- stunnel-users - stunnel.org

Re: [stunnel-users] installing stunnel on Mac Machine
by William Dockery 26 Jun '15

26 Jun '15

1. I’m an stunnel newbie. 2. I thought I would give the Mac install script a try: downloaded it to ~/Documents, did the chmod, and ran script; looks like it can’t create/find the config file? Is that something I need to do manually? WDDMBPW80336XHAGV:Documents williamdockery$ ./stunnel-5.20b8-osx [ ] Cron started [ ] Clients allowed=125 [.] stunnel 5.20 on x86_64-apple-darwin14.3.0 platform [.] Compiled/running with OpenSSL 0.9.8zd 8 Jan 2015 [.] Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,OCSP [ ] errno: (*__error()) [.] Reading configuration from file /etc/stunnel/stunnel.conf [!] Cannot open configuration file [.] [.] Syntax: [.] stunnel [<filename>] ] -fd <n> | -help | -version | -sockets [.] <filename> - use specified config file [.] -fd <n> - read the config file from a file descriptor [.] -help - get config file help [.] -version - display version and defaults [.] -sockets - display default socket options Thoughts? Thanks, William > > Message: 1 > Date: Thu, 25 Jun 2015 12:48:02 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] installing stunnel on Mac Machine > Message-ID: <558BDC62.9080606(a)mirt.net> > Content-Type: text/plain; charset=utf-8 > > Signed PGP part > On 25.06.2015 08:04, Saurabh Beriwal wrote: > > Is it possible to automate the installation on Mac machine? > > I built an executable for you: > ftp://ftp.stunnel.org/stunnel/stunnel-5.20b8-osx > Just copy to a directory, chmod a+x, and run it. > > Mike > >

1 0

installing stunnel on Mac Machine
by Saurabh Beriwal 25 Jun '15

25 Jun '15

Hi All, I need to install stunnel on Mac machine. If someone has already done this in past , then please share the installation steps with me. Do we need to install anything like loopback adopter in Mac Machine. Regards, Saurabh Beriwal

4 5

How to upgrade OpenSSL version that comes with Stunnel
by Paul Randall 24 Jun '15

24 Jun '15

Hi folks, Can you please tell me the process for swapping out the version of OpenSSL that comes with Stunnel for a newer version of OpenSSL? Is there a quick way to do this or does it require recompiling Stunnel? Thanks. Paul

1 0

Stunnel windows installer
by Deepak Subbanarasimha 22 Jun '15

22 Jun '15

Hi, Is there an MSI installer available for Stunnel version 5.19 ? If so, has anyone tried to call the stunnel MSI installer from an Install shield installer? Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:deepak.subbanarasimha@kewill.com> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

1 0

Re: [stunnel-users] stunnel 5.18 may keep high CPU usage
by Dod 22 Jun '15

22 Jun '15

Hello Michal, Same problem with 5.19b4 and nothing special in the logs. Now I know how to reproduce the problem instantly, I just have to put my computer in StanBy mode and Awake it. Using Process Explorer from Sysinternals I see that stunnel produce a permanent "Other I/O" flow when problem appear. I/O Other : "The rate at which the process is issuing bytes to I/O operations that do not involve data such as control operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os." OtherI/O is confirmed by Process Monitor that trace no File nor Registry nor Network activity. But as stunnel still respond correctly to a Quit menu or any other menus and SSL requests I assumed that it may be some Thread going crazy so I compared running thread between normal stunnel behavior with the 25% CPU behavior and found that in fact there is a thread that do no terminate correctly. Here is the Thread's stack : MSVCR90.dll!_endThread+0x7d ntoskrnl.exe!memset+0x61a ntoskrnl.exe!KeWaitForMultipleObjects+0xd52 ntoskrnl.exe!KeWaitForSingleObject+0x19f ntoskrnl.exe!PoStartNextPowerIrp+0xba4 ntoskrnl.exe!PoStartNextPowerIrp+0x1821 ntoskrnl.exe!PoStartNextPowerIrp+0x1a97 ntoskrnl.exe!KeReleaseInStackQueuedSpinLock+0x5a afd.sys+0x61c1c afd.sys+0x51d3b ntoskrnl.exe!NtMapViewOfSection+0x15b7 ntoskrnl.exe!NtDeviceIoControlFile+0x56 ntoskrnl.exe!KeSynchronizeExecution+0x3a23 wow64cpu.dll!TurboDispatchJumpAddressEnd+0x6c0 wow64cpu.dll!TurboDispatchJumpAddressEnd+0x1fb wow64.dll!Wow64SystemServiceEx+0x1ce wow64.dll!Wow64LdrpInitialize+0x42a ntdll.dll!RtlIsDosDeviceName_U+0x1f5c4 ntdll.dll!LdrInitializeThunk+0xe ntdll.dll!NtDeviceIoControlFile+0x15 WS2_32.dll!select+0x9f stunnel.exe!OPENSSL_Applink+0xd3ec stunnel.exe!OPENSSL_Applink+0x961 Hope it help... regards. MT> Please try stunnel 5.19b4: MT> https://www.stunnel.org/downloads.html

2 2

Fwd: Disabling window server service
by Saurabh Beriwal 22 Jun '15

22 Jun '15

Hi All, I am using stunnel to connect with SAMBA server and getting error in binding with server. Please let me know if it is mandatory to disable window server service for using stunnel. Also i would appreciate if some one can share knowledge\articles on window to SAMBA server connectivity through stunnel. Thank you. Regards, Saurabh Beriwal

1 0

Generate CONNECT
by reiner otto 22 Jun '15

22 Jun '15

I have following problem: I want to avoid the user to explicitly specify a https-proxy in his browser. Let me explain: For http, a transparent proxy can be interfaced via iptables DNAT, for example.Same for https will not work, without certificates installed etc.However, I only want some basic info about the https-session, like traffic volume or destination domain. In case, there is an explicit https-proxy defined in the browser, I can get this info from the connect request, preceding the secure data exchange.But I want to avoid this explicit declararion. Most likely I will need some custom programming for this, but may be there is a specialist here to give some direction.

