- stunnel-users - stunnel.org

How to get stunnel to listen on an IPv6 interface?
by jshardlo 11 Mar '12

11 Mar '12

Hi - my server was recently connected to IPv6 as well as the original IPv4 network. I have been using stunnel for some time on the IPv4 network but now that I have IPv6 access I can't work out how to get stunnel to listen on that interface as well. I checked that my stunnel has IPv6 support:- /usr/sbin/stunnel -version stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none I have a configuration like this: [pop3s] accept = 995 connect = 110 But when I do netstat I can see that it is only listening for port 995 on IPv4... netstat -an | grep 995 tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN netstat -an -A inet6 | grep 995 And of course when I connect to port 995 over the IPv6 network I get "connection refused". Any ideas how to get stunnel to listen on the v6 address? Thanks ! -- View this message in context: http://old.nabble.com/How-to-get-stunnel-to-listen-on-an-IPv6-interface--tp… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 1

Stunnel.conf won't load with certain ciphers.
by Thomas Eifert 09 Mar '12

09 Mar '12

Hello all: I'm running Stunnel 4.52 under WinXP SP3. Last night I had some questions about how the cipher list in Stunnel interacts with the cipher negotiation routine between client and server, so I did some experiments in an attempt to address those questions. In the course of doing so, I noticed that, if I attempt to load certain ciphers, Stunnel would stall at configuration load. Using OpenSSL to list TLS ciphers with 4.52's libraries yields the following: ~~~~~~~~~~~~~~~~~~~~~ C:\Program Files\stunnel>openssl ciphers -v -tls1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1 RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1 DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export C:\Program Files\stunnel> ~~~~~~~~~~~~~~~~~~~~~ As such, ciphers RC4-SHA and RC4-MD5 appear to be valid. However, any attempt at using those in client mode causes Stunnel to stall when reading the cipher from stunnel.conf: ~~~~~~~~~~~~~~~~~~~~~ 2012.03.08 20:17:10 LOG5[432:592]: Reading configuration from file stunnel.conf 2012.03.08 20:17:10 LOG5[432:592]: FIPS mode is enabled 2012.03.08 20:17:10 LOG7[432:592]: Compression not enabled 2012.03.08 20:17:10 LOG7[432:592]: Snagged 64 random bytes from C:/.rnd 2012.03.08 20:17:10 LOG7[432:592]: Wrote 1024 new random bytes to C:/.rnd 2012.03.08 20:17:10 LOG7[432:592]: PRNG seeded successfully 2012.03.08 20:17:10 LOG6[432:592]: Initializing SSL context for service nntps.1 2012.03.08 20:17:10 LOG7[432:592]: Loaded verify certificates from peer-nntps.1.pem 2012.03.08 20:17:10 LOG7[432:592]: Loaded peer-nntps.1.pem revocation lookup file 2012.03.08 20:17:10 LOG7[432:592]: SSL options set: 0x00000004 2012.03.08 20:17:10 LOG6[432:592]: SSL context initialized 2012.03.08 20:17:10 LOG6[432:592]: Initializing SSL context for service nntps.2 2012.03.08 20:17:10 LOG7[432:592]: Loaded verify certificates from peer-nntps.2.pem 2012.03.08 20:17:10 LOG7[432:592]: Loaded peer-nntps.2.pem revocation lookup file 2012.03.08 20:17:10 LOG3[432:592]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match 2012.03.08 20:17:10 LOG3[432:592]: Failed to reload the configuration file 2012.03.08 20:17:10 LOG7[432:592]: Signal pipe is empty ~~~~~~~~~~~~~~~~~~~~ This is the relevant snippet from my stunnel.conf file: ~~~~~~~~~~~~~~~~~~~~ debug = 7 delay = yes output = stunnel.log [nntps.1] client = yes sslVersion = TLSv1 ciphers = DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA cafile = peer-nntps.1.pem verify = 4 accept = 127.0.1.1:119 connect = news.server.com:443 [nntps.2] client = yes sslVersion = TLSv1 ciphers = RC4-SHA cafile = peer-nntps.2.pem verify = 4 accept = 127.0.1.2:119 connect = news.server.org:563 ~~~~~~~~~~~~~~~~~~~~ Any attempt at using ciphers RC4-SHA or RC4-MD5. with or without TLS specified, results in the same configuration crash. I don't really need to use those ciphers, but since I observed this behavior, I thought I'd better report it. Any comments welcome. Regards; Thomas . -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 3

