- stunnel-users - stunnel.org

Re: [stunnel-users] stunnel 5.x no answer in server mode?
by Ulli Horlacher 14 Sep '16

14 Sep '16

On Tue 2016-09-13 (22:25), Micha?? Trojnara wrote: > On 13.09.2016 20:35, Ulli Horlacher wrote: > >> It is impossible to say anything without analysis of the executed fexsrv > >> program. > > > > The problem cannot be in fexsrv, because it works with stunnel 4.27 > > What is the point of sending an email to the mailing list when you > ignore our effort to help you? Where do I ignore help? > fexsrv terminates immediately with exit code 1. No. It does not start at all, so it does not terminate. fexsrv logs everything and when running with stunnel 5.x the log file is empty. But meanwhile I found the error: stunnel 5.x needs the a full path for the exec statement: exec = /usr/bin/perl For stunnel 4.x it was sufficent to use: exec = perl -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<45835cd9-b239-d80c-38a0-3f978132e40e(a)stunnel.org>

2 1

Errors in log
by Mark Hannig 13 Sep '16

13 Sep '16

Can you please help me. Stunnel has been working fine for months and I just started getting these errors in the last day or two. Thank you: 2016.09.11 13:43:38 LOG5[10]: Service [ssmtp] accepted connection from 46.101.193.127:33818 2016.09.11 13:43:40 LOG3[10]: SSL_accept: Peer suddenly disconnected 2016.09.11 13:43:40 LOG5[10]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 13:43:40 LOG5[11]: Service [ssmtp] accepted connection from 46.101.193.127:34154 2016.09.11 13:43:40 LOG3[11]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:ssl3_get_client_hello:wrong version number 2016.09.11 13:43:40 LOG5[11]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 13:43:40 LOG5[12]: Service [ssmtp] accepted connection from 46.101.193.127:34254 2016.09.11 13:43:42 LOG3[12]: s_connect: connect 127.0.0.1:25: Connection refused (WSAECONNREFUSED) (10061) 2016.09.11 13:43:42 LOG5[12]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 17:22:39 LOG5[13]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:58020 2016.09.11 17:22:39 LOG5[13]: s_connect: connected 52.35.228.26:465 2016.09.11 17:22:39 LOG5[13]: Service [smtp-tls-wrapper] connected remote server from 172.31.10.223:58021 2016.09.11 17:22:40 LOG5[13]: Connection closed: 7072 byte(s) sent to SSL, 369 byte(s) sent to socket 2016.09.11 17:22:40 LOG5[14]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:58022 2016.09.11 17:22:40 LOG5[14]: s_connect: connected 52.35.58.187:465 2016.09.11 17:22:40 LOG5[14]: Service [smtp-tls-wrapper] connected remote server from 172.31.10.223:58023 2016.09.11 17:22:40 LOG5[14]: Connection closed: 7302 byte(s) sent to SSL, 361 byte(s) sent to socket -- Mark F. Hannig mhannig(a)gmail.com

2 2

Re: [stunnel-users] stunnel 5.x no answer in server mode?
by Ulli Horlacher 13 Sep '16

13 Sep '16

On Tue 2016-09-13 (12:10), Ma??gorzata Olszówka wrote: > > I use stunnel as a https proxy for my own http server (*). > > > > The server mode of stunnel 5.x does not work any more. > > It accepts the connection and then immediatelly closes it without sending > > back any data. > > stunnel 4.x is working fine (for many years!), with the same configuration. > > The client receives no data at all, the connection is closed by the server > > (stunnel). > > > > As I wrote: with stunnel 4.27 everything works as expected. Does stunnel > > 5.x need another configuration? > > The log messages show, that the child process terminated with code 1. > This is the point where you should start looking for the cause. The client fexsrv does not start at all with stunnel 5.x, whereas with stunnel 4.27 everything works fine. > It is impossible to say anything without analysis of the executed fexsrv > program. The problem cannot be in fexsrv, because it works with stunnel 4.27 -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<f0622f17-fd11-bdb8-4a82-9665463c0d64(a)olszowka.net>

1 0

Upgrade from 5.03 to 5.35
by Hon Quach 07 Sep '16

07 Sep '16

Hi, When I perform the upgrade the stunnel service won't start, it tries to load the pem files but it is failing. I noticed when I install stunnel on my test system, the conf file is different from the version 5.03. I'm looking for documentation a on how to perform a clean upgrade but I'm having difficulty finding that information. Thanks! Sent from my iPhone