2 2

Default Ciphers
by Clayton Keller 17 Jun '15

17 Jun '15

Looking at the Changelog I see the following from the 5.15 info: "MEDIUM ciphers (currently SEED and RC4) are removed from the default cipher list." And this from the 5.00 info: "Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2" due to AlFBPPS attack and bad performance of DH ciphersuites." Given these to comments would it be accurate to say that the current default "ciphers" value is: "HIGH:+3DES:+DH:!aNULL:!SSLv2" Also, some of the docs indicate what the default value currently is. Is there an easier way to determine that value via CLI or other means? Thanks Clay

2 1

stunnel 5.18 may keep high CPU usage
by Dod 17 Jun '15

17 Jun '15

Hello, I use sTunnel for years and ujpdated from 5.17 to 5.18 on my Win7 64bits. I use sTunnel for POP-SSL and SMTP-SSL for 12 accounts (gmail, yahoo ...) but I noticed that after a few connexions sTunnel may keep high CPU, 25% as reported by TaskManager (50% on core 1 and 3 on my Core-i5 quad-core). The problem, may appear after 10 cnx sometime more. The reading order the POP-S accounts that are checked do not matter. The POP accounts are never high loaded I mean I do not receive tons of e-mails and they are not oversized. Sometime the 25% CPU usage disappear by its own, sometime it can stay forever. Never noticed such problem on previous versions. Standard logs show nothing special. regards.

3 10

Stunnel 5.17 builds, 5.18 does not - AIX 6.1 - pod2man does not accept "-v"
by Rob Lockhart 17 Jun '15

17 Jun '15

Michal, I was able to build Stunnel 5.17 on AIX 6.1 using the "build" command, after completely removing the entire section for "-fstack-protector" in "configure" (my "stunnel-5.17.patch" file below). I used the following commands: mkdir $HOME/stunnel-bin-5.17 gzip -dc stunnel-5.17.tar.gz | tar xvf - patch -p0 <stunnel-5.17.patch cd stunnel-5.17 chmod 755 configure; ./configure --prefix=$HOME/stunnel-bin-5.17 make; make install However, for 5.18, those same commands (and patch file) no longer result in a successful compile due to AIX 6.1 not accepting the "-u" (Unicode) for pod2man. I looked into 5.17 and it looks like the same Makefiles are used in both (doc/Makefile.in and doc/Makefile.am) so perhaps the top-level Makefile for 5.18 adds the ".pod.8" file to the build process. Removing the "-u" in both files enables the build to complete. I just tested against Stunnel 5.19 but it looks like the step that ran "pod2html" was skipped by default (i.e., just "make") so I am able to compile stunnel correctly. Thanks for fixing this in Stunnel 5.19! For those that need the .pod.8 man pages on AIX 6.1, you'll need to remove the "-u" in the pod2man command. Regards, -Rob

2 1

stunnel 5.19 release
by Michal Trojnara 16 Jun '15

16 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.19 of stunnel. The ChangeLog entry: Version 5.19, 2015.06.16, urgency: MEDIUM: * New features - OpenSSL DLLs updated to version 1.0.2c. - Added a runtime check whether COMP_zlib() method is implemented in order to improve compatibility with the Debian OpenSSL build. * Bugfixes - Improved socket error handling. - Cron thread priority on Win32 platform changed to THREAD_PRIORITY_LOWEST to improve portability. - Makefile bugfixes for stunnel 5.18 regressions. - Fixed some typos in docs and scripts (thx to Peter Pentchev). - Fixed a log level check condition (thx to Peter Pentchev). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0b543242cf26649acfdd9f00de564c3e8de7ac2237d53935ffdc7eb24f4d556d stunnel-5.19.tar.gz 310fb015c3884dd19a1905ed84d5fbcd1579507c98ee2ba43955aa45311bc056 stunnel-5.19-installer.exe 990e636a869f4de8a55c43e7f2fa24ebbf81c1c221473106e8e6b5d89d720627 stunnel-5.19-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVgCeVAAoJEC78f/DUFuAUi98P/1cPUAg1ehgZkDXIxwIxTt/t sxYOWEmX/ajmimornRygim9HHGPB4HzDMFu1B1qCT01GE4uR+ogYZMYJAdZ+LRua J0wuDawuKgnJvWpdDGnX4Mfz/zUcV8L4T4iJvBnC8xXTQeto7+qU9YTmbYhms4xy u1CPpAXUHnwrNMkI5nqBtB8TSIEeHgmfS456/7oe9Kl+0F8hq7FkZ+1/IYxQOAPC 0drl8A8tfUroBiw+aI2aWJAq2gUoQFVpyAYi7IUBXnmGZ7H1CMcO+KpG+33L0glH oz5DxsuzHyYZYWD1NiKfre4QxMHrT9xXWoNQIHkwgEjDlQXTAqd5rhz9b13TjMmn hiHG3XtF+FvSwFJeTNk/yVYe8ZvjbXUS3BWS65HqTiRKx0iEtkkf2Z1VsieVMUGO LiWvxztz9Z4OSIUWxOFcC8WLTlIDTcIqMM79JLC33o22YSwIRqsE7u5mGiG6yZBN s78ILkqXauxQ1MSDXPArOIZr6iJIqHtuAJbnZvmAQwSKbks/gnzY4WAX0SAw9M64 hhbEnr+zsiRSq30uGrU7fxFHr4MynagEiNaAbNG2kQEJ4nSgHoY0W59dXAuVVYFM UtYgsEeMnPlaBij+ecgmk/xfpEZDQ/phaHtTKzTQUE3JWLkB/VsLz1gwZO1poH8e dOuvm5RULY29YlHcEoM+ =V456 -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] stunnel 5.18 may keep high CPU usage
by Dod 14 Jun '15

