- stunnel-users - stunnel.org

Verify peer immediately
by Phillip Hellewell 21 Mar '19

21 Mar '19

Hi, I have verifyPeer = yes in my client stunnel.conf. Is there any way to make it verify the peer right away instead of waiting until a connection is made (to the accept port)? I run stunnel with foreground = yes and would like it to exit right away if the peer doesn't have the appropriate cert/key. Thanks, Phillip

1 0

stunnel become non-non responsive and very sluggish
by Joe Phillips 18 Mar '19

18 Mar '19

I have 5.30 running on Ubuntu workstation. It has become sluggish and almost non responsive at times. I captured this in the log the other day...no source, no destination address. Maybe got stuck in a loop? Have to restart Ubuntu to clear it up. stunnel2@stunnel2:~$ /etc/init.d/stunnel4 restart [....] Restarting stunnel4 (via systemctl): stunnel4.serviceFailed to restart stunnel4.service: Access denied See system logs and 'systemctl status stunnel4.service' for details. failed! stunnel2@stunnel2:~$ sudo tail -f -n 100 /var/log/stunnel.log sudo: unable to resolve host stunnel2: Connection timed out [sudo] password for stunnel2: 2019.03.13 04:06:14 LOG5[1149140]: Connection reset: 34440 byte(s) sent to SSL, 4886 byte(s) sent to socket 2019.03.13 04:38:56 LOG5[1142702]: Connection reset: 2362 byte(s) sent to SSL, 1225 byte(s) sent to socket 2019.03.13 05:09:32 LOG5[1137283]: Connection reset: 23006 byte(s) sent to SSL, 3977 byte(s) sent to socket 2019.03.13 05:51:57 LOG5[1109534]: Connection reset: 33953 byte(s) sent to SSL, 16755 byte(s) sent to socket 2019.03.13 05:58:36 LOG5[1139715]: Connection reset: 25039 byte(s) sent to SSL, 3944 byte(s) sent to socket 2019.03.13 06:25:12 LOG5[1137757]: Connection reset: 2863 byte(s) sent to SSL, 1329 byte(s) sent to socket 2019.03.13 06:49:19 LOG5[1137393]: Connection reset: 26536 byte(s) sent to SSL, 14839 byte(s) sent to socket 2019.03.13 06:51:35 LOG5[1137344]: Connection reset: 28968 byte(s) sent to SSL, 12986 byte(s) sent to socket 2019.03.13 07:10:28 LOG5[1137343]: Connection reset: 28655 byte(s) sent to SSL, 7632 byte(s) sent to socket 2019.03.13 07:30:52 LOG5[1136403]: Connection reset: 25466 byte(s) sent to SSL, 6767 byte(s) sent to socket 2019.03.13 07:35:33 LOG5[1141675]: Connection reset: 28637 byte(s) sent to SSL, 15044 byte(s) sent to socket 2019.03.13 07:39:21 LOG5[1121823]: Connection reset: 47442 byte(s) sent to SSL, 67336 byte(s) sent to socket 2019.03.13 07:39:58 LOG5[1148822]: Connection reset: 25003 byte(s) sent to SSL, 9295 byte(s) sent to socket 2019.03.13 07:40:29 LOG5[1127468]: Connection reset: 57030 byte(s) sent to SSL, 73806 byte(s) sent to socket 2019.03.13 07:46:08 LOG5[1107655]: Connection reset: 84608 byte(s) sent to SSL, 125726 byte(s) sent to socket 2019.03.13 07:49:49 LOG5[1140561]: Connection reset: 27344 byte(s) sent to SSL, 11112 byte(s) sent to socket 2019.03.13 07:59:23 LOG5[1106646]: Connection reset: 9970 byte(s) sent to SSL, 5355 byte(s) sent to socket 2019.03.13 08:01:27 LOG5[1143613]: Connection reset: 26733 byte(s) sent to SSL, 8993 byte(s) sent to socket 2019.03.13 08:02:28 LOG5[1141251]: Connection reset: 49897 byte(s) sent to SSL, 62187 byte(s) sent to socket 2019.03.13 08:03:11 LOG5[1139045]: Connection reset: 24669 byte(s) sent to SSL, 4580 byte(s) sent to socket 2019.03.13 08:05:13 LOG5[1137322]: Connection reset: 39408 byte(s) sent to SSL, 33428 byte(s) sent to socket 2019.03.13 08:07:56 LOG5[1151696]: Connection reset: 23577 byte(s) sent to SSL, 5415 byte(s) sent to socket 2019.03.13 08:11:12 LOG5[1136170]: Connection reset: 64684 byte(s) sent to SSL, 36839 byte(s) sent to socket 2019.03.13 08:11:55 LOG5[1141693]: Connection reset: 22826 byte(s) sent to SSL, 5186 byte(s) sent to socket 2019.03.13 08:15:30 LOG5[1140377]: Connection reset: 42452 byte(s) sent to SSL, 39471 byte(s) sent to socket 2019.03.13 08:18:29 LOG5[1154893]: Connection reset: 21190 byte(s) sent to SSL, 3096 byte(s) sent to socket 2019.03.13 08:22:14 LOG5[1153488]: Connection reset: 23506 byte(s) sent to SSL, 5081 byte(s) sent to socket 2019.03.13 08:24:34 LOG5[1153167]: Connection reset: 46285 byte(s) sent to SSL, 8378 byte(s) sent to socket 2019.03.13 08:26:25 LOG5[1145557]: Connection reset: 26015 byte(s) sent to SSL, 6055 byte(s) sent to socket 2019.03.13 08:29:34 LOG5[1030096]: Connection reset: 89657 byte(s) sent to SSL, 120807 byte(s) sent to socket 2019.03.13 08:30:36 LOG5[1081623]: Connection reset: 51409 byte(s) sent to SSL, 50378 byte(s) sent to socket 2019.03.13 08:32:23 LOG5[1149449]: Connection reset: 28329 byte(s) sent to SSL, 12655 byte(s) sent to socket 2019.03.13 08:32:33 LOG5[1106312]: Connection reset: 52138 byte(s) sent to SSL, 58239 byte(s) sent to socket 2019.03.13 08:33:46 LOG5[1137325]: Connection reset: 36900 byte(s) sent to SSL, 29750 byte(s) sent to socket 2019.03.13 08:36:35 LOG5[1145147]: Connection reset: 31740 byte(s) sent to SSL, 21114 byte(s) sent to socket 2019.03.13 08:38:59 LOG5[1133239]: Connection reset: 44816 byte(s) sent to SSL, 18743 byte(s) sent to socket 2019.03.13 08:41:04 LOG5[1148129]: Connection reset: 32191 byte(s) sent to SSL, 20525 byte(s) sent to socket 2019.03.13 08:43:55 LOG5[1150567]: Connection reset: 27989 byte(s) sent to SSL, 12627 byte(s) sent to socket 2019.03.13 08:47:21 LOG5[1146666]: Connection reset: 29242 byte(s) sent to SSL, 13836 byte(s) sent to socket 2019.03.13 08:49:26 LOG5[main]: Terminated 2019.03.13 08:58:32 LOG5[ui]: stunnel 5.30 on x86_64-pc-linux-gnu platform 2019.03.13 08:58:32 LOG5[ui]: Compiled/running with OpenSSL 1.0.2g 1 Mar 2016 2019.03.13 08:58:32 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2019.03.13 08:58:32 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2019.03.13 08:58:32 LOG5[ui]: UTF-8 byte order mark detected 2019.03.13 08:58:32 LOG5[ui]: FIPS mode disabled 2019.03.13 08:58:36 LOG5[ui]: Configuration successful [UMC Color Logo - small]<http://www.universalmoney.com/> Joe Phillips SVP-IT 15301 W. 87th Street Parkway, Suite 215 Lenexa, KS 66219 Corp Office 913.831.2055 Direct via Cell 913.927.5691 www.universalmoney.com

2 1

(no subject)
by Vijay Raghavan P 05 Mar '19

05 Mar '19

Hi, I have to create tunnel between server and client. Client have proxy configured in between. So i use below in /etc/stunnel/stunnel.config pid = /var/run/stunnel.pid cert = /home/client.crt key = /home/client.key options = NO_SSLv2 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes CAfile=/home/**chain.pem verify=2 [test] protocol = connect accept = 127.0.0.1:10000 protocolHost = server.xxxx.com:443 connect = <PROXYIP>:<PROXY port> protocolUsername = user1 protocolPassword = password protocolAuthentication = Basic then i bring up the service. With above configuration connection works file. Now i don't want proxy password to be clear text in this case. Any pointers plz Thanks, Vj

2 3

Re: [stunnel-users] stunnel-users Digest, Vol 176, Issue 3
by Andrew Smalley 04 Mar '19

04 Mar '19

FIPS in stunnel and OpenSSL The actual cause of the problem is OpenSSL v1.1.x does not support FIPS engine and as such, you can only use a FIPS Compliant cipher until FIPS is recertified as I understand it Andruw Smalley Loadbalancer.org Ltd. www.loadbalancer.org +1 888 867 9504 / +44 (0)330 380 1064 asmalley(a)loadbalancer.org Leave a Review | Deployment Guides | Blog Andruw Smalley Loadbalancer.org Ltd. www.loadbalancer.org +1 888 867 9504 / +44 (0)330 380 1064 asmalley(a)loadbalancer.org Leave a Review | Deployment Guides | Blog On Mon, 4 Mar 2019 at 16:20, <stunnel-users-request(a)stunnel.org> wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. FIPS mode not supported (Yan Renelt) > 2. Re: FIPS mode not supported (mlrx) > 3. Re: FIPS mode not supported (Flo Rance) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 4 Mar 2019 16:14:47 +0100 > From: Yan Renelt <reneltyan(a)gmail.com> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] FIPS mode not supported > Message-ID: <3F804E14-5218-42A5-9850-7AEBC0EF8F96(a)gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > > my config is > cert = stunnel.pem > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > debug = 7 > > fips = yes > > [Demo-Trading] > client = yes > accept = 127.0.0.1:40001 > connect = fix-order.london-demo.lmax.com:443 > sslVersion = TLSv1 > options = NO_SSLv2 > options = NO_SSLv3 > > [Demo ñ Market Data] > client = yes > accept = 127.0.0.1:40003 > connect = fix-marketdata.london-demo.lmax.com:443 > sslVersion = TLSv1 > options = NO_SSLv2 > options = NO_SSLv3 > > > and I still receiving this error. > > FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported > > Any suggestions? Fips = no is not an option for me. > > > Thanks > > Yan >

1 0

FIPS mode not supported
by Yan Renelt 04 Mar '19

04 Mar '19

Hi, my config is cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 fips = yes [Demo-Trading] client = yes accept = 127.0.0.1:40001 connect = fix-order.london-demo.lmax.com:443 sslVersion = TLSv1 options = NO_SSLv2 options = NO_SSLv3 [Demo ñ Market Data] client = yes accept = 127.0.0.1:40003 connect = fix-marketdata.london-demo.lmax.com:443 sslVersion = TLSv1 options = NO_SSLv2 options = NO_SSLv3 and I still receiving this error. FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported Any suggestions? Fips = no is not an option for me. Thanks Yan

3 2

dhparam and others
by mlrx 02 Mar '19

02 Mar '19

Hello, This is my first run with stunnel. I have unbound and stunnel on openBSD to do DNS-over-TLS and it works (fine). I want now to enforce TLS security so I added the following options: sslVersion = TLSv1.2 options = CIPHER_SERVER_PREFERENCE ciphers = [list] curve = [name] When it will be ready to production, I will add: verify = 3 CA* OCSP* For now, I don't find any information about using dhparam file. Something like SSLOpenSSLConfCmd DHParameters "/path/to/file.pem" in Apache. How can I do it possible? Could you point me some informations or the path to do it please? Could you confirm that I can't use TLS1.3 for now in stunnel? May be you could have some security advices ? Best regards, -- mlrx

1 0

Issue with NTLM authorisation
by Vijay Raghavan P 01 Mar '19

01 Mar '19

Hi, I have to create tunnel between server and client. Client have proxy configured in between. So i use below in /etc/stunnel/stunnel.config. User name and password is correct pid = /var/run/stunnel.pid cert = /home/client.crt key = /home/client.key options = NO_SSLv2 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes CAfile=/home/**chain.pem verify=2 [test] protocol = connect accept = 127.0.0.1:10000 protocolHost = host.vmj.com:443 connect = <PROXYIP>:<PROXY port> protocolUsername = vmj.com\user1 protocolPassword = VMJTEST!123 protocolAuthentication = NTLM In stunnel.log, i can see below error 2019.02.28 18:36:50 LOG6[2103:140737354032896]: Client-mode connect protocol negotiations started 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> CONNECT host.vmj.com:443 HTTP/1.1 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> Host: host.vmj.com:443 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> Proxy-Connection: keep-alive 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAA== 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- HTTP/1.1 407 Proxy Authentication Required 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Server: squid/3.3.8 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Mime-Version: 1.0 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Date: Thu, 28 Feb 2019 18:36:33 GMT 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Content-Type: text/html 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Content-Length: 3285 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Vary: Accept-Language 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Content-Language: en 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAAAAADgAAAACAgACueAMGSlaSZ0AAAAAAAAAAAAAAAA4AAAABgEAAAAAAA8= 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- X-Cache: MISS from squidproxy.vmj.com 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- X-Cache-Lookup: NONE from squidproxy.vmj.com:3128 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Via: 1.1 squidproxy.vmj.com (squid/3.3.8) 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Connection: keep-alive 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> CONNECT host.vmj.com:443 HTTP/1.1 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> Host: host.vmj.com:443 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> Proxy-Authorization: NTLM TlRMTVNTUAADAAAAAAAAAGcAAAAYABgAQAAAAAAAAABnAAAADwAPAFgAAAAAAAAAZwAAAAAAAABnAAAAAgIAAAGbqH5v5ML8msrfm3R1yDBsS+ai3ldihnZybmkuY29tXGJoYXJ0aQ== 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- HTTP/1.1 407 Proxy Authentication Required 2019.02.28 18:36:50 LOG3[2103:140737354032896]: CONNECT request rejected 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Server: squid/3.3.8 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Mime-Version: 1.0 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Date: Thu, 28 Feb 2019 18:36:33 GMT 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Content-Type: text/html 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Content-Length: 3363 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Vary: Accept-Language 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Content-Language: en 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Proxy-Authenticate: NTLM 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- X-Cache: MISS from squidproxy.vmj.com 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- X-Cache-Lookup: NONE from squidproxy.vmj.com:3128 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Via: 1.1 squidproxy.vmj.com (squid/3.3.8) 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Connection: keep-alive 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- 2019.02.28 18:36:50 LOG5[2103:140737354032896]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.02.28 18:36:50 LOG7[2103:140737354032896]: Remote socket (FD=14) closed 2019.02.28 18:36:50 LOG7[2103:140737354032896]: Local socket (FD=3) closed 2019.02.28 18:36:50 LOG7[2103:140737354032896]: Service [test] finished (0 left) If i try with basic authentication it works fine. Its urgent , can some one help me out. Thanks, Vj

2 1

Tunnel from win32 to Unix
by Eetu Pikkarainen 26 Feb '19

26 Feb '19

Hi, I am a totally newbie with this. We have intranet system in Windows Server (32bit) which reads a database (Oracle) situated in Unix machine via a tunnel made by Putty.exe. That works well except that the connection gets lost every now and then and it must be manually logged in every time. So I decided to try stunnel which we used earlier to read email from email server. However I cannot set the connection successfully. This is what I have tried now (among many other alternatives): [Kanto2] client = yes accept = 127.0.0.1:1501 connect = kanto2.oulu.fi:22 protocolUsername = <username> protocolPassword = <password> stunnel reads the configuration OK except this notification: [:] Service [Kanto2] needs authentication to prevent MITM attacks but when the database is tried to read happens this: 2019.02.18 13:32:30 LOG5[1]: Service [Kanto2] accepted connection from 127.0.0.1:64699 2019.02.18 13:32:30 LOG5[1]: s_connect: connected 130.231.240.100:22 2019.02.18 13:32:30 LOG5[1]: Service [Kanto2] connected remote server from 130.231.241.250:64700 2019.02.18 13:32:30 LOG3[1]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2019.02.18 13:32:30 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket I have tried different protocol alternatives with no help. What could be the problem? Is this kind of use even possible? thanks Eetu Pikkarainen PhD (Ed.), (Title of) Adjunct Prof., University Lecturer (in Education) Faculty of Education, University of Oulu, Finland Research Group: https://wiki.oulu.fi/display/theored Latest publications: Semiotic Theory of Learning: New Perspectives in the Philosophy of Education. By Andrew Stables, Winfried Nöth, Alin Olteanu, Sébastien Pesce and Eetu Pikkarainen https://www.taylorfrancis.com/books/e/9781351725170 Schools in Transition: Linking Past, Present, and Future in Educational Practice. Edited by Pauli Siljander, Kimmo Kontio and Eetu Pikkarainen https://www.sensepublishers.com/catalogs/bookseries/other-books/schools-in-…

2 1

Stunnel 3.50 Win - CAPI stopped working
by pepak＠seznam.cz 18 Feb '19

18 Feb '19

Hello, I have encountered a bug in Stunnel version 3.50. I have a setup with two computers (Server and Client) connected using Stunnel. The client is using a hardware token through the CAPI engine to authenticate itself to a server, using a config file: ----- fips = no taskbar = yes options = NO_SSLv2 options = NO_SSLv3 sslVersion = TLSv1.2 engine = capi [my-server] client = yes accept = 22 connect = my.server.com:1234 requireCert = yes verifyChain = yes verifyPeer = yes CAfile = my-cert-chain.pem engineId = capi ----- This setup works perfectly in Stunnel 3.49: When I try to connect to localhost:22, I receive a request to select a certificate and enter its PIN, and if successful, a connection to my server is established. In Stunnel 3.50, the connection fails to complete. The Stunnel log shows: LOG5[0]: Service [my-server] accepted connection from 127.0.0.1:49713 LOG5[0]: s_connect: connected 1.2.3.4:1234 LOG5[0]: Service [my-server] connected remote server from 10.11.12.13:49714 LOG5[0]: Certificate accepted at depth=0: CN=My server LOG3[0]: error queue: 141F0006: error:141F0006:SSL routines:tls_construct_cert_verify:EVP lib LOG3[0]: SSL_connect: 8006F074: error:8006F074:lib(128):capi_rsa_priv_enc:function not supported LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket However, if I change the engine to the default one and use a certificate in file, everything works fine. That suggests to me that the problem lies in the Stunnel's CAPI engine library. It is quite possible the problem is caused by the CAPI engine itself. I was experimenting with OpenSSL 1.1.1a some time back, trying to compile my own library files, and I just couldn't to get CAPI to work at all - the libraries themselves compiled OK and worked fine, but the CAPI engine just wouldn't work (while it was OK with OpenSSL 1.0.2q); the only way I could get CAPI to work with OpenSSL 1.1.1a was to use the 1.1.1a libraries and the 1.0.2q capi.dll. However, I am far from an expert on compiling OpenSSL, so I may have gotten it completely wrong. Could someone please verify that their CAPI engine is working with Stunnel? Also, it may be worth trying to compile a 64bit CAPI.dll from version 1.0.2q just to see if it might start working - in that case, a bug report to OpenSSL may be in order. Thanks. pepak

2 1

Timeout's issue / network stunnel on virtual apps
by Marian Andrei Olteanu 17 Feb '19

17 Feb '19

Hi all, I have a client - server application which works as following. The server is hosted in a linux machine and the clients are up in citrix(XEN) virtual machines. I have enable stunnel encry. in between this environments but i keep getting some connection issues from time to time. To be more clear the client application starts a session for you from the virtual machine (xen) so the stunnel.exe running there in the server is meant to encrypt traffic of around 100 users(from win AD who have access to use that resource in the server) , port configured in VM machine 1001 accept - linux.host:1002 connect with linux accept on 1002 - localhost:1000. the channel opened between the VM and Linux is used by many users simultaneous. Could please tell me what is happening here?Is this architecture able to work? thank you in advance. Marian

1 0

stunnel stopped working today, had to reboot server
by Christopher Schultz 14 Feb '19

14 Feb '19

Hello, I'm new to the list so I'm sorry if this isn't the right place to report this. I had a server stop responding to stunnel connections sometime yesterday and the resolution was ultimately to reboot the server and everything was okay. Restarting the stunnel service was not enough to get things working again. I isolated the problem to stunnel by checking that the underlying service (a Java web application) would respond from the localhost machine (it did) but an openssl s_client connection to localhost:stunnel-port would connect but not proceed past the CONNECTED(3) state. Ultimately, it would time-out. stunnel was not logging anything to syslog when these connections came in. Outgoing stunnel connections seemed to be okay. Looking through the log file, I could see that there were some odd messages coming from stunnel in the daemon.log file suggesting that there might be a memory leak. I won't post them here unless requested, as they may represent a potential security issue. My concern is that a service-restart for stunnel was not sufficient. This suggests a problem which goes deeper than the stunnel service. Is it possible for stunnel to break in such a way that it continues to be broken after a restart? I'm sorry, in retrospect, I was not 100% sure that the service did indeed stop and launch a new process when running /etc/init.d/stunnel restart, but there were no errors and the service-runner did report that the service was restarted. My (simplified) configuration and version information is posted below. Please let me know if there is any other information I might be able to provide in order to investigate this. Note that this is a package-managed version of stunnel, provided by the Debian package-maintainers. Thanks, -chris PS Thanks for a wonderful product. I've relied on stunnel for years to proxy these unencrypted AJP connections for me. Cheers for all your great work. Configuration: === CUT === cert = /etc/stunnel/stunnel.crt key = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4-ajp.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 4 CAfile = /etc/stunnel/stunnel-ajp-trusted.pem [now, a series of 4 services, all configured similarly] accept=public-port connect=localhost:private-port === CUT === Version: stunnel 5.39 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.1.0c 10 Nov 2016 Running with OpenSSL 1.1.0j 20 Nov 2018 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP Global options: debug = daemon.notice pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Linux kernel version: Linux [hostname] 4.9.0-8-amd64 #1 SMP Debian 4.9.130-2 (2018-10-27) x86_64 GNU/Linux This is running on a bare metal server.

2 5

Re: [stunnel-users] Problem with name resolving on Centos 7
by tom 13 Feb '19

13 Feb '19

Hello, > Are you sure 'foobar.remote.site' should resolve? > Does "ping foobar.remote.site" work? yes, the host is resolved on commandline and other services on this system can reach this host. > Do you have a /var/run/stunnel/etc/resolv.conf file? No at this time I dont have this file, but it doesnt change anything if I copy the original from /etc to this lokation. But this brings me to the point try to dissable chroot and in this case stunnel is working as expected. So far so good - there is something wrong in the chroot jail. I try to put it to /var/run/stunnel - no luck, but maybe there are other files missing as well? regards Tom

4 10

Problem with name resolving on Centos 7
by tom 12 Feb '19

12 Feb '19

Hello, I've installed stunnel-4.56-6.el7.x86_64 on my Centos 7. I can't establish a connection. Seems to be something wrong with the name resolution, because if I use the IP derect, the tunnel works. Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526436416]: Service [cs] accepted (FD=3) from 127.0.0.1:10866 Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Service [cs] started Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Waiting for a libwrap process Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Acquired libwrap process #0 Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Releasing libwrap process #0 Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Released libwrap process #0 Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Service [cs] permitted by libwrap from 127.0.0.1:10866 Feb 12 11:58:00 server stunnel[52445]: LOG5[52445:139984526432000]: Service [cs] accepted connection from 127.0.0.1:10866 Feb 12 11:58:00 server stunnel[52445]: LOG3[52445:139984526432000]: Error resolving 'foobar.remote.site': System error returned in errno (EAI_SYSTEM) Feb 12 11:58:00 server stunnel[52445]: LOG3[52445:139984526432000]: No host resolved Feb 12 11:58:00 server stunnel[52445]: LOG5[52445:139984526432000]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Local socket (FD=3) closed Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Service [cs] finished (0 left) stunnel.conf: socket = r:TCP_NODELAY=1 socket = l:TCP_NODELAY=1 options = CIPHER_SERVER_PREFERENCE TIMEOUTclose = 0 sslVersion = TLSv1 options = NO_SSLv2 options = NO_SSLv3 client = yes options = DONT_INSERT_EMPTY_FRAGMENTS cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem debug = 7 chroot = /var/run/stunnel setuid = stunnel setgid = stunnel pid = /stunnel.pid fips = no [srvice] accept = 63123 connect = foobar.remote.site:63123 delay = yes Any suggestions are very welcome! Thanks in advance Tom

3 2

Stunnel 5.50 Transparent Both (Source+Destination)
by Luis Monteiro 01 Feb '19

01 Feb '19

Sirs. I´m trying to make Stunnel work in both source and destination transparent proxy and after looking every possibility I started to track the packet that is locally generated (Stunnel client sending to stunnel server). The packet goes out from process to raw table output chain. It deliveries to connect tracking that pass the packet to mangle output but it disappears before arriving in the nat table output chain. Stunnel Packet destination 7.0.0.2:80(Original destination)------raw/output-----connectTrack------mangle/output-------XXXX disappear With transparent destination off it works fine. Stunnel Packet destination 9.0.0.2:443(Stunnel Server IP)------raw/output-----connectTrack------mangle/output-------nat/output---- filter/output----interface The problem is probably regarding the tproxy/ip_transparent that stunnel use to control the connection and get the original src/dst to use. I tried 3 different distribution of linux with the same behavior. Does someone already use transparent=both and give me a setup that worked link linux distribution/version, stunnel version and so on? Thanks, Luis Monteiro

1 1

Re: [stunnel-users] How can stunnel use openssl HW cryptodev encryption
by Eric Eberhard 28 Jan '19

