- stunnel-users - stunnel.org

Server down
by Walter Hankins 24 Jul '13

24 Jul '13

Server is down Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from C:/.rnd Wrote 0 new random bytes to C:/.rnd PRNG seeded successfully Initializing service [Ssmtp] Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded SSL options set: 0x01000004 Configuration successful Service [Ssmtp] (FD=672) bound to 127.0.0.1:25 Cannot open log file: stunnel.log Closing service [Ssmtp] Service [Ssmtp] closed (FD=672) Sessions cached before flush: 0 Sessions cached after flush: 0 Service [Ssmtp] closed Server is down

2 1

Re: [stunnel-users] stunnel and keepalive
by David H. Durgee 23 Jul '13

23 Jul '13

> `stunnel -sockets´ should show the available socket options and their > default values. > > For the box I'm writing this mail from, the default for TCP_KEEPIDLE > is 7200 and for TCP_KEEPINTVL 75 (both in seconds). You'll have to be > quite patient if you want to watch keepalive packets in wireshark > without tweaking the defaults ... > > HTH, > > Ludolf You hit the nail on the head. I set the parameters to something more reasonable and I now see the keepalive packets. Thank you for your speedy response. Dave

1 0

keepalive and stunnel
by David H. Durgee 23 Jul '13

23 Jul '13

I am attempting to use stunnel to provide secure telnet access to a server on my system. As it is possible that a user may be idle for long period I have attempted to enable keepalive with stunnel. My stunnel conf files contain: socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 on both the server and client side. But wireshark shows no keepalive packets being exchanged. I am using socat to provide a service on the LAN and connections using socat do show keepalive packets. But to get this working with socat I had to use the following: socat -d -d -L/var/lock/Port$PORT - TCP:127.0.0.1:$PORT,keepalive,keepcnt=10,keepidle=3,keepintvl=1 I had originally tried it with only the keepalive option, but it took adding the other three options for it to work. Perhaps this is particular to my linux mint 13 maya x64 system and keepalive works by itself on windows? Are the other three options supported in stunnel? Dave

2 1

What do I need to provide an SSL service and verify individual clients?
by John Long 22 Jul '13

22 Jul '13

Hi, I want to set up a service using stunnel as a server. I want only specific clients to be able to connect. Each client will have an SSL-enabled client app. I understand the part about needing to create a self-signed cert for the stunnel server. I don't understand what Stunnel will require from each client. Do I have to create CSRs for each client and sign them with my self-signed cert, or will the keys from additional standalone self-signed certs for each client be good enough on the client side as long as I have a cert that for each key in the certificate path of the server? Is it correct that verify=3 will make sure only clients that have keys matching the certs in the server cert path can connect? If a client with a key that I have no cert for tries to connect, what should happen? Will it time out or will there be an error that the key isn't valid? Thanks, /jl

1 0

Stunnel log file limit
by mehmet ozisik 18 Jul '13

18 Jul '13

Hi, I would like to ask some questions regarding stunnel logging which I could not find answer with googling. 1) what is the limit of stunnel log file (can we define this)? 2) If there is a limit, when the limit is reached does it remove the filled file and starts with the same name an empty log file? Regards Mehmet

3 5

Feature requests
by Death Master 17 Jul '13

17 Jul '13

Can you implement some features? 1) Load balancing leastconn (like leastconn in haproxy) 2) UDT transport between stunnel instances(with several congestion controls which are already implemented for UDT) 3) SCTP transport between stunnel instances (if can be done in userspace) P.S. I'm using 400mbit WAN with 55-90ms latency+0-10%packet loss and on one end I can't control TCP settings at all (remote end is on OpenVZ VPS).

