- stunnel-users - stunnel.org

Re: [stunnel-users] FIPS compliant Stunnel build
by Michael Curran 24 Jul '14

24 Jul '14

I have already requested the CD of software from OpenSSL -- that section does not really assist with the build functions. The FIPSDIR= option still did not allow Stunnel to autodiscover FIPS.h -- this is my openssl1.0.1h configure command openssl-fips-2.0.7 ./config ; make ; make install openssl-1.0.1h./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib --with-fipsdir=/usr/local/ssl/fips-2.0/ ; make depend ; make ; make test ; make install Stunnel5.02 I am not installling the newer copy of openssl to the rest of the system, just as libraries accessible to Stunnel for building with a version that is different than the OS installed openssl so as not to risk breaking ssh or OS Upgrade capabilities ./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap ; make ; make install During the Make phase it just says it cannot find fips.h but it says fips enabled -- but when I tell it to use FIPS I get checking whether to enable FIPS mode support... yesconfigure: **************************************** SSLchecking for SSL directory... /usr/local/openssl-100checking /usr/local/openssl-100/include/openssl/engine.h usability... yeschecking /usr/local/openssl-100/include/openssl/engine.h presence... yeschecking for /usr/local/openssl-100/include/openssl/engine.h... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h usability... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h presence... yeschecking for /usr/local/openssl-100/include/openssl/ocsp.h... yeschecking /usr/local/openssl-100/include/openssl/fips.h usability... nochecking /usr/local/openssl-100/include/openssl/fips.h presence... nochecking for /usr/local/openssl-100/include/openssl/fips.h... noconfigure: WARNING: OpenSSL fips header not foundconfigure: **************************************** write the resultsconfigure: creating ./config.status Restarting Stunnel with fips=yes gives me this [!] FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported[!] Line 35: "[webapp]": Failed to initialize SSL The TODO file in Stunnel5.02 tarball has this * Support static FIPS-enabled build. Does this mean that it can only currently support a system that is fully fips enabled and not my static libraries that I use for building Stunnel? Thats what I get out of this. And upon further reading of the INSTALL.FIPS file I confirm this Unix HOWTO:* Only dynamic linking of the FIPS-enabled OpenSSL is currently supported, i.e. FIPS-enabled OpenSSL has to be configured with "shared" parameter. I cannot install it with dynamic libraries as I am required to build via the actual instructions for FIPS 140-2 compliance which implicitly states I cannot call out shared as part of the config options. Mike Curran From: mike_curran(a)hotmail.com To: nobody(a)dizum.com Subject: RE: FIPS compliant Stunnel build Date: Wed, 23 Jul 2014 17:34:08 -0500 I have already requested the CD of software from OpenSSL -- that section does not really assist with the build functions. The FIPSDIR= option still did not allow Stunnel to autodiscover FIPS.h -- this is my openssl1.0.1h configure command openssl-fips-2.0.7 ./config ; make ; make install openssl-1.0.1h./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib --with-fipsdir=/usr/local/ssl/fips-2.0/ ; make depend ; make ; make test ; make install Stunnel5.02 I am not installling the newer copy of openssl to the rest of the system, just as libraries accessible to Stunnel for building with a version that is different than the OS installed openssl so as not to risk breaking ssh or OS Upgrade capabilities ./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap ; make ; make install During the Make phase it just says it cannot find fips.h but it says fips enabled -- but when I tell it to use FIPS I get checking whether to enable FIPS mode support... yesconfigure: **************************************** SSLchecking for SSL directory... /usr/local/openssl-100checking /usr/local/openssl-100/include/openssl/engine.h usability... yeschecking /usr/local/openssl-100/include/openssl/engine.h presence... yeschecking for /usr/local/openssl-100/include/openssl/engine.h... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h usability... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h presence... yeschecking for /usr/local/openssl-100/include/openssl/ocsp.h... yeschecking /usr/local/openssl-100/include/openssl/fips.h usability... nochecking /usr/local/openssl-100/include/openssl/fips.h presence... nochecking for /usr/local/openssl-100/include/openssl/fips.h... noconfigure: WARNING: OpenSSL fips header not foundconfigure: **************************************** write the resultsconfigure: creating ./config.status Restarting Stunnel with fips=yes gives me this [!] FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported[!] Line 35: "[webapp]": Failed to initialize SSL The TODO file in Stunnel5.02 tarball has this * Support static FIPS-enabled build. Does this mean that it can only currently support a system that is fully fips enabled and not my static libraries that I use for building Stunnel? Thats what I get out of this. Mike Curran > From: nobody(a)dizum.com > To: mike_curran(a)hotmail.com > Subject: Re: FIPS compliant Stunnel build > Date: Thu, 24 Jul 2014 00:00:37 +0200 > > it IS possible... > > use FIPSDIR environment variable -- > NOT any change to FIPS Object Module ./config command > > BUT most important see: > > 6.6 The "Secure Installation" Issue > > of > > User Guide for the OpenSSL FIPS Object Module v2.0 > (including v2.0.1, v2.0.2, v2.0.3, v2.0.4, v2.0.5, v2.0.6, v2.0.7) >

