stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

STunnel nCipher openssl chil problems
by Marc Phillips 06 Aug '15

06 Aug '15

Has anyone managed to get STunnel to work with nCipher using the chil engine? STunnel appears to load the engine just fine, but failes when loading the key: [ ] Enabling support for engine "chil" [ ] Initializing engine #1 (chil) [ ] Engine #1 (chil) initialized [.] FIPS mode disabled [ ] Compression disabled [ ] PRNG seeded successfully [ ] Initializing service [https-server] [ ] Loading certificate from file: /usr/local/stunnel/etc/keystores/servercert.crt [ ] Loading key from engine: /usr/local/stunnel/etc/keystores/servercert.key [!] error queue: 26096080: error:26096080:engine routines:ENGINE_load_private_key:failed loading private key [!] ENGINE_load_private_key: 80069066: error:80069066:CHIL engine:HWCRHK_LOAD_PRIVKEY:chil error [!] Service [https-server]: Failed to initialize SSL context Using openssl directly, the key works fine (both with s_server and s_client). My stunnel config is pretty simple: pid = /usr/local/var/log/stunnel.pid debug = 7 output = /usr/local/var/log/stunnel.log options = -NO_SSLv3 engine = chil CApath = /usr/local/etc/cacerts/ [https-server] engineNum=1 accept = 4466 connect = 4433 cert=/usr/local/stunnel/etc/keystores/servercert.crt key=/usr/local/stunnel/etc/keystores/servercert.key R. Marc

1 0

Install Guide for STunnel Version 5.22
by Deepak Subbanarasimha 05 Aug '15

05 Aug '15

All, Is there an install guide for Stunnel version 5.22 for windows? If so, could you point me to it? -Deepak IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

2 2

"Chained" stunnel instances
by Michael Gebis 01 Aug '15

01 Aug '15

Hello. I have a question about a strange stunnel configuration; specifically, I'm like to use 'chained' stunnel instances, and I'm running into an issue. We have a conceptually simple setup: a client that connects to a server. We use stunnel both for encryption and for the failover mechanism. Here's a diagram of our simplest setup: /----S1 / C--st0-----S2 \ \----S3 We have a client that connects to stunnel. Our stunnel configuration lists three connections with "prio" failover mode. So usually, connections go from C thru st and onto Server 1. If S1 is down, st0 fails to connect to S1 and instead tries S2, and all is good. However, sometimes we may place an optional second instance of stunnel in front of the servers. /----st1--S1 / C--st0-----st2--S2 \ \----st3--S3 The failover mode of stunnel does not work so well in this configuration. If S1 is down, st0's failover algorithm does not kick in. Instead, st0 happily connects to st1, which is still alive and running. st1 then detects S1 is down and immediately closes the connection, but st0 does not care. Since the initial connection was successful, it does not initiate the failover algorithm. You may ask "why not change to round-robin mode?" The answer is that S1 is a dedicated machine, and S2/S3 are underpowered backups that have other primary responsibilities. We really want to direct all connections to S1 and only use S2/S3 in emergencies. You may also ask, "Why the second layer of stunnel?"--unfortunately, there are several hairy implementation-specific details that make this hard to change. My question is: is there any stunnel configuration option that can help us out? We would like the failover to work with and without the second layer of stunnel. From looking at the source code, I think I'm out of luck, but I figured it couldn't hurt to ask. Thanks! Michael

3 3

stunnel 5.21 - fails to listen on both IPv4/IPv6 (Linux)
by Lonnie Abelbeck 30 Jul '15

30 Jul '15

Very long-time user with the AstLinux project... stunnel 5.19 works fine, when upgrading to stunnel 5.21 with the same config I get: -- Starting Stunnel Server Proxy... [.] stunnel 5.21 on i586-pc-linux-gnu platform [.] Compiled/running with OpenSSL 1.0.1p 9 Jul 2015 [.] Threading:FORK Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/server.conf [.] UTF-8 byte order mark not detected [ ] Compression disabled [ ] PRNG seeded successfully [!] Error resolving "::": Address family for nodename not supported (EAI_ADDRFAMILY) [!] /etc/stunnel/server.conf:14: "accept = :::8443": Failed to resolve accepting address -- Has the syntax changed to listen on both IPv4/IPv6 ? Lonnie

2 2

Configuring stunnel on multi tenant server
by Saurabh Beriwal 30 Jul '15

30 Jul '15

Hi All, I want to configure stunnel on multi tenant server. Please let us know the best possible way to do this. Also is it OK if I keep multiple accept and connect parameters in stunnel configuration file. Thank you.

