Stunnel/Troubleshooting - Revision history

Admin at 07:15, 29 March 2017

2017-03-29T07:15:32Z

← Older revision		Revision as of 07:15, 29 March 2017
Line 303:		Line 303:
	This worked.		This worked.

			=Flags=

	~~[[Category:Stunnel]]~~		{{StunnelFlag}}
	~~[[Category:SSH]]~~

Admin: /* Attempt 2 */

2017-03-29T07:12:58Z

Attempt 2

← Older revision		Revision as of 07:12, 29 March 2017
Line 240:		Line 240:

	<pre>		<pre>
	accept = ~~196~~.~~126~~.~~102~~.~~136~~:8000		accept = A.B.C.D:8000
	accept = 8000		accept = 8000
	</pre>		</pre>
Line 253:		Line 253:
	</pre>		</pre>

	I left client connect as ~~196~~.~~126~~.~~102~~.~~136~~:8000.		I left client connect as A.B.C.D:8000.

			NOTE: The correct notation is, in the client:

			<pre>
			[ssh]
			accept = 2222
			connect = A.B.C.D:8000
			</pre>

			and in the server:

			<pre>
			[ssh]
			accept = 8000
			connect = 127.0.0.1:22
			</pre>

	==Attempt 3: Resolution==		==Attempt 3: Resolution==

Admin: /* Client configuration */

2017-03-29T07:11:31Z

Client configuration

← Older revision		Revision as of 07:11, 29 March 2017
Line 140:		Line 140:
	debug = 7		debug = 7
	[ssh]		[ssh]
	accept = ~~127.0.0.1:~~2222		accept = 2222
	connect = 92.~~126~~.~~102~~.36:8000		connect = A.B.C.D:8000
	</pre>		</pre>

Admin at 07:10, 29 March 2017

2017-03-29T07:10:36Z

← Older revision		Revision as of 07:10, 29 March 2017
Line 1:		Line 1:
	Having issues getting stunnel client and server to connect.		Having issues getting stunnel client and server to connect.

			TL;DR: ssh as root.

			Also see:
			* [[Stunnel/Server]]
			* [[Stunnel/Client]]

	Have been following this Digital Ocean guide: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ssl-tunnel-using-stunnel-on-ubuntu		Have been following this Digital Ocean guide: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ssl-tunnel-using-stunnel-on-ubuntu

Admin: /* Attempt 2 */

2017-03-29T07:09:58Z

Attempt 2

← Older revision		Revision as of 07:09, 29 March 2017
Line 248:		Line 248:

	I left client connect as 196.126.102.136:8000.		I left client connect as 196.126.102.136:8000.

			==Attempt 3: Resolution==

			After scratching my head a while, I figured that stunnel was running on the remote machine as root, so maybe it was a problem with how I was doing ssh. I tried to ssh as root, and bingo:

			<pre>
			$ ssh -p 2222 root@localhost
			The authenticity of host '[localhost]:2222 ([127.0.0.1]:2222)' can't be established.
			ECDSA key fingerprint is SHA256:9DL2ohTkZFI9oaqUtMlA5X7gTJW/mmWbC+z7DyrZHzo.
			Are you sure you want to continue connecting (yes/no)? yes
			Warning: Permanently added '[localhost]:2222' (ECDSA) to the list of known hosts.
			root@localhost's password:
			Welcome to Ubuntu 16.04.2 LTS (GNU/Linux 4.9.7-x86_64-linode80 x86_64)

			* Documentation: https://help.ubuntu.com
			* Management: https://landscape.canonical.com
			* Support: https://ubuntu.com/advantage
			Last login: Sat Mar 25 20:07:52 2017 from 104.200.154.81
			root@localhost:~#
			</pre>

			The lesson: if you are trying to tunnel a protocol through, need to pay attention to username and permissions.

			=Solution: Use Root to SSH=

			The solution to the problems I was experiencing was just to use the username "root" when connecting via ssh.

			<pre>
			$ ssh -p 2222 root@localhost
			</pre>

			This worked.


			[[Category:Stunnel]]
			[[Category:SSH]]

Admin: /* Attempt 1 */

2017-03-29T06:26:13Z

Attempt 1

← Older revision		Revision as of 06:26, 29 March 2017
Line 224:		Line 224:
	ssh_exchange_identification: read: Connection reset by peer		ssh_exchange_identification: read: Connection reset by peer
	</pre>		</pre>

			==Attempt 2==

			Trying various configuration variations, in case that's the problem.

			It's not.

