- stunnel-users - stunnel.org

transparent proxy ssl for a socket server
by Alex Needham 29 Jan '13

29 Jan '13

Hi I have to figure out how to get some ssl encapsulation for an application we have that only servs on obscure ports, the app needs to retain the source ip adress of the client requests. So i looked at stunnel, its working great in transparent mode where the stunnel server is the default gateway of the socket server, but I would like to get the stunnel server onto the same machine as the socket server and keep the client src ip. Testing with a apache as a backend as its easy to test. running centos 6.3 (2.6.32-279.19.1.el6.x86_64), updated an hour ago, built stunnel 4.54 from src.rpm. The players stunnel-boxen external=192.168.0.1, internal=192.168.1.1 web/socket-boxen internal=192.168.1.11, dg=192.168.1.1 The configs Config A - works ok debug = 7 foreground = yes #not chrooted runnnig as root no setuid,setguid [socket-1234] cert=blarg.crt key=blarg.key accept = 192.168.0.1:1234 connect = 192.168.1.11:80 transparent = source Config B - Not so good connect = 192.168.1.1:80 <- inside interface of stunnel box iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 /etc/sysctl.conf no route filtering and forwarding is on am i trying something impossible? or am i missing something? Any help greatly appreciated, if I get this going I'll happily do a nice neater write up for others. Cheers Alex

2 1

child process reaping
by Michael Weiser 29 Jan '13

29 Jan '13

Hello, recent versions (4.47+ I think) of stunnel introduce the following code in stunnel.c: --- stunnel-4.46/src/stunnel.c 2011-11-03 10:06:59.000000000 +0100 +++ stunnel-4.54/src/stunnel.c 2012-08-18 23:11:53.000000000 +0200 [...] } else { /* inetd mode */ [...] + signal(SIGCHLD, SIG_IGN); /* ignore dead children */ + signal(SIGPIPE, SIG_IGN); /* ignore broken pipe */ + client_main(alloc_client_session(&service_options, 0, 1)); } In Linux, child processes seem to inherit their parent's SIGCHLD handler setting. This means that all of stunnel's child processes will be unable to wait for their children. This causes the following uucp-over-stunnel setup I have: CAfile = /etc/ssl/certs/cacert.pem cert = /etc/ssl/certs/suucpcert.pem key = /etc/ssl/private/suucpkey.unenc verify = 2 service = suucp exec = /usr/sbin/uucico execargs = uucico -l to fail horribly with messages such as this: uucico weiser - (2013-01-29 01:25:15.33 3676) Call complete (6 seconds 21620 bytes 35103 bps) uuxqt weiser root (2013-01-29 01:25:17.36 3677) Executing X.weiserSEQ1 (rbsmtp) uuxqt weiser root (2013-01-29 01:25:17.96 3677) ERROR: waitpid: No child processes uuxqt weiser root (2013-01-29 01:25:17.96 3677) Execution failed (X.weiserSEQ1) Restoring SIGCHLD to SIG_DFL just before execvp()'ing the child as in the attached patch seems to fix it. I also attach a small test case for reproducing. It can be run like this: nc -l -p 12345 -e "stunnel sigchldtest.conf" 127.0.0.1 & openssl s_client -quiet -verify 0 -connect 127.0.0.1:12345 and should produce the following output: child: 2654 child 2654 died When automatic child reaping it active it will fail like this: child: 2538 waitpid: No child processes BTW: On Mac OS X, the SIGCHLD handler setting does not seem to be inherited by children. -- Thanks, Micha

1 0

MATCH CERT AGAINST LDAP
by Alejandro Fernandez 26 Jan '13

26 Jan '13

Hi there! I would like to know if it's possible with stunnel, as is, to match a client certificate against a certstore in a directory service, instead of a file, so to be able to revoke from a service such as Fedora 389 some access. Please, understand that the idea is not to access the LDAP itself, but to access some service within a network and grant such access based on a directory service query. Thanks everyone, Alejandro