Re: [stunnel-users] Memory allocated in a different thread at network.c, line 63
by Philippe A. 08 Mar '12

08 Mar '12

Hello Michal, 2012/3/5 Michal Trojnara <Michal.Trojnara(a)mirt.net> > > I am using fork mode because of leaks with pthread. In 4.33+pthread, >> stunnel virt size (per top) went up to 216m after 40k transactions. In >> fork mode, stunnel size after the same test was 20744 (kilobytes). In >> 4.45, I have 187m and 20676k respectively. >> > > I observed the same symptoms. Stunnel grows to ~200MB of virtual memory > after some time of usage. Then it stops growing further. I guess this > issue is caused by heap fragmentation rather than a memory leak. Otherwise > the growth would not be limited to ~200MB. > https://en.wikipedia.org/wiki/**C_dynamic_memory_allocation<https://en.wikipedia.org/wiki/C_dynamic_memory_allocation> I ran a test overnight that confirmed your point. I generated 480k+ stunnel transactions. This morning, stunnel memory usage is virt=187m and res=42m. My result after 40k transactions was exactly the same (in both cases with pthread+zlib). > I understand that virt includes shared libs, and that any issue with a >> shared lib will impact virt size. I did not have the opportunity to test >> without zlib support in openssl. Since we are not using compression, I >> wonder how much avoiding zlib would help. >> > > zlib only uses lots of memory when it's enabled. > I ran another test to clarify this. zlib appears to be adding around 3 megabytes at most. This is at least what I see under my setup and type of usage. pthread+zlib, 40k transactions before: virt=20680, res=792 after: virt=187m, res=42m pthread+nozlib, 40k transactions before: virt=20688, res=896 after: virt=185m, res=39m I have seen no benefit of compiling without zlib in fork mode. I guess it only makes forking a bit lighter. 2012/3/5 Michal Trojnara <Michal.Trojnara(a)mirt.net> > You may also try to set a lower value of MMAP_THRESHOLD to reduce heap > fragmentation: > https://www.kernel.org/doc/man-pages/online/pages/man3/malloc.3.html > This will be worth a look. Knowing what is influencing stunnel size is nice since it can avoid us restarting the processes once in a while (which we currently never do in fork mode). Thanks for your great help!

1 0

How to pass remote IP to local SMTP/POP3 server
by Zdenek Valach (INBOX) 08 Mar '12

08 Mar '12

Hi I have question, because I was not able to find answer anywhere on internet. I started to use Stunnel in server mode to provide POP3S/SMTPS functionality. Everything works fine except that I am missing remote IP of connecting client. I am using Windows version so I can not use transparent proxy mode working on Unix. Is there way how to make Stunnel for example after each establishment of TCP connection to send to SMTP/POP3 server port some special command like REMOTEIP 123.123.123.123<crlf> to pass this information there. I know it is not in SMTP/POP3 standard but it is simple for me extend behavior of SMTP/POP3 service by this command? Thank you very much for any advice Zdenek ____________________________________________________________ FREE 3D MARINE AQUARIUM SCREENSAVER - Watch dolphins, sharks & orcas on your desktop! Check it out at http://www.inbox.com/marineaquarium

2 3

mknod: not owner building stunnel on Solaris SPARC 10 zone
by Jiri ROHLICEK 07 Mar '12

07 Mar '12

Hello,I've been building stunnel 4.52 on Solaris 10 SPARC zone. Configure and make went fine, make install failed in tools with error if uname | grep SunOS; then \ ../auto/install-sh -c -d -m 755 /tmp/stunnel/var/lib/stunnel/dev; \ mknod /tmp/stunnel/var/lib/stunnel/dev/zero c 13 12; \ chmod 666 /tmp/stunnel/var/lib/stunnel/dev/zero; \ fi SunOS mknod: Not owner -- mknod is not allowed in solaris zone, only in global. One of many notices of this error skayser's http://www.mail-archive.com/devel@lists.opencsw.org/msg03031.html asks if mknod is needed on solaris 10. So I tried after configure comment out the mknod section in tools/Makefile. -- install-data-local: ... ... if uname | grep SunOS; then \ ${INSTALL} -d -m 755 $(DESTDIR)$(localstatedir)/lib/stunnel/dev; \ mknod $(DESTDIR)$(localstatedir)/lib/stunnel/dev/zero c 13 12; \ chmod 666 $(DESTDIR)$(localstatedir)/lib/stunnel/dev/zero; \ fi -- Now make install ends OK and stunnel works fine (I use it as client only). Isn't creating ./dev/zero not needed anymore? Thanks Jiri Rohlicek jrohlicek(a)aplis.cz