28 Jan '19

I'll give you two pieces of advice that almost everyone on the list won't agree with :) 1) Make a static openssl and static stunnel and locate them someplace apart from the standard locations (/usr/local/company_name/lib is what I use). This means if anyone messes with openssl or stunnel you won't be affected - and it will always work as it is static - and part of your application - the user does not even need your libraries. I have a personal distaste for dynamic linking . mostly because I have a lot of customers that update a lot of things (including openssl - a lot - and stunnel sometimes) . and then wonder why things stop working. A 10 year old openssl and stunnel - all static - will still run and work fine past all updates and user messing around. I choose when I want to update openssl and stunnel (meaning I look to see if there is something new I need or want). As a result I missed the keep alive and poodle bugs - I did not update until after both were fixed. 2) Forget hardware implementation - geez - modern computers are so darn fast that I cannot imagine you really need that level of "speed up" versus the grief you are handling. I have customers that exchange millions (4+) XML documents a day, all through stunnel, all through inetd (also not efficient supposedly - just reliable and always works and needs no management) - and have no problems. I am using IBM p Series (AIX) and these machines even at the low level are fast . but I also use some SCO and Linux and certainly with lesser volume they are fine as well. 3) OK - 3 is really - use inetd, so much easier and always works (assuming you have Unix). If inetd crashes Unix crashes so . see number 2 for reasons :) Of course, these ideas won't help much if you don't have a Unix variation or if you are really that tight on performance (although if you are I'd suggest hardware upgrades!). Good luck with your project, Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Tamar Pedersen Sent: Wednesday, January 16, 2019 1:06 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] How can stunnel use openssl HW cryptodev encryption Hello, I am evaluating stunnel, to see if it is a viable solution for providing encryption in a system that contains an Atmel processor which includes a HW accelerated encryption block. I am just ramping up on stunnel, and figured I should capture what I have done so far. My questions will come towards the end of my email. My research indicates that stunnel incorporates openssl. I have been able to use openssl independently, to access the cryptodev HW encryption engine, in the Linux kernel module located in /lib/modules/4.14.79/extra/cryptodev.ko. When openssl is run without accessing the cryptodev engine (cryptodev module not loaded), I get the pure SW encryption implementation provided by default in openssl. When I run bench mark speed tests using openssl, using SW encryption, I see the following results: # time -v openssl speed -evp aes-128-cbc Doing aes-128-cbc for 3s on 16 size blocks: 1689887 aes-128-cbc's in 2.95s Doing aes-128-cbc for 3s on 64 size blocks: 568389 aes-128-cbc's in 2.95s Doing aes-128-cbc for 3s on 256 size blocks: 151550 aes-128-cbc's in 2.96s Doing aes-128-cbc for 3s on 1024 size blocks: 38599 aes-128-cbc's in 2.96s Doing aes-128-cbc for 3s on 8192 size blocks: 4845 aes-128-cbc's in 2.95s OpenSSL 1.0.2p-fips 14 Aug 2018 built on: reproducible build, date unspecified options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr) compiler: arm-laird-linux-gnueabi-gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -I/home/sii/wb50n_space2_legacy_6.0.0.x/wb/buildroot/output/wb50n_space2_leg acy/host/arm-buildroot-linux-gnueabi/sysroot/usr/local/ssl/fips-2.0/include -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 9165.49k 12331.15k 13107.03k 13353.17k 13454.32k Command being timed: "openssl speed -evp aes-128-cbc" User time (seconds): 14.81 System time (seconds): 0.10 Percent of CPU this job got: 99% Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 15.06s Average shared text size (kbytes): 0 Average unshared data size (kbytes): 0 Average stack size (kbytes): 0 Average total size (kbytes): 0 Maximum resident set size (kbytes): 13376 Average resident set size (kbytes): 0 Major (requiring I/O) page faults: 0 Minor (reclaiming a frame) page faults: 145 Voluntary context switches: 0 Involuntary context switches: 721 Swaps: 0 File system inputs: 0 File system outputs: 0 Socket messages sent: 0 Socket messages received: 0 Signals delivered: 0 Page size (bytes): 4096 Exit status: 0 # When I load the cryptodev module, and take advantage of the accelerated hardware encryption the benchmark tests are significantly faster. Here is what those results look like. # modprobe cryptodev # time -v openssl speed -evp aes-128-cbc Doing aes-128-cbc for 3s on 16 size blocks: 44163 aes-128-cbc's in 0.12s Doing aes-128-cbc for 3s on 64 size blocks: 31345 aes-128-cbc's in 0.15s Doing aes-128-cbc for 3s on 256 size blocks: 18923 aes-128-cbc's in 0.11s Doing aes-128-cbc for 3s on 1024 size blocks: 13847 aes-128-cbc's in 0.13s Doing aes-128-cbc for 3s on 8192 size blocks: 8427 aes-128-cbc's in 0.06s OpenSSL 1.0.2p-fips 14 Aug 2018 built on: reproducible build, date unspecified options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr) compiler: arm-laird-linux-gnueabi-gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -I/home/sii/wb50n_space2_legacy_6.0.0.x/wb/buildroot/output/wb50n_space2_leg acy/host/arm-buildroot-linux-gnueabi/sysroot/usr/local/ssl/fips-2.0/include -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 5888.40k 13373.87k 44038.98k 109071.75k 1150566.40k Command being timed: "openssl speed -evp aes-128-cbc" User time (seconds): 0.59 System time (seconds): 8.72 Percent of CPU this job got: 61% Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 15.11s Average shared text size (kbytes): 0 Average unshared data size (kbytes): 0 Average stack size (kbytes): 0 Average total size (kbytes): 0 Maximum resident set size (kbytes): 13792 Average resident set size (kbytes): 0 Major (requiring I/O) page faults: 0 Minor (reclaiming a frame) page faults: 144 Voluntary context switches: 41154 Involuntary context switches: 3321 Swaps: 0 File system inputs: 0 File system outputs: 0 Socket messages sent: 0 Socket messages received: 0 Signals delivered: 0 Page size (bytes): 4096 Exit status: 0 # As can be seen in the results (hi-lighted in red), the average speed to do aes-128-cbc encryption jumped from around 2.95 s to 0.10 s. Also of interest is the context switches are significantly higher when running hardware encryption, because of interrupts and overhead to use the hardware engine. I can also look at /proc/interrupts and see significant increases in atmel-aes interrupt counts when using the cryptodev HW acceleration encryption engine. This gives a good indication that the cryptodev module is in use, and is doing encryption. I would like to try to figure out how to allow stunnel to take advantage of the cryptodev HW acceleration encryption engine available in openssl. I have made some attempts, but so far, I have not been able to determine if stunnel is successfully using the cryptodev engine. Here is what I have done with stunnel. I already have a client and server successfully communicating with each other using stunnel. To verify this I used the "nc" utility to send characters back and forth between two different machines. The stunnel.conf file, on the server, is out of the box. I'm interested in encrypting on the client side. Here is my current client.conf file, in /etc/stunnel: # cat client.conf debug = 7 output = /tmp/stunnel-server.log pid = /tmp/stunnel.pid engine = cryptodev [test] verify = 1 client = yes accept = 127.0.0.1:2000 connect = 192.168.0.220:30000 CAfile = /etc/stunnel/certificate.crt engineNum = 1 # I am attempting to set up the cryptodev to be the configured engine for the client. I am able to start stunnel, using client.conf, as follows: # stunnel /etc/stunnel/client.conf # If I do a "ps" command to display processes, I can see that stunnel is running in the background. At this point, I can use "nc" to send data, as follows: # nc 127.0.0.1 2000 < /tmp/long_file.txt I am able to see the text from long_file.txt on the server, which is also running nc. The problem is that I don't see interrupts increasing in /proc/interrupts, which leaves me wondering if I have not configured stunnel correctly to use the cryptodev engine. If I try to remove the cryptodev module as this point, while stunnel is running, I receive a message that it is in use, as follows: # modprobe -r cryptodev modprobe: FATAL: Module cryptodev is in use. # If I kill the stunnel process, I am able to successfully remove the cryptodev module, which seems to suggest stunnel is the process using the cryptodev module. Also, once I have removed the cryptodev module, I can't restart stunnel. Instead, I get the following errors back: # stunnel /etc/stunnel/client.conf [.] stunnel 5.44 on arm-buildroot-linux-gnueabi platform [.] Compiled/running with OpenSSL 1.0.2p-fips 14 Aug 2018 [.] Threading:FORK Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/client.conf [.] UTF-8 byte order mark not detected [ ] Enabling support for engine "cryptodev" [!] error queue: 2606A074: error:2606A074:engine routines:ENGINE_by_id:no such engine [!] error queue: 260B6084: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found [!] error queue: 25070067: error:25070067:DSO support routines:DSO_load:could not load the shared library [!] ENGINE_by_id: 25066067: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library [!] /etc/stunnel/client.conf:5: "engine = cryptodev": Failed to open the engine # Again, this suggests stunnel is trying to use cryptodev. I just don't know how to prove I am taking advantage of the HW encryption acceleration engine. I never see interrupts updating in /proc/interrupts when using nc, while stunnel is running. So, here are my questions: 1.) Does it look like I have things set up correctly in client.conf, to use the cryptodev engine? 2.) If client.conf is correct, how can I prove that stunnel is using the cryptodev engine, since I don't see the expected interrupts? One idea is that the cryptodev module might not support the type of encryption being requested by the certificate, so openssl falls back to the pure SW encryption implementation. I know the Atmel chip in question supports the following: # openssl engine -t -c (cryptodev) cryptodev engine [RSA, DSA, DH, DES-CBC, DES-EDE3-CBC, AES-128-CBC, AES-192-CBC, AES-256-CBC, MD5, SHA1, SHA256, SHA384, SHA512] [ available ] (dynamic) Dynamic engine loading support [ unavailable ] # I was able to decode the contents of the certificate, and it says it is sha256WithRSAEncryption. My engine supports SHA256 and RSA, but does it support combining, like SHA256WithRSA? I'm not sure. I'll keep chasing that one. Thanks for any guidance on how to use the cryptodev in stunnel. Regards, Tamar

2 2

Max Performance of Stunnel
by Luis Monteiro 21 Jan '19

21 Jan '19

I'm testing Stunnel with Ixia traffic generator (Breakingpoint Virtual Edition) and I got a limited performance of 3.5Gbps full duplex even with 6 or 9 cpu in the esxi vm. The processors are fully dedicated as well memory all reserved with passthrough od network cards intel x540 10Gbps, 2 ports. The 2 vm are similar with one running stunnel client and the other as stunnel server. The page performance of Stunnel of 5.5Gbps but doesn't inform if it's half or full since in the operation the stunnel has to deal with 2 flow coming and going. If it was 5.5Gbps total makes sense since I'm using 2 x Scalable Gold 6140 and gave me 7Gbps encryption + decryption with AES-NI I think since we are not a feasible solution to check on the fly only the overall performance. I'm using the same cipher suit of performance information of Stunnel. Does anyone know if the performance numbers is considering the total performance or full duplex? Does someone have any tip to improve the performance? Thanks, Luis Monteiro

1 0

Transparente destination
by Luis Monteiro 17 Jan '19

17 Jan '19

Sirs. I tested the stunnel client connect to a stunnel server to proxy transparent a http traffic. I used a traffic generator from Ixia (BPS), a tap to get the traffic between stunnel´s using ntop license pf_ring (Kernel bypass) with tcpdump accessing their libs and export pcaps from source and destination from Ixia. Transparent source worked flawless easily using the information on man page. Transparent destination didn´t worked. The instructions in the stunnel documentation for each are: /sbin/iptables -I INPUT -i client_interface -p tcp --dport 443 (I´m using default port os https) -j ACCEPT ----- It is filter INPUT that is executed after routing decision after nat to allow packets with destination port 443 /sbin/iptables -t nat -I PREROUTING -p tcp --dport 80 (Destination port of http in client_interface \ -i client_interface -j DNAT --to-destination 9.0.0.2:443 (connect destination on server Stunnel) The second input in iptables is executed before the routing decision and that is the problem. Looking the hit count of in iptables the nat table PREROUTING always have a hit but the filter table filter INPUT doesn´t. I set a policy routing to delivey packets to 9.0.0.2:443 to local process and the filter table filter INPUT started to receive the hit in the counters as well but stunnel didn´t worked. If I change the connect destination address to local interface 9.0.0.1:443 I do not need the pocily routing since it´s local but Stunnel did not worked too. The stunnel configuration for the client is bellow: #setgid = root #setuid = root debug = 7 log = overwrite syslog = no output = /root/stunnel.log ;engine = ENGINE_ID ;engineCtrl = COMMAND[:PARAMETER] ;engineDefault = TASK_LIST [http] client = yes accept = 6.0.0.1:80 ;connect = 9.0.0.2:443 ciphers = AES128-GCM-SHA256 requireCert = no sslVersion = TLSv1.2 transparent = destination At the end I´d like to use both source and destination but I´m testing separated. Does anyone know if there is a bug related or if there is a version working fine? Even with a lot o resource I don´t have more what to do about and any help would be appreciated. Luis Monteiro

1 0

How can stunnel use openssl HW cryptodev encryption
by Tamar Pedersen 16 Jan '19

16 Jan '19

Hello, I am evaluating stunnel, to see if it is a viable solution for providing encryption in a system that contains an Atmel processor which includes a HW accelerated encryption block. I am just ramping up on stunnel, and figured I should capture what I have done so far. My questions will come towards the end of my email. My research indicates that stunnel incorporates openssl. I have been able to use openssl independently, to access the cryptodev HW encryption engine, in the Linux kernel module located in /lib/modules/4.14.79/extra/cryptodev.ko. When openssl is run without accessing the cryptodev engine (cryptodev module not loaded), I get the pure SW encryption implementation provided by default in openssl. When I run bench mark speed tests using openssl, using SW encryption, I see the following results: # time -v openssl speed -evp aes-128-cbc Doing aes-128-cbc for 3s on 16 size blocks: 1689887 aes-128-cbc's in 2.95s Doing aes-128-cbc for 3s on 64 size blocks: 568389 aes-128-cbc's in 2.95s Doing aes-128-cbc for 3s on 256 size blocks: 151550 aes-128-cbc's in 2.96s Doing aes-128-cbc for 3s on 1024 size blocks: 38599 aes-128-cbc's in 2.96s Doing aes-128-cbc for 3s on 8192 size blocks: 4845 aes-128-cbc's in 2.95s OpenSSL 1.0.2p-fips 14 Aug 2018 built on: reproducible build, date unspecified options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr) compiler: arm-laird-linux-gnueabi-gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -I/home/sii/wb50n_space2_legacy_6.0.0.x/wb/buildroot/output/wb50n_space2_legacy/host/arm-buildroot-linux-gnueabi/sysroot/usr/local/ssl/fips-2.0/include -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 9165.49k 12331.15k 13107.03k 13353.17k 13454.32k Command being timed: "openssl speed -evp aes-128-cbc" User time (seconds): 14.81 System time (seconds): 0.10 Percent of CPU this job got: 99% Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 15.06s Average shared text size (kbytes): 0 Average unshared data size (kbytes): 0 Average stack size (kbytes): 0 Average total size (kbytes): 0 Maximum resident set size (kbytes): 13376 Average resident set size (kbytes): 0 Major (requiring I/O) page faults: 0 Minor (reclaiming a frame) page faults: 145 Voluntary context switches: 0 Involuntary context switches: 721 Swaps: 0 File system inputs: 0 File system outputs: 0 Socket messages sent: 0 Socket messages received: 0 Signals delivered: 0 Page size (bytes): 4096 Exit status: 0 # When I load the cryptodev module, and take advantage of the accelerated hardware encryption the benchmark tests are significantly faster. Here is what those results look like. # modprobe cryptodev # time -v openssl speed -evp aes-128-cbc Doing aes-128-cbc for 3s on 16 size blocks: 44163 aes-128-cbc's in 0.12s Doing aes-128-cbc for 3s on 64 size blocks: 31345 aes-128-cbc's in 0.15s Doing aes-128-cbc for 3s on 256 size blocks: 18923 aes-128-cbc's in 0.11s Doing aes-128-cbc for 3s on 1024 size blocks: 13847 aes-128-cbc's in 0.13s Doing aes-128-cbc for 3s on 8192 size blocks: 8427 aes-128-cbc's in 0.06s OpenSSL 1.0.2p-fips 14 Aug 2018 built on: reproducible build, date unspecified options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr) compiler: arm-laird-linux-gnueabi-gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -I/home/sii/wb50n_space2_legacy_6.0.0.x/wb/buildroot/output/wb50n_space2_legacy/host/arm-buildroot-linux-gnueabi/sysroot/usr/local/ssl/fips-2.0/include -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 5888.40k 13373.87k 44038.98k 109071.75k 1150566.40k Command being timed: "openssl speed -evp aes-128-cbc" User time (seconds): 0.59 System time (seconds): 8.72 Percent of CPU this job got: 61% Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 15.11s Average shared text size (kbytes): 0 Average unshared data size (kbytes): 0 Average stack size (kbytes): 0 Average total size (kbytes): 0 Maximum resident set size (kbytes): 13792 Average resident set size (kbytes): 0 Major (requiring I/O) page faults: 0 Minor (reclaiming a frame) page faults: 144 Voluntary context switches: 41154 Involuntary context switches: 3321 Swaps: 0 File system inputs: 0 File system outputs: 0 Socket messages sent: 0 Socket messages received: 0 Signals delivered: 0 Page size (bytes): 4096 Exit status: 0 # As can be seen in the results (hi-lighted in red), the average speed to do aes-128-cbc encryption jumped from around 2.95 s to 0.10 s. Also of interest is the context switches are significantly higher when running hardware encryption, because of interrupts and overhead to use the hardware engine. I can also look at /proc/interrupts and see significant increases in atmel-aes interrupt counts when using the cryptodev HW acceleration encryption engine. This gives a good indication that the cryptodev module is in use, and is doing encryption. I would like to try to figure out how to allow stunnel to take advantage of the cryptodev HW acceleration encryption engine available in openssl. I have made some attempts, but so far, I have not been able to determine if stunnel is successfully using the cryptodev engine. Here is what I have done with stunnel. I already have a client and server successfully communicating with each other using stunnel. To verify this I used the "nc" utility to send characters back and forth between two different machines. The stunnel.conf file, on the server, is out of the box. I'm interested in encrypting on the client side. Here is my current client.conf file, in /etc/stunnel: # cat client.conf debug = 7 output = /tmp/stunnel-server.log pid = /tmp/stunnel.pid engine = cryptodev [test] verify = 1 client = yes accept = 127.0.0.1:2000 connect = 192.168.0.220:30000 CAfile = /etc/stunnel/certificate.crt engineNum = 1 # I am attempting to set up the cryptodev to be the configured engine for the client. I am able to start stunnel, using client.conf, as follows: # stunnel /etc/stunnel/client.conf # If I do a "ps" command to display processes, I can see that stunnel is running in the background. At this point, I can use "nc" to send data, as follows: # nc 127.0.0.1 2000 < /tmp/long_file.txt I am able to see the text from long_file.txt on the server, which is also running nc. The problem is that I don't see interrupts increasing in /proc/interrupts, which leaves me wondering if I have not configured stunnel correctly to use the cryptodev engine. If I try to remove the cryptodev module as this point, while stunnel is running, I receive a message that it is in use, as follows: # modprobe -r cryptodev modprobe: FATAL: Module cryptodev is in use. # If I kill the stunnel process, I am able to successfully remove the cryptodev module, which seems to suggest stunnel is the process using the cryptodev module. Also, once I have removed the cryptodev module, I can't restart stunnel. Instead, I get the following errors back: # stunnel /etc/stunnel/client.conf [.] stunnel 5.44 on arm-buildroot-linux-gnueabi platform [.] Compiled/running with OpenSSL 1.0.2p-fips 14 Aug 2018 [.] Threading:FORK Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/client.conf [.] UTF-8 byte order mark not detected [ ] Enabling support for engine "cryptodev" [!] error queue: 2606A074: error:2606A074:engine routines:ENGINE_by_id:no such engine [!] error queue: 260B6084: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found [!] error queue: 25070067: error:25070067:DSO support routines:DSO_load:could not load the shared library [!] ENGINE_by_id: 25066067: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library [!] /etc/stunnel/client.conf:5: "engine = cryptodev": Failed to open the engine # Again, this suggests stunnel is trying to use cryptodev. I just don't know how to prove I am taking advantage of the HW encryption acceleration engine. I never see interrupts updating in /proc/interrupts when using nc, while stunnel is running. So, here are my questions: 1.) Does it look like I have things set up correctly in client.conf, to use the cryptodev engine? 2.) If client.conf is correct, how can I prove that stunnel is using the cryptodev engine, since I don't see the expected interrupts? One idea is that the cryptodev module might not support the type of encryption being requested by the certificate, so openssl falls back to the pure SW encryption implementation. I know the Atmel chip in question supports the following: # openssl engine -t -c (cryptodev) cryptodev engine [RSA, DSA, DH, DES-CBC, DES-EDE3-CBC, AES-128-CBC, AES-192-CBC, AES-256-CBC, MD5, SHA1, SHA256, SHA384, SHA512] [ available ] (dynamic) Dynamic engine loading support [ unavailable ] # I was able to decode the contents of the certificate, and it says it is sha256WithRSAEncryption. My engine supports SHA256 and RSA, but does it support combining, like SHA256WithRSA? I'm not sure. I'll keep chasing that one. Thanks for any guidance on how to use the cryptodev in stunnel. Regards, Tamar

1 0

Stunnel in transparent mode
by Luis Monteiro 15 Jan '19

15 Jan '19

Hi fellows. I´m from Brazil and I´m trying to use Stunnel as a TLS proxy in a bed test environment. I´m using a traffic generator from Ixia (Breakingpoint). The bed test is: |-------------------| 6.0.0.1 |-------------------|9.0.0.1 9.0.0.2|--------------------|7.0.0.2 |--------------------| | Client 6.0.0.2 |>>>>>>>>>>>>| Stunnel Client|>>>>>>>>>>>>>>>>>>| Stunnel Server|>>>>>>>>>>>>>>>>>> | Server 7.0.0.2 | |-------------------| ens224 |-------------------|ens192 ens224|--------------------|ens192 |--------------------| I´m capturing the packets in all 3 points so I can see exactly what is happening. I tested without transparent proxy and worked fine. I test with transparent = source with the additional conf bellow in both Stunnel and worked fine as well. iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 0 >/proc/sys/net/ipv4/conf/lo/rp_filter iptables -t nat -A PREROUTING -i ens224 -p tcp --dport 80 -j DNAT --to-destination 6.0.0.1:8080 I tested transparent = destination with several modification from the config bellow without success. No conf delivery packets with 7.0.0.2:443 on the Stunnel Client ens192 via 9.0.0.1 to be accept on Stunnel server 9.0.0.2:443. /sbin/iptables -I INPUT -i ens192 -p tcp --dport 8080 -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport 443 \ -i ens192 -j DNAT --to-destination 9.0.0.1:443 Any help to show me what is wrong would be appreciated. Thanks in advanced, Luis Monteiro

1 0

Re: [stunnel-users] No more addresses to connect
by Eric Eberhard 14 Jan '19

14 Jan '19

Could be the versions of communication are different – from SSLv3 to TLS1.3 … Having said that, there is NO REASON to use stunnel and a VPN – both encrypt data. You only need to encrypt it once … so I’d change your software to behave differently via VPN or not. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Ben Habel Sent: Monday, January 07, 2019 7:32 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] No more addresses to connect I am trying to implement an openvpn + stunnel vpn with a Linux host server and a windows client, i have everything connecting when alone but when I connect openvpn over Stunnel i get and error that says: 2019.01.07 21:18:50 LOG5[0]: Service [openvpn] accepted connection from 127.0.0.1:49343 <http://127.0.0.1:49343> 2019.01.07 21:19:15 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2019.01.07 21:19:20 LOG5[2]: Service [openvpn] accepted connection from 127.0.0.1:49380 <http://127.0.0.1:49380> 2019.01.07 21:19:30 LOG3[2]: s_connect: s_poll_wait 74.215.118.189:1194 <http://74.215.118.189:1194> : TIMEOUTconnect exceeded 2019.01.07 21:19:30 LOG3[2]: No more addresses to connect And this error will loop until I disable the openvpn connection. Any help would be appreciated. Thanks

2 1

Re: [stunnel-users] older browsers, stunnel and privoxy
by Eric Eberhard 14 Jan '19

14 Jan '19

Sure it can. Inetd is simply a "server" and stunnel works in inetd mode or server mode. When not using inetd, stunnel does the server work. When using inetd then inetd does the server work. In both cases the actual "instance" of stunnel is the same. And inetd always works (or essentially Unix does not). It is milliseconds slower in inetd (and unless you are doing millions of connections nobody will notice) but way more reliable in my experience. Eric -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Peter Pentchev Sent: Friday, January 04, 2019 8:06 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy On Thu, Jan 03, 2019 at 02:45:30PM -0700, Eric Eberhard wrote: > Observation: you accept on port 80 ... the log says 4121 ... any > chance you have some sort of port forwarding/NAT/firewall/router issue? Just for the record (I already answered the question in another message), the log says that the client - the program that was talking to stunnel, presumably some kind of web browser - connected *to* stunnel *from* the (ephemeral) port 4121. > Second -- if you are on Unix why not just use inetd? Easy, reliable, > simple, always works (if inetd goes down you have no Unix). And you > have nothing to manage -- just logs to look at. The inetd and stunnel tools serve different purposes - inetd cannot, by itself, proxy between a plaintext and a TLS/SSL connection. > Happy New Year > > Eric Same! G'luck, Peter > -----Original Message----- > From: stunnel-users [mailto:[email protected]] On > Behalf Of kovacs janos > Sent: Saturday, December 29, 2018 7:37 PM > To: Javier <jamilist.stn(a)gmx.es> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] older browsers, stunnel and privoxy > > it still doesnt seem to work. i tried it with deviantart.com again. > configuration: > client = yes > accept = 127.0.0.1:80 > connect = 52.85.220.247:443 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = *.deviantart.com > > the name after checkHost is the "Common Name" displayed when viewing the site's certificate in a browser(lock icon, view certificate). i also saved the certificate in case i would need to try the "certificate pinning" method. the connect IP is what 'get-site-ip.com' > says the IP of the website is. > > these are the logs: > Service [fbsd-www] accepted connection from 127.0.0.1:4121 > s_connect: connected 52.85.220.247:443 Service [fbsd-www] connected > remote server from 192.168.0.3:4122 > SSL_connect: 14077410: error:14077410:SSL > routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure > Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket > > i know i pestered everyone long enough, but i still havent been able > to connect to anything. without any verification its the same > > On 12/21/18, Javier <jamilist.stn(a)gmx.es> wrote: > > On Fri, 21 Dec 2018 13:58:35 +0200 > > Peter Pentchev <roam(a)ringlet.net> wrote: > > > >> Hm, there's no reason why stunnel would not work like that for a > >> predetermined set of hosts with known addresses. > > > > Hi, > > > > I'm just trying to avoid encouraging him on keep with his first idea > > of browsing through Stunnel, with, or without privoxy. > > > > Of course one site, one connection would work, if we forget about > > secondary issues and..., nevermind... > > > > I give up :D > > > > Regards. > > > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users -- -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Could stunnel encryption be responsible for rendering the year as "4019" instead of "2019"?
by Al Birchall 09 Jan '19

09 Jan '19

Hi All, This may be stupid question, but I'll pose it anyway! We use stunnel to encrypt communications between library self-service kiosks and a cloud-based library system. Since switching to this cloud-based library system, the self-service kiosks have been rendering the year in item due dates as "4019" instead of "2019" printed and emailed patron library account statements. Items will actually have been checked out to the correct due date in library system, with the year displayed correctly, which library staff and patrons can see is so when they access the system directly. We have fixed the problem with a work-around by configuring the kiosk software to only display the last two digits of the year. So could it be the stunnel encryption algorithms that are causing "2019" to display as "4019"? Many thanks! Alex Alex Birchall Library Systems Manager The Sheppard Library Middlesex University London NW4 4BT UK Tel: +44 (0)20 8411 5235 Mob: 07765 237 570

2 1

Internal Errors
by _ Ånüßås _ 08 Jan '19

08 Jan '19

Hello, I would like to report two bugs. I recently upgraded to stunnel 5.50 on FreeBSD 12.0 and noticed that the stunnel server service now crashes periodically. When checking the logs after a crash, I see the following error: INTERNAL ERROR: Dead canary at /usr/src/crypto/openssl/ssl/statem/extensions_sr The stunnel server service only ever talks to a stunnel client service, also running version 5.50 on FreeBSD 12.0. The server configuration is as follows. Anything in {} brackets has been redacted. I have seen this issue on multiple servers configured the same way. <config> client = no setuid = stunnel setgid = stunnel pid = {/path/to/file} output = {/path/to/file} debug = 4 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [server] accept = {ip}:{port} connect = {ip}:{port} ciphers = PSK PSKsecrets = {/path/to/file} </config> Additionally, I have noticed another error in the logs. Although it appears far more frequently than the error above, it does not seem to cause the server service to crash. INTERNAL ERROR: Double free attempt: ptr=0x802119050 alloc=/usr/src/crypto/openssl/crypto/stack/stack.c:198 free#1=/usr/src/crypto/openssl/crypto/stack/stack.c:376 free#2=/usr/src/crypto/openssl/ssl/ssl_sess.c:814 Please let me know if additional information is needed to fix these bugs. Thank you.