1 0

stunnel 5.x no answer in server mode?
by Ulli Horlacher 31 Aug '16

31 Aug '16

I use stunnel as a https proxy for my own http server (*). The server mode of stunnel 5.x does not work any more. It accepts the connection and then immediatelly closes it without sending back any data. stunnel 4.x is working fine (for many years!), with the same configuration. Here is my (test) config which shows the problem (host is Ubuntu 16.04): root@xerus:/tmp# cat stunnel.conf pid = /tmp/stunnel.pid output = /home/fex/spool/stunneld.log debug = debug fips = no foreground = yes [https] accept = 443 cert = /home/fex/etc/stunnel.pem sslVersion = all TIMEOUTclose = 1 exec = perl execargs = perl -T /home/fex/bin/fexsrv stunnel root@xerus:/tmp# /opt/stunnel-5.35/bin/stunnel stunnel.conf 2016.08.30 18:58:55 LOG7[ui]: Clients allowed=500 2016.08.30 18:58:55 LOG5[ui]: stunnel 5.35 on x86_64-unknown-linux-gnu platform 2016.08.30 18:58:55 LOG5[ui]: Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 2016.08.30 18:58:55 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.08.30 18:58:55 LOG7[ui]: errno: (*__errno_location ()) 2016.08.30 18:58:55 LOG5[ui]: Reading configuration from file /tmp/stunnel.conf 2016.08.30 18:58:55 LOG5[ui]: UTF-8 byte order mark not detected 2016.08.30 18:58:55 LOG5[ui]: FIPS mode disabled 2016.08.30 18:58:55 LOG7[ui]: Compression disabled 2016.08.30 18:58:55 LOG7[ui]: Snagged 64 random bytes from /root/.rnd 2016.08.30 18:58:55 LOG7[ui]: Wrote 1024 new random bytes to /root/.rnd 2016.08.30 18:58:55 LOG7[ui]: PRNG seeded successfully 2016.08.30 18:58:55 LOG6[ui]: Initializing service [https] 2016.08.30 18:58:55 LOG6[ui]: Loading certificate from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Certificate loaded from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Loading private key from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Private key loaded from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG7[ui]: Private key check succeeded 2016.08.30 18:58:55 LOG7[ui]: DH initialization 2016.08.30 18:58:55 LOG7[ui]: Using DH parameters from /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: 1024-bit DH parameters loaded 2016.08.30 18:58:55 LOG7[ui]: ECDH initialization 2016.08.30 18:58:55 LOG7[ui]: ECDH initialized with curve prime256v1 2016.08.30 18:58:55 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.08.30 18:58:55 LOG5[ui]: Configuration successful 2016.08.30 18:58:55 LOG7[ui]: Listening file descriptor created (FD=7) 2016.08.30 18:58:55 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2016.08.30 18:58:55 LOG7[ui]: Service [https] (FD=7) bound to 0.0.0.0:443 2016.08.30 18:58:55 LOG7[ui]: Created pid file /tmp/stunnel.pid (here comes the https client connect) 2016.08.30 18:59:20 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.30 18:59:20 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2016.08.30 18:59:20 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2016.08.30 18:59:20 LOG7[ui]: Service [https] accepted (FD=3) from 127.0.0.1:44166 2016.08.30 18:59:20 LOG7[0]: Service [https] started 2016.08.30 18:59:20 LOG7[0]: Option TCP_NODELAY set on local socket 2016.08.30 18:59:20 LOG5[0]: Service [https] accepted connection from 127.0.0.1:44166 2016.08.30 18:59:20 LOG6[0]: Peer certificate not required 2016.08.30 18:59:20 LOG7[0]: SSL state (accept): before/accept initialization 2016.08.30 18:59:20 LOG7[0]: SNI: no virtual services defined 2016.08.30 18:59:20 LOG7[0]: New session callback 2016.08.30 18:59:20 LOG7[0]: 1 server accept(s) requested 2016.08.30 18:59:20 LOG7[0]: 1 server accept(s) succeeded 2016.08.30 18:59:20 LOG7[0]: 0 server renegotiation(s) requested 2016.08.30 18:59:20 LOG7[0]: 0 session reuse(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache item(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache fill-up(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache miss(es) 2016.08.30 18:59:20 LOG7[0]: 0 external session cache hit(s) 2016.08.30 18:59:20 LOG7[0]: 0 expired session(s) retrieved 2016.08.30 18:59:20 LOG6[0]: SSL accepted: new session negotiated 2016.08.30 18:59:20 LOG6[0]: No peer certificate received 2016.08.30 18:59:20 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-SHA256 (128-bit encryption) 2016.08.30 18:59:20 LOG7[0]: Compression: null, expansion: null 2016.08.30 18:59:20 LOG6[0]: Local mode child started (PID=30833) 2016.08.30 18:59:20 LOG7[0]: Option TCP_NODELAY set on remote socket 2016.08.30 18:59:20 LOG7[0]: Remote descriptor (FD=11) initialized 2016.08.30 18:59:20 LOG6[0]: Read socket closed (readsocket) 2016.08.30 18:59:20 LOG7[0]: Sending close_notify alert 2016.08.30 18:59:20 LOG7[0]: SSL alert (write): warning: close notify 2016.08.30 18:59:20 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2016.08.30 18:59:20 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.30 18:59:20 LOG7[ui]: FD=4 events=0x2001 revents=0x1 2016.08.30 18:59:20 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2016.08.30 18:59:20 LOG7[ui]: Dispatching signals from the signal pipe 2016.08.30 18:59:20 LOG7[ui]: Processing SIGCHLD 2016.08.30 18:59:20 LOG6[ui]: Child process 30833 finished with code 1 2016.08.30 18:59:20 LOG7[ui]: Signal pipe is empty 2016.08.30 18:59:20 LOG3[0]: socket fd: Broken pipe (32) 2016.08.30 18:59:20 LOG6[0]: writesocket: Socket is closed 2016.08.30 18:59:20 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 23 byte(s) sent to socket 2016.08.30 18:59:20 LOG7[0]: Remote descriptor (FD=11) closed 2016.08.30 18:59:20 LOG7[0]: Local descriptor (FD=3) closed 2016.08.30 18:59:20 LOG7[0]: Service [https] finished (0 left) The client receives no data at all, the connection is closed by the server (stunnel). As I wrote: with stunnel 4.27 everything works as expected. Does stunnel 5.x need another configuration? (*) http://fex.rus.uni-stuttgart.de/ -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<20160831074057.GA13703(a)rus.uni-stuttgart.de>

