- stunnel-users - stunnel.org

Server is down
by Hamid.Shahid＠sungard.com 28 Nov '11

28 Nov '11

Hi, I am trying to connect to a remote SSL enabled server via stunnel. I am using a single file for key and certificate "sunStunnel.pem", just like the default "stunnel.pem" and I am getting following errors. Please let me know, what they mean and what should be done to resolve these? Note: I was able to telnet the machine, so server seems to be working. Thanks. ======= Config ======= debug = 7 output = stunnel.log cert = sunStunnel.pem [GPC-HOST] client = yes [syslog] accept = 127.0.0.1:2525 connect = <ip>:<port> ======= Log ======= No limit detected for the number of clients make_sockets: s_socket#1: FD=652 allocated (blocking mode) make_sockets: s_socket#2: FD=648 allocated (blocking mode) make_sockets: s_accept: FD=604 allocated (non-blocking mode) stunnel 4.47 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf Snagged 64 random bytes from C:/.rnd Wrote 1024 new random bytes to C:/.rnd PRNG seeded successfully Initializing SSL context for service GPC-HOST Certificate: sunStunnel.pem Certificate loaded Key file: sunStunnel.pem error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib error queue: D08303A: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error error queue: D06C03A: error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error SSL_CTX_use_PrivateKey_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag Server is down Kind Regards, Hamid Shahid

2 1

error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
by Hamid.Shahid＠sungard.com 28 Nov '11

28 Nov '11

Hi, I am trying to connect to a remote SSL enabled server via stunnel. I am using a single file for key and certificate "sunStunnel.pem", just like the default "stunnel.pem" and I am getting following errors. Please let me know, what they mean and what should be done to resolve these? Note: I was able to telnet the machine, so server seems to be working. Thanks. ======= Config ======= debug = 7 output = stunnel.log cert = sunStunnel.pem [GPC-HOST] client = yes [syslog] accept = 127.0.0.1:2525 connect = <ip>:<port> ======= Log ======= No limit detected for the number of clients make_sockets: s_socket#1: FD=652 allocated (blocking mode) make_sockets: s_socket#2: FD=648 allocated (blocking mode) make_sockets: s_accept: FD=604 allocated (non-blocking mode) stunnel 4.47 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf Snagged 64 random bytes from C:/.rnd Wrote 1024 new random bytes to C:/.rnd PRNG seeded successfully Initializing SSL context for service GPC-HOST Certificate: sunStunnel.pem Certificate loaded Key file: sunStunnel.pem error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib error queue: D08303A: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error error queue: D06C03A: error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error SSL_CTX_use_PrivateKey_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag Server is down Kind Regards, Hamid Shahid [cid:image001.gif@01CC6F01.EF535C90]<http://www.sungard.com/ten> Hamid Shahid * Integration Developer * Front Arena * Capital Markets * SunGard * Kungsbron 2, PO Box 70351, SE-107 24 Stockholm, Sweden * Tel +46 (0) 8 454 0167 * Direct +46 (0) 8 454 0167 * Mobile +46 (0) 76 869 2167 * hamid.shahid(a)sungard.com<mailto:ronny.andersson@sungard.com> * www.sungard.com<http://www.sungard.com/> Join SunGard's customers, partners and industry experts at www.sungard.com/ten<http://www.sungard.com/ten> to discuss how the need for more Transparency, Efficiency and Networks is changing our industry and to register for a city day event near you. VIENNA HOUSTON FRANKFURT BEIJING HONG KONG NEW YORK LONDON SEOUL ZURICH MUMBAI JOHANNESBURG DUBAI SAO PAULO CONFIDENTIALITY: This e-mail (including any attachments) may contain confidential, proprietary and privileged information, and unauthorized disclosure or use is prohibited. If you receive this e-mail in error, please notify the sender and delete this e-mail from your system.Thank you. P Please consider the environment before printing this e-mail.

