- stunnel-users - stunnel.org

stunnel doesn't allow two client certificates with the same Subject DN?
by Christopher Schultz 16 Apr '24

16 Apr '24

Hello, I was recently rotating a certificate for a service and I went through my usual procedure: 1. Generate a new client key+cert; don't place them into service, yet 2. Distribute the new certificate to all my stunnel servers that need to trust it by placing it at the end of each of my servers' CAFile files 3. Restart all stunnel services 4. Swap the old key+cert for the client with the new key+cert 5. Test that all is well I've found that if the Distinguished Name of both the old and new certificate are the same, stunnel will only trust the one that is mentioned /first/ in the CAFile. For example, if the CAFile contains: -----BEGIN CERTIFICATE----- certificate A Serial Number: 12345678 Subject: C=US, OU=Testing, O=Example.com, CN=test -----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE----- certificate B Serial Number: 87654321 Subject: C=US, OU=Testing, O=Example.com, CN=test -----BEGIN CERTIFICATE----- Certificate A will be trusted but Certificate B will not be trusted. The error shown in the logs is: CERT: Pre-verification error: self signed certificate Apr 15 21:33:06 mirth-pcc.chadis.com stunnel[23421]: Certificate check failed: depth=0, /C=US/OU=Testing/O=Example.com/CN=test While the certificates are both self-signed, that should not cause an error. Removing the old certificate from the CAFile or moving it to the bottom of the file resolves the problem. (But of course then Certificate A is no longer trusted despite it appearing in the CAFile.) Is this expected behavior? It would be very helpful if stunnel could support two different certificates with the same Subject DN for these kinds of cert-rotation processes. The alternatives are to always use a new DN each time or to add/remove at the same time which makes rolling-back more difficult. Note that everything else about these certificates is different: serial number, fingerprint, generating-key, etc. It's only the Subject DN that is the same. This is stunnel 4.56 on x86_64-koji-linux-gnu platform, on Amazon Linux 2. Thanks! -chris

2 1

HELO handshake problem (?)
by Ducale Ducale 10 Apr '24

10 Apr '24

In a Windows 10 machine I'm using a tool (Netwrix Service Monitor) with a SMTP notification feature that doesn't support authentication, so I'm using Stunnel 5.72 as a local relay for SMTP2GO (smtp2go.com) with this configuration: [smtp2go] client = yes accept = 127.0.0.1:25 connect = mail.smtp2go.com:2525 protocol = smtp protocolAuthentication = plain protocolHost = cloud.mydomain.com protocolUsername = smtp2go(a)mydomain.com protocolPassword = P@ssw0rd debug = 7 I try both PLAIN and LOGIN as authentication mode, with this is error: LOGIN: " ... TLS connected: new session negotiated TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) Peer temporary key: X25519, 253 bits Compression: null, expansion: null -> HELO cloud.mydomain.com <- 250 mail.smtp2go.com Hello cloud.mydomain.com [x.x.x.x] -> AUTH LOGIN <- 503 AUTH command used when not advertised Remote server does not support LOGIN authentication ... " PLAIN: " ... TLS connected: new session negotiated TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) Peer temporary key: X25519, 253 bits Compression: null, expansion: null -> HELO cloud.mydomain.com <- 250 mail.smtp2go.com Hello cloud.mydomain.com [x.x.x.x] -> AUTH PLAIN ******************************************** <- 503 AUTH command used when not advertised PLAIN Authentication Failed Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Deallocating application specific data for session connect address ... " Can anyone help me solve this problem? Thanks!

3 3

help configuration for socks5 nordvpn requiring authentication
by Alberto P 10 Apr '24

10 Apr '24

Hello, I would like to use stunnel to use a socks5 server requiring user/pass authentication (nordvpn) with different clients that allow for a socks5 proxy but no authentication. Could someone help me with the configuration (linux or windows is good). In detail, I don't know how to provide user/pass to the configuration, and if it is actually feasible. Any help will be very appreciated !

1 1

Stunnel - Silent switch to change the install directory
by Meena Prabhakaran 27 Mar '24

27 Mar '24

Hi Team, We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. For more details, please have a look at Autonomous Patching for Every Third-Party Windows App (adaptiva.com) (https://adaptiva.com/products/autonomous-patch) We are willing to add the latest stable version of Stunnel product to our catalogue. Downloaded https://www.stunnel.org/downloads/stunnel-5.72-win64-installer.exe We are testing this app on Windows 10 64Bit VM. Please help us on below points: 1. Is there any switch/parameter which can be passed along with "stunnel-5.72-win64-installer.exe" for changing the "Install directory" silently? Tried these switches - /D, /DIR, /APPDIR, /INSTALLDIR, /TARGETDIR, /INSTALLLOCATION Thanks & Regards, Meena Prabhakaran Application Packager, Adaptiva M +91 9080759487 meena.prabhakaran(a)adaptiva.com<mailto:[email protected]> www.adaptiva.com<http://www.adaptiva.com/> Data Protection and Privacy: Your privacy is important to us. We are committed to protecting your personal information and handling it responsibly. For more information on how we process and protect your data, please review our Privacy Policy (https://adaptiva.com/privacy) Confidentiality Notice: Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of Adaptiva. The recipient should check for the presence of viruses, as Adaptiva accepts no liability for any virus transmitted by this email.

3 3

Received trusted client CA list not found
by allmail 16 Mar '24

16 Mar '24

I see this message in the Stunnel (client) logs during SSL handshake with the server The server requires a client certificate which has been configured in the stunnel configuration. The handshake is working fine but I was wondering what exactly does this line mean. From what I found so far, seems like there is a way for the server to specify which CA's it will accept for the client certificate and it can specify them in the ClientCertificate request that it sends This server doesnt send anything like that, so I am guessing that is the reason for this log line? Can someone please confirm? Btw, I see this line only when using TLSv1.3. When I restrict the client to TLSv1.2, I dont see this line. thanks LOG Peer certificate required TLS state (connect): before SSL initialization Initializing application specific data for session authenticated TLS state (connect): SSLv3/TLS write client hello TLS state (connect): SSLv3/TLS write client hello TLS state (connect): SSLv3/TLS read server hello TLS state (connect): TLSv1.3 read encrypted extensions Received trusted client CA list not found TLS state (connect): SSLv3/TLS read server certificate request

1 0

Windows service won't start. ""The Stunnel TLS wrapper service is marked as an interactive service."
by docfxit＠theoffice.la 12 Mar '24

12 Mar '24

This is my log: [code] stunnel 5.72 on x64-pc-mingw32-gnu platform 2024.03.10 10:19:49 LOG5[main]: Compiled/running with OpenSSL 3.2.1 30 Jan 2024 2024.03.10 10:19:49 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2024.03.10 10:19:49 LOG7[main]: errno: (*_errno()) 2024.03.10 10:19:49 LOG6[main]: Initializing inetd mode configuration 2024.03.10 10:19:49 LOG7[main]: Running on Windows 6.2 Windows 10 2024.03.10 10:19:49 LOG5[main]: Reading configuration from file C:\Programs\stunnel\config\stunnel.conf 2024.03.10 10:19:49 LOG5[main]: UTF-8 byte order mark not detected 2024.03.10 10:19:49 LOG5[main]: FIPS mode disabled 2024.03.10 10:19:49 LOG6[main]: Compression disabled 2024.03.10 10:19:49 LOG7[main]: No PRNG seeding was required 2024.03.10 10:19:49 LOG6[main]: Initializing service [pop3_DocfxitGmail] 2024.03.10 10:19:49 LOG7[main]: Initializing context [pop3_DocfxitGmail] 2024.03.10 10:19:49 LOG6[main]: OpenSSL security level is used: 2 2024.03.10 10:19:49 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2024.03.10 10:19:49 LOG7[main]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2024.03.10 10:19:49 LOG7[main]: TLS options: 0x2100000 (+0x0, -0x0) 2024.03.10 10:19:49 LOG6[main]: Session resumption enabled 2024.03.10 10:19:49 LOG7[main]: No certificate or private key specified 2024.03.10 10:19:49 LOG6[main]: No trusted certificates found [/code] I copied a working config from Windows 7 64bit. Running stunnel 5.50

2 1

A conclusive Manual for Web Nursing Classes
by silir10174＠mcuma.com 07 Mar '24

07 Mar '24

[b]A conclusive Manual for Web Nursing Classes[/b] Show (150 words): In the rapidly creating circumstance of preparing, electronic learning has changed into an establishment for overwhelmingly most certain clinical directors searching for flexibility and responsiveness. This wide aide, "Rx for Progress: An unequivocal [url=https://tutorsacademy.co/nurs-fpx-4050-assessment-2-ethical-and-policy-factors-in-care-coordination/]4050 assessment 2[/url] Manual for Electronic Nursing Classes," bounces into the universe of web nursing bearing, offering boundless encounters and strong signs to explore this imperative learning environment. From picking the right program to winning in virtual study corridors, this guide means to empower specific specialists with the data and resources expected to prosper in the online nursing preparing space. I. The Move of Web Nursing Coaching The key piece investigates the making obviousness of electronic nursing programs, uncovering data into the parts that have added to their standing. Look at the flexibility these undertakings offer, the rising interest for remote learning, and such progress in movement that [url=https://tutorsacademy.co/nurs-fpx-4040-assessment-1-nursing-informatics-in-health-care/]nurs 4040 assessment 1[/url] make electronic arranging more open than later in consistent memory. II. Picking the Right Web Nursing Undertaking This part gives an every little push toward turn guide on picking the ideal electronic nursing program. It covers fundamental evaluations like declaration, program reputation, labor force endorsements, and the availability of clinical approaches. Furthermore, it offers tips on researching and standing separated different undertakings from ensure a remarkably arranged fit for individual necessities and goals. III. Investigating Virtual Homerooms Truly analyzing the virtual homeroom is genuine for web nursing students. This part offers significant empowering on utilizing time, as a matter of fact, convincing correspondence with instructors and mates, and utilizing on the web resources. It also addresses typical challenges looked by online students and gives systems to beat them. IV. Controlling Clinical Experiences Clinical experiences are a crucial piece of nursing tutoring. This part examines how web nursing programs coordinate clinical circumstances, orchestrating the meaning of dynamic experience and offering heading on finding fitting entryways locally. It likewise discusses the control of reenactment movement in beating any hindrance among speculation and practice. V. Instruments and Movements for Online Accomplishment To win in electronic nursing classes, students ought to be have a lot of involvement in various contraptions and levels of progress. This part approaches basic programming, stages, and resources that can moreover cultivate the shocking an open door for development. From virtual labs to crafty outline materials, this guide ensures students are outstanding for progress. VI. Vanquishing Challenges and Remaining Invigorated Web learning goes with its own course of action of troubles. This part pays special attention to normal blocks like detachment, time use difficulties, and movement issues. It gives essential clues on extra moved, searching for help, and saving solid areas for an among fun and serious exercises. End Considering everything, "Rx for Progress: A persuading Manual for Electronic Nursing Classes" fills in as a total partner without a doubt clinical managers leaving on their online training experience. By resolving focal issues of view from program decision to overwhelming virtual homerooms, this guide partners with students to thrive in the dynamic and repaying field of electronic nursing training. Outfitted with data and sensible designs, perusers are all set to embrace the doorways and burdens of electronic getting, making game plans for a valuable nursing business.

1 0

Stunnel HA Options
by caspernetherlands＠gmail.com 07 Mar '24

07 Mar '24

Hello folks, I have seen a couple of other posts concerning this question but I am still unclear and wanted to see if there are any new options for 2024. What would the recommended setup for Stunnel look like for HA (high-availability)? All I need is basically to have two servers, one active and another one stand by and be able to fail over to the standby server when the active one becomes unavailable due to hardware failure, bad vmotion etc. Extra point if this setup offers automatic failover to DR as well, meaning failover to a third server that's also on standby in case of catastrophic failures on the first two. This almost looks like a load-balancing solution but not really. I say this because I tried to leverage F5 to accomplish this HA scenario and wasn't successful at it because of the way that the F5 performs active checks so often and how noisy that can be for network perimeter security setups. My main request is the local HA though, I can come up with a solution for DR later on. Any recommendation is appreciated. Thank you in advance!

4 5

possible typo in manpage imap example
by alisonatwork＠outlook.com 05 Mar '24

05 Mar '24

Hi, It's possible that I am missing something obvious, but I was reading the manpage today and it seems like the example suggesting how to configure an email client for tunneled imap is incorrect. It suggests that the user configure their client to connect to port 119, but then the example stunnel config shows accept = 143. If this is indeed incorrect, I think the following files need to be modified to change 119 to 143: doc/stunnel.8.in doc/stunnel.html.in doc/stunnel.pl.8.in doc/stunnel.pl.html.in doc/stunnel.pl.pod.in doc/stunnel.pod.in Regards, Alison

1 0

Succeeding in Nursing Academia: The Critical Impact of Online Course Assistance on Academic Triumph
by towim42830＠artgulin.com 04 Mar '24

04 Mar '24

Introduction: In the dynamic landscape of education, the demand for online courses has witnessed an unprecedented surge, especially in fields like nursing. The flexibility and accessibility offered by online learning platforms have made education more attainable for individuals balancing work, family, and other commitments nurs fpx 4050 assessment 2. However, the rigorous nature of nursing programs can pose challenges for students, leading many to seek assistance with their coursework. In this blog, we will explore the growing trend of students turning to online course help and paying someone to do their online classes, particularly in the realm of nursing paper writing services. The Rise of Online Nursing Education: The allure of online nursing education lies in its flexibility, allowing aspiring nurses to pursue their dreams without sacrificing their current commitments. With the increasing popularity of online nursing programs, students are presented with a unique set of challenges. Balancing clinical experiences, theoretical coursework, and other responsibilities can be overwhelming, prompting students to explore options for additional support. The Need for Academic Assistance: Nursing programs often require students to delve into complex topics, complete extensive research, and submit well-crafted papers. The pressure to excel in both practical and theoretical aspects of nursing education can be daunting, leading some students to seek online course help. The question then arises – is it ethical to pay someone to do my online class or assist with nursing paper writing services? Understanding the Ethical Dilemma: The ethical considerations surrounding seeking academic assistance are complex. On one hand, students argue that external support enables them to focus on practical experiences and hands-on learning. On the other hand, critics argue that outsourcing coursework undermines the integrity of education and the development of essential skills nurs-fpx 4060 assessment 1. Navigating the Online Course Help Landscape: For those considering online course help, it is crucial to approach the situation with caution and a clear understanding of the ethical implications. Many online platforms and services claim to provide assistance with nursing paper writing services, but it is essential to discern between legitimate support and services that may compromise academic integrity. Choosing Reputable Services: When seeking online course help for nursing paper writing services, it is imperative to choose reputable and ethical service providers. These services should prioritize academic honesty, transparency, and the development of students' critical thinking skills. Thoroughly researching and vetting potential service providers can help students make informed decisions. The Role of Academic Support Services: Rather than viewing online course help as a shortcut, students should consider these services as valuable supplements to their learning journey. Academic support services can offer guidance, feedback, and assistance in understanding complex nursing concepts. This collaborative approach allows students to enhance their skills while meeting the demands of their coursework chamberlain nurse executive track. Developing Essential Skills: While online course help can provide support, it is essential for students to actively engage with the material and develop the critical skills necessary for a successful nursing career. Ethical academic support services aim to empower students, encouraging them to take an active role in their education and fostering a sense of responsibility for their learning outcomes. Balancing Priorities: The decision to seek online course help should be accompanied by a realistic assessment of one's priorities and capabilities. Nursing students juggling multiple responsibilities may find that strategic use of academic support services can help them maintain a healthy work-life balance while excelling in their coursework. The Impact on Future Nursing Practice: Aspiring nurses must recognize that the skills and knowledge acquired during their education directly impact their ability to provide quality patient care in the future. While online course help can provide temporary relief, it is crucial for students to actively engage with the material and strive for a deep understanding of nursing concepts. Conclusion: The landscape of nursing education is evolving, with online courses offering unprecedented flexibility for students. As the demand for nursing professionals continues to grow, the need for academic support services, including nursing paper writing services, is likely to persist online class help. However, students must approach online course help with a balanced perspective, understanding the ethical considerations and prioritizing the development of essential skills. By navigating the online course help landscape responsibly, nursing students can enhance their learning experience and prepare for a successful and fulfilling career in healthcare.

1 0

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

How to use best config to secure stunnel?
by sephrrr＠gmail.com 27 Feb '24

27 Feb '24

Irans goverment start to detect stunnel with openvpn tunnel. how to avoid this? is there any updates for stunnel for this problem?

