- stunnel-users - stunnel.org

verify=4
by oweijr oweirj 12 Aug '14

12 Aug '14

Hello, In the stunnel documentation, I see the following: level 4 Ignore CA chain and only verify peer certificate. My interpretation of level 4 was that only the server certificate had to be installed on the client in order for the cert verification to pass. No issuer/CA certificates were needed. However, when I do this, the connection fails. I see this following in the logs with verify=4: 2014.08.12 21:17:57 LOG7[26768]: Starting certificate verification: depth=0, subject=/C=US/CN=a.b.com 2014.08.12 21:17:57 LOG4[26768]: CERT: Verification error: unable to get local issuer certificate 2014.08.12 21:17:57 LOG4[26768]: Certificate check failed: depth=0, subject=/C=US/CN=a.b.com 2014.08.12 21:17:57 LOG7[26768]: SSL alert (write): fatal: unknown CA 2014.08.12 21:17:57 LOG3[26768]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed My config file contains the following: verify = 4 CAfile = /opt/stunnel/certs/clients.pem chroot = /opt/stunnel setuid = stunnel setgid = stunnel pid = /run/stunnel.pid debug = 7 output = stunnel.log options = NO_SSLv2 cert = /opt/stunnel/certs/server.pem key = /opt/stunnel/certs/server.pem If I append the issuer certificate to the CAfile, after the peer certificate, then the connection is successful with verify=4. Is this expected behavior? Is there a verify level that works as I described above: only the peer certificate needs to be present, no CA/issuer certificates at all? Thank you for your help.

