stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

Confusion regarding part of stunnel.conf
by Dave 12 Feb '11

12 Feb '11

I've set up a test of stunnel with the latest stunnel and latest openssl, and if I set "verify=0" or "verify=1" I can get it to work (I'm tunneling a pop3 session), but if I set it any higher (to 2 or 3) it won't work for me. Now, I'm not sure which level is "necessary" because in stunnel.conf I read: ------------------------- ; authentication stuff needs to be configured to prevent MITM attacks ; it is not enabled by default! ;verify = 2 ------------------------- ... which sounds like verify defaults to 0. But is a verify level of 1 enough to solve the man-in-the-middle problem? It seems like it would not be (since level 1 will allow absence of a certificate), but I am not sure. I guess my questions boil down to: 1) What are the necessary settings for "authentication stuff" to prevent the MITM attack vector mentioned in stunnel.conf? 2) What is the proper way to set up (self-signed) certs to prevent such an attack? Can a self-signed cert be used at a verify level of 2 or 3? Dave

2 11

[patch] Unix socket support for Stunnel
by Stefan Behte 11 Feb '11

11 Feb '11

Hi, yet another request for a patch inclusion... Quoting from http://haproxy.1wt.eu/#down : "This patch contributed by Exceliance adds to stunnel the ability to connect to haproxy over a UNIX stream socket instead of using TCP. Sometimes this can be more convenient and/or more secure. " I think it would be nice to have it upstream. And I hope I am not bothering Michals yet. ;) Best regards, Stefan Behte

1 0

Security Problems with 4.35
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, in the announcement of 4.35, I saw: "CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments." I searched a bit, but did not find an exploit or more information on the severity of this issue. Could someone elaborate the problem a bit? I could diff to the previous version and have a look, but that will take quite some time, and my C is weak... Best regards, Stefan Behte

2 1

use somaxconn in stunnel
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, attached you will find a patch from Thomas Franco to honor SOMAXCONN. It defaults to 128, which is not enough for some setups. It defines the maximum number of requests that can be queued to a listening socket and can be changed with sysctl via net.core.somaxconn. I think it would be nice to have it in stunnel-4.36 to make it usable in bigger installations. It's available online here: https://github.com/op4g/stunnel/commit/e200bebaf92c068aa319c43fdd50cddd6816… Best regards, Stefan Behte

2 4

publish/subscribe with stunnel
by Dam Dam 10 Feb '11

10 Feb '11

Hello, I am having a problem to configure stunnel in a publish/subscribe architecture. Basically, I have a publisher service configured with stunnel as a server. Its configuration is close to: [publisher] accept = p1 connect = 127.0.0.1:p2 This service publishes data to a subscriber. As far I as understood, the subscriber should be configured as a client with stunnel with a configuration close to this: [subscriber] accept = p3 connect = remote:p1 client = yes Now, my problem is that the subscriber does not listen on any port. So p3 does not actually exist. When the subscriber starts, it automatically connects and subscribes to the publisher and waits for data from the publisher service. I would like to secure the connection between the publisher and the subscriber but I am stuck with the configuration. Any ideas? Regards, Damien

2 1

stunnel, haproxy and ssl cert
by Amol 10 Feb '11

10 Feb '11

i got the SSL setup done with the stunnel, but when i connect from the url i always see this entry in my stunnel.log 2011.02.09 14:52:34 LOG3[2433:139832543721216]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing my stunnel config is cert=/etc/stunnel/ssl/group-cert.pem key = /etc/stunnel/ssl/l.key ;setuid = nobody ;setgid = nogroup pid = /etc/stunnel/stunnel.pid debug = 3 output = /etc/stunnel/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=443 connect=80 TIMEOUTclose=0 xforwardedfor=yes i have just got familiar to stunnel to not sure i that error is ok?

2 3

Help with stunnel configuration
by Rohler, Brian L 09 Feb '11

09 Feb '11

I'm looking to see if the windows version of stunnel (4.34) can be executed from a command line and have it configured to connect and accept on different ports?