1 0

Windows 2022 tunnel client issues
by Mark Weishaar 23 Feb '24

23 Feb '24

Hello, I’m working on replacing an older Windows server that uses stunnel 5.71 to connect to an Oracle database running on a Linux box. I can communicate just fine with the older Windows machine and another Linux box; however, when I try to connect with the stunnel 5.72 on the Windows 2022 server, I keep running into issues and the connection is forcibly closed. Old Windows server: stunnel 5.71 New Windows 2022 server: stunnel 5.72 (I also tried 5.71 and 5.62 just to rule things out Oracle db server: stunnel 5.72 Other Linux server: stunnel 5.72 My stunnel.conf file is very basic, but this is what is working from my other Windows server (running stunnel 5.71): debug = 7 [oracle15211] client = yes accept = 127.0.0.1:15211 connect = 172.28.125.52:15211 Below is the log with debug level 7… the only issue that I’m seeing is the “transfer() loop executes not transferring any data” message that baffles me but I’m not sure if that’s the cause of my issues or not: 2024.02.23 11:10:21 LOG7[0]: Service [oracle15211] started 2024.02.23 11:10:21 LOG7[0]: Setting local socket options (FD=768) 2024.02.23 11:10:21 LOG7[0]: Option TCP_NODELAY set on local socket 2024.02.23 11:10:21 LOG5[0]: Service [oracle15211] accepted connection from 127.0.0.1:49750 2024.02.23 11:10:21 LOG6[0]: s_connect: connecting 172.28.125.52:15211 2024.02.23 11:10:21 LOG7[0]: s_connect: s_poll_wait 172.28.125.52:15211: waiting 10 seconds 2024.02.23 11:10:21 LOG7[0]: FD=780 ifds=rwx ofds=--- 2024.02.23 11:10:21 LOG5[0]: s_connect: connected 172.28.125.52:15211 2024.02.23 11:10:21 LOG5[0]: Service [oracle15211] connected remote server from 172.28.112.245:49751 2024.02.23 11:10:21 LOG7[0]: Setting remote socket options (FD=780) 2024.02.23 11:10:21 LOG7[0]: Option TCP_NODELAY set on remote socket 2024.02.23 11:10:21 LOG7[0]: Remote descriptor (FD=780) initialized 2024.02.23 11:10:21 LOG6[0]: SNI: sending servername: 172.28.125.52 2024.02.23 11:10:21 LOG6[0]: Peer certificate not required 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): before SSL initialization 2024.02.23 11:10:21 LOG7[0]: Initializing application specific data for session authenticated 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): TLSv1.3 read encrypted extensions 2024.02.23 11:10:21 LOG6[0]: CERT: Certificate verification disabled 2024.02.23 11:10:21 LOG6[0]: CERT: Certificate verification disabled 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): TLSv1.3 read server certificate verify 2024.02.23 11:10:21 LOG7[0]: OCSP stapling: Client callback called 2024.02.23 11:10:21 LOG6[0]: OCSP: Certificate chain verification disabled 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2024.02.23 11:10:21 LOG7[0]: 1 client connect(s) requested 2024.02.23 11:10:21 LOG7[0]: 1 client connect(s) succeeded 2024.02.23 11:10:21 LOG7[0]: 0 client renegotiation(s) requested 2024.02.23 11:10:21 LOG7[0]: 0 session reuse(s) 2024.02.23 11:10:21 LOG6[0]: TLS connected: new session negotiated 2024.02.23 11:10:21 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2024.02.23 11:10:21 LOG6[0]: Peer temporary key: X25519, 253 bits 2024.02.23 11:10:21 LOG7[0]: Compression: null, expansion: null 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSL negotiation finished successfully 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSL negotiation finished successfully 2024.02.23 11:10:21 LOG7[0]: Initializing application specific data for session authenticated 2024.02.23 11:10:21 LOG7[0]: Deallocating application specific data for session connect address 2024.02.23 11:10:21 LOG7[0]: New session callback 2024.02.23 11:10:21 LOG7[0]: Peer certificate was cached (1375 bytes) 2024.02.23 11:10:21 LOG6[0]: Session id: B36502A30B16F61EFE3A13B7BAA73BBCD57C2C6DB838FFC7CDFDE9BF7D8607A0 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read server session ticket 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSL negotiation finished successfully 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSL negotiation finished successfully 2024.02.23 11:10:21 LOG7[0]: Initializing application specific data for session authenticated 2024.02.23 11:10:21 LOG7[0]: New session callback 2024.02.23 11:10:21 LOG7[0]: Deallocating application specific data for session connect address 2024.02.23 11:10:21 LOG6[0]: Session id: 7FC6ABDCD70443FE70736F725F90792FAC2692FD9AD8F54A3F0443C2403C9A0C 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read server session ticket 2024.02.23 11:10:21 LOG3[0]: transfer() loop executes not transferring any data 2024.02.23 11:10:21 LOG3[0]: please report the problem to Michal.Trojnara(a)stunnel.org<mailto:[email protected]> 2024.02.23 11:10:21 LOG3[0]: stunnel 5.72 on x64-pc-mingw32-gnu platform 2024.02.23 11:10:21 LOG3[0]: Compiled/running with OpenSSL 3.2.1 30 Jan 2024 2024.02.23 11:10:21 LOG3[0]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2024.02.23 11:10:21 LOG7[0]: errno: (*_errno()) 2024.02.23 11:10:21 LOG3[0]: protocol=TLSv1.3, SSL_pending=0, SSL_has_pending=0 2024.02.23 11:10:21 LOG3[0]: sock_open_rd=Y, sock_open_wr=Y 2024.02.23 11:10:21 LOG3[0]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2024.02.23 11:10:21 LOG3[0]: sock_can_rd=n, sock_can_wr=n 2024.02.23 11:10:21 LOG3[0]: ssl_can_rd=n, ssl_can_wr=n 2024.02.23 11:10:21 LOG3[0]: read_wants_read=Y, read_wants_write=n 2024.02.23 11:10:21 LOG3[0]: write_wants_read=n, write_wants_write=n 2024.02.23 11:10:21 LOG3[0]: shutdown_wants_read=n, shutdown_wants_write=n 2024.02.23 11:10:21 LOG3[0]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) 2024.02.23 11:10:21 LOG5[0]: Connection reset: 685 byte(s) sent to TLS, 381 byte(s) sent to socket 2024.02.23 11:10:21 LOG7[0]: remote_fd reset (FD=780) 2024.02.23 11:10:21 LOG7[0]: Remote descriptor (FD=780) closed 2024.02.23 11:10:21 LOG7[0]: local_rfd/local_wfd reset (FD=768) 2024.02.23 11:10:21 LOG7[0]: Local descriptor (FD=768) closed 2024.02.23 11:10:21 LOG7[0]: Service [oracle15211] finished (0 left) Any help is greatly appreciated! Thank you, Mark

1 0

Dynamic DNS
by alstar＠maybenot.work 20 Feb '24

20 Feb '24

Hi, I'm running Stunnel on Linux. It needs to connect to a dynamic IP address (by domain name). The DNS is updated automatically. I noticed that the last time the address changed, Stunnel stopped working. A ping from the machine produced the correct address but Stunnel was using the old one. Will a reload work?

4 6

stunnel 5.72 released
by Michał Trojnara 05 Feb '24

05 Feb '24

Dear Users, I have released version 5.72 of stunnel. ### Version 5.72, 2024.02.04, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.2.1. * Bugfixes - Fixed SSL_CTX_new() errors handling. - Fixed OPENSSL_NO_PSK builds. - Android build updated for NDK r23c. - stunnel.nsi updated for Debian 12. - Fixed tests with OpenSSL older than 1.0.2. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 3d532941281ae353319735144e4adb9ae489a10b7e309c58a48157f08f42e949 stunnel-5.72.tar.gz 1037c53f8ab590c2f3001e54cf381c3ea4225e9670b03870191383060e6851e7 stunnel-5.72-win64-installer.exe 668161b90034820198c456b4137ed3680d6fd49d4de920d51e499b84538f63d3 stunnel-5.72-android.zip Best regards, Mike

1 0

error:0A00010B:SSL routines::wrong version number
by Graham Lang 18 Dec '23

18 Dec '23

Hi, I've been using Stunnel for many years without a problem but I just changed my email provider and now my mail client can't send emails. Receiving via POP is still fine, but sending via SMTP is giving the error "SSL_connect: ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number" The old SMTP server was on port 465 whereas the new server (hotmail) is on port 587 so that may be the source of the problem. My config file is quite simple: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [pop] accept = 110 connect = outlook.office365.com:995 [smtp] accept = 25 connect = smtp-mail.outlook.com:587 I just changed the POP and SMTP server details to the new ones. POP is still on port 995 as it was before but SMTP has changed from 465 to 587. I was running an older version of Stunnel but updating to latest version hasn't helped. Does anyone have any ideas? I'd hate to have to lose my old Email client which has so many messages stored so it would be great to get it working fully with hotmail. Thanks! Graham.

4 3

stunnel - slowness
by Luciano Bonifácio 15 Dec '23

15 Dec '23

Good morning guys! I started using stunnel very recently with GLPI to authenticate to Google LDAP, and it is working, but with extreme slowness at Login. Something around 35 seconds. I believe there may be some parameters, adjustments to make. I'm sending the stunnel.conf configuration below, as well as the attached log file(txt). Could you give me a suggestion. Thanks, Luciano # stunnel.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - debug = 7 output = /var/log/stunnel4/stunnel.log [ldap] client = yes accept = 127.0.0.1:1636 connect = ldap.google.com:636 cert = /etc/certificates/glpi_ldap.crt key = /etc/certificates/glpi_ldap.key - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

1 0

Paho connection to stunnel
by jesramsing＠hotmail.com 15 Dec '23

15 Dec '23

I have a strange problem connecting from a C++ application using the Paho framework to the stunnel. The certificates are self signed, and MQTT Explorerr hooks up nicely and validates the certificate when fed with the appropriate ca certificate. So, stunnel seems to behave nicely on some cases, others not. The stunnel log shows a SSL_accept: ssl/record/ssl3_record_c:354: errror: 0A00010B:SSL wrong version. I have tried version 1.1 and 1.2 in the Paho library, both failing with the same error code. Any ideas or suggestions?

1 0

Re: Getting logs in systemd environment
by Christopher Schultz 13 Dec '23

13 Dec '23

Michael, On 12/13/23 15:43, Michael D. Setzer II wrote: > /var/log/secure Thank you for your reply, but /var/log is basically empty (meaning very few files located there). journald has absorbed everything and files are no longer the way to get logs from systemd-based environments. The only thing which contains non-trivial information is /var/log/journal/* which is a bunch of binary files. My reply below shows how you can get the stunnel-related log messages. I don't believe they are available through any traditional text-based log file. -chris > On 13 Dec 2023 at 15:37, Christopher Schultz wrote: > > Date sent: Wed, 13 Dec 2023 15:37:04 -0500 > To: "'stunnel-users(a)stunnel.org'" > <stunnel-users(a)stunnel.org> > From: Christopher Schultz > <chris(a)christopherschultz.net> > Subject: [stunnel-users] Re: Getting logs in systemd > environment > patches" <stunnel-users.stunnel.org> > >> Carter, >> >> On 12/13/23 14:53, cbrowne wrote: >>> Have you tried doing "find / -name stunnel.log -print" as root. I have >>> found that the log file can be in a number of different locations >>> depending on the system. >> >> There are no files named stunnel.log on my system. >> >> I do not have a specific setting for "output". I was expecting syslog to >> be used for that purpose without a specific setting. syslog=yes appears >> to be the default given the man page for stunnel. >> >> But your comment got me more interested in exactly what was happening, >> so I tried /not/ limiting journalctl --follow to a specific service and >> I can see all kinds of things coming from stunnel: >> >> >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready >> file descriptor(s) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 >> events=0x2001 revents=0x1 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service >> [ORU-outbound] accepted (FD=3) from ::ffff:20.204.213.204:55455 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Service >> [ORU-outbound] started >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Setting local >> socket options (FD=3) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Option >> TCP_NODELAY set on local socket >> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Service >> [ORU-outbound] accepted connection from ::ffff:20.204.213.204:55455 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174806]: Peer >> certificate required >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Initializing >> application specific data for session authenticated >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: SNI: no >> virtual services defined >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS read client hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write server hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write certificate >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write key exchange >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write certificate request >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write server done >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready >> file descriptor(s) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 >> events=0x2001 revents=0x1 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service >> [ORU-outbound] accepted (FD=15) from ::ffff:client.ip:44905 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Service >> [ORU-outbound] started >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Setting local >> socket options (FD=15) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Option >> TCP_NODELAY set on local socket >> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174807]: Service >> [ORU-outbound] accepted connection from ::ffff:client.ip:44905 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174807]: Peer >> certificate required >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Initializing >> application specific data for session authenticated >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: SNI: no >> virtual services defined >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS read client hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write server hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write certificate >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write key exchange >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write certificate request >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write server done >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS alert >> (read): fatal: certificate unknown >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Remove >> session callback >> Dec 13 20:31:00 example.com stunnel[300695]: LOG3[174806]: SSL_accept: >> ssl/record/rec_layer_s3.c:1605: error:0A000416:SSL routines::sslv3 alert >> certificate unknown >> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Connection >> reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket >> >> So this probably just comes down to either systemd/journalctl or me >> being stupid. >> >> Instead of asking for the journal/log for the "unit" stunnel (i.e. >> journalctl -u stunnel), you need instead to ask for the "systelog >> identifier" called stunnel like this: >> >> $ journalctl -t stunnel >> >> If you use --follow you get tail -f behavior, which is nice to see >> what's happening in real-time. >> >> -chris >> >>> On 12/13/2023 2:39 PM, Christopher Schultz wrote: >>>> other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears >>>> the case that I should be able to view the journals using this command: >>>> >>>> sudo journalctl --follow -u stunnel.service >>>> >>>> But nothing is ever printed there. >>> >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org >> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org > > > +------------------------------------------------------------+ > Michael D. Setzer II - Computer Science Instructor > (Retired) > mailto:[email protected] > mailto:[email protected] > mailto:[email protected] > Guam - Where America's Day Begins > G4L Disk Imaging Project maintainer > http://sourceforge.net/projects/g4l/ > +------------------------------------------------------------+ > > >

2 2

Getting logs in systemd environment
by Christopher Schultz 13 Dec '23

13 Dec '23

All, I recently built a server from scratch in Amazon EC2 using Amazon Linux 2023 which is systemd-based. When having trouble with a client failing to connect to our stunnel-based service, I tried raising the log level: debug=7 and restarted the service. I can't find any indication that the logs are available. There is no /var/log/stunnel directory. There are none of the usual files I might expect these logs to be in on other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears the case that I should be able to view the journals using this command: sudo journalctl --follow -u stunnel.service But nothing is ever printed there. Does anyone know how to get logging from stunnel in this kind of environment? (BTW, *I* am able to connect to this service, so I know it's running, etc. This is only a logging-problem, not an stunnel-isnt-working problem.) Thanks, -chris

2 1

Re: Getting logs in systemd environment
by Christopher Schultz 13 Dec '23

13 Dec '23

Carter, On 12/13/23 14:53, cbrowne wrote: > Have you tried doing "find / -name stunnel.log -print" as root. I have > found that the log file can be in a number of different locations > depending on the system. There are no files named stunnel.log on my system. I do not have a specific setting for "output". I was expecting syslog to be used for that purpose without a specific setting. syslog=yes appears to be the default given the man page for stunnel. But your comment got me more interested in exactly what was happening, so I tried /not/ limiting journalctl --follow to a specific service and I can see all kinds of things coming from stunnel: Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready file descriptor(s) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 events=0x2001 revents=0x1 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service [ORU-outbound] accepted (FD=3) from ::ffff:20.204.213.204:55455 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Service [ORU-outbound] started Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Setting local socket options (FD=3) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Option TCP_NODELAY set on local socket Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Service [ORU-outbound] accepted connection from ::ffff:20.204.213.204:55455 Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174806]: Peer certificate required Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Initializing application specific data for session authenticated Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: SNI: no virtual services defined Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS read client hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write server hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write certificate Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write key exchange Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write certificate request Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write server done Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready file descriptor(s) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 events=0x2001 revents=0x1 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service [ORU-outbound] accepted (FD=15) from ::ffff:client.ip:44905 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Service [ORU-outbound] started Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Setting local socket options (FD=15) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Option TCP_NODELAY set on local socket Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174807]: Service [ORU-outbound] accepted connection from ::ffff:client.ip:44905 Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174807]: Peer certificate required Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Initializing application specific data for session authenticated Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: SNI: no virtual services defined Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS read client hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write server hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write certificate Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write key exchange Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write certificate request Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write server done Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS alert (read): fatal: certificate unknown Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Remove session callback Dec 13 20:31:00 example.com stunnel[300695]: LOG3[174806]: SSL_accept: ssl/record/rec_layer_s3.c:1605: error:0A000416:SSL routines::sslv3 alert certificate unknown Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket So this probably just comes down to either systemd/journalctl or me being stupid. Instead of asking for the journal/log for the "unit" stunnel (i.e. journalctl -u stunnel), you need instead to ask for the "systelog identifier" called stunnel like this: $ journalctl -t stunnel If you use --follow you get tail -f behavior, which is nice to see what's happening in real-time. -chris > On 12/13/2023 2:39 PM, Christopher Schultz wrote: >> other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears >> the case that I should be able to view the journals using this command: >> >> sudo journalctl --follow -u stunnel.service >> >> But nothing is ever printed there. >

1 0

Connect multiple clients to one server port
by egig＠gmv.com 12 Dec '23

12 Dec '23

Hi all I was wondering if there is a way to connect multiple stunnel clients running on different machines to the same stunnel server service, also running on a different machine. All the clients must connect to the same server port. I have tried it with my current config but I haven't been able to make it work, is this even possible?? Thanks, Esteban.