1 0

unable to send SMTP over SSL
by Paul Hargrove 08 Aug '14

08 Aug '14

Hi, I'm a new user using stunnel-5.03 on Windows SBS 2003. I can't send email from Exchange but can from Outlook with same credentials on same network. Email gets stuck in the exchange smtp queue. Simple config: ; * Global options debug = 7 output = stunnel.log engine = capi options = NO_SSLv2 ; * Service definition [SMTP] client = yes accept = 8465 connect = smtp.virginmedia.com:465 protocol = smtp Logs look good but nothing seems to go: 2014.08.08 22:15:07 LOG7[7284]: Dispatching signals from the signal pipe 2014.08.08 22:15:07 LOG7[7284]: Processing SIGNAL_RELOAD_CONFIG 2014.08.08 22:15:07 LOG5[7284]: Reading configuration from file stunnel.conf 2014.08.08 22:15:07 LOG7[7284]: Enabling support for engine 'capi' 2014.08.08 22:15:07 LOG7[7284]: Initializing engine #1 (capi) 2014.08.08 22:15:07 LOG6[7284]: Engine #1 (capi) initialized 2014.08.08 22:15:07 LOG5[7284]: FIPS mode disabled 2014.08.08 22:15:07 LOG7[7284]: Compression disabled 2014.08.08 22:15:07 LOG7[7284]: Snagged 64 random bytes from C:/.rnd 2014.08.08 22:15:07 LOG7[7284]: Wrote 1024 new random bytes to C:/.rnd 2014.08.08 22:15:07 LOG7[7284]: PRNG seeded successfully 2014.08.08 22:15:07 LOG6[7284]: Initializing service [SMTP] 2014.08.08 22:15:08 LOG7[7284]: No private key specified 2014.08.08 22:15:08 LOG7[7284]: SSL options set: 0x01000004 2014.08.08 22:15:08 LOG5[7284]: Configuration successful 2014.08.08 22:15:08 LOG7[7284]: Closing service [SMTP] 2014.08.08 22:15:08 LOG7[7284]: Service [SMTP] closed (FD=292) 2014.08.08 22:15:08 LOG7[7284]: Sessions cached before flush: 7 2014.08.08 22:15:08 LOG7[7284]: Sessions cached after flush: 0 2014.08.08 22:15:08 LOG7[7284]: Service [SMTP] closed 2014.08.08 22:15:08 LOG7[7284]: Service [SMTP] (FD=292) bound to 0.0.0.0:8465 2014.08.08 22:15:08 LOG7[7284]: Signal pipe is empty 2014.08.08 22:16:03 LOG7[7284]: Service [SMTP] accepted (FD=392) from 127.0.0.1:26642 2014.08.08 22:16:03 LOG7[7284]: Creating a new thread 2014.08.08 22:16:03 LOG7[7284]: New thread created 2014.08.08 22:16:03 LOG7[7184]: Service [SMTP] started 2014.08.08 22:16:03 LOG5[7184]: Service [SMTP] accepted connection from 127.0.0.1:26642 2014.08.08 22:16:03 LOG6[7184]: s_connect: connecting 62.254.26.219:465 2014.08.08 22:16:03 LOG7[7184]: s_connect: s_poll_wait 62.254.26.219:465: waiting 10 seconds 2014.08.08 22:16:03 LOG5[7184]: s_connect: connected 62.254.26.219:465 2014.08.08 22:16:03 LOG5[7184]: Service [SMTP] connected remote server from 10.0.0.2:26643 2014.08.08 22:16:03 LOG7[7184]: Remote socket (FD=688) initialized 2014.08.08 22:16:14 LOG3[7184]: fd_getline: Unexpected socket close 2014.08.08 22:16:14 LOG5[7184]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.08.08 22:16:14 LOG7[7184]: Remote socket (FD=688) closed 2014.08.08 22:16:14 LOG7[7184]: Local socket (FD=392) closed 2014.08.08 22:16:14 LOG7[7184]: Service [SMTP] finished (0 left) 2014.08.08 22:16:14 LOG7[7184]: str_stats: 3 block(s), 4294966138 data byte(s), 150 control byte(s) 2014.08.08 22:16:14 LOG7[7184]: str_stats: 20 byte(s) at ..\src\network.c:413 2014.08.08 22:16:14 LOG7[7184]: str_stats: 20 byte(s) at ..\src\network.c:412 2014.08.08 22:16:14 LOG7[7184]: str_stats: 20 byte(s) at ..\src\network.c:411 If I rem out the protocol = smtp then the mails go from the queue and the logs seem to indicate a success: 2014.08.08 22:02:14 LOG7[7284]: Service [SMTP] accepted (FD=688) from 127.0.0.1:54520 2014.08.08 22:02:14 LOG7[7284]: Creating a new thread 2014.08.08 22:02:14 LOG7[7284]: New thread created 2014.08.08 22:02:14 LOG7[10072]: Service [SMTP] started 2014.08.08 22:02:14 LOG5[10072]: Service [SMTP] accepted connection from 127.0.0.1:54520 2014.08.08 22:02:14 LOG6[10072]: s_connect: connecting 62.254.26.219:465 2014.08.08 22:02:14 LOG7[10072]: s_connect: s_poll_wait 62.254.26.219:465: waiting 10 seconds 2014.08.08 22:02:14 LOG5[10072]: s_connect: connected 62.254.26.219:465 2014.08.08 22:02:14 LOG5[10072]: Service [SMTP] connected remote server from 10.0.0.2:54521 2014.08.08 22:02:14 LOG7[10072]: Remote socket (FD=456) initialized 2014.08.08 22:02:14 LOG6[10072]: SNI: sending servername: smtp.virginmedia.com 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): before/connect initialization 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 write client hello A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 read server hello A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 read finished A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 write change cipher spec A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 write finished A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 flush data 2014.08.08 22:02:14 LOG7[10072]: 6 items in the session cache 2014.08.08 22:02:14 LOG7[10072]: 13 client connects (SSL_connect()) 2014.08.08 22:02:14 LOG7[10072]: 13 client connects that finished 2014.08.08 22:02:14 LOG7[10072]: 0 client renegotiations requested 2014.08.08 22:02:14 LOG7[10072]: 0 server connects (SSL_accept()) 2014.08.08 22:02:14 LOG7[10072]: 0 server connects that finished 2014.08.08 22:02:14 LOG7[10072]: 0 server renegotiations requested 2014.08.08 22:02:14 LOG7[10072]: 7 session cache hits 2014.08.08 22:02:14 LOG7[10072]: 0 external session cache hits 2014.08.08 22:02:14 LOG7[10072]: 0 session cache misses 2014.08.08 22:02:14 LOG7[10072]: 0 session cache timeouts 2014.08.08 22:02:14 LOG6[10072]: SSL connected: previous session reused 2014.08.08 22:02:16 LOG6[10072]: Read socket closed (readsocket) 2014.08.08 22:02:16 LOG7[10072]: Sending close_notify alert 2014.08.08 22:02:16 LOG7[10072]: SSL alert (write): warning: close notify 2014.08.08 22:02:16 LOG6[10072]: SSL_shutdown successfully sent close_notify alert 2014.08.08 22:02:16 LOG6[10072]: SSL socket closed (SSL_read) 2014.08.08 22:02:16 LOG7[10072]: Sent socket write shutdown 2014.08.08 22:02:16 LOG5[10072]: Connection closed: 80 byte(s) sent to SSL, 298 byte(s) sent to socket 2014.08.08 22:02:16 LOG7[10072]: Remote socket (FD=456) closed 2014.08.08 22:02:16 LOG7[10072]: Local socket (FD=688) closed 2014.08.08 22:02:16 LOG7[10072]: Service [SMTP] finished (0 left) 2014.08.08 22:02:16 LOG7[10072]: str_stats: 3 block(s), 4294963672 data byte(s), 150 control byte(s) 2014.08.08 22:02:16 LOG7[10072]: str_stats: 20 byte(s) at ..\src\network.c:413 2014.08.08 22:02:16 LOG7[10072]: str_stats: 20 byte(s) at ..\src\network.c:412 2014.08.08 22:02:16 LOG7[10072]: str_stats: 20 byte(s) at ..\src\network.c:411 but all Mails bounce with: There was a SMTP communication problem with the recipient's email server. Please contact your system administrator. <server.domain.local #5.5.0 smtp;530 Authentication Required (VM401)> Any ideas?