14 Jun '15

Hello Michal, MT> for developers, so don't worry if you don't understand all of the output. After 5 hours of 25% CPU I decided to stunnel (again) with debug=info 2015.06.14 19:15:10 LOG6[cron]: Executing cron jobs 2015.06.14 19:19:39 LOG5[cron]: DH parameters updated 2015.06.14 19:19:39 LOG6[cron]: Cron jobs completed in 269 seconds This time DH calculation ran for 4 minutes, which is the expected behavior. btw I am developer too so no problem with the log file ;-) regards. MT> -----BEGIN PGP SIGNED MESSAGE----- MT> Hash: SHA1 MT> Hi Dod, >> 2015.06.14 10:55:06 LOG5[cron]: DH parameters updated >> >> btw if there is some message to tell about DH calculation >> ended, shouldn't be one to say that DH calculation started ? >> this could be usefull. MT> I have added logging it while replying the previous email. 8-) >> Is there some interesting higher log level I could activate to >> get more (but not too much) logs that may help me to >> understand this strange behavior ? MT> Yes. Use "debug = info" or "debug = debug". The latter is intended MT> for developers, so don't worry if you don't understand all of the output. MT> Best regards, MT> Mike MT> -----BEGIN PGP SIGNATURE----- MT> Version: GnuPG v1 MT> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ MT> iQIcBAEBAgAGBQJVfasGAAoJEC78f/DUFuAU78MP/2WTHetqYubWkhEC9OykxVji MT> rTcps69fyE+904T/sSkRWoEiZFX2MFkQQuIwHsVuRdQecxhfqOGmj5R8xpDJQPBB MT> HsT/G/xgCRqCmWbO0HlQg2Tz5td9gsfIRJi9g1T8dHkImUXQUNC2gcqRowmMvcKx MT> Ly2YF8opHZZwA/p305hjuKM6+ziXn7eLdW0yp24LTfXxZigr0QiWvmMjtxhhJ7P0 MT> UgywVTKFBJ1/mJw1TXArOrk/sFiynooLLbYIEhS2rsyXo9m2UHCIRnbvwI9iXCuz MT> foiTPjFRtkWKSsKkcFXHIRpXD3WP07XjtaIzP2XyyK7JVFAsUQNhIBJBBUATJ18r MT> GtzyRIU/zHbmbL/jem9AJkyuw+eQ5E65QhA5eTI8fAKcceFmCq7Pu/HsN1Zk3enV MT> l6NbHSuY0eyvChQ44dzM4UyiNNMBFJczfmPbM5KdwbvLHHtxvbdlLH81HAe7TmVK MT> JuxHVYHZma9PZ/+19dhScl785Ae1TxoCRab9HeShhC6SFdPZ4HV4mZHleYMNCZvP MT> f7d75qDHQZYxZhunP9xqcsoHdhY1rTO0AWZC9TMER+0jbqCcpdEzMaD2L2F8glP2 MT> PUR2StD1EHlVlpzVZL63EJK0vi91dwI/AUiuoolhPkSRtxEwGUc+eNYKcBru8Ca+ MT> O+3Sq6GcWknVd6xu+fNs MT> =ucCs MT> -----END PGP SIGNATURE----- mailto:dodfr@yahoo.com

1 0

stunnel 5.18 release
by Michal Trojnara 12 Jun '15

12 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.18 of stunnel. The ChangeLog entry: Version 5.18, 2015.06.12, urgency: MEDIUM: * New features - OpenSSL DLLs updated to version 1.0.2b. https://www.openssl.org/news/secadv_20150611.txt - Added "include" configuration file option to include all configuration file parts located in a specified directory. - Log file is reopened every 24 hours. With "log = overwrite" this feature can be used to prevent filling up disk space. - Temporary DH parameters are refreshed every 24 hours, unless static DH parameters were provided in the certificate file. - Unique initial DH parameters are distributed with each release. - Warnings are logged on potentially insecure authentication. - Improved compatibility with the current OpenSSL 1.1.0-dev tree: removed RLE compression support, etc. - Updated stunnel.spec (thx to Bill Quayle). * Bugfixes - Fixed handling of dynamic connect targets. - Fixed handling of trailing whitespaces in the Content-Length header of the NTLM authentication. - Fixed --sysconfdir and --localstatedir handling (thx to Dagobert Michelsen). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0532c0a2f8de3da1ab625e384146501ce5936fac63d01561c3a9bf652b692317 stunnel-5.18.tar.gz 9b9a64f30d4dc72f19a2f6482f5bcf76bb67cf3dd859bdd615e0345e1bb8dd41 stunnel-5.18-installer.exe a73befed476f423dee0ff25f38449570fb9f6a07ab90321d9c38e3962f833939 stunnel-5.18-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVeuE3AAoJEC78f/DUFuAU88wP/jfyOCsCBwCcIxNoQhEU5k4d mczXvWtaw0gBrOivrzgBZS0w621D66DGoXt6yMwMp1suWY9spTWZ+VjQJM8oFCul iFwYWyFyxiTOGRFXGCPEff8f4OGbGoxHfDaIrHR5AGvTzguznKTDXzM7cjixqWF9 vL/t08ZjoDWOZIVJuN8M9sVQWn7gzPnyJpvpW2D240aITBx348ZWt/QGqX4yOSzL tQCojXRO6W+rOq0WUdeDFp7CAMB7IZgZsZljqOUn4Q0wHgzuar0Kq1ZLQEkgoX5V lGJ99yZ74/H1RUDcVKGrdksX0atuf6SfzbTvZ/Osp0z7/NlWzhbCt6emYpSLxyzr 2IMX4T8Y593rDovT6AjOb2D4W0sJqAMfUMrs7+T43lYvEbQY8CoEBOH2St5h6X7Y 2ZIa1XMvMmaN08/QyUq6WqxEz0se9BPtUCC+oFjDlGw0oWrqKs1zzJAIpg0HHPOy j1NpBVPnuZz1WlTT/oGLIIVm6w8wATSKthIXstNtofXpSvJ1J94UntC3+0xga7KD SzaOm9w9kpDEtD0EwArLwak5cSevzdXQR4xfmU5OK/UohsdyTLBOab6iY3htmokk JOWIKZztATN7dq8YGvMfJvIiM1ij8Eg14wsahlwfwMZ+eGSvS5lTWvYsSirnnNFi XTrCfpnrKgrfLkUXhbtH =CdmE -----END PGP SIGNATURE-----