2 1

stunnel 5.22 released
by Michal Trojnara 30 Jul '15

30 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.22 of stunnel. The ChangeLog entry: Version 5.22, 2015.07.30, urgency: HIGH * New features - "OCSPaia = yes" added to the configuration file templates. - Improved double free detection. * Bugfixes - Fixed a number of OCSP bugs. The most severe of those bugs caused stunnel to treat OCSP responses that failed OCSP_basic_verify() checks as if they were successful. - Fixed the passive IPv6 resolver (broken in stunnel 5.21). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 8ad628a6948153cdb2044283f6988384a30585ea7e14778c2ee616a6678cb83f stunnel-5.22.tar.gz 9b3fe70bcfeb64b013b7b926e475a7d100ef1fdf5ce352ad90ac1034f780ea2a stunnel-5.22-installer.exe 2f49313debe7af27feeab246a771dc513e5e368e1839e92fba4cfe0b2735aeba stunnel-5.22-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVufy2AAoJEC78f/DUFuAUHVYQAK+keyqWyllv3ky5hRi8DlXe LLtuUdTYTalI64Fg5/TYL6+fbrEjWoAWtGwg+X/muVNj7KW4twlKrakMtkDpSDNd 0xSh94/u/PCrPVThxCq7AUbTPLyrG6ox5RKYDkOKfyGQ3q5ix6yba0l6fQqHXPCr OAbaRuwn5U6u7lPxXa69ozwyY5JHIiGqhMfQJBRXwFoeNbWak3HM7+Pe5DZ0ACLa SRY0iCseR1aQ12pZaaNoknkAAL9kmHgRP+fuPFqKMkp8TgZ2469qg30s/Bzn7n0U h5GvAuhYkQdDDbC7ozWgqaNxRNpOe+3RZ50fpCueyAlZESe8agHcyXchoj4JUVx+ 5ihOms4WujamCtP4MzHrRo6eQpeoGbw1EZ2P//Q9TlxX4METgEfV0lzaR7n376jr y24xIFEMl2tnqJ81lKQZWlxAP4MiKZgr//GOueRewRCtYSSQcK/mHvxZMDFfHAc7 N2LUmzm+PpsHwto7VkUy1m4eEAb34Tr3QubzvrT1yD4YMQDR6tID+xkRmuJWjMhf qBcXecKetIQq70KuI+VVqJxdP3Ekgjb+xnNOSKelUP/TkHpvubjTViSIVPu+5DSb x2viDBKAbgWcER2aZsB6UWXfQwjT/apDhqu6XrwjAcFfBk0ul0QazmH0HMc9ouVd yziOHVATYgcXYcTIQvj9 =DTOg -----END PGP SIGNATURE-----

1 0

Questions between stunnel 4.56 and 5.21 (current version)
by Guy.Gaudreau.TCR06＠ssss.gouv.qc.ca 28 Jul '15

28 Jul '15

Will a 4.56 installation be able to establish a tunnel to a 5.21 version. Will a 5.21 installation be able to establsih a tunnel to a 4.56 version What happends If I have a server that is currently running a 4.56 version and we install the 5.21 version on the same server. Will both versions co-exist on the same server peacefully or will the install process uninstall the 4.56 version. in that last scenario will the tunnels already configured under versio 4.56 work under the 5.21 install? Thank you Guy Gaudreau

