January 2011 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

patch for using stunnel as client with pkcs11-engine and opensc smartcard
by Märt Laak 29 Jan '12

29 Jan '12

Dear stunnel managers, I would like to inform you that there exist some incompatibility with stunnel and openssl pkcs11-engine with external PIN entry device (like RSA smartcard using opensc) in Linux. We use this config to load openssl engine stunnel.conf: --- engine=dynamic engineCtrl=SO_PATH:/usr/lib/engines/engine_pkcs11.so engineCtrl=ID:pkcs11 engineCtrl=LIST_ADD:1 engineCtrl=LOAD engineCtrl=MODULE_PATH:/usr/lib/opensc-pkcs11.so engineCtrl=INIT --- Problem is, with this setup stunnel does not allow user to enter PIN for the secret key. Instead it tries to get secret key without PIN, 3 times (and then therefore usually blocks card PIN) and retires: ---- Initializing engine 1 Engine 1 initialized PRNG seeded successfully Certificate: mart.pem Certificate loaded Key file: id_01 error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect Wrong PIN: retrying error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect Wrong PIN: retrying error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key ENGINE_load_private_key: 800050A0: error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect ---- I discovered workaround that is valid form version 4.26 till current 4.34, as follows, NULL-ing the ui_data.method property in ctx.c: --- diff -cr stunnel-4.34/src/ctx.c stunnel-4.34-patched/src/ctx.c *** stunnel-4.34/src/ctx.c 2010-09-14 18:08:43.000000000 +0300 --- stunnel-4.34-patched/src/ctx.c 2010-09-28 21:56:36.219081931 +0300 *************** *** 304,309 **** --- 304,310 ---- UI_method_set_reader(ui_method, pin_cb); #else /* USE_WIN32 */ ui_method=UI_OpenSSL(); + ui_data.section = NULL; #endif /* USE_WIN32 */ if(section->engine) for(i=1; i<=3; i++) { --- After that patch private key loads correctly: --- Initializing engine 1 Engine 1 initialized PRNG seeded successfully Certificate: mart.pem Certificate loaded Key file: id_01 private key loaded --- It would be nice if: * somebody investigates more precisely why the OpenSSL PIN entry is not showing with unpached stunnel * include my or better patch for this situation Thank you very much for excellent piece of software! With best regards, Märt Laak

2 2

Re: [stunnel-users] Stunnel on the same machine
by subrata＠indiatimes.com 01 Aug '11

01 Aug '11

The configuration files are : pid = /var/stunnel.pid ;chroot = /var/lib/stunnel setuid = nobody setgid = nobody foreground =yes ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept = 3307 connect = 192.168.1.6:3307 On 192.168.1.6 ---------------------- pid = /var/stunnel.pid setuid =nobody setgid = nobody foreground = yes client = no ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept =3307 connect =3306 connecting like /usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307 Enter password: On entring password the following lines appear : ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 Subrata ----- Original Message ----- From: Brian Hatch <bri(a)stunnel.org> To: subrata(a)indiatimes.com Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST) Subject: Re: [stunnel-users] Stunnel on the same machine Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted: > After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there. What do your stunnel configuration files look like? Other problem: mysql client may decide to use a local domain socket when connecting to localhost, thwarting your attempts to go via Stunnel. You might want to 'strace mysql ...' and look for the connect() lines. -- Brian Hatch Time flies like an Systems and arrow. Fruit flies Security Engineer like a banana. http://www.ifokr.org/bri/ Every message PGP signed -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

Stunnel 4.33 released
by Michal Trojnara 22 Apr '11

22 Apr '11

The ChangeLog entry: Version 4.33, 2010.04.05, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 1.0.0. This library requires to c_rehash CApath/CRLpath directories on upgrade. - Win32 DLLs for zlib 1.2.4. - Experimental support for local mode on WIN32 platform. Try "exec = c:\windows\system32\cmd.exe". * Bugfixes - Inetd mode fixed SHA-1 value for stunnel-4.33.tar.gz: 695c7ef834952cb8ddbc790e10b6e32798fc2767 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