1 0

TLS version
by Deepak Subbanarasimha 11 Jun '15

11 Jun '15

Does Stunnel version 4.1 support sslVersion "TLSv1.2 " and above? If not, what version of stunnel supports "TLSv1.2" Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:deepak.subbanarasimha@kewill.com> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

2 1

INTERNAL ERROR: s_poll_wait returned 1, but no descriptor is ready
by Florian Gossin 10 Jun '15

10 Jun '15

HI, I'm trying to setup a connection from JDBC to pgbouncer through stunnel. Unfortunately, I get the above error message when I try to connect. Here are the logs from stunnel: 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read client certificate A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read client key exchange A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read certificate verify A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read finished A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 write change cipher spec A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 write finished A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 flush data 2015.06.09 16:56:13 LOG7[3]: 4 server accept(s) requested 2015.06.09 16:56:13 LOG7[3]: 4 server accept(s) succeeded 2015.06.09 16:56:13 LOG7[3]: 0 server renegotiation(s) requested 2015.06.09 16:56:13 LOG7[3]: 0 session reuse(s) 2015.06.09 16:56:13 LOG7[3]: 3 internal session cache item(s) 2015.06.09 16:56:13 LOG7[3]: 0 internal session cache fill-up(s) 2015.06.09 16:56:13 LOG7[3]: 0 internal session cache miss(es) 2015.06.09 16:56:13 LOG7[3]: 0 external session cache hit(s) 2015.06.09 16:56:13 LOG7[3]: 0 expired session(s) retrieved 2015.06.09 16:56:13 LOG6[3]: SSL accepted: new session negotiated 2015.06.09 16:56:13 LOG6[3]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES256-SHA (256-bit encryption) 2015.06.09 16:56:13 LOG7[3]: Compression: null, expansion: null 2015.06.09 16:56:13 LOG6[3]: Failover strategy: round-robin 2015.06.09 16:56:13 LOG6[3]: s_connect: connecting 127.0.0.1:46432 2015.06.09 16:56:13 LOG7[3]: s_connect: s_poll_wait 127.0.0.1:46432: waiting 10 seconds 2015.06.09 16:56:13 LOG5[3]: s_connect: connected 127.0.0.1:46432 2015.06.09 16:56:13 LOG5[3]: Service [pgbouncer-client] connected remote server from 127.0.0.1:54633 2015.06.09 16:56:13 LOG7[3]: Remote socket (FD=9) initialized 2015.06.09 16:56:13 LOG6[3]: Read socket closed (read hangup) 2015.06.09 16:56:13 LOG7[3]: Sending close_notify alert 2015.06.09 16:56:13 LOG7[3]: SSL alert (write): warning: close notify 2015.06.09 16:56:13 LOG6[3]: SSL_shutdown successfully sent close_notify alert 2015.06.09 16:56:13 LOG3[3]: INTERNAL ERROR: s_poll_wait returned 1, but no descriptor is ready 2015.06.09 16:56:13 LOG5[3]: Connection reset: 58 byte(s) sent to SSL, 164 byte(s) sent to socket 2015.06.09 16:56:13 LOG7[3]: Remote socket (FD=9) closed 2015.06.09 16:56:13 LOG7[3]: Local socket (FD=8) closed 2015.06.09 16:56:13 LOG7[3]: Service [pgbouncer-client] finished (0 left) In pgbouncer, I get the following error: Pooler Error: bad packet header: '70' And in JDBC, the following exception: GRAVE: ERROR: bad packet header: '70' org.postgresql.util.PSQLException: ERROR: bad packet header: '70' Where might be the problem ? Does the stunnel parameter protocol=pgsql work with JDBC ? Thank you

2 1

How to tell what Ciphers are supported?
by Del Benjamin 06 Jun '15

06 Jun '15

I am using the pre-compiled windows binary version of stunnel in client mode, how do I tell on that version what cipher versions I can use? Essentially the equivalent of this command in openssl *openssl* *ciphers* [*-s*] [*-v*] [*-V*] [*-ssl3*] [*-tls1*] [*-stdname*] [ *cipherlist*]

2 2

Rework "Honor --sysconfdir and --localstatedir in stunnel.conf-sample.in"
by Dagobert Michelsen 01 Jun '15

01 Jun '15

Hi, I took the liberty of reworking the patch presented in http://www.stunnel.org/pipermail/stunnel-users/2010-July/002711.html to fix the issues raised in http://www.stunnel.org/pipermail/stunnel-users/2010-August/002719.html The main reason why the substitution didn't work is because it should not be done during configure-time but inside the Makefile as described in the Autoconf manual http://www.gnu.org/savannah-checkouts/gnu/autoconf/manual/autoconf-2.69/htm… The patch is attached to this email or you can browse the patch at https://github.com/dago/stunnel/compare/master...sysconfdir The patch is against 5.18b3 (is there a public repo available to make patches?) It would be great if the change could be applied. Best regards -- Dago

