March 2013 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 10 Dec '20

10 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Problem with roundrobbin failover mode?
by Matt Wise 01 May '13

01 May '13

I've got dozens of clients connecting with Stunnel to a group of 5 servers. Each system has a config that looks like this: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > delay = yes > sslVersion = TLSv1 > client = yes > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > session = 86400 > debug = 5 > [zookeeper] > accept = 127.0.0.1:2182 > failover = rr > connect = prod-zookeeper:2182 > connect = prod-zookeeper-1:2182 > connect = prod-zookeeper-2:2182 > connect = prod-zookeeper-3:2182 > connect = prod-zookeeper-4:2182 > connect = prod-zookeeper-5:2182 Essentially the first host is a load balancer, and the next 5 are the actual zookeeper hosts so that we can bypass the ELB if its giving us fits. Now what we're seeing is that almost every connection ends up on prod-zookeeper-5. Over and over and over again, our hosts pick the same system each time. We're running Stunnel 4.52: > Clients allowed=8000 > stunnel 4.52 on i486-pc-linux-gnu platform > Compiled/running with OpenSSL 0.9.8k 25 Mar 2009 > Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 Any ideas what might be wrong here? Obviously we want the connections to be *roughly* random across the list of hosts... and if one of the hosts goes down, and the connection fails, we want the stunnel service to try again, and randomly pick a new host. It doesn't really seem to be doing that though. --Matt

3 8

Trying to Upgrade stunnel, but compile isn't working?
by Michael D. Setzer II 03 Apr '13

03 Apr '13

I have been using stunnel for a long time, but was just trying to compile the latest version from source, and it compiles, but doesn't work like the older version, so I must have some option wrong. With the current version on my Fedora 14 machine using the latest version it loads the stunnel ports and works, but the newer version does seem to load or give an error message. I've tested the stunnel from Fedora 16 and Fedora 17, and they work fine with the stunnel.conf to load the settings. Current version info from Fedora 14 system. stunnel 4.34 on x86_64-redhat-linux-gnu with OpenSSL 1.0.0e-fips 6 Sep 2011 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 curve = sect163r2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none The new build does this. stunnel 4.56 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0e-fips 6 Sep 2011 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Global options: debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Have also tried it with --disable-fips With the new version I have to provide the /etc/stunnel/stunnel.conf, but it doesn't load any of the options. Sure it is just a simple configure setting I am missing. Thanks. +----------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor Guam Community College Computer Center mailto:mikes@kuentos.guam.net mailto:msetzerii@gmail.com http://www.guam.net/home/mikes Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +----------------------------------------------------------+ http://setiathome.berkeley.edu (Original) Number of Seti Units Returned: 19,471 Processing time: 32 years, 290 days, 12 hours, 58 minutes (Total Hours: 287,489) BOINC@HOME CREDITS SETI 14305761.074364 | EINSTEIN 10610832.119852 ROSETTA 6726167.419674 | ABC 15903532.519753