3 4

Accepted connection and then TIMEOUTconnection exceeded:
by trashrap22＠gmail.com 07 Dec '23

07 Dec '23

Hi All, I can ssh to my VM with terminal etc. However my stunnel has something stopping the packet flow? What could be the problem and what should I check / troubleshoot: client log file: 2023.12.07 07:21:05 LOG7[0]: Service [Sql_Silicon] started 2023.12.07 07:21:05 LOG7[0]: Setting local socket options (FD=636) 2023.12.07 07:21:05 LOG7[0]: Option TCP_NODELAY set on local socket 2023.12.07 07:21:05 LOG5[0]: Service [Sql_Silicon] accepted connection from 127.0.0.1:50474 2023.12.07 07:21:05 LOG6[0]: s_connect: connecting <IP>:<Port> 2023.12.07 07:21:05 LOG7[0]: s_connect: s_poll_wait <IP>:<Port>: waiting 10 seconds 2023.12.07 07:21:05 LOG7[0]: FD=676 ifds=rwx ofds=--- 2023.12.07 07:21:15 LOG3[0]: s_connect: s_poll_wait <IP>:<Port>: TIMEOUTconnect exceeded 2023.12.07 07:21:15 LOG3[0]: No more addresses to connect 2023.12.07 07:21:15 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.12.07 07:21:15 LOG7[0]: local_rfd/local_wfd reset (FD=636) 2023.12.07 07:21:15 LOG7[0]: Local descriptor (FD=636) closed 2023.12.07 07:21:15 LOG7[0]: Service [Sql_Silicon] finished (0 left) My VM is a linux server, on startup of stunnel I get this concerning message which might be the cause? However, I checked and stunnel4:stunnel4 has permissions on the folder and psk file. 2023.12.07 07:40:45 LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/pskSQL_.txt server log file on start service: 2023.12.07 07:40:45 LOG7[ui]: Clients allowed=500 2023.12.07 07:40:45 LOG5[ui]: stunnel 5.56 on x86_64-pc-linux-gnu platform 2023.12.07 07:40:45 LOG5[ui]: Compiled with OpenSSL 1.1.1k 25 Mar 2021 2023.12.07 07:40:45 LOG5[ui]: Running with OpenSSL 1.1.1w 11 Sep 2023 2023.12.07 07:40:45 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2023.12.07 07:40:45 LOG7[ui]: errno: (*__errno_location ()) 2023.12.07 07:40:45 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2023.12.07 07:40:45 LOG5[ui]: UTF-8 byte order mark not detected 2023.12.07 07:40:45 LOG5[ui]: FIPS mode disabled 2023.12.07 07:40:45 LOG7[ui]: Compression disabled 2023.12.07 07:40:45 LOG7[ui]: No PRNG seeding was required 2023.12.07 07:40:45 LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/pskSQL_.txt 2023.12.07 07:40:45 LOG6[ui]: PSKsecrets line 1: 64-byte hexadecimal key configured for identity "siliconServer" 2023.12.07 07:40:45 LOG6[ui]: Initializing service [SQL-<port>] 2023.12.07 07:40:45 LOG6[ui]: PSK identities: 1 retrieved 2023.12.07 07:40:45 LOG7[ui]: Ciphers: PSK 2023.12.07 07:40:45 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.12.07 07:40:45 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2023.12.07 07:40:45 LOG7[ui]: No certificate or private key specified 2023.12.07 07:40:45 LOG6[ui]: DH initialization needed for DHE-PSK-AES256-GCM-SHA384 2023.12.07 07:40:45 LOG7[ui]: DH initialization 2023.12.07 07:40:45 LOG7[ui]: No certificate available to load DH parameters 2023.12.07 07:40:45 LOG6[ui]: Using dynamic DH parameters 2023.12.07 07:40:45 LOG7[ui]: ECDH initialization 2023.12.07 07:40:45 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.12.07 07:40:45 LOG5[ui]: Configuration successful 2023.12.07 07:40:45 LOG7[ui]: Binding service [SQL-<port>] 2023.12.07 07:40:45 LOG7[ui]: Listening file descriptor created (FD=9) 2023.12.07 07:40:45 LOG7[ui]: Setting accept socket options (FD=9) 2023.12.07 07:40:45 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2023.12.07 07:40:45 LOG6[ui]: Service [SQL-<port>] (FD=9) bound to <IP>:<port> 2023.12.07 07:40:45 LOG5[ui]: Switched to chroot directory: /var/lib/stunnel4/ 2023.12.07 07:40:45 LOG7[main]: Created pid file /stunnel.pid 2023.12.07 07:40:45 LOG7[cron]: Cron thread initialized 2023.12.07 07:40:45 LOG6[cron]: Executing cron jobs 2023.12.07 07:40:45 LOG5[cron]: Updating DH parameters

2 1

Stunnel load balancing through F5
by caspernetherlands＠gmail.com 05 Dec '23

05 Dec '23

Hello, Was wondering if anyone has tried to setup an HA like setup, specifically active/passive through two Stunnel servers and F5 load balancers. The problem I have is that TCP health checks (active checks) from the F5 are causing session initiation all the way to the 3rd party on the other side and this is causing a lot of unnecessary TCP traffic at the transport layer. The good thing is that the F5 closes these TCP sessions, but the problem is the 3rd party thinks someone is trying to brute force or something. Does anyone know how to maintain the TCP active health checks that the F5 does, but at the same time not cause a session initiation all the way to the 3rd party? Or if it’s not possible to stop the session initiation, would there be any option where something can be adjusted in the stunnel side so that the other side sees only one TCP health check as opposed to multiple every few seconds?

3 3

Connection failed: no suitable signature algorithm
by Martin K. 01 Dec '23

01 Dec '23

I'm trying to understand this error: SSL_accept: ssl/t1_lib.c:2827: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm How can I fix that? Is it because of the openssl version? I'm using Stunnel 5.71 on both sides. The server-side stunnel is built from source.

1 0

WG: stunnel core dumps, "SSL3_GET_RECORD:decryption failed or bad record mac"
by Sacha Hottinger 27 Nov '23

27 Nov '23

Hello, We are using stunnel 5.71 on Solaris 10 to tunnel NFS on more than 50 systems. In the past we saw stunnel dumping cores without any errors or hints in the stunnel log file. It was believed to be an OpenSSL 1.x problem. We got an stunnel version with SSL 2.x and 3.x but we had to go back to 1.x because of other problems. We noticed the dumps to happen at regular times and found a script that made NFS requests every 10 Min. After changing the script so there are less NFS requests it was stable. It looked like the problem accumulated over time and a counter or something alike reached its limit which then resulted in the core dump. Then the core dumps started again. It still seems to be related to the amount of requests because the problem occurs on the two NFS Servers with the highest number of connections. This time, we see errors in the stunnel log. The error slightly varies: 2023.10.12 22:05:43 LOG3[10745]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac // There were also a few cases with an additional "internal error". I.e: 2023.10.16 00:23:53 LOG5[2968]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:38270 2023.10.16 00:40:19 LOG3[2968]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.16 00:40:19 LOG3[2967]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.16 00:40:19 LOG5[2968]: Connection reset: 2476 byte(s) sent to TLS, 3324 byte(s) sent to socket 2023.10.16 00:40:19 LOG5[2967]: Connection reset: 2500 byte(s) sent to TLS, 3100 byte(s) sent to socket INTERNAL ERROR: Bad magic at ssl.c, line 192 2023.10.16 00:40:20 LOG6[ui]: Initializing inetd mode configuration // or 2023.10.23 07:33:53 LOG5[62]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:50626 2023.10.23 07:38:37 LOG3[62]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.23 07:38:37 LOG5[62]: Connection reset: 364 byte(s) sent to TLS, 336 byte(s) sent to socket ... 2023.10.23 07:44:37 LOG5[61]: Connection reset: 1704 byte(s) sent to TLS, 2360 byte(s) sent to socket INTERNAL ERROR: Bad magic at OpenSSL, line 0 // or 2023.10.24 08:20:59 LOG5[52]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:43966 2023.10.24 08:56:13 LOG6[52]: Read socket closed (readsocket) ... 2023.10.24 09:00:01 LOG5[53]: Service [tls-nfs-srv] accepted connection from 1.2.3.4:59973 2023.10.24 09:00:01 LOG6[53]: Peer certificate not required 2023.10.24 09:00:01 LOG3[49]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.24 09:00:01 LOG5[49]: Connection reset: 7112 byte(s) sent to TLS, 9188 byte(s) sent to socket INTERNAL ERROR: Dead canary at OpenSSL, line 0 I have attached a file with more details. Although this looks like an OpenSSL problem at first glance, we think it still could be a problem with stunnel. Can you make more out of this data? Do you know a way to log more information about the connections? i.e. not all requests were accepted. What happened here? 2023.11.24 02:50:13 LOG7[359]: 354 server accept(s) requested 2023.11.24 02:50:13 LOG7[359]: 351 server accept(s) succeeded Thank you in advance. Best regards Sasha This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager.

1 0

Proxy an unencrypted Oracle client
by Randall Smith 15 Nov '23

15 Nov '23

I'm trying to determine if it is possible to connect an Oracle client that is not configured for encrypted connections to a TLS or mTLS connected Oracle Autonomous database using an stunnel client connection. First I tested a TLS capable client to verify connectivity. Next I set up stunnel to make the same TLS connection. I have configured stunnel as follows: foreground = yes debug = info [oracle] accept = 127.0.0.1:1521 connect = adb.us-ashburn-1.oraclecloud.com:1521 client = yes Next, I attempted a non-encrypted Oracle database connection to 127.0.0.1:1521, but got the following errors from stunnel: 2023.11.14 10:58:50 LOG6[0]: TLS connected: new session negotiated 2023.11.14 10:58:50 LOG6[0]: TLSv1.2 ciphersuite: AES256-GCM-SHA384 (256-bit encryption) 2023.11.14 10:58:50 LOG3[0]: SSL_read: ../ssl/record/ssl3_record.c:1065: error:14191044:SSL routines:tls1_enc:internal error 2023.11.14 10:58:50 LOG5[0]: Connection reset: 752 byte(s) sent to TLS, 8 byte(s) sent to socket ^C2023.11.14 10:58:57 LOG3[ui]: Received SIGINT; terminating Could this be a configuration issue in stunnel or might there be something in the Oracle database protocol itself that is different for TLS connections that would prevent tunneling?

1 0

Re: Silent installation is not working for Stunnel v5.71
by Josealf.rm 10 Nov '23

10 Nov '23

Hi Pavan, AFAIK, there is no option to customise the components when you do a silent install. You get all components. If someone knows better, let me know. Regards Jose > On 9/11/2023, at 1:09 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: > > Hi Jose, > > Gentle Reminder !! > > Can we get an update on this. > > Regards, > PavanReddy. > > -----Original Message----- > From: Pavan Reddy > Sent: Tuesday, November 7, 2023 10:17 AM > To: Josealf.rm <josealf(a)rocketmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: RE: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Jose, > > I have re-attached the snapshots for your reference. > > Regards, > PavanReddy. > > -----Original Message----- > From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Thursday, November 2, 2023 4:49 PM > To: Pavan Reddy <pavan.reddy(a)adaptiva.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Pavan, > > Sorry, I don’t see the snapshots/customizations you talk about. > > Regards > Jose > >> On 30/10/2023, at 7:19 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: >> >> Hi Team, >> >> Could you please provide an update on this. >> >> Regards, >> PavanReddy. >> >> -----Original Message----- >> From: Pavan Reddy >> Sent: Wednesday, October 25, 2023 3:08 PM >> To: Josealf.rm <josealf(a)rocketmail.com> >> Cc: stunnel-users(a)stunnel.org >> Subject: RE: [stunnel-users] Silent installation is not working for >> Stunnel v5.71 >> >> Hi Team, >> >> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. >> For more details you may refer https://adaptiva.com/products/autonomous-patch. We are willing to add Stunnel 5.71 product to our catalogue. >> >> Application is installing silently by using /S. >> >> While installing the application we found these customizations. And I am attaching the snapshots. >> >> Could you please have a look and help us to handle these customizations with silent properties. >> >> Regards, >> PavanReddy. >> >> -----Original Message----- >> From: Josealf.rm <josealf(a)rocketmail.com> >> Sent: Monday, October 23, 2023 4:50 PM >> To: Meta Email <meta(a)adaptiva.com> >> Cc: stunnel-users(a)stunnel.org >> Subject: Re: [stunnel-users] Silent installation is not working for >> Stunnel v5.71 >> >> [Some people who received this message don't often get email from >> josealf(a)rocketmail.com. Learn why this is important at >> https://aka.ms/LearnAboutSenderIdentification ] >> >> Stunnel uses an NSIS based installer. Try using /S instead of -quiet. >> >> -quiet is a switch for stunnel.exe, not for the installer and is used to configure stunnel as a service. >> >> >> Regards >> Jose >> >>>> On 23/10/2023, at 3:30 AM, Meta Adaptiva via stunnel-users <stunnel-users(a)stunnel.org> wrote: >>> >>> Hi Team, >>> >>> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. >>> https://ada/ >>> p%2F&data=05%7C01%7Cpavan.reddy%40adaptiva.com%7C1d6b0f9facd740f536d4 >>> 08dbdb959b24%7C1264bc823da147f88a41e4c19cdc7499%7C0%7C0%7C63834520784 >>> 7265891%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiL >>> CJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=hWcJe3nMjxuwIPz9M >>> ee9qKT5xCAi6ubmK3l%2FIu45e94%3D&reserved=0 >>> tiva.com%2Fproducts%2Fautonomous-patch&data=05%7C01%7Cpavan.reddy%40a >>> d >>> aptiva.com%7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e >>> 4 >>> c19cdc7499%7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWI >>> j >>> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7 >>> C >>> %7C%7C&sdata=Vp%2FDHnulu3OEo%2BBnEnt5EY4GQfThzGQ5SC75YK%2Bb3V0%3D&res >>> e >>> rved=0 >>> >>> We have downloaded the binary from below URL – >>> https://www/. >>> stunnel.org%2Fdownloads.html&data=05%7C01%7Cpavan.reddy%40adaptiva.co >>> m >>> %7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4c19cdc749 >>> 9 >>> %7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjA >>> w >>> MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sd >>> a >>> ta=kIsTmj%2Bx3fIiPWKL85BDKJ8yN2K%2FKk077dWHsb82Q9M%3D&reserved=0 >>> >>> We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. >>> Could you please help us to install the application silently. >>> _______________________________________________ >>> stunnel-users mailing list -- stunnel-users(a)stunnel.org To >>> unsubscribe send an email to stunnel-users-leave(a)stunnel.org >> >> Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email. > > Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email.

1 0

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

Re: Silent installation is not working for Stunnel v5.71
by Josealf.rm 02 Nov '23

02 Nov '23

Hi Pavan, Sorry, I don’t see the snapshots/customizations you talk about. Regards Jose > On 30/10/2023, at 7:19 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: > > Hi Team, > > Could you please provide an update on this. > > Regards, > PavanReddy. > > -----Original Message----- > From: Pavan Reddy > Sent: Wednesday, October 25, 2023 3:08 PM > To: Josealf.rm <josealf(a)rocketmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: RE: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Team, > > We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. > For more details you may refer https://adaptiva.com/products/autonomous-patch. We are willing to add Stunnel 5.71 product to our catalogue. > > Application is installing silently by using /S. > > While installing the application we found these customizations. And I am attaching the snapshots. > > Could you please have a look and help us to handle these customizations with silent properties. > > Regards, > PavanReddy. > > -----Original Message----- > From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Monday, October 23, 2023 4:50 PM > To: Meta Email <meta(a)adaptiva.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > [Some people who received this message don't often get email from josealf(a)rocketmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] > > Stunnel uses an NSIS based installer. Try using /S instead of -quiet. > > -quiet is a switch for stunnel.exe, not for the installer and is used to configure stunnel as a service. > > > Regards > Jose > >> On 23/10/2023, at 3:30 AM, Meta Adaptiva via stunnel-users <stunnel-users(a)stunnel.org> wrote: >> >> Hi Team, >> >> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. >> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fadap >> tiva.com%2Fproducts%2Fautonomous-patch&data=05%7C01%7Cpavan.reddy%40ad >> aptiva.com%7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4 >> c19cdc7499%7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIj >> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C >> %7C%7C&sdata=Vp%2FDHnulu3OEo%2BBnEnt5EY4GQfThzGQ5SC75YK%2Bb3V0%3D&rese >> rved=0 >> >> We have downloaded the binary from below URL – >> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww. >> stunnel.org%2Fdownloads.html&data=05%7C01%7Cpavan.reddy%40adaptiva.com >> %7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4c19cdc7499 >> %7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAw >> MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sda >> ta=kIsTmj%2Bx3fIiPWKL85BDKJ8yN2K%2FKk077dWHsb82Q9M%3D&reserved=0 >> >> We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. >> Could you please help us to install the application silently. >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe >> send an email to stunnel-users-leave(a)stunnel.org > > Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email.

