- stunnel-users - stunnel.org

stunnel for Solaris 10
by shanmuganathan sedukumar 24 Jan '13

24 Jan '13

Hi All, I'm new and about to start with stunnel. We are facing certain issues with our application server (operating on Solaris 10), as it is unable to establish SSL connection with an email exchange server (P0P3). So, we have planned to use stunnel for establishing SSL connection. May I get some guidelines on installation and configuration part, if anything available? Regards,Shanmuganathan

2 2

Hello, I am trying to connect to FIX server, and getting stunnel error.
by 724live 21 Jan '13

21 Jan '13

Hello, I am working on a project with FIX protocol, but have SSL connection error. *This is the stunnel.log info:* 2013.01.21 20:38:09 LOG5[5388:6900]: connect_blocking: connected XX.XX.XX.XX:2525 2013.01.21 20:38:09 LOG5[5388:6900]: Service [demo] connected remote server from 10.0.0.59:9532 2013.01.21 20:38:09 LOG7[5388:6900]: Remote socket (FD=620) initialized 2013.01.21 20:38:09 LOG7[5388:6900]: SNI: host name: XX.XX.XX.XX 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): before/connect initialization 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 write client hello A 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 read server hello A 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 read server certificate A 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 read server done A 2013.01.21 20:38:09 LOG3[5388:6900]: error queue: 14098077: error:14098077:SSL routines:SSL3_SEND_CLIENT_KEY_ EXCHANGE:bad rsa encrypt 2013.01.21 20:38:09 LOG3[5388:6900]: SSL_connect: 4068078: error:04068078:rsa routines:RSA_EAY_PUBLIC_ENCRYPT:key size too small 2013.01.21 20:38:09 LOG5[5388:6900]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.01.21 20:38:09 LOG7[5388:6900]: Remote socket (FD=620) closed 2013.01.21 20:38:09 LOG7[5388:6900]: Local socket (FD=540) closed 2013.01.21 20:38:09 LOG7[5388:6900]: Service [demo] finished (0 left) I will appreciate if you can guide me with help. It will help to make your Archive Searchable. Thank you, Isaac

2 1

unknown protocol
by Brandon Glenn 11 Jan '13

11 Jan '13

I am currently trying to setup stunnel to help me send emails from a program that sends alerts but does not use SSL, to a cloud email service that I use that requires SSL. I have the configuration setup trying to find out where the error is, and I am down to this last error. SSL23_GET_CLIENT_HELLO:unknown protocol Here is my config file. ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2012 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may useful for troubleshooting) ;debug = 7 ;output = stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem sslVersion = all ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; The default certificate cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Set client mode client = yes ; GMail ssmtp settings [ssmtp] accept = 25 connect = 174.129.0.38:465 ; GMail pop3s settings [pop3s] accept = 110 connect = 174.129.0.38:995 ; GMail imaps settings [imaps] accept = 143 connect = 174.129.0.38:993 ; Example SSL front-end to a web server ;[https] ;accept = 443 ;connect = 80 ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL ; Microsoft implementations do not use SSL close-notify alert and thus ; they are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; vim:ft=dosini

2 1

Error 111 (net::ERR_TUNNEL_CONNECTION_FAILED): Unknown error.
by Mr Nerdy 03 Jan '13

03 Jan '13

Hi. I installed Stunnel to secure the traffic to my HFS web-server at home. Everything works fine except that if I am trying to connect through a firewall (e.g. from work) Chrome shows an error message: Error 111 (net::ERR_TUNNEL_CONNECTION_FAILED): Unknown error.