2 2

32/64 bit interposition on Solaris
by Norm Jacobs 29 Mar '13

29 Mar '13

I was recently working with stunnel on Solaris and ran across the following code in client.c: putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); This appears to have been put in place to interpose a stunnel version of getpeername() on the downstream application. This works great when libstunnel.so has the same bittedness as the downstream application, but Solaris allows users to install and run both 32 and 64 bit applications on the same system. If the stunnel exectuable is a 32 bit application and the downstream application is a 64 bit application, the runtime linker falls over because of the mismatch with the interposed library. To avoid this problem, stunnel should use LD_PRELOAD_32 and LD_PRELOAD_64 on Solaris. I have put together a patch to client.c that sets both LD_PRELOAD_* environment variables to something that seems to make sense on Solaris, but have used a fairly hacky way of enabling it when I build. The client.c changes that I put together are: # On Solaris, fix stunnel so that the linker know where both the 32 and 64 bit # interposer libraries are. If you use LD_PRELOAD with the wrong bittedness # of interposer, the runtime linker hits a fatal error in trying to load # mismatched ELF objects. # diff -r -u stunnel-4.55.orig/src/client.c stunnel-4.55/src/client.c --- stunnel-4.55.orig/src/client.c 2013-02-28 00:17:58.000000000 -0800 +++ stunnel-4.55/src/client.c 2013-03-21 22:55:21.098479331 -0700 @@ -1096,9 +1096,14 @@ /* just don't set these variables if getnameinfo() fails */ putenv(str_printf("REMOTE_HOST=%s", host)); if(c->opt->option.transparent_src) { - putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); - /* for Tru64 _RLD_LIST is used instead */ +#ifdef MACH64 + putenv("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); + putenv("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so"); +#elif __osf /* for Tru64 _RLD_LIST is used instead */ putenv("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT"); +#else + putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); +#endif } } This adds more appropriate environment variables into the calling environment on Solaris. It still needs some work to integrate better with the build. Anyway, I thought that I would raise the issue and at least offer a direction to work from. I am happy to work with someone on a better resolution to this. -Norm

1 0

use of CRYPTO_NUM_LOCKS
by Norm Jacobs 29 Mar '13

29 Mar '13

A while ago, the Solaris security group noticed that stunnel uses CRYPTO_NUM_LOCKS to size a lock table in the code at compile time. They noted that there is function CRYPTO_num_locks() that can do the same thing at runtime and have requested that the function be used so that FIPS/non-FIPS support can be switched on by users simply using interposition. As a result of this, I put together this patch that switches to code to use the function instead of macro. -Norm # stunnel should use CRYPTO_num_locks() function instead of CRYPTO_NUM_LOCKS # macro. The function interogates libcrypto at run-time for sizing and the # macro at compile time. If you interpose a a version at runtime to switch # between FIPS/non-FIPS support, the lock table may not be sized correctly. # diff -r -u stunnel-4.55.orig/src/sthreads.c stunnel-4.55/src/sthreads.c --- stunnel-4.55.orig/src/sthreads.c 2012-08-09 14:44:18.000000000 -0700 +++ stunnel-4.55/src/sthreads.c 2013-03-21 23:29:34.912001586 -0700 @@ -212,7 +212,7 @@ #ifdef USE_PTHREAD static pthread_mutex_t stunnel_cs[CRIT_SECTIONS]; -static pthread_mutex_t lock_cs[CRYPTO_NUM_LOCKS]; +static pthread_mutex_t *lock_cs; void enter_critical_section(SECTION_CODE i) { pthread_mutex_lock(stunnel_cs+i); @@ -275,13 +275,15 @@ int sthreads_init(void) { int i; + int num_locks = CRYPTO_num_locks(); /* initialize stunnel critical sections */ for(i=0; i<CRIT_SECTIONS; i++) pthread_mutex_init(stunnel_cs+i, NULL); /* initialize OpenSSL locking callback */ - for(i=0; i<CRYPTO_NUM_LOCKS; i++) + lock_cs = calloc(num_locks, sizeof (*lock_cs)); + for(i=0; i<num_locks; i++) pthread_mutex_init(lock_cs+i, NULL); CRYPTO_set_id_callback(stunnel_thread_id); CRYPTO_set_locking_callback(locking_callback);

