July 2010 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Re: [stunnel-users] Stunnel on the same machine
by subrata＠indiatimes.com 01 Aug '11

01 Aug '11

The configuration files are : pid = /var/stunnel.pid ;chroot = /var/lib/stunnel setuid = nobody setgid = nobody foreground =yes ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept = 3307 connect = 192.168.1.6:3307 On 192.168.1.6 ---------------------- pid = /var/stunnel.pid setuid =nobody setgid = nobody foreground = yes client = no ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept =3307 connect =3306 connecting like /usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307 Enter password: On entring password the following lines appear : ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 Subrata ----- Original Message ----- From: Brian Hatch <bri(a)stunnel.org> To: subrata(a)indiatimes.com Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST) Subject: Re: [stunnel-users] Stunnel on the same machine Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted: > After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there. What do your stunnel configuration files look like? Other problem: mysql client may decide to use a local domain socket when connecting to localhost, thwarting your attempts to go via Stunnel. You might want to 'strace mysql ...' and look for the connect() lines. -- Brian Hatch Time flies like an Systems and arrow. Fruit flies Security Engineer like a banana. http://www.ifokr.org/bri/ Every message PGP signed -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

Stunnel 4.33 released
by Michal Trojnara 22 Apr '11

22 Apr '11

The ChangeLog entry: Version 4.33, 2010.04.05, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 1.0.0. This library requires to c_rehash CApath/CRLpath directories on upgrade. - Win32 DLLs for zlib 1.2.4. - Experimental support for local mode on WIN32 platform. Try "exec = c:\windows\system32\cmd.exe". * Bugfixes - Inetd mode fixed SHA-1 value for stunnel-4.33.tar.gz: 695c7ef834952cb8ddbc790e10b6e32798fc2767 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

4 6

Honor --sysconfdir and --localstatedir in stunnel.conf-sample.in
by Sebastian Kayser 01 Sep '10

01 Sep '10

Hi, I am packaging stunnel for opencsw.org. Would you guys mind merging a patch [1] to make use of --sysconfdir and --localstatedir (instead of @prefix@/{etc,var}) in the sample configuration file? Currently, if --sysconfdir and --localstatedir are passed to ./configure and are not a directory below prefix, the configuration file doesn't reflect this layout. The patch is against 4.33. Fedora seems to carry the same change [2]. Sebastian [1]http://gar.svn.sf.net/svnroot/gar/csw/mgar/pkg/stunnel/trunk/files/0001-M… [2]http://lists.fedoraproject.org/pipermail/scm-commits/2010-March/413078.ht…

3 4

stunnel and loading keys from hw devices
by Victor Wagner 20 Aug '10

20 Aug '10

Hello, all I've tried to use stunnel with keys on the hardware device, supported by OpenSSL engine and encountered some minor problems: 1. Under Unix systems stunnel doesn't provide UI_METHOD for ENGINE_load_private_key. It passes NULL there and engine complains that no user interface provided. On Unix in many cases default UI_METHOD provided by OpenSSL would do So, replacing line 302 in the ctx.c (line number are given for release 4.33) from uim=NULL ; to uim=UI_OpenSSL(); would significanly improve stunnel functionality. 2. OpenSSL UI objects have two methods to pass arbitraty pointers along 1. generic ex_data based macros UI_set_app_data/UI_get_app_data 2. UI-specific UI_add_user_data/UI_get0_user_data Unfortunately app-specific pointer is set inside engine and retrieved inside a callback, which belongs to application. So author of an engine and author of an application should somehow agree on which metod to use. All engines shipped with OpenSSL (ones which do provide load_private_key method) use UI_add_user_data to pass data to the callback. stunnel's pin_cb (for Win32 version of stunnel in the gui.c) uses UI_get_app_data to retrieve ui_data. I wonder what engine was used when this code was developed and debugged. And it does no check if any meaningful pointer is obtained. I suggest to add following code after line 602 in gui.c: /* if set_app_Data haven't-return anything */ if (!ui_data) ui_data=UI_get0_user_data(ui); /* if still no avail */ if (!ui_data) { s_log(LOG_ERR,"Engine haven't passed our callback data to callback. Sorry!"); return 0; } Or instead of complaining we can use some structure, local to function pin_cb as fallback UI_DATA - just as password buffer, and check if ui_data->section is not NULL before reading ui_data->section->key in the pass_proc (line 543 of gui.c) Thus it would work even with really broken engines which do not pass userdata from ENGINE_load_private_key to UI callbacks at all. ----- End forwarded message -----

