February 2019 - stunnel-users

Timeout's issue / network stunnel on virtual apps
by Marian Andrei Olteanu 17 Feb '19

17 Feb '19

Hi all, I have a client - server application which works as following. The server is hosted in a linux machine and the clients are up in citrix(XEN) virtual machines. I have enable stunnel encry. in between this environments but i keep getting some connection issues from time to time. To be more clear the client application starts a session for you from the virtual machine (xen) so the stunnel.exe running there in the server is meant to encrypt traffic of around 100 users(from win AD who have access to use that resource in the server) , port configured in VM machine 1001 accept - linux.host:1002 connect with linux accept on 1002 - localhost:1000. the channel opened between the VM and Linux is used by many users simultaneous. Could please tell me what is happening here?Is this architecture able to work? thank you in advance. Marian

1 0

stunnel stopped working today, had to reboot server
by Christopher Schultz 14 Feb '19

14 Feb '19

Hello, I'm new to the list so I'm sorry if this isn't the right place to report this. I had a server stop responding to stunnel connections sometime yesterday and the resolution was ultimately to reboot the server and everything was okay. Restarting the stunnel service was not enough to get things working again. I isolated the problem to stunnel by checking that the underlying service (a Java web application) would respond from the localhost machine (it did) but an openssl s_client connection to localhost:stunnel-port would connect but not proceed past the CONNECTED(3) state. Ultimately, it would time-out. stunnel was not logging anything to syslog when these connections came in. Outgoing stunnel connections seemed to be okay. Looking through the log file, I could see that there were some odd messages coming from stunnel in the daemon.log file suggesting that there might be a memory leak. I won't post them here unless requested, as they may represent a potential security issue. My concern is that a service-restart for stunnel was not sufficient. This suggests a problem which goes deeper than the stunnel service. Is it possible for stunnel to break in such a way that it continues to be broken after a restart? I'm sorry, in retrospect, I was not 100% sure that the service did indeed stop and launch a new process when running /etc/init.d/stunnel restart, but there were no errors and the service-runner did report that the service was restarted. My (simplified) configuration and version information is posted below. Please let me know if there is any other information I might be able to provide in order to investigate this. Note that this is a package-managed version of stunnel, provided by the Debian package-maintainers. Thanks, -chris PS Thanks for a wonderful product. I've relied on stunnel for years to proxy these unencrypted AJP connections for me. Cheers for all your great work. Configuration: === CUT === cert = /etc/stunnel/stunnel.crt key = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4-ajp.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 4 CAfile = /etc/stunnel/stunnel-ajp-trusted.pem [now, a series of 4 services, all configured similarly] accept=public-port connect=localhost:private-port === CUT === Version: stunnel 5.39 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.1.0c 10 Nov 2016 Running with OpenSSL 1.1.0j 20 Nov 2018 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP Global options: debug = daemon.notice pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Linux kernel version: Linux [hostname] 4.9.0-8-amd64 #1 SMP Debian 4.9.130-2 (2018-10-27) x86_64 GNU/Linux This is running on a bare metal server.

2 5

Re: [stunnel-users] Problem with name resolving on Centos 7
by tom 13 Feb '19

13 Feb '19

Hello, > Are you sure 'foobar.remote.site' should resolve? > Does "ping foobar.remote.site" work? yes, the host is resolved on commandline and other services on this system can reach this host. > Do you have a /var/run/stunnel/etc/resolv.conf file? No at this time I dont have this file, but it doesnt change anything if I copy the original from /etc to this lokation. But this brings me to the point try to dissable chroot and in this case stunnel is working as expected. So far so good - there is something wrong in the chroot jail. I try to put it to /var/run/stunnel - no luck, but maybe there are other files missing as well? regards Tom

4 10

Problem with name resolving on Centos 7
by tom 12 Feb '19

12 Feb '19

Hello, I've installed stunnel-4.56-6.el7.x86_64 on my Centos 7. I can't establish a connection. Seems to be something wrong with the name resolution, because if I use the IP derect, the tunnel works. Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526436416]: Service [cs] accepted (FD=3) from 127.0.0.1:10866 Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Service [cs] started Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Waiting for a libwrap process Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Acquired libwrap process #0 Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Releasing libwrap process #0 Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Released libwrap process #0 Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Service [cs] permitted by libwrap from 127.0.0.1:10866 Feb 12 11:58:00 server stunnel[52445]: LOG5[52445:139984526432000]: Service [cs] accepted connection from 127.0.0.1:10866 Feb 12 11:58:00 server stunnel[52445]: LOG3[52445:139984526432000]: Error resolving 'foobar.remote.site': System error returned in errno (EAI_SYSTEM) Feb 12 11:58:00 server stunnel[52445]: LOG3[52445:139984526432000]: No host resolved Feb 12 11:58:00 server stunnel[52445]: LOG5[52445:139984526432000]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Local socket (FD=3) closed Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Service [cs] finished (0 left) stunnel.conf: socket = r:TCP_NODELAY=1 socket = l:TCP_NODELAY=1 options = CIPHER_SERVER_PREFERENCE TIMEOUTclose = 0 sslVersion = TLSv1 options = NO_SSLv2 options = NO_SSLv3 client = yes options = DONT_INSERT_EMPTY_FRAGMENTS cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem debug = 7 chroot = /var/run/stunnel setuid = stunnel setgid = stunnel pid = /stunnel.pid fips = no [srvice] accept = 63123 connect = foobar.remote.site:63123 delay = yes Any suggestions are very welcome! Thanks in advance Tom

3 2

Stunnel 5.50 Transparent Both (Source+Destination)
by Luis Monteiro 01 Feb '19

01 Feb '19

Sirs. I´m trying to make Stunnel work in both source and destination transparent proxy and after looking every possibility I started to track the packet that is locally generated (Stunnel client sending to stunnel server). The packet goes out from process to raw table output chain. It deliveries to connect tracking that pass the packet to mangle output but it disappears before arriving in the nat table output chain. Stunnel Packet destination 7.0.0.2:80(Original destination)------raw/output-----connectTrack------mangle/output-------XXXX disappear With transparent destination off it works fine. Stunnel Packet destination 9.0.0.2:443(Stunnel Server IP)------raw/output-----connectTrack------mangle/output-------nat/output---- filter/output----interface The problem is probably regarding the tproxy/ip_transparent that stunnel use to control the connection and get the original src/dst to use. I tried 3 different distribution of linux with the same behavior. Does someone already use transparent=both and give me a setup that worked link linux distribution/version, stunnel version and so on? Thanks, Luis Monteiro

1 1