- stunnel-users - stunnel.org

debug level 7
by Damian Wiest 25 Jan '08

25 Jan '08

Hi, I'm new to stunnel and have run into some unexpected behavior. I'm inclined to think it's a bug, but perhaps I'm misunderstanding some things. I'm running FreeBSD 6.2 with stunnel 4.21 (installed via ports collection). I'm able to configure things properly when using stunnel in daemon mode, but am unable to run stunnel from inetd when I set the debug level to 7. Here's the config file I'm using, cert = /usr/local/CA/stunnel.pem key = /usr/local/CA/stunnel.pem sslVersion = all pid = /var/log/swat-stunnel.pid debug = 7 output = /tmp/stunnel.log exec = /usr/local/sbin/swat execargs = swat ...and the inetd.conf entry, swat stream tcp nowait.400 root /usr/local/sbin/stunnel stunnel /usr/local/etc/stunnel/swat.conf If I connect to port 901, some debug messages are written to the socket, dwiest(a)dfwdamian.vail: telnet localhost 901 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 2008.01.22 22:19:09 LOG7[81278:134651904]: Snagged 64 random bytes from /home/dwiest/.rnd 2008.01.22 22:19:09 LOG7[81278:134651904]: Wrote 1024 new random bytes to /home/dwiest/.rnd 2008.01.22 22:19:09 LOG7[81278:134651904]: RAND_status claims sufficient entropy for the PRNG 2008.01.22 22:19:09 LOG7[81278:134651904]: PRNG seeded successfully 2008.01.22 22:19:09 LOG7[81278:134651904]: Certificate: /usr/local/CA/stunnel.pem 2008.01.22 22:19:09 LOG7[81278:134651904]: Certificate loaded 2008.01.22 22:19:09 LOG7[81278:134651904]: Key file: /usr/local/CA/stunnel.pem 2008.01.22 22:19:09 LOG7[81278:134651904]: Private key loaded 2008.01.22 22:19:09 LOG7[81278:134651904]: SSL context initialized for service stunnel ^] telnet> q Connection closed. ...and some are written to the file I specified, dwiest(a)dfwdamian.vail: cat /tmp/stunnel.log 2008.01.22 22:19:09 LOG5[81278:134651904]: stunnel 4.21 on i386-unknown-freebsd6.2 with OpenSSL 0.9.7e-p1 25 Oct 2004 2008.01.22 22:19:09 LOG5[81278:134651904]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.01.22 22:19:09 LOG7[81278:134651904]: stunnel started 2008.01.22 22:19:09 LOG7[81278:134651904]: FD 0 in non-blocking mode 2008.01.22 22:19:09 LOG7[81278:134651904]: FD 1 in non-blocking mode 2008.01.22 22:19:09 LOG7[81278:134651904]: stunnel permitted by libwrap from 127.0.0.1:53961 2008.01.22 22:19:09 LOG5[81278:134651904]: stunnel accepted connection from 127.0.0.1:53961 2008.01.22 22:19:09 LOG7[81278:134651904]: SSL state (accept): before/accept initialization 2008.01.22 22:19:11 LOG3[81278:134651904]: SSL_accept: Peer suddenly disconnected 2008.01.22 22:19:11 LOG5[81278:134651904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.01.22 22:19:11 LOG7[81278:134651904]: stunnel finished (0 left) If I run stunnel in daemon mode with the debug level set to 7, then the messages are printed to stderr. Shouldn't they go to either syslog, or to the file specified with the "output" option? I dug through the source code and discovered that file_putline() is being called from parse_config() before open_log() has been called. This results in file_putline() writing to stderr instead of the specified output file. If this is known behavior, then it would be nice if the man page mentioned something. -Damian

3 3

rtmps with stunnel
by David Schulberg 24 Jan '08

24 Jan '08

Hi, A while ago I reported an issue with using rtmps on linux to connect to a Red5 server through stunnel. I am having no issues on Windows. The rtmps connection is made from Flash code running in the browser. The error reported on Linux was 'SSL_accept: Peer suddenly disconnected' which occurs straight after 'SSL state (accept): before/accept initialization' . Now I am having a similar problem trying to connect from a MAC. In this case I also get 'SSL_accept: Peer suddenly disconnected' which occurs straight after 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): before/accept initialization 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 read client hello A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write server hello A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write certificate A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write server done A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 flush data It seems to get further on the MAC but still fails. Regards, David