2 1

help - SSL bandwidth overhead with using different ciphers
by Slim Ben Mahmoud 30 Jul '10

30 Jul '10

Dear SSL experts, In order to assess the performances of an adaptive security algorithm using SSL, I need to measure the network overhead induced by the establishment of SSL tunnels. The experiment aims to measure the bandwidth consumptions (or throughputs) when SSL tunnels are established using the different ciphers implemented in Stunnel (AES256-SHA or RC4-SHA for instance). Do you think that I have to expect a different throughput when I use different ciphers for every tunnels or the overhead is the pretty much the same? In fact, the first results show no difference between the throughputs no matter the cipher I use. I know that SSL overhead is traditionally measured in delay or latency because of the handshake phase (the encryption process time is negligible on the new CPUs) but this is not what i want to show. I hope that my request is enough clear, let me know if it is not the case. Best regards. --Slim

2 1

Proxy for content filtering
by Raj 29 Jul '10

29 Jul '10

Hi All I want to build a proxy server, which acts as man in the middle proxy. The main intention of application is to do content filtering, whether it is an http or https request. I want to block some specified URL. Can anybody tell me what is the best approach of doing this Thanks, Raj Rajmohan SK

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 72, Issue 2
by TONY WESTENHOFER 07 Jul '10

07 Jul '10

stunnel-users-request(a)mirt.net wrote: >Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > >To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users >or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > >You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of stunnel-users digest..." > > >Today's Topics: > > 1. Re: telnetd and tcp_wrappers (Spence, Thomas Civ 844 CS/SCOX) > 2. change openssl version with configure (Bhavna Jhunjhunwala) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Tue, 6 Jul 2010 08:28:11 -0400 >From: "Spence, Thomas Civ 844 CS/SCOX" <Thomas.Spence(a)pentagon.af.mil> >Subject: Re: [stunnel-users] telnetd and tcp_wrappers >To: "stunnel-users(a)mirt.net" <stunnel-users(a)mirt.net> >Message-ID: > <751B1F405F4AFF4D907BD567538A83FB04FFE0B6DA(a)tequilasunrise.pentagon.ncr.ds.af.mil> > >Content-Type: text/plain; charset="us-ascii" > >2 guys did help me and still no luck... > >Anyone who tried this: > >[tssl] >accept = 992 >exec = /usr/sbin/telnetd > >Let me know... Reason why I am asking you because when I log off the server then stunnel's process stopped running but I want it keep running after logoff. Before I changed 'exec = /usr/sbin/telnetd', it was 'connect = 23' and the stunnel's process ran great and never stop running... Strange. > >I really need your help. Thanks. > >--------------- >Tom Spence >ABIDES SYSTEM SUPPORT >844th CS/SCOX > > > >------------------------------ > >Message: 2 >Date: Tue, 6 Jul 2010 17:41:42 -0400 >From: Bhavna Jhunjhunwala <bhavnaj(a)quantitativebrokers.com> >Subject: [stunnel-users] change openssl version with configure >To: stunnel-users(a)mirt.net >Message-ID: > <AANLkTikGWuO2XbF8-rtOTMyfeHVdeUV8TZGJvmYfKekB(a)mail.gmail.com> >Content-Type: text/plain; charset="iso-8859-1" > >Hi, > >I have stunnel version as below installed on Mac: > >s*tunnel 4.33 on i386-apple-darwin10.2.0 with OpenSSL 0.9.8k 25 Mar 2009* >*Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP* >* * >*Global options* >*debug = daemon.notice* >*pid = /usr/local/var/run/stunnel/stunnel.pid* >*RNDbytes = 64* >*RNDfile = /dev/urandom* >*RNDoverwrite = yes* >* * >*Service-level options* >*cert = /usr/local/etc/stunnel/stunnel.pem* >*ciphers = ALL:!aNULL:!eNULL:!SSLv2* >*session = 300 seconds* >*stack = 65536 bytes* >*sslVersion = SSLv3 for client, all for server* >*TIMEOUTbusy = 300 seconds* >*TIMEOUTclose = 60 seconds* >*TIMEOUTconnect = 10 seconds* >*TIMEOUTidle = 43200 seconds* >*verify = none* > >I would like to upgrade the openssl version to 1.0.0a, so I do >./configure --with-ssl=dir >make >make install > >After make install i get below error: > >*make install* >*Making install in src* >*test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* >* /bin/sh ../libtool --mode=install /usr/bin/install -c 'stunnel' >'/usr/local/bin/stunnel'* >*/usr/bin/install -c stunnel /usr/local/bin/stunnel* >*test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* >* /usr/bin/install -c 'stunnel3' '/usr/local/bin/stunnel3'* >*test -z "/usr/local/lib/stunnel" || ../auto/install-sh -c -d >"/usr/local/lib/stunnel"* >* /bin/sh ../libtool --mode=install /usr/bin/install -c 'libstunnel.la' >'/usr/local/lib/stunnel/libstunnel.la'* >*/usr/bin/install -c .libs/libstunnel.dylib >/usr/local/lib/stunnel/libstunnel.dylib* >*/usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/ >libstunnel.la* >*----------------------------------------------------------------------* >*Libraries have been installed in:* >* /usr/local/lib/stunnel* >* >* >*If you ever happen to want to link against installed libraries* >*in a given directory, LIBDIR, you must either use libtool, and* >*specify the full pathname of the library, or use the `-LLIBDIR'* >*flag during linking and do at least one of the following:* >* - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable* >* during execution* >* >* >*See any operating system documentation about shared libraries for* >*more information, such as the ld(1) and ld.so(8) manual pages.