1 0

Stunnel v4.54 SSL_connect: Peer suddenly disconnected
by Arun Kumar 02 Jan '13

02 Jan '13

Team, I am configuring stunnel for the first time. My Requirement: "NetApp DataFabricManager" application on SLES10 SP4 platform <------ (LDAP over Stunnel) -----> Windows 2003 Active Directory, for Active Directory user authentication. Stunnel.conf: ----------------------------------------------------------- setuid = root setgid = root client = yes debug = 7 output = /root/stunnel.log cert = /opt/crt_key.pem key = /opt/crt_key.pem pid = /var/run/stunnel.pid verify = 3 CAfile = /opt/crt_key.pem options = NO_SSLv2 [ldap] accept = 389 connect = winad1-197-187:636 [ldap-ha] accept = 8389 connect = winad2-197-189:636 ----------------------------------------------------------- ocm5-197-196:~ # dfm ldap list Address Port Last Use Last Failure ------------------------------------------ ------ -------------------------- -------------------------- 127.0.0.1 389 2013-01-02 14:01:52.000000 127.0.0.1 8389 2013-01-02 13:49:35.000000 ocm5-197-196:~ # ocm5-197-196:~ # dfm ldap find user1 Warning: Failed to bind to ldap server '127.0.0.1' as user 'CN=Administrator,CN=Users,DC=<zz>,DC=<xx>,DC=<yy>,DC=com': Can't contact LDAP server Error: Failed to search for user1. ocm5-197-196:~ # NOTE: If i add active directory server IP in the above list, instead of 127.0.0.1, ldap authentication works fine. ocm5-197-196:~ # cat /etc/services ... ..... ........ #### This is a Manual Entry made by root user for AD authentication services & Stunnel Integration ######## ldap-ha 8389/tcp # 2nd LDAP host for DC redundancy [Redirected to 2nd DC by Stunnel, see /etc/stunnel/stunnel.conf] ldap-ha 8389/udp # 2nd LDAP host for DC redundancy [Redirected to 2nd DC by Stunnel, see /etc/stunnel/stunnel.conf] ocm5-197-196:~ # stunnel /root/stunnel-4.54/tools/stunnel.conf stunnel.log: 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Clients allowed=500 2013.01.02 14:00:42 LOG5[7102:47010476379680]: stunnel 4.54 on x86_64-unknown-linux-gnu platform 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Compiled/running with OpenSSL 0.9.8a 11 Oct 2005 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Threading:PTHREAD SSL:+ENGINE Auth:none Sockets:POLL+IPv6 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Reading configuration from file /root/stunnel-4.54/tools/stunnel.conf 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Compression not enabled 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Snagged 64 random bytes from /root/.rnd 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Wrote 1024 new random bytes to /root/.rnd 2013.01.02 14:00:42 LOG7[7102:47010476379680]: PRNG seeded successfully 2013.01.02 14:00:42 LOG6[7102:47010476379680]: Initializing service [ldap] 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Key file: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Private key loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded verify certificates from /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded /opt/crt_key.pem revocation lookup file 2013.01.02 14:00:42 LOG7[7102:47010476379680]: SSL options set: 0x01000004 2013.01.02 14:00:42 LOG6[7102:47010476379680]: Initializing service [ldap-ha] 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Key file: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Private key loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded verify certificates from /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded /opt/crt_key.pem revocation lookup file 2013.01.02 14:00:42 LOG7[7102:47010476379680]: SSL options set: 0x01000004 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Configuration successful 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Service [ldap] (FD=7) bound to 0.0.0.0:389 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Service [ldap-ha] (FD=8) bound to 0.0.0.0:8389 2013.01.02 14:00:42 LOG7[7103:47010476379680]: Created pid file /var/run/stunnel.pid 2013.01.02 14:01:52 LOG7[7103:47010476379680]: Service [ldap] accepted (FD=3) from 127.0.0.1:60332 2013.01.02 14:01:52 LOG7[7103:1073809728]: Service [ldap] started 2013.01.02 14:01:52 LOG5[7103:1073809728]: Service [ldap] accepted connection from 127.0.0.1:60332 2013.01.02 14:01:52 LOG6[7103:1073809728]: connect_blocking: connecting 192.168.10.7:636 2013.01.02 14:01:52 LOG7[7103:1073809728]: connect_blocking: s_poll_wait 192.168.10.7:636: waiting 10 seconds 2013.01.02 14:01:52 LOG5[7103:1073809728]: connect_blocking: connected 192.168.10.7:636 2013.01.02 14:01:52 LOG5[7103:1073809728]: Service [ldap] connected remote server from 192.168.10.1:40664 2013.01.02 14:01:52 LOG7[7103:1073809728]: Remote socket (FD=10) initialized 2013.01.02 14:01:52 LOG7[7103:1073809728]: SSL state (connect): before/connect initialization 2013.01.02 14:01:52 LOG7[7103:1073809728]: SSL state (connect): SSLv3 write client hello A 2013.01.02 14:01:52 LOG3[7103:1073809728]: SSL_connect: Peer suddenly disconnected <------------------ 2013.01.02 14:01:52 LOG5[7103:1073809728]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.01.02 14:01:52 LOG7[7103:1073809728]: Remote socket (FD=10) closed 2013.01.02 14:01:52 LOG7[7103:1073809728]: Local socket (FD=3) closed 2013.01.02 14:01:52 LOG7[7103:1073809728]: Service [ldap] finished (0 left) I initially started with stunnel-4.14 available with SLES10 GA OS media. Noticed peer disconnected issue. I went through the stunnel mailing list archive for related issues, but didn't get much help. Finally upgraded stunnel to v4.54 & to no progress. google hits mentioned that its configuration issue / client is not accepting sockets.. but finally no clue how to proceed. Kindly assist "SSL_connect: Peer suddenly disconnected" & SSL handshake work. Warm Regards, Arun UNIX admin