1 0

stunnel with Fedora core
by Andy 17 Jan '08

17 Jan '08

Hello everyone I am trying to configure stunnel on a Fedora Core machine, but have had little luck. The below configuration is in the /etc/stunne/stunnel.conf. I want this machine to send encrypted data to another machine via stunnel. My knowledge of stunnel is quite limited. chroot = /home/stunnel pid = /stunnel.pid setuid = stunnel setgid = stunne; debug = 7 output = /var/log/messages client = yes [ldap] accept = 389 connect = ldap.example.com:636 I have been told that this command will work. stunnel -c -d ldaps -r <LDAPSERVER>:ldaps This command does work under debian but does not work under fedora core. Can anyone help me with this? -- REGARDS, Andy

1 0

Debian Bug#460019: cert= produces output on stderr even with log= set
by Luis Rodrigo Gallardo Cruz 16 Jan '08

16 Jan '08

----- Forwarded message from Bryan Donlan <bd(a)fushizen.net> ----- Version: 3:4.21-1 With the following configuration: output = /srv/stun/log compression = zlib CApath = /srv/stun/keys cert = /srv/stun/server.pem connect = localhost:9999 verify = 3 The following is output on stderr: 2008.01.10 02:54:19 LOG5[11786:3083495088]: Peer certificate location /srv/stun/keys This confuses clients when stunnel is driven direcly from xinetd. This output, if it is produced at all, should be placed in the log file. ----- End forwarded message ----- The issue is that verify_init (verify.c:103) calls s_log(LOG_NOTICE, "Peer certificate location %s", section->ca_dir); apparently before the logfile is setup. Could the log file initialization be moved earlier in the starup sequence? Or maybe this log call's severity could be lowered.

2 6

Nessus crashes stunnel
by Joe Kemp 16 Jan '08

16 Jan '08

I am running some tests against my stunnel configuration with Nessus. I am able to get stunnel to exit silently when I run Nessus with the Nessus TCP Scan and Weak Supported SSL Cipher Suites test. I have played with a few different options but the process consistently ends when these tests are run together. Here is the config: Linux testssl.capwin.net 2.6.18-53.1.4.el5 #1 SMP Fri Nov 30 00:45:16 EST 2007 i686 i686 i386 GNU/Linux gcc version 4.1.2 20070626 (Red Hat 4.1.2-14) stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP OpenSSL 0.9.8b 04 May 2006 Tail of log file during nessus tests 2008.01.15 21:24:30 LOG5[10646:3086605200]: XMPP accepted connection from 10.102.11.250:41781 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL state (accept): before/accept initialization 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL alert (write): fatal: handshake failure 2008.01.15 21:24:30 LOG3[10646:3086605200]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number 2008.01.15 21:24:30 LOG5[10646:3086605200]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.01.15 21:24:30 LOG7[10646:3086605200]: XMPP finished (0 left) 2008.01.15 21:24:30 LOG7[10646:3086608080]: XMPP accepted FD=7 from 10.102.11.250:41782 2008.01.15 21:24:30 LOG7[10646:3086605200]: XMPP started 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 7 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086605200]: TCP_NODELAY option set on local socket 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 8 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 9 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086608080]: Cleaning up the signal pipe 2008.01.15 21:24:30 LOG6[10646:3086608080]: Child process 10676 finished with code 0 2008.01.15 21:24:30 LOG7[10646:3086605200]: Connection from 10.102.11.250:41782 permitted by libwrap 2008.01.15 21:24:30 LOG5[10646:3086605200]: XMPP accepted connection from 10.102.11.250:41782 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL state (accept): before/accept initialization Joe A. Kemp CapWIN Senior Systems Architect 6305 Ivy Lane Suite 300 Greenbelt, MD 20770 (P) 301-614-3727 (F) 301-614-0581

2 1

Re: [stunnel-users] stunnel automatically listening to extra ports: BAD
by Luis Rodrigo Gallardo Cruz 12 Jan '08