1 0

Issue with stunnel over squid
by Mike McPhee 30 Aug '16

30 Aug '16

Hello, I have a windows machine running as a stunnel client that establishes a session but then, when launching an SSH session to my loopback crashes. Putty reports that the "Server unexpectedly closed the network connection." Here are the logs: 2016.08.30 16:06:08 LOG5[main]: Reading configuration from file stunnel.conf 2016.08.30 16:06:08 LOG5[main]: UTF-8 byte order mark detected 2016.08.30 16:06:08 LOG5[main]: FIPS mode disabled 2016.08.30 16:06:08 LOG4[main]: Service [squid] needs authentication to prevent MITM attacks 2016.08.30 16:06:08 LOG5[main]: Configuration successful 2016.08.30 16:06:17 LOG5[2]: Service [squid] accepted connection from 127.0.0.1:55791 2016.08.30 16:06:17 LOG5[2]: s_connect: connected 10.5.8.74:8888 2016.08.30 16:06:17 LOG5[2]: Service [squid] connected remote server from 10.5.8.69:55792 2016.08.30 16:06:17 LOG5[2]: Connection closed: 28 byte(s) sent to SSL, 0 byte(s) sent to socket Here is the server-side stunnel.conf: sslVersion = all options = NO_SSLv2 client = no cert = /etc/stunnel/server.pem pid = /var/run/stunnel.pid output = /var/log/stunnel [squid] accept = 8888 connect = 127.0.0.1:3128 cert = /etc/stunnel/stunnel.pem [openvpn] client = no accept = 993 connect = 34567 Here is the client side (Windows 7): cert = stunnel.pem client = yes [squid] accept = 127.0.0.1:8080 connect = 10.5.8.74:8443 I seem to be negotiating all of the appropriate keys, openvpn and squid3 are verified running, and have iptables configured, so I am not sure what I am missing. Can anyone assist? Thanks in advance! Mike

1 0

-reopen for Ubuntu?
by mguyre＠comcast.net 24 Aug '16

24 Aug '16

Are there any plans to add the -reopen functionality to other operating systems? Thanks Mike

1 0

[Stunnel] [Android x86] Compilation
by John Fisherman 22 Aug '16

22 Aug '16

Dear all, I am currently trying to make stunnel work for an Android x86 architecture. The android binary found on the stunnel official website is not supported on x86 architecture, so I'd like to cross-compile it myself using the 'configure' options. I did not find much informations about this around the web, could you give me some advices or at least tell me if it is possible to make Stunnel work on an Android x86 device ? Thanks in advance, Regards, - John