1 0

Re: [stunnel-users] Stunnel setup for SSL connection with POP3 server
by Ludolf Holzheid 25 Jan '13

25 Jan '13

On Thu, 2013-01-24 21:09:13 +0530, shanmuganathan sedukumar wrote: > > Hi Ludolf, > Thanks for your input. I will try the same :) Hello Shanmuganathan, always reply to the list, so others are able to follow (and to comment). > One more clarification, we have multiple mail accounts configured in the same POP3 server. In our application, for each email account the username/password credentials would vary. So, in stunnel config file do we need to specify the credentials with parameters? If so, how do we need to specify the credentials for all the accounts? As far as I understood, stunnel has nothing to do with the POP3 authentication. It merely provides with an (encrypted) transport layer for the (plain text) POP3 session. I.e., you have to specify the credentials in your application. HTH, Ludolf -- Bihl+Wiedemann GmbH Floßwörthstr. 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 e-mail: lholzheid(a)bihl-wiedemann.de website: www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim HRB 5796

1 0

stunnel for Solaris 10
by shanmuganathan sedukumar 24 Jan '13

24 Jan '13

Hi All, I'm new and about to start with stunnel. We are facing certain issues with our application server (operating on Solaris 10), as it is unable to establish SSL connection with an email exchange server (P0P3). So, we have planned to use stunnel for establishing SSL connection. May I get some guidelines on installation and configuration part, if anything available? Regards,Shanmuganathan

2 2

Hello, I am trying to connect to FIX server, and getting stunnel error.
by 724live 21 Jan '13

21 Jan '13

Hello, I am working on a project with FIX protocol, but have SSL connection error. *This is the stunnel.log info:* 2013.01.21 20:38:09 LOG5[5388:6900]: connect_blocking: connected XX.XX.XX.XX:2525 2013.01.21 20:38:09 LOG5[5388:6900]: Service [demo] connected remote server from 10.0.0.59:9532 2013.01.21 20:38:09 LOG7[5388:6900]: Remote socket (FD=620) initialized 2013.01.21 20:38:09 LOG7[5388:6900]: SNI: host name: XX.XX.XX.XX 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): before/connect initialization 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 write client hello A 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 read server hello A 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 read server certificate A 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 read server done A 2013.01.21 20:38:09 LOG3[5388:6900]: error queue: 14098077: error:14098077:SSL routines:SSL3_SEND_CLIENT_KEY_ EXCHANGE:bad rsa encrypt 2013.01.21 20:38:09 LOG3[5388:6900]: SSL_connect: 4068078: error:04068078:rsa routines:RSA_EAY_PUBLIC_ENCRYPT:key size too small 2013.01.21 20:38:09 LOG5[5388:6900]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.01.21 20:38:09 LOG7[5388:6900]: Remote socket (FD=620) closed 2013.01.21 20:38:09 LOG7[5388:6900]: Local socket (FD=540) closed 2013.01.21 20:38:09 LOG7[5388:6900]: Service [demo] finished (0 left) I will appreciate if you can guide me with help. It will help to make your Archive Searchable. Thank you, Isaac

2 1

unknown protocol
by Brandon Glenn 11 Jan '13

11 Jan '13

I am currently trying to setup stunnel to help me send emails from a program that sends alerts but does not use SSL, to a cloud email service that I use that requires SSL. I have the configuration setup trying to find out where the error is, and I am down to this last error. SSL23_GET_CLIENT_HELLO:unknown protocol Here is my config file. ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2012 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may useful for troubleshooting) ;debug = 7 ;output = stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem sslVersion = all ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; The default certificate cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Set client mode client = yes ; GMail ssmtp settings [ssmtp] accept = 25 connect = 174.129.0.38:465 ; GMail pop3s settings [pop3s] accept = 110 connect = 174.129.0.38:995 ; GMail imaps settings [imaps] accept = 143 connect = 174.129.0.38:993 ; Example SSL front-end to a web server ;[https] ;accept = 443 ;connect = 80 ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL ; Microsoft implementations do not use SSL close-notify alert and thus ; they are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; vim:ft=dosini