12 Jan '08

[You forgot to cc: the list] On Fri, Jan 11, 2008 at 03:24:32PM -0500, Alan Pinstein wrote: > On Jan 11, 2008, at 3:02 PM, Luis Rodrigo Gallardo Cruz wrote: >> On Fri, Jan 11, 2008 at 02:31:58PM -0500, Alan Pinstein wrote: >>> Hi All- >>> [ Stunnel listens on ports it shouldn't ] >>> >>> If I start up stunnel from the command line as "root" or another user >>> even, it only listens on the port listed in the conf file. >> >> Could you have some startup script that's automatically getting run >> with your logrotate scripts? >> > The problem happens the MOMENT stunnel starts. It has nothing to do with > the logrotate scripts. Oh, sorry, I got confused. (/me goes and re-reads the original mail ...) > I've done a bunch of debugging and can't figure out what's going on. > I have only one guess: stunnel automatically listens on any ports > that the process calling stunnel is listening on, in some sort of > attempt to seamlessly add SSL to existing daemons. I can't find any > docs or tell from the source code, but it's the only idea I can't > rule out... All this is in a *nix, right? The following is an educated guess: Open connections are open file descriptors, and fork()/exec() do not close open file descriptors. Thus, stunnel is inheriting the open connection. And, since it knows nothing about it, it does not close it or anything like that. So it's not that it activelly listens on it, but only that it does not bother to stop. You might check this theory by trying to connect to the port *after* apache is shut down. If I'm right you should get no answer at all. So, the solution is to have the file descriptors close when exec'ing stunnel. PHP or apache might have some option somewhere to do that (look for "close on exec" or something similarly named), but if not, you might have to write some sort of wrapper to do it. It's a messy thing, because AFAIK there's no clean way to do it short of for (i = 0; i < [some-hopefuly-large-enough-value]; i++) close(i); where the [large-enough-value] is determined by your system's file descriptor limit and your desire not to loop all the way to 2^32 or something. -- Rodrigo i-think-this-time-i-answered-the-question-asked Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