2 3

Looking to confirm that stunnel is encrypting traffic via wireshark
by David Trebacz 31 Dec '12

31 Dec '12

I'm using stunnel to encrypt newsgroup traffic. Essentially use stunnel to encrypt port 119 traffic (from the Pan Newsreader) then securely communicate over 563 with astraweb secure servers. The whole set-up is described in detail in this blog post: http://blog.trebacz.com/2012/03/installing-stunnel-to-enable-ssl.html The system has been "working" for several months, but someone on the blog asked how to confirm it. I checked my logs and each time I'm finished using Pan/Stunnel to download anything I get several entries in my syslog like: stunnel: LOG5[2111:140426048358144]: Connection closed: 3259 byte(s) sent to SSL, 16756212 byte(s) sent to socket I started to wonder does this mean some of the traffic was encrypted, but most wasn't? I fired up wireshark filtered the results to show port 563 traffic ( filter set to tcp.port == 563) as was suggested in another post ( http://ubuntuforums.org/showpost.php?p=5400958&postcount=9) Wireshark does show the traffic is correctly flow through port 563 with astrawebs newsservers when requesting data, but how do I know the traffic is encrypted? I inspected likely packets to contain encrypted data and I don't see anything in plain text (but they're zlib compressed also).

1 0

How to set DSCP in stunnel?
by Death Master 30 Dec '12

30 Dec '12

How to set DSCP in stunnel? For some reasons I can't set DSCP via iptables(server side is on ovz VPS). Is there such feature? If no - please add it(it will be very usefull for me ;) )

3 3

Embedded linux run time problem (starting version 4.53), and work around
by Bao, Robert 28 Dec '12

28 Dec '12

To those running stunnel on Embedded Linux ARMv4 platform, You may have noticed that stunnel (starting from version 4.53 to the latest) will crash immediately even if you run as "stunnel -version". The work around is to remove "-pie" and "-fPIE" from CFLAG in Makefile. Michal, You may fix this problem permanently in config file when you roll out the official 5.00 version. Thanks, and happy holidays. Robert Bao Software House Tyco International

1 0

core dump when running stunnel on Arm based board
by ning ji 21 Dec '12

21 Dec '12

Hi everyone, i'm new to this. got a task to update stunnel from 4.52 to 5.00b1. 1. ./configure --host arm-none-linux-gnueabi --target arm-none-linux-gnueabi --prefix= i compared the makefile with the one in our 4.52 code base, same. 2. build with make -C stunnel CROSS_COMPILE=arm-none-linux-gnueabi- ARCH=arm 3. scp to ARM board, run without arugments, core dump. (the line number might be different as i was putting printfs. but as long as it enters parse_commandline, it crashes) [New LWP 867]Cannot access memory at address 0x70797263(gdb) bt#0 parse_commandline (name=0xbefdce29 "/opt/ultra/config/stunnel.conf", parameter=0xbefdce48 "-version") at options.c:1940#1 0x0003ba04 in main_configure (arg1=0xbefdce29 "/opt/ultra/config/stunnel.conf", arg2=0xbefdce48 "-version") at stunnel.c:199#2 0x0003bd44 in main_unix (argv=<optimized out>, argc=<optimized out>)at stunnel.c:135#3 main (argc=3, argv=0xbefdcd24) at stunnel.c:110my question is, it crashed when just entering parse_commandline( ),the 2 arguments look fine to me.How could this happen ?Many thanks !