* >*----------------------------------------------------------------------* >*make[2]: Nothing to be done for `install-data-am'.* >*Making install in doc* >*make[2]: Nothing to be done for `install-exec-am'.* >*test -z "/usr/local/share/doc/stunnel" || ../auto/install-sh -c -d >"/usr/local/share/doc/stunnel"* >* /usr/bin/install -c -m 644 'stunnel.html' >'/usr/local/share/doc/stunnel/stunnel.html'* >* /usr/bin/install -c -m 644 'stunnel.pl.html' >'/usr/local/share/doc/stunnel/stunnel.pl.html'* >* /usr/bin/install -c -m 644 'stunnel.fr.html' >'/usr/local/share/doc/stunnel/stunnel.fr.html'* >*test -z "/usr/local/share/man/man8" || ../auto/install-sh -c -d >"/usr/local/share/man/man8"* >*mkdir: /usr/local/share/man/man8: Permission denied* >*make[2]: *** [install-man8] Error 1* >*make[1]: *** [install-am] Error 2* > > > >and when I check the stunnel version it still uses the old ssl version. >Am I doing something wrong here? > >-- >Thanks, >Bhavna >Quantitative Brokers >646 293 1808 > > >DISCLAIMER: >This e-mail and any attachments are for the confidential use of the >intended recipient. If you are not the intended recipient of this >message you are hereby notified that any review, dissemination, >distribution or copying of this message is strictly prohibited. This >communication is for information purposes only and should not be >regarded as an offer to sell or as a solicitation of an offer to buy >any investment product, an official confirmation of any transaction >or an official statement of Quantitative Brokers, LLC. > >E-mail transmissions cannot be guaranteed to be secure or error-free. >Therefore, we do not represent that this information is complete or >accurate and it should not be relied upon as such. > >All information is subject to change without notice. >Quantitative Brokers may, at its discretion, monitor and review the >content of all e-mail communications. >

1 0

problem with "verify=0"
by wujot＠home.pl 07 Jul '10

07 Jul '10

Hello everybody, The basic SSL negotiation requires the exchange of nine SSL messages. If client authentication is required, server can send additional message "certificate request". But this message is optional. I'm using stunnel ver. 4.27 for Win and 4.28 for Linux. In both cases stunnel, working as server, is sending "certificate request" message to the client, regardless of "verify" state, even with "verify=0". When "verify=0", server doesn't care about client's certificate. So, what for server sends this message? The part of my configuration and log is bellow: [test] accept = 60000 connect = 192.168.3.15:4679 client = no ;verify = 0 verify = none ciphers=DES-CBC3-SHA session = 3600 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): before/accept initialization 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 read client hello A 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 write server hello A 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 write certificate A 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 write certificate request A <-------------???!!! 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 flush data 2010.07.07 12:53:42 LOG6[2412:4280]: VERIFY IGNORE: depth=1, /C= .............. 2010.07.07 12:53:42 LOG5[2412:4280]: CRL: verification passed 2010.07.07 12:53:42 LOG5[2412:4280]: VERIFY OK: depth=1, /C= .......... 2010.07.07 12:53:42 LOG6[2412:4280]: VERIFY IGNORE: depth=0, /C= ................ 2010.07.07 12:53:42 LOG5[2412:4280]: CRL: verification passed 2010.07.07 12:53:42 LOG5[2412:4280]: VERIFY OK: depth=0, /C= .......................... 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read client certificate A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read client key exchange a 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read certificate verify A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read finished A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 write change cipher spec A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 write finished A So, my question is: how to remove "certificate request" message from stunnel-as-server negotiation? Regards, Wojtek

