December 2014 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 10 Dec '20

10 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

help with xforwarded-for
by Senthil Naidu 30 Dec '14

30 Dec '14

Hi, I am trying to use stunnel 5.08 can we enable xforwarded-for option using some patches , the last patch I see is in haproxy website for version stunnel version 4.32 Regards Senthil

2 1

SSL alert (read): warning: close notify
by Jinming Shao 22 Dec '14

22 Dec '14

I am trying to use stunnel to turn ws into wss. Stunnel is running in client mode. It always got disconnected from remote server. my stunnel configuration: [websocket] client = yes accept = localhost:8676 connect = echo.websocket.org:443 Then I use wsdump.py(https://github.com/liris/websocket-client) to connect it: $ wsdump.py ws://localhost:8676 Handshake status 40 Does anyone know what's wrong? The log file: 2014.12.22 23:13:01 LOG7[4445147136]: Service [websocket] started 2014.12.22 23:13:01 LOG5[4445147136]: Service [websocket] accepted connection from ::1:52132 2014.12.22 23:13:01 LOG6[4445147136]: s_connect: connecting 174.129.224.73:443 2014.12.22 23:13:01 LOG7[4445147136]: s_connect: s_poll_wait 174.129.224.73:443: waiting 10 seconds 2014.12.22 23:13:02 LOG5[4445147136]: s_connect: connected 174.129.224.73:443 2014.12.22 23:13:02 LOG5[4445147136]: Service [websocket] connected remote server from 192.168.1.100:52133 2014.12.22 23:13:02 LOG7[4445147136]: Remote socket (FD=10) initialized 2014.12.22 23:13:02 LOG6[4445147136]: SNI: sending servername: echo.websocket.org 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): before/connect initialization 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write client hello A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read server hello A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read server certificate A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read server done A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write client key exchange A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write change cipher spec A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write finished A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 flush data 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read finished A 2014.12.22 23:13:02 LOG7[4445147136]: 1 items in the session cache 2014.12.22 23:13:02 LOG7[4445147136]: 1 client connects (SSL_connect()) 2014.12.22 23:13:02 LOG7[4445147136]: 1 client connects that finished 2014.12.22 23:13:02 LOG7[4445147136]: 0 client renegotiations requested 2014.12.22 23:13:02 LOG7[4445147136]: 0 server connects (SSL_accept()) 2014.12.22 23:13:02 LOG7[4445147136]: 0 server connects that finished 2014.12.22 23:13:02 LOG7[4445147136]: 0 server renegotiations requested 2014.12.22 23:13:02 LOG7[4445147136]: 0 session cache hits 2014.12.22 23:13:02 LOG7[4445147136]: 0 external session cache hits 2014.12.22 23:13:02 LOG7[4445147136]: 0 session cache misses 2014.12.22 23:13:02 LOG7[4445147136]: 0 session cache timeouts 2014.12.22 23:13:02 LOG7[4445147136]: Peer certificate was cached (6641 bytes) 2014.12.22 23:13:02 LOG6[4445147136]: SSL connected: new session negotiated 2014.12.22 23:13:02 LOG6[4445147136]: Negotiated TLSv1/SSLv3 ciphersuite: RC4-SHA (128-bit encryption) 2014.12.22 23:13:02 LOG6[4445147136]: Compression: null, expansion: null 2014.12.22 23:13:03 LOG7[4445147136]: SSL alert (read): warning: close notify 2014.12.22 23:13:03 LOG6[4445147136]: SSL closed (SSL_read) 2014.12.22 23:13:03 LOG7[4445147136]: Sent socket write shutdown 2014.12.22 23:13:03 LOG6[4445147136]: Read socket closed (readsocket) 2014.12.22 23:13:03 LOG7[4445147136]: Sending close_notify alert 2014.12.22 23:13:03 LOG7[4445147136]: SSL alert (write): warning: close notify 2014.12.22 23:13:03 LOG6[4445147136]: SSL_shutdown successfully sent close_notify alert 2014.12.22 23:13:03 LOG5[4445147136]: Connection closed: 184 byte(s) sent to SSL, 132 byte(s) sent to socket 2014.12.22 23:13:03 LOG7[4445147136]: Remote socket (FD=10) closed 2014.12.22 23:13:03 LOG7[4445147136]: Local socket (FD=3) closed 2014.12.22 23:13:03 LOG7[4445147136]: Service [websocket] finished (0 left) 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 3 block(s), 18446744073709549504 data byte(s), 222 control byte(s) 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 128 byte(s) at network.c:413 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 128 byte(s) at network.c:412 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 128 byte(s) at network.c:41

1 0

RHEL6 Update stunnel-4.29-3.el6_6.1 breaks functionality?
by H.U.Flück 21 Dec '14