2 1

OpenVPN over stunnel
by Derek Cole 24 Jul '14

24 Jul '14

Hello, I am doing something similar to what is happening in this scenario: http://kyl191.net/2012/12/tunneling-openvpn-through-stunnel/ That is, I have set my openvpn client configuration to be "remote localhost port" where port is the port my stunnel client is listening on the same box as my openvpn client. This seems to work - I get connected to OpenVPN server fine, however, I don't seem to be able to ping the openvpn server by either of it's public or private ip addresses. In fact, it seems like when I do a tcpdump on the stunnel server, I don't see any incoming traffic on port 443. How is it possible that I am getting the VPN connection, but then the rest of the traffic just sort of stops going through stunnel? My stunnel client service looks like the following: [openvpn] accept = 127.0.0.1:5150 connect = stunnelserver:443 and my stunnel server looks like: [ovpnout] cert = mycert.pem accept = 443 connect = openvpn server Any ideas?

2 3

FIPS compliant Stunnel build
by Michael Curran 24 Jul '14

24 Jul '14

Hello -- Is Stunnel (any version) compatible with Fips-2.0 for compliance? I have found one individuals instructions for compiling fips-2.0.5 , but he calls out a prefix= in his configure for FIPS which breaks 140-2 compliance rules and makes the build no longer viable >From the Fips-2.0 userguide "Note that as a condition of the FIPS 140-2 validation no other user specified configuration optionsmay be specified. This restriction means that an optional install prefix cannot be specified –however, there is no restriction on subsequent manual relocation of the generated files to thedesired final location." I know that Stunnel compiles just fine with OpenSSL1.0.1 versions, but there appears to have been a difference in the method of validation and installation of FIPS modules into a seperate modular directory, and is not located in the openssl/include files after build now The stunnel configure script only looks for fips-1.0 as well , so my base assumption is might not be capable of handling FIPS-2.0 at this time.

1 0

CApath not working anymore
by Jordan Paschalidis 17 Jul '14

17 Jul '14

Hello, i have an existing stunnel-installation with CApath. I tried to setup a new stunnel-version, and copied all certifictes and had allwas an error like 2014.07.16 09:50:36 LOG7[15937:0]: Starting certificate verification: depth=1, /C=DE/emailAddress=ssladmin(a)v.de 2014.07.16 09:50:36 LOG4[15937:0]: CERT: Verification error: self signed certificate in certificate chain 2014.07.16 09:50:36 LOG4[15937:0]: Certificate check failed: depth=1, /C=DE/emailAddress=ssladmin(a)v.de 2014.07.16 09:50:36 LOG7[15937:0]: SSL alert (write): fatal: bad certificate 2014.07.16 09:50:36 LOG3[15937:0]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2014.07.16 09:50:36 LOG5[15937:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket i had an hard time to find out that CApath is not working anymore. I put for test all certificates into a file and used CAfile and immediately the connection was established. Does somebody know why CApath is not working anymore? Tested with stunnel 5.02, 4.56, 4.55, 4.54 cheers, jordan

2 2

telnet-ssl protocol?
by Edoardo Spadolini 11 Jul '14

11 Jul '14

I'm disappointed by the lack of customization available in telnetd-ssl, so I wanted to add a "telnet-ssl" protocol to stunnel. Can anyone give me some pointers on how to go about doing that? Kerio

1 0

Question in using stunnel
by Sara Baghbanzadeh 03 Jul '14

03 Jul '14

Hi there, I have a proxy (PHP file) which I want it to work as a server for me. I have PhantomJS as my client which loads particular url and instead of sending its requests to the main server it will send them to my proxy. I am going to send it back its responses. I have no problem when the website is based on HTTP. But, since my proxy cannot deal with SSL, I have problem with HTTPS websites. Actually, I have a database contains all the requests and responses which I captured by Fiddler. I use this database when I want to send a response to PhantomJS. Now, I cannot fill out my database since I cannot capture completely decrypted traffic using none of existing tools. Also I need to receive decrypted request from PhantomJS! Therefore, I decided to use stunnel for solving my problem. I am going to use it in order to decrypt all the requests from PhantomJS, and then, send them to my proxy, and also encrypt all my responses, before sending back to PhantomJS. I have installed latest version of stunnel on my Ubuntu machine and have generated a config file. I could not solve my problem using stunnel so far and my question is: Can stunnel solve my problem? I mean, can I use stunnel in order to decrypt PhantomJS's requests and encrypt my responses? ... If yes, could you please tell me how? Thank you so much and I am eagerly waiting to receive your response. Thanks in advance, Best regards, Sara

1 0

Re: [stunnel-users] OpenSSL FIPS header not found - version 5.02
by Hui Yu 26 Jun '14

26 Jun '14

No, you don't need to do "make depend". Just follow my exact steps, it is enough to compile a FIPS enabled stunnel. I did it on the 64 bits centos linux (linux-x86_64) and redhat linux (linux-generic32) , so that is probably the only change you need. Good luck.

