February 2014 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 10 Dec '20

10 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

behavior change after enabling proxy protocol
by Philippe Anctil 05 Jun '14

05 Jun '14

Hello, We use stunnel to secure a proprietary tcp/ip protocol over the internet. More specifially we have - 1 balancer - 2 stunnel boxes - 1 app server The load balancer 'pings' stunnel boxes regularly to know if one is down. Recently, we have added support for the proxy protocol in our app and turned it on in our stunnel config. It works great except for one small new behavior: upon receiving a load balancer ping, stunnel performs a connection on our app (and sends the proxy header). I ran a tcpdump for a telnet on the stunnel port (8000). With proxy protocol disabled, stunnel does nothing while it waits for the certificate. The connection ended at my request. 17:33:08.537385 IP 127.0.0.1.6015 > 127.0.0.1.8000: S 356922015:356922015(0) win 32792 <mss 16396,sackOK,timestamp 1085620573 0,nop,wscale 7> 17:33:08.537386 IP 127.0.0.1.8000 > 127.0.0.1.6015: S 1525966521:1525966521(0) ack 356922016 win 32768 <mss 16396,sackOK,timestamp 1085620573 1085620573,nop,wscale 7> 17:33:08.537393 IP 127.0.0.1.6015 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085620573 1085620573> 17:33:19.750431 IP 127.0.0.1.6015 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085631785 1085620573> 17:33:19.751065 IP 127.0.0.1.8000 > 127.0.0.1.6015: . ack 2 win 256 <nop,nop,timestamp 1085631786 1085631785> 17:33:19.751794 IP 127.0.0.1.8000 > 127.0.0.1.6015: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085631787 1085631785> With proxy protocol enabled, stunnel establishes a connection to my app and sends the proxy protocol before even receiving the certificate. 17:34:35.370462 IP 127.0.0.1.6026 > 127.0.0.1.8000: S 2949098861:2949098861(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.370475 IP 127.0.0.1.8000 > 127.0.0.1.6026: S 1044893129:1044893129(0) ack 2949098862 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.370481 IP 127.0.0.1.6026 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371035 IP 127.0.0.1.37654 > 127.0.0.1.9000: S 801705083:801705083(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.371046 IP 127.0.0.1.9000 > 127.0.0.1.37654: S 4068822820:4068822820(0) ack 801705084 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.371052 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371583 IP 127.0.0.1.37654 > 127.0.0.1.9000: P 1:44(43) ack 1 win 257 <nop,nop,timestamp 1085707403 1085707402> 17:34:35.371595 IP 127.0.0.1.9000 > 127.0.0.1.37654: . ack 44 win 256 <nop,nop,timestamp 1085707403 1085707403> 17:34:50.484991 IP 127.0.0.1.9000 > 127.0.0.1.37654: F 1:1(0) ack 44 win 256 <nop,nop,timestamp 1085722515 1085707403> 17:34:50.485892 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 2 win 257 <nop,nop,timestamp 1085722516 1085722515> 17:35:08.824661 IP 127.0.0.1.6026 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085740854 1085707402> 17:35:08.824906 IP 127.0.0.1.8000 > 127.0.0.1.6026: . ack 2 win 256 <nop,nop,timestamp 1085740854 1085740854> 17:35:08.824972 IP 127.0.0.1.37654 > 127.0.0.1.9000: R 44:44(0) ack 2 win 257 <nop,nop,timestamp 1085740854 1085722515> 17:35:08.825013 IP 127.0.0.1.8000 > 127.0.0.1.6026: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085740855 1085740854> Note I used 'tcpdump -i lo -nn port 8000 or port 9000' for both traces. I see no good reason to connect to the application before the ssl session is established. Thank you for reading! -- Philippe Anctil