1 0

two stunnels in the local network
by alessandro.deliperi＠ichnobyte.it 02 Nov '23

02 Nov '23

Hi everyone, this is my first question. I have successfully configured a stunnel (A) that does the job of it. I need to configure a second stunnel (B) that works in a more hidden network. When B connects to A, which connects to public mail server X I get a time out error. I bring you the logs, I think it is related to the fact that both stunnel servers are trying to establish a TLS session. Is there a way to solve? 2023.11.02 08:42:10 LOG7[0]: Option TCP_NODELAY set on local socket 2023.11.02 08:42:10 LOG5[0]: Service [smtp-tls] accepted connection from 192.168.0.109:46078 2023.11.02 08:42:10 LOG6[0]: s_connect: connecting 192.168.180.10:25 2023.11.02 08:42:10 LOG7[0]: s_connect: s_poll_wait 192.168.180.10:25: waiting 10 seconds 2023.11.02 08:42:10 LOG7[0]: FD=6 events=0x2001 revents=0x0 2023.11.02 08:42:10 LOG7[0]: FD=11 events=0x2005 revents=0x0 2023.11.02 08:42:10 LOG5[0]: s_connect: connected 192.168.180.10:25 2023.11.02 08:42:10 LOG5[0]: Service [smtp-tls] connected remote server from 192.168.0.23:41156 2023.11.02 08:42:10 LOG7[0]: Setting remote socket options (FD=11) 2023.11.02 08:42:10 LOG7[0]: Option TCP_NODELAY set on remote socket 2023.11.02 08:42:10 LOG7[0]: Remote descriptor (FD=11) initialized 2023.11.02 08:42:10 LOG7[0]: <- 220 mailservers 2023.11.02 08:42:10 LOG7[0]: -> 220 mailservers 2023.11.02 08:42:10 LOG7[0]: -> EHLO localhost 2023.11.02 08:42:11 LOG7[0]: <- 250-email-smtp.posta 2023.11.02 08:42:11 LOG7[0]: <- 250-8BITMIME 2023.11.02 08:42:11 LOG7[0]: <- 250-STARTTLS 2023.11.02 08:42:11 LOG7[0]: <- 250-AUTH PLAIN LOGIN 2023.11.02 08:42:11 LOG7[0]: <- 250 Ok 2023.11.02 08:42:11 LOG7[0]: -> STARTTLS 2023.11.02 08:42:11 LOG7[0]: <- 503 TLS not available due to temporary reason: TLS already active 2023.11.02 08:42:11 LOG3[0]: Remote server is not RFC 2487 compliant 2023.11.02 08:42:11 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

1 0

Suppressing warnings
by Ian Pilcher 31 Oct '23

31 Oct '23

I am using stunnel (along with an Apache reverse proxy) to enable my browser to connect to my old managed switches. An example configuration looks like this: debug = warning syslog = yes [switch1] client = yes accept = 127.0.0.1:8081 connect = 192.168.4.1:443 verifyChain = yes checkHost = switch1.example.com CAfile = /etc/pki/ca-trust/source/anchors/example-com-ca.crt sslVersion = TLSv1 ciphers = DHE-RSA-AES256-SHA options = ALLOW_UNSAFE_LEGACY_RENEGOTIATION securityLevel = 1 OCSPrequire = no Everything is working, but I'm seeing a lot of warnings in my system log: OCSP: No OCSP stapling response received transfer: s_poll_wait: TIMEOUTclose exceeded: closing Are there any settings that I can use to suppress these warnings? Thanks! -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

1 0

TLSV1.0
by Stefano Pelli 27 Oct '23

27 Oct '23

Dear all, as my first post, I am asking a confirmation: is TLS ver 1.0 still supported by stunnel (unfortunately, I need that deprecated version to access a server)? It all worked fine, then I upgraded to Kubuntu 22.04 and for some reason that broke the support of this protocol. I get the connection closed right after trying to open it. Before upgrading all was working without a hitch. Since then (1 year ago), I have been looking for solutions and trying all sorts of fixes by changing stunnel.conf, but with no success. Can you be so kind to give me some info about this and if possible a remedy until the server gets updated (not under my control)? Thank you in advance, Stefano

3 3

Re: TLSV1.0
by Stefano Pelli 26 Oct '23

26 Oct '23

At 04:26 AM 10/26/2023, Thomas Ward via stunnel-users wrote: >This is not an STunnel issue but an OpenSSL libraries/defaults issue. Thank you Thomas. After your input I made some more tests. Following advice founf in the net, I had already included: >[system_default_sect] >CipherString = DEFAULT@SECLEVEL=1 in openssl.cnf But still it would not work through stunnel. Today I tried a connection directly from openssl and I managed to succesfully initiate and conclude a proper POP3 dialog with the culprit server. Then, looking at the messages from openssl, I saw that the connection was established, as expected, by TLSV1 and AES256-SHA protocol. Therefore, I tried to force this in the relevant section of stunnel.conf: >ciphers = AES256-SHA But with the same result when trying to open the connection through stunnel (5.71) >telnet 127.0.1.1 110 >Trying 127.0.1.1... >Connected to 127.0.1.1. >Escape character is '^]'. >Connection closed by foreign host. With the other servers I can this way estblish a POP3 dialog, as I managed directly through openssl. What am I missing here? Thank you for any addition insights! Stefano

1 0

Silent installation is not working for Stunnel v5.71
by meta＠adaptiva.com 23 Oct '23

23 Oct '23

Hi Team, We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. https://adaptiva.com/products/autonomous-patch We have downloaded the binary from below URL – https://www.stunnel.org/downloads.html We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. Could you please help us to install the application silently.

2 1

Re: Silent installation is not working for, Stunnel v5.71
by Miroslav Geisselreiter 23 Oct '23

23 Oct '23

Hi, we use /S switch which works for us for a long time. Miroslav Geisselreiter > Message: 1 > Date: Mon, 23 Oct 2023 08:30:30 -0000 > From: meta(a)adaptiva.com > Subject: [stunnel-users] Silent installation is not working for > Stunnel v5.71 > To: stunnel-users(a)stunnel.org > Message-ID: <169804983049.1982.1603425052292506533(a)stunnel.org> > Content-Type: text/plain; charset="utf-8" > > Hi Team, > > We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. > https://adaptiva.com/products/autonomous-patch > > We have downloaded the binary from below URL – > https://www.stunnel.org/downloads.html > > We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. > Could you please help us to install the application silently. >

1 0

Re: How do I hide my browsing?
by Eberhard 21 Oct '23

21 Oct '23

Exactly! If people could get around the Forti products that easily they would not have the reputation they have! Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 From: Thomas Ward via stunnel-users <stunnel-users(a)stunnel.org> Sent: Friday, October 20, 2023 6:11 AM To: Jason Long <hack3rcon(a)yahoo.com>; Stewart Anderson via Stunnel-users <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Re: How do I hide my browsing? Stunnel is not a VPN, so no it can't "hide your browsing". Hiding your browsing needs more than just stunnel because of how DNS and other components for browsing work. Question 2 is beyond the scope of stunnel's list to answer. This said: If you have to ask how to hide your browsing that means you're violating your network's use policies, and with Fortinet and Fortigate in line it sounds like you're on a workplace network. Just don't use your workplace network for whatever shady stuff you're concerned about them finding you doing. Sent from my Galaxy -------- Original message -------- From: Jason Long via stunnel-users <stunnel-users(a)stunnel.org <mailto:[email protected]> > Date: 10/20/23 09:05 (GMT-05:00) To: Stewart Anderson via Stunnel-users <stunnel-users(a)stunnel.org <mailto:[email protected]> > Subject: [stunnel-users] How do I hide my browsing? Hello, In an internal network, they monitor web browsing through firewalls (Fortinet and FortiGate). I have two questions: 1- Can I use Stunnel to hide my browsing? 2- Can they capture usernames and passwords for email and other websites? Thank you.

3 4

How do I hide my browsing?
by Jason Long 20 Oct '23

20 Oct '23

Hello,In an internal network, they monitor web browsing through firewalls (Fortinet and FortiGate). I have two questions: 1- Can I use Stunnel to hide my browsing? 2- Can they capture usernames and passwords for email and other websites? Thank you.

3 2

stunnel cmvp number
by Seray Tokadli 09 Oct '23

09 Oct '23

Hi, for our company i need to find the cvmp number for stunnel however I am not able to find it. Is there anyone who can help me with that? https://csrc.nist.gov/projects/cryptographic-module-validation-program/vali… I could not find stunnel here. -- Seray TOKADLI KILIÇ +420778116052

2 1

Re: stunnel smtp tls frontend server/proxy for remote backend postfix
by James Thornton 09 Oct '23

09 Oct '23

The direction is mail sent from an external email address to stunnel (running on google cloud) for delivery to a postfix mailbox running on a local network. I posted this question on serverfault ( https://serverfault.com/questions/1145279/stunnel-smtp-tls-frontend-server-…) and someone said the problem may be either stunnel strips the ip and/or the the sender is trying to switch to TLS on postfix, not realizing the TLS connection has already been made by stunnel. On Sat, Oct 7, 2023 at 9:22 AM Stewart Anderson <stuson_2000(a)yahoo.co.uk> wrote: > Client and server will both negotiate SSL. Your server mode is presenting > a certificate. > > It's not clear from your config /text which direction your traffic is > going !! > > If it's incoming from Google to your postfix server then server mode is > correct. Stunnel will negotiate the SSL and then forward to postfix in > clear. If the handshake isn't happening, have you put Google's cert in > your CA certs somewhere? > > What confuses it for me is the Google internal IP reference. If you are > getting traffic from Google then stunnel would need to be accepting on the > host where stunnel is, so only a port is required in the accept. This can > be on a machine in your DMZ or behind a firewall, e.g. on or close to your > postfix server. > > Hope that helps. > > > > > Stewart > stuson_2000(a)yahoo.co.uk > > On 6 October 2023 05:51:14 "james(a)jamesthornton.com" < > james(a)jamesthornton.com> wrote: > > I'm running stunnel in server mode and listening on port 587 and trying to >> connect to a remote postfix server running on port 25. >> >> NB: the two servers are connected via zerortier, which may or may no be >> relevant to the issue. >> >> DEBUG = 7 >> >> [ssmtp] >> protocol = smtp >> accept = google_cloud_internal_ip:587 >> connect = remote_zerotier_postfix_ip:25 >> cert = /etc/stunnel/domain.pem >> >> I thought this would set up stunnel to handle the TLS handshake and >> terminate the TLS connection, while proxing to the backend postfix server >> without requiring postfix to worry about TLS. But I'm getting LOG3[0]: >> STARTTLS expected when stunnel tries to connect to postfix. If I put >> stunnel in client mode, then it doesn't negotiate the incoming TLS >> (right?). >> >> What am I missing? >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org >> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org >> > > -- James Thornton, *http://electricspeed.com <http://electricspeed.com>*

2 1

stunnel smtp tls frontend server/proxy for remote backend postfix
by james＠jamesthornton.com 06 Oct '23

06 Oct '23

I'm running stunnel in server mode and listening on port 587 and trying to connect to a remote postfix server running on port 25. NB: the two servers are connected via zerortier, which may or may no be relevant to the issue. DEBUG = 7 [ssmtp] protocol = smtp accept = google_cloud_internal_ip:587 connect = remote_zerotier_postfix_ip:25 cert = /etc/stunnel/domain.pem I thought this would set up stunnel to handle the TLS handshake and terminate the TLS connection, while proxing to the backend postfix server without requiring postfix to worry about TLS. But I'm getting LOG3[0]: STARTTLS expected when stunnel tries to connect to postfix. If I put stunnel in client mode, then it doesn't negotiate the incoming TLS (right?). What am I missing?

1 0

stunnel events
by noel_melvin＠neimanmarcus.com 02 Oct '23

02 Oct '23

Whats the difference between Connection closed: : 2505 byte(s) sent to TLS, 59 byte(s) sent to socket and Connection closed: : 0 byte(s) sent to TLS, 0 byte(s) sent to socket we can see these kind of variations in the stunnel logs. if its 0 bytes doest it mean that client didnt send any data/packet to stunnel server? Need help

1 1

Java jdk.disabled.NamedCurves
by Randy Curry 27 Sep '23

27 Sep '23

Hello, We are making a Rest API to an endpoint that uses stunnel for their proxy. We recently upgraded our integration engine and it's running Java AdoptOpenJDK 11.0.15. Since we've upgraded we can only successfully make one or two POST API calls then we get an error: Caused by: java.io.IOException: Error writing to server I did some research and found this version of Java has disabled named curves, part of it's Elliptic-curve cryptography. Is there any known issues with stunnel and the version of Java that's being used or the disabled named curves? Thank you, Randy Curry Senior Integration Services Architect [cid:[email protected]] [cid:[email protected]][email protected]<mailto:[email protected]> [cid:[email protected]] 919.588.1036 [cid:[email protected]] www.mihin.org<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.mihin.org&d=DwQGaQ&…> [cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_MiHIN&d=Dw…>[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.youtube.com_user_M…>[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…> Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by returning the e-mail and destroying all copies of the original message.

1 0

stunnel 5.71 released
by Michał Trojnara 19 Sep '23

19 Sep '23

Dear Users, I have released version 5.71 of stunnel. ### Version 5.71, 2023.09.19, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.1.3. * Bugfixes - Fixed the console output of tstunnel.exe. * Features sponsored by SAE IT-systems - OCSP stapling is requested and verified in the client mode. - Using "verifyChain" automatically enables OCSP stapling in the client mode. - OCSP stapling is always available in the server mode. - An inconclusive OCSP verification breaks TLS negotiation. This can be disabled with "OCSPrequire = no". - Added the "TIMEOUTocsp" option to control the maximum time allowed for connecting an OCSP responder. * Features - Added support for Red Hat OpenSSL 3.x patches. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: f023aae837c2d32deb920831a5ee1081e11c78a5d57340f8e6f0829f031017f5 stunnel-5.71.tar.gz 945df5118473bcbf1ecdc5561fd6f26743c5dd1fd82e1a25199d0fd5c39a9373 stunnel-5.71-win64-installer.exe d511df533bb89464a324b2439e7e04b24b6ce26ecc0e03b67ada307725343d40 stunnel-5.71-android.zip Best regards, Mike

2 1

New machine
by stunnel＠paapnet.nl 16 Sep '23

16 Sep '23

Hello All, Who can help me? Just setup a new Ubuntu 22.04 (server) machine gcc version 11.4.0 (Ubuntu 11.4.0-1ubuntu1~22.04) grabbed stunnel (git) However running into issues (an old linux box runs well with compile) configure runs well: config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tests/Makefile config.status: creating tests/certs/Makefile config.status: creating src/config.h config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success Make bails out: root@dns:/Downloads/stunnel# make CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/bash '/Downloads/stunnel/auto/missing' aclocal-1.16 -I m4 cd . && /bin/bash /Downloads/stunnel/auto/missing automake-1.16 --foreign CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/bash '/Downloads/stunnel/auto/missing' autoconf configure.ac:53: warning: back quotes and double quotes must not be escaped in: Unknown thread model \"${withval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1553: AC_ARG_WITH is expanded from... configure.ac:53: the top level configure.ac:285: warning: back quotes and double quotes must not be escaped in: bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:285: the top level configure.ac:309: warning: back quotes and double quotes must not be escaped in: bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:309: the top level configure.ac:334: warning: back quotes and double quotes must not be escaped in: Bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:334: the top level configure.ac:369: warning: back quotes and double quotes must not be escaped in: Bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:369: the top level configure.ac:4: error: possibly undefined macro: AC_MSG_NOTICE If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. configure.ac:22: error: possibly undefined macro: AC_DEFINE make: *** [Makefile:409: configure] Error 1 aclocal (GNU automake) 1.16.5 autoconf (GNU Autoconf) 2.71 Is active What do I mis here ? Chrs....

1 0

Use of dante socks proxy with Stunnel
by vinesh＠techvinesh.com 15 Sep '23

15 Sep '23

I am deploying connection between on premise database with BI application on cloud. Currently the on premise database connecting via jdbc driver and it not supporting encryption. As per my understanding Stunnel opens port listening on http:127.0.0.1 ( as local) and forward traffic to destination over https using TLSv1.2. I have few question on this , to protect on network level, 1- can I use dante socks proxy along with Stunnel to provide 2 layer of protection? On-prem --- cloud ( 2 layer of protection) -- dante socks ( unencrypted tunnel) -- Stunnel ( e2e Encryption) 2- will it supporting CA other than openSsl

1 0

The stunnel process running on an AWS EC2 instance frequently enters a zombie state.
by sharukh.khan+stunnel＠seclore.com 12 Sep '23

12 Sep '23

We're facing an issue where the stunnel process running on our AWS Ec2 enters a zombie state. This results in the nfs server timeout (We're using EFS). We're running Amazon Linux 2 (Kernel version 4.14.318-241.531) with stunnel version 5.6.4. The configuration for stunnel is stated below: ; Sample stunnel configuration file for Win64 by Michal Trojnara 2002-2022 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) ;debug = info ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later ;securityLevel = 0 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini

2 4

stunnel events
by noel_melvin＠neimanmarcus.com 11 Sep '23

11 Sep '23

We have stunnel running on Windows machine. Just would like to know whether the below events is anything abnormal/critical to be addressed. 2023.09.07 10:10:16 LOG5[7]: Service [Application1] accepted connection from x.x.x.x:1234 2023.09.07 10:10:16 LOG6[7]: Peer certificate not required 2023.09.07 10:10:16 LOG6[7]: No peer certificate received 2023.09.07 10:10:16 LOG6[7]: Session id: (Alphanumeric) 2023.09.07 10:10:16 LOG6[7]: TLS accepted: new session negotiated 2023.09.07 10:10:16 LOG6[7]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-SHA256 (128-bit encryption) 2023.09.07 10:10:16 LOG6[7]: s_connect: connecting x.x.x.x:1234 2023.09.07 10:10:16 LOG5[7]: s_connect: connected x.x.x.x:1234 2023.09.07 10:10:16 LOG6[7]: persistence: x.x.x.x:1234 cached

1 1

Stunnel hangs with static build with openssl 1.1.1c
by eklein＠triple-eye.nl 07 Sep '23

07 Sep '23

I successfully cross compiled and built a static version of stunnel for ARM. It works with stunnel 5.70 and openssl 1.1.1b If however, I try to use openssl 1.1.1c, stunnel hangs. I narrowed the problem down to the following call in compression_init in ssl.c: comp_methods[COMP_NONE]=sk_SSL_COMP_new_null(); The program does not get past this point. I also tried to build with openssl 1.1.1v and 3.0.0, to no avail. I am using the following commands: To build openssl: ./Configure linux-armv4 --prefix=/home/erik/Documents/openssl-1.1.1b/install --openssldir=/home/erik/Documents/openssl-1.1.1b/install threads shared make CC=arm-linux-gnueabi-gcc make install To build stunnel: sed -i 's/^stunnel_LDFLAGS = /&-all-static /' src/Makefile.in export CFLAGS='-Os -fomit-frame-pointer -pipe' ./configure --with-ssl=/home/erik/Documents/openssl-1.1.1b/install --disable-fips --disable-shared --enable-static --disable-silent-rules --build x86_64-pc-linux-gnu --host arm-linux-gnueabi make What is the difference between openssl1.1.1b and 1.1.1c which causes this problem?

