January 2008 - stunnel-users

Re: [stunnel-users] Stunnel on the same machine
by subrata＠indiatimes.com 31 Jul '11

31 Jul '11

The configuration files are : pid = /var/stunnel.pid ;chroot = /var/lib/stunnel setuid = nobody setgid = nobody foreground =yes ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept = 3307 connect = 192.168.1.6:3307 On 192.168.1.6 ---------------------- pid = /var/stunnel.pid setuid =nobody setgid = nobody foreground = yes client = no ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept =3307 connect =3306 connecting like /usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307 Enter password: On entring password the following lines appear : ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 Subrata ----- Original Message ----- From: Brian Hatch <bri(a)stunnel.org> To: subrata(a)indiatimes.com Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST) Subject: Re: [stunnel-users] Stunnel on the same machine Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted: > After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there. What do your stunnel configuration files look like? Other problem: mysql client may decide to use a local domain socket when connecting to localhost, thwarting your attempts to go via Stunnel. You might want to 'strace mysql ...' and look for the connect() lines. -- Brian Hatch Time flies like an Systems and arrow. Fruit flies Security Engineer like a banana. http://www.ifokr.org/bri/ Every message PGP signed -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

Re: [stunnel-users] rewrite Destination: when rewriting Host:
by Brian Hatch 07 Oct '09

07 Oct '09

Sometime near 2007-11-11 00:15 -0500, Marcio Marchini shouted: > Researching online one can see that WebDAV's spec requires that they > check both src and dest URLs for protocol & port. But with some proxies or > SSL fronts like stunnel, only one of the URLs is rewritten, so one goes as > http and the other as https. Here's one person explaining it, much better > than me: http://svn.haxx.se/users/archive-2006-03/0549.shtml Stunnel doesn't currently have the ability to scan and re-write the plaintext. For HTTP redirects it could possibly be implemented (re-write only the response before ^$, and redirects aren't chunked and don't have content lengths to work with, etc) but you'd still need enough HTTP logic to handle keepalives and such. It's not trivial and not likely. Another option would be to have something already HTTP aware doing the rewriting in between stunnel and subversion. A re-writing proxy. Another option would be to use mod_rewrite in apache to rewrite the urls. But the best way would be to just use SSL inside apache and drop stunnel entirely. -- Brian Hatch The best way to accelerate Systems and a Windows machine is at Security Engineer 9.8 meters per second http://www.ifokr.org/bri/ squared. Every message PGP signed

3 2

Bugs
by Jan.Haering＠rz-kiru.de 28 Feb '08

28 Feb '08

Hallo, I have found 2 Bugs. 1. In Version 4.21: No Taskbar Icon is displayed when the service starts. Although the taskbar ist set in config file (taskbar = yes). 2. In probably all Versions (I have testet 4.18, 4.20 and 4.21) If i started the service over Start -> Programm Files -> stunnel -> Service Start (stunnel -start) no log files are written. If i start the service over services.msc from Windows or "sc start stunnel" log files are written. The icon log displayed the following message in version 4.18 and 4.20 2007.11.09 09:41:03 LOG3[2396:2400]: stunnel.log: Broken pipe (32) 2007.11.09 09:41:03 LOG3[2396:2400]: Unable to open output file: stunnel.log Best Regards Jan

5 9

xforwardedfor in config
by Jill Rochelle 04 Feb '08

04 Feb '08

I am new to stunnel and the ssl world. I'm trying to get stunnel to work with haproxy for load balancing https requests. In the haproxy documentation it says that the stunnel.conf should look like this cert=/etc/stunnel/stunnel.pem setuid=stunnel setgid=proxy socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=192.168.1.1:443 connect=192.168.1.1:80 xforwardedfor=yes However, when I try to start the stunnel service I get this Starting stunnel: file /etc/stunnel/stunnel.conf line 9: Specified option name is not valid here If I comment out the xforwardedfor parameter, it starts. Any help is greatly appreciated. Thank you, Jill Rochelle