2 6

Incompatibility - Content-length parsing
by Marcin Gryszkalis 25 May '15

25 May '15

Hi, I noticed that parsing of HTTP header fields is not robust enough and not RFC compliant - and that way it casues incompatibility with Microsoft TMG proxy with NTLM authentication. The symptom is "Proxy-Authenticate: Invalid Content-Length" message while the header received is "Content-Length: 0 " <- note trailing spaces. The responsible piece of code is in protocol.c: if(tmpstr==line+16 || *tmpstr || content_length<0) { (tmpstr contains trailing spaces in this case). According to RFC 7230 trailing space is allowed and should be discarded by parser: A field value might be preceded and/or followed by optional whitespace (OWS); a single SP preceding the field-value is preferred for consistent readability by humans. The field value does not include any leading or trailing whitespace: OWS occurring before the first non-whitespace octet of the field value or after the last non-whitespace octet of the field value ought to be excluded by parsers when extracting the field value from a header field. best regards -- Marcin Gryszkalis, PGP 0xA5DBEEC7 jabber jid:mg@fork.pl

2 3

Compiling for Android
by Pio Tofanelli 21 May '15

21 May '15

Hi, I'm new to stunnel and I'd like to compile it to ARM and x86 platforms. I downloaded the stunnel-5.17 package and I'm using the build-android.sh and android-ndk-r10e script to compile it: ../../configure --with-sysroot=/home/ptofanelli/android-ndk-r10e/platforms/android-18/arch-arm/ --build=i686-pc-linux-gnu --host=arm-linux-androideabi --prefix=/data/local I'm getting the message "The C compiler cannot create executables" and checking the logs I've found that the problem is this: configure:3538: arm-linux-androideabi-gcc conftest.c >&5 /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot open crtbegin_dynamic.o: No such file or directory /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot open crtend_android.o: No such file or directory /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot find -lc /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot find -ldl collect2: error: ld returned 1 exit status I searched for this problem and a topic in stackoverflow ( http://stackoverflow.com/questions/16795583/android-error-cannot-open-crtbe…) is said that the problem is the sysroot, so I tried to use the option --with-sysroot, but I'm getting the same problem. Can you help me? Thanks and regards, Pio Tofanelli

1 0

Stunnel not working with Office 365
by Hannu Viitala 19 May '15

19 May '15

Hi, We cannot get stunnel SMTP to work with Office 365 mail server. We are using Stunnel 5.13 and below are the config file content and the the client PC logs. The mail server logs do not reveal anything more. Two observations of the test setup: 1) Using e.g. Mozilla Firebird mail client directly SLL/SMTP on the same PC connection to same Office 365 mail server works ok, but via Stunnel it outputs the error log below. 2) Also, on the same PC, SSL/SMTP connection via stunnel to Gmail server works ok. Stunnel conf-file: ============== output = stunnel_log.txt debug = debug cert = tstunnel.pem client = yes [SSMTP] accept = 127.0.0.1:54500 connect = xxx.xxx.xxx.xxx:587 (Hannu V: removed IP address from this mail) protocol = smtp Client PC logs: =========== 2015.04.28 09:17:36 LOG7[ui]: No limit detected for the number of clients 2015.04.28 09:17:36 LOG5[ui]: stunnel 5.13 on x86-pc-msvc-1500 platform 2015.04.28 09:17:36 LOG5[ui]: Compiled/running with OpenSSL 1.0.2a 19 Mar 2015 2015.04.28 09:17:36 LOG5[ui]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2015.04.28 09:17:36 LOG7[ui]: errno: (*_errno()) 2015.04.28 09:17:36 LOG5[ui]: Reading configuration from file tstunnelSmtp_SAUX1_0.conf 2015.04.28 09:17:36 LOG5[ui]: UTF-8 byte order mark not detected 2015.04.28 09:17:36 LOG5[ui]: FIPS mode disabled 2015.04.28 09:17:36 LOG7[ui]: Compression disabled 2015.04.28 09:17:36 LOG7[ui]: PRNG seeded successfully 2015.04.28 09:17:36 LOG6[ui]: Initializing service [SSmtp] 2015.04.28 09:17:36 LOG6[ui]: Loading certificate from file: tstunnel.pem 2015.04.28 09:17:36 LOG6[ui]: Loading key from file: tstunnel.pem 2015.04.28 09:17:36 LOG7[ui]: Private key check succeeded 2015.04.28 09:17:36 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.04.28 09:17:36 LOG5[ui]: Configuration successful 2015.04.28 09:17:36 LOG7[ui]: Listening file descriptor created (FD=448) 2015.04.28 09:17:36 LOG7[ui]: Service [SSmtp] (FD=448) bound to 127.0.0.1:8030 2015.04.28 09:17:36 LOG7[ui]: Service [SSmtp] accepted (FD=456) from 127.0.0.1:54500 2015.04.28 09:17:36 LOG7[ui]: Creating a new thread 2015.04.28 09:17:36 LOG7[ui]: New thread created 2015.04.28 09:17:36 LOG7[0]: Service [SSmtp] started 2015.04.28 09:17:36 LOG5[0]: Service [SSmtp] accepted connection from 127.0.0.1:54500 2015.04.28 09:17:36 LOG6[0]: s_connect: connecting xxx.xxx.xxx.xxx:587 (Hannu V: removed IP address from this mail) 2015.04.28 09:17:36 LOG7[0]: s_connect: s_poll_wait connecting xxx.xxx.xxx.xxx:587 : waiting 10 seconds (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG5[0]: s_connect: connected connecting xxx.xxx.xxx.xxx:587 (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG5[0]: Service [SSmtp] connected remote server from yyy.yyy.yyy.yyy:54503 (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG7[0]: Remote socket (FD=472) initialized 2015.04.28 09:17:37 LOG7[0]: <- 220 NNN.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 28 Apr 2015 14:17:38 +0000 2015.04.28 09:17:37 LOG7[0]: -> 220 NNN.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 28 Apr 2015 14:17:38 +0000 2015.04.28 09:17:37 LOG7[0]: -> EHLO localhost 2015.04.28 09:17:37 LOG7[0]: <- 250-NNN.outlook.office365.com Hello [xxx.xxx.xxx.161] (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG7[0]: <- 250-SIZE 157286400 2015.04.28 09:17:37 LOG7[0]: <- 250-PIPELINING 2015.04.28 09:17:37 LOG7[0]: <- 250-DSN 2015.04.28 09:17:37 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2015.04.28 09:17:37 LOG7[0]: <- 250-STARTTLS 2015.04.28 09:17:37 LOG7[0]: <- 250-8BITMIME 2015.04.28 09:17:37 LOG7[0]: <- 250-BINARYMIME 2015.04.28 09:17:37 LOG7[0]: <- 250 CHUNKING 2015.04.28 09:17:37 LOG7[0]: -> STARTTLS 2015.04.28 09:17:37 LOG7[0]: <- 220 2.0.0 SMTP server ready 2015.04.28 09:17:37 LOG6[0]: SNI: sending servername: NNN.office365.com 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): before/connect initialization 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server certificate request A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server done A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write client certificate A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write certificate verify A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write finished A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 flush data 2015.04.28 09:17:37 LOG3[0]: SSL_connect: Peer suddenly disconnected 2015.04.28 09:17:37 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.04.28 09:17:37 LOG7[0]: Remote socket (FD=472) closed 2015.04.28 09:17:37 LOG7[0]: Local socket (FD=456) closed 2015.04.28 09:17:37 LOG7[0]: Service [SSmtp] finished (0 left) --- Hannu

