April 2009 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 10 Dec '20

10 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Re: [stunnel-users] Stunnel on the same machine
by subrata＠indiatimes.com 31 Jul '11

31 Jul '11

The configuration files are : pid = /var/stunnel.pid ;chroot = /var/lib/stunnel setuid = nobody setgid = nobody foreground =yes ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept = 3307 connect = 192.168.1.6:3307 On 192.168.1.6 ---------------------- pid = /var/stunnel.pid setuid =nobody setgid = nobody foreground = yes client = no ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept =3307 connect =3306 connecting like /usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307 Enter password: On entring password the following lines appear : ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 Subrata ----- Original Message ----- From: Brian Hatch <bri(a)stunnel.org> To: subrata(a)indiatimes.com Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST) Subject: Re: [stunnel-users] Stunnel on the same machine Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted: > After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there. What do your stunnel configuration files look like? Other problem: mysql client may decide to use a local domain socket when connecting to localhost, thwarting your attempts to go via Stunnel. You might want to 'strace mysql ...' and look for the connect() lines. -- Brian Hatch Time flies like an Systems and arrow. Fruit flies Security Engineer like a banana. http://www.ifokr.org/bri/ Every message PGP signed -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

Re: [stunnel-users] rewrite Destination: when rewriting Host:
by Brian Hatch 07 Oct '09

07 Oct '09

Sometime near 2007-11-11 00:15 -0500, Marcio Marchini shouted: > Researching online one can see that WebDAV's spec requires that they > check both src and dest URLs for protocol & port. But with some proxies or > SSL fronts like stunnel, only one of the URLs is rewritten, so one goes as > http and the other as https. Here's one person explaining it, much better > than me: http://svn.haxx.se/users/archive-2006-03/0549.shtml Stunnel doesn't currently have the ability to scan and re-write the plaintext. For HTTP redirects it could possibly be implemented (re-write only the response before ^$, and redirects aren't chunked and don't have content lengths to work with, etc) but you'd still need enough HTTP logic to handle keepalives and such. It's not trivial and not likely. Another option would be to have something already HTTP aware doing the rewriting in between stunnel and subversion. A re-writing proxy. Another option would be to use mod_rewrite in apache to rewrite the urls. But the best way would be to just use SSL inside apache and drop stunnel entirely. -- Brian Hatch The best way to accelerate Systems and a Windows machine is at Security Engineer 9.8 meters per second http://www.ifokr.org/bri/ squared. Every message PGP signed

3 2

[PATCH] Fix undefined aliasing in libwrap.c
by Miloslav Trmac 02 May '09

02 May '09

Hello, The attached patch changes the code not to access a part of a char[...] array using an int *, which is undefined in ISO C. Using memcpy() is safe. I would have posted it on in the BTS, but it doesn't allow me even to log in... Thank you, Mirek

3 4

Re: [stunnel-users] stunnel-users Digest, Vol 57, Issue 10
by Brian P Hinz 21 Apr '09