2 2

debug level 7
by Damian Wiest 25 Jan '08

25 Jan '08

Hi, I'm new to stunnel and have run into some unexpected behavior. I'm inclined to think it's a bug, but perhaps I'm misunderstanding some things. I'm running FreeBSD 6.2 with stunnel 4.21 (installed via ports collection). I'm able to configure things properly when using stunnel in daemon mode, but am unable to run stunnel from inetd when I set the debug level to 7. Here's the config file I'm using, cert = /usr/local/CA/stunnel.pem key = /usr/local/CA/stunnel.pem sslVersion = all pid = /var/log/swat-stunnel.pid debug = 7 output = /tmp/stunnel.log exec = /usr/local/sbin/swat execargs = swat ...and the inetd.conf entry, swat stream tcp nowait.400 root /usr/local/sbin/stunnel stunnel /usr/local/etc/stunnel/swat.conf If I connect to port 901, some debug messages are written to the socket, dwiest(a)dfwdamian.vail: telnet localhost 901 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 2008.01.22 22:19:09 LOG7[81278:134651904]: Snagged 64 random bytes from /home/dwiest/.rnd 2008.01.22 22:19:09 LOG7[81278:134651904]: Wrote 1024 new random bytes to /home/dwiest/.rnd 2008.01.22 22:19:09 LOG7[81278:134651904]: RAND_status claims sufficient entropy for the PRNG 2008.01.22 22:19:09 LOG7[81278:134651904]: PRNG seeded successfully 2008.01.22 22:19:09 LOG7[81278:134651904]: Certificate: /usr/local/CA/stunnel.pem 2008.01.22 22:19:09 LOG7[81278:134651904]: Certificate loaded 2008.01.22 22:19:09 LOG7[81278:134651904]: Key file: /usr/local/CA/stunnel.pem 2008.01.22 22:19:09 LOG7[81278:134651904]: Private key loaded 2008.01.22 22:19:09 LOG7[81278:134651904]: SSL context initialized for service stunnel ^] telnet> q Connection closed. ...and some are written to the file I specified, dwiest(a)dfwdamian.vail: cat /tmp/stunnel.log 2008.01.22 22:19:09 LOG5[81278:134651904]: stunnel 4.21 on i386-unknown-freebsd6.2 with OpenSSL 0.9.7e-p1 25 Oct 2004 2008.01.22 22:19:09 LOG5[81278:134651904]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.01.22 22:19:09 LOG7[81278:134651904]: stunnel started 2008.01.22 22:19:09 LOG7[81278:134651904]: FD 0 in non-blocking mode 2008.01.22 22:19:09 LOG7[81278:134651904]: FD 1 in non-blocking mode 2008.01.22 22:19:09 LOG7[81278:134651904]: stunnel permitted by libwrap from 127.0.0.1:53961 2008.01.22 22:19:09 LOG5[81278:134651904]: stunnel accepted connection from 127.0.0.1:53961 2008.01.22 22:19:09 LOG7[81278:134651904]: SSL state (accept): before/accept initialization 2008.01.22 22:19:11 LOG3[81278:134651904]: SSL_accept: Peer suddenly disconnected 2008.01.22 22:19:11 LOG5[81278:134651904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.01.22 22:19:11 LOG7[81278:134651904]: stunnel finished (0 left) If I run stunnel in daemon mode with the debug level set to 7, then the messages are printed to stderr. Shouldn't they go to either syslog, or to the file specified with the "output" option? I dug through the source code and discovered that file_putline() is being called from parse_config() before open_log() has been called. This results in file_putline() writing to stderr instead of the specified output file. If this is known behavior, then it would be nice if the man page mentioned something. -Damian

3 3

rtmps with stunnel
by David Schulberg 24 Jan '08

24 Jan '08

Hi, A while ago I reported an issue with using rtmps on linux to connect to a Red5 server through stunnel. I am having no issues on Windows. The rtmps connection is made from Flash code running in the browser. The error reported on Linux was 'SSL_accept: Peer suddenly disconnected' which occurs straight after 'SSL state (accept): before/accept initialization' . Now I am having a similar problem trying to connect from a MAC. In this case I also get 'SSL_accept: Peer suddenly disconnected' which occurs straight after 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): before/accept initialization 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 read client hello A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write server hello A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write certificate A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write server done A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 flush data It seems to get further on the MAC but still fails. Regards, David

1 0

stunnel with Fedora core
by Andy 16 Jan '08

16 Jan '08

Hello everyone I am trying to configure stunnel on a Fedora Core machine, but have had little luck. The below configuration is in the /etc/stunne/stunnel.conf. I want this machine to send encrypted data to another machine via stunnel. My knowledge of stunnel is quite limited. chroot = /home/stunnel pid = /stunnel.pid setuid = stunnel setgid = stunne; debug = 7 output = /var/log/messages client = yes [ldap] accept = 389 connect = ldap.example.com:636 I have been told that this command will work. stunnel -c -d ldaps -r <LDAPSERVER>:ldaps This command does work under debian but does not work under fedora core. Can anyone help me with this? -- REGARDS, Andy

1 0

Debian Bug#460019: cert= produces output on stderr even with log= set
by Luis Rodrigo Gallardo Cruz 16 Jan '08

16 Jan '08

----- Forwarded message from Bryan Donlan <bd(a)fushizen.net> ----- Version: 3:4.21-1 With the following configuration: output = /srv/stun/log compression = zlib CApath = /srv/stun/keys cert = /srv/stun/server.pem connect = localhost:9999 verify = 3 The following is output on stderr: 2008.01.10 02:54:19 LOG5[11786:3083495088]: Peer certificate location /srv/stun/keys This confuses clients when stunnel is driven direcly from xinetd. This output, if it is produced at all, should be placed in the log file. ----- End forwarded message ----- The issue is that verify_init (verify.c:103) calls s_log(LOG_NOTICE, "Peer certificate location %s", section->ca_dir); apparently before the logfile is setup. Could the log file initialization be moved earlier in the starup sequence? Or maybe this log call's severity could be lowered.

