[stunnel-users] Stunnel4 not working?
David H. Durgee
dhdurgee at verizon.net
Sat May 9 13:54:56 CEST 2015
> Please see highlighted below:
>
> On Fri, May 8, 2015 at 5:27 PM, David H. Durgee <dhdurgee at verizon.net <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users>>
> wrote:
>
> >/ At some point in the near past stunnel stopped working on my laptop. The
> />/ laptop is running Linux Mint 17.1 Rebecca x64 and stunnel from the
> />/ repositories. I enabled debug=7, but I am not getting much from the log:
> />/
> />/
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Clients allowed=500
> />/
> />/
> />/
> />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]:
> />/ stunnel 4.53 on x86_64-pc-linux-gnu platform 2015.05.08 17
> />/ <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Compiled with OpenSSL
> />/ 1.0.1e 11 Feb 2013 2015.05.08 17 <2015.05.08%2017>:12:06
> />/ LOG5[10804:140318864611136]: Running with OpenSSL 1.0.1f 6 Jan 2014
> />/ 2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Update
> />/ OpenSSL shared libraries or rebuild stunnel*
> /
>
> Is there a reason that you're using libraries from a different compiled
> Stunnel? In fact, isn't there another Stunnel package you can use that is
> more up-to-date? If not, perhaps compile your own using the OpenSSL
> libraries that comes with Mint.
I am using the package from the Mint repository, which in this case is
the Ubuntu Trusty repository. If you know of a repository I can add
with a more current package I will do so. If necessary I guess I could
build from source, but I don't do that often and would prefer to locate
a binary.
> >/
> />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Threading:PTHREAD
> />/ SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6
> />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Reading configuration
> />/ from file /etc/stunnel/stunnel.conf
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Compression not enabled
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: PRNG seeded successfully
> />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service
> />/ section [telnets]
> />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]:
> />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem*
> /
>
> Warning: the permissions may be too wide-open (should be 700 I assume)
>
>
> >/
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate:
> />/ /etc/ssl/certs/stunnel.pem
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file:
> />/ /etc/ssl/certs/stunnel.pem
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set:
> />/ 0x00000004
> />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service
> />/ section [dsp3270s]
> />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]:
> />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem*
> /
>
> Same as above, perhaps too wide open, permissions should be 700 I assume.
>
>
> >/
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate:
> />/ /etc/ssl/certs/stunnel.pem
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file:
> />/ /etc/ssl/certs/stunnel.pem
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set:
> />/ 0x00000004
> />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Configuration successful
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [telnets]
> />/ (FD=12) bound to 0.0.0.0:3141
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [dsp3270s]
> />/ (FD=13) bound to 0.0.0.0:7490
> />/ 2015.05.08 17:12:06 LOG7[10810:140318864611136]: Created pid file
> />/ /stunnel4.pid
> />/ 2015.05.08 17:12:31 LOG7[10810:140318864611136]: Service [telnets]
> />/ accepted (FD=3) from 127.0.0.1:40090
> />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] started
> />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Waiting for a libwrap
> />/ process
> />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Acquired libwrap process
> />/ #0
> />/
> />/
> />/ *2015.05.08 17 <2015.05.08%2017>:12:31 LOG3[10810:140318864770816]:
> />/ Unexpected socket close (read_blocking) 2015.05.08 17
> />/ <2015.05.08%2017>:12:31 LOG5[10810:140318864770816]: Connection reset: 0
> />/ byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17
> />/ <2015.05.08%2017>:12:31 LOG7[10810:140318864770816]: Local socket (FD=3)
> />/ closed*
> /
>
> that sounds like SELinux permissions perhaps? Have you tried temporarily
> disabling SELinux, or perhaps you have a firewall (iptables) set up? You'll
> have to allow the incoming port and possibly an entry in /etc/services
> IIRC. I don't know if this helps but this is what I found:
> https://sites.google.com/site/easylinuxtipsproject/security
> A link to "ufw" may prove useful, if your system has that installed. Most
> systems have locked-down privileged ports (any port less than 1024, like in
> your example).
I do have ufw here, but I have the same problem with it enabled or
disabled. The telnets service is listening on port 3141 and the
dsp3270s on port 7490, so neither of them are privileged ports.
> >/
> />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets]
> />/ finished (0 left)
> />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: str_stats: 1 block(s),
> />/ 32 data byte(s), 58 control byte(s)
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864611136]: Service [dsp3270s]
> />/ accepted (FD=3) from 127.0.0.1:48534
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s]
> />/ started
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Waiting for a libwrap
> />/ process
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Acquired libwrap process
> />/ #1
> />/ *2015.05.08 17 <2015.05.08%2017>:13:32 LOG3[10810:140318864770816]:
> />/ Unexpected socket close (read_blocking)*
> />/
> /
> That sounds like some kind of firewall issue (like above).
As noted above, same behavior with ufw enabled or disabled.
> >/ 2015.05.08 17:13:32 LOG5[10810:140318864770816]: Connection reset: 0
> />/ byte(s) sent to SSL, 0 byte(s) sent to socket
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Local socket (FD=3)
> />/ closed
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s]
> />/ finished (0 left)
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: str_stats: 1 block(s),
> />/ 32 data byte(s), 58 control byte(s)
> />/
> />/
> / When in a situation like this, I would first try unprivileged ports with
> localhost using iperf, just to generate some dummy traffic. A good
> technique I use when debugging stunnel versus debugging networking or other
> security issues is to do local traffic only like this:
>
> 1. iperf client connect to localhost port 5000
> 2. Stunnel client listen on port 5000, connect to localhost port 6000
> 3. Stunnel server listen on port 6000, connect to localhost port 7000
> 4. iperf server listening on localhost port 7000
>
> As you can see from that, running iperf client for a few seconds, it should
> be able to connect to the iperf server. If not, stunnel is not working.
> Debug this FIRST before proceeding to working with non-localhost IP
> addresses. The actual procedure would be as follows:
>
> 1. Download/install iperf
> 2. Verify iperf works by having one shell run as server, listening on
> localhost port 7000, and another shell setup iperf client sending on port
> 7000. If that works, then proceed. Don't use iperf to connect to port 7000
> again.
> 3. Set up two config files, one for stunnel client and one for stunnel
> server, with different ports and the "client=yes" in the client config
> file. For easier detection with "ps" or "top", you can copy the executable
> file to another name (i.e., "s4client" for the stunnel 4 client, and
> "s4server" for the stunnel 4 server). Similarly for iperf, you can copy the
> exe to "iperfc" and "iperfs" for iperf server, for easier process detection.
> 4. Start up the stunnel server first, then stunnel client, with the
> appropriate config files per the port enumeration mentioned above.
> 5. Start iperf server listening on port 7000.
> 6. Start iperf client sending on port 5000. If you get some really large
> value or nothing, then your stunnel config (client/server) needs to be
> debugged first before proceeding to non-localhost IPs. I usually get
> something like 3GB/sec when using a Windows 7 VM inside Windows 7 doing
> this from DOS prompts with appropriate server/client configs set up. I
> usually use four windows: two for iperf (c/s), two for stunnel (c/s).
>
> Hope that helps...
> -Rob
I have an stunnel server on another system on the LAN and that is the
one I am having the client with the problem connect to while trying to
find the problem. I know that server is working, as I have seen other
incoming traffic handled by it.
I suspect the problem is related to the message you pointed out that I
missed about SSL libraries. I would very much appreciate a pointer to a
more current package in a repository.
Thanks for your response, Rob.
Dave
More information about the stunnel-users
mailing list