- stunnel-users - stunnel.org

Access control/TCP wrappers
by Craig Watkinson 23 Feb '10

23 Feb '10

Hi, We're using stunnel to provide a secure interface to an old server that doesn't support HTTPS natively. I'd like to implement some access control so that connections are only supported from specific IP addresses. I am using v4.27 of stunnel that I downloaded from HPs website, and am running it from inittab to ensure it is always running. Unfortunately I don't think it's compiled with libwrap. Should I see libwrap listed when I run ldd against the binary (see below for output)? I think it's possible to run stunnel from inetd. Could I wrapper it here? Is the following entry correct? stunnel stream tcp nowait root /usr/lbin/tcpd /opt/iexpress/stunnel/bin/stunnel stunnel I think this would work, but I'm concerned that if stunnel was to crash or be killed that there would be nothing restarting it if we ran it from inetd. Any advice much appreciated Craig ------------------------------------- # ./stunnel -version stunnel 4.27 on ia64-hp-hpux11.23 with OpenSSL 0.9.7m 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = 5 pid = /opt/iexpress/stunnel/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL+RC4:@STRENGTH key = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # ldd ./stunnel libdl.so.1 => /usr/lib/hpux32/libdl.so.1 libnsl.so.1 => /usr/lib/hpux32/libnsl.so.1 libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1 libunwind.so.1 => /usr/lib/hpux32/libunwind.so.1 libc.so.1 => /usr/lib/hpux32/libc.so.1 libxti.so.1 => /usr/lib/hpux32/libxti.so.1 libuca.so.1 => /usr/lib/hpux32/libuca.so.1 libdl.so.1 => /usr/lib/hpux32/libdl.so.1 _________________________________________________________________ Do you have a story that started on Hotmail? Tell us now http://clk.atdmt.com/UKM/go/195013117/direct/01/

2 2

4.26 and commercial certificate - Now working.
by Editor (Kevin) 20 Feb '10

20 Feb '10

Hi: Thanks. Everything is working now. > Message: 1 > Date: Wed, 17 Feb 2010 07:11:16 -0800 (PST) > From: Leandro Avila <leandro.avila(a)ymail.com> > Subject: Re: [stunnel-users] Small challenge with version 4.26 and a > commercial certificate > To: stunnel-users(a)mirt.net > Message-ID: <544640.49520.qm(a)web111011.mail.gq1.yahoo.com> > Content-Type: text/plain; charset=us-ascii > > Hi Kevin, > > I think there is ambiguous information about this. > The man page states that the private key should be unencrypted > However, the changelog states that the support for pass phrases was fixed in v4.20 > > I'll do some testing see what I can find. Or maybe someone can shed some light on the issue. > > Best regards > > ----------------- > Leandro Avila

1 0

Re: [stunnel-users] Make reports an error on Aix with stunnel-4.30
by Michal Trojnara 19 Feb '10

19 Feb '10

Derek Nicholls wrote: > gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith > -I/opt/freeware/include -o stunnel file.o client.o log.o options.o > protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o > pty.o libwrap.o -lz -ldl -L/opt/freeware/lib -lssl -lcrypto > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_set_info_callback > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_new_cb > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_get_cb > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_remove_cb > ld: 0711-317 ERROR: Undefined symbol: .BIO_set_flags > ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more > information. > collect2: ld returned 8 exit status > make: 1254-004 The error code from the last command is 1. What it means is that the linker has found on its path another version of libssl, older than your headers in /opt/freeware/include. Mike

1 0

Cert Chain Question
by Craig Kelley 18 Feb '10

18 Feb '10

I've been attempting to include an intermediate chain for my stunnel setup. First, I previously used an entrust-signed certificate with stunnel just fine, but now I've purchased one from godaddy ($190 for 3 certs for 5 years!). The only problem is that the server has multiple certificates to install. Under Apache, I solved it with this: SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key SSLCertificateChainFile /etc/httpd/conf/ssl.crt/godaddy.crt Which works just fine. With stunnel I attempted this configuration: cert = /etc/stunnel/server.crt key = /etc/stunnel/server.key CAfile = /etc/stunnel/godaddy.crt All those files are identical to the Apache configuration. Stunnel starts up, but clients loudly complain that the certificate is not valid. If I examine the certificate in Thunderbird (I use stunnel for IMAPS and POP3S), it correctly identifies the cert as being from GoDaddy and that it will expire in 2015. But for some reason, the chain to its root server is broken. What am I doing wrong? -- Craig Kelley http://inconnu.islug.org/~ink finger same server for PGP block