1 0

stunnel 4.48 released
by Michal Trojnara 26 Nov '11

26 Nov '11

Dear Users, I have released version 4.48 of stunnel. The ChangeLog entry: Version 4.48, 2011.11.26, urgency: MEDIUM: * New features - FIPS support on Win32 platform added. OpenSSL 0.9.8r DLLs based on FIPS 1.2.3 canister are included with this version of stunnel. FIPS mode can be disabled with "fips = no" configuration file option. * Bugfixes - Fixed canary initialization problem on Win32 platform. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.48.tar.gz: 9fa723595726806cbf6547a2c453e695e33bf635f2d4771e80d110a06f27ea37 Best regards, Mike

1 0

stunnel & HAProxy : patch still required ?
by Thomas Manson 24 Nov '11

24 Nov '11

Hi, I'm willing to use this kind of configuration : https client -->stunnel --> haproxy --> 2 web servers in http (or more) I've understand that haproxy can't handle the ssl part, that's why stunnel is needed. I've read that a Patch is required for stunnel to work with haproxy in this kind of confirmation "I run stunnel 4.32 with patch from http://haproxy.1wt.eu/download/patches/ on port 443 and forward it to port 81 on the same machine which is bound to haproxy." Can anyone tell me if this patch is now included in stunnel, in particular, does Ubuntu 11.10 include it ? I really would rather stay with package provided by ubuntu in order to have easy upgrade/security fix. I've experiences the work overload of manually compiling everything in Apache for instance ;) Any advices on this kind of setup ? documentation pointers? best practices ? Regards, Thomas. here is the current package version on ubuntu 11.10 thomas@daisybox:~/Documents$ aptitude show stunnel4 Package: stunnel4 New: yes State: not installed Version: 3:4.35-2build1 Priority: optional Section: universe/net Maintainer: Ubuntu Developers <ubuntu-devel-discuss(a)lists.ubuntu.com> Uncompressed Size: 541 k Depends: libc6 (>= 2.11), libssl1.0.0 (>= 1.0.0), libwrap0 (>= 7.6-4~), openssl, netbase, perl-modules PreDepends: adduser Suggests: logcheck-database Conflicts: stunnel4 Breaks: stunnel (< 3:4.20-3), stunnel (< 3:4.20-3) Replaces: stunnel, stunnel Provides: stunnel Description: Universal SSL tunnel for network daemons The stunnel program is designed to work as SSL encryption wrapper between remote client and local (inetd-startable) or remote server. The concept is that having non-SSL aware daemons running on your system you can easily setup them to communicate with clients over secure SSL channel. stunnel can be used to add SSL functionality to commonly used inetd daemons like POP-2, POP-3 and IMAP servers without any changes in the programs' code. This package contains a wrapper script for compatibility with stunnel 3.x Homepage: http://www.stunnel.org/ thomas@daisybox:~/Documents$ aptitude show stunnel No current or candidate version found for stunnel Package: stunnel State: not a real package Provided by: stunnel4

2 1

Patch: Include source IP in connection failure log lines
by Alex Gottschalk 23 Nov '11

23 Nov '11

I'm setting up an internet-facing server that will be running a service wrapped with stunnel. Given that, it made sense to me to use fail2ban to block repeat connection attempts from clients who don't have the right certificate (the system is using client-certificate authentication). Unfortunately, stunnel4 doesn't put the client source IP in connection failure log lines, so I made this quick patch to enable that. ---cut here---- --- src/client.c.orig 2011-10-05 16:47:48.000000000 -0700 +++ src/client.c 2011-10-05 16:50:37.000000000 -0700 @@ -358,10 +358,13 @@ continue; } } - if(c->opt->option.client) + if(c->opt->option.client) { sslerror("SSL_connect"); - else - sslerror("SSL_accept"); + } else { + char buf[255]; + sprintf(buf, "SSL_accept from %s ", c->accepted_address); + sslerror(buf); + } longjmp(c->err, 1); } if(SSL_session_reused(c->ssl)) { ----cut here----

1 0

Getting Stunnel to work
by Brian Miller 21 Nov '11

21 Nov '11

Hello, I recently moved my Homeseer software from web server 08 to server 08. I had stunnel working on there properly to send out e mails using a hotmail account. I downloaded the new verison of Stunnel and tried to use the same config but Stunnel was crashing. Both versions web server 08 and server 08 are 64bit. Below is the original stunnel config file that I used on web server 08, this is cashing stunnel to crash when I run it. Using the default settings works, but I need to edit the config. I'm not to smart in the whole stunnel / Homeseer side of things. I was told by the Homeseer community that I need this to use my hotmail e mail to send e mails. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 110 connect = pop3.live.com:995 [imaps] accept = 993 connect = 143 [ssmtp] accept = 25 connect = smtp.live.com:587 protocol = smtp ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

