Protecting against POODLE SSL on stunnel

Question

How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?

Sergey · Accepted Answer · 2014-10-20T00:54:18.537

19

You can disable SSLv3 protocol on stunnel altogether.

From stunnel documentation:

sslVersion = SSL_VERSION

select version of SSL protocol Allowed

options: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2

I've added this to the config file:

sslVersion = TLSv1 TLSv1.1 TLSv1.2

And now I am not able to connect with SSLv3 (using openssl s_client -connect my.domain.com:443 -ssl3)

NOTE: Some older versions of stunnel and OpenSSL don't support TLSv1.2 (and even TLSv1.1). In this case, remove them from sslVersion directive to avoid incorrect version of ssl protocol error.

edited Oct 20 '14 at 00:54

answered Oct 15 '14 at 20:34

Sergey

928
4
10
22

I get the following error when I use the sslVersion = from above: Starting stunnel: file /etc/stunnel/stunnel.conf line 6: Incorrect version of SSL protocol. This is with 4.29. Can anyone else confirm that they do not get this error? – Ross Oct 17 '14 at 21:43
Some older versions of stunnel do not support TLSv1.2 or TLSv1.1. Try removing those, leaving just TLSv1. Confirmed this working on an older installation. – Sergey Oct 20 '14 at 00:50

score 10 · Answer 2 · answered Oct 20 '14 at 03:05

10

if you prefer to stick with older stunnel (like the 4.53 in your Debian Stable), you can disable SSLv2 and SSLv3 with:

sslVersion = all
options = NO_SSLv2
options = NO_SSLv3

instead of

sslVersion = TLSv1

which would disable TLSv1.1 and TLSv1.2 also.

answered Oct 20 '14 at 03:05

Matija Nalis

2,409
23
37

1

This works for me with stunnel 4.53 (Debian) and a modern OpenSSL (1.0.1e+security patches that Debian provides). I can connect to it using TLSv1.2. Yay! – Christopher Schultz Sep 02 '15 at 00:52

score 2 · Answer 3 · edited Oct 18 '14 at 12:00

Since I cannot comment, I will "answer" (sorry).

Anyway, I am running stunnel 5.01 and I also get the "incorrect version of SSL" error after making the change to sslVersion:

[!] Server is down
[.] Reading configuration from file stunnel.conf
[!] Line 4: "sslVersion = TLSv1 TLSv1.1 TLSv1.2": Incorrect version of SSL protocol

Fixed (for me). Had to upgrade stunnel to v5.06 (most current release as of today). Conf file is exactly the same so I guess there is some mojo happening between v5.01 and v5.06 that goes beyond a mere mortal to understand.

Protecting against POODLE SSL on stunnel

3 Answers3

Linked