• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

STunnel Is Modifying PEM File Incorrectly & Not Recreating /var/tmp/stunnel

Scheduled Pinned Locked Moved pfSense Packages
11 Posts 2 Posters 1.3k Views 2 Watching
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • A Offline
    alteredstate
    last edited by Nov 13, 2018, 6:51 PM

    Using the STunnel 5.37_1 package in pfSense 2.4.4 I have an issue where STunnel is not separating the: "-----END PRIVATE KEY-----" and "-----BEGIN CERTIFICATE-----". I believe this is only happening when I use an imported certificate using: "System --> Cert. Manager --> Certificates --> +Add/Sign --> Method --> Import an existing Certificate". Looking at that certificate's PEM file:

    cat /usr/local/etc/stunnel/'mycertfile'.pem
    

    I see this:

    ....Xhnsugqd
    -----END PRIVATE KEY----------BEGIN CERTIFICATE-----
    MIIGaTCCB....
    

    After I change it to this:

    ....Xhnsugqd
    -----END PRIVATE KEY-----
    -----BEGIN CERTIFICATE-----
    MIIGaTCCB....
    

    then STunnel will start. The problem is that after a pfSense reboot or reload the PEM file reverts back. There is also an issue where:

    /var/tmp/stunnel/
    

    will disappear after a pfSense reboot and then must be re-created before STunnel will start. Other than that, STunnel works great! Does anyone know how to permanently correct these issues?

    A 1 Reply Last reply Nov 14, 2018, 1:27 PM Reply Quote 0
    • A Offline
      alteredstate @alteredstate
      last edited by Nov 14, 2018, 1:27 PM

      ....Xhnsugqd
      -----END PRIVATE KEY----------BEGIN CERTIFICATE-----
      MIIGaTCCB....
      

      Adding an extra line at the end of: "-----END PRIVATE KEY-----" in the "Private key data" section seems to have fixed this issue and it is properly formatted during a service restart.

      0_1542201796770_0fd79b24-dbeb-4262-b768-1c1a13641dfe-image.png

      But there's still the issue where:

      /var/tmp/stunnel
      

      is removed during a reboot. Is it acceptable to move this directory inside of:

      /usr/local/etc/stunnel
      
      1 Reply Last reply Reply Quote 0
      • J Offline
        jimp Rebel Alliance Developer Netgate
        last edited by Nov 14, 2018, 2:43 PM

        Stunnel wasn't modifying the pem incorrectly, it just didn't handle a private key that was imported without a trailing newline.

        https://redmine.pfsense.org/issues/9118

        Fixed in stunnel pkg version 5.47, which should show up for upgrade shortly.

        Also, the /var/tmp/stunnel parts are a chroot and not meant to be altered. They will be regenerated when needed.

        The config files written by a package (or even the base system) are never meant to be modified by hand and will be overwritten by the package when syncing, at boot, etc.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        A 1 Reply Last reply Nov 14, 2018, 5:04 PM Reply Quote 0
        • A Offline
          alteredstate @jimp
          last edited by Nov 14, 2018, 5:04 PM

          @jimp said in STunnel Is Modifying PEM File Incorrectly & Not Recreating /var/tmp/stunnel:

          Stunnel wasn't modifying the pem incorrectly, it just didn't handle a private key that was imported without a trailing newline.

          https://redmine.pfsense.org/issues/9118

          Fixed in stunnel pkg version 5.47, which should show up for upgrade shortly.

          Also, the /var/tmp/stunnel parts are a chroot and not meant to be altered. They will be regenerated when needed.

          The config files written by a package (or even the base system) are never meant to be modified by hand and will be overwritten by the package when syncing, at boot, etc.

          I'm not altering the:

          /var/tmp/stunnel
          

          something (I assume pfSense or STunnel) is removing that directory after a reboot. I just rebooted pfSense and that directory is gone preventing STunnel from starting.

          This is the error I'm seeing:

          [!] chroot: No such file or directory (2)
          

          See, there's no "stunnel" directory here:

          [2.4.4-RELEASE][admin@pfSense]/root: ls -alh /var/tmp/
          total 16
          drwxrwxrwt   4 root  wheel   512B Nov 14 11:51 .
          drwxr-xr-x  15 root  wheel   512B Nov 14 11:51 ..
          drwxr-xr-x   7 root  wheel   512B Nov 14 11:51 nginx
          drwxr-xr-x   2 root  wheel   512B Nov 14 11:51 vi.recover
          

          Create the directory:

          [2.4.4-RELEASE][admin@pfSense]/root: mkdir /var/tmp/stunnel
          

          Now STunnel starts up and everyone is happy! Would you fix this please?

          1 Reply Last reply Reply Quote 0
          • J Offline
            jimp Rebel Alliance Developer Netgate
            last edited by Nov 14, 2018, 5:06 PM

            It starts up fine after a reboot here. Do you maybe have /var/ and /tmp/ in RAM disks?

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            A 1 Reply Last reply Nov 14, 2018, 5:21 PM Reply Quote 0
            • J Offline
              jimp Rebel Alliance Developer Netgate
              last edited by Nov 14, 2018, 5:18 PM

              That should be fixed now, too, once the new packages are built you'll see another update.

              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              1 Reply Last reply Reply Quote 0
              • A Offline
                alteredstate @jimp
                last edited by Nov 14, 2018, 5:21 PM

                @jimp said in STunnel Is Modifying PEM File Incorrectly & Not Recreating /var/tmp/stunnel:

                It starts up fine after a reboot here. Do you maybe have /var/ and /tmp/ in RAM disks?

                Yes, I have this enabled in pfSense:

                0_1542216061677_ba788096-5b76-4005-a858-fddeb0c27e4f-image.png

                1 Reply Last reply Reply Quote 0
                • J Offline
                  jimp Rebel Alliance Developer Netgate
                  last edited by Nov 14, 2018, 5:32 PM

                  That is what is causing it to be removed every reboot, not the package.

                  I made the package re-create the dirs on each sync now though so it should be fine.

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  A 1 Reply Last reply Nov 14, 2018, 5:35 PM Reply Quote 0
                  • A Offline
                    alteredstate @jimp
                    last edited by Nov 14, 2018, 5:35 PM

                    @jimp said in STunnel Is Modifying PEM File Incorrectly & Not Recreating /var/tmp/stunnel:

                    That is what is causing it to be removed every reboot, not the package.

                    I made the package re-create the dirs on each sync now though so it should be fine.

                    Great! and this is the updated package you are soon going to add to the repo?

                    1 Reply Last reply Reply Quote 0
                    • J Offline
                      jimp Rebel Alliance Developer Netgate
                      last edited by Nov 14, 2018, 5:36 PM

                      It should already be up and available for 2.4.4 users. If not, it will be in a few moments.

                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                      Need help fast? Netgate Global Support!

                      Do not Chat/PM for help!

                      A 1 Reply Last reply Nov 14, 2018, 5:39 PM Reply Quote 0
                      • A Offline
                        alteredstate @jimp
                        last edited by Nov 14, 2018, 5:39 PM

                        @jimp said in STunnel Is Modifying PEM File Incorrectly & Not Recreating /var/tmp/stunnel:

                        It should already be up and available for 2.4.4 users. If not, it will be in a few moments.

                        Wonderful, thanks for the help!

                        1 Reply Last reply Reply Quote 0
                        11 out of 11
                        • First post
                          11/11
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                          This community forum collects and processes your personal information.
                          consent.not_received