21 Apr '09

>> Does stunnel support the use of the aNULL cipher suites? I can't >> seem to make it work, stunnel just fails with a "no shared >> ciphers" message. I don't think that the problem is with openssl >> or the client, since when I test it with s_server the handshake >> completes. >> > > >Review the default cipher list. > >Do... > >stunnel -version > > >Then edit configuration file ciphers options to suit requirements. I was trying to get stunnel working with anonymous ciphers (SSL_DH_anon_WITH_RC4_MD5_128, etc.) from a java based client and found that s_server succeeded while stunnel failed with the "no shared ciphers" message because it has routines to initialize a temporary DH key in the absence of a certificate. Here's a sloppy patch that just borrows those routines from the s_server source code. This is against an older version of stunnel (RHEL4u7 based system), but the latest version also fails without similar patching. Cheers, -brian # cat /usr/src/redhat/SOURCES/stunnel-4.05-dhe.patch --- stunnel-4.05/src/ssl.c.dhe 2004-01-25 14:26:03.000000000 -0500 +++ stunnel-4.05/src/ssl.c 2009-04-22 00:11:10.000000000 -0400 @@ -236,6 +236,32 @@ return -1; /* FAILED */ } +static unsigned char dh512_p[]={ + 0xDA,0x58,0x3C,0x16,0xD9,0x85,0x22,0x89,0xD0,0xE4,0xAF,0x75, + 0x6F,0x4C,0xCA,0x92,0xDD,0x4B,0xE5,0x33,0xB8,0x04,0xFB,0x0F, + 0xED,0x94,0xEF,0x9C,0x8A,0x44,0x03,0xED,0x57,0x46,0x50,0xD3, + 0x69,0x99,0xDB,0x29,0xD7,0x76,0x27,0x6B,0xA2,0xD3,0xD4,0x12, + 0xE2,0x18,0xF4,0xDD,0x1E,0x08,0x4C,0xF6,0xD8,0x00,0x3E,0x7C, + 0x47,0x74,0xE8,0x33, +}; + +static unsigned char dh512_g[]={ + 0x02, +}; + +static DH *get_dh512(void); + +static DH *get_dh512(void) { + DH *dh=NULL; + + if ((dh=DH_new()) == NULL) return(NULL); + dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL); + dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL); + if ((dh->p == NULL) || (dh->g == NULL)) + return(NULL); + return(dh); +} + static int init_dh(void) { #ifdef USE_DH FILE *fp; @@ -274,6 +300,12 @@ log(LOG_INFO, "Diffie-Hellman initialized with %d bit key", 8*DH_size(dh)); DH_free(dh); +#else + DH *dh=NULL; + log(LOG_INFO,"Using default temp DH parameters\n"); + dh=get_dh512(); + SSL_CTX_set_tmp_dh(ctx,dh); + DH_free(dh); #endif /* USE_DH */ return 0; /* OK */ }

1 0

aNULL ciphers
by Brian P Hinz 20 Apr '09

20 Apr '09

Hi, Does stunnel support the use of the aNULL cipher suites? I can't seem to make it work, stunnel just fails with a "no shared ciphers" message. I don't think that the problem is with openssl or the client, since when I test it with s_server the handshake completes. Thanks, -brian

1 0

Issue resolving path to .conf using DFS and changing from "by name" to "by IP address"
by Peterson, Stephen 17 Apr '09

17 Apr '09

We use stunnel 4.20 and encountered a problem today and hope someone may be able to provide some insight to a solution. Our client machines are all Windows XP machines with stunnel started as a service. Those installs of stunnel have the path to the .conf as part of the path to the executable. The path to the .conf uses a DFS share. Our network administrator changed our DFS share from "by name" to "by IP address" and then the client services could not resolve the location of the .conf file when the services started on the next start up of client machines. Has anyone encountered this before and what did you do to fix it? Thanks for any assistance. Stephen

1 0

error during multithreaded operation
by Dale Kingsbury 13 Apr '09

13 Apr '09

OS: Windows 2003 SP2 SDK: 2003 R2 SDK We have a multithreaded application that uses a REST-style interface to an SSL-enabled UNIX box that only uses AES. I tried using WinHTTP, but unfortunately, AES is broken in the 2003 version of WinHTTP (confirmed by M$). SO, I hook up stunnel, which works fine when I only start one thread, but if I use more than 1 thread, I get the following error in the stunnel.log. Note that the error is on thread 7140, and the connection is immediately closed. I have retry logic that re-starts failed threads, and the restarted thread works the second time. (of course, the first has finished, so it is essentially running by itself.) The other item of interest is that each thread is sending about 500,000 bytes of data in chunks of 16,000 bytes, and my trace shows that it usually fails after having written more than 100,000 bytes successfully. Any suggestions or help would be greatly appreciated... 2009.04.10 13:17:01 LOG7[3016:7040]: SSL state (connect): SSLv3 flush data 2009.04.10 13:17:01 LOG7[3016:7140]: SSL alert (write): fatal: decrypt error <<<<< ----- NOTE FAILS HERE ON thread 7140 2009.04.10 13:17:01 LOG7[3016:7040]: SSL state (connect): SSLv3 read finished A 2009.04.10 13:17:01 LOG7[3016:7040]: 0 items in the session cache 2009.04.10 13:17:01 LOG7[3016:7040]: 20 client connects (SSL_connect()) 2009.04.10 13:17:01 LOG7[3016:7040]: 19 client connects that finished 2009.04.10 13:17:01 LOG7[3016:7040]: 0 client renegotiations requested 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server connects (SSL_accept()) 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server connects that finished 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server renegotiations requested 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache hits 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache misses 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache timeouts 2009.04.10 13:17:01 LOG6[3016:7040]: SSL connected: new session negotiated 2009.04.10 13:17:01 LOG6[3016:7040]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.04.10 13:17:01 LOG3[3016:7140]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed 2009.04.10 13:17:01 LOG5[3016:7140]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.04.10 13:17:01 LOG7[3016:7140]: bycast-write-1 finished (1 left) Configuratation file: ;Stunnel configuration for Acuo. ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client=yes verify=0 ; Service-level configuration [bycast-read-1] accept = 18080 connect = 10.220.8.100:8080 ;ciphers=AES128-SHA:AES256-SHA TIMEOUTclose = 0 sslVersion = TLSv1 Dale Kingsbury Founder - Lead Software Engineer Phone: 651-744-9225 << NOTE new number Fax: 651-730-4231 Cel: 651-592-5204 email: dale(a)acuotech.com <mailto:dale@acuotech.com> RSNA Booth #4980