21 Dec '14

Hello I realized that the latest RHEL6 updates including stunnel-4.29-3.el6_6.1 break our Stunnel connections! We are forced to go back to previous version stunnel-4.29-3.el6_4 in order to have the systems running again, and blocking Stunnel updates in /etc/yum.conf for the moment. Our typical client config and server configs are as follows: Client (5.08): ********** client = yes compression = zlib sslversion = TLSv1 delay = yes debug = 7 taskbar = yes cert = my.pem [abas_ssh] accept = 127.0.30.10:5303 connect = firewall.client.dom:5303 Server, xinetd.d: ************* service stunnel_ssh { disable = no socket_type = stream instances = UNLIMITED per_source = UNLIMITED wait = no user = root server = /usr/bin/stunnel server_args = /etc/stunnel/stunnel_ssh.conf log_on_success += HOST DURATION log_on_failure += HOST } Server, stunnel_ssh.conf **************** cert = /support/stunnel/cert/server.pem CApath = / support /stunnel/hash/ verify = 3 debug = 7 connect = 192.168.1.100:22 The error thrown is something like: Dec 17 17:30:23 srvabas stunnel: LOG3[3385:140171595282368]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol What are we missing? Do we need to change the configuration? Any help is highly appreciated. Kind regards H.U.Flueck

4 3

Ordinal not found error on new Stunnel install
by Tracy Drake - IQ-C 15 Dec '14

15 Dec '14

Hello Michal! We have just pushed/began to push Stunnel version 5.04 to our user community. This version was extensively tested, pushed/installed on a number of machines both with an older version of Stunnel and no Stunnel at all. We are having a barrage of users encountering the below error. [image: Inline image 1] Can you offer insight/a quick resolution? Bear in mind that although I support the apps that require Stunnel I know very little about the ins and outs of Stunnel. I did google this error and found something to the effect that a newer version of the LIBEAY32.dll is required. Does this perhaps mean that this file did not get replaced on these machines. We were previously running quite an older version - 4.27. Please advise asap! -- Tracy Drake CSM Senior Consultant GSA-FAS CAMEO Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

2 1

building stunnel in FreeBSD
by Mirimir 11 Dec '14

11 Dec '14

In building the stunnel package from the port in FreeBSD 10.1, is it more secure to enable SSL_PORT? In particular, will that ensure that stunnel is using the latest openssl release? And if that is so, why is that build option disabled by default?

1 0

Stunnel PSK authentication
by Michal Trojnara 11 Dec '14

11 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Starting with stunnel-5.09b1 it is now possible to use stunnel without certificates. https://www.stunnel.org/downloads.html Example server configuration is: [PSK server] accept = <stunnel_port> connect = <dst_port> PSKsecrets = psk.txt , where the psk.txt may contain the following lines: test1:oaP4EishaeSaishei6rio6xeeph3az test2:yah5uS4aijooxilier8iaphuwah1Lo Example client configuration: [PSK client 1] client = yes accept = 127.0.0.1:<src_port> connect = <stunnel_ip>:<stunnel_port> PSKsecrets = psk1.txt PSKidentity = test1 The psk1.txt file only needs to contain: test1:oaP4EishaeSaishei6rio6xeeph3az Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlSKHNMACgkQ/NU+nXTHMtE72wCg/EZp4NdVnkrQFffGVWZO65lE QucAn3ddp+yTDruP+gNkevf///0olb1+ =o0k3 -----END PGP SIGNATURE-----

1 0

configure.ac patch
by Kip Walraven 11 Dec '14

11 Dec '14

In case others are struggling with CentOS 6.5 configure issues that I had, I'm providing the following unified diff patch -Kip #============================================== --- ../stunnel-5.08/configure.ac 2014-12-03 05:35:16.000000000 -0500 +++ ./configure.ac 2014-12-11 10:32:47.000000000 -0500 @@ -402,13 +402,13 @@ AC_MSG_RESULT([autodetecting]) # the library name has changed to -lsystemd in systemd 209 AC_SEARCH_LIBS([sd_listen_fds], [systemd systemd-daemon], - AC_CHECK_HEADERS([systemd/sd-daemon.h], [ + [ AC_CHECK_HEADERS([systemd/sd-daemon.h], [ AC_DEFINE([USE_SYSTEMD], [1], [Define to 1 to enable systemd socket activation]) AC_MSG_NOTICE([systemd support enabled]) ], [ AC_MSG_NOTICE([systemd header not found]) - ]), [ + ]) ], [ AC_MSG_NOTICE([systemd library not found]) ]) ] @@ -462,7 +462,8 @@ AC_MSG_CHECKING([for compiler sysroot]) if test "$GCC" = yes; then SYSROOT=`$CC --print-sysroot 2>/dev/null` -else +fi +if test -z "$SYSROOT" ; then SYSROOT="/" fi AC_MSG_RESULT([$SYSROOT]) #==============================================

2 1

Can I run stunnel on TWO computers with the same certificates?
by Ben Stover 09 Dec '14

09 Dec '14

I would like to use stunnel from my DEsktop AND my Notebook. Can I run them in parallel (with the same certificates) or do they confuse each other? Ben

1 0