4 6

The verify=3 option in client mode
by Philipp Hartwig 09 Apr '11

09 Apr '11

Hello, I'm using stunnel in client mode to provide an SSL connection for offlineimap[1] which does not support verification of SSL certificates. As I've read stunnel does not compare the name of the server offering the certificate to the server name mentioned in the certificate (in the CN field for example). So if I used the following section in my stunnel.conf client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile = /usr/share/ca-certificates/mozilla/Equifax_Secure_CA.crt verify = 2 stunnel would happily accept any certificate signed by Equifax for an arbitrary website. Is this correct? So I've switched to using the verify=3 option and I just want to make sure I configured it correctly. I'm now using the following section client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile= /home/ph/.certs/imaps.pem verify = 3 imaps.pem is a file containing two certificates, namely the first and the last certificate in the certificate chain of imap.gmail.com, that is the Equifax CA certificate and the server certificate itself. I then use offlineimap to establish an unencrypted connection to 127.0.0.1:4322. My understanding is that stunnel will now exclusively accept the server certificate stored in the imaps.pem file rendering all MITM attacks impossible. I'd be grateful if someone could confirm that this setup makes sense. Is this the way the verify=3 option is supposed to use? First I thought that it should be enough to just provide the server certificate in the imaps.pem file, but then openssl would complain about a self-signed certificate, so I included the CA certificate as well. Regards, Philipp [1] https://github.com/jgoerzen/offlineimap/wiki/

2 3

Compiling with ./configure --enable-fips option
by Lewis, Joseph E Sr Mr CTR USA USA 01 Feb '11

01 Feb '11

I am having a problem with compiling with fips enable mode on. The default is suppose to fips enabled but when the configure runs with no options it states that fips is not enabled and the make runs successfully. When I use the –enable-fips option, the configure runs just fine but the make fails with : In file included from common.h:374, from file.c:38: /usr/include/openssl/fips.h:69:2: error: #error FIPS is disabled. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. IBM support assures me that FIPS is enabled. At this point I am stuck and do not know what to do next. Can anyone offer any suggestions? My system, oslevel, ssl level, etc… are as follows: $ uname -a AIX velssi02 3 5 00C866124C00 $oslevel –s AIX 5300-12-02-1036 $ lslpp -l | grep libc bos.rte.libc 5.3.12.2 COMMITTED libc Library bos.rte.libcfg 5.3.12.1 COMMITTED libcfg Library bos.rte.libcur 5.3.11.0 COMMITTED libcurses Library $ gcc -v Using built-in specs. Target: powerpc-ibm-aix5.3.0.0 Configured with: ../configure --with-as=/usr/bin/as --with-ld=/usr/bin/ld --enable-languages=c,c++,java --prefix=/opt/freeware --enable-threads --enable-version-specific-runtime-libs --host=powerpc-ibm-aix5.3.0.0 --target=powerpc-ibm-aix5.3.0.0 --build=powerpc-ibm-aix5.3.0.0 --disable-libjava-multilib Thread model: aix gcc version 4.2.0 $ ssh –V OpenSSH_5.2p1, OpenSSL 0.9.8k-fips 25 Mar 2009 stunnel-4.34 $ /usr/local/bin/stunnel/stunnel -version stunnel 4.32 on powerpc-ibm-aix5.3.0.0 with OpenSSL 0.9.8k-fips 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

2 2

Stunnel to IRC (quakenet)
by s 31 Jan '11

31 Jan '11

Greetings all, I'm trying to set up stunnel for use with IRC for the first time, and everything appears to work dandy until I try to connect to connect to the various servers, I which I receive errors of the following type: 2011.01.31 16:06:39 LOG5[2212:2640]: Service 6001 accepted connection from 127.0.0.1:37345 2011.01.31 16:06:39 LOG5[2212:2640]: connect_blocking: connected 213.131.156.50:6667 2011.01.31 16:06:39 LOG5[2212:2640]: Service 6001 connected remote server from 10.1.4.13:37346 2011.01.31 16:06:40 LOG3[2212:2640]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.01.31 16:06:40 LOG5[2212:2640]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Below is my stunnel.conf: cert = C:\temp\downloads\stunnel\stunnel.pem key = C:\temp\downloads\stunnel\stunnel.pem client = yes [6001] accept = 6001 connect = irc.quakenet.org:6667 [6002] accept = 6002 connect = irc.fu-berlin.de:6667 [6003] accept = 6003 connect = eu.undernet.org:6667 [6004] accept = 6004 connect = irc.servercentral.net:6667 Can anyone explain to me the significance of my error? Thank you very much, S