1 0

SSL VPN configuration confusion
by TJ 27 Mar '13

27 Mar '13

I'm using stunnel v4.56 on Linux (Ubuntu) and trying to configure a routed tunnel in conjunction with pppd. I could do with some help to figure it out - my biggest problem is not knowing what a good connection configuration or log looks like. I've read lots of (old) patchy articles on how it is done but the instructions are either hopelessly out of date, or plain wrong. During extensive trial and error I found what appeared to be bugs in the Ubuntu distro-packaged v4.42 but as I don't yet know what a successful connection log looks like they may have been red herrings. The main issue I was trying to build out of was (on the server): SSL accepted: new session negotiated Negotiated ciphers: ECDHE-RSA-RC4-SHA SSLv3 Kx=ECDH Au=RSA Enc=RC4(128) Mac=SHA1 TTY=/dev/pts/4 allocated Local mode child started (PID=17247) Remote FD=1 initialized TCP_NODELAY: Socket operation on non-socket (88) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket linger (remote): Socket operation on non-socket (88) Service vpn finished (0 left) At this point there would be no pppX interfaces. I created an up-to-date Debian/Ubuntu package for v4.56 which has been more successful. Both ends of the link have the same x86 (i386) package installed. On the server again: stunnel: LOG6[23986:3073268544]: SSL accepted: new session negotiated stunnel: LOG6[23986:3073268544]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-RC4-SHA (128-bit encryption) stunnel: LOG6[23986:3073268544]: Compression: null, expansion: null stunnel: LOG7[23986:3073268544]: TTY=/dev/pts/5 allocated stunnel: LOG6[23986:3073268544]: Local mode child started (PID=23989) stunnel: LOG7[23986:3073268544]: Remote socket (FD=14) initialized stunnel: LOG3[23986:3073268544]: TCP_NODELAY: Socket operation on non-socket (88) stunnel: LOG4[23986:3073268544]: Failed to set remote socket options pppd[23989]: pppd options in effect: pppd[23989]: debug^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: updetach^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: linkname pella^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: ktune^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: unit 3^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: dump^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: nomp^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noauth^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: ^I^I# (from /etc/ppp/options) pppd[23989]: notty^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: crtscts^I^I# (from /etc/ppp/options) pppd[23989]: local^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noaccomp^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: asyncmap 0^I^I# (from /etc/ppp/options) pppd[23989]: nopcomp^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: silent^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: lcp-echo-failure 4^I^I# (from /etc/ppp/options) pppd[23989]: lcp-echo-interval 30^I^I# (from /etc/ppp/options) pppd[23989]: hide-password^I^I# (from /etc/ppp/options) pppd[23989]: novj^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noipdefault^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noccp^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noipx^I^I# (from /etc/ppp/options) pppd[23989]: pppd 2.4.5 started by root, uid 0 pppd[23989]: using channel 19 udevd[2122]: device 0xb7b0a6e8 has devpath '/devices/virtual/net/ppp3' udevd[2122]: created empty file '/run/udev/data/n27' for '/devices/virtual/net/ppp3' pppd[23989]: Using interface ppp3 pppd[23989]: Connect: ppp3 <--> /dev/pts/6 Both ends of the link have ppp interfaces but neither have IP addresses. The server configuration is: ----- /etc/stunnel/pella-vpn.conf ----- CAfile = /etc/stunnel/vpn.pem cert = /etc/stunnel/vpn.pem key = /etc/stunnel/vpn.pem output = /var/log/stunnel-vpn.log #verify = 2 debug = 7 client = no foreground = no [vpn] accept = 109.74.x.y:9876 exec = /usr/sbin/pppd execargs = pppd call pella-vpn 10.254.241.1:10.254.241.2 pty = yes ---------- ----- /etc/ppp/peers/pella-vpn ----- unit 3 notty ktune local noipdefault noccp noauth novj nomp nopcomp noaccomp silent updetach linkname pella debug dump ---------- # ifconfig ppp3 ppp3 Link encap:Point-to-Point Protocol POINTOPOINT NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:3 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) The client configuration is: ---- /etc/network/interfaces ----- # SSL VPN to Pella iface ppp3 inet ppp unit 3 provider pella-vpn pre-up /sbin/ifconfig ppp0 up ---------- ----- /etc/ppp/peers/pella-vpn ----- # ensure we use ppp3 (ppp0-2 are already in use) unit 3 ktune local noipdefault noccp noauth novj nomp nopcomp noaccomp silent updetach logfd 2 linkname pella pty "/usr/bin/stunnel4 /etc/stunnel/pella.conf.vpn" user "tj" # debugging debug dump ---------- ----- /etc/stunnel/pella.conf.vpn ----- pid = /var/run/stunnel4/pella.pid debug = debug output = /var/log/stunnel-pella.log foreground = no client=yes connect = 109.74.x.y:9876 CAfile = /etc/stunnel/vpn.pem # verify the peer's certificate verify = 2 ---------- # ifup ppp3 pppd options in effect: debug # (from /etc/ppp/peers/pella-vpn) updetach # (from command line) logfd 2 # (from /etc/ppp/peers/pella-vpn) linkname pella # (from /etc/ppp/peers/pella-vpn) ktune # (from /etc/ppp/peers/pella-vpn) unit 3 # (from command line) dump # (from /etc/ppp/peers/pella-vpn) nomp # (from /etc/ppp/peers/pella-vpn) noauth # (from /etc/ppp/peers/pella-vpn) user tj # (from /etc/ppp/peers/pella-vpn) # (from /etc/ppp/options) pty /usr/bin/stunnel4 /etc/stunnel/pella.conf.vpn # (from /etc/ppp/peers/pella-vpn) crtscts # (from /etc/ppp/options) local # (from /etc/ppp/peers/pella-vpn) noaccomp # (from /etc/ppp/peers/pella-vpn) asyncmap 0 # (from /etc/ppp/options) nopcomp # (from /etc/ppp/peers/pella-vpn) silent # (from /etc/ppp/peers/pella-vpn) lcp-echo-failure 4 # (from /etc/ppp/options) lcp-echo-interval 30 # (from /etc/ppp/options) hide-password # (from /etc/ppp/options) novj # (from /etc/ppp/peers/pella-vpn) noipdefault # (from /etc/ppp/peers/pella-vpn) noccp # (from /etc/ppp/peers/pella-vpn) noipx # (from /etc/ppp/options) using channel 43 Using interface ppp3 Connect: ppp3 <--> /dev/pts/5 # ifconfig ppp3 ppp3 Link encap:Point-to-Point Protocol POINTOPOINT NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:3 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) # netstat -natp | grep stun tcp 0 0 82.71.a.b:34437 109.74.x.y:9876 ESTABLISHED 24105/stunnel4