1 0

No more addresses to connect
by Ben Habel 08 Jan '19

08 Jan '19

I am trying to implement an openvpn + stunnel vpn with a Linux host server and a windows client, i have everything connecting when alone but when I connect openvpn over Stunnel i get and error that says: 2019.01.07 21:18:50 LOG5[0]: Service [openvpn] accepted connection from 127.0.0.1:49343 2019.01.07 21:19:15 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2019.01.07 21:19:20 LOG5[2]: Service [openvpn] accepted connection from 127.0.0.1:49380 2019.01.07 21:19:30 LOG3[2]: s_connect: s_poll_wait xx.xxx.xxx.xxx:1194: TIMEOUTconnect exceeded 2019.01.07 21:19:30 LOG3[2]: No more addresses to connect And this error will loop until I disable the openvpn connection. Any help would be appreciated. Thanks

2 1

Need help to confi Stunnel
by Larry Alba 08 Jan '19

08 Jan '19

I need help to configure Stunnel to work again for my Secure Email being sent by my NoteSmith software thru Aplus.net mail server. I am: larryalba(a)yahoo.com Sent from Yahoo Mail on Android

1 0

ssl3_get_record:wrong version number
by Moellers 07 Jan '19

07 Jan '19

Hello, what I´m trying to accomplish is to build a secure RDP Connection between my Laptop and a Server, which are in the same Network but as RDP in itself is not secure enough I need the stunnel encryption. As of now I can establish a connection but as soon as I try to start an RDP Connection I get the following message: SSL_accept: 1408F10B: error:1408F10B:SSL routines:ssl3_get_record:wrong version number I tried serveral things for example: sslVersion = all options = NO_SSLv2 Sadly this doesn´t work either as I get a different error after that. This is pretty much the config for both Server and Client. ; R.B. Konfiguration HMailServer InvNr. 4522 RDP Zugriff mit STunnel-Verschlüsselung [RDP-SSL] CAfile = certs.pem accept = 9000 connect = 3389 ;verify = 4 verifyPeer = yes verifyChain = no sslVersion = all cert = stunnel.pem I exchanged the certificates between the Server and the Laptop but can´t establish a connection to get a RDP Session going. Hope someone can help me. Kind regards. F.Moellers Mit freundlichen Grüßen IT-Abteilung Jugendhilfe Köln e.V. Christianstr. 82 50825 Köln Tel. (0221) 54600-177 <mailto:[email protected]> it(a)jugendhilfe-koeln.de <http://www.jugendhilfe-koeln.de> www.jugendhilfe-koeln.de Geschäftsführerin: Almut Gross - Amtsgericht Köln VR 7348 Vorstandsvorsitzende: Dr. Agnes Klein

2 1

Re: [stunnel-users] older browsers, stunnel and privoxy
by Eric Eberhard 04 Jan '19

04 Jan '19

Observation: you accept on port 80 ... the log says 4121 ... any chance you have some sort of port forwarding/NAT/firewall/router issue? Second -- if you are on Unix why not just use inetd? Easy, reliable, simple, always works (if inetd goes down you have no Unix). And you have nothing to manage -- just logs to look at. Happy New Year Eric -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of kovacs janos Sent: Saturday, December 29, 2018 7:37 PM To: Javier <jamilist.stn(a)gmx.es> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy it still doesnt seem to work. i tried it with deviantart.com again. configuration: client = yes accept = 127.0.0.1:80 connect = 52.85.220.247:443 verifyChain = yes CAfile = ca-certs.pem checkHost = *.deviantart.com the name after checkHost is the "Common Name" displayed when viewing the site's certificate in a browser(lock icon, view certificate). i also saved the certificate in case i would need to try the "certificate pinning" method. the connect IP is what 'get-site-ip.com' says the IP of the website is. these are the logs: Service [fbsd-www] accepted connection from 127.0.0.1:4121 s_connect: connected 52.85.220.247:443 Service [fbsd-www] connected remote server from 192.168.0.3:4122 SSL_connect: 14077410: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket i know i pestered everyone long enough, but i still havent been able to connect to anything. without any verification its the same On 12/21/18, Javier <jamilist.stn(a)gmx.es> wrote: > On Fri, 21 Dec 2018 13:58:35 +0200 > Peter Pentchev <roam(a)ringlet.net> wrote: > >> Hm, there's no reason why stunnel would not work like that for a >> predetermined set of hosts with known addresses. > > Hi, > > I'm just trying to avoid encouraging him on keep with his first idea > of browsing through Stunnel, with, or without privoxy. > > Of course one site, one connection would work, if we forget about > secondary issues and..., nevermind... > > I give up :D > > Regards. > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

stunnel not working properly on Redhat linux (fresh install)
by Klaus Kloeser 04 Jan '19

04 Jan '19

Hi, I have set up Stunnel as SSL Wrapper for googlemail on a Redhat Enterprise Linux 7.2 installation. The stunnel.conf: output = /var/log/stunnel.log cert = /etc/pki/tls/certs/2019stunnel.pem client = yes sslVersion = TLSv1 ;fips=no [ssmtp] accept = 1925 connect=smtp.googlemail.com:587 lets me start stunned well. I have created the file 2019stunnel.pem following the Instructions on Redhat: make 2019stunnel.pem in the correct directory (certs) now I tried to telnet localhost 1925; I get a “connected”, but nothing more. telnet smtp.googlemail 587 runs very well, I get connected, so I assume it is not a firewall issue. I checked the options sslVersion = TLSv1 and sslVersion = all alternatively, which led to different errors in stunnel.log: Service [ssmtp] accepted connection from 127.0.0.1:49723 2019.01.04 14:45:01 LOG3[4500:140416608397056]: connect_blocking: connect 2a00:1450:400c:c0c::10:587: Network is unreachable (101) 2019.01.04 14:45:01 LOG5[4500:140416608397056]: connect_blocking: connected 74.125.140.16:587 2019.01.04 14:45:01 LOG5[4500:140416608397056]: Service [ssmtp] connected remote server from 192.168.178.57:44246 2019.01.04 14:45:01 LOG3[4500:140416608397056]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2019.01.04 14:45:01 LOG5[4500:140416608397056]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.01.04 14:54:24 LOG5[4500:140416608249920]: Terminated or Service [ssmtp] accepted connection from 192.168.178.57:57612 2019.01.04 14:54:36 LOG5[7437:139957105055488]: connect_blocking: connected 173.194.76.16:587 2019.01.04 14:54:36 LOG5[7437:139957105055488]: Service [ssmtp] connected remote server from 192.168.178.57:52192 2019.01.04 14:54:36 LOG3[7437:139957105055488]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2019.01.04 14:54:36 LOG5[7437:139957105055488]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Now Open SSL: Openssl output: openssl s_client -connect localhost:1925 CONNECTED(00000003) write:errno=104 no peer certificate available No client certificate CA names sent SSL handshake has read 0 bytes and written 289 bytes New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1546610402 Timeout : 300 (sec) Verify return code: 0 (ok) What do I miss here; what is running wrong ? Mit freundlichen Grüßen/ best regards Klaus Klöser

2 1

(no subject)
by Guido 30 Dec '18

30 Dec '18

Gesendet von Mail für Windows 10

1 0

(no subject)
by Guido 30 Dec '18

30 Dec '18

Gesendet von Mail für Windows 10

1 0

sslv3 alert bad certificate
by marko 26 Dec '18

26 Dec '18

Hello all, I'm using xmas for something useful - i.e. to configure a new server. After an install of stunnel 5.50 and generating the .pem and .key files with: openssl req -new -x509 -nodes -out /usr/local/etc/stunnel/nw_stunnel.pem -keyout /usr/local/etc/stunnel/nw_stunnel.key -days 1825 using this settings in the stunnel.conf: cert = /usr/local/etc/stunnel/nw_stunnel.pem key = /usr/local/etc/stunnel/nw_stunnel.key options = -NO_SSLv3 sslVersion = all I got LOG5[0]: Service [imaps] accepted connection from 192.168.1.3:64233 Dec LOG3[0]: SSL_accept: 14094412: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Just wondering: this is a self issued CA-Cert. Does the bad certificate error refer to the unsafe ssl3-standard or is it a placeholder for the certificate being self-generated as well? I'm currentlty on [.] stunnel 5.50 on amd64-portbld-freebsd12.0 platform [.] Compiled/running with OpenSSL 1.1.1a-freebsd 20 Nov 2018 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI This configuration works with the same install procedure: [.] stunnel 5.49 on i386-portbld-freebsd11.2 platform [.] Compiled/running with OpenSSL 1.0.2o-freebsd 27 Mar 2018 [.] Threading:PTHREAD Sockets:POLL,IPv4 TLS:ENGINE,OCSP,PSK,SNI Any insights into this matter are highly welcome. Cheers, and merry youknowwhat, Marko

1 0

win32 support
by Vida Bence 20 Dec '18

20 Dec '18

Hi Everyone! Is there any option to use s-tunnel on win32? I can see only win64 download links on the front page. Sorry if this is a blatant question, I am a totally new user. Thank you for the replies! All the best Bence

3 2

stunnel log size
by Joe Phillips 13 Dec '18

13 Dec '18

My stunnel log continues to grow. Will it truncate automatically? How do I restrict its size?

2 1

How to configure STunnel to use cert. from certificate store
by Chicoine, Jonathan 12 Dec '18

12 Dec '18

How in the word you specify the certificate to use from the windows certificate store (for example, on Windows 10 or Windows Server 2012)? The documentation obviously says to use the "cert" config option to specify a file (and the "key" config option for the private key) ... but to use a cert from the windows certificate store, shouldn't it be the certs "common name" field or thumbprint ... or something. Am new to this whole thing and have been googling for the answer for days. Any help would be greatly appreciated. -jonathan

2 1

stunnel 5.50 on Solaris 10
by Udo Erdelhoff 12 Dec '18

12 Dec '18

Hi, quick heads-up to anybody building/using stunnel 5.50 on Solaris 10 and wondering where the "Invalid configuration file name" errors are coming from: The problem is the call to realpath in line 334 of options.c, it uses NULL as second argument as a request to have the realpath function allocate the memory buffer for the sanitized string. This variant of realpath is not supported on Solaris 10, and leads to EINVAL (error code 22). Quickest fix is to run configure and then manually change src/config.h to have /* #undef HAVE_REALPATH */ instead of #define HAVE_REALPATH 1 -- "Treason is a charge invented by winners as an excuse for hanging the losers." - Benjamin Franklin, ca. 1776

1 0

Support for multiple root CAs
by Tom Bentley 07 Dec '18

07 Dec '18

Hi, I'm using stunnel to secure communication between nodes in a cluster, using a self-signed CA to sign the server certs and the `verify = 2` config parameter. This works great. What I want to be able to do is replace the CA key and certificate without breaking the cluster. How I thought this should work would be: 1. Configure the stunnels to trust both the old and new CA certificates while the nodes continued to use server certificates signed by the old CA key. 2. Switch to using using server certifcates signed by the new CA key. 3. Finally remove trust in the old CA certificate. I'd tried this by putting both CA certificates in a single file and using `CAfile` config parameter, and also by using the `CApath` config parameter with both root CA certificates in the configured directory, but I've not been able to get this to work while keeping `verify = 2`. It does work if I temporary use `verify = 0`, but obviously that means I've not got TLS authentication duration the duration of the process. Can anyone confirm whether stunnel supports this use case, and if so suggest where I might be going wrong? Many thanks, Tom

1 0

Re: [stunnel-users] older browsers, stunnel and privoxy (kovacs janos) - stunnel-users Digest, Vol 173, Issue 7
by Thomas GMX 07 Dec '18

07 Dec '18

Hi Janos, mail (SMTP / POP / IMAP) are other protocols as HTTPS. I was not able to connect via sTunnel to a server via HTTPS - and this was the reason to create and use my HTTPSProxy. HTTPSProxy is based on this code (local front- and rear proxy are connected directly without Proxomitron): https://prxbx.com/forums/showthread.php?tid=2172 https://prxbx.com/forums/showthread.php?tid=2191&pid=19252#pid19252 You can build your own release with python if you do not trust the versions offered by me or HeinoGanda on MSFN. Regards Thomas S. -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Friday, December 07, 2018 12:00 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 173, Issue 7 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: older browsers, stunnel and privoxy (kovacs janos) ---------------------------------------------------------------------- Message: 1 Date: Fri, 7 Dec 2018 01:30:21 +0100 From: kovacs janos <kovacsjanosfasz(a)gmail.com> To: Flo Rance <trourance(a)gmail.com> Cc: zizazit(a)protonmail.com, stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAOchpkp+5YDig_XpWPFVdP9zQ-L2UN10p8Wzsm9ggv2iuWpU8Q(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" now im really not sure, since the wikipedia page on stunnel also describes the program doing exactly what i need in the Example scenario section: https://en.wikipedia.org/wiki/Stunnel#Example_scenario "Network traffic from the client initially passes over SSL to the stunnel application, which transparently encrypts/decrypts traffic and forwards unsecured traffic to port 25 locally. The mail server sees a non-SSL mail client. " only difference is, i need it to forward "unsecured traffic" to my browser client, not a server. are you all sure its really not possible? On 12/5/18, kovacs janos <kovacsjanosfasz(a)gmail.com> wrote: > thank you for suggestions, but can someone tell me in what cases > stunnel can be used? > i can connect to http websites through it, but https doesnt work, even > if it would otherwise do. > i try to connect to 'https://via.hypothes.is/' like this, which i can > access in browser without any proxy: > [Tunnel_in] > client = yes > accept = 127.0.0.1:443 > connect = via.hypothes.is:443 > > i get these logs: > LOG5[1]: Service [Tunnel_in] accepted connection from 127.0.0.1:1788 > LOG5[1]: s_connect: connected 104.20.214.15:443 > LOG5[1]: Service [Tunnel_in] connected remote server from 192.168.0.3:1789 > LOG5[1]: Connection closed: 197 byte(s) sent to TLS, 332 byte(s) sent to > socket > > and the browser just shows a 'server not found' error. > with http sites its the same logs except the IP and bytes, and it > loads in the browser. > > On 12/5/18, Flo Rance <trourance(a)gmail.com> wrote: >> I would recommend to use squid which is able to do SSL bump. >> >> https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit >> >> Therefore, you'll be able to connect with TLS1.0 to squid and the proxy >> will establish a TLSv1.2 to the final destination. >> >> Regards, >> Flo >> >> On Tue, Dec 4, 2018 at 9:38 PM kovacs janos <kovacsjanosfasz(a)gmail.com> >> wrote: >> >>> well, what i meant is forwarding to the current address the browser >>> connects to, so basically browsing through stunnel. >>> >>> is it really that complicated to achieve that? if i configure stunnel >>> as a client, and make the browser send traffic to the accept address, >>> shouldnt stunnel encrypt the traffic with TLS and send forward to the >>> connect address? if thats true, shouldnt it also decrypt returning >>> traffic and send back to the browser? >>> when i configured stunnel as both client and server on the same >>> computer, it worked, but the browser still gave >>> 'ssl_error_no_cypher_overlap' errors. probably because the server side >>> decrypted it again before it reached the website's server? >>> >>> i dont necessarily need it to strip encryption, just use anything >>> below TLS 1.1. for example on 'https://via.hypothes.is/' i can visit >>> sites that would otherwise give cypher error, and they stay as https >>> >>> On 12/4/18, Zizhong Zhang <zizazit(a)protonmail.com> wrote: >>> > Hello, >>> > >>> >> im trying to make older browsers be able to display TLS 1.1 and TLS >>> >> 1.2 >>> >> sites. >>> >> i heard stunnel cant be configured to always forward to the current >>> >> site address dynamically, thats why i would use privoxy. >>> > >>> > If by "forward to the current site address dynamically" you meant >>> "forward >>> > to the current address of one specific domain" then stunnel can >>> > achieve >>> that >>> > by adding "delay = yes". >>> > >>> > However, if I understood correctly, you wanted to let stunnel strip >>> > or remove SSL for whatever sites you visit. Then no, I don't think you >>> can >>> > achieve that with privoxy and stunnel. If that's what you want, I >>> > would >>> > suggest you use nginx to remove SSL. The following example >>> > configuration >>> > will let nginx "upgrade" your HTTP request to HTTPS. >>> > >>> > events {} http { server { >>> > resolver 9.9.9.9; >>> > listen 80; >>> > location / { >>> > proxy_pass https://$host$request_uri; >>> > proxy_set_header Host $http_host; >>> > } >>> > }} >>> > >>> > You can then point any domain to the nginx server (for example, via >>> > the >>> > hosts file) and visit the site via HTTP. This will make HTTPS-oly >>> > servers >>> > happy. >>> > >>> > That won't strip third-party HTTPS:// URL resources like NewIPNow >>> > does, >>> but >>> > you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. >>> Also >>> > there are "security features" like "Content-Security-Policy" that >>> > prevent >>> > modern browsers from visiting your SSL-stripped sites, but I believe >>> > your >>> > out-dated browser will happily ignore those. >>> > >>> > --Zizhong >>> > >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >> > ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 173, Issue 7 *********************************************

1 0

Re: [stunnel-users] older browsers with modern HTTPS - stunnel-users Digest, Vol 173, Issue 4
by Thomas GMX 05 Dec '18

05 Dec '18

Hi Janos, you can use a local proxy to "translate" HTTPS TLS1.0 to TLS1.2 Look here: https://msfn.org/board/topic/176344-problems-accessing-certain-sites-https-… HTTPSProxy (and tools) manage the whole traffic locally (in- and outgoing HTTPS), but needs manually configuration as described in the help files. If you have questions please ask in this forum. Regards Thomas S. -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 05, 2018 10:12 AM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 173, Issue 4 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: older browsers, stunnel and privoxy (kovacs janos) 2. Re: older browsers, stunnel and privoxy (Zizhong Zhang) 3. Re: older browsers, stunnel and privoxy (kovacs janos) 4. Re: older browsers, stunnel and privoxy (Flo Rance) ---------------------------------------------------------------------- Message: 1 Date: Tue, 4 Dec 2018 19:27:15 +0100 From: kovacs janos <kovacsjanosfasz(a)gmail.com> To: Flo Rance <trourance(a)gmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAOchpkrOTmoAgCpv4fK19NhZeP-5-JgjX3EASFcfQbMVydR2yA(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" well yes, im pretty sure the same encryption is needed in requests and the returned page, otherwise it would probably get a no cypher overlap error. so i basically need stunnel to encrypt outgoing requests, and decrypt the returned things and only on the browser side of connection. there's a good reason why they are deprecated, but it would be better to add this functionality this way if possible, rather than change whole programs, especially when its the purpose of stunnel, according to the description On 12/4/18, Flo Rance <trourance(a)gmail.com> wrote: > This is not what I've understood from your first description. You would > like to bridge TLSv1 to TLSv1.1 or TLSv1.2 before sending requests to a web > proxy. > > This is why I don't think stunnel is intended for that. > > That said, if SSLV3 and TLSv1 have been deprecated, there's a good reason > and you should seriously think to update your tools. > > Regards, > Flo > > On Tue, Dec 4, 2018 at 3:18 PM kovacs janos <kovacsjanosfasz(a)gmail.com> > wrote: > >> well, it says this on the first line of the website: >> "Stunnel is a proxy designed to add TLS encryption functionality to >> existing clients and servers without any changes in the programs' >> code." >> >> i just want to add TLS functionality to client browsers which dont >> have it. i only need stunnel to decrypt TLS traffic going back to the >> browser. >> >> On 12/4/18, Flo Rance <trourance(a)gmail.com> wrote: >> > Sorry I didn't read it correctly. I don't think this is something >> > stunnel >> > can handle. >> > >> > Regards, >> > Flo >> > >> > On Mon, Dec 3, 2018 at 9:31 PM kovacs janos <kovacsjanosfasz(a)gmail.com> >> > wrote: >> > >> >> thank you for the reply, >> >> its the address and port where privoxy listens for requests. >> >> from the config file: >> >> "# 4.1. listen-address >> >> # ==================== >> >> # >> >> # Specifies: >> >> # >> >> # The IP address and TCP port on which Privoxy will listen for >> >> # client requests." >> >> and under it: >> >> >> >> listen-address 127.0.0.1:8118 >> >> >> >> On 12/3/18, Flo Rance <trourance(a)gmail.com> wrote: >> >> > Hi, >> >> > >> >> > It's not clear in your description what is running on 8118 local >> >> > port. >> >> > >> >> > Regards, >> >> > Flo >> >> > >> >> > On Mon, Dec 3, 2018 at 2:40 PM kovacs janos < >> kovacsjanosfasz(a)gmail.com> >> >> > wrote: >> >> > >> >> >> sorry to bother, >> >> >> im trying to make older browsers be able to display TLS 1.1 and TLS >> >> >> 1.2 >> >> >> sites. >> >> >> i heard stunnel cant be configured to always forward to the current >> >> >> site address dynamically, thats why i would use privoxy. >> >> >> the browser is configured to send to: >> >> >> 127.0.0.1 443 >> >> >> >> >> >> stunnel config has this at the end: >> >> >> [Tunnel_in] >> >> >> client = yes >> >> >> accept = 127.0.0.1:443 >> >> >> connect = 127.0.0.1:8118 >> >> >> verifyChain = yes >> >> >> CAfile = ca-certs.pem >> >> >> checkHost = localhost >> >> >> >> >> >> 127.0.0.1:8118 is the privoxy address. >> >> >> this is what stunnel writes: >> >> >> LOG5[main]: Configuration successful >> >> >> LOG5[0]: Service [Tunnel_in] accepted connection from >> >> >> 127.0.0.1:3261 >> >> >> LOG5[0]: s_connect: connected 127.0.0.1:8118 >> >> >> LOG5[0]: Service [Tunnel_in] connected remote server from >> >> 127.0.0.1:3262 >> >> >> >> >> >> and the browser infinitely loads, and never loads anything or >> >> >> leaves >> >> >> the >> >> >> page. >> >> >> if i remove the last 3 lines, its the same just with this line >> >> >> added: >> >> >> LOG4[main]: Service [Tunnel_in] needs authentication to prevent >> >> >> MITM >> >> >> attacks >> >> >> >> >> >> but it doesnt give an error or anything. >> >> >> >> >> >> with a configuration like: >> >> >> [Tunnel_out] >> >> >> client = no >> >> >> accept = 127.0.0.1:443 >> >> >> connect = 127.0.0.1:8118 >> >> >> cert = stunnel.pem >> >> >> >> >> >> this is what it gives: >> >> >> LOG5[3]: Service [Tunnel_out] accepted connection from >> 127.0.0.1:3294 >> >> >> LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL >> >> >> routines:SSL23_GET_CLIENT_HELLO:https proxy request >> >> >> LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to >> >> >> socket >> >> >> >> >> >> and browser gives a server not found error immediately. im not even >> >> >> sure if i should use client or server configuration in a case like >> >> >> this, but none of them works anyway. all i would need is for my >> >> >> browser to get the pages decrypted, or at least in less than >> >> >> TLS1.1. >> >> >> like how on newipnow.com i can access sites with any encryption, >> since >> >> >> they are sent to the browser without encryption. the browser just >> >> >> gives an "unencrypted tunnel" warning, which is how i found >> >> >> stunnel, >> >> >> and which is exactly what i need, just locally. >> >> >> _______________________________________________ >> >> >> stunnel-users mailing list >> >> >> stunnel-users(a)stunnel.org >> >> >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> >> >> >> > >> >> >> > >> > ------------------------------ Message: 2 Date: Tue, 04 Dec 2018 19:16:53 +0000 From: Zizhong Zhang <zizazit(a)protonmail.com> To: kovacs janos <kovacsjanosfasz(a)gmail.com> Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <mSx8WOjppmpWbvW5ETuPUXO048xh4PcPTtZPpOpzkrecueeSUtjQQx13FhtLO24lkyNXRPe_lNpMV8ko6RMEvowOx7mg6rl_1hwj43QAxWw=(a)protonmail.com> Content-Type: text/plain; charset=UTF-8 Hello, > im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. > i heard stunnel cant be configured to always forward to the current > site address dynamically, thats why i would use privoxy. If by "forward to the current site address dynamically" you meant "forward to the current address of one specific domain" then stunnel can achieve that by adding "delay = yes". However, if I understood correctly, you wanted to let stunnel strip or remove SSL for whatever sites you visit. Then no, I don't think you can achieve that with privoxy and stunnel. If that's what you want, I would suggest you use nginx to remove SSL. The following example configuration will let nginx "upgrade" your HTTP request to HTTPS. events {} http { server { resolver 9.9.9.9; listen 80; location / { proxy_pass https://$host$request_uri; proxy_set_header Host $http_host; } }} You can then point any domain to the nginx server (for example, via the hosts file) and visit the site via HTTP. This will make HTTPS-oly servers happy. That won't strip third-party HTTPS:// URL resources like NewIPNow does, but you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. Also there are "security features" like "Content-Security-Policy" that prevent modern browsers from visiting your SSL-stripped sites, but I believe your out-dated browser will happily ignore those. --Zizhong ------------------------------ Message: 3 Date: Tue, 4 Dec 2018 21:37:53 +0100 From: kovacs janos <kovacsjanosfasz(a)gmail.com> To: Zizhong Zhang <zizazit(a)protonmail.com> Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAOchpkq7vG8vHBCrbVn6d4Eh7M2rd6jEob_huhoG=ZefJnpHLw(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" well, what i meant is forwarding to the current address the browser connects to, so basically browsing through stunnel. is it really that complicated to achieve that? if i configure stunnel as a client, and make the browser send traffic to the accept address, shouldnt stunnel encrypt the traffic with TLS and send forward to the connect address? if thats true, shouldnt it also decrypt returning traffic and send back to the browser? when i configured stunnel as both client and server on the same computer, it worked, but the browser still gave 'ssl_error_no_cypher_overlap' errors. probably because the server side decrypted it again before it reached the website's server? i dont necessarily need it to strip encryption, just use anything below TLS 1.1. for example on 'https://via.hypothes.is/' i can visit sites that would otherwise give cypher error, and they stay as https On 12/4/18, Zizhong Zhang <zizazit(a)protonmail.com> wrote: > Hello, > >> im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 >> sites. >> i heard stunnel cant be configured to always forward to the current >> site address dynamically, thats why i would use privoxy. > > If by "forward to the current site address dynamically" you meant "forward > to the current address of one specific domain" then stunnel can achieve that > by adding "delay = yes". > > However, if I understood correctly, you wanted to let stunnel strip > or remove SSL for whatever sites you visit. Then no, I don't think you can > achieve that with privoxy and stunnel. If that's what you want, I would > suggest you use nginx to remove SSL. The following example configuration > will let nginx "upgrade" your HTTP request to HTTPS. > > events {} http { server { > resolver 9.9.9.9; > listen 80; > location / { > proxy_pass https://$host$request_uri; > proxy_set_header Host $http_host; > } > }} > > You can then point any domain to the nginx server (for example, via the > hosts file) and visit the site via HTTP. This will make HTTPS-oly servers > happy. > > That won't strip third-party HTTPS:// URL resources like NewIPNow does, but > you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. Also > there are "security features" like "Content-Security-Policy" that prevent > modern browsers from visiting your SSL-stripped sites, but I believe your > out-dated browser will happily ignore those. > > --Zizhong > ------------------------------ Message: 4 Date: Wed, 5 Dec 2018 10:12:06 +0100 From: Flo Rance <trourance(a)gmail.com> To: kovacsjanosfasz(a)gmail.com Cc: zizazit(a)protonmail.com, stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAHogYcV+ig2-2u8CWYbbqH_AnkiZNzqM9etx=jHj3N+nug-FpQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I would recommend to use squid which is able to do SSL bump. https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit Therefore, you'll be able to connect with TLS1.0 to squid and the proxy will establish a TLSv1.2 to the final destination. Regards, Flo On Tue, Dec 4, 2018 at 9:38 PM kovacs janos <kovacsjanosfasz(a)gmail.com> wrote: > well, what i meant is forwarding to the current address the browser > connects to, so basically browsing through stunnel. > > is it really that complicated to achieve that? if i configure stunnel > as a client, and make the browser send traffic to the accept address, > shouldnt stunnel encrypt the traffic with TLS and send forward to the > connect address? if thats true, shouldnt it also decrypt returning > traffic and send back to the browser? > when i configured stunnel as both client and server on the same > computer, it worked, but the browser still gave > 'ssl_error_no_cypher_overlap' errors. probably because the server side > decrypted it again before it reached the website's server? > > i dont necessarily need it to strip encryption, just use anything > below TLS 1.1. for example on 'https://via.hypothes.is/' i can visit > sites that would otherwise give cypher error, and they stay as https > > On 12/4/18, Zizhong Zhang <zizazit(a)protonmail.com> wrote: > > Hello, > > > >> im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 > >> sites. > >> i heard stunnel cant be configured to always forward to the current > >> site address dynamically, thats why i would use privoxy. > > > > If by "forward to the current site address dynamically" you meant > "forward > > to the current address of one specific domain" then stunnel can achieve > that > > by adding "delay = yes". > > > > However, if I understood correctly, you wanted to let stunnel strip > > or remove SSL for whatever sites you visit. Then no, I don't think you > can > > achieve that with privoxy and stunnel. If that's what you want, I would > > suggest you use nginx to remove SSL. The following example configuration > > will let nginx "upgrade" your HTTP request to HTTPS. > > > > events {} http { server { > > resolver 9.9.9.9; > > listen 80; > > location / { > > proxy_pass https://$host$request_uri; > > proxy_set_header Host $http_host; > > } > > }} > > > > You can then point any domain to the nginx server (for example, via the > > hosts file) and visit the site via HTTP. This will make HTTPS-oly servers > > happy. > > > > That won't strip third-party HTTPS:// URL resources like NewIPNow does, > but > > you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. > Also > > there are "security features" like "Content-Security-Policy" that prevent > > modern browsers from visiting your SSL-stripped sites, but I believe your > > out-dated browser will happily ignore those. > > > > --Zizhong > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