2 2

Small challenge with version 4.26 and a commercial certificate
by editor 17 Feb '10

17 Feb '10

Hi: I decided to spend the money and get a commercial certificate from Thawte. It was not a bad price. I have installed in the Sun host and while it works perfectly for Apache but I can not get the file to work for stunnel. The idea is to allow mobile users to access their mail without annoying certificate warnings. This is what happens: # /usr/local/bin/stunnel & [1] 13704 # Enter PEM pass phrase: 2010.02.14 05:32:46 LOG7[13704:1]: Snagged 64 random bytes from /export/home/kgreene/.rnd 2010.02.14 05:32:46 LOG7[13704:1]: Wrote 1024 new random bytes to /export/home/kgreene/.rnd 2010.02.14 05:32:46 LOG7[13704:1]: RAND_status claims sufficient entropy for the PRNG 2010.02.14 05:32:46 LOG7[13704:1]: PRNG seeded successfully 2010.02.14 05:32:46 LOG7[13704:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2010.02.14 05:32:46 LOG7[13704:1]: Certificate loaded 2010.02.14 05:32:46 LOG7[13704:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2010.02.14 05:32:46 LOG3[13704:1]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2010.02.14 05:32:46 LOG3[13704:1]: error stack: 906A068 : error:0906A068:PEM routines:PEM_do_header:bad password read 2010.02.14 05:32:46 LOG3[13704:1]: SSL_CTX_use_RSAPrivateKey_file: 906406D: error:0906406D:PEM routines:PEM_def_callback:problems getting password [1]+ Exit 1 /usr/local/bin/stunnel # It never pauses to let me enter the PEM pass phase. As in instructed in the man pages, I created the pem file by merging the private key and the certificate from Thawte. This is the version statement: # /usr/local/bin/stunnel -version stunnel 4.26 on sparc-sun-solaris2.9 with OpenSSL 0.9.8l 5 Nov 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------- Any ideas would be great. Thanks. Kevin

3 2

nessus crashes stunnel
by Roger Cruz 12 Feb '10

12 Feb '10

We ran Nessus on a Linux system and found that stunnel crashes when the weak certificate suite is enabled. GDB shows the stack trace below and it appears to be in the SSL library. My search on this mailing list led me to this message that appears to report a similar problem http://mirt.net/pipermail/stunnel-users/2008-January/001830.html Am I to understand that the problem is really with OpenSSL and that's what needs to be upgraded? If so, do we know what version will have the fixed problem? I'm going to post in the OpenSSL forum as well, but I wanted to start here since from our perspective, Stunnel is the one crashing. Thank you Roger Cruz 2010.02.05 12:49:11 LOG7[13524:3086718672]: Cleaning up the signal pipe 2010.02.05 12:49:11 LOG6[13524:3086718672]: Child process 13575 finished with code 0 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb7fa7b90 (LWP 13574)] 0x007b24a7 in krb5_is_referral_realm () from /usr/lib/libkrb5.so.3 (gdb) bt #0 0x007b24a7 in krb5_is_referral_realm () from /usr/lib/libkrb5.so.3 #1 0x0089d338 in kssl_keytab_is_available () from /lib/libssl.so.6 #2 0x008803b1 in ssl3_choose_cipher () from /lib/libssl.so.6 #3 0x0087b2a2 in ssl3_get_client_hello () from /lib/libssl.so.6 #4 0x0087bc85 in ssl3_accept () from /lib/libssl.so.6 #5 0x0089109a in SSL_accept () from /lib/libssl.so.6 #6 0x00884d0d in ssl23_get_client_hello () from /lib/libssl.so.6 #7 0x0088554b in ssl23_accept () from /lib/libssl.so.6 #8 0x0089109a in SSL_accept () from /lib/libssl.so.6 #9 0x003628e2 in ?? () from /usr/sbin/stunnel #10 0x00363acd in ?? () from /usr/sbin/stunnel #11 0x003645ba in ?? () from /usr/sbin/stunnel #12 0x003646a8 in client () from /usr/sbin/stunnel #13 0x0025f45b in start_thread () from /lib/libpthread.so.0 #14 0x00448e5e in clone () from /lib/libc.so.6 (gdb) quit [root@p20xen1 current_hq]# stunnel -version stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

using ECDH with stunnel
by Carl 11 Feb '10

11 Feb '10

Is is possible to use ECDH with stunnel? When using s_server and specifying the cipher I can establish a connection. But when using stunnel and specifing the same cipher, the connection is rejected with "no shared cipher". e.g. openssl s_server -cert server.pem -cipher DHE-RSA-AES256-SHA It appears the difference is that s_server uses "default temp ECDH parameters" while stunnel doesn't have a default nor is there a way to specify the ECDH parameters. >From what I understand the ECDH parameters cannot be included with the certificate, unlike DH parameters. Is my understanding correct? Thanks, Carl