2 1

Authentication methods
by Michal Trojnara 15 May '15

15 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, While reading various 3rd party stunnel tutorials I noticed that they either don't configure authentication, or they recommend insecure configurations. I wrote a short overview of authentication methods available in stunnel: https://www.stunnel.org/auth.html Proper authentication is essential to TLS security. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVVXk5AAoJEC78f/DUFuAUN/QP/3m4HX4zWS8SehukDNWw54AB ySAT+XmT8SEo/iuGer/CRYbUWoMDpmwaI9x+whXMg+EBsxGd+nmyE9fkFiFSqOsV vnXc14zuMkQYorWbGtduXdnQ0/jQzWPDOIeKgpyXIsN/OvEhx1A6med9Go/SqaFz couW55wysqpJ9a+3YMtxIjLoCMzIGOZ8TKIHWJiZaBcgp93YCABeoE5hKR4RlxVj OrgHhuyA8yz1EIYUPKTEMuJwqnCl9Mk3FVskKIXgfEcxBzism2n/xJpEIYAWVPRW N8JaaZDojk6dt5oMiMzXUeobigZ82SKuV9MG3aQjuxXAP7IX2vuOa6rQ/85T1OFI PMZMKENM1aAcOVpiq/4OMNKhIG+OuhDm/dla5NC8lsfxDuJ3YESVp/Z0VeW1EWYA BFHxjGw8OA65izTYcvJKl1j7flfSgRELOCf1SMakR+VIUhkWlPQjdHWuW2V5NKgv 5aU0fwPGEpudKdsLFzgaYzhVPjTNfavl8k+xUWHOQyrNvEM9SNbOTyorxY7QA2aQ uyAOrUF8whboBTX59/3gXYI9vaepvT00ktCtQEz3XelkYT9SzCRYV+I+mUqquBd+ 0JQdiSMvOzfNraxT03rzYA6h/Iey9+tj9WnffpmYU5eyTt2bCp+xavzCyEmdQZlq 4LfAPgFYII9+59444dY2 =m51O -----END PGP SIGNATURE-----

1 0

Stunnel4 not working?
by David H. Durgee 13 May '15

13 May '15

Given a lack of other suggestions here and elsewhere that yielded any progress, I decided to download the current source and attempt to build it on my system. I didn't see a routine to check for prerequisites being met, so I wound up running ./configure several times and adding the libssl-dev, libwrap0-dev and libsystemd-daemon-dev packages based on what I saw in the output. Perhaps a check routine could be added later? I then ran make and the output contains neither errors nor warnings, so that looks good. As suggested in the INSTALL file, I next ran make check and received neither errors nor warnings. At this point the next step appears to be make install as root, but I am wondering if I should uninstall the stunnel4 package from the repository first. I am also wondering if I can simply use the existing /etc/stunnel/stunnel.conf that I included in my first post in this thread or if I should start over with one of the examples included with this version. I would appreciate input from the list on this. If you want to see further details, such as ./configure or make outputs or configuration files just let me know and I will put them in a follow-up post. Dave

2 1

Re: [stunnel-users] Stunnel 5.17 on AIX
by Eckert, Doug 13 May '15

13 May '15

Thanks! I applied the patch to tls.c and I'm able to create sessions with no problem. The version of OpenSSL provided by IBM is built off the 1.0.1e codebase, with backported security fixes via "iFixes" for announced CVEs. They apparently don't backport new functionality or maybe even non-CVE bugfixes. I'm guessing an un-patched stunnel 5.17 would work once/if they release OpenSSL built off 1.0.1j or later. > On Tue, May 12, 2015 at 3:40 PM, Michal Trojnara <Michal.Trojnara(a)mirt.net > > wrote: > >> On 12.05.2015 18:29, Eckert, Doug wrote: >> > With that in mind, I compiled stunnel v5.03 with same OpenSSL 1.0.1.513 >> > and iFix IV71446m9a applied as with the v5.17 attempt. I'm able to >> > create sessions with no problem. The internal error/bad magic does not >> > occur. >> >> Additional security checks to the OpenSSL memory management functions >> were introduced in stunnel 5.09. The enclosed patch disables them in >> the latest stunnel 5.17. >> >> Mike >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> > > > -- > > > >