1 0

stunnel 5.21 released
by Michal Trojnara 27 Jul '15

27 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.21 of stunnel. The ChangeLog entry: Version 5.21, 2015.07.27, urgency: MEDIUM * New features - Signal names are displayed instead of numbers. - First resolve IPv4 addresses on passive resolver requests. This speeds up stunnel startup on Win32 with a slow/defunct DNS service. - The "make check" target was modified to only build Win32 executables when stunnel is built from a git repository (thx to Peter Pentchev). - More elaborate descriptions were added to the warning about using "verify = 2" without "checkHost" or "checkIP". - Performance optimization was performed on the debug code. * Bugfixes - Fixed the FORK and UCONTEXT threading support. - Fixed "failover=prio" (broken since stunnel 5.15). - Added a retry when sleep(3) was interrupted by a signal in the cron thread scheduler. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 2aef568b1955f5e233f6a8e17ebce3d30755f1be44c813f5a48e621f785596e3 stunnel-5.21.tar.gz d5ec83140060af2b373a82abab0f7fd34c76a68c4f2990d46be460526b325de6 stunnel-5.21-installer.exe 2788d9e11b65dd4b111616bab1d7f09943916c924ba023cc3ad4260ac1f6f6d7 stunnel-5.21-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVtfz2AAoJEC78f/DUFuAUey4P/0tQ8yj3Yt7K5yLIorDGu9lI w95Vs2MtyOvFQyoX24dPKrDULKmxE28Dg8RJt51ZuT9q8mIfPdBA+jphyfjbpzl0 BeNQNbzEfN36dhOa2+dvr4+fcna/lnRpNMQg6sP/z4KHDLoI72lAg9vVwv5VX/4X JAMAaTxbrOXuXOmVPLSdHBeug7Y/0Q/+jPg9tSEslMtBaJvMd4CcHs4q8dCW9OQv AUWLtOiSsubfCvQ9rwGODObFJCA3BINrmh3a9EyhKJTov+8JKHlJY02r4zGJYMC4 PIVAVZWit9mEFefG6BuEWwOw4gohAInDXpsN2X9BNNDfUAVlUtp6OoxATcGv/H45 Uf25Dz2Bu8WtKIuuCIhN79PBfqSG8f2mSwNsec8OcYNOTzkAHKoFQQfKbJ1FUD5+ lTBhOFfo/B5haQA1EHNf0z8JxDulnsL7JsQQo4hF3ShSiCZpEAVvSkixpwCjm2kR WCtQ0w5eLccD/CnfjNrcOp3QKGLacZ+PCm9MH+cQDQvnmhAaelWK+OL67L9FKwBf hbJMA2RwwjN7efwEeUlnzVTBiJS9fsPTJghh8CzYuDWlnhEEnB9WX2FI1yVZVxM+ 8tGifpdOkRCFhpQSQkj0pWy/qf/cU8mL2uM31hBNcsRjCt6PfjQfKQ7jyMFvicmc rWJhvWvAfLAJXl+rgn5r =WvhQ -----END PGP SIGNATURE-----

1 0

Disable TLSv1
by Smith, Michael 23 Jul '15

23 Jul '15

I am running stunnel version 5.20. How do I disable TLSv1 and leave only TLSv1.2 and TSLv2 enabled? Michael Smith System Specialist II 281-283-2930

2 1

Question about behavior with "failover = prio"
by Michael Gebis 22 Jul '15

22 Jul '15

Hello again. We recently noticed a behavior in stunnel that surprised us, and seems to be inconsistent with the man page description. We use "failover = prio" in our configuration file. To refresh everyone's memory, the man page describes this option here: failover = rr | prio Failover strategy for multiple "connect" targets. rr (round robin) - fair load distribution prio (priority) - use the order specified in config file default: rr Our config file contains a list of connect targets, like this: [...] connect = h1.example.com connect = h2.example.com connect = h3.example.com connect = h4.example.com [...] Based on the description, we expect the connection to try h1 first, and if h1 fails, failover through the remainder of the list, in-order. However, what we observe is that the connections start at a seemingly random place in the list. It does appear to proceed in-order...it's just the starting place that seems incorrect. For example, we might get a sequence that proceeds "h3->h4->h1->h2". Please let me know if I am misunderstanding the intended behavior of the 'prio' failover strategy. Here is a trial patch that hard-codes the starting place for the failover to the beginning of the list. I am not sure if this change has any unintended consequences for other configurations. But as a proof-of-concept, it does seem to fix the behavior to be consistent with our reading of the man page. This patch is against 5.20 but it appears that 5.21b2 acts the same way. Thanks! Michael diff -ru stunnel-5.20.orig/src/client.c stunnel-5.20-prio-fix/src/client.c --- stunnel-5.20.orig/src/client.c 2015-07-16 15:55:52.213064746 -0700 +++ stunnel-5.20-prio-fix/src/client.c 2015-07-17 16:13:12.129184507 -0700 @@ -1285,7 +1285,8 @@ *c->connect_addr.rr_ptr=(i+1)%c->connect_addr.num; s_log(LOG_INFO, "failover: round-robin"); } else { - s_log(LOG_INFO, "failover: priority"); + s_log(LOG_INFO, "failover: priority, starting at first entry"); + i=0; } return i; }

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users