1 0

change openssl version with configure
by Bhavna Jhunjhunwala 06 Jul '10

06 Jul '10

Hi, I have stunnel version as below installed on Mac: s*tunnel 4.33 on i386-apple-darwin10.2.0 with OpenSSL 0.9.8k 25 Mar 2009* *Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP* * * *Global options* *debug = daemon.notice* *pid = /usr/local/var/run/stunnel/stunnel.pid* *RNDbytes = 64* *RNDfile = /dev/urandom* *RNDoverwrite = yes* * * *Service-level options* *cert = /usr/local/etc/stunnel/stunnel.pem* *ciphers = ALL:!aNULL:!eNULL:!SSLv2* *session = 300 seconds* *stack = 65536 bytes* *sslVersion = SSLv3 for client, all for server* *TIMEOUTbusy = 300 seconds* *TIMEOUTclose = 60 seconds* *TIMEOUTconnect = 10 seconds* *TIMEOUTidle = 43200 seconds* *verify = none* I would like to upgrade the openssl version to 1.0.0a, so I do ./configure --with-ssl=dir make make install After make install i get below error: *make install* *Making install in src* *test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* * /bin/sh ../libtool --mode=install /usr/bin/install -c 'stunnel' '/usr/local/bin/stunnel'* */usr/bin/install -c stunnel /usr/local/bin/stunnel* *test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* * /usr/bin/install -c 'stunnel3' '/usr/local/bin/stunnel3'* *test -z "/usr/local/lib/stunnel" || ../auto/install-sh -c -d "/usr/local/lib/stunnel"* * /bin/sh ../libtool --mode=install /usr/bin/install -c 'libstunnel.la' '/usr/local/lib/stunnel/libstunnel.la'* */usr/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib* */usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/ libstunnel.la* *----------------------------------------------------------------------* *Libraries have been installed in:* * /usr/local/lib/stunnel* * * *If you ever happen to want to link against installed libraries* *in a given directory, LIBDIR, you must either use libtool, and* *specify the full pathname of the library, or use the `-LLIBDIR'* *flag during linking and do at least one of the following:* * - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable* * during execution* * * *See any operating system documentation about shared libraries for* *more information, such as the ld(1) and ld.so(8) manual pages.* *----------------------------------------------------------------------* *make[2]: Nothing to be done for `install-data-am'.* *Making install in doc* *make[2]: Nothing to be done for `install-exec-am'.* *test -z "/usr/local/share/doc/stunnel" || ../auto/install-sh -c -d "/usr/local/share/doc/stunnel"* * /usr/bin/install -c -m 644 'stunnel.html' '/usr/local/share/doc/stunnel/stunnel.html'* * /usr/bin/install -c -m 644 'stunnel.pl.html' '/usr/local/share/doc/stunnel/stunnel.pl.html'* * /usr/bin/install -c -m 644 'stunnel.fr.html' '/usr/local/share/doc/stunnel/stunnel.fr.html'* *test -z "/usr/local/share/man/man8" || ../auto/install-sh -c -d "/usr/local/share/man/man8"* *mkdir: /usr/local/share/man/man8: Permission denied* *make[2]: *** [install-man8] Error 1* *make[1]: *** [install-am] Error 2* and when I check the stunnel version it still uses the old ssl version. Am I doing something wrong here? -- Thanks, Bhavna Quantitative Brokers 646 293 1808 DISCLAIMER: This e-mail and any attachments are for the confidential use of the intended recipient. If you are not the intended recipient of this message you are hereby notified that any review, dissemination, distribution or copying of this message is strictly prohibited. This communication is for information purposes only and should not be regarded as an offer to sell or as a solicitation of an offer to buy any investment product, an official confirmation of any transaction or an official statement of Quantitative Brokers, LLC. E-mail transmissions cannot be guaranteed to be secure or error-free. Therefore, we do not represent that this information is complete or accurate and it should not be relied upon as such. All information is subject to change without notice. Quantitative Brokers may, at its discretion, monitor and review the content of all e-mail communications.

1 0