stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

newb: setting up and debugging a windows stunnel
by Jay Sprenkle 19 Apr '10

19 Apr '10

Good afternoon, I'm trying to use stunnel to secure a legacy application's communications. I can't seem to get it setup and working. Can anyone provide any hints where I'm going wrong? Here's what I'm trying to accomplish: A windows service on a client machine connects to a server on port 7000 using TCP. I'd like to encrypt the communication between client and server. Here's what I've tried: Created a new server that accepts ssl connections on port 7443. Got a certificate for the server and installed it. Installed stunnel on my windows machine (version 7.43 from the distribution archive file). Installed libssl32.dll and libeay32.dll in the same directory as stunnel.exe ( from the openssl-0.9.8h-1 binary distribution). Installed it as a service using "stunnel -install" Configured stunnel as follows: debug=7 output=C:\p4\internal\Utility\Proxy\proxy.log service=Proxy taskbar=no [exchange] accept=7000 client=yes connect=proxy.blah.com:7443 I changed my hosts file to trick the old application: server.blah.com 127.0.0.1 proxy.blah.com IP-address-of-server.blah.com "server.blah.com" now resolves to the machine it's running on (i.e. stunnel). "proxy.blah.com" goes to the real server. stunnel should connect to the server. I start the stunnel service and try to connect. It looks like it's working but the stunnel service just shuts down with no message. 2010.04.19 13:16:21 LOG5[4924:3716]: stunnel 4.33 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2010.04.19 13:16:21 LOG5[4924:3716]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.04.19 13:16:49 LOG5[4924:3748]: Service exchange accepted connection from 127.0.0.1:4134 2010.04.19 13:16:49 LOG6[4924:3748]: connect_blocking: connecting x.80.60.32:7443 2010.04.19 13:16:49 LOG5[4924:3748]: connect_blocking: connected x.80.60.32:7443 2010.04.19 13:16:49 LOG5[4924:3748]: Service exchange connected remote server from x.253.120.19:4135 2010.04.19 13:20:24 LOG5[3668:3856]: Reading configuration from file stunnel.conf 2010.04.19 13:20:24 LOG7[3668:3856]: Snagged 64 random bytes from C:/.rnd 2010.04.19 13:20:24 LOG7[3668:3856]: Wrote 1024 new random bytes to C:/.rnd 2010.04.19 13:20:24 LOG7[3668:3856]: RAND_status claims sufficient entropy for the PRNG 2010.04.19 13:20:24 LOG7[3668:3856]: PRNG seeded successfully 2010.04.19 13:20:24 LOG7[3668:3856]: SSL context initialized for service exchange 2010.04.19 13:20:24 LOG5[3668:3856]: Configuration successful 2010.04.19 13:20:24 LOG5[3668:3856]: No limit detected for the number of clients 2010.04.19 13:20:24 LOG7[3668:3856]: FD=312 in non-blocking mode 2010.04.19 13:20:24 LOG7[3668:3856]: Option SO_REUSEADDR set on accept socket 2010.04.19 13:20:24 LOG7[3668:3856]: Service exchange bound to 0.0.0.0:7000 2010.04.19 13:20:24 LOG7[3668:3856]: Service exchange opened FD=312 2010.04.19 13:20:24 LOG5[3668:3856]: stunnel 4.33 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2010.04.19 13:20:24 LOG5[3668:3856]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.04.19 13:21:02 LOG7[3668:4556]: Service exchange accepted FD=372 from 127.0.0.1:4156 2010.04.19 13:21:02 LOG7[3668:4556]: Creating a new thread 2010.04.19 13:21:02 LOG7[3668:4556]: New thread created 2010.04.19 13:21:02 LOG7[3668:3756]: Service exchange started 2010.04.19 13:21:02 LOG7[3668:3756]: FD=372 in non-blocking mode 2010.04.19 13:21:02 LOG5[3668:3756]: Service exchange accepted connection from 127.0.0.1:4156 2010.04.19 13:21:02 LOG7[3668:3756]: FD=396 in non-blocking mode 2010.04.19 13:21:02 LOG6[3668:3756]: connect_blocking: connecting x.80.60.32:7443 2010.04.19 13:21:02 LOG7[3668:3756]: connect_blocking: s_poll_wait x.80.60.32:7443: waiting 10 seconds 2010.04.19 13:21:02 LOG5[3668:3756]: connect_blocking: connected x.80.60.32:7443 2010.04.19 13:21:02 LOG5[3668:3756]: Service exchange connected remote server from x.253.120.19:4157 2010.04.19 13:21:02 LOG7[3668:3756]: Remote FD=396 initialized 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): before/connect initialization 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write client hello A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read server hello A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read server certificate A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read server done A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write client key exchange A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write change cipher spec A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write finished A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 flush data 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read finished A The client thinks the connection is closed: No connection could be made because the target machine actively refused it 127.0.0.1:7000 at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress) at System.Net.Sockets.Socket.Connect(EndPoint remoteEP) at Service.ConnUtility.Connect() Any suggestions? Thanks