5 4

Re: [stunnel-users] config socket SSL TCP
by khaled khaled 12 Jan '08

12 Jan '08

Hi,Can you send me please ( certificate+Key: Client & server) + CA.i want to try my server.The Client is a socket TCP developped on Openssl and C++.(I 'am sure that theclient work) but my config ???i want to generate a key for the client?the SSL client authenticate itself.Many thanks,FOR the server:-----BEGIN RSA PRIVATE KEY-----MIICXAIBAAKBgQDEIXwTWeacXiNOICmkgTgc+MD/i1w1sJ3LBR/lfnH+9pfs/6HBKY4SW+GHQtlSiHVx0WNQgoPQIU1J29PPWONYivIe2hdSvn1uSSmypa7gudWxUqBYuFKzzlmEMtFmUn8UG5KmV8SYQ/970C1bcEchWMyp40C+f9vkP3U/SmFBAwIDAQABAoGAQaWzkgaVWeFoj83UImveDFR2xRIwWwgyyLF+a6JXJbAESh+GVNFD7IE0i8GkXCuwo9giFeCZniCHbiFWVCC8d1/PZd/inQGfmtdTNbvr9xI7AVTTAH4D+mZTwduAuOAUdoI/r5+Ll/hyfZDdFMZuypbFHCUBspkNIfHymJ8qNwECQQD3Q16K1iuwRjZF7Pwl8YT3t8otnMawilFsV5f3RpGlxCT8yGH23liidPr9cwUCORRT4Lar98a9B77E7lTZEzQJAkEAyw+YW9pNqH13+nvcOkIVwefl1umNuU5ayye7gYi5xuccaoc2AnjtPPX8lSvM9ZNcT/0YQZSAsRfMm7YIq+dHqwJBAIZBDhRUNWSAuvc8tavkd04JfL1HYpp4f71T0i9xIaPf3DVkl8xy7a1H1v/Gc/HBDEh+urCk2EPK8Mn8nhU/WAECQAVikn3NGkYfnbDs2/hHjGAqEDRU2UdSxqGgmh5jS9n0gxJoJ4yFPHVjaKFkGflhQQ91/NCwaYFIykpO14gHiCUCQHkB8W/4zaB47skmB181p9WNiprWZRgqo4BINW6ecVQfc87s7+Jaz3GgRyCJ4QeUtbimOVd3wBO3FqzCyOnOLpY=-----END RSA PRIVATE KEY----------BEGIN CERTIFICATE-----MIICdzCCAeCgAwIBAgIBBzANBgkqhkiG9w0BAQQFADCBhDELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBBUklTMQ4wDAYDVQQHEwVQQVJJUzEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZraGFsZWQxITAfBgkqhkiG9w0BCQEWEmtraGFsZWRAaG90bWFpbC5mcjAeFw0wODAxMDgxOTQ5NDJaFw0xODAxMDUxOTQ5NDJaMDAxDzANBgNVBAMTBmNsaWVudDEdMBsGCSqGSIb3DQEJARYObmR0QHdhdmVjb20uZnIwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMQhfBNZ5pxeI04gKaSBOBz4wP+LXDWwncsFH+V+cf72l+z/ocEpjhJb4YdC2VKIdXHRY1CCg9AhTUnb089Y41iK8h7aF1K+fW5JKbKlruC51bFSoFi4UrPOWYQy0WZSfxQbkqZXxJhD/3vQLVtwRyFYzKnjQL5/2+Q/dT9KYUEDAgMBAAGjTDBKMBkGA1UdEQQSMBCBDm5kdEB3YXZlY29tLmZyMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU2LdfcyCatRPpCalV3Qyq7RJwUjowDQYJKoZIhvcNAQEEBQADgYEAMcC80wuYfwycQF/6mbG2D4iQJkUJGXyWd2ColwPvxos5S07oUyPpy1ev+OVmHCSMZMuBpGsJ+0oNyqe39wWvvjB80pddXaKcRN4lNj7BSo2u/edy8WRoFjj75JV3Z35K5KmMAGs2MS7Np/sHa4CVlu5yd8gI0CIA5gxXwqPNJV8=-----END CERTIFICATE-----For CA ROOT:-----BEGIN RSA PRIVATE KEY-----MIICXwIBAAKBgQDCK1KTB2TkLVbNYnU9t29ZmlClEnszHa/xX8slB/VnFdazw/U2iSS01OtwXaUNTrA/hQJ50ykls14dRBguwJnNuGM8IH8zCCWNdesTMtYF0ZucCkrfSmir9210A2m6Wo1SEbKyUHErFMsW9UcxDPAGyfZQ0dIhjUDDkw9SL+fTPQIDAQABAoGBAJm3SGDjqqjFiAGC38QjM0DhXNTCA8ycxQw2xREk8s9QR6/7A2bQPcH3Cgjj6eXWFMvElggx9lJFZM2QegCRM3B7DlB4VYviCz+T5urezuRiHZkxfHp6m2T9fitcfB+FUCq3uGn3yeA+rLc/P5/dXV3JE1uNmH96p96e6kwRnorBAkEA6eDPz7dIh+2znbCcoyrX4G5tp7DqNooBH5p5gLp9an7DePgfHH15POZfCQ4oNv16VIfPhM8fF9u8tmbs5jjFsQJBANSI/OdNitlQYXCoUuDqgPbsxhnS6ajVUa7ZlMoGgkLCmuSj99gphD0q6tp/9niEhAdp36wSyerEZKvu5TEobU0CQQDZGEeOhpGbK3iJLcGYbFKLD7ZV7JDcI2o7jcavSWzVh+mmxpsKdSYu86DP5QZLVStSf+aPXzt7iAs6PXw1kAlhAkEAwywVSverdUraYFFC4qaWzaq7dMV5q4BRpYbLmwaFIneBNEva8teVR3Kc/xAZr6zJbeFs9KDAaeX2KOmV8SGV1QJBAKGPzYwD5XpW3v9NpmyNYzFf4HuzK6Gh90aZ5CLxSSdDHc9cmCZEgoXgepb6/48+qRpRELkSpeE2IWHBxmGMPa8=-----END RSA PRIVATE KEY----------BEGIN