1 0

malformed packets
by Jean-Yves F. Barbier 31 Jan '11

31 Jan '11

server: xp sp3, 4.34, http-tunnel (192.168.1.251) client: vm virtualbox xp sp3 under Debian Linux sid, 4.34, http-tunnel purpose: secured tunneling of an RDP access =================== Hi list, As I made a wireshark packet analysis, I noticed that *every* packet coming from the server id tagged [Malformed Packet], ie: No Time Source SrcP Destination DstP Protocol 620 37.247880 192.168.1.251 443 192.168.1.26 1062 SSLv3 Info Continuation Data [Malformed Packet] The protocols analyse window says 25% packets are malformed. Could you tell me where it comes from, if it generates extra traffic and if so, how I can fix that? (this setup will be used on a laptop that connect to the internet with a cell phone, so each byte has a cost.) JY -- You will be dead within a year.

1 0

How to define stunnel.conf so openvpn packet will go thru stunnel to as HTTP?
by Guy Sapir 23 Jan '11

23 Jan '11

Hi, >From what I read the examples in stunnel site it possible to wrap VPN's using Stunnel tool. Is it possible to do it for openvpn packets? I can configure thru the openvpn configurations that it packets will go thru port 80 and use TCP but the packets are not http pure. I need to wrap this packets using the stunnel tool. The purpose is to use openvpn over http. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn if possible. Thanks

2 1

s_poll_wait timeout: connection reset
by manoj kumar 19 Jan '11

19 Jan '11

Hi, We have a problem in our production system. Need help to isolate the cause. Want to know whether issue is with stunnel. We are not in situation to upgrade, since we are in production. Your help is appreciated. Environment: 1) Client program(java in win desktops) connect to server (solaris) Stunnel port which is forwarded locally to an inetd program which connects to oracle database. ( 2 Tier Architecture ) 2) Setup worked for almost 2 years without any issue, suddenly since last September, we have connection reset issue on app clients intermittently. 3) almost lots of clients ( in 100's ) get reset and we find 100's of below messages in /var/adm/messages file of solaris. stunnel: [ID 821868 daemon.info] LOG6[21204:5272]: s_poll_wait timeout: connection reset stunnel: [ID 821868 daemon.notice] LOG5[21204:4804]: Connecti on reset: 1867341 bytes sent to SSL, 55211 bytes sent to socket 4) After reset, Client attempt to relogin works without any issue. there is no pattern of load, time, no of users. 5) all the database, inetd program, stunnel runs with oracle userid 6) No other OS related, resource related errors in /var/adm/messages. 7) At this point, i dont have stunnel debug log during the problem occurrence , since we have cron job that recycles logs. if required will send later. 8) Interms of change happend before the first occurance of issue, we did CPU/RAM upgrade, Oracle Database CPU Patch. But database team says no errors reported on oracle side during reset. 9) Max users on database is around 1024, which our max users is 300. ******************************************************************** Config: #/usr/local/bin/stunnel -version stunnel 4.25 on sparc-sun-solaris2.10 with OpenSSL 0.9.7d 17 Mar 2004 (+ security fixes for: CVE-2005-2969 CVE-2006-2937 CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2007-5135 CVE-2007-3108 CVE-2008-5077 CVE-2009-0590 CVE-2009-3555) Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!DHE-RSA-AES256-SHA:!DHE-DSS-AES256-SHA:!AES256-SHA:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------------------------- #uname -a SunOS xxxxxxxxxx 5.10 Generic_144488-02 sun4u sparc SUNW,SPARC-Enterprise --------------------------------------------------------------------- # gcc -v Reading specs from /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/specs Configured with: /sfw10/builds/build/sfw10-patch/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/ccs/bin/as --without-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath) ------------------------------------------------------------------------ # openssl version OpenSSL 0.9.7d 17 Mar 2004 (+ security fixes for: CVE-2005-2969 CVE-2006-2937 CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2007-5135 CVE-2007-3108 CVE-2008-5077 CVE-2009-0590 CVE-2009-3555) ----------------------------------------------------------------------------- # more avaloq.conf ( Ssl config file we use /usr/local/bin/stunnel /opt/app/ssl/stunnel.conf ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/app/ssl/cert.pem key = /opt/app/ssl/cert.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/var/lib/stunnel/ ;setuid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /opt/app/ssl/avaloq_ssl/avaloq.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /usr/local/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /db/avaloq/export/stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [application] accept =7766 connect =localhost:7767 TIMEOUTconnect = 60 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini -------------------------------------------------------------------------------- #netstat -an |grep 7766 |wc -l 249 Regards, kumar

2 5