5 11

public domain [PATCH] to stunnel 500b3 for Windows CE / Windows Mobile, "no log window bug" on WCE, UNICODE wce/w32, and compilation issues fixed
by Pierre DELAAGE 18 Dec '12

18 Dec '12

Dear All, Please find enclosed a patch in "diff -cr orig patched" format, applying to stunnel v500b3 as found here https://www.stunnel.org/downloads.html This patch mainly addresses compilation and unicode issues for Windows CE targets + ONE issue preventing stunnel to display error logs in error Window on WCE. This code has been made common to WCE AND W32, by selecting proper win32 api calls common to both platforms. For example : InsertMenuItem does not exist on WCE, but InsertMenu can do the same job. ShellExecute does not exist on WCE, but...ShellExecuteEx does exist on both platforms and can do the job. I use MS EVC 4sp4 compiler with WCE 420 SDK, on a vista sp2 host platform. Once debugged the code works fine on WM6 HTC smartphones. Should work on WM5. It needs a windows CE openssl lib (I recompiled MY patched version of openssl 1.0.2snap20121213 successfully: I have sent a patch to those openssl gentlemen, hoping that they will integrate it one fine day..., something not so obvious ...). You will find my openssl "patch to port", by following carefully this thread at openssl diffusion list : http://marc.info/?l=openssl-dev&m=135574071824906&w=2 two messages are more important than the others : one containing the patch on the code. Another one containing 2 useful scripts. The present stunnel patch addresses the following issues : ************* I] COMPILATION FAILURES It is important to state that to detect more type mismatching (that can be error prone at runtime), I delibarately use /WX option on both WCE and W32 compilers: this flag takes each warning as an error. This is very useful for UNICODE clean coding as, without this option, the compiler will just warn when seeing a short* (unicode string) used as a char* (ansi string), which leads to big pb at run time. 1/ orig/src/client.c just a warning on missing "return". 2/ evc.mak new SSLDIR to openssl V102snap20121213 Missing flag x86 needed to get inline function InterlockedExchange from winbase.h. Added dependency to evc.mak itself, as in vc.mak Added commctrl.lib for CommandBar routines (although, strangely, the program was running without that !) 3/ gui.c : UNICODE port for W32/WCE. WM_WINDOWSPOSCHHANGED replaces WM_SHOWINDOW, as the latter is unsupported in WCE. some mismatch between prototype and function definition for service_install. Visible now is a BOOL, as it is more consistant with its value and usage. Some "return TRUE" have been replaced by "return 0" as stated in msdn doc. Trick to delete menuitems : itemcount does not exist in WCE, but the delete loop is using the return value of deletemenu. message_boxT created for Tchar vars such as section->help ShellExecute replaced by shellExecuteEx, common to WCE and W32 4/ prototypes.h : declared message_boxT 5/ resolver.c : UNICODE issue on LoadLibrary 6/ stunnel.c type cast for time_t 7/ vc.mak : inc32 for openssl includes /WX warning as error flag to see every potential casting problem around UNICODE ************* II] OPERATIONAL ERRORS (at run-time) 1/ error log windows is displayed empty : cause = WM_SHOWWINDOW does not exist on WCE, although the constant is declared ! solution : use WM_WINDOWPOSCHANGED instead... 2/ Unsolved, unfortunaltely : on WCE only, on start, there is an error message, but no real error behind : "CommandBar_InsertMenuBar : error 120 : this function is only valid in win32 mode" I am still searching... ************* III] MINOR IMPROVMENT 1/replaced some win3.1 ugly fonts See resources.rc : some nice FONT on About and Password dlgbox...to replace ugly windows3.1 style bold font... Note : I use stunnel to establish a simple "vpn" between smartphones and a corporate linux server mainly for HTTPS/POPS/SMTPS support. Stunnel is very relevant in that matter, over solutions based on SSH (although we use also ssh), from a communication cost point of view : ssh establishes permanent socket between client and server, so that the communication is charged by the mobile network provider : and these charges are very expensive. On the contrary stunnel only establishes ssl sockets on demand so that financial charges are limited to strict necessary. Please note that stunnel brings "client based certificate authentication" to POP/SMTP mobile mail user agents which only BASICALLY supports SSL with server authentication, but NO client authentication, such as M$ Outlook for Mobile (unless you pay for an exchange server and exchange client licence). Here again stunnel is very relevant. Note 2 : TODO list and Wish list : 1/ there is a remaining runtime bug on WCE : On start there is a warning that is NOT causing any failure in the software. Very difficult to analyse... 2/ find a notepad for WCE... 3/ in log.c...I really it would be good to replace hard coded values for socket errors by symbolic constant. 4/ fips openssl for WCE and then stunnel for WCE... I hope you will find this patch useful. Michal, thank you for your excellent work, Yours sincerely, Pierre Delaage

2 1