1 0

Stunnel connection from A to B but direction from B to A?
by Carsten Krüger 13 Apr '10

13 Apr '10

Hi, is it possible with stunnel to connect from host A to host B but to have the port redirection the other way? host A has a webserver on 127.0.0.1:80 host A connects to Host B (example.dyndns.org:8000) Host B opens a browser on page http://127.0.0.1:80 and reaches the webserver on A If yes, how do I have to configure A and B? The manpage didn't enlighten me. The normal way A connects to B and A reaches webserver on B works perfectly. greetings Carsten

2 1

multiple systems
by tony westenhofer 12 Apr '10

12 Apr '10

Hello, My currently working setup is using verify=2 (at client only )and the server1's info is in my .pem on the clients. This works fine, but if need to have server2 act as backup when server1 is down. Can I just add server2's info to the .pem or do I need to setup multiple files for the different keys? Thanks in advance for saving me some lab time! Noob _________________________________________________________________ The New Busy think 9 to 5 is a cute idea. Combine multiple calendars with Hotmail. http://www.windowslive.com/campaign/thenewbusy?tile=multicalendar&ocid=PID2…

1 0

"bind: Address already in use (48)"
by Dino Buzzetti 12 Apr '10

12 Apr '10

Please pardon me if this is an improper question to the list. But I am a freshman who uses stunnel to connect to his university library proxy from abroad. I had stunnel installed and it worked properly, but after an upgrade of all old ports, solicited by the installation process of a new application requiring MacPorts, stunnel doesn't work anymore. I have tried to re-install it, but I still get the same error message > Error binding squidssl to ::1:8095 > bind: Address already in use (48) Any clue as to what might have engaged the 8095 address and on how I might try to solve the problem? Best, -dino buzzetti

3 2

Stunnel doesn't work at all since 4.30
by Denis Solovyov 05 Apr '10

05 Apr '10

Dear friends, I use stunnel for a long time to provide pop3s connections inside a local network. It is quite an old linux server under 2.4 kernel. Stunnel is started from xinetd. xinetd.conf: service pop3s { socket_type = stream wait = no user = root server = /usr/local/bin/stunnel server_args = /usr/local/etc/stunnel/pop3s.conf bind = [ip_address] } /usr/local/etc/stunnel/pop3s.conf: cert = /usr/local/etc/stunnel/mail.pem debug = debug exec = /usr/local/sbin/popa3d execargs = popa3d Everything worked perfectly before 4.30, but when I installed 4.30 pop3s connections just stopped. There is absolutely nothing in logs, just start and stop; example: Mar 24 20:29:51 aldema xinetd[2235]: START: pop3s pid=19123 from=[ip] Mar 24 20:29:51 aldema xinetd[2235]: EXIT: pop3s status=1 pid=19123 duration=0(sec) It is "all.log", i.e. syslog puts everything (*.*) into this file. If starting xinetd with '-v' option, nothing interesting is shown in its own verbose output. When I use 4.29 all.log looks like (with debug = info): Mar 21 09:40:04 aldema xinetd[2235]: START: pop3s pid=32516 from=[ip] Mar 21 09:40:04 aldema stunnel: LOG5[32516:16384]: stunnel 4.29 on i686-pc-linux-gnu with OpenSSL 0.9.7e Mar 21 09:40:04 aldema stunnel: LOG5[32516:16384]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Mar 21 09:40:04 aldema stunnel: LOG5[32516:16384]: stunnel accepted connection from[ip]:4020 Mar 21 09:40:04 aldema stunnel: LOG6[32516:16384]: SSL accepted: new session negotiated Mar 21 09:40:04 aldema stunnel: LOG6[32516:16384]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 Mar 21 09:40:04 aldema stunnel: LOG6[32516:16384]: Local mode child started (PID=32517) Mar 21 09:40:05 aldema popa3d[32517]: Authentication passed for [username] from 127.0.0.1 Mar 21 09:40:05 aldema popa3d[32517]: 0 messages (0 bytes) loaded Mar 21 09:40:05 aldema popa3d[32517]: 0 (0) deleted, 0 (0) left Mar 21 09:40:05 aldema stunnel: LOG6[32516:16384]: SSL_shutdown successfully sent close_notify Mar 21 09:40:05 aldema stunnel: LOG5[32516:16384]: Connection closed: 29 bytes sent to SSL, 48 bytes sent to socket Mar 21 09:40:05 aldema xinetd[2235]: EXIT: pop3s status=0 pid=32516 duration=1(sec) When 4.30 was released I thought it may be buggy because it was marked "experimental", but now I see 4.32 and the same behaviour. Actually, I don't know what to do... nothing in logs really confuses me. Does it mean stunnel crashes at startup (running "stunnel -version" is OK)? Any ideas? Thank you. With the best regards, Denis Solovyov