Web mail browsing over stunnel
by Osvald Brko 05 Dec '18

05 Dec '18

Hello, I would like to use stunnel for mail reading from www.hotmail.com . But there are plenty of redirections, to outlook.live.com, login.live.com, outlook.office365.com etc., moreover IP adresses of these servers are changing... Is there any configuration which allowed to use such web server over stunnel? Regards, Olda

1 0

stunnel 5.50 released
by Michal Trojnara 04 Dec '18

04 Dec '18

Dear Users, I have released version 5.50 of stunnel. Version 5.50, 2018.12.02, urgency: MEDIUM * New features - 32-bit Windows builds replaced with 64-bit builds. - OpenSSL DLLs updated to version 1.1.1. - Check whether "output" is not a relative file name. - Major code cleanup in the configuration file parser. - Added sslVersion, sslVersionMin and sslVersionMax for OpenSSL 1.1.0 and later. * Bugfixes - Fixed PSK session resumption with TLS 1.3. - Fixed a memory leak in WIN32 logging subsystem. - Allow for zero value (ignored) TLS options. - Partially refactored configuration file parsing and logging subsystems for clearer code and minor bugfixes. * Caveats - We removed FIPS support from our standard builds. FIPS will still be available with bespoke builds. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 951d92502908b852a297bd9308568f7c36598670b84286d3e05d4a3a550c0149 stunnel-5.50.tar.gz e855d58a05dca0943a5da8d030b5904630ee9cff47c3d747d326e151724f3bc8 stunnel-5.50-win64-installer.exe ad6c952cd26951c5a986efe8034b71af07c951e11d06e0b0ce73ef82594b1041 stunnel-5.50-android.zip Best regards, Mike

3 2

PSK mode does not work correctly with TLSv1.3
by Zizhong Zhang 21 Nov '18

21 Nov '18

Hello, In TLSv1.3, session resumption has been reworked to be the same way as PSK. The client attempts resumption by appending a ticket as PSK identity to the head of the list. With OpenSSL 1.1.1, the server side should use the new SSL_CTX_set_psk_find_session_callback() callback instead of SSL_CTX_set_psk_server_callback() which is used by stunnel now. Because stunnel only verifies against the first PSK identity, stunnel will fail for every other connections it makes. This impacts the default configuration when running with OpenSSL 1.1.1 because TLSv1.3 is enabled by default. It may be confusing because only half of the connections will fail as the client will try to resume the last successful session for every second connections. I purpose that stunnel should switch to SSL_CTX_set_psk_find_session_callback() for OpenSSL 1.1.1, and that it preferably should default to a maximum version of TLSv1.2 because it might be compiled with OpenSSL 1.0.x but runs with OpenSSL 1.1.1 which will enable TLSv1.3 automatically. With regards, --Zizhong

1 0

Installing stunnel as a Windows service with another service name?
by Al Birchall 16 Nov '18

16 Nov '18

Hi, Is it possible to install stunnel as a Windows service with another name? I want to have multiple instances of stunnel running on the same Windows 2008 server, if possible. Many thanks. Al

2 1

Server is down
by Paul Muller 12 Nov '18

12 Nov '18

I've installed Stunnel before with no issues. But now I'm getting the following: ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [SMTP Outgoing] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [SMTP Outgoing] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [SMTP Outgoing] [ ] Listening file descriptor created (FD=1388) [ ] Setting accept socket options (FD=1388) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [SMTP Outgoing] to 0.0.0.0:25: Address already in use (WSAEADDRINUSE) (10048) [!] Binding service [SMTP Outgoing] failed [ ] Deallocating section defaults [ ] Unbinding service [SMTP Outgoing] [ ] Service [SMTP Outgoing] closed [ ] Deallocating section [SMTP Outgoing] [!] Server is down Please let me know what I'm doing wrong here. Thank you, [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

1 0

Issue with Office365 certificates
by milanimarco82＠libero.it 09 Nov '18

09 Nov '18

Hello, I'm encountering an issue while using sTunnel with an Office365 account. sTunnel worked properly for a few months, while it gived an error with certificates since yesterday, whilst didn't change anything in the configuration. This is our configuration: [pop3s] client = yes accept = 127.0.0.1:2001 connect = outlook.office365.com:995 CAfile = C:\Program Files (x86)\stunnel\config\ca-certs.pem checkHost = outlook.office365.com verifyChain = yes OCSPaia = yes This is what we get in the log: 2018.11.09 11:34:09 LOG7[main]: Found 1 ready file descriptor(s) 2018.11.09 11:34:09 LOG7[main]: FD=432 ifds=r-x ofds=--- 2018.11.09 11:34:09 LOG7[main]: Service [pop3s] accepted (FD=672) from 127.0.0.1:49619 2018.11.09 11:34:09 LOG7[main]: Creating a new thread 2018.11.09 11:34:09 LOG7[main]: New thread created 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] started 2018.11.09 11:34:09 LOG7[30]: Setting local socket options (FD=672) 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on local socket 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] accepted connection from 127.0.0.1:49619 2018.11.09 11:34:09 LOG6[30]: failover: priority, starting at entry #0 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 40.101.9.178:995 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 40.101.9.178:995: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 40.101.9.178:995 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] connected remote server from 172.31.20.23:49620 2018.11.09 11:34:09 LOG7[30]: Setting remote socket options (FD=668) 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on remote socket 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) initialized 2018.11.09 11:34:09 LOG6[30]: SNI: sending servername: outlook.office365.com 2018.11.09 11:34:09 LOG6[30]: Peer certificate required 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): before/connect initialization 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv2/v3 write client hello A 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv3 read server hello A 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=2: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG7[30]: OCSP: Ignoring root certificate 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=2: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocsp.digicert.com" 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocsp.digicert.com:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received 2018.11.09 11:34:09 LOG6[30]: OCSP: Status: good 2018.11.09 11:34:09 LOG6[30]: OCSP: This update: Nov 9 00:00:00 2018 GMT 2018.11.09 11:34:09 LOG6[30]: OCSP: Next update: Nov 16 00:00:00 2018 GMT 2018.11.09 11:34:09 LOG5[30]: OCSP: Certificate accepted 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG6[30]: CERT: Host name "outlook.office365.com" matched with "*.office365.com" 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocspx.digicert.com" 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocspx.digicert.com:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received 2018.11.09 11:34:09 LOG3[30]: OCSP: Responder error: 6: unauthorized 2018.11.09 11:34:09 LOG4[30]: Rejected by OCSP at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com 2018.11.09 11:34:09 LOG7[30]: TLS alert (write): fatal: handshake failure 2018.11.09 11:34:09 LOG3[30]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed 2018.11.09 11:34:09 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.11.09 11:34:09 LOG7[30]: Deallocating application specific data for session connect address 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) closed 2018.11.09 11:34:09 LOG7[30]: Local descriptor (FD=672) closed 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] finished (0 left) Can you please help me? Thanks in advance!

2 3

Please need urgent help
by Alix Janeth Jerez 09 Nov '18

09 Nov '18

Hi, I have installed the last stunnel version 5.4.9, i get this fatal error [cid:60207984-5796-4d47-986e-21551ff82966] The stunnel.conf is configured so: debug = 7 output = stunnel.log # GLOBAL OPTIONS client = yes taskbar=yes [SMTP Outgoing] protocol = smtp accept = 172.31.41.84:117 connect = smtp.outlook.com:587 checkHost = smtp.outlook.com verifyChain = yes CAfile = ca-certs.pem OCSPaia = yes cert = stunnel.pem I tried to enable this option ; Enable support for the insecure SSLv3 protocol options = -NO_SSLv3 But stunnel does't work. Thank you in advance for your help. Best regards,

2 3

Re: [stunnel-users] Multiple Instance of sTunnel on same machine
by Shah, Marmik 31 Oct '18

31 Oct '18

I would be connecting to different Vendors using sTunnel from my machine. I want to run multiple instance of sTunnel as hosted service on Window Server. How can I achieve that ? I can do that through Terminal but I want to install stunnel service per vendor (in Service Control Manager) so that I can manage them independently and stop or start based on Vendor's requirement. I can do this through Command Prompt. Thanks Marmik ............................................................................ For further important information about AllianceBernstein please click here http://www.alliancebernstein.com/disclaimer/email/disclaimer.html

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 171, Issue 16
by Johann Hörmann 25 Oct '18

25 Oct '18

Am 25.10.18 um 12:00 schrieb stunnel-users-request(a)stunnel.org: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian > jessie (Johann Hörmann) > 2. Re: stunnel 5.06 not yet linked against OpenSSL 1.0.1t on > debian jessie (Eric Eberhard) > 3. stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian > jessie (Jakob Hirsch) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 24 Oct 2018 17:29:18 +0200 > From: Johann Hörmann <support(a)hans-hoermann.de> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL > 1.0.1t on debian jessie > Message-ID: <f9fb3d42-c0f2-dffd-e0b1-249d8e068081(a)hans-hoermann.de> > Content-Type: text/plain; charset=utf-8 > > Hi, > > that's the log on a debian jessie, starting stunnel: > > 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform > 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 > 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 > 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel > > All debian packages are upgraded: > $ sudo apt-get update > ... > $ sudo apt-get upgrade > 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. > $ > > $ dpkg -l|egrep 'openssl|stunnel' > ... > ii openssl 1.0.1t-1+deb8u9 > ... > ii stunnel4 3:5.06-2+deb8u1 > $ > > Guess the log tells the current stunnel-package is not linked against > openssl 1.0.1t lib yet. > > No pinning is active: > $ ls -l /etc/apt/preferences > -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences > $ > > Is that - stunnel not being linked against the current openssl-lib - a > serious problem? > Will there soon be a stunnel-package being linked against openssl 1.0.1t? > > > Thanks in Advance > -- > Hans > > > ------------------------------ > > Message: 2 > Date: Wed, 24 Oct 2018 15:02:08 -0700 > From: "Eric Eberhard" <flash(a)vicsmba.com> > To: 'Johann Hörmann' <support(a)hans-hoermann.de>, > <stunnel-users(a)stunnel.org> > Subject: Re: [stunnel-users] stunnel 5.06 not yet linked against > OpenSSL 1.0.1t on debian jessie > Message-ID: <03bb01d46be5$40d264c0$c2772e40$(a)vicsmba.com> > Content-Type: text/plain; charset="utf-8" > > Static linking is much easier, especially when put in a non-standard place, such as /usr/local/customer-name/lib -- this means if somebody does an update of say openssl alone you won't have this problem. You can also do it non-static as long as it is in a non-standard place and be pretty safe. > > My versions have stunnel 5.44 and openssl 1.0.2 -- works fine. It is static and keeps on ticking. > > Eric > > -----Original Message----- > From: stunnel-users [mailto:[email protected]] On Behalf Of Johann Hörmann > Sent: Wednesday, October 24, 2018 8:29 AM > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie > > Hi, > > that's the log on a debian jessie, starting stunnel: > > 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform > 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 > 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 > 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel > > All debian packages are upgraded: > $ sudo apt-get update > ... > $ sudo apt-get upgrade > 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. > $ > > $ dpkg -l|egrep 'openssl|stunnel' > ... > ii openssl 1.0.1t-1+deb8u9 > ... > ii stunnel4 3:5.06-2+deb8u1 > $ > > Guess the log tells the current stunnel-package is not linked against openssl 1.0.1t lib yet. > > No pinning is active: > $ ls -l /etc/apt/preferences > -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences $ > > Is that - stunnel not being linked against the current openssl-lib - a serious problem? > Will there soon be a stunnel-package being linked against openssl 1.0.1t? > > > Thanks in Advance > -- > Hans > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > > ------------------------------ > > Message: 3 > Date: Thu, 25 Oct 2018 10:58:48 +0200 > From: Jakob Hirsch <jh(a)plonk.de> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL > 1.0.1t on debian jessie > Message-ID: <a518f51f-180d-b1a3-96e1-c3f976dd1e42(a)Message-ID.plonk.de> > Content-Type: text/plain; charset=utf-8 > > Hi, > > On 2018-10-24 17:29, Johann Hörmann wrote: >> Is that - stunnel not being linked against the current openssl-lib - a >> serious problem? > > It is usually not necessary to rebuild all packages using a specific lib > just because it got updated. > >> Will there soon be a stunnel-package being linked against openssl 1.0.1t? > > The debian people are doing that, so that would be something to ask > them, specifically the package maintainers (see > https://packages.debian.org/jessie/stunnel4) But since jessie support > ended last June and LTS won't rebuild , I would not hold my breath. > > Why do you care about this in the first place? You are using a stunnel > version that is 4 years old and got last patched more than 3 years ago. > If it's of any importance to you, you should really upgrade to stretch > (optionally with bpo) or at least use jessie-backports. > > > Regards > Jakob > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > ------------------------------ > > End of stunnel-users Digest, Vol 171, Issue 16 > ********************************************** > Thanks a lot for your valuable advices, Eric and Jakob! Being just a dumb user, i supposed the distribution should stay 'in harmony': Ok now i know for oldstable this can be solved by backports or compiling stunnel with a static openssl-lib. Upgrading to stretch is not yet a choice because i am using stunnel with 'verify=3' which results in checking the self-signed client-certs at the server: Can't tell why but my cacert file was generated with a CAFile value of FALSE, which worked until jessie but at stretch the request results in a reject by the openssl-lib because of the FALSE-value. So first i have to renew and deploy all my customers certs - about 80 - with a stretch-conform cacert performing with CAFile=true. Hans -- https://hoermann-solutions.com

1 0

stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie
by Johann Hörmann 25 Oct '18

25 Oct '18

Hi, that's the log on a debian jessie, starting stunnel: 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel All debian packages are upgraded: $ sudo apt-get update ... $ sudo apt-get upgrade 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. $ $ dpkg -l|egrep 'openssl|stunnel' ... ii openssl 1.0.1t-1+deb8u9 ... ii stunnel4 3:5.06-2+deb8u1 $ Guess the log tells the current stunnel-package is not linked against openssl 1.0.1t lib yet. No pinning is active: $ ls -l /etc/apt/preferences -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences $ Is that - stunnel not being linked against the current openssl-lib - a serious problem? Will there soon be a stunnel-package being linked against openssl 1.0.1t? Thanks in Advance -- Hans

2 1

Re: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie
by Eric Eberhard 24 Oct '18

24 Oct '18

Static linking is much easier, especially when put in a non-standard place, such as /usr/local/customer-name/lib -- this means if somebody does an update of say openssl alone you won't have this problem. You can also do it non-static as long as it is in a non-standard place and be pretty safe. My versions have stunnel 5.44 and openssl 1.0.2 -- works fine. It is static and keeps on ticking. Eric -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Johann Hörmann Sent: Wednesday, October 24, 2018 8:29 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie Hi, that's the log on a debian jessie, starting stunnel: 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel All debian packages are upgraded: $ sudo apt-get update ... $ sudo apt-get upgrade 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. $ $ dpkg -l|egrep 'openssl|stunnel' ... ii openssl 1.0.1t-1+deb8u9 ... ii stunnel4 3:5.06-2+deb8u1 $ Guess the log tells the current stunnel-package is not linked against openssl 1.0.1t lib yet. No pinning is active: $ ls -l /etc/apt/preferences -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences $ Is that - stunnel not being linked against the current openssl-lib - a serious problem? Will there soon be a stunnel-package being linked against openssl 1.0.1t? Thanks in Advance -- Hans _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] stunnel logging of OpenSSL error source file and line number?
by Eric Eberhard 19 Oct '18

19 Oct '18

Good idea and about as much fun as watching grass grow :) E From: stunnel-users [mailto:[email protected]] On Behalf Of Tom Hood Sent: Friday, October 19, 2018 7:09 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel logging of OpenSSL error source file and line number? Hi, Was it by design that stunnel's logging of OpenSSL errors does not include the OpenSSL source file and line number? If not, please consider switching from ERR_get_error to ERR_get_error_line <https://www.openssl.org/docs/man1.0.2/crypto/ERR_get_error_line.html> . Thanks, -- Tom

1 0

stunnel logging of OpenSSL error source file and line number?
by Tom Hood 19 Oct '18

19 Oct '18

Hi, Was it by design that stunnel's logging of OpenSSL errors does not include the OpenSSL source file and line number? If not, please consider switching from ERR_get_error to ERR_get_error_line <https://www.openssl.org/docs/man1.0.2/crypto/ERR_get_error_line.html>. Thanks, -- Tom

1 0

Re: [stunnel-users] CPU 100%
by Eric Eberhard 19 Oct '18

19 Oct '18

Somewhere there is a physical network card - checking the firewall/router for traffic is a good idea no matter what it is running on. VMs have lots of clever software to isolate each instance (including resources) and you may be being streamed at a rate the VM as whole can handle, and your isolated VM cannot. And setting the debug level up is still a good idea. And forcing core files and using a debugger is still a good idea. And trying inetd mode is still a good idea. You need to narrow your focus and each of these suggestions will tell you something that narrows the problem. Eric From: Murrey, Brian J. [mailto:[email protected]] Sent: Thursday, October 18, 2018 7:14 AM To: Eric Eberhard <flash(a)vicsmba.com>; stunnel-users(a)stunnel.org Subject: RE: [stunnel-users] CPU 100% Thank you Eric, this server is a VM running under vSphere 6.5 and has no physical network card. From: Eric Eberhard <flash(a)vicsmba.com <mailto:[email protected]> > Sent: Wednesday, October 17, 2018 7:56 PM To: Murrey, Brian J. <Brian.Murrey(a)trimedx.com <mailto:[email protected]> >; stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: RE: [stunnel-users] CPU 100% Long ago I had a server with a bad network card. Every once in a while it would spew uncontrollable bytes onto the network. If you open a stunnel connection and it does that this could very well be the problem. If it cheap, try changing the network card. If not, you should be able to look in your firewall/router and it will tell you who is sending what bytes to whomever. See if that machine is indeed streaming the bytes in massive quantities. If not, I would suspect your stunnel is getting stuck in it's own loop. There are a million reasons this can happen (well a few less than a million) - such as maybe a bad library in the FreeBSD or a bad choice in the Makefile - such as doing threads or something in a way your O/S does not like (I use threads=fork or whatever it is, instead of actual threading). You might tinker with some of the options that make the stunnel build and try different ones. Especially if stunnel was compiled on a different version of the O/S - could be differences in bytes in things and who knows what. That is all I can suggest beyond setting the debug level to 7 (I think is highest) and then watching the log file. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 10:57 AM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment. _____ CAUTION: This email originated from outside of the organization. Do not open links or attachments you were not expecting, even from known senders, and use caution when responding. Please contact the Service Desk if in doubt regarding the legitimacy of this email. _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 1

Re: [stunnel-users] Windows stunnel Command Line Configuration File Location
by Eric Eberhard 18 Oct '18

18 Oct '18

If it reading from .\config . then I would try putting the path in quotes. If it fails to read the one in \temp but is not reading anything, I would check permissions on the directory and file (easy test is set "everyone" to full permissions, at least as a test). You have to do the entire directory tree (in the case of c:\temp it is just that directory) and the file. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Steve Jones Sent: Wednesday, October 17, 2018 1:59 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Windows stunnel Command Line Configuration File Location I would like to be able to run stunnel interactively on Windows, but specify a different location for the configuration file. When I looked at the help output, it stated that you could pass a parameter for "[<filename>]". I assumed I could put a path on there, but it does not appear to work. For example, I tried running "stunnel.exe C:\temp\stunnel.conf", but it would not find the configuration file even though it is there. Is there a way to do what I am trying to do or does the config file have to be in a folder "..\config"? Thanks.

2 1

Re: [stunnel-users] CPU 100%
by Eric Eberhard 18 Oct '18

18 Oct '18

One other suggestion - run it in inetd mode. This is MUCH simpler, stunnel will not have to do as much forking and managing and so forth. The O/S will do all that. I know - it is a little less efficient. However, I have found on modern Centos and AIX computers that even with very high volumes it makes no measurable difference. If nothing else, it is another debugging technique. Especially if the runaway process is the parent process . because that does not exist under inetd mode. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 11:09 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] CPU 100% We have one service, connecting stunnel to another application. Relevant configuration: [vpn] client = no accept = 172.17.102.122:443 exec = /usr/sbin/ppp execargs = ppp -direct vpn pty = yes Brian From: Vincent Deschenes <vdeschenes(a)stelvio.com <mailto:[email protected]> > Sent: Wednesday, October 17, 2018 2:05 PM To: Murrey, Brian J. <Brian.Murrey(a)trimedx.com <mailto:[email protected]> >; stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: RE: [stunnel-users] CPU 100% Just a silly idea, but is it possible you have a re-entrant configuration for one service, one that connect back to itself creating a loop? Vincent Deschenes Ing. PMP From: stunnel-users <stunnel-users-bounces(a)stunnel.org <mailto:[email protected]> > On Behalf Of Murrey, Brian J. Sent: Wednesday, 17 October 2018 1:57 PM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment. _____ CAUTION: This email originated from outside of the organization. Do not open links or attachments you were not expecting, even from known senders, and use caution when responding. Please contact the Service Desk if in doubt regarding the legitimacy of this email. _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

1 0

Re: [stunnel-users] CPU 100%
by Eric Eberhard 18 Oct '18

18 Oct '18

Also a good idea. That would be found in the log ASAP certainly with a high debug level. Might fill the filesystem for the log if that is so :) Does FreeBSD support kill -9 (or is it 11?) that forces a core dump? If so, when you kill it and leave a core file, you can use the debugger on that core file and see what it is doing. Look at the stack trace. You may need several to catch the problem. If it is simply in a read() type state then the other machine is streaming you. If it is loop around you should see it in a different place in each core file (the odds of hitting the same line of code when kill it every time are not good). I do not know what debuggers you have (gdb?) but that is another trick. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Vincent Deschenes Sent: Wednesday, October 17, 2018 11:05 AM To: Murrey, Brian J. <Brian.Murrey(a)trimedx.com>; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] CPU 100% Just a silly idea, but is it possible you have a re-entrant configuration for one service, one that connect back to itself creating a loop? Vincent Deschenes Ing. PMP From: stunnel-users <stunnel-users-bounces(a)stunnel.org <mailto:[email protected]> > On Behalf Of Murrey, Brian J. Sent: Wednesday, 17 October 2018 1:57 PM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

1 0

Windows stunnel Command Line Configuration File Location
by Steve Jones 17 Oct '18

17 Oct '18

I would like to be able to run stunnel interactively on Windows, but specify a different location for the configuration file. When I looked at the help output, it stated that you could pass a parameter for "[<filename>]". I assumed I could put a path on there, but it does not appear to work. For example, I tried running "stunnel.exe C:\temp\stunnel.conf", but it would not find the configuration file even though it is there. Is there a way to do what I am trying to do or does the config file have to be in a folder "..\config"? Thanks.

