- stunnel-users - stunnel.org

Stunnel + Hybrid-ircd issues
by Strykar 09 Feb '08

09 Feb '08

Hi, I'm running Hybrid-7.2 on two PCs, one of which has a dynamic IP, as Hybrid wants a static IP and not hostname in its connect section, we are trying to use stunnel to encrypt server<->server communication. Server 1 specs (To which I'm connecting) running FreeBSD 6.3: *********************************************** #stunnel -version stunnel 4.05 on amd64-unknown-freebsd5.3 PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /var/tmp/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes #gcc -v Using built-in specs. Configured with: FreeBSD/amd64 system compiler Thread model: posix gcc version 3.4.6 [FreeBSD] 20060305 #uname FreeBSD 6.3-STABLE FreeBSD 6.3-STABLE #6: Tue Jan 22 13:23:51 GMT 2008 root@:/usr/obj/usr/src/sys/SVR1 amd64 Server 2 specs (From which I'm connecting via stunnel as a client) running OpenBSD 4.2: ****************************************************************** #stunnel -version stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/arandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/lib/gcc-lib/i386-unknown-openbsd4.2/3.3.5/specs Configured with: Thread model: single gcc version 3.3.5 (propolice) # cat stunnel.conf: cert = /etc/ssl/private/stunnel.pem key = /etc/ssl/private/rsa.key setuid = _stunnel setgid = _stunnel pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 foreground = yes [irc] client = yes accept = localhost:994 connect = xxx.xxx.xxx.xxx:994 Here's the debug logged to stderr: # stunnel 2008.02.08 19:34:54 LOG7[11904:2237644800]: Snagged 64 random bytes from /dev/arandom 2008.02.08 19:34:54 LOG7[11904:2237644800]: RAND_status claims sufficient entropy for the PRNG 2008.02.08 19:34:54 LOG7[11904:2237644800]: PRNG seeded successfully 2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate: /etc/ssl/private/stunnel.pem 2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate loaded 2008.02.08 19:34:54 LOG7[11904:2237644800]: Key file: /etc/ssl/private/rsa.key 2008.02.08 19:34:54 LOG7[11904:2237644800]: Private key loaded 2008.02.08 19:34:54 LOG7[11904:2237644800]: SSL context initialized for service irc 2008.02.08 19:34:54 LOG5[11904:2237644800]: stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006 2008.02.08 19:34:54 LOG5[11904:2237644800]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.02.08 19:34:54 LOG6[11904:2237644800]: file ulimit = 128 (can be changed with 'ulimit -n') 2008.02.08 19:34:54 LOG6[11904:2237644800]: poll() used - no FD_SETSIZE limit for file descriptors 2008.02.08 19:34:54 LOG5[11904:2237644800]: 61 clients allowed 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 6 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 7 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 8 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: SO_REUSEADDR option set on accept socket 2008.02.08 19:34:54 LOG7[11904:2237644800]: irc bound to 127.0.0.1:994 2008.02.08 19:34:54 LOG7[11904:2237644800]: Created pid file /var/run/stunnel.pid 2008.02.08 19:35:15 LOG7[11904:2237644800]: irc accepted FD=9 from 127.0.0.1:8579 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc started 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 9 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on local socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 11 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: Connection from 127.0.0.1:8579 permitted by libwrap 2008.02.08 19:35:15 LOG5[11904:2336256000]: irc accepted connection from 127.0.0.1:8579 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc connecting 69.50.175.50:994 2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: waiting 10 seconds 2008.02.08 19:35:15 LOG7[11904:2237644800]: Cleaning up the signal pipe 2008.02.08 19:35:15 LOG6[11904:2237644800]: Child process 26562 finished with code 0 2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: connected 2008.02.08 19:35:15 LOG5[11904:2336256000]: irc connected remote server from 192.168.1.101:42954 2008.02.08 19:35:15 LOG7[11904:2336256000]: Remote FD=10 initialized 2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on remote socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): before/connect initialization 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write client hello A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server hello A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server certificate A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server done A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write client key exchange A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write change cipher spec A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write finished A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 flush data 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read finished A 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 items in the session cache 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects (SSL_connect()) 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects that finished 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 client renegotiations requested 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects (SSL_accept()) 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects that finished 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server renegotiations requested 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache hits 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache misses 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache timeouts 2008.02.08 19:35:15 LOG6[11904:2336256000]: SSL connected: new session negotiated 2008.02.08 19:35:15 LOG6[11904:2336256000]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2008.02.08 19:35:15 LOG3[11904:2336256000]: SSL_read: Connection reset by peer (54) 2008.02.08 19:35:15 LOG5[11904:2336256000]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc finished (0 left) What is going on here with "SSL_read: Connection reset by peer (54)"? This process keeps repeating itself without the ircd's linking. - S

