January 2012 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

stunnel.conf in %USERAPPDATA%
by Sebastian Rose-Indorf 19 Mar '12

19 Mar '12

Hello, I use Stunnel with Windows. The configuration file "stunnel.conf" and the log file "stunnel.log" are in the %USERAPPDATA%\Stunnel folder. Stunnel starts and works without problems. But the GUI options "Edit stunnel.conf" and "Reload stunnel.conf" do not work. Is remedy possible? Sebastian

2 3

No SSL handshake between stunnel in client mode and SSL server
by Denis Berezhnoy 01 Feb '12

01 Feb '12

Hi guys, I have a quick question. I am trying to use stunnel in client mode to encrypt traffic going to my server. Basically, I have a server which listens for SSL connection. And I have a client which can not do SSL but it needs to communicate with server over SSL. I setup stunnel in client mode to accept unecrypted traffic from client and redirect it to server over SSL. I checked TCP traffic with WireShark between stunnel and my server and I can see that there is no SSL handshake, stunnel makes TCP connection with server and sends some TCP packets but I expect to see SSL handshake. My stunnel conf file is here: [Router] client=yes accept = 192.168.1.121:55555 connect = 192.168.160.168:55443 Can you please comment on this? Best regards, Denis

2 5

Possible use-after-free in stunnel 4.52
by David Shaw 01 Feb '12

01 Feb '12

Hello, I am using stunnel 4.52 in client mode with exec and connect. The client program that stunnel execs periodically exits, and is properly re-started by stunnel, as I have "retry = yes" set. However, after a retry, I occasionally get a segfault inside one of the OpenSSL libraries. It does not happen right away, but once it happens, every retry causes the same segfault. I did some debugging and it seems that what is happening during a retry is that the SSL connection is brought down in client_run(), then is freed via SSL_free(c->ssl). However, it seems that c->ssl is used after this free, for example in connect_local(), which calls SSL_get_peer_certificate(c->ssl). When exec, connect, and retry are all set, client_main() will call connect_local() after client_run() exits. This patch seems to resolve the issue: --- client.c.orig 2012-01-11 10:43:33.000000000 -0500 +++ client.c 2012-01-31 18:02:19.155213010 -0500 @@ -162,6 +162,7 @@ if(c->ssl) { /* SSL initialized */ SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN); SSL_free(c->ssl); + c->ssl=NULL; ERR_remove_state(0); } For completeness, here's my stunnel.conf: client = yes sslVersion = SSLv3 pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 foreground=yes [experiment] connect = x.x.x.x:443 exec = testprog retry = yes David

2 2

stunnel and connection alerts for Windows
by John A. Wallace 31 Jan '12

31 Jan '12

Hello. It would be helpful to me to see a little popup window notification of connections or data transfers made through Stunnel, a small and unobtrusive alert of such kind as not requiring me to open another Window, etc.. One thought I have along these lines is to have the stunnel Log Window to serve this purpose by having a configuration option for it to open in a small window by the system alert toolbar on the bottom right, providing a one-liner or abbreviated rendition of its current logging text. I do not know of a way to make this happen within stunnel itself, but if there is functionality of this sort already available, please advise. Another program that comes to mind with this sort of purpose would be Growl, which allows developers to make plugins to create this effect. http://www.growlforwindows.com/gfw/apps.aspx. Is there anyone else here who would find this useful or who is aware of work along these lines? Thanks. John

2 1

stunnel and local proxies
by John A. Wallace 30 Jan '12

30 Jan '12

Hello. At times I would like to have Stunnel (in Windows OS) running through a proxy on localhost, say, a socks proxy. Based on what I have seen and read here and in the list archives about that, although admittedly I have not yet read every single thread, I am inclined to say that it is not designed to do so easily if at all. Someone even suggested to me that these settings alone would allow running it over a socks proxy on my machine: ; these settings relate to using stunnel through a proxy ;protocol=connect ;protocolHost=127.0.0.1:portXYZ I tested this on my system but it failed to work. On the other hand I have had success using a program like socat for this purpose. Am I correct in thinking that the above settings alone are not going to do it or do I need additional settings with them for this purpose, or is it not going to work with Stunnel alone? Thanks.