1 0

Stunnel 5.17 on AIX
by Eckert, Doug 12 May '15

12 May '15

I've gotten v5.17 compiled on AIX 5.3 & 6.1 with the following xlccmp.13.1.0 13.1.0.3 COMMITTED XL C compiler openssl.base 1.0.1.513 COMMITTED Open Secure Socket Layer IV71446m9a Ifix for Openssl CVE Everything seems to have compiled fine. I packaged it up, installed, and set up a quick config. The server side aborts on me. Debug output follows. Need some direction on where to look next. Thanks in advance! 2015.05.06 12:08:03 LOG7[ui]: Clients allowed=31999 2015.05.06 12:08:03 LOG5[ui]: stunnel 5.17 on powerpc-ibm-aix5.3.0.0 platform 2015.05.06 12:08:03 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2015.05.06 12:08:03 LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2015.05.06 12:08:03 LOG7[ui]: errno: (*_Errno()) 2015.05.06 12:08:03 LOG5[ui]: Reading configuration from file /opt/freeware/etc/stunnel/stunnel.conf 2015.05.06 12:08:03 LOG5[ui]: UTF-8 byte order mark not detected 2015.05.06 12:08:03 LOG7[ui]: Compression disabled 2015.05.06 12:08:03 LOG7[ui]: Snagged 64 random bytes from //.rnd 2015.05.06 12:08:03 LOG7[ui]: Wrote 1024 new random bytes to //.rnd 2015.05.06 12:08:03 LOG7[ui]: PRNG seeded successfully 2015.05.06 12:08:03 LOG6[ui]: Initializing service [client] 2015.05.06 12:08:03 LOG6[ui]: Loading certificate from file: /usr/share/ssl/certs/skdkgesaix53-client-cert.pem 2015.05.06 12:08:03 LOG6[ui]: Loading key from file: /usr/share/ssl/certs/skdkgesaix53-client-key.pem 2015.05.06 12:08:03 LOG7[ui]: Private key check succeeded 2015.05.06 12:08:03 LOG7[ui]: Verify directory set to /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: Added /usr/share/ssl/certs revocation lookup directory 2015.05.06 12:08:03 LOG6[ui]: Peer certificate location /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: SSL options: 0x01000004 (+0x03000000, -0x02000000) 2015.05.06 12:08:03 LOG6[ui]: Initializing service [server] 2015.05.06 12:08:03 LOG6[ui]: Loading certificate from file: /usr/share/ssl/certs/skdkgesaix53-server-cert.pem 2015.05.06 12:08:03 LOG6[ui]: Loading key from file: /usr/share/ssl/certs/skdkgesaix53-server-key.pem 2015.05.06 12:08:03 LOG7[ui]: Private key check succeeded 2015.05.06 12:08:03 LOG7[ui]: Verify directory set to /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: Added /usr/share/ssl/certs revocation lookup directory 2015.05.06 12:08:03 LOG6[ui]: Peer certificate location /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: DH initialization 2015.05.06 12:08:03 LOG7[ui]: Could not load DH parameters from /usr/share/ssl/certs/skdkgesaix53-server-cert.pem 2015.05.06 12:08:03 LOG7[ui]: Using hardcoded DH parameters 2015.05.06 12:08:03 LOG7[ui]: DH initialized with 2048-bit key 2015.05.06 12:08:03 LOG7[ui]: ECDH initialization 2015.05.06 12:08:03 LOG7[ui]: ECDH initialized with curve prime256v1 2015.05.06 12:08:03 LOG7[ui]: SSL options: 0x01004004 (+0x03004000, -0x02000000) 2015.05.06 12:08:03 LOG5[ui]: Configuration successful 2015.05.06 12:08:03 LOG7[ui]: Listening file descriptor created (FD=7) 2015.05.06 12:08:03 LOG7[ui]: Service [client] (FD=7) bound to 127.0.0.1:22 2015.05.06 12:08:03 LOG7[ui]: Listening file descriptor created (FD=8) 2015.05.06 12:08:03 LOG7[ui]: Service [server] (FD=8) bound to 172.26.85.13:2222 2015.05.06 12:08:04 LOG7[main]: Created pid file /var/pid/stunnel.pid 2015.05.06 12:08:29 LOG7[main]: Service [server] accepted (FD=3) from 172.26.85.14:52649 2015.05.06 12:08:29 LOG7[0]: Service [server] started 2015.05.06 12:08:29 LOG5[0]: Service [server] accepted connection from 172.26.85.14:52649 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): before/accept initialization 2015.05.06 12:08:29 LOG7[0]: SNI: no virtual services defined 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 read client hello A 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 write server hello A 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 write certificate A INTERNAL ERROR: Bad magic at tls.c, line 182 --Doug