CERTIFICATE-----MIIDZTCCAs6gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBhDELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBBUklTMQ4wDAYDVQQHEwVQQVJJUzEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZraGFsZWQxITAfBgkqhkiG9w0BCQEWEmtraGFsZWRAaG90bWFpbC5mcjAeFw0wODAxMDgxOTIyMTlaFw0xODAxMDUxOTIyMTlaMIGEMQswCQYDVQQGEwJGUjEOMAwGA1UECBMFUEFSSVMxDjAMBgNVBAcTBVBBUklTMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxDzANBgNVBAMTBmtoYWxlZDEhMB8GCSqGSIb3DQEJARYSa2toYWxlZEBob3RtYWlsLmZyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCK1KTB2TkLVbNYnU9t29ZmlClEnszHa/xX8slB/VnFdazw/U2iSS01OtwXaUNTrA/hQJ50ykls14dRBguwJnNuGM8IH8zCCWNdesTMtYF0ZucCkrfSmir9210A2m6Wo1SEbKyUHErFMsW9UcxDPAGyfZQ0dIhjUDDkw9SL+fTPQIDAQABo4HkMIHhMB0GA1UdDgQWBBTYt19zIJq1E+kJqVXdDKrtEnBSOjCBsQYDVR0jBIGpMIGmgBTYt19zIJq1E+kJqVXdDKrtEnBSOqGBiqSBhzCBhDELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBBUklTMQ4wDAYDVQQHEwVQQVJJUzEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZraGFsZWQxITAfBgkqhkiG9w0BCQEWEmtraGFsZWRAaG90bWFpbC5mcoIBADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBAUAA4GBAENN2yi1jGD87BjzQ7PfmmRiwP7psisy8GKv4ipRhho76Su353BOZJXNj1x+gyk1/gsDVeSRf0YDJTiH6bMLY2usC9UA3F7x6zvb36joVxbnKLNhxrXStYIaJgVYW+Pf8Wr3sXO/yAkiyDsCsDseofnSGrirPsMC0N9n5X5qf+ER-----END CERTIFICATE-----FOR the Client-----BEGIN CERTIFICATE-----MIICdzCCAeCgAwIBAgIBBjANBgkqhkiG9w0BAQQFADCBhDELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBBUklTMQ4wDAYDVQQHEwVQQVJJUzEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZraGFsZWQxITAfBgkqhkiG9w0BCQEWEmtraGFsZWRAaG90bWFpbC5mcjAeFw0wODAxMDgxOTQ2MzhaFw0xODAxMDUxOTQ2MzhaMDAxDzANBgNVBAMTBnNlcnZlcjEdMBsGCSqGSIb3DQEJARYOa2toQHdhdmVjb20uZnIwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM9Sl2bn98NylY7KITLL//vJsr0OeuS79qTBdy2ticIWjz4k9/iVDQ7YmvxlxR5KtY1kSZYaSU44lXATH15ukczGWo2qy9uNfA5PhsEIUsE3SaQA+EptaicHQhsZ3QkLypz4gqNqK8Im/Nk4qvTR9Z7pturgROFOsckwOdSYbkC3AgMBAAGjTDBKMBkGA1UdEQQSMBCBDmtraEB3YXZlY29tLmZyMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU2LdfcyCatRPpCalV3Qyq7RJwUjowDQYJKoZIhvcNAQEEBQADgYEAAfP0JXQlbi0GUIE04dYsCqug2D/l8+PtRuZ0iRUSznwhc5H7nkTeAV/i91BIBC3NtKdlhj6COcCApEVD9Jbax2dPJBm9ZCccVC41qKaD5Wi82y0aK7yIF+EvPGAieSWphhRbNH4ElF/rWADaIGMJz2PqtE0WgptDOfH5z/mn2MM=-----END CERTIFICATE----------BEGIN RSA PRIVATE KEY-----MIICXwIBAAKBgQDPUpdm5/fDcpWOyiEyy//7ybK9Dnrku/akwXctrYnCFo8+JPf4lQ0O2Jr8ZcUeSrWNZEmWGklOOJVwEx9ebpHMxlqNqsvbjXwOT4bBCFLBN0mkAPhKbWonB0IbGd0JC8qc+IKjaivCJvzZOKr00fWe6bbq4EThTrHJMDnUmG5AtwIDAQABAoGBAL00oNvXY3RJhFgV/ApBxtJhFvAW4O0S5Vsi/MMBFzG8KOoMDwob7RjZcUhbEHQ+tkXdepK0VqY+WZM4wG4L9p4IzpvU1CgLcPXf9zw7JLFZITMux1WhDCT/HEnr/sh138va7b7HXOl7TSgBrmo8xyPNktzqsye2TXiRU6rSHjjhAkEA7W+VnzA5V1T/H5N2p3V4Hy6P9Kv83nTqlq4JP9S939/1JYF2ZrdFPluNOO1Gn3PDFhuKZekFvvBdjXq8EH3H/wJBAN+IRdqFvah0smfASV3bEPbP1tl7JwsaOb8UqQciZHkwzQztHrZ7Gf3s+5HvMcQj4TMR9Dl4ad00kmB6pVnnx0kCQQCCBuOXY99jFicI8ca++jOoT+WCBlXatYhqsDBchnLdEVa9DWL76U3AUn7KOBa+57RkfPyTxsLgx91Tx20KUvedAkEAxd2+17xjMeZ6tdREHUx5K8C2kjStTuqcC0Siiqoq/gvwtmx/L1CwpVFNLtTo3JJWGfrekLDCJQkQOU7XZ0n/4QJBAOMpeKnf+ZXAuyhY9DVeCWK9G3MP/2VZuC7Z5N56P5VVk22mxe9LdyMdA2FG69fIuoaT9Uni/yD+tzRb6PJTDzM=-----END RSA PRIVATE KEY----- _________________________________________________________________ Comme 9 millions de français, créez un compte Hotmail ! http://www.windowslive.fr/hotmail/default.asp