1 1

Failover configuration using a proxy
by Daphne Shaw 06 Sep '23

06 Sep '23

Hello! I have a configuration question around failover with stunnel as a https client (that is, "client=yes"). The end goal here is a "Try to connect to host A, if that fails, connect to host B, etc." type of setup. I can do that with multiple connect= options, one per host, and it works as expected: connect=x.x.x.x connect=y.y.y.y connect=z.z.z.z The question I have is around doing the same thing with a proxy. In a proxy configuration, connect= specifies the proxy (https in my case, so "protocol=connect"), and protocolHost= specifies the host that I want to connect to via that proxy. Unfortunately, it seems that protocolHost only allows a single host and cannot be used multiple times, so I can't specify the hosts to failover to. connect=my.proxy.ip protocol=connect protocolhost=x.x.x.x protocolhost=y.y.y.y protocolhost=z.z.z.z That always attempts to connect to z.z.z.z (the last specified host) via the proxy. I am using stunnel 4.56 (stock stunnel from Centos 7), but happy to upgrade if a newer version makes this possible (the manual suggests the latest version works the same way). Any suggestions? I'm sure I could accomplish this by wrapping stunnel in a script that generates a new config file for each failover, but well, I'm hoping to not have to do that. Thanks, Daphne

2 2

Connection abend between Stunnel and multiple clients
by arunprasanna_dhayalavel＠neimanmarcus.com 06 Sep '23

06 Sep '23

Hello All!! We are experiencing multiple transactions initiated from the different clients towards the Stunnel getting reset. We are trying to identify if the below events relate to the issue. If yes, kindly suggest how we can rectify the below. 2023.09.05 09:10:43 LOG6[210]: transfer: s_poll_wait: TIMEOUTidle exceeded: sending reset 2023.09.05 09:10:43 LOG5[210]: Connection reset: 2505 byte(s) sent to TLS, 59 byte(s) sent to socket

1 0

error:0A000126 on windows 10
by Stewart Anderson 02 Sep '23

02 Sep '23

Hi, First apologies I posted this question on a google stunnel group, but I realise that does not have much activity, so posting here also. I am trying to get stunnel up and running and getting the error in the subject. The full error text is: "SSL_accept: ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number" I have a simple service which seems to load fine. I have stunnel up at the "server side" on a VM in azure and if I telnet to the VM public address I can see the activity in the stunnel logs on the VM, so I know at least a pipe is open. I can hit the port server side and see the log activity in stunnel also. If I try a telnet to the local stunnel accept port. I see the error above. This is the full log. 2023.08.23 11:01:04 LOG7[service]: Found 1 ready file descriptor(s) 2023.08.23 11:01:04 LOG7[service]: FD=604 ifds=r-x ofds=--- 2023.08.23 11:01:04 LOG7[service]: FD=664 ifds=r-x ofds=r-- 2023.08.23 11:01:04 LOG7[service]: Service [dev-dev-testHarness] accepted (FD=708) from 127.0.0.1:10756 2023.08.23 11:01:04 LOG7[service]: Creating a new thread 2023.08.23 11:01:04 LOG7[service]: New thread created 2023.08.23 11:01:04 LOG7[4]: Service [dev-dev-testHarness] started 2023.08.23 11:01:04 LOG7[4]: Setting local socket options (FD=708) 2023.08.23 11:01:04 LOG7[4]: Option TCP_NODELAY set on local socket 2023.08.23 11:01:04 LOG5[4]: Service [dev-dev-testHarness] accepted connection from 127.0.0.1:10756 2023.08.23 11:01:04 LOG6[4]: Peer certificate not required 2023.08.23 11:01:04 LOG7[4]: TLS state (accept): before SSL initialization 2023.08.23 11:01:04 LOG7[4]: TLS alert (write): fatal: decode error 2023.08.23 11:01:04 LOG3[4]: SSL_accept: ssl/record/rec_layer_s3.c:303: error:0A000126:SSL routines::unexpected eof while reading 2023.08.23 11:01:04 LOG5[4]: Connection reset/closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.08.23 11:01:04 LOG7[4]: Local descriptor (FD=708) closed 2023.08.23 11:01:04 LOG7[4]: Service [dev-dev-testHarness] finished (0 left) What am I missing, I haven't used stunnel for quite a while and previous effort were on linux and I did not see this problem then. Using telnet/TNC as the local test tools and stunnel was installed with bare default installation. The only thing I have done different is to set a config fragment folder to separate services on the sever side and they report as loading fine. any help greatly appreciated. Stu

1 1

Re: Need help setting up new stunnel config
by Mark Foley 01 Sep '23

01 Sep '23

I think I'm confused here. My objective is for requests sent to port 3389 on the Windows 10 machine to be "validated" by stunnel, then passed on to the service listening on that port. Am I mistaken about what stunnel is supposed to do? If not, what would my config look like to accomplish this? I don't see how changing the RDC port would help. Regardless of what port RDC listens on, it's still going to be used by RDC and therefore I don't see why the 'accept' wouldn't continue to fail. Sorry to be so obtuse on this. I just don't get it and haven't found any examples for stunneling to RDC. --Mark -----Original Message----- From: Michael Curran <mike_curran(a)hotmail.com> To: Mark Foley <mfoley(a)novatec-inc.com>, "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Re: Need help setting up new stunnel config Date: Fri, 1 Sep 2023 17:39:25 +0000 Mark -- Your full stanza should look like this [dbserver] accept = <some port> connect = 3389 CAfile = stunnel.pem The IP:PORT was a suggestion for the RDC connection string. If you cannot start RDC with an IP:PORT, then you can change the internal RDC port from 3389 to something else. I have not done this, you will have to review Microsofts site to find out how. If RDC can be changed , but not the RDC connection string then your stanza might look like [dbserver] accept = 3389 connect = <new rdc port> CAfile = stunnel.pem Mike ________________________________ From: Mark Foley <mfoley(a)novatec-inc.com> Sent: Friday, September 1, 2023 1:28 PM To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Re: Need help setting up new stunnel config Michael - thanks for your response. I did not see the "ip:port" syntax you suggested in the stunnel doc, so I just use 'port'. Below is the config I tried: [DBSERVER] connect = 3389 CAfile = stunnel.pem When running I got the following errors: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.70 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.9 30 May 2023 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [DBSERVER] [!] Service [DBSERVER]: TLS server needs a certificate [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [DBSERVER] Notice "TLS server needs a certificate". The installation dialog steps me through creating a certificate which it puts in stunnel.pem. So why this message? I also tried the full pathname to stunnel.pem. --Mark -----Original Message----- From: Michael Curran <michael.curran(a)cosocloud.com> To: Mark Foley <mfoley(a)novatec-inc.com>, "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Need help setting up new stunnel config Date: Fri, 1 Sep 2023 13:12:30 +0000 accept is the port you want them to connect on remotely – which would have to be other than 3389 since it is open already connect would be 3389 I think in the connection string for RDC you can just specify ip:port to connect If you cannot , you can also redesignate the port remote desktop answers on -- Michael Curran Systems Architect| CoSo Cloud D 614.568.2285 | C 614.403.6320 | michael.curran(a)cosocloud.com From: Mark Foley <mfoley(a)novatec-inc.com> Date: Thursday, August 31, 2023 at 11:33 AM To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Need help setting up new stunnel config I used stunnel about 5 years ago and now I want to use it again, but my notes are terrible and I'm having trouble getting started. I want to create a connection between Windows computer on port 3389. The "client" will be some remote Windows computer, perhaps at someone's home office. The "server" will be a Windows workstation at the office. I've installed stunnel 5.70 on a Windows 10 workstation at the office, hostname COMMONW10. I'm at a loss creating the config file on this machine. I have: [COMMONW10] ;client = yes accept = 3389 ;connect = ???:xxxx CAfile = stunnel.pem The stunnel.pem was create when I installed stunnel. I have no idea what the 'connect' line should have. When I run stunnel (clicking on desktop icon) I get: [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [COMMONW10] [ ] Listening file descriptor created (FD=724) [ ] Setting accept socket options (FD=724) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [COMMONW10] to 127.0.0.1:3389: Permission denied (WSAEACCES) (10013) [!] Binding service [COMMONW10] failed [ ] Unbinding service [COMMONW10] [ ] Service [COMMONW10] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [COMMONW10] [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 Server is down I'm assuming the "Permission denied" is because Remote Desktop is already listening on 3389. So, I'm stuck and feeling quite ignorant! Help appreciated. --Mark _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org This is an external email and may have suspicious content. Please take care when clicking links or opening attachments. When in doubt, contact your IT Department. _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org

2 1

Re: Need help setting up new stunnel config
by Mark Foley 01 Sep '23

01 Sep '23

Michael - thanks for your response. I did not see the "ip:port" syntax you suggested in the stunnel doc, so I just use 'port'. Below is the config I tried: [DBSERVER] connect = 3389 CAfile = stunnel.pem When running I got the following errors: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.70 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.9 30 May 2023 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [DBSERVER] [!] Service [DBSERVER]: TLS server needs a certificate [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [DBSERVER] Notice "TLS server needs a certificate". The installation dialog steps me through creating a certificate which it puts in stunnel.pem. So why this message? I also tried the full pathname to stunnel.pem. --Mark -----Original Message----- From: Michael Curran <michael.curran(a)cosocloud.com> To: Mark Foley <mfoley(a)novatec-inc.com>, "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Need help setting up new stunnel config Date: Fri, 1 Sep 2023 13:12:30 +0000 accept is the port you want them to connect on remotely – which would have to be other than 3389 since it is open already connect would be 3389 I think in the connection string for RDC you can just specify ip:port to connect If you cannot , you can also redesignate the port remote desktop answers on -- Michael Curran Systems Architect| CoSo Cloud D 614.568.2285 | C 614.403.6320 | michael.curran(a)cosocloud.com From: Mark Foley <mfoley(a)novatec-inc.com> Date: Thursday, August 31, 2023 at 11:33 AM To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Need help setting up new stunnel config I used stunnel about 5 years ago and now I want to use it again, but my notes are terrible and I'm having trouble getting started. I want to create a connection between Windows computer on port 3389. The "client" will be some remote Windows computer, perhaps at someone's home office. The "server" will be a Windows workstation at the office. I've installed stunnel 5.70 on a Windows 10 workstation at the office, hostname COMMONW10. I'm at a loss creating the config file on this machine. I have: [COMMONW10] ;client = yes accept = 3389 ;connect = ???:xxxx CAfile = stunnel.pem The stunnel.pem was create when I installed stunnel. I have no idea what the 'connect' line should have. When I run stunnel (clicking on desktop icon) I get: [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [COMMONW10] [ ] Listening file descriptor created (FD=724) [ ] Setting accept socket options (FD=724) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [COMMONW10] to 127.0.0.1:3389: Permission denied (WSAEACCES) (10013) [!] Binding service [COMMONW10] failed [ ] Unbinding service [COMMONW10] [ ] Service [COMMONW10] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [COMMONW10] [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 Server is down I'm assuming the "Permission denied" is because Remote Desktop is already listening on 3389. So, I'm stuck and feeling quite ignorant! Help appreciated. --Mark _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org This is an external email and may have suspicious content. Please take care when clicking links or opening attachments. When in doubt, contact your IT Department.

1 0

Problem TLS connection Outlook 365
by adebelew＠gmail.com 01 Sep '23

01 Sep '23

Hi, I'm trying to connect to Outlook 365 with this setup [office365] client = yes accept = 127.0.0.1:993 connect = outlook.office365.com:993 unfortunately, when from my penthao software, I try to connect with email and password stunnel responds like this: 2023.09.01 09:57:33 LOG5[2]: Service [office365] accepted connection from 127.0.0.1:63027 2023.09.01 09:57:33 LOG5[2]: s_connect: connected 52.98.206.242:993 2023.09.01 09:57:33 LOG5[2]: Service [office365] connected remote server from 192.168.1.228:63028 2023.09.01 09:57:33 LOG5[2]: Connection closed: 258 byte(s) sent to TLS, 160 byte(s) sent to socket could you help me? is it necessary to configure the certificates? How should it be done? Thank you!

1 0

Need help setting up new stunnel config
by Mark Foley 31 Aug '23

31 Aug '23

I used stunnel about 5 years ago and now I want to use it again, but my notes are terrible and I'm having trouble getting started. I want to create a connection between Windows computer on port 3389. The "client" will be some remote Windows computer, perhaps at someone's home office. The "server" will be a Windows workstation at the office. I've installed stunnel 5.70 on a Windows 10 workstation at the office, hostname COMMONW10. I'm at a loss creating the config file on this machine. I have: [COMMONW10] ;client = yes accept = 3389 ;connect = ???:xxxx CAfile = stunnel.pem The stunnel.pem was create when I installed stunnel. I have no idea what the 'connect' line should have. When I run stunnel (clicking on desktop icon) I get: [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [COMMONW10] [ ] Listening file descriptor created (FD=724) [ ] Setting accept socket options (FD=724) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [COMMONW10] to 127.0.0.1:3389: Permission denied (WSAEACCES) (10013) [!] Binding service [COMMONW10] failed [ ] Unbinding service [COMMONW10] [ ] Service [COMMONW10] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [COMMONW10] [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 Server is down I'm assuming the "Permission denied" is because Remote Desktop is already listening on 3389. So, I'm stuck and feeling quite ignorant! Help appreciated. --Mark

1 0

Fail to build stunnel 5.70 for windows using xmingw64
by roierachamim＠gmail.com 30 Aug '23

30 Aug '23

Hi, Trying to build stunnel the following warning showed up: network.c: In function 's_read': network.c:737:44: warning: unknown conversion type character 'l' in format [-Wformat=] s_log(LOG_ERR, "s_read: Received %llu out of requested %llu byte(s)", ^ network.c:737:66: warning: unknown conversion type character 'l' in format [-Wformat=] s_log(LOG_ERR, "s_read: Received %llu out of requested %llu byte(s)", ^ network.c:737:24: warning: too many arguments for format [-Wformat-extra-args] s_log(LOG_ERR, "s_read: Received %llu out of requested %llu byte(s)", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ And one more of the same kind. I wonder how it didn't happen in the official binaries. Are they being built using the instructions in INSTALL.W32 ? Using xmingw-64 ? Roie

2 1

Config stunnel for outgoing mails to Ionos
by a.franken＠management-kommunikation.de 22 Aug '23

22 Aug '23

In these days, our provider Ionos/1&1 starts to accept only encrypted access to its mail server and at least TLS 1.2. There are no problems with incoming mails. In order to be on the safe side with our Win SBS Server 2008 (no comments please!) with outgoing mails, I now have interposed stunnel as recommended many times on the web. This works in principle. Unfortunate exception: In some cases - expecially if the mail recipient has a Microsoft address like @hotmail.de, @live.de, @outlook.com -, sending aborts with error 503 5.5.2 ("Need mail command"). Unfortunately, I'm quite innocent with SMTP, SSL and certificates, but worked hard to create the following stunnel configuration file: socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 client = yes output = C:\Program Files (x86)\stunnel\stunnel.log [smtpionos] accept = localhost:465 connect = smtp.ionos.de:465 verifyChain = yes verifyPeer = yes CAfile = C:\Program Files (x86)\stunnel\config\amakor2022.pem checkHost = remote.management-kommunikation.de protocolHost = smtp.ionos.de protocolAuthentication = login protocolUsername = OUR_USERNAME protocolPassword = OUR_PASSWORD sslVersionMin = TLSv1.2 sslVersionMax = TLSv1.2 delay = yes protocol = smtp amakor2022.pem is the "PositiveSSL" certificate that we acquired for our subdomain remote.management-kommunikation.de. "Our_Username" and "Our_Password" are of course our correct access data. After spending hours searching the web for a solution, does anyone have a tip what's wrong and what to do?

1 2

error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40
by kgpunix＠gmail.com 16 Aug '23

16 Aug '23

error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40

1 0

Passing client IP via stunned to HAProxy
by Ashok Kumar Agrawal 07 Aug '23

07 Aug '23

Hi, Our setup has stunnel and HAproxy running on same server. Our clients (postgresql clients) connect to port where stunnel is listening. Clients are sending encrypted data (setting sslmode=require in pgsql connection options). Stunnel listens to encrypted traffic and writes unencrypted traffic to another port on same host where HAproxy is listening. Then, HAProxy passes this request to one of many postgresql servers. These servers are custom written to implement postgresql protocol. We want IP of the postgresql clients to be captured at the server. HAProxy documentation says that proxy protocol is only way to pass original client IP for non-http traffic. Can you please suggest how we can configure Stunnel to listen to encrypted postgresql client traffic (pgsql protocol) and write unencrypted data to HAProxy instance in proxy protocol. Following are our current configurations for stunnel and HAProxy: Stunnel: foreground = yes debug = 5 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = l:TCP_KEEPIDLE=120 socket = l:TCP_KEEPINTVL=30 socket = l:TCP_KEEPCNT=3 ciphers = HIGH:MEDIUM [postgres-serverB] protocol = pgsql accept = 0.0.0.0:3255 connect = localhost:5433 retry = yes cert = /etc/stunnel/stunnel.crt delay = no sslVersion = TLSv1.2 HAProxy: listen pgsql mode tcp option tcplog bind *:5433 balance leastconn timeout server 1d timeout client 1d option tcp-check option clitcpka server qspgsqlsvr1 host.docker.internal:5432 check Thanks, Ashok

1 0

Oqsprovider support with Openssl 3,x
by mukesh.kochu＠yahoo.com 01 Aug '23

01 Aug '23

hello Team, Anybody knows how to plugin the provider included in the openssl 3.x , to be supported with stunnel , by doing any configuration change or so . To give you guys a background , I compiled a openssl 3.x version and and then compiled liboqs , and build the ops provider support in the openssl 3.x .following the below link. https://github.com/open-quantum-safe/oqs-provider I was under the impression tunnel might support all algorithm which is supported in the openssl version which is used to build the stunnel So I rebuild the same using the pqc supported openssl , but unfortunately not sure how to consume the provider there and or what to be tweaked in he tunnel source code that multiple providers or algorithms will be supported or not . or is it not possible to achieve this without doing a massive source code change ? Appreciate any help on this Regards Mukesh

1 0

can not send
by wizardm＠gmx.de 21 Jul '23

21 Jul '23

hello, I have accounts with gmx, aol and 1&1 (ionos). with gmx and aol I can receive and send. but with 1&1 I can only receive. the stunnel log says "SSL_connect: ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number". in the log of the mail program there is an "error - Unexpected connection termination. Connection lost." what can I do? here is my configuration. [gmx-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmx.net:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmx.net OCSPaia = yes [gmx-smtp] client = yes accept = 127.0.0.1:25 connect = mail.gmx.net:465 verifyChain = yes CAfile = ca-certs.pem checkHost = mail.gmx.net OCSPaia = yes [aol-pop3] client = yes accept = 127.0.0.1:10110 ; protocol = pop3 connect = pop.aol.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.aol.com OCSPaia = yes [aol-smtp] client = yes accept = 127.0.0.1:10025 ; protocol = smtp connect = smtp.aol.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.aol.com OCSPaia = yes [1und1-pop3] client = yes accept = 127.0.0.1:1110 connect = pop.ionos.de:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.ionos.de OCSPaia = yes [1und1-smtp] client = yes accept = 127.0.0.1:1111 connect = smtp.ionos.de:587 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.ionos.de OCSPaia = yes thank you very much