1 1

Openssl-1.0.0 incompatibility
by Carter Browne 02 Apr '10

02 Apr '10

Is there any update on the compatibility issues between openssl-0.9.8n and openssl-1.0.0? The same configuration file was used in both cases. Linux CentOS 5.4 and SuSE 11.1. Stunnel and openssl both built from sources. I have a number of self-signed certificates in a sub-directory. With openssl-1.0.0, the error is: VERIFY ERROR: depth=0, error= self signed certificate:... SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned With openssl-0.9.8n VERIFY OK: depth=0, ... I have compiled and linked a version of openssh-5.4p1 from sources with openssl-1.0.0 and it works correctly. Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

Re: [stunnel-users] stunnel sends empty list of trusted CAs
by Sebastian Bork 01 Apr '10

01 Apr '10

2010/3/31 Michal Trojnara <Michal.Trojnara(a)mirt.net> > You should have implemented it the other way around: The "cert" option should contain the complete certificate chain of stunnel, > and "CApath"/"CAfile" should only contain the trusted CA certificate for "verify > = 2", and the trusted peer certificate for "verify = 3". Hi, thank you for your quick reply! Alas, I think we started with a misunderstanding. I know how the own certificate and the partner certificates are configured, and the instance with verify=3 works for some thirty partners. All client certificates are validated just as they should be. The file I set in "cert" contains the three certificates in the server certificate chain for stunnel, in the correct order. "CApath" is set to a directory that has all the symlinks with md5 hashes for the client certificates (the certificates themselves are all in their own subdirectories, with another set of symlinks, so I can use the subdirectory for an stunnel client process, and the directory at the top for the server). So when I wrote I put the whole certificate chain for each partner in the CA path, I meant in the directory there is the partner certificate as well as the certificate(s) of the CA that they got their certificate from. With "openssl verify -CApath . partner.crt" I check if everything is complete. Maybe this is overkill, if I do not really need a self-signed certificate at the top, but it shouldn't hurt either. The problem is this: their SAP software (I think they use the Business Connector, but it might be their PI directly, as indicated by the "XI" at the end of the capture file - I am no SAP guru) does not send a partner certificate. The partner claims this is because the "Distinguished Names" list is empty. In this list the server is supposed to send all the CAs it accepts, so the client can then chose one of the certificates it has installed to present it to the server. Since the list is empty, no certificate is found. So I need to find a way to send back a list of accepted root CA certificates. What I tried, and described in the mail, was this: I set up a second stunnel with verify=2. For this, I use the same file in "cert", but a new directory for CApath. In this directory, I have put the symlink for the CA certificate of the partner (their own company-wide CA) , in the hope that this is not only used to verify their client certificate when they present it, but also sent in the Distinguished Names list of accepted CAs. Unfortunately, this did not work, that list is still empty. I have attached the data of the connection attempt, including a screenshot the partner sent us, which shows the field they are talking about with a size of "0", Is there any way, regardless of how complex, to send the DNs? I'll gladly patch the source and compile instead of using a binary package, as long as it helps.

1 0

More Issues with Openssl 1.0.0
by Carter Browne 31 Mar '10

31 Mar '10

My standard configurations of stunnel use the verify=2 option. With recent versions of stunnel and openssl-0.9.8 for Linux systems, I have capath = /capath and stunnel searches directory /capath relative to chroot for the certificates. Using the same configuration file and openssl-1.0.0, this directory is no longer being searched. Any ideas about how to specify the location of capath with openssl-1.0.0? Thanks, Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

stunnel sends empty list of trusted CAs
by Sebastian Bork 31 Mar '10

31 Mar '10

Hi, I have a problem which Google did not help me with. A communications partner of one of our customers wants to connect their SAP Business Connector to our platform using HTTPS. Our software does not have SSL/TLS implemented, we rather use stunnel for all communications links, inbound or outbound, where the customer or partner wants to use HTTPS with client authentication. The normal setup is "verify = 3" and the complete certificate chain for each partner is put into the CA path. In most cases, this works without problems. However, in the handshake, after the server certificate is sent and stunnel asks the client to send a client certificate, stunnel sends an empty list of triusted CAs. SAP BC expects the list of supported CAs to contain certificates, instead of being empty. My hope was that using "verify = 2" might help, so I have configured a new server instance of stunnel, and have copied the certificate of the partner's own CA into the CA path. Unfortunately, the partner says it still does not work, and the log file shows they still do not send their certificate when the server asks for a client cert. It seems that stunnel still returns an empty list of trusted CAs, which causes SAP BC to find no certificate to send. Is there any way I can configure stunnel to send back either every certificate found in a path or file, or at least to send back some fixed value for the trusted CAs?

2 1

Problem with openssl-1.0.0
by Carter Browne 30 Mar '10

30 Mar '10

For the Windows version of stunnel-4.31 and 4.32 I tried running stunnel with openssl-1.0.0 compiled for Windows and ssleay32.dll renamed to libssl32.dll. When I make a connection using using stunnel, I get a invalid memory reference to location 0 in libeay32.dll. I have had no problem with this approach with many versions of openssl up through and including openssl-0.9.8n. Any ideas? Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users