2 1

Re: [stunnel-users] OpenSSL FIPS header not found - version 5.02
by Hui Yu 26 Jun '14

26 Jun '14

You need to follow these steps: 1.1.1 Build openssl-fips package >From https://www.openssl.org/source/, download latest openssl-fips package and unzip under tar -zxvf openssl-fips-2.0.5.tar.gz<https://www.openssl.org/source/openssl-fips-2.0.5.tar.gz> cd /home/user/openssl-fips-2.0.5 /Configure --prefix=/usr/local linux-generic32 make make install 1.1.2 Build FIPS capable openssl package >From https://www.openssl.org/source/, download latest openssl package and unzip under tar -zxvf openssl-1.0.1h.tar.gz<https://www.openssl.org/source/openssl-1.0.1h.tar.gz> Cd /home/user/openssl-1.0.1h ./Configure --prefix=/usr/local --with-fipsdir=/usr/local fips linux-generic32 make CC=fipsld FIPSLD_CC=gcc -j 8 make install the binary openssl can be found at /usr/local/bin/openssl [root@ssl86 hyu]# openssl version OpenSSL 1.0.1h-fips 5 Jun 2014 #######here is tricky, go back to FIPS directory make install again. cd /home/user/openssl-fips-2.0.5 make install 1.1.3 Build stunnel package >From https://www.stunnel.org/downloads.html, Download latest stunnel version 5.02 package and unzip under tar -zxvf stunnel-5.02.tar.gz<https://www.stunnel.org/downloads/stunnel-5.02.tar.gz> cd /home/user/stunnel-5.02 ./configure --enable-fips --with-ssl=/usr/local/ --prefix=/usr/local make CC=fipsld FIPSLD_CC=gcc -j 8 make install the stunnel binary can be found at /usr/local/bin/stunnel

2 1

(no subject)
by Paulraj Samikannu 25 Jun '14

25 Jun '14

I see the following messages on the production server, any special log setting requirement or is our stunnel generating too many messages too fast? Jun 25 06:13:35 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting Jun 25 06:15:34 pprccmfaap001 rsyslogd-2177: imuxsock lost 47 messages from pid 171059 due to rate-limiting Jun 25 06:15:36 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting

4 6

public domain [PATCH] to stunnel v456 to clear SSL_OP_LEGACY_SERVER_CONNECT
by Simner, John 25 Jun '14

25 Jun '14

Dear Michal, Dear All, Please find attached a patch to stunnel 4.56 to clear SSL_OP_LEGACY_SERVER_CONNECT. There was a security requirement to ensure that the stunnel client could not connect to unpatched servers. I am aware from OpenSSL (https://www.openssl.org/docs/ssl/SSL_CTX_set_options.html ) that this parameter is currently set by default and has to be manually cleared by calling SSL_CTX_clear_options() or SSL_clear_options()if an OpenSSL client applications wants to ensure they can not connect to unpatched servers (and thus avoid any security issues). The attached patch achieves this. OpenSSL also state "As more servers become patched the option SSL_OP_LEGACY_SERVER_CONNECT will not be set by default in a future version of OpenSSL" so this patch is only required until OpenSSL change the default value. Thanks.. John [Unify: Harmonize your enterprise] John Simner BSc(Hons) MSc CEng. MIET Software Engineer, Devices Development Unify Enterprise Communications Ltd. Tel.: +44 (1908) 817378 (One Number Service) Email: john.simner(a)unify.com <mailto:vorname.name@unify.com> www.unify.co.uk<http://www.unify.co.uk/> Follow us: [Social_media_icons] <http://www.unify.com/social-media> Unify Enterprise Communications Limited. Registered Office: Brickhill Street, Willen Lake, Milton Keynes, MK15 0DJ Registered No: 5903714, England. This email contains confidential information and is for the exclusive use of the addressee. If you are not the addressee then any distribution, copying, or use of this email is prohibited. If received in error, please advise the sender and delete immediately. We accept no liability for any loss or damage suffered by any person arising from use of this email.

1 0