1 0

“latest” alias
by David Richard (CajunD) 16 Jul '23

16 Jul '23

Hi Folks, I have found some older discussions about keeping archives and such, but wanted to ask if you could create an alias that always pointed to the latest version. We were hard-linking to a version in /downloads/ and when version 5.69 was removed a few days ago, some automation on our end broke and (as a result of circumstance) caused an outage while we were trying to fix another problem with a remote dependency. We have altered our script to point to the archive version and added checking to ensure any future problems are handled properly. That being said, we will always want the latest version of your software when we build our machine images. And while you do send an announcement, we have to take additional action on our end to get that new version. A “latest” link would allow us to get the latest version automatically when we perform security updates. Thanks for considering this request. David. --- David Richard cajund(a)gmail.com

4 3

securityLevel doesn't work with OpenSSL 3.0
by Yasuhiro Kimura 14 Jul '23

14 Jul '23

Hello, I'd like to use stunnel to acccess SMTP server that has following configuration parameters. Host: smtp.example.org Port number: smtps (465) Encryption method: SMTP over TLS At first I created following configuration file and run stunnel 5.70 with it on FreeBSD 13.2-RELEASE. ---------------------------------------------------------------------- CApath=/home/yasu/.certs client=yes foreground=yes syslog=no verify=2 [12345] accept=localhost:12345 checkHost=smtp.examle.org connect=smtp.examle.org:465 ---------------------------------------------------------------------- But unfortunately stunnel emits following messages and local-side connection.is closed when I connect to 12345 port of localhost. ---------------------------------------------------------------------- 2023.07.14 12:29:12 LOG5[0]: Service [12345] accepted connection from ::1:14632 2023.07.14 12:29:12 LOG5[0]: s_connect: connected 10.0.0.1:465 2023.07.14 12:29:12 LOG5[0]: Service [12345] connected remote server from 192.168.0.1:14633 2023.07.14 12:29:12 LOG5[0]: Certificate accepted at depth=0: C=JP, ST=Tokyo, L=Ohta-Ku, O=EXAMLE.INC, CN=smtp.examle.org 2023.07.14 12:29:12 LOG3[0]: SSL_connect: /usr/src/crypto/openssl/ssl/t1_lib.c:1146: error:1414D172:SSL routines:tls12_check_peer_sigalg:wrong signature type 2023.07.14 12:29:12 LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket ---------------------------------------------------------------------- So I added setting of securityLevel as following. ---------------------------------------------------------------------- CApath=/home/yasu/.certs client=yes foreground=yes securityLevel=1 syslog=no verify=2 [12345] accept=localhost:12345 checkHost=smtp.examle.org connect=smtp.examle.org:465 ---------------------------------------------------------------------- And now I can successfully access to STMP server through stunnel. Next, I also tried it on FreeBSD 14-CURRENT and surprisingly stunnel 5.70 emits following messages even if 'securityLevel=1' is specified in configuration file. ---------------------------------------------------------------------- 2023.07.14 12:31:12 LOG5[0]: Service [12345] accepted connection from ::1:10838 2023.07.14 12:31:12 LOG5[0]: s_connect: connected 10.0.0.1:465 2023.07.14 12:31:12 LOG5[0]: Service [12345] connected remote server from 192.168.0.11:41449 2023.07.14 12:31:12 LOG3[0]: SSL_connect: /usr/src/crypto/openssl/ssl/statem/extensions.c:894: error:0A000152:SSL routines::unsafe legacy renegotiation disabled 2023.07.14 12:31:12 LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket ---------------------------------------------------------------------- So I also tried on 2 other platforms. a. Cygwin's stunnel.exe (version 5.69) b. tstunnel.exe installed by useing stunnel-5.69-win64-installer.exe And result is that the former works fine and the latter emits same message as FreeBSD 14-CURRENT. According to these result it seems the failure is related to the version of OpenSSL. That is, while FreeBSD 13.2-RELEASE and Cygwin use OpenSSL 1.1.1, FreeBSD 14-CURRENT and stunnel-5.69-win64-installer.exe use OpenSSL 3.0. So does this mean securityLevel option doesn't work with OpenSSL 3.0? Regards. --- Yasuhiro Kimura

2 1

Stunnel is not accepting TLS1.1 anymore?
by Bohnig＠gmx.de 13 Jul '23

13 Jul '23

Hi there, i have a problem (maybe with understanding) with stunnel. I'm using the newest version 5.70 but had this also with 5.66 and 5.69. My goal was to access an Exchange server IIS (on port 443, which understands only TLS1.1 and below) with TLS1.2 and upper. I was able to achieve this with the following config --------------------------- debug = 7 output = stunnel.log [Exserver] accept = 441 connect = 442 cert = stunneldd.pem TIMEOUTclose = 0 [Exclient] client = yes accept = 442 connect = 443 --------------------------- stunneldd.pem i made with openssl req -new -x509 -days 365 -nodes -config openssl.cnf -out stunneldd.pem -keyout stunneldd.pem This is working so far. My problem is, stunnel is no longer accepting TLS1.0 and TLS1.1. I need this for some clients which couldn't talk TLS1.2. But why? All infos i could find (and this was days, not hours) are showing that it should work. Even with the added line sllVerison = all or sslVersionMin = TLSv1 sslVersionMax = TLSv1.3 it ws not accepting TLS1 queries. My steps to confirm this: ------------------------- - install stunnel 5.70 - take the config shown above - make a cert with openssl req -new -x509 -days 365 -nodes -config openssl.cnf -out stunneldd.pem -keyout stunneldd.pem - start stunnel - test it with openssl s_client -connect localhost:441 -tls1_1 -debug stunnel log: ------------ 2023.07.13 09:53:04 LOG7[25]: TLS alert (write): fatal: internal error 2023.07.13 09:53:04 LOG3[25]: SSL_accept: ssl/t1_lib.c:3342: error:0A000076:SSL routines::no suitable signature algorithm I'm thinking, that the bind OpenSSL doesn't support TLS1.1 anymore but the [Exclient] which is talking to Port 443 uses TLS1.1. Or has the cert anything to do with it. I think no, because the andshake failed and that is befor the cert is used? What I'm missing? I want stunnel to accept TLs1.0, TLS1.1. TLS1.2 and upwards on the same port. Would be nice if anybody could help me with this? Many thanks.

1 0

Default destination folder of stunnel-*-win64-installer.exe
by Yasuhiro Kimura 13 Jul '23

13 Jul '23

Hello, If you install stunnel on Windows with stunnel-*-win64-installer.exe, it installs everything under "C:\Program Files (x86)\stunnel" by default. But since it installs 64bit binaries, should default destination folder be "C:\Program Files\stunnel"? Regards.

1 0

`tstunnel -(help|options|version)` outputs garbase with 5.70
by Yasuhiro Kimura 13 Jul '23

13 Jul '23

Hello, With tstunnel.exe installed with stunnel-5.70-win64-installer.exe, `tstunnel -help', `tstunnel -options` and `tstunnel -version` output gabases. The issue doesn't happen with either stunnel 5.70 on Unix or tstunnel.exe installed with stunnel-5.69-win64-installer.exe. Regards. --- Yasuhiro Kimura

1 0

stunnel 5.70 released
by Michal Trojnara 12 Jul '23

12 Jul '23

Dear Users, I have released version 5.70 of stunnel. ### Version 5.70, 2023.07.12, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.9. - OpenSSL FIPS Provider updated to version 3.0.8. * Bugfixes - Fixed TLS socket EOF handling with OpenSSL 3.x. This bug caused major interoperability issues between stunnel built with OpenSSL 3.x and Microsoft's Schannel Security Support Provider (SSP). - Fixed reading certificate chains from PKCS#12 files. * Features - Added configurable delay for the "retry" option. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 7bbc7b9e9a988d76301325db4c110ec360a98ffb8a221c7accbff9c0a8bae2f3 stunnel-5.70.tar.gz c50fb79329ddbf095e65ba8817a0249188aa5b25f15557f8504d8f65876034d9 stunnel-5.70-win64-installer.exe df87f71596ddd8730a5394fd3795b32689664816c0aa87e206e94fdab540f672 stunnel-5.70-android.zip Best regards, Mike

1 0

Cannot open PSKsecrets file
by trashrap22＠gmail.com 11 Jul '23

11 Jul '23

Hi, I am setting up stunnel on my Windows 10 PC, but must be missing something small with the error I am getting: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.69 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.8 7 Feb 2023 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [Sql_Secure_Trek-<port>] [!] Cannot open PSKsecrets file [!] C:\Program Files (x86)\stunnel\config\stunnel.conf:68: "PSKsecrets = "C:\Program Files (x86)\stunnel\config\pskSql.txt"": Failed to read PSK secrets [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [Sql_Secure_Trek-<port>] Server is down Here is my .conf file: ;Global settings: debug = 7 output = stunnel.log sslVersion = all sslVersionMin = TLSv1.2 sslVersionMax = TLSv1.2 [Sql_Secure_Trek-<port>] client = yes accept = 0.0.0.0:<port> connect = <IP>:<port> ciphers = PSK PSKsecrets = "C:\Program Files (x86)\stunnel\config\pskSql.txt" Any ideas?

1 1

stunnel 5.57 crashed while trying to write logs
by phananh.nguyen＠dxc.com 06 Jul '23

06 Jul '23

it crashed at the function log_raw. here is the backtrace == Backtrace #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49 #1 0x0000007f82ed54b4 in __GI_abort () at abort.c:79 #2 0x0000007f82f1f984 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f82fdc660 "%s\n") at ../sysdeps/posix/libc_fatal.c:155 #3 0x0000007f82f273dc in malloc_printerr (str=str@entry=0x7f82fd7bc8 "corrupted double-linked list") at malloc.c:5389 #4 0x0000007f82f27cc8 in unlink_chunk (p=p@entry=0x7f64012260, av=0x7f64000020) at malloc.c:1472 #5 0x0000007f82f27e48 in malloc_consolidate (av=av@entry=0x7f64000020) at malloc.c:4539 #6 0x0000007f82f29df0 in _int_malloc (av=av@entry=0x7f64000020, bytes=bytes@entry=8192) at malloc.c:3727 #7 0x0000007f82f2c5b0 in __libc_calloc (n=<optimized out>, elem_size=<optimized out>) at malloc.c:3448 #8 0x0000007f82f1e41c in __GI___open_memstream (bufloc=bufloc@entry=0x7f72ffc3f8, sizeloc=sizeloc@entry=0x7f72ffc400) at memstream.c:83 #9 0x0000007f82f7d274 in __vsyslog_internal (pri=31, pri@entry=7, fmt=fmt@entry=0x5584b5f930 "%s: %s", ap=..., mode_flags=mode_flags@entry=2) at ../misc/syslog.c:181 #10 0x0000007f82f7d810 in __syslog_chk (pri=pri@entry=7, flag=flag@entry=1, fmt=fmt@entry=0x5584b5f930 "%s: %s") at ../misc/syslog.c:136 #11 0x0000005584b45884 in syslog (__fmt=0x5584b5f930 "%s: %s", __pri=7) at /usr/include/bits/syslog.h:31 #12 log_raw (level=level@entry=7, stamp=stamp@entry=0x7f64003420 "2023.06.16 01:36:58", id=id@entry=0x7f64001120 "LOG7[19]", text=text@entry=0x7f6401b060 "Service [proxy-r] started", opt=<optimized out>, opt=<optimized out>) at ../../stunnel-5.57/src/log.c:263 #13 0x0000005584b45b88 in s_log (level=level@entry=7, format=format@entry=0x5584b5a780 "Service [%s] started") at ../../stunnel-5.57/src/log.c:192 #14 0x0000005584b454e8 in client_main (c=c@entry=0x7f82e30060) at ../../stunnel-5.57/src/client.c:178 #15 0x0000005584b45658 in client_thread (arg=0x7f82e30060) at ../../stunnel-5.57/src/client.c:130 #16 0x0000007f83026e64 in start_thread (arg=0x7fc21e457f) at pthread_create.c:463 #17 0x0000007f82f815dc in thread_start () at ../sysdeps/unix/sysv/linux/aarch64/clone.S:78 == Thread apply all backtrace full

2 4

Using URL Subfolders to redirect traffic to a different service?
by hellmanandrew＠comcast.net 02 Jul '23

02 Jul '23

I want to be able to actually use stunnel as a reverse proxy by running everything through one port. How I want to do that is by using subfolders in a URL like: webpage.net/service1 webpage.net/service2 Basically, every subfolder will redirect to a different IP address or port offered by a server. Just not sure how I should configure this.

1 0

help
by Seray Tokadli 26 Jun '23

26 Jun '23

Hello, I am trying to configure stunnel on windows (version 5.69) I am using the capi engine with below conf. I am sending the logs to logstash and not sure if it is working or not. My questions are: 1) I dont see anything in the log after initializing the service. When it sends the logs through stunnel, should i see an entry in the logs? 2) When using capi engine, should i limit the ssl version still ? in your website i see that the tls version supposed to be limited but is it an old info? 3) in your website again it mentions that i should specify the security level to zero for capi engine, is it also a valid info? if yes, do i need to set it in global section or service level? https://www.stunnel.org/config_windows.html fips = yes taskbar = yes engine = capi output = C:\Logs\stunnel\stunnel.log debug = debug [logging_service_for_filebeat] engineId = capi client = yes accept = {{ stunnel_logging_port_filebeat }} delay = yes connect = {{ logstash_vip }}:{{ stunnel_logging_port_filebeat }} ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256 sessionCacheSize = 5000 sessionCacheTimeout = 300 socket = l:TCP_NODELAY=1 # the only FIPS 140-2 compliant protocol sslVersion = TLSv1.2 CApath = <ca path> verifyChain = yes checkHost = <ca host> verify = 2 Log: 023.06.26 14:37:39 LOG6[service]: Initializing inetd mode configuration 2023.06.26 14:37:39 LOG7[service]: Running on Windows 6.2 2023.06.26 14:37:39 LOG7[service]: No limit detected for the number of clients 2023.06.26 14:37:39 LOG5[service]: stunnel 5.69 on x64-pc-mingw32-gnu platform 2023.06.26 14:37:39 LOG5[service]: Compiled/running with OpenSSL 3.0.8 7 Feb 2023 2023.06.26 14:37:39 LOG5[service]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2023.06.26 14:37:39 LOG7[service]: errno: (*_errno()) 2023.06.26 14:37:39 LOG6[service]: Initializing inetd mode configuration 2023.06.26 14:37:39 LOG7[service]: Running on Windows 6.2 2023.06.26 14:37:39 LOG5[service]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2023.06.26 14:37:39 LOG5[service]: UTF-8 byte order mark not detected 2023.06.26 14:37:39 LOG7[service]: Enabling support for engine "capi" 2023.06.26 14:37:39 LOG6[service]: Logging not supported by engine #1 (capi) 2023.06.26 14:37:39 LOG6[service]: UI not supported by engine #1 (capi) 2023.06.26 14:37:39 LOG7[service]: Initializing engine #1 (capi) 2023.06.26 14:37:39 LOG6[service]: Engine #1 (capi) initialized 2023.06.26 14:37:39 LOG5[service]: FIPS provider enabled 2023.06.26 14:37:39 LOG5[service]: FIPS mode enabled 2023.06.26 14:37:39 LOG6[service]: Compression disabled 2023.06.26 14:37:39 LOG7[service]: No PRNG seeding was required 2023.06.26 14:37:39 LOG6[service]: Initializing service [logging_service_for_filebeat] 2023.06.26 14:37:39 LOG6[service]: stunnel default security level set: 2 2023.06.26 14:37:39 LOG7[service]: Ciphers: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256 2023.06.26 14:37:39 LOG7[service]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.06.26 14:37:39 LOG7[service]: TLS options: 0x2100000 (+0x0, -0x0) 2023.06.26 14:37:39 LOG6[service]: Session resumption enabled 2023.06.26 14:37:39 LOG6[service]: Client certificate engine (capi) enabled 2023.06.26 14:37:39 LOG7[service]: No certificate or private key specified 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA:xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA:xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: DH initialization skipped: client section 2023.06.26 14:37:39 LOG7[service]: ECDH initialization 2023.06.26 14:37:39 LOG7[service]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.06.26 14:37:39 LOG6[service]: Initializing service [logging_service_for_winlogbeat] 2023.06.26 14:37:39 LOG6[service]: stunnel default security level set: 2 2023.06.26 14:37:39 LOG7[service]: Ciphers: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256 2023.06.26 14:37:39 LOG7[service]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.06.26 14:37:39 LOG7[service]: TLS options: 0x2100000 (+0x0, -0x0) 2023.06.26 14:37:39 LOG6[service]: Session resumption enabled 2023.06.26 14:37:39 LOG6[service]: Client certificate engine (capi) enabled 2023.06.26 14:37:39 LOG7[service]: No certificate or private key specified 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: DH initialization skipped: client section 2023.06.26 14:37:39 LOG7[service]: ECDH initialization 2023.06.26 14:37:39 LOG7[service]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.06.26 14:37:39 LOG5[service]: Configuration successful 2023.06.26 14:37:39 LOG7[service]: Deallocating deployed section defaults 2023.06.26 14:37:39 LOG7[service]: Binding service [logging_service_for_filebeat] 2023.06.26 14:37:39 LOG7[service]: Listening file descriptor created (FD=632) 2023.06.26 14:37:39 LOG7[service]: Setting accept socket options (FD=632) 2023.06.26 14:37:39 LOG7[service]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.06.26 14:37:39 LOG6[service]: Service [logging_service_for_filebeat] (FD=632) bound to 0.0.0.0:10300 2023.06.26 14:37:39 LOG7[service]: Binding service [logging_service_for_winlogbeat] 2023.06.26 14:37:39 LOG7[service]: Listening file descriptor created (FD=648) 2023.06.26 14:37:39 LOG7[service]: Setting accept socket options (FD=648) 2023.06.26 14:37:39 LOG7[service]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.06.26 14:37:39 LOG6[service]: Service [logging_service_for_winlogbeat] (FD=648) bound to 0.0.0.0:10301 2023.06.26 14:37:39 LOG6[service]: Accepting new connections 2023.06.26 14:37:39 LOG7[per-second]: Per-second thread initialized 2023.06.26 14:37:39 LOG7[per-day]: Per-day thread initialized 2023.06.26 14:37:39 LOG6[per-day]: Executing per-day jobs 2023.06.26 14:37:39 LOG6[per-day]: Per-day jobs completed in 0 seconds 2023.06.26 14:37:39 LOG7[per-day]: Waiting 86400 seconds -- Seray TOKADLI KILIÇ +420778116052

1 0

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 21 Jun '23

21 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

2 7

help configuring stunnel with ssl ceritificate
by Andrei 20 Jun '23

20 Jun '23

Hello! I'm trying to configure stunnel with an ssl certificate. I have the certificate (.p12 format) from the site owners, installed it in the Personal folder of the current user and local machine. Before installing stunnel I had to select the certificate in the browser when accessing the site. With this configuration [sts] client = yes accept = 127.0.0.1:42354 connect = y7m2zq.its:443 key = E:\!Work\ cert_.pem CAfile = E:\!Work\ cert_.pem verify=0 the stunnel starts but I get a `No required SSL certificate was sent`when accessing from the browser. If I use this config [sts] client = yes accept = 127.0.0.1:42354 connect = y7m2zq.its:443 cert = E:\!Work\cert_.p12 key = E:\!Work\cert_.pem CAfile = E:\!Work\cert_.pem verify=0 the stunnel will not start PKCS12_parse: crypto/evp/evp_fetch.c:373: error:0308010C:digital envelope routines::unsupported LOG3[main]: Service [sts]: Failed to initialize TLS context Please help. I would like to be able to open the site without choosing the certificate. Thank you!