1 0

Verify Question
by Vlad 08 Feb '08

08 Feb '08

I'm sure that people have asked this question before, but i cannot find a way to search the archives. What is the difference between verify = 2 and verify = 3, The docs indicate that with verify = 3it will check against locally installed certs, but what does that mean, if I use =2 then what does it verify the cert against? Also a second question: I'm pretty sure that the answer is no but is it possible to do the following, have a cert A that is signed by CA cert B which itself is singed by a self-signed cert C. If the clients has C installed as a trusted cert, and it received A, is there anyway for it to validate A. I realize that these are probably pretty novice questions so I really appreciate your patience, thanks!

1 0

xforwardedfor in config
by Jill Rochelle 04 Feb '08

04 Feb '08

I am new to stunnel and the ssl world. I'm trying to get stunnel to work with haproxy for load balancing https requests. In the haproxy documentation it says that the stunnel.conf should look like this cert=/etc/stunnel/stunnel.pem setuid=stunnel setgid=proxy socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=192.168.1.1:443 connect=192.168.1.1:80 xforwardedfor=yes However, when I try to start the stunnel service I get this Starting stunnel: file /etc/stunnel/stunnel.conf line 9: Specified option name is not valid here If I comment out the xforwardedfor parameter, it starts. Any help is greatly appreciated. Thank you, Jill Rochelle

2 2

2 secure sockets TCP (Server / Client) as posted earlier last month by khaled
by Dick van Fulpen 04 Feb '08

04 Feb '08

> Hi, > > I'm having the same question (and problem) as posted by khaled on Mon > Jan 7 19:31:03 CET 2008, subject [stunnel-users] 2 secure sockets TCP > (Server / Client). > > I think I have to send data to stunnel on the client side by a write > to localhost:1974 where stunnel is configured with this stunnel.conf: > ; Sample stunnel configuration file by Michal Trojnara 2002-2006 > ; Some options used here may not be adequate for your particular > configuration > ; Certificate/key is needed in server mode and optional in client mode > ; The default certificate is provided only for testing and should not > ; be used in a production environment > cert = stunnel.pem > ;key = stunnel.pem > > ; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > ; Use it for client mode > ;client = yes > > ; Service-level configuration > [sip2s] > accept = 1975 > connect = 127.0.0.1:1974 > > To start stunnel only works with just stunnel. > Started from batch or in dos-box with the options -d -r etc. as > explained in the documentation does not work, error message: file not > found) > BTW: I'm using Windows XP Professional on both client and server. > Client IP = 10.4.208.159, server IP = 10.4.208.102 for a test set-up. > > On the server side it gives the same error when started with options. > stunnel.conf on the server is this: > ; Sample stunnel configuration file by Michal Trojnara 2002-2006 > ; Some options used here may not be adequate for your particular > configuration > ; Certificate/key is needed in server mode and optional in client mode > ; The default certificate is provided only for testing and should not > be used in a production environment > cert = stunnel.pem > ;key = stunnel.pem > > ; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > ; Some debugging stuff useful for troubleshooting > debug = 7 > output = stunnel.log > > ; Use it for client mode > client = yes > > ; Service-level configuration > [sip2s] > accept = 1975 > connect = 127.0.0.1:1974 > > Reading data on TCP/IP 1974 does not display anything when the client > is sending data to localhost:1974 which is encrypted by stunnel an > forwarded on TCP/IP 1975. > At least that is my intention, but something I do is wrong. > Data sending unencrypted between client an server works fine, so > connection is possible. > > Any idea what I should do to let it work like this: > - a client sends data to a server and reads the response from this > server. > - all data on the network between client an server should be > encrypted. > As far as I could find in the stunnel manual it should be able to use > stunnel for this. > In the manual is an example using foo (client) and bar (server). > > Dick van Fulpen | Senior Software Engineer | Infor | Tel:+31 (0)73 > 6205 222 | Dick.vanFulpen(a)infor.com | Infor | Postbus 2067 | 5202 CB > 's-Hertogenbosch | Nederland | Bezoek onze website www.vubis-smart.com > | >