2 1

Error 111 (net::ERR_TUNNEL_CONNECTION_FAILED): Unknown error.
by Mr Nerdy 03 Jan '13

03 Jan '13

Hi. I installed Stunnel to secure the traffic to my HFS web-server at home. Everything works fine except that if I am trying to connect through a firewall (e.g. from work) Chrome shows an error message: Error 111 (net::ERR_TUNNEL_CONNECTION_FAILED): Unknown error.

1 0

Stunnel v4.54 SSL_connect: Peer suddenly disconnected
by Arun Kumar 02 Jan '13

02 Jan '13

Team, I am configuring stunnel for the first time. My Requirement: "NetApp DataFabricManager" application on SLES10 SP4 platform <------ (LDAP over Stunnel) -----> Windows 2003 Active Directory, for Active Directory user authentication. Stunnel.conf: ----------------------------------------------------------- setuid = root setgid = root client = yes debug = 7 output = /root/stunnel.log cert = /opt/crt_key.pem key = /opt/crt_key.pem pid = /var/run/stunnel.pid verify = 3 CAfile = /opt/crt_key.pem options = NO_SSLv2 [ldap] accept = 389 connect = winad1-197-187:636 [ldap-ha] accept = 8389 connect = winad2-197-189:636 ----------------------------------------------------------- ocm5-197-196:~ # dfm ldap list Address Port Last Use Last Failure ------------------------------------------ ------ -------------------------- -------------------------- 127.0.0.1 389 2013-01-02 14:01:52.000000 127.0.0.1 8389 2013-01-02 13:49:35.000000 ocm5-197-196:~ # ocm5-197-196:~ # dfm ldap find user1 Warning: Failed to bind to ldap server '127.0.0.1' as user 'CN=Administrator,CN=Users,DC=<zz>,DC=<xx>,DC=<yy>,DC=com': Can't contact LDAP server Error: Failed to search for user1. ocm5-197-196:~ # NOTE: If i add active directory server IP in the above list, instead of 127.0.0.1, ldap authentication works fine. ocm5-197-196:~ # cat /etc/services ... ..... ........ #### This is a Manual Entry made by root user for AD authentication services & Stunnel Integration ######## ldap-ha 8389/tcp # 2nd LDAP host for DC redundancy [Redirected to 2nd DC by Stunnel, see /etc/stunnel/stunnel.conf] ldap-ha 8389/udp # 2nd LDAP host for DC redundancy [Redirected to 2nd DC by Stunnel, see /etc/stunnel/stunnel.conf] ocm5-197-196:~ # stunnel /root/stunnel-4.54/tools/stunnel.conf stunnel.log: 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Clients allowed=500 2013.01.02 14:00:42 LOG5[7102:47010476379680]: stunnel 4.54 on x86_64-unknown-linux-gnu platform 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Compiled/running with OpenSSL 0.9.8a 11 Oct 2005 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Threading:PTHREAD SSL:+ENGINE Auth:none Sockets:POLL+IPv6 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Reading configuration from file /root/stunnel-4.54/tools/stunnel.conf 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Compression not enabled 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Snagged 64 random bytes from /root/.rnd 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Wrote 1024 new random bytes to /root/.rnd 2013.01.02 14:00:42 LOG7[7102:47010476379680]: PRNG seeded successfully 2013.01.02 14:00:42 LOG6[7102:47010476379680]: Initializing service [ldap] 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Key file: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Private key loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded verify certificates from /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded /opt/crt_key.pem revocation lookup file 2013.01.02 14:00:42 LOG7[7102:47010476379680]: SSL options set: 0x01000004 2013.01.02 14:00:42 LOG6[7102:47010476379680]: Initializing service [ldap-ha] 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Key file: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Private key loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded verify certificates from /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded /opt/crt_key.pem revocation lookup file 2013.01.02 14:00:42 LOG7[7102:47010476379680]: SSL options set: 0x01000004 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Configuration successful 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Service [ldap] (FD=7) bound to 0.0.0.0:389 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Service [ldap-ha] (FD=8) bound to 0.0.0.0:8389 2013.01.02 14:00:42 LOG7[7103:47010476379680]: Created pid file /var/run/stunnel.pid 2013.01.02 14:01:52 LOG7[7103:47010476379680]: Service [ldap] accepted (FD=3) from 127.0.0.1:60332 2013.01.02 14:01:52 LOG7[7103:1073809728]: Service [ldap] started 2013.01.02 14:01:52 LOG5[7103:1073809728]: Service [ldap] accepted connection from 127.0.0.1:60332 2013.01.02 14:01:52 LOG6[7103:1073809728]: connect_blocking: connecting 192.168.10.7:636 2013.01.02 14:01:52 LOG7[7103:1073809728]: connect_blocking: s_poll_wait 192.168.10.7:636: waiting 10 seconds 2013.01.02 14:01:52 LOG5[7103:1073809728]: connect_blocking: connected 192.168.10.7:636 2013.01.02 14:01:52 LOG5[7103:1073809728]: Service [ldap] connected remote server from 192.168.10.1:40664 2013.01.02 14:01:52 LOG7[7103:1073809728]: Remote socket (FD=10) initialized 2013.01.02 14:01:52 LOG7[7103:1073809728]: SSL state (connect): before/connect initialization 2013.01.02 14:01:52 LOG7[7103:1073809728]: SSL state (connect): SSLv3 write client hello A 2013.01.02 14:01:52 LOG3[7103:1073809728]: SSL_connect: Peer suddenly disconnected <------------------ 2013.01.02 14:01:52 LOG5[7103:1073809728]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.01.02 14:01:52 LOG7[7103:1073809728]: Remote socket (FD=10) closed 2013.01.02 14:01:52 LOG7[7103:1073809728]: Local socket (FD=3) closed 2013.01.02 14:01:52 LOG7[7103:1073809728]: Service [ldap] finished (0 left) I initially started with stunnel-4.14 available with SLES10 GA OS media. Noticed peer disconnected issue. I went through the stunnel mailing list archive for related issues, but didn't get much help. Finally upgraded stunnel to v4.54 & to no progress. google hits mentioned that its configuration issue / client is not accepting sockets.. but finally no clue how to proceed. Kindly assist "SSL_connect: Peer suddenly disconnected" & SSL handshake work. Warm Regards, Arun UNIX admin

2 3

Looking to confirm that stunnel is encrypting traffic via wireshark
by David Trebacz 31 Dec '12

31 Dec '12

I'm using stunnel to encrypt newsgroup traffic. Essentially use stunnel to encrypt port 119 traffic (from the Pan Newsreader) then securely communicate over 563 with astraweb secure servers. The whole set-up is described in detail in this blog post: http://blog.trebacz.com/2012/03/installing-stunnel-to-enable-ssl.html The system has been "working" for several months, but someone on the blog asked how to confirm it. I checked my logs and each time I'm finished using Pan/Stunnel to download anything I get several entries in my syslog like: stunnel: LOG5[2111:140426048358144]: Connection closed: 3259 byte(s) sent to SSL, 16756212 byte(s) sent to socket I started to wonder does this mean some of the traffic was encrypted, but most wasn't? I fired up wireshark filtered the results to show port 563 traffic ( filter set to tcp.port == 563) as was suggested in another post ( http://ubuntuforums.org/showpost.php?p=5400958&postcount=9) Wireshark does show the traffic is correctly flow through port 563 with astrawebs newsservers when requesting data, but how do I know the traffic is encrypted? I inspected likely packets to contain encrypted data and I don't see anything in plain text (but they're zlib compressed also).

1 0