1 0

Stunnel exits with timeout
by SP 19 Aug '16

19 Aug '16

Summary of problem (configuration and log details below): I am attempting to configure Stunnel to run a pop3s service on our server so that users can retrieve email securely. Stunnel is started as a systemctl service. If I include both the following in the stunnel.conf: accept = mail.myserver.net:995 connect = localhost:110 then systemctl will exit immediately with: Service [pop3s]: Each service must define two endpoints stunnel.service: Control process exited, code=exited status=1 Failed to start SSL tunnel for network daemons. If I comment the connect to 110 then it will start and hang then eventually timeout: stunnel.service: Failed with result 'timeout'. Below is my stunnel.conf and log excerpt from the start with the connect to 110 commented out. I would greatly appreciate any advice. ---stunnel.conf setuid = nobody setgid = nobody pid = /usr/local/var/lib/stunnel/var/run/stunnel.pid foreground = yes ;debug = info debug = 7 sslVersion = TLSv1.2 output = /usr/local/var/lib/stunnel/var/log/stunnel.log ;ciphers = HIGH:MEDIUM:+DH:!SSLv2:!aNULL:+SHA256:+SHA1:+MD5 ciphers = HIGH:+3DES:+DH:!aNULL:!SSLv2 transparent = yes delay = no fips = no compression = deflate client = no [pop3s] accept = mail.myserver.net:995 ;connect = localhost:110 cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem exec = /usr/local/sbin/gnu-pop3d execargs = --debug=000 --mdn --timeout=60 --ipv6 ----log excerpt ----- 2016.08.17 15:08:55 LOG7[ui]: Clients allowed=500 2016.08.17 15:08:55 LOG5[ui]: stunnel 5.35 on x86_64-unknown-linux-gnu platform 2016.08.17 15:08:55 LOG5[ui]: Compiled/running with OpenSSL 1.0.2h 3 May 2016 2016.08.17 15:08:55 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.08.17 15:08:55 LOG7[ui]: errno: (*__errno_location ()) 2016.08.17 15:08:55 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2016.08.17 15:08:55 LOG5[ui]: UTF-8 byte order mark not detected 2016.08.17 15:08:55 LOG7[cron]: Cron thread initialized 2016.08.17 15:08:55 LOG5[ui]: FIPS mode disabled 2016.08.17 15:08:55 LOG6[ui]: Compression enabled: 1 method(s) 2016.08.17 15:08:55 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2016.08.17 15:08:55 LOG7[ui]: PRNG seeded successfully 2016.08.17 15:08:55 LOG6[ui]: Initializing service [pop3s] 2016.08.17 15:08:55 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG7[ui]: Private key check succeeded 2016.08.17 15:08:55 LOG7[ui]: DH initialization 2016.08.17 15:08:55 LOG7[ui]: Could not load DH parameters from /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Using dynamic DH parameters 2016.08.17 15:08:55 LOG7[ui]: ECDH initialization 2016.08.17 15:08:55 LOG7[ui]: ECDH initialized with curve prime256v1 2016.08.17 15:08:55 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.08.17 15:08:55 LOG5[ui]: Configuration successful 2016.08.17 15:08:55 LOG7[ui]: Listening file descriptor created (FD=7) 2016.08.17 15:08:55 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2016.08.17 15:08:55 LOG7[ui]: Service [pop3s] (FD=7) bound to 60.62.114.105:995 2016.08.17 15:08:55 LOG6[cron]: Executing cron jobs 2016.08.17 15:08:55 LOG7[ui]: Created pid file /usr/local/var/lib/stunnel/var/run/stunnel.pid 2016.08.17 15:08:55 LOG5[cron]: Updating DH parameters 2016.08.17 15:10:01 LOG5[cron]: DH parameters updated 2016.08.17 15:10:01 LOG6[cron]: Cron jobs completed in 66 seconds 2016.08.17 15:10:01 LOG7[cron]: Waiting 86334 seconds 2016.08.17 15:10:25 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.17 15:10:25 LOG7[ui]: FD=4 events=0x2001 revents=0x1 2016.08.17 15:10:25 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2016.08.17 15:10:25 LOG7[ui]: Dispatching signals from the signal pipe 2016.08.17 15:10:25 LOG7[ui]: Processing SIGNAL_TERMINATE 2016.08.17 15:10:25 LOG5[ui]: Terminated 2016.08.17 15:10:25 LOG7[ui]: Closing service [pop3s] 2016.08.17 15:10:25 LOG7[ui]: Service [pop3s] closed (FD=7) 2016.08.17 15:10:25 LOG7[ui]: Service [pop3s] closed 2016.08.17 15:10:25 LOG7[ui]: removing pid file /usr/local/var/lib/stunnel/var/run/stunnel.pid

2 6

Logging Issues Causing Crash?
by Randall LeJeune 08 Aug '16

08 Aug '16

Hello all, Has anyone experienced a full log file causing stunnel issues in the past? We tried upgrading from 4.56 to 5.17 and the upgrade seemed to go fine at first, but a day or so later we began to have some disconnects. Later we downgraded to 5.01 which worked OK at first, but then we ran into the same kinds of problems again after a few days. We eventually put the stunnel.log file on a separate filesystem, but I am curious, has anyone else experienced any issues like this? Thanks, Randy

3 2