1 0

Connection Refused locally, SSL Proxy.
by Avner Peled 01 Feb '08

01 Feb '08

Hello! I have a game client connecting to a server using TCP over SSL. I'm trying to setup an SSL proxy using 2 stunnels on the same server like so: Client --> Stunnel-Server:20001 (decrypt)--> Stunnel-Client:901 (encrypt)---> Server:20001 Using latest stunnel-4.21-r1 on Gentoo kernel 2.6.22-gentoo-r9 I have a weird problem. The first connection after starting both stunnels works fine. Afterwards every time the client tries to connect, it gets refused once. Then it tries again and gets connected. Then the next time it will once again get refused once and then connect. I have looked at the logs and it seems the Stunnel server (the first) gets Connection Refused from localhost:901. Then it tries again and gets connected. The Stunnel client (the second) doesn't even mention the first failing local connection in the log. I have provided the config files of both stunnels and a log with debug = 7 (server ip's are censored) I have also tried the following config tweaks with no luck socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 TIMEOUTclose = 0 retry = yes Any help would be appreciated. Thanks!! -- Avner Peled. avnerus(a)gmail.com

1 1

debug level 7
by Damian Wiest 25 Jan '08

25 Jan '08

Hi, I'm new to stunnel and have run into some unexpected behavior. I'm inclined to think it's a bug, but perhaps I'm misunderstanding some things. I'm running FreeBSD 6.2 with stunnel 4.21 (installed via ports collection). I'm able to configure things properly when using stunnel in daemon mode, but am unable to run stunnel from inetd when I set the debug level to 7. Here's the config file I'm using, cert = /usr/local/CA/stunnel.pem key = /usr/local/CA/stunnel.pem sslVersion = all pid = /var/log/swat-stunnel.pid debug = 7 output = /tmp/stunnel.log exec = /usr/local/sbin/swat execargs = swat ...and the inetd.conf entry, swat stream tcp nowait.400 root /usr/local/sbin/stunnel stunnel /usr/local/etc/stunnel/swat.conf If I connect to port 901, some debug messages are written to the socket, dwiest(a)dfwdamian.vail: telnet localhost 901 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 2008.01.22 22:19:09 LOG7[81278:134651904]: Snagged 64 random bytes from /home/dwiest/.rnd 2008.01.22 22:19:09 LOG7[81278:134651904]: Wrote 1024 new random bytes to /home/dwiest/.rnd 2008.01.22 22:19:09 LOG7[81278:134651904]: RAND_status claims sufficient entropy for the PRNG 2008.01.22 22:19:09 LOG7[81278:134651904]: PRNG seeded successfully 2008.01.22 22:19:09 LOG7[81278:134651904]: Certificate: /usr/local/CA/stunnel.pem 2008.01.22 22:19:09 LOG7[81278:134651904]: Certificate loaded 2008.01.22 22:19:09 LOG7[81278:134651904]: Key file: /usr/local/CA/stunnel.pem 2008.01.22 22:19:09 LOG7[81278:134651904]: Private key loaded 2008.01.22 22:19:09 LOG7[81278:134651904]: SSL context initialized for service stunnel ^] telnet> q Connection closed. ...and some are written to the file I specified, dwiest(a)dfwdamian.vail: cat /tmp/stunnel.log 2008.01.22 22:19:09 LOG5[81278:134651904]: stunnel 4.21 on i386-unknown-freebsd6.2 with OpenSSL 0.9.7e-p1 25 Oct 2004 2008.01.22 22:19:09 LOG5[81278:134651904]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.01.22 22:19:09 LOG7[81278:134651904]: stunnel started 2008.01.22 22:19:09 LOG7[81278:134651904]: FD 0 in non-blocking mode 2008.01.22 22:19:09 LOG7[81278:134651904]: FD 1 in non-blocking mode 2008.01.22 22:19:09 LOG7[81278:134651904]: stunnel permitted by libwrap from 127.0.0.1:53961 2008.01.22 22:19:09 LOG5[81278:134651904]: stunnel accepted connection from 127.0.0.1:53961 2008.01.22 22:19:09 LOG7[81278:134651904]: SSL state (accept): before/accept initialization 2008.01.22 22:19:11 LOG3[81278:134651904]: SSL_accept: Peer suddenly disconnected 2008.01.22 22:19:11 LOG5[81278:134651904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.01.22 22:19:11 LOG7[81278:134651904]: stunnel finished (0 left) If I run stunnel in daemon mode with the debug level set to 7, then the messages are printed to stderr. Shouldn't they go to either syslog, or to the file specified with the "output" option? I dug through the source code and discovered that file_putline() is being called from parse_config() before open_log() has been called. This results in file_putline() writing to stderr instead of the specified output file. If this is known behavior, then it would be nice if the man page mentioned something. -Damian