2 2

SSL connection through Proxy server with authentication
by Girish Kolari 09 Feb '10

09 Feb '10

Hi I am trying to create a SSL connection through Proxy server with authentication. my stunnel.conf file ----- part of the conf file connect = <Proxy server IP: Port number> protocol=connect protocolHost=<Destination server:Port number> protocolUsername = useme protocolPassword = test ----- but it fails to establish connection. Log details: ----- part of log generated 2010.02.09 16:07:49 LOG5[14506:2952859648]: Negotiations for connect (client side) started 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> CONNECT <Destination server:Port number> HTTP/1.1 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> Host: 6<Destination server:Port number> 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> Proxy-Authorization: basic dXNlbWU6dGVzdA== 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> 2010.02.09 16:07:49 LOG3[14506:2952859648]: Unexpected socket close (fdgetline) 2010.02.09 16:07:49 LOG5[14506:2952859648]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.02.09 16:07:49 LOG7[14506:2952859648]: Service IDrive finished (0 left) ----- I tried with proxy server without authentication it works great, but not sure why Proxy server with authentication is not working. Is it I am missing some thing or am I doing something wrong? I appreciate all suggestion and help on this. Thanks & Regards Girish Kolari

1 0

Stunnel and multiple endpoints.
by Richard Harvey 08 Feb '10

08 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi guys, I'm new to stunnel and I'm looking for a way to run stunnel on a single port. Then based on the client certificate, proxy that connection (in clear) to a different IP:port. If this something I can do with stunnel or am i barking up the wrong tree so to speak. Any help would be a appreciated guys. Cheers Ric - -- Richard Harvey European Linux Administrator Core Systems Ticketmaster +44 (0)207 9804328 80228 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAktv5ZIACgkQlh7dZJ0PyjcfxQCfWA5PO0d/uDf/Mqq2BrFsu5wf xBYAoKmKW8760P91JR3oeviKwjd/1o/A =o+/U -----END PGP SIGNATURE-----

3 5

Re: [stunnel-users] Memory problems
by Peter Griffin 05 Feb '10

05 Feb '10

A portion of the messages in /var/log/stunnel.log before I disabled logging as I thought it would help: 2010.02.04 22:46:28 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:46:32 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:46:55 LOG3[1615:140132734469904]: getpeerbyname: Transport endpoint is not connected (107) 2010.02.04 22:46:57 LOG3[1615:140132734400272]: SSL_read: Connection reset by peer (104) 2010.02.04 22:47:12 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:47:35 LOG3[1615:140132735235856]: SSL_read: Connection reset by peer (104) 2010.02.04 22:48:08 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:23 LOG3[1615:140132735235856]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:42 LOG3[1615:140132733982480]: transfer() loop executes not transferring any data 2010.02.04 22:48:42 LOG3[1615:140132733982480]: please report the problem to Michal.Trojnara(a)mirt.net 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket open: rd=yes wr=no, ssl open: rd=no wr=yes 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket ready: rd=no wr=no, ssl ready: rd=yes wr=no 2010.02.04 22:48:42 LOG3[1615:140132733982480]: wants: SSL_read rd=no wr=no, SSL_write rd=no wr=yes, SSL_shutdown rd=no wr=no 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket input buffer: 16384 byte(s), ssl input buffer: 0 byte(s) 2010.02.04 22:48:42 LOG3[1615:140132733982480]: check_SSL_pending=0 2010.02.04 22:48:52 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:56 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:01 LOG3[1615:140132734330640]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:03 LOG3[1615:140132734400272]: SSL socket closed on SSL_read with 7294 byte(s) in buffer 2010.02.04 22:49:05 LOG3[1615:140132734469904]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:16 LOG3[1615:140132721108752]: SSL socket closed on SSL_read with 16384 byte(s) in buffer 2010.02.04 22:49:26 LOG3[1615:140132733982480]: SSL socket closed on SSL_read with 16384 byte(s) in buffer 2010.02.04 22:49:28 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:34 LOG3[1615:140132733982480]: getpeerbyname: Transport endpoint is not connected (107) 2010.02.04 22:49:35 LOG3[1615:140132720899856]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:35 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected

1 0