1 0

stunnel automatically listening to extra ports: BAD
by Alan Pinstein 11 Jan '08

11 Jan '08

Hi All- I am using stunnel to secure a connection between a local python script using telnetlib and a custom sockets-based server requiring SSL, from local port 4449 to remote port 4449. This is done via: stunnel /opt/www/domains/admin.showcasere.com/showcase/classes/ opensrs-php/stunnel-app.conf where the conf file is: > client = yes > pid = /opt/www/domains/admin.showcasere.com/runtime/stunnel.pid > debug = 7 > [telnet] > accept = 4449 > connect = admin.hostedemail.com:4449 Functionally, everything works for my application, but I am experiencing a bad side-effect. stunnel is ALSO setting up listeners on HTTP and HTTPS ports, and when my daily logrotate scripts run and HUP apache, stunnel steals the web server's ports and the server won't come back up! I had 7 hours of downtime today because of this. I've done a bunch of debugging and can't figure out what's going on. I have only one guess: stunnel automatically listens on any ports that the process calling stunnel is listening on, in some sort of attempt to seamlessly add SSL to existing daemons. I can't find any docs or tell from the source code, but it's the only idea I can't rule out... Here is the debug log of the startup of stunnel (which is run from an apache/php script): Jan 11 13:10:13 bigwoody stunnel: LOG5[13964:3086333632]: stunnel 4.14 on i386-redhat-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: RAND_status claims sufficient entropy for the PRNG Jan 11 13:10:13 bigwoody stunnel: LOG6[13964:3086333632]: PRNG seeded successfully Jan 11 13:10:13 bigwoody stunnel: LOG6[13964:3086333632]: file ulimit = 1024 (can be changed with 'ulimit -n') Jan 11 13:10:13 bigwoody stunnel: LOG6[13964:3086333632]: poll() used - no FD_SETSIZE limit for file descriptors Jan 11 13:10:13 bigwoody stunnel: LOG5[13964:3086333632]: 500 clients allowed Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: FD 31 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: FD 32 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: FD 33 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: SO_REUSEADDR option set on accept socket Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: telnet bound to 0.0.0.0:4449 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086333632]: Created pid file /opt/www/domains/admin.showcasere.com/runtime/stunnel.pid Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086333632]: telnet accepted FD=34 from 127.0.0.1:48335 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: telnet started Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: FD 34 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: FD 35 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: FD 36 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086333632]: Cleaning up the signal pipe Jan 11 13:10:13 bigwoody stunnel: LOG6[13965:3086333632]: Child process 13967 finished with code 0 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: Connection from 127.0.0.1:48335 permitted by libwrap Jan 11 13:10:13 bigwoody stunnel: LOG5[13965:3086330784]: telnet connected from 127.0.0.1:48335 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: FD 35 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: telnet connecting 216.40.42.6:4449 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: connect_wait: waiting 10 seconds Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: connect_wait: connected Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: Remote FD=35 initialized Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): before/connect initialization Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 write client hello A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 read server hello A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 read server certificate A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 read server done A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 write client key exchange A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 write change cipher spec A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 write finished A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 flush data Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 read finished A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 1 items in the session cache Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 1 client connects (SSL_connect()) Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 1 client connects that finished Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 client renegotiatations requested Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 server connects (SSL_accept()) Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 server connects that finished Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 server renegotiatiations requested Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 session cache hits Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 session cache misses Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 session cache timeouts Jan 11 13:10:13 bigwoody stunnel: LOG6[13965:3086330784]: SSL connected: new session negotiated Jan 11 13:10:13 bigwoody stunnel: LOG6[13965:3086330784]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4 (128) Mac=MD5 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL socket closed on SSL_read Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: Socket write shutdown Jan 11 13:10:13 bigwoody stunnel: LOG5[13965:3086330784]: Connection closed: 91 bytes sent to SSL, 73 bytes sent to socket Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: telnet finished (0 left) And then, you can see what stunnel is listening on: [root@bigwoody custom_img]# lsof -i | grep stunnel stunnel 13965 apache 4u IPv4 156503478 TCP static-216.114.79.43.primarynetwork.com:http (LISTEN) stunnel 13965 apache 5u IPv4 156503480 TCP static-216.114.79.43.primarynetwork.com:https (LISTEN) stunnel 13965 apache 30u IPv4 156771437 TCP localhost.localdomain:51333->localhost.localdomain:9676 (ESTABLISHED) stunnel 13965 apache 33u IPv4 156846546 TCP *:privatewire (LISTEN) If I start up stunnel from the command line as "root" or another user even, it only listens on the port listed in the conf file. Does anyone have any idea what's going on here? How can I turn off this behavior? Thanks! Alan