3 3

rtmps with stunnel
by David Schulberg 24 Jan '08

24 Jan '08

Hi, A while ago I reported an issue with using rtmps on linux to connect to a Red5 server through stunnel. I am having no issues on Windows. The rtmps connection is made from Flash code running in the browser. The error reported on Linux was 'SSL_accept: Peer suddenly disconnected' which occurs straight after 'SSL state (accept): before/accept initialization' . Now I am having a similar problem trying to connect from a MAC. In this case I also get 'SSL_accept: Peer suddenly disconnected' which occurs straight after 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): before/accept initialization 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 read client hello A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write server hello A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write certificate A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write server done A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 flush data It seems to get further on the MAC but still fails. Regards, David

1 0

stunnel with Fedora core
by Andy 17 Jan '08

17 Jan '08

Hello everyone I am trying to configure stunnel on a Fedora Core machine, but have had little luck. The below configuration is in the /etc/stunne/stunnel.conf. I want this machine to send encrypted data to another machine via stunnel. My knowledge of stunnel is quite limited. chroot = /home/stunnel pid = /stunnel.pid setuid = stunnel setgid = stunne; debug = 7 output = /var/log/messages client = yes [ldap] accept = 389 connect = ldap.example.com:636 I have been told that this command will work. stunnel -c -d ldaps -r <LDAPSERVER>:ldaps This command does work under debian but does not work under fedora core. Can anyone help me with this? -- REGARDS, Andy

1 0

Debian Bug#460019: cert= produces output on stderr even with log= set
by Luis Rodrigo Gallardo Cruz 16 Jan '08

16 Jan '08

----- Forwarded message from Bryan Donlan <bd(a)fushizen.net> ----- Version: 3:4.21-1 With the following configuration: output = /srv/stun/log compression = zlib CApath = /srv/stun/keys cert = /srv/stun/server.pem connect = localhost:9999 verify = 3 The following is output on stderr: 2008.01.10 02:54:19 LOG5[11786:3083495088]: Peer certificate location /srv/stun/keys This confuses clients when stunnel is driven direcly from xinetd. This output, if it is produced at all, should be placed in the log file. ----- End forwarded message ----- The issue is that verify_init (verify.c:103) calls s_log(LOG_NOTICE, "Peer certificate location %s", section->ca_dir); apparently before the logfile is setup. Could the log file initialization be moved earlier in the starup sequence? Or maybe this log call's severity could be lowered.

2 6

Nessus crashes stunnel
by Joe Kemp 16 Jan '08

16 Jan '08

I am running some tests against my stunnel configuration with Nessus. I am able to get stunnel to exit silently when I run Nessus with the Nessus TCP Scan and Weak Supported SSL Cipher Suites test. I have played with a few different options but the process consistently ends when these tests are run together. Here is the config: Linux testssl.capwin.net 2.6.18-53.1.4.el5 #1 SMP Fri Nov 30 00:45:16 EST 2007 i686 i686 i386 GNU/Linux gcc version 4.1.2 20070626 (Red Hat 4.1.2-14) stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP OpenSSL 0.9.8b 04 May 2006 Tail of log file during nessus tests 2008.01.15 21:24:30 LOG5[10646:3086605200]: XMPP accepted connection from 10.102.11.250:41781 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL state (accept): before/accept initialization 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL alert (write): fatal: handshake failure 2008.01.15 21:24:30 LOG3[10646:3086605200]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number 2008.01.15 21:24:30 LOG5[10646:3086605200]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.01.15 21:24:30 LOG7[10646:3086605200]: XMPP finished (0 left) 2008.01.15 21:24:30 LOG7[10646:3086608080]: XMPP accepted FD=7 from 10.102.11.250:41782 2008.01.15 21:24:30 LOG7[10646:3086605200]: XMPP started 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 7 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086605200]: TCP_NODELAY option set on local socket 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 8 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 9 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086608080]: Cleaning up the signal pipe 2008.01.15 21:24:30 LOG6[10646:3086608080]: Child process 10676 finished with code 0 2008.01.15 21:24:30 LOG7[10646:3086605200]: Connection from 10.102.11.250:41782 permitted by libwrap 2008.01.15 21:24:30 LOG5[10646:3086605200]: XMPP accepted connection from 10.102.11.250:41782 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL state (accept): before/accept initialization Joe A. Kemp CapWIN Senior Systems Architect 6305 Ivy Lane Suite 300 Greenbelt, MD 20770 (P) 301-614-3727 (F) 301-614-0581

2 1