1 0

Re: [stunnel-users] stunnel 5.03 released
by Michal Trojnara 08 Aug '14

08 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Peter Pentchev wrote: > Um, there's just one little problem with this; what do you think > about the attached public-domain patch that removes what looks very > much like a stray quote character? Argh! Thank you. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlPlP0MACgkQ/NU+nXTHMtG61QCgrh8w889DGai/Xbc7y42vTkQ/ /BQAnRsl60djjKX2O3PJWzRrVkLXDnEt =yKfI -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] stunnel 5.03 released
by Peter Pentchev 08 Aug '14

08 Aug '14

On Thu, Aug 07, 2014 at 10:15:47PM +0200, Michal Trojnara wrote: > Dear Users, > > I have released version 5.03 of stunnel. Hi, (-announce and openssl-users dropped from CC) Thanks a lot - and thanks for saving downstream distro maintainers the trouble of releasing an intermediate package update for the init script fix ;) > > The ChangeLog entry: [snip] > * Bugfixes [snip] > - Fixed whitespace handling in the stunnel.init script. Um, there's just one little problem with this; what do you think about the attached public-domain patch that removes what looks very much like a stray quote character? Once again, thanks for writing and maintaining stunnel! G'luck, Peter PS. I tried to send this from my <roam(a)ringlet.net> address, but mx1.mirt.net bounced my message due to a junkemailfilter.com blacklist problem that I've taken up with the folks over there (at junkemailfilter.com, not mirt.net, obviously ;) -- Peter Pentchev roam(a)ringlet.net roam(a)FreeBSD.org p.penchev(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Windows Certificate Store
by j nasty 07 Aug '14

07 Aug '14

I haven't been able to get a definitive answer and can't find the information I need through traditional searching around. Anyways, is it possible to have sTunnel access the Windows certificate store to get the certificate that will be used for client authentication? If so, how can this be configured in sTunnel's configuration file? Or can you at least point me in the direction I can find the information I'm looking for? Many thanks in advance everyone!