1 0

Stunnel configuration to forward IP address
by Rajat Garg 29 Jan '12

29 Jan '12

Folks, I have done a setup where I am using Stunnel to forward incoming HTTPS requests to HaProxy. But, I am unable to get IP address at HaProxy level (determined by looking at logs) - Here is the configuration file for Stunnel - cert = /etc/stunnel/ssl.crt key = /etc/apache2/ssl.key/socialappshq.com.key sslVersion = all chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 CAfile = /etc/apache2/ssl.key/ca.pem output = /var/log/stunnel4/stunnel.log [proxy] accept = 443 connect = 81 TIMEOUTclose = 0 Here is the config file for HaProxy - global log 127.0.0.1 local0 log 127.0.0.1 local1 notice maxconn 4096 user haproxy group haproxy defaults log global option httplog option dontlognull mode http stats enable retries 3 option redispatch maxconn 2000 timeout client 40s # Client and server timeout must match the longest timeout server 40s # time we may wait for a response from the server. timeout queue 40s # Don't queue requests too long if saturated. timeout connect 20s # There's no reason to change this one. timeout http-request 30s # A complete request may never take that long. frontend webfarm_ssl *:81 accept-proxy option httpclose option forwardfor acl is_social hdr_dom(host) -i socialappshq.com use_backend socialappshq_ssl if is_social backend socialappshq_ssl balance roundrobin cookie JSESSIONID prefix option httpchk GET /check.txt HTTP/1.0 server web2 ec2-XX.us-west-1.compute.amazonaws.com:8080 cookie B check inter 2000 rise 2 fall 3 What else should I do so that IP address passes from Stunnel to Haproxy? Your help will be extremely appreciated. Thx Rajat Garg https://www.socialappshq.com

3 3

patch for using stunnel as client with pkcs11-engine and opensc smartcard
by Märt Laak 29 Jan '12

29 Jan '12

Dear stunnel managers, I would like to inform you that there exist some incompatibility with stunnel and openssl pkcs11-engine with external PIN entry device (like RSA smartcard using opensc) in Linux. We use this config to load openssl engine stunnel.conf: --- engine=dynamic engineCtrl=SO_PATH:/usr/lib/engines/engine_pkcs11.so engineCtrl=ID:pkcs11 engineCtrl=LIST_ADD:1 engineCtrl=LOAD engineCtrl=MODULE_PATH:/usr/lib/opensc-pkcs11.so engineCtrl=INIT --- Problem is, with this setup stunnel does not allow user to enter PIN for the secret key. Instead it tries to get secret key without PIN, 3 times (and then therefore usually blocks card PIN) and retires: ---- Initializing engine 1 Engine 1 initialized PRNG seeded successfully Certificate: mart.pem Certificate loaded Key file: id_01 error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect Wrong PIN: retrying error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect Wrong PIN: retrying error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key ENGINE_load_private_key: 800050A0: error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect ---- I discovered workaround that is valid form version 4.26 till current 4.34, as follows, NULL-ing the ui_data.method property in ctx.c: --- diff -cr stunnel-4.34/src/ctx.c stunnel-4.34-patched/src/ctx.c *** stunnel-4.34/src/ctx.c 2010-09-14 18:08:43.000000000 +0300 --- stunnel-4.34-patched/src/ctx.c 2010-09-28 21:56:36.219081931 +0300 *************** *** 304,309 **** --- 304,310 ---- UI_method_set_reader(ui_method, pin_cb); #else /* USE_WIN32 */ ui_method=UI_OpenSSL(); + ui_data.section = NULL; #endif /* USE_WIN32 */ if(section->engine) for(i=1; i<=3; i++) { --- After that patch private key loads correctly: --- Initializing engine 1 Engine 1 initialized PRNG seeded successfully Certificate: mart.pem Certificate loaded Key file: id_01 private key loaded --- It would be nice if: * somebody investigates more precisely why the OpenSSL PIN entry is not showing with unpached stunnel * include my or better patch for this situation Thank you very much for excellent piece of software! With best regards, Märt Laak