2 4

Stunnel4 not working?
by David H. Durgee 09 May '15

09 May '15

> Please see highlighted below: > > On Fri, May 8, 2015 at 5:27 PM, David H. Durgee <dhdurgee at verizon.net <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users>> > wrote: > > >/ At some point in the near past stunnel stopped working on my laptop. The > />/ laptop is running Linux Mint 17.1 Rebecca x64 and stunnel from the > />/ repositories. I enabled debug=7, but I am not getting much from the log: > />/ > />/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Clients allowed=500 > />/ > />/ > />/ > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: > />/ stunnel 4.53 on x86_64-pc-linux-gnu platform 2015.05.08 17 > />/ <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Compiled with OpenSSL > />/ 1.0.1e 11 Feb 2013 2015.05.08 17 <2015.05.08%2017>:12:06 > />/ LOG5[10804:140318864611136]: Running with OpenSSL 1.0.1f 6 Jan 2014 > />/ 2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Update > />/ OpenSSL shared libraries or rebuild stunnel* > / > > Is there a reason that you're using libraries from a different compiled > Stunnel? In fact, isn't there another Stunnel package you can use that is > more up-to-date? If not, perhaps compile your own using the OpenSSL > libraries that comes with Mint. I am using the package from the Mint repository, which in this case is the Ubuntu Trusty repository. If you know of a repository I can add with a more current package I will do so. If necessary I guess I could build from source, but I don't do that often and would prefer to locate a binary. > >/ > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Threading:PTHREAD > />/ SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Reading configuration > />/ from file /etc/stunnel/stunnel.conf > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Compression not enabled > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: PRNG seeded successfully > />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service > />/ section [telnets] > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]: > />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem* > / > > Warning: the permissions may be too wide-open (should be 700 I assume) > > > >/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: > />/ 0x00000004 > />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service > />/ section [dsp3270s] > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]: > />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem* > / > > Same as above, perhaps too wide open, permissions should be 700 I assume. > > > >/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: > />/ 0x00000004 > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Configuration successful > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [telnets] > />/ (FD=12) bound to 0.0.0.0:3141 > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [dsp3270s] > />/ (FD=13) bound to 0.0.0.0:7490 > />/ 2015.05.08 17:12:06 LOG7[10810:140318864611136]: Created pid file > />/ /stunnel4.pid > />/ 2015.05.08 17:12:31 LOG7[10810:140318864611136]: Service [telnets] > />/ accepted (FD=3) from 127.0.0.1:40090 > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] started > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Waiting for a libwrap > />/ process > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Acquired libwrap process > />/ #0 > />/ > />/ > />/ *2015.05.08 17 <2015.05.08%2017>:12:31 LOG3[10810:140318864770816]: > />/ Unexpected socket close (read_blocking) 2015.05.08 17 > />/ <2015.05.08%2017>:12:31 LOG5[10810:140318864770816]: Connection reset: 0 > />/ byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17 > />/ <2015.05.08%2017>:12:31 LOG7[10810:140318864770816]: Local socket (FD=3) > />/ closed* > / > > that sounds like SELinux permissions perhaps? Have you tried temporarily > disabling SELinux, or perhaps you have a firewall (iptables) set up? You'll > have to allow the incoming port and possibly an entry in /etc/services > IIRC. I don't know if this helps but this is what I found: > https://sites.google.com/site/easylinuxtipsproject/security > A link to "ufw" may prove useful, if your system has that installed. Most > systems have locked-down privileged ports (any port less than 1024, like in > your example). I do have ufw here, but I have the same problem with it enabled or disabled. The telnets service is listening on port 3141 and the dsp3270s on port 7490, so neither of them are privileged ports. > >/ > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] > />/ finished (0 left) > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: str_stats: 1 block(s), > />/ 32 data byte(s), 58 control byte(s) > />/ 2015.05.08 17:13:32 LOG7[10810:140318864611136]: Service [dsp3270s] > />/ accepted (FD=3) from 127.0.0.1:48534 > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] > />/ started > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Waiting for a libwrap > />/ process > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Acquired libwrap process > />/ #1 > />/ *2015.05.08 17 <2015.05.08%2017>:13:32 LOG3[10810:140318864770816]: > />/ Unexpected socket close (read_blocking)* > />/ > / > That sounds like some kind of firewall issue (like above). As noted above, same behavior with ufw enabled or disabled. > >/ 2015.05.08 17:13:32 LOG5[10810:140318864770816]: Connection reset: 0 > />/ byte(s) sent to SSL, 0 byte(s) sent to socket > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Local socket (FD=3) > />/ closed > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] > />/ finished (0 left) > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: str_stats: 1 block(s), > />/ 32 data byte(s), 58 control byte(s) > />/ > />/ > / When in a situation like this, I would first try unprivileged ports with > localhost using iperf, just to generate some dummy traffic. A good > technique I use when debugging stunnel versus debugging networking or other > security issues is to do local traffic only like this: > > 1. iperf client connect to localhost port 5000 > 2. Stunnel client listen on port 5000, connect to localhost port 6000 > 3. Stunnel server listen on port 6000, connect to localhost port 7000 > 4. iperf server listening on localhost port 7000 > > As you can see from that, running iperf client for a few seconds, it should > be able to connect to the iperf server. If not, stunnel is not working. > Debug this FIRST before proceeding to working with non-localhost IP > addresses. The actual procedure would be as follows: > > 1. Download/install iperf > 2. Verify iperf works by having one shell run as server, listening on > localhost port 7000, and another shell setup iperf client sending on port > 7000. If that works, then proceed. Don't use iperf to connect to port 7000 > again. > 3. Set up two config files, one for stunnel client and one for stunnel > server, with different ports and the "client=yes" in the client config > file. For easier detection with "ps" or "top", you can copy the executable > file to another name (i.e., "s4client" for the stunnel 4 client, and > "s4server" for the stunnel 4 server). Similarly for iperf, you can copy the > exe to "iperfc" and "iperfs" for iperf server, for easier process detection. > 4. Start up the stunnel server first, then stunnel client, with the > appropriate config files per the port enumeration mentioned above. > 5. Start iperf server listening on port 7000. > 6. Start iperf client sending on port 5000. If you get some really large > value or nothing, then your stunnel config (client/server) needs to be > debugged first before proceeding to non-localhost IPs. I usually get > something like 3GB/sec when using a Windows 7 VM inside Windows 7 doing > this from DOS prompts with appropriate server/client configs set up. I > usually use four windows: two for iperf (c/s), two for stunnel (c/s). > > Hope that helps... > -Rob I have an stunnel server on another system on the LAN and that is the one I am having the client with the problem connect to while trying to find the problem. I know that server is working, as I have seen other incoming traffic handled by it. I suspect the problem is related to the message you pointed out that I missed about SSL libraries. I would very much appreciate a pointer to a more current package in a repository. Thanks for your response, Rob. Dave

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users