2 1

stunnel 5.03 released
by Michal Trojnara 07 Aug '14

07 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.03 of stunnel. The ChangeLog entry: Version 5.03, 2014.08.07, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1i. See https://www.openssl.org/news/secadv_20140806.txt * New features - FIPS autoconfiguration cleanup. - FIPS canister updated to version 2.0.6. - Improved SNI diagnostic logging. * Bugfixes - Compilation fixes for old versions of OpenSSL. - Fixed whitespace handling in the stunnel.init script. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 5e8196f913bf7460082c1c7e5d436fbfba7f65d56c60065e6ccf0df9057294ef stunnel-5.03-android.zip 803bc85fbc80f22d71b13d4180e2d51c02586b2cc611169961a2745e47e31c4f stunnel-5.03-installer.exe 9a1e369466fa756e6f48b11480a3338c1fa4717e6472871bf4a3a96c483edd03 stunnel-5.03.tar.gz Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlPj3nMACgkQ/NU+nXTHMtGM3ACfdFm7k754Pzo1rhDkVb6rT5nO EEUAoJoSXbRPHu3jphxXYVA5SeJ05BXj =tFws -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] cert verification problem
by n n 07 Aug '14

07 Aug '14

Hi! I want to authenticate server, using valid cert from StartSSL, and I receive error: ## sie 07 16:24:17 yabba stunnel[4247]: LOG4[5495]: CERT: Verification error: unable to get local issuer certificate sie 07 16:24:17 yabba stunnel[4247]: LOG4[5495]: Certificate check failed: depth=1, subject=/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA sie 07 16:24:17 yabba stunnel[4247]: LOG3[5495]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed sie 07 16:24:17 yabba stunnel[4247]: LOG5[5495]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket ## I don't know what's wrong. There is server's config: ## chroot = /var/run/stunnel/ pid=/stunnel.pid setuid = nobody setgid = nobody [squid] accept = 80 connect = 127.0.0.1:3128 verify=0 ## Client's config: ## client = yes [proxy] accept = 127.0.0.1:8005 connect = server:80 ##

1 0

Possible false positive trojan detection on stunnel-5.02-installer.exe
by Drew Mayo 06 Aug '14

06 Aug '14

Hi all, This is just an FYI. I'm a recent user of stunnel, and one of my team has just alerted me that f-prot (and unfortunately hence google drive) detects the current windows installer for stunnel 5.02 as a trojan. virustotal (which confirms it matches the sha256) tells me that the file is detected as: W32/Trojan.TDWH-2255 W32/Trojan3.JUA I've raised a misclassification request with f-prot, but of course that will probably take some time to get resolved. Of course, it is remotely possible it's not false, but i'm betting the other way. -d

2 2

More peer cert info export, new verify option
by Michal Vaško 05 Aug '14

05 Aug '14

Hello, for our current use-case we needed to add functionality to stunnel and therefore have made few patches. We distribute these patches with our software and were wondering what do you think about including them directly in stunnel. Firstly, we need peer certificate fingerprints in MD5, SHA1, SHA224, SHA256, SHA384 and SHA512. Patched stunnel exports all these in separate variables "SSL_CLIENT_*". Secondly, we could need subjectAltName values. Patched stunnel exports these in "SSL_CLIENT_SAN", but only rfc822Name, iPAddress and dNSName as we need only these. It could easily be expanded to all the values. Lastly, we required verification as if we first used verify = 2 and after failing trying verify = 4 (verify = 3 is technically verify = 2 AND verify = 4, if I am not wrong, and we need verify = 2 OR verify = 4). For this purpose my patch adds new verify = 5 option. I want to say that we did not just make all these requirements up, but we want to conform to RFCs describing NETCONF over TLS and its configuration. All the patches are included so you can go through them. Thank you. Kind regards, Michal Vasko