1 0

CPU 100%
by Murrey, Brian J. 17 Oct '18

17 Oct '18

We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure ________________________________ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 2

stunnel 5.49 on Win32 (invalid configuration file)
by Hardik Mehta 10 Oct '18

10 Oct '18

Hi, can you please help, I was able to send a mail using blat, stunnel and gmail and then i tried adding Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name: Stunnel Type: REG_SZ Value: "c:\Program Files (x86)\stunnel\bin\stunnel.exe" to run on windows startup, but as soon as i restarted the system gave me following message stunnel 5.49 on Win32 (invalid configuration file) Stunnel server is down due to an error. you need to exit and correct the problem. click of to see the error lg window this is the log that i'm getting on stunnel [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [SMTP Gmail] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [SMTP Gmail] needs authentication to prevent MITM attacks [ ] Initializing service [POP3 Gmail] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [POP3 Gmail] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [SMTP Gmail] [ ] Listening file descriptor created (FD=1800) [ ] Setting accept socket options (FD=1800) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [SMTP Gmail] (FD=1800) bound to ::1:1099 [ ] Listening file descriptor created (FD=1516) [ ] Setting accept socket options (FD=1516) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [SMTP Gmail] to 127.0.0.1:1099: Address already in use (WSAEADDRINUSE) (10048) [ ] Binding service [POP3 Gmail] [ ] Listening file descriptor created (FD=1516) [ ] Setting accept socket options (FD=1516) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [POP3 Gmail] to 127.0.0.1:1109: Address already in use (WSAEADDRINUSE) (10048) [!] Binding service [POP3 Gmail] failed [ ] Deallocating section defaults [ ] Unbinding service [SMTP Gmail] [ ] Service [SMTP Gmail] closed (FD=1800) [ ] Service [SMTP Gmail] closed [ ] Deallocating section [SMTP Gmail] [ ] Unbinding service [POP3 Gmail] [ ] Service [POP3 Gmail] closed [ ] Deallocating section [POP3 Gmail] [!] Server is down I also tried changing 1099 to some other random ports but nothing works tried stopping gui, service & service uninstall, then service reinstall, service start & open gui, but the same log appears an early help will be highly appreciated. -- Regards Quick Support <https://get.teamviewer.com/66sdg3u>, Buy Tally Online <http://experts.tallysolutions.com/tallyweb/modules/sd/docmgmt/COnlineOrderE…> , Buy Addons Online <http://www.tallysolutions.com/tallyweb/modules/sd/docmgmt/CMktPlaceHomepage…> , Tally Solutions Website <http://www.tallysolutions.com>, Hardik Printers Youtube Channel <https://www.youtube.com/user/hardikcomp>, Twitter Handle <https://twitter.com/hardikcomp>, Quora Answers <https://www.quora.com/profile/Hardik-N-Mehta-Vadalia> Legal Disclaimer The information contained in this electronic communication is intended solely for the individual(s) or entity to which it is addressed. It may contain proprietary, confidential and/or legally privileged information. Any review, retransmission, dissemination, printing, copying or other use of, or taking any action in reliance on the contents of this information by person(s) or entities other than the intended recipient is strictly prohibited and may be unlawful. If you are not the addressee, or person responsible for delivering it to the addressee, you should not copy or deliver this to anyone else. If you receive this message by mistake, please notify us by responding to this email or telephone and immediately and permanently delete all copies of this message and any attachments from your system(s). We appreciate your assistance in preserving the confidentiality of our correspondence. Any information in this message that does not relate to the official business of the organization shall be understood as neither given nor endorsed by it. The contents of this message do not necessarily represent the views or policies of the Hardik Printers. Computer viruses can be transmitted via email. Hardik Printers attempts to sweep e-mails and attachments for viruses, it does not guarantee that either are virus free. The recipient should check this email and any attachments for the presence of viruses. Hardik Printers shall neither be liable for security of any information transmitted electronically nor be liable or responsible for the proper, timely and complete transmission thereof.

2 1

Re: [stunnel-users] build static stunnel with openssl
by Peter Pentchev 08 Oct '18

08 Oct '18

On Mon, Oct 08, 2018 at 03:09:07PM +0800, White Little wrote: > Thanks, Eric > > But I did not put it on /usr/local/opensl or /usr/local/stunnel > > > Below is my configuration log > > > [root@Stunnel-Fedora stunnel-5.49]# ./configure --enable-static > --with-ssl=/root/stunnel/openssl-1.1.0i [snip] > configure: **************************************** TLS [snip] > checking for TLS directory... /root/stunnel/openssl-1.1.0i [snip] > > I tested on ubuntu14.04, 16.04 64bit and fedora 32bit, all of them are > them are not include opennssl. What exactly makes you think that this does not include OpenSSL support? The configure script seemed to find the include/openssl/ directory in the directory that you specified; does the build fail somehow later? If it does, show us the logs from the failed build. Or does the compiled executable does not say "Compiled with OpenSSL 1.1.0i"? If it does not, show us the full build log (maybe use a pastebin-like service somewhere, e.g. paste.debian.net) BTW a question: is /root/stunnel/openssl-1.1.0i the place you extracted and compiled OpenSSL, or the place you installed it after building it? If you just built it there, you also need to install it somewhere and point the stunnel configure script at the directory where it is installed, not at the build tree. This might mean that you may need to rebuild it again after specifying a --prefix or something like that (I do not remember exactly how the OpenSSL build works). G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Re: [stunnel-users] build static stunnel with openssl
by Eric Eberhard 06 Oct '18

06 Oct '18

Make openssl and stunnel static. That is what I do and I consider it MUCH smarter than dynamic. I got tired of getting support calls because stunnel stopped working because the user installed a new openssl. Static will always work. Another piece of advice – do NOT put it on /usr/local/opensl or /usr/local/stunnel (or whatever the defaults are). Before building make your OWN directories. Our short name for our product is “met” so we use /usr/local/met/obj and /usr/local/met/bin for the object and binary files, respectively. This ensures nobody will install over you. This is also a real security issue mostly ignored. Most people have heard of SQL injection (where SQL is modified to do what the developer never intended). However, DLL injection (e.g. dynamic library injection) is a real problem. I could easily install an openssl DLL that does exactly what it should do … and sends the same data in clear text (or with my own encryption) to my machine. A thief could simply install one dynamic library and then OWN your data. E From: stunnel-users [mailto:[email protected]] On Behalf Of White Little Sent: Sunday, September 30, 2018 11:33 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] build static stunnel with openssl Hi All I try to build a static (portable) stunnel that contain opensll. I know there are some similar questions long ago, but I still fail on how to build it. I try to link the stunnel to latest openssl, so I download the openssl-1.0.2p and make it. And then I type ./configure --enable-static --with-ssl= openssl-1.0.2p_dir And typing make, I found there is a stunnel binary under /src folder, but it still not include the openssl. Do I miss something that I did not notice? Thanks

1 0

server mode support for both ECC and RSA server certificates
by Tom Hood 02 Oct '18

02 Oct '18

Hi, Can one stunnel service in server mode be configured with both ECDSA and RSA server certs? The stunnel man page Certificates section suggests only one can be specified along with its CA chain. Use case is some legacy clients don't support ECDSA, but it would be nice to support ECDSA when a client does support it. It appears that HAProxy supports this <https://www.haproxy.com/blog/serving-ecc-and-rsa-certificates-on-same-ip-wi…>,but I'm hoping there is an equivalent way to do this with stunnel. I'm currently testing with stunnel 5.49 with OpenSSL 1.0.2p on Solaris 11.3, but can rebuild with any version of openssl if that helps. Thanks, -- Tom

1 0

build static stunnel with openssl
by White Little 01 Oct '18

01 Oct '18

Hi All I try to build a static (portable) stunnel that contain opensll. I know there are some similar questions long ago, but I still fail on how to build it. I try to link the stunnel to latest openssl, so I download the openssl-1.0.2p and make it. And then I type *./configure --enable-static --with-ssl= openssl-1.0.2p_dir* And typing make, I found there is a stunnel binary under /src folder, but it still not include the openssl. Do I miss something that I did not notice? Thanks

1 0

Re: [stunnel-users] stunnel log rolling
by Eric Eberhard 17 Sep '18

17 Sep '18

Most O/S will either prevent renaming a file that is in use (or deleting it). Some will – but they will actually continue to write to the old file (and if that file was deleted then it writes to a file you can nexer see). Since I generally use AIX it is the second feature I see. We have systems with over 500 connections via stunnel – it never rests, and rolling the log file is not easy. I can easily provide a code fix for stunnel that we use in out software. It allows daily logs, sized logs, etc. And it rolls properly. The downside is we open the log, write to it, and close it – each time – which is not efficient. Given modern computers I have come to not care. So the open routine either opens (append) a daily file or it looks up the file and gets the size and decides to move it (or not). The second is not perfect … if three other processes have it open at the moment they will finish writing to that log. Who cares? As long as the logging is always opening and closing the “bleed over” is minimized. If people want me to do this, I will – if they can tell me the log routines it would speed me some, preventing from having to search for them. We like and prefer the daily logs – it is clean as you get one per day. As long as one day is never too huge it is great and we have daemons that remove logs over xx number of days (although I could add a simple parameter for that as well and simply kill those files). This is an annoying problem – especially for multi-O/S software – but one I am good at. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Daniel Trickett Sent: Wednesday, September 12, 2018 11:16 AM To: Tom Hood <tom.w.hood(a)gmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel log rolling Hi Tom, Is what you refer to? I think the open and re-open only happen when the service is stopped and restarted. It hasn’t rolled over like Apache in my short experience. log = append | overwrite log file handling This option allows you to choose whether the log file (specified with the output option) is appended or overwritten when opened or re-opened. default: append Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence – MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email <mailto:[email protected]> daniel.trickett(a)emdmillipore.com From: Tom Hood <tom.w.hood(a)gmail.com <mailto:[email protected]> > Sent: Wednesday, September 12, 2018 1:10 PM To: Daniel Trickett <daniel.trickett(a)emdmillipore.com <mailto:[email protected]> > Cc: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: Re: [stunnel-users] stunnel log rolling Hi Daniel, The trick is how to roll the logs without an interruption of service (i.e. without a stunnel restart). I believe stunnel claims to support this, but I think the feature might be broken in 5.49 Thanks, -- Tom On Wed, Sep 12, 2018 at 5:43 AM Daniel Trickett <daniel.trickett(a)emdmillipore.com <mailto:[email protected]> > wrote: Tom, Kill the stunnel process. Then mv the log. This will allow stunnel to right to a new log file. Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence – MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email <mailto:[email protected]> daniel.trickett(a)emdmillipore.com From: stunnel-users <stunnel-users-bounces(a)stunnel.org <mailto:[email protected]> > On Behalf Of Tom Hood Sent: Tuesday, September 11, 2018 5:02 PM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] stunnel log rolling Hi, I'm new to stunnel and it isn't clear to me how the log rolling feature works. I built stunnel 5.49 with gcc 4.2.0 on Solaris 10. I'm running it on Solaris 11.3 SPARC. Using openssl 1.0.2p The config file has disabled syslog and is logging to stunnel.log. Command line is: stunnel stunnel.conf where stunnel.conf contains the following: syslog = no output = stunnel.log debug = 7 [service-exterior] client = no options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = -NO_TLSv1.2 cert = /path/to/stunnel.pem curve = zzz accept = testhost:32100 connect = 127.0.0.1:32200 <http://127.0.0.1:32200> [service-interior] client = yes options = NO_SSLv2 options = NO_SSLv3 accept = 127.0.0.1:32200 <http://127.0.0.1:32200> connect = 127.0.0.1:32100 <http://127.0.0.1:32100> sslVersion = TLSv1 ciphers = zzz TIMEOUTconnect = 60 The log rollowing steps I tried that don't work are: mv stunnel.log stunnel.log.1 kill -USR1 <stunnelpid> The log message "LOG7[main]: Processing SIGNAL_REOPEN_LOG" shows up in stunnel.log.1. However, new client connections to host:32100 do not trigger creation of a new stunnel.log file. In fact, logging stops to stunnel.log.1 as soon as the USR1 is processed. The new client connections work as before, but there isn't any logging. I restarted stunnel and tried the test again with these steps: mv stunnel.log stunnel.log.1 touch stunnel.log kill -USR1 <stunnelpid> That also doesn't work. Please let me know the correct sequence of steps to roll the stunnel.log Thank you, -- Tom This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer. This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

2 1

stunnel log rolling
by Tom Hood 12 Sep '18

12 Sep '18

Hi, I'm new to stunnel and it isn't clear to me how the log rolling feature works. I built stunnel 5.49 with gcc 4.2.0 on Solaris 10. I'm running it on Solaris 11.3 SPARC. Using openssl 1.0.2p The config file has disabled syslog and is logging to stunnel.log. Command line is: stunnel stunnel.conf where stunnel.conf contains the following: syslog = no output = stunnel.log debug = 7 [service-exterior] client = no options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = -NO_TLSv1.2 cert = /path/to/stunnel.pem curve = zzz accept = testhost:32100 connect = 127.0.0.1:32200 [service-interior] client = yes options = NO_SSLv2 options = NO_SSLv3 accept = 127.0.0.1:32200 connect = 127.0.0.1:32100 sslVersion = TLSv1 ciphers = zzz TIMEOUTconnect = 60 The log rollowing steps I tried that don't work are: mv stunnel.log stunnel.log.1 kill -USR1 <stunnelpid> The log message "LOG7[main]: Processing SIGNAL_REOPEN_LOG" shows up in stunnel.log.1. However, new client connections to host:32100 do not trigger creation of a new stunnel.log file. In fact, logging stops to stunnel.log.1 as soon as the USR1 is processed. The new client connections work as before, but there isn't any logging. I restarted stunnel and tried the test again with these steps: mv stunnel.log stunnel.log.1 touch stunnel.log kill -USR1 <stunnelpid> That also doesn't work. Please let me know the correct sequence of steps to roll the stunnel.log Thank you, -- Tom

2 4

stunnel 5.49 released
by Michal Trojnara 03 Sep '18

03 Sep '18

Dear Users, I have released version 5.49 of stunnel. Version 5.49, 2018.09.03, urgency: MEDIUM * New features - Performance optimizations. - Logging of negotiated or resumed TLS session IDs (thx to ANSSI - National Cybersecurity Agency of France). - Merged Debian 10-enabled.patch and 11-killproc.patch (thx to Peter Pentchev). - OpenSSL DLLs updated to version 1.0.2p. - PKCS#11 engine DLL updated to version 0.4.9. * Bugfixes - Fixed a crash in the session persistence implementation. - Fixed syslog identifier after configuration file reload. - Fixed non-interactive "make check" invocations. - Fixed reloading syslog configuration. - stunnel.pem created with SHA-256 instead of SHA-1. - SHA-256 "make check" certificates. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 3d6641213a82175c19f23fde1c3d1c841738385289eb7ca1554f4a58b96d955e stunnel-5.49.tar.gz 459bbb212baf0b9821c80e0664c830246ef6e97c7329fb08160e87ff11ae9692 stunnel-5.49-win32-installer.exe 72416c6664106ad815a8da67a525c6593247fc06cbca3b8918ffc87ae92595e8 stunnel-5.49-android.zip Best regards, Mike

1 0

Adding custom HTTP headers to a proxy'ed HTTP request when stunnel is used as an endpoint for a HTTP proxy
by Tony Cheneau 02 Sep '18

02 Sep '18

Good evening folks, Michal was kind enough to review and rewrite/integrate one of my patches for logging session IDs [1] and post the remaining ones on the website [2]! So, I feel I should also contribute to this list a little program I wrote. It is meant to be used with the exec= directive. It is mostly useful when stunnel is used to secure a connexion between a client and a HTTP proxy. A stunnel instance can run locally on the client while a stunnel server runs on the HTTP proxy: HTTP client (proxy'ed) <- > stunnel client <--> stunnel server <-> HTTP proxy Here, the "exec=" program will run on the stunnel server and add some extra headers to each HTTP request. One of this headers is the client's Distinguished Name (from its X.509 certificate). The HTTP proxy (squid for example) can then make some decision based on this HTTP header (authorisation, etc.). It relies heavily on PicoHTTPParser. Regards, Tony Cheneau [1]: to appear in version 5.49, see https://www.stunnel.org/sdf_ChangeLog.html [2]: patches 0002 and 0003 on https://www.stunnel.org/patches.html

1 0

OpenSSL 1.1.1 secure level and also an old problem rearing up
by Peter Pentchev 26 Aug '18

26 Aug '18

Hi, Sorry to be the bearer of a "those OS vendors did something again and now we have to catch up with them... again..." type of news, but, well, the maintainers of the Debian package of OpenSSL upgraded it to a prerelease 1.1.1 version and, in the process, changed the default cipher selection in the openssl.cnf file to 'SECLEVEL=2'. Unfortunately, this means that the server certificate used in the stunnel test suite is not considered strong enough, so the test suite is failing. More details may be found in the description of the Debian bug https://bugs.debian.org/906981 and the error message itself is at https://ci.debian.net/data/autopkgtest/testing/amd64/s/stunnel4/865956/log.… (look for all the lines containing "SSL_CTX_use_certificate:ca md too weak") So my first reaction was to stop running the stunnel test suite and only leave my functional test script; however, I then had another idea and tried to get the stunnel test suite to explicitly specify SECLEVEL=1 using the attached patch. This actually helped a bit - it made most of the tests pass - but then I hit a problem with e.g. 037_failover_prio1: if there is a "ciphers" option in the config file, stunnel eventually dies with an error that I seem to remember having seen before; take a look at this gdb backtrace from stunnel 5.48: (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007f0a349882f1 in __GI_abort () at abort.c:79 #2 0x000055b1aa3ad645 in fatal_debug (txt=0x55b1aa3c503c "Bad magic", file=0x55b1aa3ca6dd "ssl.c", line=118) at log.c:379 #3 0x000055b1aa3ae066 in get_alloc_list_ptr (ptr=0x7f0a24014520, file=0x55b1aa3ca6dd "ssl.c", line=118) at str.c:429 #4 0x000055b1aa3ae229 in str_detach_debug (ptr=ptr@entry=0x7f0a24014520, file=file@entry=0x55b1aa3ca6dd "ssl.c", line=line@entry=118) at str.c:378 #5 0x000055b1aa3ae884 in str_detach_debug (line=118, file=0x55b1aa3ca6dd "ssl.c", ptr=0x7f0a24014520) at str.c:413 #6 str_free_debug (ptr=0x7f0a24014520, file=0x55b1aa3ca6dd "ssl.c", line=118) at str.c:413 #7 0x00007f0a34f7661a in CRYPTO_free_ex_data () from /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 #8 0x00007f0a35112a98 in SSL_SESSION_free () from /usr/lib/x86_64-linux-gnu/libssl.so.1.1 #9 0x00007f0a34f7a1bc in OPENSSL_LH_doall_arg () from /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 #10 0x00007f0a35114177 in SSL_CTX_flush_sessions () from /usr/lib/x86_64-linux-gnu/libssl.so.1.1 #11 0x000055b1aa3c3701 in unbind_ports () at stunnel.c:439 #12 0x000055b1aa3c3799 in main_cleanup () at stunnel.c:224 #13 0x000055b1aa3ad720 in main (argc=<optimized out>, argv=<optimized out>) at ui_unix.c:79 (gdb) (the line numbers may be a bit off from the stock stunnel source, since I also added a setrlimit(RLIMIT_CORE, infinity) patch) So, yeah, what would be the best way forward here? I guess I might create a new certificate specifically for the Debian package's test suite, but I think the double-free problem may also need to be fixed. Let me know if you need any more information about reproducing it or any more data in case it doesn't happen on your end. Thanks for everything you're doing for stunnel, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

2 2

Log to syslog without process name, after reloading the configuration (sighup)
by Reschke, Sven (VWIF G-TS/P) 22 Aug '18

22 Aug '18

Hi, I've upgraded my stunnel from version 5.44 to 5.45. After reloading the configuration of stunnel (via pkill -sighup stunnel) several times, I've stumbled about missing syslogs. Only the loading of the configuration file was still visible. Then I've noticed, that greping the syslog for stunnel was my mistake. Stunnel doesn't log its process name after reloading the configuration file the second time (see logs below) Can someone verify, or is it just me, or some configuration I'm missing? BTW: I've reproduced the "problem" also for the version 5.48 as you can see from the logs. With version 5.44 stunnel always logged its process name to syslog. Syslog output for greping after "stunnel": Aug 17 13:41:14 <user> stunnel: LOG5[ui]: stunnel 5.48 on armv7l-unknown-linux-gnueabihf platform Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Compiled/running with OpenSSL 1.0.2p 14 Aug 2018 Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Reading configuration from file /home/pi/stunnel.conf Aug 17 13:41:14 <user> stunnel: LOG5[ui]: UTF-8 byte order mark not detected Aug 17 13:41:14 <user> stunnel: LOG5[ui]: FIPS mode disabled Aug 17 13:41:14 <user> stunnel: LOG4[ui]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:14 <user> stunnel: LOG4[ui]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Configuration successful ---------------- Reloading the configuration the first time ----------------------- Aug 17 13:41:21 <user> stunnel: LOG5[main]: Reading configuration from file /home/pi/stunnel.conf Aug 17 13:41:21 <user> stunnel: LOG5[main]: UTF-8 byte order mark not detected Aug 17 13:41:21 <user> stunnel: LOG5[main]: FIPS mode disabled Aug 17 13:41:21 <user> stunnel: LOG4[main]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:21 <user> stunnel: LOG4[main]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:21 <user> stunnel: LOG5[main]: Configuration successful ---------------- Reloading the configuration a second time ------------------------ Aug 17 13:41:26 <user> : LOG5[main]: Reading configuration from file /home/pi/stunnel.conf My configuration file: [PSK client] client = yes accept = <listen address> connect = <remote address> PSKsecrets = /home/pi/psk.txt [PSK server] accept = <listen address> connect = <remote address> PSKsecrets = /home/pi/psk.txt Sven Reschke Embedded System SW Developer G-TS/P Volkswagen Infotainment GmbH Universitätsstr. 140 44799 Bochum Mobile +49 1525-887 2762 sven.reschke(a)volkswagen-infotainment.com<mailto:[email protected]> http://www.volkswagen-infotainment.com<http://www.volkswagen-infotainment.com/> Sitz der Gesellschaft: Wolfsburg Amtsgericht Braunschweig: HRB 204780 Geschäftsführung: Bernhard Krauße (Sprecher), Tobias Nadjib

2 2

OFFICE 365
by Mark Brezinski 15 Aug '18

15 Aug '18

Hello, Anyone have any luck connecting stunnel to office 365 I keep getting a socket 10061 error Mark Brezinski IT / EDI Manager [cid:[email protected]]Healthcare, Inc. Proud Winner of the US National Minority Manufacturer of the Year Award 2012, MBDA, US Dept of Commerce Proud Winner of the Supplier of the Year Award 2012, Chicago Minority Supplier Development Council (Class IV >$50MM) Manufacturer of Medical Devices & Disposable Kits 5535 N. Wolcott Avenue Chicago, IL 60640 Tel : (773) 878-1100 ext.277 Fax: (773) 878-9100 mark.brezinski(a)lslhealthcare.com<mailto:[email protected]> www.LSLHealthcare.com<http://www.lslhealthcare.com/> Notice: If you are not the intended recipient, please note that any dissemination, disclosure, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately by telephone or by return e-mail and delete it from their computer. This communication may contain information that is privileged, confidential or exempt from disclosure. P LSL Healthcare, Inc.is dedicated to preserving our environment. Please join us and consider not printing this e-mail unless necessary.

