Hi,
Long time lurker, new poster though!
I've got two servers running Stunnel v2.54 (yet to upgrade as I've been
waiting for an x-forwardfor patch to become available). I noticed recently
that one Stunnel nodes had exited, requiring a restart. I'm not sure if
it's a co-incidence, but I've only just changed the cert on both installs
last night.
This, of course, is very concerning as it's only just become a problem, but
being the core SSL endpoint, it knocks our server offline until it's
…
[View More]restarted.
Now comes the interesting bit, I've run the SSL Labs SSL Health check at
https://www.ssllabs.com/ssltest/ just to see if anything comes out of it,
and noticed that without fail every time it runs (and the first server is
online) it'll know Stunnel offline as it goes through it's tests:
*"Testing TLS v1.0...."
"Testing TLS v1.2...."*
*-- SERVER OFFLINE --*
This was noticed by a fluke, but appears to happen every time I restart and
then rerun the test.
I'm not getting any segfaults, or errors from stunnel, and it only affects
the one (primary) server. Can anyone shed any light as to what might be
causing it, how I can get any more info out of stunnel, or better yet, fix
it completely?
Thanks all
Alfie
[View Less]
I am getting a success with doing the configure, make and make install.
However when I go to start up stunnel I get the following error message:
Clients allowed=500
stunnel 4.56 on x86_64-unknown-linux-gnu platform
Compiled/running with OpenSSL 1.0.1 14 Mar 2012
Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS
Reading configuration from file /usr/local/etc/stunnel/stunnel.conf
FIPS_mode_set: F06D065: error:0F06D065:common libcrypto
routines:FIPS_mode_set:fips mode not supported
Line 51:…
[View More] "[pop3s]": Failed to initialize SSL
str_stats: 9 block(s), 163 data byte(s), 522 control byte(s)
Any assistance would be greatly appreciated.
--
Laura J. Fried
[View Less]
We are running stunnel and noticed an issue with what ended up being an issue creating a new thread due to running out of memory at 2gb - error (8) on create_client
Are there any known issues with 4.53 around memory usage?
We only terminate 2 ports against the installation 443 on 2 different interfaces / IP addresses and we ran into this issue with just under 5000 total connections
We are not doing ECDH , but are using a 1024-bit param file
I've got dozens of clients connecting with Stunnel to a group of 5 servers. Each system has a config that looks like this:
> cert = /etc/stunnel/zookeeper.pem
> key = /etc/stunnel/zookeeper.key
> CAfile = /etc/stunnel/zookeeper_ca.pem
> verify = 2
> delay = yes
> sslVersion = TLSv1
> client = yes
> setuid = stunnel4
> setgid = stunnel4
> pid = /var/lib/stunnel4/zookeeper.stunnel4.pid
> socket = l:TCP_NODELAY=1
> socket = r:TCP_NODELAY=1
> TIMEOUTconnect = …
[View More]2
> session = 86400
> debug = 5
> [zookeeper]
> accept = 127.0.0.1:2182
> failover = rr
> connect = prod-zookeeper:2182
> connect = prod-zookeeper-1:2182
> connect = prod-zookeeper-2:2182
> connect = prod-zookeeper-3:2182
> connect = prod-zookeeper-4:2182
> connect = prod-zookeeper-5:2182
Essentially the first host is a load balancer, and the next 5 are the actual zookeeper hosts so that we can bypass the ELB if its giving us fits. Now what we're seeing is that almost every connection ends up on prod-zookeeper-5. Over and over and over again, our hosts pick the same system each time. We're running Stunnel 4.52:
> Clients allowed=8000
> stunnel 4.52 on i486-pc-linux-gnu platform
> Compiled/running with OpenSSL 0.9.8k 25 Mar 2009
> Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6
Any ideas what might be wrong here? Obviously we want the connections to be *roughly* random across the list of hosts... and if one of the hosts goes down, and the connection fails, we want the stunnel service to try again, and randomly pick a new host. It doesn't really seem to be doing that though.
--Matt
[View Less]
Hello all!
I'm in charge of activating stunnel to connect a service to a remote service.
Since I'm totally new on this product, I'd be grateful if someone could help me in configuring.
This is where I stand:
Stunnel version:
stunnel 4.29 on x86_64-unknown-linux-gnu with OpenSSL 1.0.0-fips 29 Mar 2010
OS:
Linux 2.6.32-220.23.1.el6.x86_64 #1 SMP Mon Jun 18 18:58:52 BST 2012 x86_64 x86_64 x86_64 GNU/Linux
I'd need to have it started by non-root user, and I have loaded under a specific path (…
[View More]owned by the same user):
Stunnel.conf:
; Sample stunnel configuration file
;cert = FXMS1.pem
client = yes
output = /export/home/bg_mtsbv/slev5fix/log
pid = /export/home/bg_mtsbv/slev5fix/conf/stunnel.pid
[ssl01]
accept = 127.0.0.1:18889
connect = 193.203.229.143:443
Stunnel.pid (empty)
xxx.pem (certificate has been provided by the owner of the target server)
my first two questions:
which is the correct command line to be launched?
Is it correct to have all the files under the user's directory?
Many thanks in advance for your help!
Regards,
Valerio
[View Less]
Hi All,
I am experimenting with stunnel inside a VM on Xenserver 6.02. So this may
not be a "common" use case, nonetheless, I would like to point out the
issue.
It is a basic setup as follows with 3 VMs running "ab" for webclient,
stunnel+haproxy combo as the https/http bridge and nginx as the webserver.
client VM (ab) <-> stunnel + haproxy VM <-> webserver VM (nginx)
Specs on the stunnel VM are 2GB RAM, single-core dedicated 2.5 GHz Xeon
E5-2640 vCPU, running Debian Squeeze 2.6.…
[View More]32-5-amd64 (64 bit) kernel.
All things unchanged such as stunnel/haproxy/nginx config and taking care
of common gotchas such as file descriptor limit, TIMEOUTclose, disabling
libwrap, etc. stunnel is built with pthreads. Also stunnel is configured to
use a 2K RSA self-signed certificate, and the client is being forced to do
TLS1. "ab" is invoked with "-c 4" so as to peg the stunnel VM CPU (any
value beyond 4 doesn't seem to matter). nginx serves a tiny 32 byte static
html file.
With stunnel 4.29 and OpenSSL 0.9.8o, I get 300 requests per second as max
throughput.
With stunnel 4.56 and OpenSSL 1.0.1e, I get only 40 requests per second as
max throughput.
tcpdump tells me that the Server Hello sent to the client takes a longer
time in the latter case. Tinkering with TCP_NODELAY doesn't change anything.
Anyone else seeing this maybe even on physical hardware?
Has anything changed in OpenSSL across those versions?
Suggestions?
Thanks.
[View Less]
All,
A (hopefully) quick question: Is stunnel supported on Windows Failover Clusters...specifically as a clustered service or to encrypt connections to/from a clustered IP?
Thanks in advance,
CJH
Hi,
There appears to be a limit to the number of services you can define.
Services beyond the 64th service appear to get set up without any log
warnings or errors, yet don't pass traffic.
The code uses select() & FD_SET to accept() an incoming connection &
in Windows (using Windows Server 2008) the default is 64 sockets for
that so wondering if I can just recompile, setting FD_SETSIZE to
something larger.
I'll try it either way, just wanted to put it out there to see if anyone
…
[View More]else has ever run into this.
Thanks,
Terren
[View Less]