1 0

stunnel 4.47 released
by Michal Trojnara 20 Nov '11

20 Nov '11

Dear Users, I have released version 4.47 of stunnel. This version includes a number of important bugfixes. The ChangeLog entry: Version 4.47, 2011.11.21, urgency: MEDIUM: * Internal improvements - CVE-2010-3864 workaround improved to check runtime version of OpenSSL rather than compiled version, and to allow OpenSSL 0.x.x >= 0.9.8p. - Encoding of man page sources changed to UTF-8. * Bugfixes - Handling of socket/SSL close in transfer() function was fixed. - Logging was modified to save and restore system error codes. - Option "service" was restricted to Unix, as since stunnel 4.42 it wasn't doing anything useful on Windows platform. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.47.tar.gz: 0b70f8bad8b6963e6154606571a83a3f0e0dea88d7dbd7e3b83cde5a07dd95ae Best regards, Mike

1 0

Re: [stunnel-users] expired certificate problem
by Rolf Ruediger 18 Nov '11

18 Nov '11

Yeah, great idea...now the log looks a little different: CRL: verification passed 2011.11.18 14:33:22 LOG5[2517:3077962608]: VERIFY OK: depth=2, /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only [...and so on...] But at the end, same as usual: 2011.11.18 14:33:22 LOG3[2517:3077962608]: SSL_connect: 14094415: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired 2011.11.18 14:33:22 LOG5[2517:3077962608]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Maybe there is another reason, why I cant connect? Maybe the lines 2011.11.18 14:33:22 LOG5[2517:3077962608]: connect_blocking: connected example.com:443 2011.11.18 14:33:22 LOG5[2517:3077962608]: https connected remote server from my_outsid_ip:38491 are messing something? -Rolf ________________________________ From: "josealf(a)rocketmail.com" <josealf(a)rocketmail.com> To: Rolf Ruediger <stunnel(a)ymail.com> Sent: Friday, November 18, 2011 2:18 PM Subject: Re: [stunnel-users] expired certificate problem Rolf, Try verify = 0 Regards -----Original Message----- From: Rolf Ruediger <stunnel(a)ymail.com> Sender: stunnel-users-bounces(a)stunnel.org Date: Fri, 18 Nov 2011 05:15:33 To: stunnel-users(a)stunnel.org<stunnel-users(a)stunnel.org> Reply-To: Rolf Ruediger <stunnel(a)ymail.com> Subject: Re: [stunnel-users] expired certificate problem _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

expired certificate problem
by Rolf Ruediger 18 Nov '11

18 Nov '11

Hello there! Some time ago I used stunnel to send the output of a homebrew logging script to a remote server. For a few weeks now, the sever has an expired certificate, so I get an error while connecting to it. The stunnel.log looks like that: 2011.11.18 12:23:36 LOG5[753:3078719168]: stunnel 4.29 on i486-pc-linux-gnu with OpenSSL 0.9.8o 01 Jun 2010 2011.11.18 12:23:36 LOG5[753:3078719168]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.11.18 12:23:36 LOG5[753:3078719168]: 500 clients allowed 2011.11.18 12:24:00 LOG5[759:3078716272]: https accepted connection from 127.0.0.1:40691 2011.11.18 12:24:00 LOG5[759:3078716272]: connect_blocking: connected example.com:443 2011.11.18 12:24:00 LOG5[759:3078716272]: https connected remote server from my_outside_ip:38486 2011.11.18 12:24:00 LOG3[759:3078716272]: SSL_connect: 14094415: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired 2011.11.18 12:24:00 LOG5[759:3078716272]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket This happens, when connecting manually with "nc -v 127.0.0.1 1234" to make a http-get request. To also provide the config file of my linux client: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/https.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration [https] accept = 127.0.0.1:1234 connect = example.com:443 TIMEOUTclose = 0 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 465 connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini So, the server is not under my control, where I am logging to. Is there a problem I don't see? I thought, that when I connect to localhost, the data should be forwarded to the https-server. Thanks in advance. -Rolf

2 2

[patch] x-forwarded-for patch for the new stunnel 4.46
by Michel Belleau 18 Nov '11

18 Nov '11

Hi. I use HAProxy and STunnel and I had to do a new installation lately. I took time to check the latest versions available of each product as this is a good time to test it out before production roll-out. I figured out that enough things have changed from STunnel version 4.44 to 4.46 making the X-Forwarded-For patch (that is usually used when STunnel sits in front of HAProxy) reject some parts of the latest 4.44 patch I found on the internet. Here is the patch, applying with no problems on 4.46, for anyone else interested: http://labs.malaiwah.com/stunnel-4.46-xforwarded-for.diff PS: I didn't try it yet for IPv6 connections yet. Michel Belleau

3 2