1 0

x64 Installers and Upgrade HowTo
by Cynthia Davis 07 Aug '18

07 Aug '18

Two questions for the mailing list: 1. Are win64 installers available for stunnel? I only see win32 installers on the downloads page. 2. Are there formal (or informal) instructions for upgrading an existing stunnel installation? Thanks in advance, CJD

1 0

zlib1.dll not installed
by Gonzalo Costantini 01 Aug '18

01 Aug '18

Hi, The installer stunnel-5.48-win32-installer.exe do not copy zlib1.dll in any directory; this problem begins with the installer stunnel-5.44-win32-installer. Thaks. -- Luis Gonzalo Costantini Rickel Clave GPG (GPG Key): Fingerprint: 081069E0C552DFBDF53A0D2046ECD11A960D250F Key-ID.: 0x960D250F

1 0

Re: [stunnel-users] Is there a way to specify certificate content in stunnel config
by Eric S Eberhard 24 Jul '18

24 Jul '18

Use stunnel in inetd mode. Execute a script (or better C program). Copy the certificates for making the stunnel connection to a directory that is OK … then delete them immediately after stunnel starts. Hack – but might be OK for what you are doing. I am not sure why anyone would think it more secure to put the keys into the stunnel command than to just use them from a file … but I likely do not know enough about your application to make a judgement. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 From: stunnel-users [mailto:[email protected]] On Behalf Of Hari Sent: Thursday, July 19, 2018 4:42 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Is there a way to specify certificate content in stunnel config Hi, I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them. Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged. Thanks Hari <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> Virus-free. <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> www.avg.com

3 2

Grok log parsing
by Manuele Trimarchi 24 Jul '18

24 Jul '18

I would ask if someone use Grok log parsing for stunnel and, if yes, what kind of filter statement are you using? At the moment I've just created 2 parser: STUNNEL_AcceptedConnectionParser %{date("yyyy.MM.dd HH:mm:ss"):date} LOG%{integer:loglevel}\[%{integer:session_id}\]\: Service \[%{word:csb_name}\-%{word:csb_port}\] accepted connection from %{ipv4:caller_ip}\:%{port:caller_port} and STUNNEL_ConnectionClosedParser %{date("yyyy.MM.dd HH:mm:ss"):date} LOG%{integer:loglevel}\[%{integer:session_id}\]\: Connection closed\: %{integer:byte_tx} byte$s$ sent to SSL\, %{integer:byte_rx} byte$s$ sent to socket I'm new with Grok and all the things related to log match-and-parse, so I think that there will be a much better solution than mine, anyway Google this time doesn't help unfortunately. Thank you so much to all those who will help me with this stuff! Manuele

1 1

Cross Compiling Stunnel-5.48 Using BoringSSL
by Jaymin D 24 Jul '18

24 Jul '18

Hi All, I want to cross compile the Stunnel-5.48 for my Android AOSP (arch64) platform using BoringSSL's 'libssl.so' and 'libcrypto.so' libraries. I have successfully cross compiled the BoringSSL in my AOSP and both .so file was generated for arch64 platform. Am using BoringSSL which was delivered with Android AOSP (Android 7). Am cross compiling using "build-android.sh" script. But, while cross compiling the Stunnel-5.48 facing error as below: ------------------------------------------------------------------------------------------------ VERSION=5.48 > DST=stunnel-$VERSION-android > # to build OpenSSL: > # ./Configure threads no-shared no-dso > --cross-compile-prefix=arm-linux-androideabi- > --prefix=/opt/androideabi/sysroot linux-armv4 > # make install > LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE" > export LDFLAGS > test -f Makefile && make distclean > mkdir -p bin/android > cd bin/android > ../../configure --with-pic --enable-shared --with-sysroot > --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib > configure: **************************************** initialization > checking for a BSD-compatible install... /usr/bin/install -c > checking whether build environment is sane... yes > checking for aarch64-linux-android-strip... no > checking for strip... strip > checking for a thread-safe mkdir -p... /bin/mkdir -p > checking for gawk... gawk > checking whether make sets $(MAKE)... yes > checking whether make supports nested variables... yes > checking build system type... x86_64-pc-linux-gnu > checking host system type... aarch64-unknown-linux-android > checking for aarch64-linux-android-gcc... no > checking for gcc... gcc > checking whether the C compiler works... yes > checking for C compiler default output file name... a.out > checking for suffix of executables... > checking whether we are cross compiling... no > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ISO C89... none needed > checking whether gcc understands -c and -o together... yes > checking for style of include used by make... GNU > checking dependency style of gcc... gcc3 > checking whether make sets $(MAKE)... (cached) yes > checking whether make supports nested variables... (cached) yes > configure: **************************************** thread model > checking for a sed that does not truncate output... /bin/sed > checking how to run the C preprocessor... gcc -E > checking for grep that handles long lines and -e... /bin/grep > checking for egrep... /bin/grep -E > checking whether gcc is Clang... no > checking whether pthreads work with -pthread... yes > checking for joinable pthread attribute... PTHREAD_CREATE_JOINABLE > checking whether more special flags are required for pthreads... no > checking for PTHREAD_PRIO_INHERIT... yes > configure: PTHREAD thread model detected > configure: **************************************** compiler/linker flags > checking whether C compiler accepts -Wall... yes > checking whether C compiler accepts -Wextra... yes > checking whether C compiler accepts -Wpedantic... yes > checking whether C compiler accepts -Wformat=2... yes > checking whether C compiler accepts -Wconversion... yes > checking whether C compiler accepts -Wno-long-long... yes > checking whether C compiler accepts -Wno-deprecated-declarations... yes > checking whether C compiler accepts -fPIE... yes > checking whether C compiler accepts -fstack-protector... yes > checking whether the linker accepts -fPIE... yes > checking whether the linker accepts -pie... yes > checking whether the linker accepts -Wl,-z,relro... yes > checking whether the linker accepts -Wl,-z,now... yes > checking whether the linker accepts -Wl,-z,noexecstack... yes > checking whether C compiler accepts -D_FORTIFY_SOURCE=2... yes > configure: **************************************** libtool > checking how to print strings... printf > checking for a sed that does not truncate output... (cached) /bin/sed > checking for fgrep... /bin/grep -F > checking for ld used by gcc... /usr/bin/ld > checking if the linker (/usr/bin/ld) is GNU ld... yes > checking for BSD- or MS-compatible name lister (nm)... no > checking for aarch64-linux-android-dumpbin... no > checking for aarch64-linux-android-link... no > checking for dumpbin... no > checking for link... link -dump > checking the name lister (nm) interface... BSD nm > checking whether ln -s works... yes > checking the maximum length of command line arguments... 1572864 > checking how to convert x86_64-pc-linux-gnu file names to > aarch64-unknown-linux-android format... func_convert_file_noop > checking how to convert x86_64-pc-linux-gnu file names to toolchain > format... func_convert_file_noop > checking for /usr/bin/ld option to reload object files... -r > checking for aarch64-linux-android-objdump... no > checking for objdump... objdump > checking how to recognize dependent libraries... pass_all > checking for aarch64-linux-android-dlltool... no > checking for dlltool... no > checking how to associate runtime and link libraries... printf %s\n > checking for aarch64-linux-android-ar... no > checking for ar... ar > checking for archiver @FILE support... @ > checking for aarch64-linux-android-strip... strip > checking for aarch64-linux-android-ranlib... no > checking for ranlib... ranlib > checking command to parse nm output from gcc object... ok > checking for sysroot... / > checking for a working dd... /bin/dd > checking how to truncate binary pipes... /bin/dd bs=4096 count=1 > checking for aarch64-linux-android-mt... no > checking for mt... mt > checking if mt is a manifest tool... no > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking for dlfcn.h... yes > checking for objdir... .libs > checking if gcc supports -fno-rtti -fno-exceptions... no > checking for gcc option to produce PIC... -fPIC -DPIC > checking if gcc PIC flag -fPIC -DPIC works... yes > checking if gcc static flag -static works... no > checking if gcc supports -c -o file.o... yes > checking if gcc supports -c -o file.o... (cached) yes > checking whether the gcc linker (/usr/bin/ld) supports shared libraries... > yes > checking whether -lc should be explicitly linked in... no > checking dynamic linker characteristics... Android linker > checking how to hardcode library paths into programs... immediate > checking whether stripping libraries is possible... yes > checking if libtool supports shared libraries... yes > checking whether to build shared libraries... yes > checking whether to build static libraries... no > configure: **************************************** types > checking for int8_t... yes > checking for int16_t... yes > checking for int32_t... yes > checking for int64_t... yes > checking for uint8_t... yes > checking for uint16_t... yes > checking for uint32_t... yes > checking for uint64_t... yes > checking for size_t... yes > checking for ssize_t... yes > checking for uid_t in sys/types.h... yes > checking for socklen_t... yes > checking for struct sockaddr_un... yes > checking for struct addrinfo... yes > configure: **************************************** PTY device files > checking for "/dev/ptmx"... yes > checking for "/dev/ptc"... no > configure: **************************************** entropy sources > checking for "/dev/urandom"... yes > configure: **************************************** default group > checking for default group... nogroup > checking for special C compiler options needed for large files... no > checking for _FILE_OFFSET_BITS value needed for large files... no > configure: **************************************** header files > checking for stdint.h... (cached) yes > checking for inttypes.h... (cached) yes > checking malloc.h usability... yes > checking malloc.h presence... yes > checking for malloc.h... yes > checking ucontext.h usability... yes > checking ucontext.h presence... yes > checking for ucontext.h... yes > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes > checking poll.h usability... yes > checking poll.h presence... yes > checking for poll.h... yes > checking tcpd.h usability... no > checking tcpd.h presence... no > checking for tcpd.h... no > checking stropts.h usability... yes > checking stropts.h presence... yes > checking for stropts.h... yes > checking grp.h usability... yes > checking grp.h presence... yes > checking for grp.h... yes > checking for unistd.h... (cached) yes > checking util.h usability... no > checking util.h presence... no > checking for util.h... no > checking libutil.h usability... no > checking libutil.h presence... no > checking for libutil.h... no > checking pty.h usability... yes > checking pty.h presence... yes > checking for pty.h... yes > checking limits.h usability... yes > checking limits.h presence... yes > checking for limits.h... yes > checking for sys/types.h... (cached) yes > checking sys/select.h usability... yes > checking sys/select.h presence... yes > checking for sys/select.h... yes > checking sys/poll.h usability... yes > checking sys/poll.h presence... yes > checking for sys/poll.h... yes > checking sys/socket.h usability... yes > checking sys/socket.h presence... yes > checking for sys/socket.h... yes > checking sys/un.h usability... yes > checking sys/un.h presence... yes > checking for sys/un.h... yes > checking sys/ioctl.h usability... yes > checking sys/ioctl.h presence... yes > checking for sys/ioctl.h... yes > checking sys/filio.h usability... no > checking sys/filio.h presence... no > checking for sys/filio.h... no > checking sys/resource.h usability... yes > checking sys/resource.h presence... yes > checking for sys/resource.h... yes > checking sys/uio.h usability... yes > checking sys/uio.h presence... yes > checking for sys/uio.h... yes > checking sys/syscall.h usability... yes > checking sys/syscall.h presence... yes > checking for sys/syscall.h... yes > checking linux/sched.h usability... yes > checking linux/sched.h presence... yes > checking for linux/sched.h... yes > checking for struct msghdr.msg_control... yes > checking for linux/netfilter_ipv4.h... yes > configure: **************************************** libraries > checking for library containing gethostbyname... none required > checking for library containing yp_get_default_domain... -lnsl > checking for library containing socket... none required > checking for library containing openpty... -lutil > checking for library containing dlopen... -ldl > checking for library containing shl_load... no > configure: **************************************** library functions > checking for snprintf... yes > checking for vsnprintf... yes > checking for openpty... yes > checking for _getpty... no > checking for daemon... yes > checking for waitpid... yes > checking for wait4... yes > checking for setsid... yes > checking for setgroups... yes > checking for chroot... yes > checking for realpath... yes > checking for sysconf... yes > checking for getrlimit... yes > checking for pthread_sigmask... yes > checking for localtime_r... yes > checking for getcontext... yes > checking for __makecontext_v2... no > checking for poll... yes > checking for gethostbyname2... yes > checking for endhostent... yes > checking for getnameinfo... yes > checking for getaddrinfo... yes > checking for broken poll() implementation... no > checking for pipe2... yes > checking for accept4... yes > configure: **************************************** optional features > checking whether to enable IPv6 support... yes (default) > checking whether to enable FIPS support... autodetecting > checking whether to enable systemd socket activation support... > autodetecting > checking for library containing sd_listen_fds... no > configure: systemd library not found > checking whether to enable TCP wrappers support... autodetecting > checking for hosts_access in -lwrap... no > configure: libwrap library not found > configure: **************************************** TLS > checking for compiler sysroot... / > checking for TLS directory... /home/jaymin/Desktop/boringssl_lib > checking for FIPS_mode_set... yes > configure: FIPS support enabled > configure: **************************************** write the results > checking that generated files are newer than configure... done > configure: creating ./config.status > config.status: creating Makefile > config.status: creating src/Makefile > config.status: creating doc/Makefile > config.status: creating tools/Makefile > config.status: creating tests/Makefile > config.status: creating src/config.h > config.status: src/config.h is unchanged > config.status: executing depfiles commands > config.status: executing libtool commands > configure: **************************************** success > make clean > Making clean in src > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > rm -f stunnel > test -z "stunnel3" || rm -f stunnel3 > rm -rf .libs _libs > rm -rf ../obj ../bin > test -z "libstunnel.la" || rm -f libstunnel.la > rm -f ./so_locations > rm -f *.o > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Making clean in doc > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc' > test -z "stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html" || rm -f > stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc' > Making clean in tools > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools' > test -z "stunnel.conf-sample stunnel.init stunnel.service" || rm -f > stunnel.conf-sample stunnel.init stunnel.service > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools' > Making clean in tests > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests' > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests' > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android' > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android' > make > Making all in src > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > make all-am > make[2]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > CC env.lo > CCLD libstunnel.la > CC stunnel-tls.o > CC stunnel-str.o > CC stunnel-file.o > CC stunnel-client.o > CC stunnel-log.o > CC stunnel-options.o > CC stunnel-protocol.o > CC stunnel-network.o > CC stunnel-resolver.o > CC stunnel-ssl.o > CC stunnel-ctx.o > CC stunnel-verify.o > CC stunnel-sthreads.o > CC stunnel-fd.o > CC stunnel-dhparam.o > CC stunnel-cron.o > CC stunnel-stunnel.o > CC stunnel-pty.o > CC stunnel-libwrap.o > CC stunnel-ui_unix.o > CCLD stunnel > /usr/bin/ld: skipping incompatible > /home/jaymin/Desktop/boringssl_lib/libssl.so when searching for -lssl > /usr/bin/ld: skipping incompatible > /home/jaymin/Desktop/boringssl_lib/libcrypto.so when searching for -lcrypto > stunnel-str.o: In function `str_leak_debug': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:459: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:470: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:501: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:509: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `session_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:568: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:581: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `ssl_start': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:501: > undefined reference to `OpenSSL_version_num' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:519: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:511: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:502: > undefined reference to `OpenSSL_version_num' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:503: > undefined reference to `OpenSSL_version_num' > stunnel-client.o: In function `print_cipher': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:595: > undefined reference to `SSL_session_reused' > stunnel-client.o: In function `idx_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1446: > undefined reference to `SSL_session_reused' > stunnel-client.o: In function `idx_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1432: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1436: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `idx_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1447: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1453: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1469: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `client_run': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:224: > undefined reference to `CRYPTO_atomic_add' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:323: > undefined reference to `CRYPTO_atomic_add' > stunnel-log.o: In function `log_close': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:109: > undefined reference to `CRYPTO_THREAD_write_lock' > stunnel-log.o: In function `s_log': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:165: > undefined reference to `CRYPTO_THREAD_read_lock' > stunnel-log.o: In function `log_queue': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:194: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:201: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `s_log': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:170: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_flush': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:205: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:211: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:219: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_close': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:115: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_flush': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:220: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-options.o: In function `engine_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:4219: > undefined reference to `OPENSSL_init_crypto' > stunnel-options.o: In function `service_up_ref': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614: > undefined reference to `CRYPTO_atomic_add' > stunnel-options.o: In function `parse_global_option': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:681: > undefined reference to `OpenSSL_version_num' > stunnel-options.o: In function `tls_methods_set': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3514: > undefined reference to `TLS_client_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3515: > undefined reference to `TLS_server_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3506: > undefined reference to `TLS_client_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3507: > undefined reference to `TLS_server_method' > stunnel-options.o: In function `service_up_ref': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614: > undefined reference to `CRYPTO_atomic_add' > stunnel-options.o: In function `service_free': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:624: > undefined reference to `CRYPTO_atomic_add' > stunnel-ssl.o: In function `ssl_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:56: > undefined reference to `OPENSSL_init_ssl' > stunnel-ssl.o: In function `sk_SSL_COMP_pop': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_pop' > stunnel-ssl.o: In function `sk_SSL_COMP_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > stunnel-ssl.o: In function `sk_SSL_COMP_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_value' > stunnel-ssl.o: In function `compression_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:217: > undefined reference to `SSL_COMP_get0_name' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:221: > undefined reference to `SSL_COMP_get_id' > stunnel-ssl.o: In function `ssl_configure': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:127: > undefined reference to `OPENSSL_init_crypto' > stunnel-ssl.o: In function `compression_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:201: > undefined reference to `COMP_get_type' > stunnel-ctx.o: In function `info_callback': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:1231: > undefined reference to `SSL_get_state' > stunnel-ctx.o: In function `session_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:981: > undefined reference to `SSL_SESSION_up_ref' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:986: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-ctx.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-ctx.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-ctx.o: In function `session_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-ctx.o: In function `context_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:154: > undefined reference to `SSL_CTX_set_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:157: > undefined reference to `SSL_CTX_clear_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:161: > undefined reference to `SSL_CTX_set_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:164: > undefined reference to `SSL_CTX_clear_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:170: > undefined reference to `SSL_CTX_get_options' > stunnel-ctx.o: In function `dh_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:328: > undefined reference to `SSL_CTX_get_ciphers' > stunnel-ctx.o: In function `sk_SSL_CIPHER_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined > reference to `OPENSSL_sk_num' > stunnel-ctx.o: In function `sk_SSL_CIPHER_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined > reference to `OPENSSL_sk_value' > stunnel-ctx.o: In function `dh_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:356: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:358: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-verify.o: In function `ocsp_request': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:539: > undefined reference to `X509_STORE_CTX_get0_chain' > stunnel-verify.o: In function `get_current_issuer': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:701: > undefined reference to `X509_STORE_CTX_get0_chain' > stunnel-verify.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_OPENSSL_STRING_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151: > undefined reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_OPENSSL_STRING_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151: > undefined reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `cert_check_local': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:353: > undefined reference to `X509_STORE_CTX_get1_certs' > stunnel-verify.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_X509_pop_free': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_pop_free' > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_pop_free' > stunnel-verify.o: In function `sk_X509_NAME_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_NAME_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined > reference to `OPENSSL_sk_value' > stunnel-sthreads.o: In function `locking_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358: > undefined reference to `CRYPTO_THREAD_lock_new' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358: > undefined reference to `CRYPTO_THREAD_lock_new' > stunnel-dhparam.o: In function `get_dh2048': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/dhparam.c:49: > undefined reference to `DH_set0_pqg' > stunnel-cron.o: In function `cron_dh_param': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:193: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:196: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-stunnel.o: In function `stunnel_info': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:887: > undefined reference to `OpenSSL_version' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:889: > undefined reference to `OpenSSL_version' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:890: > undefined reference to `OpenSSL_version_num' > collect2: error: ld returned 1 exit status > Makefile:538: recipe for target 'stunnel' failed > make[2]: *** [stunnel] Error 1 > make[2]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Makefile:401: recipe for target 'all' failed > make[1]: *** [all] Error 2 > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Makefile:447: recipe for target 'all-recursive' failed > make: *** [all-recursive] Error 1 ------------------------------------------------------------------------------------------------ As I want to use SSL, did modification as below: --------------------------------------------------------------------------------------------- #!/bin/sh > set -ev > VERSION=5.48 > DST=stunnel-$VERSION-android > # to build OpenSSL: > # ./Configure threads no-shared no-dso > --cross-compile-prefix=arm-linux-androideabi- > --prefix=/opt/androideabi/sysroot linux-armv4 > # make install > LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE" > export LDFLAGS > test -f Makefile && make distclean > mkdir -p bin/android > cd bin/android > ../../configure --with-pic --enable-shared --with-sysroot > --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib > make clean > make > cd ../.. > mkdir $DST > cp bin/android/src/stunnel $DST > # arm-linux-androideabi-strip $DST/stunnel $DST/openssl > # cp /opt/androideabi/sysroot/bin/openssl $DST > # arm-linux-androideabi-strip $DST/openssl > zip -r $DST.zip $DST > rm -rf $DST > # sha256sum $DST.zip > # mv $DST.zip ../dist/ --------------------------------------------------------------------------------------------- How can I cross compile the Stunnel-5.48 using this BoringSSL? Are my BoringSSL's .so files incompatible? Any suggestions. Regards, Jaymin

1 0

"Reverse" tunneling with stunnel.
by C. Petro 20 Jul '18

20 Jul '18

I have a client who is setting up a logging infrastructure involving a couple of DMZs forwarding logs into central logging points. They have to pass compliance audits (SOX, PCI at least) and have some rather specific desires in regards to how they want the log traffic to move, and which servers *initiate* the connections. Which is to say they want the internal servers to set up tunnels to the DMZ servers and then the forwarders use that tunnel to deliver logs back. Lemme see if I can ascii art this: central1----------------------------------dmz1 \____________________ / _____________________\ _/ / \ central2----------------------------------dmz2 Something like that. Central1=10.10.1.2 Central2=10.9.1.2 DMZ1=172.18.0.5 DMZ2=172.20.0.5 Firewalls are in effect. I have gotten it set up so that I can initiate a connection FROM Central1 to DMZ2. [Tunnel_to_DMZ2] client = yes accept = 3002 connect = 172.20.0.5:5000 And [Tunnel_from_Central1] accept = 5000 connect = 3000 Like I said, I can open a tunnel from Central1 to DMZ2, but can't get traffic to pass backwards--I get a message in the log saying the session is closed. Is it possible to set stunnel up in a "reverse tunnel" mode--one where the connect is initiated from one end, but the other does most of the message passing? What I am missing? Thanks, Petro.

2 2

TLS alert (read): fatal: bad record mac (windows)
by Per Gunnarsson 19 Jul '18

19 Jul '18

I found it after looking once more in the log file. PSK client configured for identity "ï»¿user2" (the identity in the secrets.txt is user2:secretkey, somehow those three weird characters are added on windows) I got around it by copying the secrets.txt file to the server so that the secrets.txt on the server also begins with "ï»¿user2" but I suspect it's a bug. Regards, Per Gunnarsson

1 0

Is there a way to specify certificate content in stunnel config
by Hari 19 Jul '18

19 Jul '18

Hi, I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them. Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged. ThanksHari | | Virus-free. www.avg.com |

1 0

TLS alert (read): fatal: bad record mac (windows)
by Per Gunnarsson 19 Jul '18

19 Jul '18

Hello! I am trying to set up stunnel from a windows box to a VPS. I have working tunnels from a FreeBSD box to the VPS. On the VPS, the config looks like: [socks_server] protocol = socks PSKsecrets = /my/secret/location/secrets.txt accept = xxx.xxx.xxx.xxx:xxxx [ssh] PSKsecrets = /my/secret/location/hecrets.txt accept = xxx.xxx.xxx.xxx:xxxx connect = 127.0.0.1:22 On the windows box, the config looks like this: [socks_client2] debug = 7 client = yes PSKsecrets = c:\my\secret\location\secrets.txt accept = 127.0.0.1:1080 connect = xxx.xxx.xxx.xxx:xxxx The log on Windows looks like this: 2018.07.19 13:13:09 LOG5[main]: stunnel 5.48 on x86-pc-msvc-1500 platform 2018.07.19 13:13:09 LOG5[main]: Compiled/running with OpenSSL 1.0.2o-fips 27 Mar 2018 2018.07.19 13:13:09 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.07.19 13:13:09 LOG5[main]: Reading configuration from file stunnel.conf 2018.07.19 13:13:09 LOG5[main]: UTF-8 byte order mark detected 2018.07.19 13:13:09 LOG5[main]: FIPS mode disabled 2018.07.19 13:13:09 LOG5[main]: Configuration successful 2018.07.19 13:13:11 LOG7[0]: Service [socks_client2] started 2018.07.19 13:13:11 LOG7[0]: Setting local socket options (FD=460) 2018.07.19 13:13:11 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.19 13:13:11 LOG5[0]: Service [socks_client2] accepted connection from 127.0.0.1:56598 2018.07.19 13:13:11 LOG6[0]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:11 LOG7[0]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:13:11 LOG5[0]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:11 LOG5[0]: Service [socks_client2] connected remote server from 192.168.1.65:56599 2018.07.19 13:13:11 LOG7[0]: Setting remote socket options (FD=508) 2018.07.19 13:13:11 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.19 13:13:11 LOG7[0]: Remote descriptor (FD=508) initialized 2018.07.19 13:13:11 LOG6[0]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:13:11 LOG6[0]: Peer certificate not required 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): before/connect initialization 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:13:11 LOG6[0]: Client certificate not requested 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:13:11 LOG6[0]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 flush data 2018.07.19 13:13:11 LOG3[0]: SSL_connect: Peer suddenly disconnected 2018.07.19 13:13:11 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:13:11 LOG7[0]: Deallocating application specific data for session connect address 2018.07.19 13:13:11 LOG7[0]: Remote descriptor (FD=508) closed 2018.07.19 13:13:11 LOG7[0]: Local descriptor (FD=460) closed 2018.07.19 13:13:11 LOG7[0]: Service [socks_client2] finished (0 left) 2018.07.19 13:13:34 LOG7[1]: Service [socks_client2] started 2018.07.19 13:13:34 LOG7[1]: Setting local socket options (FD=528) 2018.07.19 13:13:34 LOG7[1]: Option TCP_NODELAY set on local socket 2018.07.19 13:13:34 LOG5[1]: Service [socks_client2] accepted connection from 127.0.0.1:56601 2018.07.19 13:13:34 LOG6[1]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:34 LOG7[1]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:13:34 LOG5[1]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:34 LOG5[1]: Service [socks_client2] connected remote server from 192.168.1.65:56602 2018.07.19 13:13:34 LOG7[1]: Setting remote socket options (FD=536) 2018.07.19 13:13:34 LOG7[1]: Option TCP_NODELAY set on remote socket 2018.07.19 13:13:34 LOG7[1]: Remote descriptor (FD=536) initialized 2018.07.19 13:13:34 LOG6[1]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:13:34 LOG6[1]: Peer certificate not required 2018.07.19 13:13:34 LOG7[1]: TLS state (connect): before/connect initialization 2018.07.19 13:13:34 LOG7[1]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:13:35 LOG6[1]: Client certificate not requested 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:13:35 LOG6[1]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 flush data 2018.07.19 13:13:35 LOG7[1]: TLS alert (read): fatal: bad record mac 2018.07.19 13:13:35 LOG3[1]: SSL_connect: 140943FC: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac 2018.07.19 13:13:35 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:13:35 LOG7[1]: Deallocating application specific data for session connect address 2018.07.19 13:13:35 LOG7[1]: Remote descriptor (FD=536) closed 2018.07.19 13:13:35 LOG7[1]: Local descriptor (FD=528) closed 2018.07.19 13:13:35 LOG7[1]: Service [socks_client2] finished (0 left) 2018.07.19 13:14:06 LOG7[2]: Service [socks_client2] started 2018.07.19 13:14:06 LOG7[2]: Setting local socket options (FD=1880) 2018.07.19 13:14:06 LOG7[2]: Option TCP_NODELAY set on local socket 2018.07.19 13:14:06 LOG5[2]: Service [socks_client2] accepted connection from 127.0.0.1:56604 2018.07.19 13:14:06 LOG6[2]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:14:06 LOG7[2]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:14:06 LOG5[2]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:14:06 LOG5[2]: Service [socks_client2] connected remote server from 192.168.1.65:56605 2018.07.19 13:14:06 LOG7[2]: Setting remote socket options (FD=2044) 2018.07.19 13:14:06 LOG7[2]: Option TCP_NODELAY set on remote socket 2018.07.19 13:14:06 LOG7[2]: Remote descriptor (FD=2044) initialized 2018.07.19 13:14:06 LOG6[2]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:14:06 LOG6[2]: Peer certificate not required 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): before/connect initialization 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:14:06 LOG6[2]: Client certificate not requested 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:14:06 LOG6[2]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 flush data 2018.07.19 13:14:06 LOG7[2]: TLS alert (read): fatal: bad record mac 2018.07.19 13:14:06 LOG3[2]: SSL_connect: 140943FC: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac 2018.07.19 13:14:06 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:14:06 LOG7[2]: Deallocating application specific data for session connect address 2018.07.19 13:14:06 LOG7[2]: Remote descriptor (FD=2044) closed 2018.07.19 13:14:06 LOG7[2]: Local descriptor (FD=1880) closed 2018.07.19 13:14:06 LOG7[2]: Service [socks_client2] finished (0 left)

1 0

Loss of ability to use Stunnel-Blat, and a solution
by Roger Bohl 10 Jul '18

10 Jul '18

Early in 2018, around the time when I upgraded my system to Windows 10, the Stunnel and Blat files that had worked fine with my Vista PC would not work with the new PC. However, the "bug" turned out to be unrelated to the change in operating systems, but rather an "upgrade" to Gmail: Coincidentally, about that time, Gmail evidently decided to stop accepting e-mails from apps deemed "a less secure app", including Stunnel-Blat, with Blat then displaying messages: *** Warning *** The SMTP server did not accept Auth PLAIN value. *** Warning *** Are your login userid and password correct? *** Warning *** The SMTP server did not accept Auth LOGIN PASSWD value. Only a failure message sent to my "backup e-mail address" led me to explore this as a possible cause for what I had thought was, but turned out not to be, a Stunnel-Blat problem. Gmail has an option to suppress this heightened security feature, and when I activated this option, my Stunnel-Blat tools immediately began to function as intended. While I was at first able to enable Gmail to "Allow access from "less secure accounts," I have been unable to get through Gmail options consistently to turn this on and off and share this info with others. (I would welcome instructions that work consistently.) I would also welcome guidance on how to include Stunnel-Blat as a specific alllowed app, without having to enable Gmail to enable *all* "less secure apps" Roger Bohl