2 1

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 20 Jun '23

20 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

1 0

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 20 Jun '23

20 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

1 0

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 20 Jun '23

20 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

1 0

Inbound and outbound connection on same PC?
by trashrap22＠gmail.com 15 Jun '23

15 Jun '23

Hi, I have a linux PC that now successfully runs a stunnel client connection with a remote server. I now want to be able to access sql server on that linux PC from a remote Windows PC. What I would like to gather information on: 1. Can the client configuration of stunnel on the linux PC be used for a second connection from the remote windows PC to access data (sql server)? 2. Thus, what differentiates a client from a server - a server can have multiple connections and provides data? A client can't? 3. What is the correct route I should take? Regards,

3 3

Reading HSM Pincode from file and passing it to Stunnel/OpenSSL
by Andreas Heijdendael 30 May '23

30 May '23

Hi there, I'm running into an issue. I'm trying to run stunnel on my new Ubuntu 22.04 system whereas before I was running it on Windows. Thing is, on the Windows system I had to compile stunnel manually as I need to read an encrypted file on the filesystem that contains the user-pin for my HSM. On Windows, that worked. On Ubuntu I'm having issues with the C11 _s functions (like sscanf_s and the likes). ChatGTP suggested using clang compiler, but I have not clue on how to do that. Of enabling C11 Annex K support in Ubuntu (no such thing, apparently).... Is there anybody here that makes use of these _s functions in their code on Ubuntu 22.04? Or explain how to use these functions in gcc? Or compile stunnel (+ additional code) using Clang. Thanks!! Andreas

1 0

ssl3 wrong version number
by trashrap22＠gmail.com 18 May '23

18 May '23

I get the following error running 'sudo service stunnel4 status' : LOG3[0]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number is that merely a mismatch between openSSL versions used by client and server? I have tried changing the config file options, also with no specification since the default according to stunnel.org is: options = NO_SSLv2 options = NO_SSLv3 I have tried (service level option): sslVersion = TLSv1 Same error. When running sudo service stunnel4 status after start: May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP May 12 08:22:45 user-Linux stunnel4[16616]: Starting TLS tunnels: /etc/stunnel/stunnel.conf: started May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf May 12 08:22:45 user-Linux systemd[1]: Started LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons). May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: UTF-8 byte order mark not detected May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: FIPS mode disabled May 12 08:22:45 user-Linux stunnel[16630]: LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/psk.txt May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: Configuration successful May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: Switched to chroot directory: /var/lib/stunnel4/ May 12 08:22:45 user-Linux stunnel[16632]: LOG5[cron]: Updating DH parameters After trying to make a connection via FIX connection: May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Service [**redacted**] started May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Setting local socket options (FD=3) May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Option TCP_NODELAY set on local socket May 12 08:28:04 user-Linux stunnel[16798]: LOG5[0]: Service [**redacted**] accepted connection from 127.0.0.1:51954 May 12 08:28:04 user-Linux stunnel[16798]: LOG6[0]: Peer certificate not required May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: TLS state (accept): before SSL initialization May 12 08:28:04 user-Linux stunnel[16798]: LOG3[0]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number May 12 08:28:04 user-Linux stunnel[16798]: LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Local descriptor (FD=3) closed May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Service [**redacted**] finished (0 left)

2 1

TLS alert (read): warning: close notify
by trashrap22＠gmail.com 18 May '23

18 May '23

Hi All, Hopefully the last question with my struggles! Stunnel connects and the initial TLS connection works - but then it seems the client or server (I am client) does not trust the psk key? Any ideas? Note - part of the previous issue was creating a 64B/512b PSK and NOT a 32/B/256b psk. I created that key and shared it with the server. See below line referencing 256bit encryption? May 18 16:34:38 user-Linux stunnel: LOG5[0]: Service [** redacted **] connected remote server from ** redacted ** May 18 16:34:38 user-Linux stunnel: LOG7[0]: Setting remote socket options (FD=11) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Option TCP_NODELAY set on remote socket May 18 16:34:38 user-Linux stunnel: LOG7[0]: Remote descriptor (FD=11) initialized May 18 16:34:38 user-Linux stunnel: LOG6[0]: SNI: sending servername: ** redacted ** May 18 16:34:38 user-Linux stunnel: LOG6[0]: Peer certificate not required May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): before SSL initialization May 18 16:34:38 user-Linux stunnel: LOG7[0]: Initializing application specific data for session authenticated May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write client hello May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write client hello May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server hello May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange May 18 16:34:38 user-Linux stunnel: LOG6[0]: Client certificate not requested May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server done May 18 16:34:38 user-Linux stunnel: LOG6[0]: PSK client configured for identity "client" May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write finished May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write finished May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server session ticket May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read finished May 18 16:34:38 user-Linux stunnel: LOG7[0]: New session callback May 18 16:34:38 user-Linux stunnel: LOG6[0]: No peer certificate received May 18 16:34:38 user-Linux stunnel: LOG6[0]: Session id: ***** redacted **** May 18 16:34:38 user-Linux stunnel: LOG7[0]: 1 client connect(s) requested May 18 16:34:38 user-Linux stunnel: LOG7[0]: 1 client connect(s) succeeded May 18 16:34:38 user-Linux stunnel: LOG7[0]: 0 client renegotiation(s) requested May 18 16:34:38 user-Linux stunnel: LOG7[0]: 0 session reuse(s) May 18 16:34:38 user-Linux stunnel: LOG6[0]: TLS connected: new session negotiated May 18 16:34:38 user-Linux stunnel: LOG6[0]: TLSv1.2 ciphersuite: ECDHE-PSK-CHACHA20-POLY1305 (256-bit encryption) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Compression: null, expansion: null May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS alert (read): warning: close notify May 18 16:34:38 user-Linux stunnel: LOG6[0]: TLS closed (SSL_read) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Sent socket write shutdown May 18 16:34:38 user-Linux stunnel: LOG6[0]: Read socket closed (readsocket) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Sending close_notify alert May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS alert (write): warning: close notify May 18 16:34:38 user-Linux stunnel: LOG6[0]: SSL_shutdown successfully sent close_notify alert May 18 16:34:38 user-Linux stunnel: LOG5[0]: Connection closed: 98 byte(s) sent to TLS, 0 byte(s) sent to socket May 18 16:34:38 user-Linux stunnel: LOG7[0]: Remote descriptor (FD=11) closed May 18 16:34:38 user-Linux stunnel: LOG7[0]: Local descriptor (FD=3) closed May 18 16:34:38 user-Linux stunnel: LOG7[0]: Service [*redacted*]finished (0 left)

1 0

chroot jail on debian 11 for stunnel steps?
by trashrap22＠gmail.com 11 May '23

11 May '23

Does someone have all the steps in order to setup a chroot jail on debian 11 OS - I have followed [this](https://manpages.debian.org/testing/stunnel4/stunnel.8.en.html) mostly - but think I am going to miss some differences to Debian 11 and go down a rabbit hole. Anyone have done it on Debian 11 care to share the steps?

3 3

Re: stunnel not starting
by Christopher Schultz 10 May '23

10 May '23

Hello, On 5/10/23 00:28, d3rIIIe15ter Tier wrote: > Please advise why you strongly advise running stunnel in a chroot jail? Because: 1. It's insanely easy to do (it literally IS just "chroot=/path/to/jail") and 2. If there is a problem with stunnel (e.g. security issue), the amount of damage an attacker can do is significantly limited -chris > On Tue, May 9, 2023 at 5:59 PM Christopher Schultz > <chris(a)christopherschultz.net <mailto:[email protected]>> wrote: > > Hello, > > On 5/9/23 11:13, d3rIIIe15ter Tier wrote: > > After giving access to var/log/secure/stunnel.log, I now get logs! > > > > There I get the following error: > > > > Cannot create pid file /var/run/stunnel4.pid > > create: Permission denied (13) > > What is the euid of the stunnel process? Does it have access to that > path? Are you using a chroot jail? (You should be.) Does that path > exist > in the chroot jail? Can the stunnel user write to that path? > > -chris > > > On Tue, May 9, 2023 at 4:34 PM d3rIIIe15ter Tier > <trashrap22(a)gmail.com <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>>> wrote: > > > > You are right... bad mistake. > > > > Now I get: cannot open log file - which I am sure is a > permission > > thing since I need to use sudo to be able to write to that file. > > Any ideas further? > > > > On Tue, May 9, 2023 at 4:21 PM Christopher Schultz > > <chris(a)christopherschultz.net > <mailto:[email protected]> > <mailto:[email protected] > <mailto:[email protected]>>> > > wrote: > > > > Hello, > > > > On 5/9/23 10:17, d3rIIIe15ter Tier wrote: > > > I have tried changing the location to > > > > > > var/log/stunnel4/stunnel.log > > > var/log/stunnel4/stunnelLog > > > var/log/secure/ > > > var/log/secure/stunnel.log > > > etc/stunnel/stunnel.log > > > etc/stunnel/stunnelLog > > > > > > don't know how to fix it yet... > > I don't think the *value* is the problem. The problem is that > > you have > > defined "output" somewhere that isn't valid, such as within a > > specific > > service's section instead of as a global setting. > > > > -chris > > > > > On Tue, May 9, 2023 at 3:54 PM Christopher Schultz > > > <chris(a)christopherschultz.net > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>>> wrote: > > > > > > Hello, > > > > > > On 5/9/23 09:40, trashrap22(a)gmail.com > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>>> > > > wrote: > > > > Hi, I am on Debian - when I run "sudo stunnel > > stunnel.conf" I > > > get the following output: > > > > > > > > [ ] Clients allowed=500 > > > > [.] stunnel 5.56 on x86_64-pc-linux-gnu platform > > > > [.] Compiled with OpenSSL 1.1.1k 25 Mar 2021 > > > > [.] Running with OpenSSL 1.1.1n 15 Mar 2022 > > > > [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD > > > TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP > > > > [ ] errno: (*__errno_location ()) > > > > [.] Reading configuration from file > > /etc/stunnel/stunnel.conf > > > > [.] UTF-8 byte order mark not detected > > > > [.] FIPS mode disabled > > > > [ ] Compression disabled > > > > [ ] No PRNG seeding was required > > > > [!] /etc/stunnel/stunnel.conf:24: "output = > > /tmp/stunnel.log": > > > Specified option name is not valid here > > > > [ ] Deallocating section defaults > > > > > > > > When I run "sudo netstat -tulnp | grep -i > stunnel" I > > also get no > > > output - which means that stunnel is not starting up? > > > > > > The log message seems pretty specific to me. Maybe you > > should fix that? > > > > > > -chris > > > _______________________________________________ > > > stunnel-users mailing list -- > stunnel-users(a)stunnel.org <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > To unsubscribe send an email to > > stunnel-users-leave(a)stunnel.org > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > > > _______________________________________________ > > stunnel-users mailing list -- stunnel-users(a)stunnel.org > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > To unsubscribe send an email to > stunnel-users-leave(a)stunnel.org <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > _______________________________________________ > stunnel-users mailing list -- stunnel-users(a)stunnel.org > <mailto:[email protected]> > To unsubscribe send an email to stunnel-users-leave(a)stunnel.org > <mailto:[email protected]> >

1 0

stunnel not starting
by trashrap22＠gmail.com 09 May '23

09 May '23

Hi, I am on Debian - when I run "sudo stunnel stunnel.conf" I get the following output: [ ] Clients allowed=500 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled with OpenSSL 1.1.1k 25 Mar 2021 [.] Running with OpenSSL 1.1.1n 15 Mar 2022 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [!] /etc/stunnel/stunnel.conf:24: "output = /tmp/stunnel.log": Specified option name is not valid here [ ] Deallocating section defaults When I run "sudo netstat -tulnp | grep -i stunnel" I also get no output - which means that stunnel is not starting up?

4 7

Update newest version
by sportman7＠netzero.com 05 May '23

05 May '23

Have used Stunnel for years. To update I normally download the latest version and copy the files (DLL, exe, etc.) to my client's computers. But I tried this with latest update and I must be missing something as my app is not able to use this version. Went back to previous version but really need to know how to deliver the update to a client's computer. Thanks for any ideas on this.

2 2

stunnel and Google LDAP
by matt.colwell＠sduhsd.net 01 May '23

01 May '23

Hi, I'm trying to setup stunnel as a proxy to Google Workplace's LDAP service. I followed the instructions located here: https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3… I've set the up on Ubuntu 22.04.2 LTS When attempting to connect I get the following error: SSL_read: ../ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading Connection reset: 217 byte(s) sent to TLS, 164 byte(s) sent to socket What might be my issue here? thanks

1 0

error starting / restarting /etc/init.d/stunnel4 on debian
by trashrap22＠gmail.com 28 Apr '23

28 Apr '23

Hi, I am not getting any stunnel logs. Though my syslog gives me the info below. The stunnel4 file in /usr/bin/ is empty? Apr 28 15:18:01 User-Linux systemd[1]: Starting LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)... Apr 28 15:18:01 User-Linux stunnel4[30850]: Starting TLS tunnels: /etc/stunnel/stunnel.conf: Apr 28 15:18:01 User-Linux stunnel4[30864]: /sbin/start-stop-daemon: unable to start /usr/bin/stunnel4 (Exec format error) Apr 28 15:18:01 User-Linux stunnel4[30850]: failed Apr 28 15:18:01 User-Linux stunnel4[30850]: You should check that you have specified the pid= in you configuration file

4 4

Is there installing instructions for Stunnel on Debian ?
by trashrap22＠gmail.com 26 Apr '23

26 Apr '23

Hi, I don't see installing instructions for Linux or rather for Debian specifically anywhere ?