2 2

Weird problem starting stunnel
by Matthew Lunnon 04 Mar '14

04 Mar '14

Hello, Can anyone enlighten me on the following: I have installed stunnel up on my Mac (OS X Lion) and it all runs just fine. When I put this on another machine (OS X Mountain Lion) stunnel refuses to start. I include the output and the stunnel.conf file below. We have some experience of stunnel as we have been using it in both client and server mode on Windows and RedHat for years but none of my colleagues can give me much help here. It looks to me like although stunnel is reporting that it is starting with the correct stunnel.conf file it is actually using something else as: 1) no stunnel.log file is created 2) after successfully seeding the PRNG it seems to be Initializing inetd mode and starting as a service when this should be starting in client mode. (The only way I can get it to do something similar on the machine that works is to remove all the service definitions and put in a line service = SERVICE when it blows up but with a slightly different error about needing an end/connection point (not sure the exact error) and then it fails. Even so in this case it will still create an output log in the correct place) My thoughts are that it might be something to do with the installation process of stunnel that hasn't been followed properly or some kind of permissions issue. Apologies if I am being dim but I am at a bit of a loss to explain what is going on here. I do not have direct access to the second machine and am trying to support it over the phone. Thanks for any help. Matthew ========================================================================== = Here is the output: ========================================================================== Last login: Fri Jan 31 10:44:30 on ttys000 Administrator:~ admin$ cd stunnel Administrator:stunnel admin$ stunnel /Users/admin/stunnel/stunnel.conf Clients allowed=125 stunnel 4.56 on x86_64-apple-darwin11.4.2 platform Compiled with OpenSSL 0.9.8r 8 Feb 2011 Running with OpenSSL 0.9.8y 5 Feb 2013 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:SELECT,IPv6 SSL:ENGINE,OCSP Auth:LIBWRAP Reading configuration from file /Users/admin/stunnel/stunnel.conf Compression not enabled Snagged 64 random bytes from /Users/admin/.rnd Wrote 1024 new random bytes to /Users/admin/.rnd PRNG seeded successfully Initializing inetd mode configuration Service [stunnel]: SSL server needs a certificate str_stats: 2 block(s), 45 data byte(s), 116 control byte(s) Administrator:stunnel admin$ ========================================================================== = And here is the stunnel.conf file: ========================================================================== ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2012 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may useful for troubleshooting) debug = 7 ;output = stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no client=yes sslVersion=SSLv3 output=/Users/admin/stunnel/stunnel.log pid=/Users/admin/stunnel/stunnel.pid ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode ;cert = rwa2012.clientkeycert.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! verify = 2 ;verify = 0 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile CAfile = /Users/admin/stunnel/ca.crt ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** [Gounder] cert = /Users/admin/stunnel/gounder20141401011000.pem accept=8128 connect=311.219.292.173:9876 [Gounder IJ] cert = /Users/admin/stunnel/gounder20141401011000.pem accept=9128 connect=311.219.292.173:9875 -- Matthew Lunnon Technical Consultant RWA Ltd. mlunnon(a)rwa-net.co.uk Tel: +44 (0)29 2081 5056 www.rwa-net.co.uk

2 1

Stunnel use with Juniper VPN
by Nancy Shortall 19 Feb '14

19 Feb '14

Looking for help in planning a point to point VPN between a fixed site and a mobile site. The fixed site currently uses Stunnel and the mobile site must use a Juniper VPN SSG 140 hardware VPN device. Would this configuration be possible?

1 0

Re: [stunnel-users] Compatible with windows 8.1?
by peter 07 Feb '14

07 Feb '14

Is the stunnel compatible with windows 8.1? I am having problems after updating to 8.1 Peter

1 0

DNS SSL tunnel
by Quinn Wood 06 Feb '14

06 Feb '14

Woops, starting with the forwarded ports... 192.168.1.100 UDP/5353 -> VM UDP/53 192.168.1.100 TCP/5353 -> VM TCP/53 192.168.1.100 TCP/5667 -> VM TCP/5667 [...] I am able to get DNS replies using both of dig @192.168.1.100 -p 5353 google.com A dig @192.168.1.100 -p 5353 google.com A +tcp But dig times out when I try to use dig @192.168.1.100 -p 53 google.com A The stunnel server log is here: http://sprunge.us/deLY The stunnel client log is here: http://sprunge.us/ScAC Why this is happening? I notice the three connection attempts which seems like it's relevant to the connection resets.