2 2

STunnel on Windows (2008R2 Server)
by Skinner, Robert 28 Jan '12

28 Jan '12

I am attempting to use stunnel to encrypt traffic between our backup client (Window2008R2) and our NetApp filer, but I'm not having any luck We would like to use the stunnel to redirect the port 80 calls to the filer (ubfs2.buffalo.edu) to port 443. Be design, the backup client (IBM Tivoli/TSM V6.2.4) makes a call to the Netapp over http.admin interface to tell it to create a snapshot. The filer listens on https.admin (not http.admin), and we don't want to turn on http.admin for security reasons. I've included the stunnel.config file, hosts file, and the output below. If anyone could give us a hand here it would be much appreciated. We tested this config on a Mac laptop and it works just fine, so I would assume that it has something to do with Windows2008R2 Stunnel.config debug = 7 client = yes [snapdiff] accept = localhost:80 connect = 128.205.5.55:443 sslVersion = all hosts 127.0.0.1 localhost ubfs2.buffalo.edu output 7[1596:4336]: No limit detected for the number of clients 2012.01.27 15:16:30 LOG5[1596:4336]: stunnel 4.52 on x86-pc-mingw32-gnu platform 2012.01.27 15:16:30 LOG5[1596:4336]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.01.27 15:16:30 LOG5[1596:4336]: Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 2012.01.27 15:16:30 LOG5[1596:4336]: Reading configuration from file stunnel.conf 2012.01.27 15:16:30 LOG5[1596:4336]: FIPS mode is enabled 2012.01.27 15:16:30 LOG7[1596:4336]: Compression not enabled 2012.01.27 15:16:30 LOG7[1596:4336]: Snagged 64 random bytes from C:/.rnd 2012.01.27 15:16:30 LOG7[1596:4336]: Wrote 1024 new random bytes to C:/.rnd 2012.01.27 15:16:30 LOG7[1596:4336]: PRNG seeded successfully 2012.01.27 15:16:31 LOG6[1596:4336]: Initializing SSL context for service snapdiff 2012.01.27 15:16:31 LOG7[1596:4336]: SSL options set: 0x00000004 2012.01.27 15:16:31 LOG6[1596:4336]: SSL context initialized 2012.01.27 15:16:31 LOG5[1596:4336]: Configuration successful 2012.01.27 15:16:31 LOG7[1596:4336]: Service snapdiff bound FD=396 to 127.0.0.1:80 2012.01.27 15:16:40 LOG7[1596:4336]: Service snapdiff accepted FD=452 from 127.0.0.1:51366 2012.01.27 15:16:40 LOG7[1596:4336]: Creating a new thread 2012.01.27 15:16:40 LOG7[1596:4336]: New thread created 2012.01.27 15:16:40 LOG7[1596:4336]: Service snapdiff accepted FD=460 from 127.0.0.1:51367 2012.01.27 15:16:40 LOG7[1596:4336]: Creating a new thread 2012.01.27 15:16:40 LOG7[1596:4336]: New thread created 2012.01.27 15:16:40 LOG7[1596:5080]: Service snapdiff started 2012.01.27 15:16:40 LOG5[1596:5080]: Service snapdiff accepted connection from 127.0.0.1:51366 2012.01.27 15:16:40 LOG6[1596:5080]: connect_blocking: connecting 128.205.5.55:443 2012.01.27 15:16:40 LOG7[1596:5080]: connect_blocking: s_poll_wait 128.205.5.55:443: waiting 10 seconds 2012.01.27 15:16:40 LOG7[1596:4720]: Service snapdiff started 2012.01.27 15:16:40 LOG5[1596:4720]: Service snapdiff accepted connection from 127.0.0.1:51367 2012.01.27 15:16:40 LOG6[1596:4720]: connect_blocking: connecting 128.205.5.55:443 2012.01.27 15:16:40 LOG7[1596:4720]: connect_blocking: s_poll_wait 128.205.5.55:443: waiting 10 seconds 2012.01.27 15:16:40 LOG5[1596:4720]: connect_blocking: connected 128.205.5.55:443 2012.01.27 15:16:40 LOG5[1596:4720]: Service snapdiff connected remote server from 128.205.4.234:51369 2012.01.27 15:16:40 LOG7[1596:4720]: Remote FD=508 initialized 2012.01.27 15:16:40 LOG3[1596:4720]: SSL_connect: 14077410: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure 2012.01.27 15:16:40 LOG5[1596:4720]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.01.27 15:16:40 LOG7[1596:4720]: Service snapdiff finished (1 left) 2012.01.27 15:16:43 LOG5[1596:5080]: connect_blocking: connected 128.205.5.55:443 2012.01.27 15:16:43 LOG5[1596:5080]: Service snapdiff connected remote server from 128.205.4.234:51368 2012.01.27 15:16:43 LOG7[1596:5080]: Remote FD=480 initialized 2012.01.27 15:16:43 LOG3[1596:5080]: SSL_connect: 14077410: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure 2012.01.27 15:16:43 LOG5[1596:5080]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.01.27 15:16:43 LOG7[1596:5080]: Service snapdiff finished (0 left)

2 1