1 0

Re: [stunnel-users] FIPS compliant Stunnel build
by Michael Curran 24 Jul '14

24 Jul '14

I have already requested the CD of software from OpenSSL -- that section does not really assist with the build functions. The FIPSDIR= option still did not allow Stunnel to autodiscover FIPS.h -- this is my openssl1.0.1h configure command openssl-fips-2.0.7 ./config ; make ; make install openssl-1.0.1h./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib --with-fipsdir=/usr/local/ssl/fips-2.0/ ; make depend ; make ; make test ; make install Stunnel5.02 I am not installling the newer copy of openssl to the rest of the system, just as libraries accessible to Stunnel for building with a version that is different than the OS installed openssl so as not to risk breaking ssh or OS Upgrade capabilities ./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap ; make ; make install During the Make phase it just says it cannot find fips.h but it says fips enabled -- but when I tell it to use FIPS I get checking whether to enable FIPS mode support... yesconfigure: **************************************** SSLchecking for SSL directory... /usr/local/openssl-100checking /usr/local/openssl-100/include/openssl/engine.h usability... yeschecking /usr/local/openssl-100/include/openssl/engine.h presence... yeschecking for /usr/local/openssl-100/include/openssl/engine.h... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h usability... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h presence... yeschecking for /usr/local/openssl-100/include/openssl/ocsp.h... yeschecking /usr/local/openssl-100/include/openssl/fips.h usability... nochecking /usr/local/openssl-100/include/openssl/fips.h presence... nochecking for /usr/local/openssl-100/include/openssl/fips.h... noconfigure: WARNING: OpenSSL fips header not foundconfigure: **************************************** write the resultsconfigure: creating ./config.status Restarting Stunnel with fips=yes gives me this [!] FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported[!] Line 35: "[webapp]": Failed to initialize SSL The TODO file in Stunnel5.02 tarball has this * Support static FIPS-enabled build. Does this mean that it can only currently support a system that is fully fips enabled and not my static libraries that I use for building Stunnel? Thats what I get out of this. And upon further reading of the INSTALL.FIPS file I confirm this Unix HOWTO:* Only dynamic linking of the FIPS-enabled OpenSSL is currently supported, i.e. FIPS-enabled OpenSSL has to be configured with "shared" parameter. I cannot install it with dynamic libraries as I am required to build via the actual instructions for FIPS 140-2 compliance which implicitly states I cannot call out shared as part of the config options. Mike Curran From: mike_curran(a)hotmail.com To: nobody(a)dizum.com Subject: RE: FIPS compliant Stunnel build Date: Wed, 23 Jul 2014 17:34:08 -0500 I have already requested the CD of software from OpenSSL -- that section does not really assist with the build functions. The FIPSDIR= option still did not allow Stunnel to autodiscover FIPS.h -- this is my openssl1.0.1h configure command openssl-fips-2.0.7 ./config ; make ; make install openssl-1.0.1h./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib --with-fipsdir=/usr/local/ssl/fips-2.0/ ; make depend ; make ; make test ; make install Stunnel5.02 I am not installling the newer copy of openssl to the rest of the system, just as libraries accessible to Stunnel for building with a version that is different than the OS installed openssl so as not to risk breaking ssh or OS Upgrade capabilities ./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap ; make ; make install During the Make phase it just says it cannot find fips.h but it says fips enabled -- but when I tell it to use FIPS I get checking whether to enable FIPS mode support... yesconfigure: **************************************** SSLchecking for SSL directory... /usr/local/openssl-100checking /usr/local/openssl-100/include/openssl/engine.h usability... yeschecking /usr/local/openssl-100/include/openssl/engine.h presence... yeschecking for /usr/local/openssl-100/include/openssl/engine.h... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h usability... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h presence... yeschecking for /usr/local/openssl-100/include/openssl/ocsp.h... yeschecking /usr/local/openssl-100/include/openssl/fips.h usability... nochecking /usr/local/openssl-100/include/openssl/fips.h presence... nochecking for /usr/local/openssl-100/include/openssl/fips.h... noconfigure: WARNING: OpenSSL fips header not foundconfigure: **************************************** write the resultsconfigure: creating ./config.status Restarting Stunnel with fips=yes gives me this [!] FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported[!] Line 35: "[webapp]": Failed to initialize SSL The TODO file in Stunnel5.02 tarball has this * Support static FIPS-enabled build. Does this mean that it can only currently support a system that is fully fips enabled and not my static libraries that I use for building Stunnel? Thats what I get out of this. Mike Curran > From: nobody(a)dizum.com > To: mike_curran(a)hotmail.com > Subject: Re: FIPS compliant Stunnel build > Date: Thu, 24 Jul 2014 00:00:37 +0200 > > it IS possible... > > use FIPSDIR environment variable -- > NOT any change to FIPS Object Module ./config command > > BUT most important see: > > 6.6 The "Secure Installation" Issue > > of > > User Guide for the OpenSSL FIPS Object Module v2.0 > (including v2.0.1, v2.0.2, v2.0.3, v2.0.4, v2.0.5, v2.0.6, v2.0.7) >

2 1