1 0

DNS SSL tunnel
by Quinn Wood 06 Feb '14

06 Feb '14

I am attempting to tunnel DNS traffic over stunnel using socat. I am following a guide[1] by the German Privacy Foundation. The client is my physical machine and the server is a VirtualBox virtual machine with three ports forwarded: 192.168.1.100 53/UDP My configs for stunnel are an exact match to the ones on the guide, and I am able to get a DNS reply using dig @IP [1] https://www.privacyfoundation.de/wiki/SSL-DNS

1 0

Problem in stunnel log
by sawbona＠xsmail.com 06 Feb '14

06 Feb '14

Good morning: This connection was working perfectly well up until yesterday. Now it fails and I get this text in the log: (date/time snipped for brevity's sake) --- LOG5[648:980]: FIPS mode is enabled LOG5[648:980]: Configuration successful LOG5[648:2448]: Service [gmx-POP3-SSL] accepted connection from 127.0.0.1:1212 LOG5[648:2448]: connect_blocking: connected xxx.xxx.xxx.xxx:995 LOG5[648:2448]: Service [gmx-POP3-SSL] connected remote server from 192.168.1.136:1213 LOG4[648:2448]: CERT: Verification error: self signed certificate in certificate chain LOG4[648:2448]: Certificate check failed: depth=2, /C=DE/O=Deutsche Telekom AG/OU=T-TeleSec Trust Center/CN=Deutsche Telekom Root CA 2 LOG3[648:2448]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed LOG5[648:2448]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket --- What has happened? I have not changed anything ... This is the stunnel.conf bit: --- [gmx-POP3-SSL] client = yes accept = 20995 connect = pop.gmx.net:995 CAfile = peer-gmx-POP3-SSL.pem verify = 3 [gmx-smtp-SSL] client = yes accept = 20465 connect = mail.gmx.net:465 [gmx-IMAP-SSL] client = yes accept = 20993 connect = imap.gmx.net:993 --- Is it 'me' or is it 'them'? Thanks in advance for any input. Best regards.

1 0

Stunnel - how to make Google App Engine HTTP into HTTPS ?
by Shamun Toha Md 06 Feb '14

06 Feb '14

I have Google App Engine running in HTTP (port tcp 80), which is a daemon based service it execute back-end some python instances. Now all that works over HTTP , TCP 80, and Google App Engine itself do not have any kind of HTTPS setup, it has to be organized externally. Therefore, the biggest problem is now that how can i use stunnel to resolve this problem please? I have already tried following setup and it does not work at all. 1) if the user visit https://www.mysite.com then he hit stunnel accept=443 after that he is connected with connect=80 but user browser change into http:// instead of remaining in https:// . Which make the whole thing not working $ uname -a Linux server2 2.6.32-358.23.2.el6.x86_64 #1 SMP Wed Oct 16 18:37:12 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux $ cat /etc/stunnel/stunnel.conf pid = /stunnel.pid cert=/etc/stunnel/abyhu.crt CAfile=/etc/stunnel/abyhu.ca key=/etc/stunnel/abyhu.key sslVersion = all ;socket = l:TCP_NODELAY=1 ;socket = r:TCP_NODELAY=1 client=no debug = 7 output = /var/log/stunnel.log [SSL] accept=443 connect=80 TIMEOUTclose = 0 My goal is: when user visit https://www.mysite.com it remain as https not become http:// then it is not solving the problem cause Google app engine do not have HTTPS Thank you. Best regards

3 4