			Tried server configuration file specifying accept the following ways:

			<pre>
			accept = 196.126.102.136:8000
			accept = 8000
			</pre>

			I left server connect as 127.0.0.1:port

			Tried the following client configuration files:

			<pre>
			accept = 127.0.0.1
			accept = 2222
			</pre>

			I left client connect as 196.126.102.136:8000.

Admin: /* Error: Connection Reset by Peer */

2017-03-29T06:01:02Z

Error: Connection Reset by Peer

← Older revision		Revision as of 06:01, 29 March 2017
Line 203:		Line 203:
	=Connect Over Stunnel Connection=		=Connect Over Stunnel Connection=

	==Error: Connection Reset by Peer==		==Attempt 1==

			===Error: Connection Reset by Peer===

	When I run an ssh command on the client, using port 2222, it's no die:		When I run an ssh command on the client, using port 2222, it's no die:
Line 213:		Line 215:

	The error message takes about 15 seconds to show up.		The error message takes about 15 seconds to show up.

			===Reproducing Error===

			I was able to reproduce the error on another Mac running Homebrew stunnel, with the same configuration file.

			<pre>
			$ ssh -p 2222 zappa@localhost
			ssh_exchange_identification: read: Connection reset by peer
			</pre>

Admin: /* Client configuration */

2017-03-29T05:57:37Z

Client configuration

← Older revision		Revision as of 05:57, 29 March 2017
Line 134:		Line 134:
	debug = 7		debug = 7
	[ssh]		[ssh]
	accept = 127.0.0.1:22		accept = 127.0.0.1:2222
	connect = 92.126.102.36:8000		connect = 92.126.102.36:8000
	</pre>		</pre>

Admin: /* Verifying the client is ok */

2017-03-29T05:34:12Z

Verifying the client is ok

← Older revision		Revision as of 05:34, 29 March 2017
Line 198:		Line 198:

	Can see port 2222 has been opened locally.		Can see port 2222 has been opened locally.

			At this point we have verified that both the server and the client are configured okay, and listening on the correct ports.

			=Connect Over Stunnel Connection=

			==Error: Connection Reset by Peer==

			When I run an ssh command on the client, using port 2222, it's no die:

			<pre>
			$ ssh -p 2222 zappa@localhost
			ssh_exchange_identification: read: Connection reset by peer
			</pre>

			The error message takes about 15 seconds to show up.

Admin: /* Client behavior */

2017-03-29T05:31:46Z

Client behavior

← Older revision		Revision as of 05:31, 29 March 2017
Line 140:		Line 140:
	===Client behavior===		===Client behavior===

	~~When~~ the stunnel ~~command is~~ run on the client,		On the client, these steps are for starting the stunnel server. These commands are run on Mac, with stunnel installed by homebrew to <code>/usr/local/</code>.

			First check the config file:

			<pre>
			$ cat /usr/local/etc/stunnel/stunnel.conf
			</pre>

			(Not opening any firewalls or opening port 8000. Letting stunnel take care of that.)

			Stop previous stunnel instances and start a new one:

			<pre>
			$ killall stunnel && stunnel
			</pre>

			Check the last few lines of the log to verify that everything is running correctly and bound to port 8000:

			<pre>
			$ tail /var/log/stunnel4/stunnel.log
			...
			2017.03.28 22:11:17 LOG5[ui]: Configuration successful
			2017.03.28 22:11:17 LOG7[ui]: Listening file descriptor created (FD=6)
			2017.03.28 22:11:17 LOG7[ui]: Service [ssh] (FD=6) bound to 0.0.0.0:2222
			</pre>

			===Verifying the client is ok===

			Not sure how to run the equivalent of the above netstat command.

			Checking open ports with nmap shows that port 2222

			<pre>
			$ nmap localhost; echo; nmap 127.0.0.1

			Starting Nmap 6.47 ( http://nmap.org ) at 2017-03-28 22:30 PDT
			Nmap scan report for localhost (127.0.0.1)
			Host is up (0.00042s latency).
			Not shown: 970 closed ports, 28 filtered ports
			PORT STATE SERVICE
			22/tcp open ssh
			2222/tcp open EtherNet/IP-1

			Nmap done: 1 IP address (1 host up) scanned in 5.59 seconds


			Starting Nmap 6.47 ( http://nmap.org ) at 2017-03-28 22:30 PDT
			Nmap scan report for localhost (127.0.0.1)
			Host is up (0.025s latency).
			Not shown: 998 closed ports
			PORT STATE SERVICE
			22/tcp open ssh
			2222/tcp open EtherNet/IP-1

			Nmap done: 1 IP address (1 host up) scanned in 10.93 seconds
			</pre>

			Can see port 2222 has been opened locally.