1 2

Fw: High memory usage problem.
by mkanet＠yahoo.com 27 Mar '13

27 Mar '13

Jeremy, I know there's an android build of stunnel. Im not trying to be funny, but are you running stunnel on your mobile phone? :) The latest android mobile phones include quadcore CPU's with 2GB's of RAM It would be interesting to see how much of a load a mobile phone can handle with a USB to RJ45 Ethernet interface. Edit: I tried sending this earlier, but it doesn't look like it went through. My apologies in case this is a duplicate. ------------------------ Thanks for taking the time to read this. We're operating on a low spec system that can not be modified at this point. stunnel was introduced at the last minute, without consideration to resource requirements and now consumes enough ram to cause the kernel to issue OOM exceptions. So in short, we are trying to trade increased CPU usage for less memory usage and have tried setting “sessions” to 3600 to reduce memory pressure, but unfortunately it doesn't last. Our current solution is to cron a restart of stunnel on a regular basis, but would prefer to limit number of threads or number of cache entries or something else altogether similarly gentler. Thanks again for your consideration and assistance in this! If there's any specific information I can give, please let me know. Regards, Jeremy

3 7

environment/user variable
by Sebastian Rose-Indorf 26 Mar '13

26 Mar '13

Hello, Stunnel is a very helpful tool. But I miss the support of a environment/user variable to reference the configuration file or the folder of the configuration file: such as %GNUPGHOME% in GnuPG or %OPENSSL_CONF% in OpenSSL. Sebastian

1 0

the range of stunnel functionality
by John A. Wallace 26 Mar '13

26 Mar '13

Where can I find more information about the use and functionality of "tstunnel.exe"? Maybe I am going quite blind, but I looked around unsuccessfully. Thanks. John A. Wallace The pen is mightier than the sword, but only if you get in the first stroke.

3 3