepted: new session negotiated When I run under my account I normally save output to a separate file with output=. I guess this is what is having an influence on the log format? Is there any way I can have logging format in my account consistent with what I have in syslog? Thanks. -- Philippe Anctil

1 0

Problem with pidfile
by reg14＠rambler.ru 30 May '14

30 May '14

I run stunnel (version 5.00) as a non-root user which does not have write permissions to /var/run. So I created file /var/run/stunnel.log with right access for that user -rw-r--r--. 1 stunnel stunnel 0 May 28 21:31 stunnel.pid When I start daemon, it writes to logfile the following 2014.05.28 22:18:44 LOG3[8878]: Cannot create pid file /var/run/stunnel.pid 2014.05.28 22:18:44 LOG3[8878]: create: File exists (17) It seems that it tries to create pidfile in /var/run, and ignores that the file is already exists. As a result, pid is not written to stunnel.pid, and daemon crashes. Could this be fixed?

3 7

Possible Mail Relay (port 465/tcp-SSL) after stunnel install
by Sven Schulte 28 May '14

28 May '14

Dear colleagues, after installing stunnel (v 5.01) an PCI Security Scan finished with finding that port 465 allows mail relaying. (CVE-1999-0512, CVE-2002-1278, CVE-2003-0285). Any comments/ideas how to comly? Thanks in advance! Sven

1 0

Strange performance problem, need help troubleshooting
by Paulo Azevedo 24 May '14

24 May '14

I have a strange performance problem with stunnel, could you help me? Here is my setup: PC1 & PC2 -- Switch (GbE) -- Switch (100mbps) -- Router -- modem -- Internet PC1 has stunnel and HFS installed, sharing a folder to the internet.My internet upload speed is 20Mbps. With this setup, I can serve files at 8Mbps over the internet, but if I disable stunnel the speed doubles to 16Mbps. However, with stunnel active, if I try the same with PC2, I get 82Mbps (using the internet IP, it goes all the way to the router), so this does not appear to be a performance problem on the hardware. Can you give me some hints on what is limiting my speed here?

2 1

[patch] Systemd socket activation support in daemon mode
by Mark Theunissen 14 May '14

14 May '14

Hi, This patch allows stunnel to be started in daemon mode by systemd's socket activation. This is superior to inetd mode, for all the reasons specified in the stunnel howto. Since systemd is now the default in most of the major Linux distros, it would be great to have this committed upstream. https://gist.github.com/marktheunissen/7ce9426e66aa8f0ec2e1 Example systemd unit files: ### stunnel.socket [Unit] Description=Stunnel socket After=network.target [Socket] ListenStream=9999 ### stunnel.service [Unit] Description=Stunnel service After=network.target [Service] Type=forking ExecStart=stunnel /etc/stunnel/stunnel.conf Thanks, Mark Theunissen

1 1

Re: [stunnel-users] certificate verify failed
by Aaron Haywood 05 May '14

05 May '14

The following is an excerpt from my log's slightly modified to hide company specific data: 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=2, subject=/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2014.05.01 10:11:05 LOG6[5956]: Certificate accepted: depth=2, subject=/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=1, subject=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=######## 2014.05.01 10:11:05 LOG6[5956]: Certificate accepted: depth=1, subject=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=######## 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=0, subject=/O=*.somedomain.com/OU=Domain Control Validated/CN=*.somedomain.com 2014.05.01 10:11:05 LOG3[5956]: CERT: X509_STORE_get1_certs: Peer suddenly disconnected 2014.05.01 10:11:05 LOG4[5956]: Certificate check failed: depth=0, subject=/O=*.somedomain.com/OU=Domain Control Validated/CN=*.somedomain.com 2014.05.01 10:11:05 LOG7[5956]: SSL alert (write): fatal: certificate unknown Respectfully, Aaron Haywood | Systems Administrator [cid:image002.png@01CEDA11.E935A7F0] O: 858.614.1547 | M: 858.699.8302 | www.sdhealthconnect.org CONNECT WITH US: Facebook<https://www.facebook.com/SDHealthConnect?filter=1> | Twitter<https://twitter.com/SDHealthConnect> | LinkedIn<http://www.linkedin.com/company/san-diego-health-connect?trk=company_logo> | Google+<https://plus.google.com/u/0/b/112077458420951237937/112077458420951237937/p…> | YouTube<http://www.youtube.com/SDHealthConnect>

1 0

Re: [stunnel-users] certificate verify failed
by Aaron Haywood 05 May '14

05 May '14

Roman, I was wondering if you changed your verify from level 3 to level 2, and if this resolved your peer disconnection error with stunnel. We're experiencing a similar problem but was wondering if anyone out there has resolved this issue already; and if so..how? :) Respectfully, Aaron Haywood | Systems Administrator [cid:image002.png@01CEDA11.E935A7F0] O: 858.614.1547 | M: 858.699.8302 | www.sdhealthconnect.org CONNECT WITH US: Facebook<https://www.facebook.com/SDHealthConnect?filter=1> | Twitter<https://twitter.com/SDHealthConnect> | LinkedIn<http://www.linkedin.com/company/san-diego-health-connect?trk=company_logo> | Google+<https://plus.google.com/u/0/b/112077458420951237937/112077458420951237937/p…> | YouTube<http://www.youtube.com/SDHealthConnect>

1 0

New stunnel how-to
by Patrick J. 30 Apr '14

30 Apr '14

Hi all, I've spent some time to write a new stunnel how-to. - Install and configure stunnel on a Raspberry Pi - Run stunnel in a chroot jail - Limit allowed ciphers and force Forward Secrecy - Restrict access to the stunnel server (verify = 3) - Disguise SSH as HTTPS traffic http://stunnel.qnea.net/ Regards from Germany, Patrick

1 1

Error 126 compiling on Mac OS X 10.7.5
by James Brown 29 Apr '14

29 Apr '14

I’ve just tried to install version 5.01 and encountered an error. I had no problems installing 5.01b1 previously. I just thought I’d install the release version. System is running Mac OS X 10.7.5. make ends with a warning, and make install fails: ld: warning: directory not found for option '-L/usr//lib64' Making all in doc make[1]: Nothing to be done for `all'. Making all in tools make[1]: Nothing to be done for `all'. make[1]: Nothing to be done for `all-am'. mail:stunnel-5.01 2 jlbrown$ sudo make install Password: Making install in src ../auto/install-sh -c -d '/usr/local/bin' /bin/sh ../libtool --mode=install /usr/bin/install -c stunnel '/usr/local/bin' libtool: install: /usr/bin/install -c stunnel /usr/local/bin/stunnel ../auto/install-sh -c -d '/usr/local/bin' /usr/bin/install -c stunnel3 '/usr/local/bin' ../auto/install-sh -c -d '/usr/local/lib/stunnel' /bin/sh ../libtool --mode=install /usr/bin/install -c libstunnel.la '/usr/local/lib/stunnel' libtool: install: /usr/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib libtool: install: /usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/libstunnel.la /Users/jlbrown/Downloads/stunnel-5.01: /Users/jlbrown/Downloads/stunnel-5.01: is a directory make[2]: *** [install-pkglibLTLIBRARIES] Error 126 make[1]: *** [install-am] Error 2 make: *** [install-recursive] Error 1 I just used ./configure with no arguments. Any suggestions? Thanks, James.

1 0