2 1

Re: [stunnel-users] your mail
by Brian Hatch 10 Jan '08

10 Jan '08

On or about 2008-01-10 15:34 +0100, khaled45(a)free.fr directed: > Here attached files generated. > can you send me the configuration element of SSL and Stunnel or explain me how > to generate? You sent the private keys too - you shouldn't do this. You should create new keys when done debugging this problem. I saw only 2 keys - the CA and the stunnel.pem. Your configuration specifies 3 keys, the CA, stunnel.pem, and is attempting to verify the SSL client (browser? something else) against the CA via the 'verify=' line. What is the SSL client? Did you generate a key for it? Because your config is requiring the SSL client authenticate itself, and Stunnel is dropping the connection because that phase isn't working correctly. -- Brian Hatch "So, what's the problem?" Systems and "I don't know. Security Engineer *That's* the problem." http://www.ifokr.org/bri/ Every message PGP signed

1 0

Re: [stunnel-users] your mail
by Brian Hatch 09 Jan '08

09 Jan '08

At more or less 2008-01-09 18:09 +0100, khaled45(a)free.fr squalked: > ; It's often easier to use CAfile > CAfile = ca.pem > cert = userkey.pem > debug = 7 > client = no > [apache] > accept = 4433 > connect = 192.168.1.4:433 I'd suggest using the full path for your pem files above, just to be safe. Can you shoot the public keys of the client (which is not on this machine) and the ca.pem and the public key from userkey.pem (which is actually the server's key - you may wish to rename.) There are three pems involved: * the CA key (private) and cert (public) in ca.pem * the stunnel server's key (private) and cert (public) in userkey.pem. ('userkey' is a bad name here.) * the client's key (private) and cert (public) on 192.168.1.5. Can you send the public parts here so I can verify that they're signed by the appropritate folks? -- Brian Hatch "Everybody's cute! Systems and Everybody's cute! Security Engineer Even me. But in http://www.ifokr.org/bri/ purple I'm stunning!" Every message PGP signed

1 0