1 0

Username and Password in Stunnel
by Jim Murphy 07 Mar '12

07 Mar '12

I have a program that only allows me to enter a From email address and a mail server IP in its setup. Is there any way that I could enter a username and a password in stunnel.conf and let Stunnel send this information out to Office 365 or Gmail for delivery? Thanks! Jim

3 2

Re: [stunnel-users] Memory allocated in a different thread at network.c, line 63
by Philippe A. 07 Mar '12

07 Mar '12

Hello Michal, 2012/3/5 Michal Trojnara <Michal.Trojnara(a)mirt.net> > I fixed it: > ftp://ftp.stunnel.org/stunnel/**beta/stunnel-4.53b10.tar.gz<ftp://ftp.stunnel.org/stunnel/beta/stunnel-4.53b10.tar.gz> > Please give it a try and let me know whether it works for you. I tried the beta and the error is definitely gone. However I will stick with 4.45 for now as my next deployment is already prepared. Thanks a lot for your assistance!

1 0

Couple of issues with 4.45
by Philippe A. 07 Mar '12

07 Mar '12

Hello, I have encountered a couple of issues with stunnel 4.45 on RHEL 5.5. I tried configuring stunnel to log messages in /var/log/messages and later found that messages were logged both in that file AND /var/log/messages. In stunnel.conf, I had specified: debug=local6.info In syslog.conf: local6.* /var/log/stunnel.log I could achieve what I wanted only with the combination of the following two options: syslog=no output=/usr/local/app/stunnel/var/stunnel.log Is this expected? The second issue I have noticed is that stunnel seems to have a bit of trouble handling the hup signal. If you start stunnel specifying a relative path to the config, sending hup will cause stunnel to log and error but it won't exit. 2012.03.01 16:31:29 LOG5[19000:0]: Reading configuration from file etc/server.conf 2012.03.01 16:31:29 LOG3[19000:0]: etc/server.conf: No such file or directory (2) 2012.03.01 16:31:29 LOG3[19000:0]: Cannot read configuration 2012.03.01 16:31:29 LOG3[19000:0]: Failed to reload the configuration file If you specify an absolute path, no error will be reported but stunnel will exit anyway.

2 3

No sub folders, calendar or contacts
by Jonathan Harrison 05 Mar '12

05 Mar '12

Dear sirs I am using Ubuntu 11.10 64-bit, Outlook 2007 and 4 x gmail accounts (1 x personal (gmail.com) and 3 x business (baroni-limited.com, hosted by gmail). I have set up Stunnel, I belive the latest version and created a SSL license as instructed. The Stunnel Telnets OK and I can send and recieve eMails (I do send directly via my ISP rather than use Stunnel) without any problem. Where I seem to be having problems is that: I have no sub folders to each account. None are appearing. I have no calendars - I have followed the instructions but they fail to load. I have no contacts. Message from Outlook: Sync error > > Task 'Synchronizing subscribed folders for Baroni.' reported error > (0x800CCC0E) : 'Outlook cannot synchronize subscribed folders for Baroni. > Error: Cannot connect to the server. If you continue to receive this > message, contact your server administrator or Internet service provider > (ISP).' > > Task 'Internet Calendar Subscriptions' reported error (0x8004010F) : 'The > operation failed. An object cannot be found.' > Config attached - I hope. It is most likely I have missed something or done something wrong. I have not found anything to help me on the web or archives, could you please advise. If you feel you need a copy of the the logs, please advise and I shall happily provide what I can. I am assuming I have just missed something. -- Regards Jonathan

1 0

FIPS_mode_set:fingerprint does not match
by Jack 04 Mar '12

04 Mar '12

I have the following problem running stunnel on Centos 6.x 64bit with the following error: I have been search with google to see if there was a solution but nothing was found Thank you for your reply and your help, hopefully I can get this solved. ******************************************************************************** Clients allowed=500 stunnel 4.52 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:ENGINE,FIPS Auth:none Sockets:POLL,IPv6 Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match *******************************************************************************

3 2