2 6

Nessus crashes stunnel
by Joe Kemp 16 Jan '08

16 Jan '08

I am running some tests against my stunnel configuration with Nessus. I am able to get stunnel to exit silently when I run Nessus with the Nessus TCP Scan and Weak Supported SSL Cipher Suites test. I have played with a few different options but the process consistently ends when these tests are run together. Here is the config: Linux testssl.capwin.net 2.6.18-53.1.4.el5 #1 SMP Fri Nov 30 00:45:16 EST 2007 i686 i686 i386 GNU/Linux gcc version 4.1.2 20070626 (Red Hat 4.1.2-14) stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP OpenSSL 0.9.8b 04 May 2006 Tail of log file during nessus tests 2008.01.15 21:24:30 LOG5[10646:3086605200]: XMPP accepted connection from 10.102.11.250:41781 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL state (accept): before/accept initialization 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL alert (write): fatal: handshake failure 2008.01.15 21:24:30 LOG3[10646:3086605200]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number 2008.01.15 21:24:30 LOG5[10646:3086605200]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.01.15 21:24:30 LOG7[10646:3086605200]: XMPP finished (0 left) 2008.01.15 21:24:30 LOG7[10646:3086608080]: XMPP accepted FD=7 from 10.102.11.250:41782 2008.01.15 21:24:30 LOG7[10646:3086605200]: XMPP started 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 7 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086605200]: TCP_NODELAY option set on local socket 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 8 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 9 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086608080]: Cleaning up the signal pipe 2008.01.15 21:24:30 LOG6[10646:3086608080]: Child process 10676 finished with code 0 2008.01.15 21:24:30 LOG7[10646:3086605200]: Connection from 10.102.11.250:41782 permitted by libwrap 2008.01.15 21:24:30 LOG5[10646:3086605200]: XMPP accepted connection from 10.102.11.250:41782 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL state (accept): before/accept initialization Joe A. Kemp CapWIN Senior Systems Architect 6305 Ivy Lane Suite 300 Greenbelt, MD 20770 (P) 301-614-3727 (F) 301-614-0581

2 1

Re: [stunnel-users] stunnel automatically listening to extra ports: BAD
by Luis Rodrigo Gallardo Cruz 12 Jan '08

12 Jan '08

[You forgot to cc: the list] On Fri, Jan 11, 2008 at 03:24:32PM -0500, Alan Pinstein wrote: > On Jan 11, 2008, at 3:02 PM, Luis Rodrigo Gallardo Cruz wrote: >> On Fri, Jan 11, 2008 at 02:31:58PM -0500, Alan Pinstein wrote: >>> Hi All- >>> [ Stunnel listens on ports it shouldn't ] >>> >>> If I start up stunnel from the command line as "root" or another user >>> even, it only listens on the port listed in the conf file. >> >> Could you have some startup script that's automatically getting run >> with your logrotate scripts? >> > The problem happens the MOMENT stunnel starts. It has nothing to do with > the logrotate scripts. Oh, sorry, I got confused. (/me goes and re-reads the original mail ...) > I've done a bunch of debugging and can't figure out what's going on. > I have only one guess: stunnel automatically listens on any ports > that the process calling stunnel is listening on, in some sort of > attempt to seamlessly add SSL to existing daemons. I can't find any > docs or tell from the source code, but it's the only idea I can't > rule out... All this is in a *nix, right? The following is an educated guess: Open connections are open file descriptors, and fork()/exec() do not close open file descriptors. Thus, stunnel is inheriting the open connection. And, since it knows nothing about it, it does not close it or anything like that. So it's not that it activelly listens on it, but only that it does not bother to stop. You might check this theory by trying to connect to the port *after* apache is shut down. If I'm right you should get no answer at all. So, the solution is to have the file descriptors close when exec'ing stunnel. PHP or apache might have some option somewhere to do that (look for "close on exec" or something similarly named), but if not, you might have to write some sort of wrapper to do it. It's a messy thing, because AFAIK there's no clean way to do it short of for (i = 0; i < [some-hopefuly-large-enough-value]; i++) close(i); where the [large-enough-value] is determined by your system's file descriptor limit and your desire not to loop all the way to 2^32 or something. -- Rodrigo i-think-this-time-i-answered-the-question-asked Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

5 4