4 4

FW: Help with disabling SSLv3
by Eberhard 14 Mar '23

14 Mar '23

Actually I think the SSLv3 in the log is a lie - as this is also in the log just before the below: TLS state (connect): before/connect initialization TLS state (connect): SSLv3 write client hello A TLS state (connect): SSLv3 read server hello A So I am thinking the eliptic curve stuff is more likely the issue? Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 _____________________________________________ From: Eberhard <flash(a)vicsmba.com> Sent: Tuesday, March 14, 2023 9:15 AM To: 'stunnel-users(a)stunnel.org' <stunnel-users(a)stunnel.org> Subject: Help with disabling SSLv3 Importance: High I am suddenly getting errors from Fedex: TLS state (connect): SSLv3 read server certificate A error queue: 1408D010: error:1408D010:SSL routines:ssl3_get_key_exchange:EC lib error queue: 100AE081: error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group error queue: 100AF003: error:100AF003:elliptic curve routines:EC_GROUP_NEW_FROM_DATA:BN lib SSL_connect: 3078072: error:03078072:bignum routines:BN_EXPAND_INTERNAL:bignum too long My .conf file says: output = /tmp/fedex.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ws.fedex.com:443 ;connect = gateway.fedex.com:443 ;connect = wssha1ends12172016.fedex.com:443 sslVersion = TLSv1.2 options = NO_SSLv3 sslVersionMin = TLSv1.2 CAfile = /usr/local/ssl/certs/cacert.pem It is a very old version of stunnel but I cannot upgrade as this is a 15 year old AIX (IBM) computer stunnel 5.44 on powerpc-ibm-aix4.3.3.0 platform Compiled/running with OpenSSL 1.0.2 22 Jan 2015 Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI Invalid configuration file name "--version" realpath: No such file or directory (2) Yet the log implies I am still trying SSLv3. Any ideas? Thanks in advance. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115

2 1

Help with disabling SSLv3
by Eberhard 14 Mar '23

14 Mar '23

I am suddenly getting errors from Fedex: TLS state (connect): SSLv3 read server certificate A error queue: 1408D010: error:1408D010:SSL routines:ssl3_get_key_exchange:EC lib error queue: 100AE081: error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group error queue: 100AF003: error:100AF003:elliptic curve routines:EC_GROUP_NEW_FROM_DATA:BN lib SSL_connect: 3078072: error:03078072:bignum routines:BN_EXPAND_INTERNAL:bignum too long My .conf file says: output = /tmp/fedex.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ws.fedex.com:443 ;connect = gateway.fedex.com:443 ;connect = wssha1ends12172016.fedex.com:443 sslVersion = TLSv1.2 options = NO_SSLv3 sslVersionMin = TLSv1.2 CAfile = /usr/local/ssl/certs/cacert.pem It is a very old version of stunnel but I cannot upgrade as this is a 15 year old AIX (IBM) computer stunnel 5.44 on powerpc-ibm-aix4.3.3.0 platform Compiled/running with OpenSSL 1.0.2 22 Jan 2015 Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI Invalid configuration file name "--version" realpath: No such file or directory (2) Yet the log implies I am still trying SSLv3. Any ideas? Thanks in advance. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115

1 0

Stunnel Installation.
by nathan.king＠unpredictableporridge.co.uk 12 Mar '23

12 Mar '23

Hello, New stunnel user here - or trying to ne! I manage a streaming service using both SHOUT and Icecast servers, on a Widows 10 platform. Have been hit by the update to the G/Chrome browser, and while the Website is secure, the streams are not. There is limited support for S.S.L. for Icecast, but none for SHOUTcast. Was recommended to use S.S.L., but apparently the OpenSSL library isn't downloaded for Widows, only Linux, so have tried using Debian 11, which have installed within VirtualBox. However, have had no luck making the connection. Happened to read in another tutorial that if stunnel isn't installed on the same Computer, as the Playout system and encoder - use B.U.T.T., and Sound Empire Caster - one has to have stunnel installed on both Computers? Is the above true? EIther way,, would appreciate some advice on how to resolve this issue, and am new to stunnel, and only a basic knowledge of Debian. Thanks for your help with this issue. Cheers.

3 8

stunnel as server dont connect to endpoint
by mahdi.section8＠gmail.com 05 Mar '23

05 Mar '23

hello everyone i have a setup of openvpn + stunnel stunnel(client) in a server stunnel(server) + openvpn in another server both were working fine until i moved the second server to another one i moved all openvpn and stunnel files to new one but even though its same stunnel it dont work properly i even compiled latest 5.69 version thinking it was a bug this is my stunnel config: setuid = root setgid = root [openvpn] cert=/etc/stunnel/cert.pem key=/etc/stunnel/key.pem accept = 0.0.0.0:1381 connect = 127.0.0.1:1194 its so simple yet idk whats the problem, cause in the logs i only see from stunnel that a connection from ip x accepted but nothing else saying that it connected to 127.0.0.1:1194 its just accepting connections and nothing more like it forgot there is a connect option there. but i confirm openvpn is correct as i tested with netcat and openvpn showed up in logs saying there is a connection but somehow stunnel dont connect to 127.0.0.1:1194 its crazy that either i forgot something or misconfig of stunnel cause its so simple and its not working

2 2

stunnel 5.69 released
by Michał Trojnara 04 Mar '23

04 Mar '23

Dear Users, I have released version 5.69 of stunnel. ### Version 5.69, 2023.03.04, urgency: MEDIUM * New features - Improved logging performance with the "output" option. - Improved file read performance on the WIN32 platform. - DH and kDHEPSK ciphersuites removed from FIPS defaults. - Set the LimitNOFILE ulimit in stunnel.service to allow for up to 10,000 concurrent clients. * Bugfixes - Fixed the "CApath" option on the WIN32 platform by applying https://github.com/openssl/openssl/pull/20312. - Fixed stunnel.spec used for building rpm packages. - Fixed tests on some OSes and architectures by merging Debian 07-tests-errmsg.patch (thx to Peter Pentchev). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 1ff7d9f30884c75b98c8a0a4e1534fa79adcada2322635e6787337b4e38fdb81 stunnel-5.69.tar.gz 66c4f3bbb94c4a274f2e8e98e3d44e74c0460d6494986f0a94b9b8becdc63cc3 stunnel-5.69-win64-installer.exe 74813a0be13270b5348fc4bc7c16ada668d151773be19f404db1176b7e22aafc stunnel-5.69-android.zip Best regards, Mike

1 0

Can I use SCCM to push the install of stunnel to multiple devices
by kmbpabvmkrmtzuzurk＠bbitf.com 27 Feb '23

27 Feb '23

Just a quick question around this and are there any documentation/guides that could be useful?

1 0

Stunnel Configuration issues
by ringbretson＠keplp.com 22 Feb '23

22 Feb '23

I'm trying to create a FIX application that interfaces with ICE using Stunnel to provide encryption. I'm encountering a handshake failure trying to interface with the FIX application. I've copies portions of the Stunnel configuration file as well as the entire FIX configuration file below. Can you do a quick review of the two configuration files and tell me what I'm doing wrong? Both FIX and Stunnel are running on the same Windows 10 virtual pc. *** Stunnel ERRORS with accept set to 127.0.0.1:83 *** 2023.02.21 20:07:13 LOG5[main]: stunnel 5.68 on x64-pc-mingw32-gnu platform 2023.02.21 20:07:13 LOG5[main]: Compiled/running with OpenSSL 3.0.8 7 Feb 2023 2023.02.21 20:07:13 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2023.02.21 20:07:13 LOG5[main]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2023.02.21 20:07:13 LOG5[main]: UTF-8 byte order mark detected 2023.02.21 20:07:13 LOG5[main]: FIPS mode disabled 2023.02.21 20:07:13 LOG3[main]: No trusted certificates found 2023.02.21 20:07:13 LOG5[main]: Configuration successful 2023.02.21 20:07:25 LOG5[0]: Service [fix_initiator_session1_tunnel] accepted connection from 127.0.0.1:62314 2023.02.21 20:07:25 LOG5[0]: s_connect: connected 63.247.113.201:443 2023.02.21 20:07:25 LOG5[0]: Service [fix_initiator_session1_tunnel] connected remote server from 192.168.1.219:62315 2023.02.21 20:07:25 LOG3[0]: SSL_connect: ssl/record/rec_layer_s3.c:1605: error:0A000410:SSL routines::sslv3 alert handshake failure 2023.02.21 20:07:25 LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.02.21 20:07:26 LOG5[1]: Service [fix_initiator_session1_tunnel] accepted connection from 127.0.0.1:62316 2023.02.21 20:07:26 LOG5[1]: s_connect: connected 63.247.113.201:443 2023.02.21 20:07:26 LOG5[1]: Service [fix_initiator_session1_tunnel] connected remote server from 192.168.1.219:62317 2023.02.21 20:07:26 LOG3[1]: SSL_connect: ssl/record/rec_layer_s3.c:1605: error:0A000410:SSL routines::sslv3 alert handshake failure 2023.02.21 20:07:26 LOG5[1]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket *** FIX ERRORS with accept set to 127.0.0.1:49200 *** Same errors in stunnel, but (Socket Error: An existing connection was forcibly closed by the remote host.) in FIX Application *** Stunnel configuration *** [fix_initiator_session1_tunnel] client = yes accept = 127.0.0.1:83 connect = 63.247.113.201:443 cert = stunnel.pem ciphers = PSK PSKsecrets = psk.txt *** FIX 4.4 Configuration *** [DEFAULT] ConnectionType=initiator ReconnectInterval=60 FileStorePath=c:\Temp\WebIce_Initiator FileLogPath=c:\Temp\WebIce_Initiator StartTime=00:00:00 EndTime=23:59:59 SocketConnectHost=127.0.0.1 SocketConnectPort=83 ResetOnLogon=Y ResetOnLogout=Y ResetOnDisconnect=Y [SESSION] BeginString=FIX.4.4 SenderCompID=8655 SenderSubID=0921 TargetCompID=ICE HeartBtInt=30 ValidateFieldsOutOfOrder=N UseDataDictionary=Y DataDictionary=C:\Applications\WebIceInitiator_Pub\FIX44.xml CheckLatency=N SSLEnable=Y SSLProtocols=Tls12 SSLValidateCertificates=N SSLCertificateRevocation=N SSLCertificate=C:\Applications\WebIceInitiator_Pub\Wildcard.ingsoftware.net. pfx SSLCertificatePassword=9322 SSLRequireClientCertificate=N ScreenLogEvents=N ScreenLogShowIncoming=N ScreenLogShowOutgoing=N ScreenLogShowHeartBeats=N

1 0

tstunnel.exe fails to start after updating from 5.67 to 5.68
by Yasuhiro Kimura 21 Feb '23

21 Feb '23

Hello, I install stunnel to my 64bit Windows 10 22H2 PC with official Windows installer and use tstunnel.exe to create TLS connection to IMAP server with configuration file as following ("debug=debug" line is added for debugging purpose). ---------------------------------------------------------------------- client=yes verify=2 checkHost=imap.example.org CApath=C:/Users/yasu/.certs debug=debug [13579] accept=localhost:13579 connect=imap.example.org:143 protocol=imap ---------------------------------------------------------------------- With version 5.67, tstunnel.exe successfully starts as following. ---------------------------------------------------------------------- C:\Users\yasu>tstunnel C:\Users\yasu\Temp\tstunnel.conf 2023.02.19 04:29:11 LOG6[ui]: Initializing inetd mode configuration 2023.02.19 04:29:11 LOG7[ui]: Running on Windows 6.2 2023.02.19 04:29:11 LOG7[ui]: No limit detected for the number of clients 2023.02.19 04:29:11 LOG5[ui]: stunnel 5.67 on x64-pc-mingw32-gnu platform 2023.02.19 04:29:11 LOG5[ui]: Compiled/running with OpenSSL 3.0.7 1 Nov 2022 2023.02.19 04:29:11 LOG5[ui]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2023.02.19 04:29:11 LOG7[ui]: errno: (*_errno()) 2023.02.19 04:29:11 LOG6[ui]: Initializing inetd mode configuration 2023.02.19 04:29:11 LOG7[ui]: Running on Windows 6.2 2023.02.19 04:29:11 LOG5[ui]: Reading configuration from file C:\Users\yasu\Temp\tstunnel.conf 2023.02.19 04:29:11 LOG5[ui]: UTF-8 byte order mark not detected 2023.02.19 04:29:11 LOG5[ui]: FIPS mode disabled 2023.02.19 04:29:11 LOG6[ui]: Compression disabled 2023.02.19 04:29:11 LOG7[ui]: No PRNG seeding was required 2023.02.19 04:29:11 LOG6[ui]: Initializing service [13579] 2023.02.19 04:29:11 LOG6[ui]: stunnel default security level set: 2 2023.02.19 04:29:11 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2023.02.19 04:29:11 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.02.19 04:29:11 LOG7[ui]: TLS options: 0x2100000 (+0x0, -0x0) 2023.02.19 04:29:11 LOG6[ui]: Session resumption enabled 2023.02.19 04:29:11 LOG7[ui]: No certificate or private key specified 2023.02.19 04:29:11 LOG6[ui]: DH initialization skipped: client section 2023.02.19 04:29:11 LOG7[ui]: ECDH initialization 2023.02.19 04:29:11 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.02.19 04:29:11 LOG5[ui]: Configuration successful 2023.02.19 04:29:11 LOG7[ui]: Deallocating deployed section defaults 2023.02.19 04:29:11 LOG7[ui]: Binding service [13579] 2023.02.19 04:29:11 LOG7[ui]: Listening file descriptor created (FD=524) 2023.02.19 04:29:11 LOG7[ui]: Setting accept socket options (FD=524) 2023.02.19 04:29:11 LOG7[ui]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.02.19 04:29:11 LOG6[ui]: Service [13579] (FD=524) bound to ::1:13579 2023.02.19 04:29:11 LOG7[ui]: Listening file descriptor created (FD=528) 2023.02.19 04:29:11 LOG7[ui]: Setting accept socket options (FD=528) 2023.02.19 04:29:11 LOG7[ui]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.02.19 04:29:11 LOG6[ui]: Service [13579] (FD=528) bound to 127.0.0.1:13579 2023.02.19 04:29:11 LOG7[cron]: Cron thread initialized 2023.02.19 04:29:11 LOG6[cron]: Executing cron jobs 2023.02.19 04:29:11 LOG6[cron]: Cron jobs completed in 0 seconds 2023.02.19 04:29:11 LOG7[cron]: Waiting 86400 seconds ---------------------------------------------------------------------- And if I try `telnet localhost 13579`, then I can successfully connect to IMAP server. But after updating from 5.67 to 5.68, it fails to start as following. ---------------------------------------------------------------------- C:\Users\yasu>tstunnel C:\Users\yasu\Temp\tstunnel.conf [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.68 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.8 7 Feb 2023 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Users\yasu\Temp\tstunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [13579] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] No certificate or private key specified [!] No trusted certificates found [!] Service [13579]: Failed to initialize TLS context [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [13579] ---------------------------------------------------------------------- Why these different results happen? Is it bug of 5.68? Or it there any incompatible change between 5.67 and 5.68? --- Yasuhiro Kimura

2 2

No peer temporary key received
by Michael S. Chusovitin 17 Feb '23

17 Feb '23

Hi folks, is there any chance to grasp why such a line - "No peer temporary key received" - is logged immediately after successful negotiation? It does not look harmful but I cannot understand *how ECDHE can do without the ephemeral key*. 2023.02.17 20:33:41 LOG6[4]: TLS accepted: new session negotiated 2023.02.17 20:33:41 LOG6[4]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2023.02.17 20:33:41 LOG6[4]: No peer temporary key received 2023.02.17 20:33:41 LOG7[4]: Compression: null, expansion: null 2023.02.17 20:33:41 LOG6[4]: s_connect: connecting 127.0.0.1:9000 2023.02.17 20:33:41 LOG7[4]: s_connect: s_poll_wait 127.0.0.1:9000: waiting 10 seconds 2023.02.17 20:33:41 LOG7[4]: FD=524 ifds=--- ofds=r-- 2023.02.17 20:33:41 LOG7[4]: FD=540 ifds=rwx ofds=--- 2023.02.17 20:33:41 LOG5[4]: s_connect: connected 127.0.0.1:9000 The above is logged by Stunnel 5.67/5.68; whereas Stunnel 5.66 logs the very same moments differently: it says "SSL_get_peer_tmp_key: Peer suddenly disconnected" (but this can hardly be true). 2023.02.17 20:27:15 LOG6[4]: TLS accepted: new session negotiated 2023.02.17 20:27:15 LOG6[4]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2023.02.17 20:27:15 LOG3[4]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2023.02.17 20:27:15 LOG7[4]: Compression: null, expansion: null 2023.02.17 20:27:15 LOG6[4]: s_connect: connecting 127.0.0.1:9000 2023.02.17 20:27:15 LOG7[4]: s_connect: s_poll_wait 127.0.0.1:9000: waiting 10 seconds 2023.02.17 20:27:15 LOG7[4]: FD=512 ifds=--- ofds=r-- 2023.02.17 20:27:15 LOG7[4]: FD=528 ifds=rwx ofds=--- 2023.02.17 20:27:15 LOG5[4]: s_connect: connected 127.0.0.1:9000 Thanks in advance, Mikhail

1 0

blat, stunnel, and gmail with an app password
by blat_stunnel2023＠protonmail.com 17 Feb '23

17 Feb '23

I was using a Windows command line blat.exe mailer with stunnel along with a gmail account to send emails from a Windows command line batch file. Gmail started requiring I se the gmail account to allow "less secure" sign in options. That worked for a while, but in May 2022, gmail discontinued that option. It sounds like you can set two factor on the gmail account and then generate an app password for the gmail account. So I did that. I'm stumped on how to get either blat or stunnel to use that gmail app password though. Any ideas? Blat is looking super old though. I see when I set up this computer to with blat-stunnel-gmail, that I ran a line with blat.exe to store the gmail password. I don't see a way to store an app password, but blat is old. This is blat. http://www.blat.net./ Looks like the last update was in 2012, so app passwords may not have even existed then. Is there any way to stunnel to store a gmail app password? My goal is just to send an email from a Windows machine with either a Windows batch file or PowerShell script. It's not mission critical. It's for home use. I just like to get email alerts when my home machines complete some task. If something else works, I'm interested. It needs to work in a batch file though, or at least powershell if a batch file can't work. For my previous set up, I just kept stunnel updated, initially set up blat with the email information, and used only a batch file with blat to send emails from a gmail account. And then it was making sure less secure apps was an option on the gmail account. Now it's been broken for almost a year.

2 2

Windows offical release - Anyone knows which compiler is used ? VS or minigw ?
by roie rachamim 13 Feb '23

13 Feb '23

Many thanks, Roie

1 0

stunnel 5.68 released
by Michał Trojnara 12 Feb '23

12 Feb '23

Dear Users, I have released version 5.68 of stunnel. ### Version 5.68, 2023.02.07, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.8. * New features - Added the new 'CAengine' service-level option to load a trusted CA certificate from an engine. - Added requesting client certificates in server mode with 'CApath' besides 'CAfile'. * Bugfixes - Fixed EWOULDBLOCK errors in protocol negotiation. - Fixed handling TLS errors in protocol negotiation. - Prevented following fatal TLS alerts with TCP resets. - Improved OpenSSL initialization on WIN32. - Improved testing suite stability. - Improved file read performance. - Improved logging performance. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: dcd895ab088b043d4e0bafa8b934e7ab3e697293828dbe9fce46cb7609a7dacf stunnel-5.68.tar.gz 62807f6233c8a5693104c09b44ebde6cc395877d948651c3ff0767e07ccdd316 stunnel-5.68-win64-installer.exe 93291060fdfc889431e8bce5cfe875b23be2bac11e2338f8f8f84d509f1b33fa stunnel-5.68-android.zip Best regards, Mike

2 1