3 3

Re: [stunnel-users] Intermittent error in 042_inetd
by Eric S Eberhard 10 Jul '18

10 Jul '18

The 50% could be because the server side is not fully updated - we have this problem a lot with very large companies that should know better (and in reality should overlap instead of changing over - meaning allow SSLv3 for 3 months or something while also accepting TLSv2. A very good way to test is to get a telnet program. Then "telnent localhost port#" - the port # being the port number stunnel is running on. This will remove all variables except stunnel and allow you to see the output. It could be you are connecting fine and failing some other authentication like a login - which you can see often with telnet. And set your firewall to not allow telnet on port 23. Also, we have found stunnel MUCH more reliable under inetd (if you are on Unix of course) than as a stand-alone server. A little performance loss that is unnoticeable to us - big customers exchange 2-4 million XML documents a day (using stunnel) so inetd is definitely not the most efficient way, but the machines are so darn fast it seems not to matter. The certificates have become more painful but I have never had to use an official signed one. I make my own with openssl. However, there are intermediate ones that are needed from whomever you connect to if they have a signed certificate - say from Verisign - you may need your certificate and Verisigns, etc - in a chain. I use "cacert" to set to a large file of .pem certificates - which I simply download from the Web (available all over, some work, some don't. When you get one that works . then use it. You can modify them by adding anything not found in the file. Supposedly the cacert file I have now is good till 2020 for the big names. You can also use openssl to get the certificate from the server - just ask and you shall receive. It should have the entire chain. I used to have on massive cacert for everyone and it was getting out of hand. As tacky as it is, I just make a cacert.pem file for every connection (e.g. Walmart, Fedex, Target, whatever). This allows working connections to keep working while you fiddle with a tricky one. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 From: stunnel-users [mailto:[email protected]] On Behalf Of Ian Bamforth Sent: Wednesday, July 04, 2018 9:00 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Intermittent error in 042_inetd Afternoon, Until recently we'd disabled `make test` because of certificate problems - we've re-enabled it (using `make check`) but are getting intermittent failures (around 50% of CI runs). Below is the output from the logs - I can't see what's gone wrong, can anyone shed any light? 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02004004 (+0x00004000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: Private key check succeeded 2018.07.04 09:59:36 LOG7[ui]: ECDH initialization 2018.07.04 09:59:36 LOG7[ui]: ECDH initialized with curve prime256v1 2018.07.04 09:59:36 LOG7[ui]: Binding service [server] 2018.07.04 09:59:36 LOG7[ui]: Listening file descriptor created (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Setting accept socket options (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.07.04 09:59:36 LOG7[main]: Created pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[cron]: Cron thread initialized 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: Service [server] accepted (FD=3) from 127.0.0.1:58890 2018.07.04 09:59:36 LOG7[0]: Service [server] started 2018.07.04 09:59:36 LOG7[0]: Setting local socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: SNI: no virtual services defined 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 server renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: 1 internal session cache item(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache fill-up(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache miss(es) 2018.07.04 09:59:36 LOG7[0]: 0 external session cache hit(s) 2018.07.04 09:59:36 LOG7[0]: 0 expired session(s) retrieved 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=10) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) initialized 2018.07.04 09:59:36 LOG7[0]: TLS alert (read): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Sent socket write shutdown 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) closed 2018.07.04 09:59:36 LOG7[0]: Local descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [server] finished (0 left) 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGCHLD 2018.07.04 09:59:36 LOG7[main]: Retrieving pid statuses with waitpid() 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02000004 (+0x00000000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: No certificate or private key specified 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] started 2018.07.04 09:59:36 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:4433: waiting 10 seconds 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) initialized 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server done 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: Peer certificate was cached (1241 bytes) 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 client renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Sending close_notify alert 2018.07.04 09:59:36 LOG7[0]: TLS alert (write): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] finished (0 left) 2018.07.04 09:59:36 LOG7[0]: Deallocating section defaults 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGNAL_TERMINATE 2018.07.04 09:59:36 LOG7[main]: Leak detection table utilization: 86/997, 8.63% 2018.07.04 09:59:36 LOG7[main]: Removed pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[main]: Deallocating section defaults Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division T: <tel:00441133443970> +44 (0)113 344 3970 M: <tel:00447852404240> +44 (0)7852 404240 E: <mailto:[email protected]> Ian.Bamforth(a)tracsis.com W: <https://www.tracsis.com> www.tracsis.com <http://www.tracsisops.com> www.tracsisops.com Follow Us <https://www.linkedin.com/company/972873?trk=tyah&trkInfo=idx:1-1-1,tarId:14 20795682492,tas:tracsis> <https://www.twitter.com/tracsis> Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF <https://static.tracsis.com/email/award4.png> Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error.

2 1

Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue?
by Eric S Eberhard 09 Jul '18

09 Jul '18

Exactly. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Peter Pentchev Sent: Thursday, July 05, 2018 5:47 AM To: Spies, Will <Will_Spies(a)comcast.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue? On Thu, Jul 05, 2018 at 11:41:18AM +0000, Spies, Will wrote: > Thanks for the quick response. The client is an Echo Show device and > there is no log. It is an RTSP connection and my backend (behind > Stunnel) is Live555ProxyServer. I read somewhere there is some bug > related to MSIE that closed the connection like this and the fix is to > use TIMEOUTclose=0 which I did but this did not help. This is the > earlier (startup) portion of my log: Hi, Unfortunately, without more information about what the client doesn't like about the established connection, I don't think there is anything more I can help you with :( You *might* try playing with stunnel's cipher settings (OpenSSL options), on the off chance that the client is somewhat confused and offers for negotiation a cipher or something that it later realizes it cannot support... but that would be really weird. G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue?
by Eric S Eberhard 09 Jul '18

09 Jul '18

I should also point out that the cipher suite is related to openssl version stunnel is compiled with. Again, we had customers that connected with TLSv1.3 and then could not negotiate a cipher suite ... leading to lost connection. Make sure you update openssl first -- then compile stunnel. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Javier Sent: Monday, July 09, 2018 9:55 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue? On Mon, 9 Jul 2018 12:26:08 +0000 Daniel Trickett <daniel.trickett(a)emdmillipore.com> wrote: > > Will, > > I was told to ignore the SSLv3 stuff in the log. I have options set to > allow only TLS1.2 and still see SSLv3 references in the log. > > Best regards, > > Dan Hi, in fact, the version can be disclosed from following lines in the log, where is told the cipher used, but not where you usually look: LOG6[1]: TLSv(1-1.1-1.2-1.3-whatever) ciphersuite: (whatever) Regards. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel connection issue?
by Spies, Will 09 Jul '18

09 Jul '18

I've been trying to get Stunnel to work for some time now. I have avoided using the mail list - but I see no recourse now. I think I've tried just about every setting I could find. I appear to be getting a connection issue - but as you will see the log just doesn't indicate clearly what is going on. The behavior is my client is failing to get a connection through Stunnel to my backend. The log appears to be closing a socket (but can't tell which one frontend or backend). Nothing wrong happens up until a client connects - 443 binds fine and later a connection to my backend 554 appears to connect find. If someone/anyone can help direct me to how to trouble shoot this better I would greatly appreciate it. As you will see in the log - the client attempts twice to get through. An excerpt of my log and the conf is below. /etc/stunnel.conf: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel.log debug=7 [rtsp] cert = /etc/stunnel/stunnel.pem accept=192.168.112.16:443 connect=192.168.112.16:554 TIMEOUTclose = 0 TIMEOUTbusy = 5 TIMEOUTidle = 30 delay = yes sslVersion = TLSv1.2 /var/log/stunnel.log: 2018.07.05 05:31:01 LOG7[main]: Service [rtsp] accepted (FD=3) from 192.168.112.197:43869 2018.07.05 05:31:01 LOG7[5]: Service [rtsp] started 2018.07.05 05:31:01 LOG7[5]: Setting local socket options (FD=3) 2018.07.05 05:31:01 LOG7[5]: Option TCP_NODELAY set on local socket 2018.07.05 05:31:01 LOG5[5]: Service [rtsp] accepted connection from 192.168.112.197:43869 2018.07.05 05:31:01 LOG6[5]: Peer certificate not required 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): before SSL initialization 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): before SSL initialization 2018.07.05 05:31:01 LOG7[5]: SNI: no virtual services defined 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read client hello 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write server hello 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write certificate 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read finished 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write finished 2018.07.05 05:31:01 LOG7[5]: New session callback 2018.07.05 05:31:01 LOG6[5]: No peer certificate received 2018.07.05 05:31:01 LOG7[5]: 6 server accept(s) requested 2018.07.05 05:31:01 LOG7[5]: 3 server accept(s) succeeded 2018.07.05 05:31:01 LOG7[5]: 0 server renegotiation(s) requested 2018.07.05 05:31:01 LOG7[5]: 0 session reuse(s) 2018.07.05 05:31:01 LOG7[5]: 3 internal session cache item(s) 2018.07.05 05:31:01 LOG7[5]: 0 internal session cache fill-up(s) 2018.07.05 05:31:01 LOG7[5]: 0 internal session cache miss(es) 2018.07.05 05:31:01 LOG7[5]: 0 external session cache hit(s) 2018.07.05 05:31:01 LOG7[5]: 0 expired session(s) retrieved 2018.07.05 05:31:01 LOG6[5]: TLS accepted: new session negotiated 2018.07.05 05:31:01 LOG6[5]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.07.05 05:31:01 LOG7[5]: Compression: null, expansion: null 2018.07.05 05:31:01 LOG6[5]: s_connect: connecting 192.168.112.16:554 2018.07.05 05:31:01 LOG7[5]: s_connect: s_poll_wait 192.168.112.16:554: waiting 10 seconds 2018.07.05 05:31:01 LOG5[5]: s_connect: connected 192.168.112.16:554 2018.07.05 05:31:01 LOG6[5]: persistence: 192.168.112.16:554 cached 2018.07.05 05:31:01 LOG5[5]: Service [rtsp] connected remote server from 192.168.112.16:58594 2018.07.05 05:31:01 LOG7[5]: Setting remote socket options (FD=9) 2018.07.05 05:31:01 LOG7[5]: Option TCP_NODELAY set on remote socket 2018.07.05 05:31:01 LOG7[5]: Remote descriptor (FD=9) initialized 2018.07.05 05:31:02 LOG6[5]: TLS socket closed (SSL_read) 2018.07.05 05:31:02 LOG7[5]: Sent socket write shutdown 2018.07.05 05:31:02 LOG5[5]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.05 05:31:02 LOG7[5]: Remote descriptor (FD=9) closed 2018.07.05 05:31:02 LOG7[5]: Local descriptor (FD=3) closed 2018.07.05 05:31:02 LOG7[5]: Service [rtsp] finished (0 left) 2018.07.05 05:31:02 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.05 05:31:02 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.05 05:31:02 LOG7[main]: FD=7 events=0x2001 revents=0x1 2018.07.05 05:31:02 LOG7[main]: Service [rtsp] accepted (FD=3) from 192.168.112.197:43870 2018.07.05 05:31:02 LOG7[6]: Service [rtsp] started 2018.07.05 05:31:02 LOG7[6]: Setting local socket options (FD=3) 2018.07.05 05:31:02 LOG7[6]: Option TCP_NODELAY set on local socket 2018.07.05 05:31:02 LOG5[6]: Service [rtsp] accepted connection from 192.168.112.197:43870 2018.07.05 05:31:02 LOG6[6]: Peer certificate not required 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): before SSL initialization 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): before SSL initialization 2018.07.05 05:31:02 LOG7[6]: SNI: no virtual services defined 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read client hello 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write server hello 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write certificate 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read finished 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write finished 2018.07.05 05:31:02 LOG7[6]: New session callback 2018.07.05 05:31:02 LOG6[6]: No peer certificate received 2018.07.05 05:31:02 LOG7[6]: 7 server accept(s) requested 2018.07.05 05:31:02 LOG7[6]: 4 server accept(s) succeeded 2018.07.05 05:31:02 LOG7[6]: 0 server renegotiation(s) requested 2018.07.05 05:31:02 LOG7[6]: 0 session reuse(s) 2018.07.05 05:31:02 LOG7[6]: 4 internal session cache item(s) 2018.07.05 05:31:02 LOG7[6]: 0 internal session cache fill-up(s) 2018.07.05 05:31:02 LOG7[6]: 0 internal session cache miss(es) 2018.07.05 05:31:02 LOG7[6]: 0 external session cache hit(s) 2018.07.05 05:31:02 LOG7[6]: 0 expired session(s) retrieved 2018.07.05 05:31:02 LOG6[6]: TLS accepted: new session negotiated 2018.07.05 05:31:02 LOG6[6]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.07.05 05:31:02 LOG7[6]: Compression: null, expansion: null 2018.07.05 05:31:02 LOG6[6]: s_connect: connecting 192.168.112.16:554 2018.07.05 05:31:02 LOG7[6]: s_connect: s_poll_wait 192.168.112.16:554: waiting 10 seconds 2018.07.05 05:31:02 LOG5[6]: s_connect: connected 192.168.112.16:554 2018.07.05 05:31:02 LOG6[6]: persistence: 192.168.112.16:554 cached 2018.07.05 05:31:02 LOG5[6]: Service [rtsp] connected remote server from 192.168.112.16:58596 2018.07.05 05:31:02 LOG7[6]: Setting remote socket options (FD=9) 2018.07.05 05:31:02 LOG7[6]: Option TCP_NODELAY set on remote socket 2018.07.05 05:31:02 LOG7[6]: Remote descriptor (FD=9) initialized 2018.07.05 05:31:02 LOG6[6]: TLS socket closed (SSL_read) 2018.07.05 05:31:02 LOG7[6]: Sent socket write shutdown 2018.07.05 05:31:02 LOG5[6]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.05 05:31:02 LOG7[6]: Remote descriptor (FD=9) closed 2018.07.05 05:31:02 LOG7[6]: Local descriptor (FD=3) closed 2018.07.05 05:31:02 LOG7[6]: Service [rtsp] finished (0 left) 2018.07.05 05:31:05 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.05 05:31:05 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.05 05:31:05 LOG7[main]: FD=7 events=0x2001 revents=0x1

6 12

Fwd: stunnel-users Digest, Vol 168, Issue 2
by Avinash Kumar 05 Jul '18

05 Jul '18

Regards, Avinash Kumar ---------- Forwarded message ---------- From: Avinash Kumar <avinash14331(a)gmail.com> Date: Wed, Jul 4, 2018 at 11:59 AM Subject: Re: [stunnel-users] stunnel-users Digest, Vol 168, Issue 2 To: "Jose Alf." <josealf(a)rocketmail.com> Hi, I commented sslVersion but still getting the same issue. Please find below my configuration details for both client and server: Server conf: Client Conf: Regards, Avinash Kumar On Tue, Jul 3, 2018 at 6:26 PM, Jose Alf. <josealf(a)rocketmail.com> wrote: > Kumar, > > Probably you are trying to connect to a server that dos not allow TLs > v1.0m a protocol that has been deprecated. Please Comment out the > sslVersion line and try again. > > regards, > > Jose > > > > On Tuesday, July 3, 2018, 6:37:53 AM GMT-5, Avinash Kumar < > avinash14331(a)gmail.com> wrote: > > > Hi, > > As requested, Posting my configuration. > [https-App-setup] client = yes accept = 9898 connect = > <<source-ipaddress>>:9898 cert = <<stunnel-installationdirectory>>\config\App\morpheus.pem > key = <<stunnel-installationdirectory>>\config\App\morpheus.key CAfile = > <<stunnel-installationdirectory>>\config\App\root-ca.pem sslVersion = > TLSv1 options = NO_SSLv3 > > > Regards, > Avinash Kumar > > On Tue, Jul 3, 2018 at 3:30 PM, <stunnel-users-request(a)stunnel.org> wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi- bin/mailman/listinfo/stunnel- users > <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users> > or, via email, send a message with subject or body 'help' to > stunnel-users-request@stunnel. org > <stunnel-users-request(a)stunnel.org> > > You can reach the person managing the list at > stunnel-users-owner@stunnel. org <stunnel-users-owner(a)stunnel.org> > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: Stunnel Issue (Flo Rance) > > > ------------------------------ ------------------------------ ---------- > > Message: 1 > Date: Tue, 3 Jul 2018 11:18:03 +0200 > From: Flo Rance <trourance(a)gmail.com> > To: Avinash Kumar <avinash14331(a)gmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Stunnel Issue > Message-ID: > <CAHogYcUn6BzfBr75X- DuteetppESv2KOjGJmGO7mc=SuHVaE > Xw(a)mail.gmail.com <SuHVaEXw(a)mail.gmail.com>> > Content-Type: text/plain; charset="utf-8" > > Please post your configuration. Without that, it's not obvious. > > Regards, > Flo > > On Tue, Jul 3, 2018 at 10:42 AM, Avinash Kumar <avinash14331(a)gmail.com> > wrote: > > > Attaching the screenshot > > > > Regards, > > Avinash Kumar > > > > On Tue, Jul 3, 2018 at 2:11 PM, Avinash Kumar <avinash14331(a)gmail.com> > > wrote: > > > >> Hi, > >> > >> I am getting below error while connecting through stunnel: > >> > >> > >> > >> Regards, > >> Avinash Kumar > >> > > > > > > ______________________________ _________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi- bin/mailman/listinfo/stunnel- users > <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users> > > > > >

3 3

Intermittent error in 042_inetd
by Ian Bamforth 04 Jul '18

04 Jul '18

Afternoon, Until recently we'd disabled `make test` because of certificate problems - we've re-enabled it (using `make check`) but are getting intermittent failures (around 50% of CI runs). Below is the output from the logs - I can't see what's gone wrong, can anyone shed any light? 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02004004 (+0x00004000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: Private key check succeeded 2018.07.04 09:59:36 LOG7[ui]: ECDH initialization 2018.07.04 09:59:36 LOG7[ui]: ECDH initialized with curve prime256v1 2018.07.04 09:59:36 LOG7[ui]: Binding service [server] 2018.07.04 09:59:36 LOG7[ui]: Listening file descriptor created (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Setting accept socket options (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.07.04 09:59:36 LOG7[main]: Created pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[cron]: Cron thread initialized 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: Service [server] accepted (FD=3) from 127.0.0.1:58890 2018.07.04 09:59:36 LOG7[0]: Service [server] started 2018.07.04 09:59:36 LOG7[0]: Setting local socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: SNI: no virtual services defined 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 server renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: 1 internal session cache item(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache fill-up(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache miss(es) 2018.07.04 09:59:36 LOG7[0]: 0 external session cache hit(s) 2018.07.04 09:59:36 LOG7[0]: 0 expired session(s) retrieved 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=10) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) initialized 2018.07.04 09:59:36 LOG7[0]: TLS alert (read): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Sent socket write shutdown 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) closed 2018.07.04 09:59:36 LOG7[0]: Local descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [server] finished (0 left) 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGCHLD 2018.07.04 09:59:36 LOG7[main]: Retrieving pid statuses with waitpid() 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02000004 (+0x00000000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: No certificate or private key specified 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] started 2018.07.04 09:59:36 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:4433: waiting 10 seconds 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) initialized 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server done 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: Peer certificate was cached (1241 bytes) 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 client renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Sending close_notify alert 2018.07.04 09:59:36 LOG7[0]: TLS alert (write): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] finished (0 left) 2018.07.04 09:59:36 LOG7[0]: Deallocating section defaults 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGNAL_TERMINATE 2018.07.04 09:59:36 LOG7[main]: Leak detection table utilization: 86/997, 8.63% 2018.07.04 09:59:36 LOG7[main]: Removed pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[main]: Deallocating section defaults Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division T: +44 (0)113 344 3970<tel:00441133443970> M: +44 (0)7852 404240<tel:00447852404240> E: Ian.Bamforth(a)tracsis.com<mailto:[email protected]> W: www.tracsis.com<https://www.tracsis.com> www.tracsisops.com<http://www.tracsisops.com> Follow Us [https://static.tracsis.com/email/lin2.png]<https://www.linkedin.com/company/972873?trk=tyah&trkInfo=idx:1-1-1,tarId:14…> [https://static.tracsis.com/email/twi2.png] <https://www.twitter.com/tracsis> Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF [https://static.tracsis.com/email/award4.png] Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error.

1 0

stunnel on Windows - using CAPI - tls v1.2?==?utf-8?q? ?
by Brian Ipsen 04 Jul '18

04 Jul '18

Hi Does anyone know whether there is a fix pending for being able to use the Windows built-in certificate store (by CAPI) for client authentication - and using TLS v1.2 ? Currently I need to force the stunnel client to use TLS v1.1, as there seem to be a limitation somewhere if using TLS v1.2... Regards Brian

1 0

tls linger
by Daniel Trickett 03 Jul '18

03 Jul '18

Hi, We are using stunnel to allow us to punchout to suppliers using TLS 1.2 protocol. We are seeing the following with this particular supplier. 2018.07.02 08:49:05 LOG6[4]: TLS connected: previous session reused 2018.07.02 08:49:05 LOG6[4]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-SHA384 (256-bit encryption) 2018.07.02 08:49:05 LOG7[4]: Compression: null, expansion: null 2018.07.02 08:49:15 LOG3[4]: SSL_read: Connection reset by peer (131) 2018.07.02 08:49:15 LOG5[4]: Connection reset: 1720 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.02 08:49:15 LOG7[4]: linger (remote): Invalid argument (22) 2018.07.02 08:49:15 LOG7[4]: Remote descriptor (FD=13) closed 2018.07.02 08:49:15 LOG7[4]: Local descriptor (FD=3) closed 2018.07.02 08:49:15 LOG7[4]: Service [dell-https] finished (0 left) We have set socket = l:SO_LINGER=1:60, but still occasionally have an issue. Is there anything else that we may need to set? Since the below is default, would not expect to set it.. socket = a:SO_REUSEADDR=no disable address reuse (enabled by default) Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 168, Issue 2
by Avinash Kumar 03 Jul '18

03 Jul '18

Hi, As requested, Posting my configuration. [https-App-setup] client = yes accept = 9898 connect = <<source-ipaddress>>:9898 cert = <<stunnel-installationdirectory>>\config\App\morpheus.pem key = <<stunnel-installationdirectory>>\config\App\morpheus.key CAfile = <<stunnel-installationdirectory>>\config\App\root-ca.pem sslVersion = TLSv1 options = NO_SSLv3 Regards, Avinash Kumar On Tue, Jul 3, 2018 at 3:30 PM, <stunnel-users-request(a)stunnel.org> wrote: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: Stunnel Issue (Flo Rance) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 3 Jul 2018 11:18:03 +0200 > From: Flo Rance <trourance(a)gmail.com> > To: Avinash Kumar <avinash14331(a)gmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Stunnel Issue > Message-ID: > <CAHogYcUn6BzfBr75X-DuteetppESv2KOjGJmGO7mc=SuHVaE > Xw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Please post your configuration. Without that, it's not obvious. > > Regards, > Flo > > On Tue, Jul 3, 2018 at 10:42 AM, Avinash Kumar <avinash14331(a)gmail.com> > wrote: > > > Attaching the screenshot > > > > Regards, > > Avinash Kumar > > > > On Tue, Jul 3, 2018 at 2:11 PM, Avinash Kumar <avinash14331(a)gmail.com> > > wrote: > > > >> Hi, > >> > >> I am getting below error while connecting through stunnel: > >> > >> > >> > >> Regards, > >> Avinash Kumar > >> > > > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > >

2 1

Stunnel Issue
by Avinash Kumar 03 Jul '18

03 Jul '18

Hi, I am getting below error while connecting through stunnel: Regards, Avinash Kumar

2 2

stunnel 5.48 released
by Michal Trojnara 02 Jul '18

02 Jul '18

Dear Users, I have released version 5.48 of stunnel. Version 5.48, 2018.07.02, urgency: HIGH * Security bugfixes - Fixed requesting client certificate when specified as a global option. * New features - Certificate subject checks modified to accept certificates if at least one of the specified checks matches. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 1011d5a302ce6a227882d094282993a3187250f42f8a801dcc1620da63b2b8df stunnel-5.48.tar.gz eb160fdf28061eb509e09824ab9cd26f4f0ca9be3b90008bba32274d5136c7eb stunnel-5.48-win32-installer.exe 667ee8c8d5440117285eb5a5ddf0d305a6dd1dbb93dcf5b7bac62f84ddba7466 stunnel-5.48-android.zip Best regards, Mike

1 0

tls question
by Daniel Trickett 02 Jul '18

02 Jul '18

Hi, If I use stunnel 5.44, how do I know that the protocol being used is TLS1.2? Is it the default? Working with supplier sites which still accept 1.0/1.1, but want to make sure that I am using 1.2, as they will be disabling the older protocols. Thanks and Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

4 3

Potentially dangerous change of behavior in handling "global option" in stunnel after version 5.45
by Tony Cheneau 29 Jun '18

29 Jun '18

Hello everyone, I was updating my version of stunnel and playing my regression suite and I was surprised to see some tests fail. We usually apply "verify = 2" as global option at the beginning of the configuration file on our stunnel "server" so as to enforce the client certificate verification. So I was a little bit surprise to see I could establish a TLS connection with my test server without providing a client certificate. The "verify = 2" as a "global option" is parsed at some point, because I can trigger an error message if I place a bogus value ("verify = 8"). Yet, it seems to be ignored when accepting connections. If I move the "verify = 2" from the "global option" to a service-level option for a specific service/tunnel, it works as expected (and documented): it rejects my certificate-less client. After a little bit of investigation, I was able to narrow down the change of behavior in version 5.45 (meaning that 5.44 still follow the old behavior). All the newer version follow this new behavior. I haven't seen any public CVS/SVN/git for stunnel, so I was not able to narrow it down further and I could not identify the exact change in the code that modified the behavior. While I understand that this option is documented in the manpage as a service-level option, in practice, "verify" could be used as a global option for years (my oldest documented usage at my company dates back from stunnel 4.54). (I know this option is going to be replaced by verifyChain/requireCert, the observed behavior reported in this email also applies on these options: they can't be applied program wide as a "global option") Am I missing something obvious here ? I haven't seen the change documented in the changelog, so it looks like a regression to me. Thank you in advance (and thank you for the great piece of software, obviously!). Regards, Tony Cheneau