1 0

X-Forwarded-For / X-Forwarded-Proto
by Stefan Behte 09 Feb '11

09 Feb '11

Hello Michal, I've read that you prefer not to support X-Forwarded-For because an old code had a buffer overflow and did not support keep-alive functions of HTTP/1.1. I believe the overflow was fixed in the newer version of the patch I've attached. IMHO the patch will still be very useful, even if it does not support keep-alive: often in high-performence setups keep-alive is not even desired because it fills up ressources needlessly. Even if this does not provide all features, a lot of people would be satisfied with it. There is a great desire for this patch, if one searches for "stunnel x-forwarded-for" on google, you will find more than 60 pages and not only a few dozens of blogs/mailing lists that discuss applying the patch and getting it to work as an SSL terminator for loadbalancing software. And last, I know that the patch (the one Willy Tarreau is hosting on haproxy.1wt.eu and is attached) is in use at several high-traffic websites and runs stable. ;) If it's too much of a hassle for you to review and/or integrate the patch, I can understand that very well, I'd just like to open a discussion and would like to know if you have concerns regarding the patch quality, even if you do not want to include the patch at this time. :) Best regards, Stefan Behte

2 1

stunnel HUP bug
by Stefan Behte 09 Feb '11

09 Feb '11

Hi, kill -HUP does not seem to work for me with 4.35, I always get: 2011.02.07 17:51:25 LOG5[14988:139705784043264]: Received signal 15; terminating Best regards, Stefan Behte Babiel GmbH Moskauer Str. 27 D-40227 Düsseldorf Tel: 0211-179349 0 Fax: 0211-179349 29 E-Mail: S.Behte(a)babiel.com Internet: http://www.babiel.com

2 6

stunnel libwrap/tcpwrapper bug (patch included)
by Stefan Behte 09 Feb '11

09 Feb '11

Hi, I stumbled upon a really old bug in stunnel: ./configure --enable-libwrap && make [...] mv -f .deps/pty.Tpo .deps/pty.Po gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.35\" -DPACKAGE_STRING=\"stunnel\ 4.35\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.35\" -D_GNU_SOURCE=1 -DHOST=\"i686-pc-linux-gnu\" -DCPU_I686=1 -DVENDOR_PC=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_TCPD_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LINUX_NETFILTER_IPV4_H=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_PIPE2=1 -DHAVE_ACCEPT4=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -DHAVE_LIBWRAP=1 -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wextra -pedantic -Wno-long-long -I/usr/include -MT libwrap.o -MD -MP -MF .deps/libwrap.Tpo -c -o libwrap.o libwrap.c libwrap.c: In function 'libwrap_init': libwrap.c:91: warning: ignoring return value of 'write', declared with attribute warn_unused_result mv -f .deps/libwrap.Tpo .deps/libwrap.Po /bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wextra -pedantic -Wno-long-long -I/usr/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lutil -lnsl -lpthread -L/usr/lib64 -L/usr/lib -lssl -lcrypto /bin/sh: warning: setlocale: LC_ALL: cannot change locale (c) libtool: link: gcc -g -O2 -Wall -Wextra -pedantic -Wno-long-long -I/usr/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lutil -lnsl -lpthread -L/usr/lib64 -L/usr/lib -lssl -lcrypto libwrap.o: In function `check': /usr/portage/distfiles/stunnel-4.35/src/libwrap.c:194: undefined reference to `request_init' /usr/portage/distfiles/stunnel-4.35/src/libwrap.c:195: undefined reference to `sock_host' /usr/portage/distfiles/stunnel-4.35/src/libwrap.c:196: undefined reference to `hosts_access' collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make[1]: Leaving directory `/usr/portage/distfiles/stunnel-4.35/src' make: *** [all-recursive] Error 1 The attached patch solves the problem; it would be cool, if you could include it in the next release. Best regards Stefan Behte Babiel GmbH Moskauer Strasse 27 D-40227 Düsseldorf Tel: 0211-179349 0 Fax: 0211-179349 29 E-Mail: S.Behte(a)babiel.com Internet: http://www.babiel.com Geschäftsführer: Georg Babiel, Dr. Rainer Babiel, Harald Babiel Amtsgericht Düsseldorf HRB 38633 ~~~~~~~~~~~~~~ DISCLAIMER ~~~~~~~~~~~~~~~ The information transmitted in this electronic mail message may contain confidential and or privileged materials. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you receive such e-mails in error, please contact the sender and delete the material from any computer.

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users