2 1

Line 51: "[pop3s]": Failed to initialize SSL
by Laura Fried 15 Jul '13

15 Jul '13

Beginning with Stunnel version 4.55 and continuing with 4.56 I can configure, make and make install without issue. But as soon as I try to start stunnel with the following command: /usr/local/bin/stunnel /usr/local/etc/stunnel/stunnel.conf I get the folllowing error message: Clients allowed=500 stunnel 4.56 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1 14 Mar 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported Line 51: "[pop3s]": Failed to initialize SSL str_stats: 9 block(s), 163 data byte(s), 522 control byte(s) Any insight into this issue would be greatly appreciated. -- Laura J. Fried

3 5

is verify level 4 working?
by dansmith 11 Jul '13

11 Jul '13

I would expect that level 4 only compares locally installed certificates, however I get the same behaviour as with level 3, stunnel expects a CA cert. Here'e the relevant log when on level 4 Jul 6 23:46:31 mmm stunnel: LOG7[7870:140491349628672]: Starting certificate verification: depth=0, /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: CERT: Verification error: unable to get local issuer certificate Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: Certificate check failed: depth=0, /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd Jul 6 23:46:31 mmm stunnel: LOG7[7872:140080853112576]: SSL alert (read): fatal: unknown CA What am I missing in understanding verify's level 4 ?

3 6

Creating a Centralized Secure Log Server with syslog-ng and Stunnel
by Szajt, Pablo 10 Jul '13

10 Jul '13

Hi guys, I have the task to install a secure syslog server using syslog-ng and stunnel. The Syslog server is a Solaris 10 and Syslog clients are HP-UX 11.31. I've spent already so many hours and I cannot make it run properly. I know syslog-ng works well without stunnel. I'm pretty sure someone is already using it. I'd like to have step by step installation process. I have no issue if I have to start from scratch. Thanks for your help, Pablo Pablo Szajt

2 1

Stunnel 4.56 and FIPS
by Ondrej Hrebicek 09 Jul '13

09 Jul '13

Hello stunnel users, I'm trying to compile stunnel 4.56 with FIPS support on Ubuntu 12.04. Always end up with the infamous "fingerprint does not match" error. I can't figure out what I'm doing wrong. 1. Download openssl-fips-2.0.2.tar.gz, unpack, ./config, make, and sudo make install (as specified in http://www.openssl.org/docs/fips/UserGuide-2.0.pdf) 2. Download openssl-1.0.1e.tar.gz, unpack, ./config fips --with-fipslibdir=/usr/local/ssl/fips-2.0/lib/ --with-fipsdir=/usr/local/ssl/fips-2.0/, make depend, make, and sudo make install 3. At this point, openssl is working in FIPS mode: > OPENSSL_FIPS=1 /usr/local/ssl/bin/openssl version OpenSSL 1.0.1e-fips 11 Feb 2013 > OPENSSL_FIPS=1 /usr/local/ssl/bin/openssl sha1 c_rehash SHA1(c_rehash)= 5af9e1479950bbbd9d3304c181b3f802c54f64fd > OPENSSL_FIPS=1 /usr/local/ssl/bin/openssl md5 c_rehash Error setting digest md5 139806582736544:error:060A80A3:digital envelope routines:FIPS_DIGESTINIT:disabled for fips:fips_md.c:180: 4. Download stunnel-4.56.tar.gz, unpack, ./configure --enable-fips --with-ssl=/usr/local/ssl, make, and sudo make install 5. While configuring and building stunnel completes as expected, the following does appear in ./configure's output: checking whether to enable FIPS mode support... yes configure: **************************************** SSL checking for SSL directory... /usr/local/ssl checking /usr/local/ssl/include/openssl/engine.h usability... yes checking /usr/local/ssl/include/openssl/engine.h presence... yes checking for /usr/local/ssl/include/openssl/engine.h... yes checking /usr/local/ssl/include/openssl/ocsp.h usability... yes checking /usr/local/ssl/include/openssl/ocsp.h presence... yes checking for /usr/local/ssl/include/openssl/ocsp.h... yes checking /usr/local/ssl/include/openssl/fips.h usability... no checking /usr/local/ssl/include/openssl/fips.h presence... no checking for /usr/local/ssl/include/openssl/fips.h... no configure: WARNING: OpenSSL fips header not found This is not entirely unexpected as fips.h only exists in /usr/local/ssl/fips-2.0/include/openssl. 6. Running stunnel however fails: > /usr/local/bin/stunnel Clients allowed=500 stunnel 4.56 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06B06F: error:2D06B06F:FIPS routines:FIPS_check_incore_fingerprint:fingerprint does not match Line 61: "[pop3s]": Failed to initialize SSL str_stats: 5 block(s), 120 data byte(s), 290 control byte(s) I can't figure out what's causing this, hoping someone on the list may have a couple suggestions. Thanks in advance!

2 2