2 1

Re: [stunnel-users] OpenSSL Vulnerabilities
by Cal Webster 09 Apr '09

09 Apr '09

On Thu, 2009-04-09 at 12:08 -0500, Guy wrote: > Cal Webster wrote: > > > > Do these SSL libraries still require "MSVCR90.dll" from the > > "Visual C++ Redistributables"? > > > > I appreciate the swift response. :-) > > > > > No, the only Microsoft C Runtime Library dependency is MSVCRT.DLL > (see below output) Thank you. I see that. I've also confirmed by uninstalling "Visual C++ Redistributables" and the OpenSSL package from "slproweb.com". The stunnel service starts up and runs fine with the latest stunnel version 4.27b2. -----------[From stunnel.log]----------- 2009.04.09 14:56:11 LOG7[1240:1236]: RAND_status claims sufficient entropy for the PRNG 2009.04.09 14:56:11 LOG7[1240:1236]: PRNG seeded successfully 2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service vnc1 2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service vnc2 2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service vnc3 2009.04.09 14:56:11 LOG5[1240:1236]: stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009 2009.04.09 14:56:11 LOG5[1240:1236]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 2009.04.09 14:56:11 LOG5[1240:1260]: No limit detected for the number of clients 2009.04.09 14:56:11 LOG7[1240:1260]: FD 312 in non-blocking mode 2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept socket 2009.04.09 14:56:11 LOG7[1240:1260]: vnc1 bound to 127.0.0.1:5973 2009.04.09 14:56:11 LOG7[1240:1260]: FD 320 in non-blocking mode 2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept socket 2009.04.09 14:56:11 LOG7[1240:1260]: vnc2 bound to 127.0.0.1:5972 2009.04.09 14:56:11 LOG7[1240:1260]: FD 328 in non-blocking mode 2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept socket 2009.04.09 14:56:11 LOG7[1240:1260]: vnc3 bound to 127.0.0.1:15900 -----------[/From stunnel.log]----------- > > On Tue, 2009-04-07 at 19:34 -0500, Guy wrote: ... > $ listdlls -r stunnel > > ListDLLs v2.25 - DLL lister for Win9x/NT > Copyright (C) 1997-2004 Mark Russinovich > Sysinternals - www.sysinternals.com Thank you for the link. I've downloaded and installed the GUI version, "Process Explorer", on a test machine. I'm pleasantly surprised at its utility and light impact on system resources. One more question please: Will the Win32 binaries at the link you provided <ftp://stunnel.mirt.net/stunnel> keep up fairly closely with the latest OpenSSL releases? With OpenSSL so widely used it is constantly being evaluated for vulnerabilities. When they're found, it is patched quickly but dependent applications are sometimes slow to incorporate patched versions. Thanks again for your excellent help. ./Cal

1 0

Re: [stunnel-users] OpenSSL Vulnerabilities
by Cal Webster 09 Apr '09

09 Apr '09

Thank you Guy! I'll try the Win32 binaries and SSL libraries on a test machine. Do these SSL libraries still require "MSVCR90.dll" from the "Visual C++ Redistributables"? I appreciate the swift response. :-) ./Cal On Tue, 2009-04-07 at 19:34 -0500, Guy wrote: > Cal Webster wrote: > > > To update the OpenSSL libraries you must download and... > > > > > Find OpenSSL v.0.9.8k bins and stunnel-4.27b2-installer > (which includes OpenSSL v.0.9.8k DLLs) at: > > <ftp://stunnel.mirt.net/stunnel> >

1 0