1 0

Re: [stunnel-users] stunnel 5.47 released
by Eric S Eberhard 28 Jun '18

28 Jun '18

Query -- how does this relate to TLSv1.3 and the alpha version (which is not going to work with the final version -- and does not exist I think) -- and what version of openssl do you recommend? Thanks, Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Friday, June 22, 2018 11:10 PM To: stunnel-users(a)stunnel.org; stunnel-announce(a)stunnel.org; openssl-users(a)openssl.org Subject: [stunnel-users] stunnel 5.47 released Dear Users, I have released version 5.47 of stunnel. Version 5.47, 2018.06.23, urgency: HIGH * New features - Fast add_lock_callback for OpenSSL < 1.1.0. This largely improves performance on heavy load. - Automatic detection of Homebrew OpenSSL. - Clarified port binding error logs. - Various "make test" improvements. * Bugfixes - Fixed a crash on switching to SNI slave sections. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c4e675db996eb92beef885f72a3ed8af3c7603fea6b99d2873198dd6c0021d0b stunnel-5.47.tar.gz 985e1d65a3f4a7599cc78630960e1b2c97981f91ce6bc41f2eefcd371b4067a3 stunnel-5.47-win32-installer.exe 309cfb79329448f0c134aece0d10d0737e3728b25c288e9a76650837cd6f839c stunnel-5.47-android.zip Best regards, Mike

1 0

question regarding TLS connection.
by Daniel Trickett 26 Jun '18

26 Jun '18

Hi We are using stunnel 5.44. We are having an issue connecting with a customer who is not supporting TLS 1.1, only 1.2 and 1.3. When I look in the log, I see the following. Why do I see the SSLv3 note in the line? The below leads me to believe that we connect to the customer, but they say that we are not. 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read server certificate A 2018.06.25 11:37:24 LOG6[7]: Client certificate not requested 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read server done A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write client key exchange A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write change cipher spec A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write finished A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 flush data 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read finished A 2018.06.25 11:37:24 LOG7[7]: 1 client connect(s) requested 2018.06.25 11:37:24 LOG7[7]: 1 client connect(s) succeeded 2018.06.25 11:37:24 LOG7[7]: 0 client renegotiation(s) requested 2018.06.25 11:37:24 LOG7[7]: 0 session reuse(s) 2018.06.25 11:37:24 LOG6[7]: TLS connected: new session negotiated Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence - 7/2/2018 - 7/6/2018 MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email daniel.trickett(a)emdmillipore.com<mailto:[email protected]> This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

2 1

stunnel 5.47 released
by Michal Trojnara 23 Jun '18

23 Jun '18

Dear Users, I have released version 5.47 of stunnel. Version 5.47, 2018.06.23, urgency: HIGH * New features - Fast add_lock_callback for OpenSSL < 1.1.0. This largely improves performance on heavy load. - Automatic detection of Homebrew OpenSSL. - Clarified port binding error logs. - Various "make test" improvements. * Bugfixes - Fixed a crash on switching to SNI slave sections. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c4e675db996eb92beef885f72a3ed8af3c7603fea6b99d2873198dd6c0021d0b stunnel-5.47.tar.gz 985e1d65a3f4a7599cc78630960e1b2c97981f91ce6bc41f2eefcd371b4067a3 stunnel-5.47-win32-installer.exe 309cfb79329448f0c134aece0d10d0737e3728b25c288e9a76650837cd6f839c stunnel-5.47-android.zip Best regards, Mike

2 1

Stunnel 5.45 and 5.46 crashes upon reconnect HTTPS
by Javier 22 Jun '18

22 Jun '18

Hi, isn't annoying when you are using an old version, 5.44, and all goes fine, you notice you are outdated and then comes the problems after update? :-P The thing is that yesterday I needed the HTTPS server so I run Stunnel 5.44 for my non-SSL app and all was fine. I updated to 5.46 just because I forgot the last time and didn't even run again because I didn't need it. Today I used it and... I had a crash. I tested 5.45 to trace versions back, and it crashes as well. Back to 5.44 and no crash. The crash happens when there is a reload/reconnect/multiconnect (example, 2 connections html+images) by the browser when connects to an HTTPS server. It only happens when using a SNI service. I've been able to trace back the log on those versions and when fails in 5.45 and 5.46 is at the time when it needs to switch to the SNI service. (log from 5.44) SNI: requested servername: xxx SNI: matched pattern: xxx SNI: switched to service [xxx] <<<<----- BEFORE SWITCH, IT CRASHES on 5.45 and 5.46 Imagine you load https://xxx/. The first time is fine, the second, crashes stunnel. Not happening with 5.44. I haven't seen any change to SNI in manual so... :-? These are the configs for the used virtual servers. Nothing has been changed, anyway: [SSL] client = no accept = y.y.y.1:4747 connect = y.y.y.2:443 [SSL-xxx-SNI] client = no sni = SSL:xxx connect = y.y.y.2:443 cert = pem key = pem Don't mind the port numbers. They aren't in conflict. Running on Windows 2000. Regards.

3 4

Reg : Stunnel + RSYNC Usage with TLSv1.2
by Sakthivel Ganesamoorthy 20 Jun '18

20 Jun '18

Hi, I have configured a server and client for Stunnel + Rsync usage over TLSv1.2. It is working fine, but I wanted to verify the "Cipher Key" exchange mechanism between "Server & Client" via "Wireshark". When I captured the logs via "Wireshark", it shows everything as TCP messages and I don't see any "Client Hello message (or) Cipher Key exchange message (or) any of the TLSv1.2" handshake messages. Please let me know whether I'm missing something here. Thanks, Sakthi

1 0

stunnel used as jump host for SFTP
by Schultz, Cecilia 20 Jun '18

20 Jun '18

Hello, I am trying to test stunnel to see if it can provide the functionality we need. We are a Windows shop. What we need is for multiple client machines (I call these C1, C2, C3) to connect to our server (S). Server S will connect to a remote SFTP server (port 22). I call the remote SFTP server "R". C1, C2, C3 and S are all inside our firewall. Currently S can connect and send files to R using SFTP (port 22). The problem is that R does not accept a range of IP addresses, and has a limit on the number of IP addresses they can accept. So, what I need is for C1, C2, C3 to be able to connect to server R using S as a jump host. >From R's perspective, it should be like the connection is coming from S. Question 1: can stunnel be used to accomplish this? Question 2: I have installed stunnel in a test server ("stunnel -install" actually from the bin folder), and configured the conf like this: [sftp] accept=127.0.0.1:22 connect=some.remote.server.com:22 I tried to use Winscp SFTP client to test a connection, but it times out. I then checked S, and I don't see anything listening on port 22. I did "netstat -a" and I don't see anything listening on port 22. Was something wrong in the "stunnel -install" command? Shouldn't it be listening on port 22? Also, I uncommented the entry for log, but I don't see any log file in the stunnel folder/subfolders ; Debugging stuff (may be useful for troubleshooting) debug = info output = stunnel.log Thanks for your help, Cecilia

3 3

Re: [stunnel-users] stunnel used as jump host for SFTP
by Schultz, Cecilia 20 Jun '18

20 Jun '18

Thank you so much for the info! I will try this out. From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Harris, Douglas (SSC/SPC) Sent: Wednesday, June 20, 2018 5:08 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel used as jump host for SFTP You can accomplish this in Windows. Just add a port forwarding rule to S: netsh interface portproxy add v4tov4 listenport=22 listenaddress=[IP of S] connectport=22 connectaddress=[IP of R] -Doug

1 0

stunnel PSK support via custome openssl engine
by Tarakeshwar Rao 14 Jun '18

14 Jun '18

Dear Stunnel-users, >From Stunnel man pages, I could see that we could read PSK secret from plain text file with following option: PSKsecrets = psk.txt Could it possible to use custom openssl engine to read PSK file from HSM. I know that this works for reading TLS keys. I am not sure how I could do it for PSK. Thanks for your support, Regards, Tarak

1 0

is it possible to make stunnel works for dbmail timsieved?
by cktmwe＠gmail.com 12 Jun '18

12 Jun '18

hello everyone, I'm currently try to stunnel sieve traffic to local dbmail timsieved, unfortunately I couldn't get it to work, my first question, does stunnel support sieve manage protocol? secondly if it does, how can I config the service? what I've done so far. timsieved started on 127.0.0.1:2000, connect and manage all works, I saw connection in dbmail log, then define sieve service block in stunnel.conf, restart stunnel, but if I connect our.public.ip:4190, timsieved becames no connection at all, dbmail log kept silent. traffic from port 4190 is already accepted in iptables. config that I used. > [sieve] > accept = our.public.ip:4190 > connect = 127.0.0.1:2000 > software version: stunnel-5.43 dbmail-3.2.3 Thanks.

2 1

Slow DNS lookups when DNS does not respond
by Guillermo Rodriguez Garcia 08 Jun '18

08 Jun '18

Hi all, I have stunnel setup on a Linux box and I am experiencing very slow DNS lookup times when DNS does not respond. On this same system, anything that results in a DNS lookup (e.g. ping, ...) takes about 20 seconds before it times out and fails. However with stunnel (and a single service configured) the lookup takes more than 1 minute (approx 80 seconds). Is there any way to configure this? Thank you, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

1 0

Windows 2016 Server: [!] bind: Address already in use (WSAEADDRINUSE) (10048)
by Martin Schweizer 06 Jun '18

06 Jun '18

Hello List My problem: If I run stunnel I regular get the below error: [.] stunnel 5.46 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2o-fips 27 Mar 2018 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [smtps] [ ] GUI message loop initialized [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [smtps] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [smtps] [ ] Listening file descriptor created (FD=676) [ ] Setting accept socket options (FD=676) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket >>> [!] bind: Address already in use (WSAEADDRINUSE) (10048) <<<< [!] Error binding service [smtps] to 192.168.10.62:11465 [!] Could not bind any accepting port [ ] Deallocating section defaults [ ] Unbinding service [smtps] [ ] Service [smtps] closed [ ] Deallocating section [smtps] I had the same problem with the previous versions aswell. To temporary resolv the problem I have to change the listen port to another number. Reread the config file and let the stunnel GUI open. Then all is working until I close the GUI (not each time but most of). My system: - Windows 2016 Server - stunnel-5.46 - stunnel installed as service and GUI My config file (relevant part): taskbar = yes client=yes [smtps] ;delay = yes accept = 192.168.10.62:11466 connect = server.domain.ch:465 cert = stunnel.pem local = 192.168.10.53 (this is dedicated address) I found a similar threat in the archives (but on Linux): https://www.stunnel.org/pipermail/stunnel-users/2018-February/005935.html Here is Microsoft's describtion about WSAEADDRINUSE) (10048): https://msdn.microsoft.com/en-us/library/windows/desktop/ms740668(v=vs.85).… All helps are welcome. Kind regards, -- Martin Schweizer PC-Service M. Schweizer GmbH; Bannholzstrasse 6; Postfach 132; CH-8608 Bubikon; Tel. +41 55 243 30 00; Fax: +41 55 243 33 22

1 0

port-only accept value binds to 127.0.0.1, instead of the wildcard address
by Poor Yorick 30 May '18

30 May '18

The stunnel 6.45 documentation for "accept" states, "If no host specified, defaults to all IPv4 addresses for the local host." In this case, stunnel actually binds to 127.0.0.1. Indeed, inspection of the relevant code paths reveals that addr_list->passive is never set to 1 in this case. To get stunnel to bind to all addresses, 0.0.0.0 must be explicitly specified. Furthermore, inspection of the code path for the "local" option reveals that addr_list->passive is set to 1 in this case, which seems to be backwards: The documentation for getaddrinfo states that AI_PASSIVE is ignored in this case. The logic for these two cases seems to be reversed. -- Yorick

1 0

stunnel 5.46 released
by Michal Trojnara 28 May '18

28 May '18

Dear Users, I have released version 5.46 of stunnel. Version 5.46, 2018.05.28, urgency: MEDIUM * New features - The default cipher list was updated to a safer value: "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK". * Bugfixes - Default accept address restored to INADDR_ANY. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 76aab48c28743d78e4b2f6b2dfe49994b6ca74126046c179444f699fae7a84c7 stunnel-5.46.tar.gz 721cc4d7c385743df767a32a53c11477def2440ae20ad4538d8e685f7b7d6538 stunnel-5.46-win32-installer.exe d08a3b3598868064db08d6f0e3a97e3c49dedbf6c8d7f348a613b832eca16dd6 stunnel-5.46-android.zip Best regards, Mike

1 0

Stunnel stopps in Windows Failover Cluster
by Tobias Gillstöm 28 May '18

28 May '18

Hi, I'm having problems with Stunnel in a Windows Failover Cluster. When a failover happens and the stunnel service changes node that it's running on, the service changes node just fine but the stunnel service dosen't appear to be doing anything? If anyone has some prior knowledge about Stunnel in a Windows Failover Cluster i would appreciate the help :)

1 0

stunnel and CAPI on Windows
by Brian Ipsen 23 May '18

23 May '18

Hi I am trying to use the Microsoft certificate store/API for client validation of Windows hosts towards an F5. Everything works, when we use file-based certificates - but for security purposes I would prefer to use the windows certificate store, and set the private key on the client as non-exportable... I have enabled the engineId = capi in the global section of stunnel.conf - and for the required client/service I have: [F5CertAdmin] client=yes accept = 127.0.0.1:1679 connect = w.x.y.z:443 delay = yes sni = ssl79admpki.xxxx.com CApath = C:\Program Files (x86)\stunnel\config\certs CAFile = C:\Program Files (x86)\stunnel\config\certs\GlobalSign-Cert-Chain.pem verify = 2 engineId = capi key = BaaSClientCertificateCP cert = BaaSClientCertificateCP I have a certificate in the local computer certificate store with the supplied name - but stunnel is not able to locate it... Is it because it will look under the user account? If yes, will it look under the local machine when running as local system ? The output from stunnel says: [ ] Initializing service [F5CertAdmin] [ ] Ciphers: HIGH:!DH:!aNULL:!SSLv2 [ ] TLS options: 0x03000004 (+0x03000000, -0x00000000) [ ] Client certificate engine (capi) enabled [ ] Loading certificate from engine ID: BaaSClientCertificateCP [!] ENGINE_ctrl_cmd: Peer suddenly disconnected [ ] Initializing private key on engine ID: BaaSClientCertificateCP [!] ENGINE_load_private_key: 26096080: error:26096080:engine routines:ENGINE_load_private_key:failed loading private key [ ] Loading certificate from file: BaaSClientCertificateCP [!] error queue: 140DC002: error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib [!] error queue: 20074002: error:20074002:BIO routines:FILE_CTRL:system lib [!] SSL_CTX_use_certificate_chain_file: 2001002: error:02001002:system library:fopen:No such file or directory [!] Service [F5CertAdmin]: Failed to initialize TLS context @am6pr03mb3813.eurprd03.prod.outlook.com>Any advice appreciated... Thanks Brian

1 0

stunnel 5.45 released
by Michal Trojnara 21 May '18

21 May '18

Dear Users, I have released version 5.45 of stunnel. Version 5.45, 2018.05.21, urgency: MEDIUM * New feature sponsored by https://loadbalancer.org/ - Implemented delayed deallocation of service sections after configuration file reload. * Other new features - OpenSSL DLLs updated to version 1.0.2o. - Deprecated the sslVersion option. - The "socket" option is now also available in service sections. - Implemented try-restart in the SysV init script (thx to Peter Pentchev). - TLS 1.3 compliant session handling for OpenSSL 1.1.1. - Default "failover" value changed from "rr" to "prio". - New "make check" tests. * Bugfixes - A service no longer refuses to start if binding fails for some (but not all) addresses:ports. - Fixed compression handling with OpenSSL 1.1.0 and later. - _beginthread() replaced with safer _beginthreadex(). - Fixed exception handling in libwrap. - Fixed exec+connect services. - Fixed automatic resolver delaying. - Fixed a Gentoo cross-compilation bug (thx to Joe Harvell). - A number of "make check" framework fixes. - Fixed false postive memory leak logs. - Build fixes for OpenSSL versions down to 0.9.7. - Fixed (again) round-robin failover in the FORK threading model. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 548244839b8a4bf4dffea46c97893b203d1b9eed118c3dd6a9ac4d8d02592ee3 stunnel-5.45.tar.gz fc13a224c7ec1290035efe8317c53d62a0980a5ab2efe8930b06aae269fbe873 stunnel-5.45-win32-installer.exe 29025eaed007c62856f16c7a8a22f9713eee9762ed95009f6f91f729c35c0bc0 stunnel-5.45-android.zip Best regards, Mike

1 0

configuring Stunnel
by support 20 May '18

20 May '18

The config as described hereby did work properly a few times giving a secured connection. All of a sudden this is no longer working? Any suggestions? Namens IMS evba Paul Waegemans +32475341310 <mailto:[email protected]> support(a)imseuro.be <http://eu.ntrsupport.com/inquiero/web/digisign/digisign.asp?login=I23EBF509 C6B51A9E700D43&lang=nl>

1 0

UTF8 BOM in PSKsecrets file
by Jakob Hirsch 17 May '18

17 May '18

Hi! I just found out (after a while of troubleshooting) that stunnel does not handle UTF-8 BOM in the PSKsecrets file, i.e. the BOM is considered part of the identity (tested with 5.44, 5.45b4 and 5.45b6 on Windows 10 1709). It was a little tricky to figure this out, as the BOM is apparently filtered out in the logs, e.g. the server just says 'No key found for PSK identity "client1"'. Ok, nobody says that this is supported or that you should do it, it just happens automatically when you click "Edit Configuration" in the Windows GUI and click "Save as" (out of convenience, because you will already be in the config directory then), because the sample config has a BOM and Notepad will also insert a BOM in the new file. I don't know how much work it would be to handle the BOM correctly or at least print a warning (didn't look at the code, sorry), a warning in the manual would probably sufficient, as it could be that I'm the first one to stumble over this (at least I didn't find anything about it on the net). Regards (and thanks for this nice piece of software) Jakob

1 0

Windows Server 2012 R2
by Daniel McArdell 17 May '18

17 May '18

Hello, I have joined the mail group in the hope that someone can help with problems I am having running on our Server machine. I downloaded "stunnel-5.45b6-win64-installer" and installed it on our Server. When I run the executable I get: 2018.05.17 12:48:33 LOG5[main]: stunnel 5.45 on x64-pc-msvc-1913 platform 2018.05.17 12:48:33 LOG5[main]: Compiled/running with OpenSSL 1.1.0g 2 Nov 2017 2018.05.17 12:48:33 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2018.05.17 12:48:33 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.17 12:48:33 LOG5[main]: UTF-8 byte order mark detected 2018.05.17 12:48:33 LOG5[main]: Configuration successful The shortcut [cid:[email protected]] I was expecting to get a GUI interface but that does not happen. Can someone tell me what is going wrong. I feel as though I have missed something obvious. Daniel McArdell | Senior Analyst Programmer | Products & Technology | BNZ<http://www.bnz.co.nz/> L6 Custom House, 17 Whitmore St, Wellington 6011 DDI +64 4 4746679 (extn 76679) | F +64 4 4746023 | M +64 29 2220451 | E Daniel_McArdell(a)bnz.co.nz<mailto:[email protected]?Subject=> CAUTION - This message may contain privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that any use, dissemination, distribution or reproduction of this message is prohibited. This email was sent by the Bank of New Zealand. You can contact us on 0800 ASK BNZ (0800 275 269). Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of Bank of New Zealand.

1 0

stunnel with client-auth via proxy-server
by jack.reacher＠gmx.de 16 May '18

16 May '18

2 1

Stunnel running as service on Windows Server 2008 R2 but Stunnel All Users shortcut on the desktop reports that it server is down?
by Alex Birchall 16 May '18

16 May '18

Hello, I have Stunnel running as a service on a Windows Server 2008 R2. But the shortcut on the desktop "Stunnel All Users", when launched, informs me that the server is down due to an "invalid configuration file". In the config file, if Stunnel is being run as a service, should it be "client = no" or "server = yes"? Many thanks. Best regards, Alex

2 2

SMTP Authentication failed
by Ian Coetzee 15 May '18

15 May '18

Hi List, I have just joined the stunnel community. I am in the process of migrating our mailserver's public facing ports to stunnel for PCI compliance reasons. So far i have managed to get working: - imap (143/tcp) with starttls - imaps (993/tcp) - pop3 (110/tcp) with starttls - pop3s (995/tcp) My trouble is with smtp(25/tcp,587/tcp) with starttls. I have now tried a couple different mail clients and everyone of them tells me that the server does not support the authentication protocols. I have installed stunnel 5.44. Tee relevant parts in my config: [mail2-imap] protocol = imap accept = 143 connect = <mail-fqdn>:143 [mail2-imaps] accept = 993 connect = <mail-fqdn>:143 [mail2-pop3] protocol = pop3 accept = 110 connect = <mail-fqdn>:110 [mail2-pop3s] accept = 995 connect = <mail-fqdn>:110 [mail2-smtp] protocol = smtp accept = 25 connect = <mail-fqdn>:25 [mail2-smtps] accept = 465 connect = <mail-fqdn>:465 [mail2-smtps-submission] debug = 7 protocol = smtp accept = 587 connect = <mail-fqdn>:587 In the logfile I have the following entries upon connecting 2018.04.30 09:20:50 LOG7[5]: Service [mail2-smtps-submission] started 2018.04.30 09:20:50 LOG7[5]: Option TCP_NODELAY set on local socket 2018.04.30 09:20:50 LOG5[5]: Service [mail2-smtps-submission] accepted connection from 41.13.8.49:56890 2018.04.30 09:20:50 LOG6[5]: s_connect: connecting 10.10.11.2:587 2018.04.30 09:20:50 LOG7[5]: s_connect: s_poll_wait 10.10.11.2:587: waiting 10 seconds 2018.04.30 09:20:50 LOG5[5]: s_connect: connected 10.10.11.2:587 2018.04.30 09:20:50 LOG5[5]: Service [mail2-smtps-submission] connected remote server from 10.10.11.11:42466 2018.04.30 09:20:50 LOG7[5]: Option TCP_NODELAY set on remote socket 2018.04.30 09:20:50 LOG7[5]: Remote descriptor (FD=23) initialized 2018.04.30 09:20:50 LOG7[5]: RFC 2487 detected 2018.04.30 09:20:50 LOG7[5]: <- 220 <mail-fqdn> ESMTP Postfix 2018.04.30 09:20:50 LOG7[5]: -> 220 <mail-fqdn> stunnel for ESMTP Postfix 2018.04.30 09:20:51 LOG7[5]: <- EHLO [100.125.153.220] 2018.04.30 09:20:51 LOG7[5]: -> 250-<mail-fqdn> 2018.04.30 09:20:51 LOG7[5]: -> 250 STARTTLS 2018.04.30 09:20:51 LOG7[5]: <- STARTTLS 2018.04.30 09:20:51 LOG7[5]: -> 220 Go ahead 2018.04.30 09:20:51 LOG6[5]: Peer certificate not required 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): before/accept initialization 2018.04.30 09:20:51 LOG7[5]: SNI: no virtual services defined 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 read client hello A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write server hello A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write certificate A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write key exchange A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write server done A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 flush data 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 read client certificate A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read client key exchange A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read certificate verify A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read finished A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 write change cipher spec A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 write finished A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 flush data 2018.04.30 09:20:52 LOG7[5]: New session callback 2018.04.30 09:20:52 LOG7[5]: 2 server accept(s) requested 2018.04.30 09:20:52 LOG7[5]: 2 server accept(s) succeeded 2018.04.30 09:20:52 LOG7[5]: 0 server renegotiation(s) requested 2018.04.30 09:20:52 LOG7[5]: 0 session reuse(s) 2018.04.30 09:20:52 LOG7[5]: 2 internal session cache item(s) 2018.04.30 09:20:52 LOG7[5]: 0 internal session cache fill-up(s) 2018.04.30 09:20:52 LOG7[5]: 0 internal session cache miss(es) 2018.04.30 09:20:52 LOG7[5]: 0 external session cache hit(s) 2018.04.30 09:20:52 LOG7[5]: 0 expired session(s) retrieved 2018.04.30 09:20:52 LOG6[5]: TLS accepted: new session negotiated 2018.04.30 09:20:52 LOG6[5]: No peer certificate received 2018.04.30 09:20:52 LOG6[5]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2018.04.30 09:20:52 LOG7[5]: Compression: null, expansion: null 2018.04.30 09:20:52 LOG6[5]: Read socket closed (read hangup) 2018.04.30 09:20:52 LOG7[5]: Sending close_notify alert 2018.04.30 09:20:52 LOG7[5]: TLS alert (write): warning: close notify 2018.04.30 09:20:52 LOG6[5]: SSL_shutdown successfully sent close_notify alert 2018.04.30 09:20:52 LOG6[5]: TLS fd: Connection reset by peer (104) 2018.04.30 09:20:52 LOG6[5]: TLS socket closed (SSL_read) 2018.04.30 09:20:52 LOG7[5]: Sent socket write shutdown 2018.04.30 09:20:52 LOG5[5]: Connection closed: 156 byte(s) sent to TLS, 30 byte(s) sent to socket 2018.04.30 09:20:52 LOG7[5]: Remote descriptor (FD=23) closed 2018.04.30 09:20:52 LOG7[5]: Local descriptor (FD=22) closed 2018.04.30 09:20:52 LOG7[5]: Service [mail2-smtps-submission] finished (4 left) This is the error I am getting from K9-Mail The google mail app just tells me: Alpine (linux commandline smtp client) Any advise from the gurus? Kind regards Ian

1 1

Error with negotiation OK
by Alix Janeth Jerez 15 May '18

15 May '18

Hi I am using lastest stunnel version. When i try to send an email, i get: "error permanente de SMTP: 503 Bad sequence of commands". This is the trace generated when I try to send an email. 2018.05.14 12:59:08 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.14 12:59:08 LOG5[main]: UTF-8 byte order mark not detected 2018.05.14 12:59:08 LOG5[main]: FIPS mode disabled 2018.05.14 12:59:08 LOG5[main]: Configuration successful 2018.05.14 12:59:08 LOG7[main]: Binding service [pseudo-ssmtp] 2018.05.14 12:59:08 LOG7[main]: Listening file descriptor created (FD=568) 2018.05.14 12:59:08 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.05.14 12:59:08 LOG7[main]: Service [pseudo-ssmtp] (FD=568) bound to 172.31.41.84:116 2018.05.14 12:59:08 LOG7[main]: Signal pipe is empty 2018.05.14 12:59:22 LOG7[main]: Found 1 ready file descriptor(s) 2018.05.14 12:59:22 LOG7[main]: FD=324 ifds=r-x ofds=r-- 2018.05.14 12:59:22 LOG7[main]: Dispatching signals from the signal pipe 2018.05.14 12:59:22 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2018.05.14 12:59:22 LOG7[main]: Running on Windows 6.1 2018.05.14 12:59:22 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.14 12:59:22 LOG5[main]: UTF-8 byte order mark not detected 2018.05.14 12:59:22 LOG5[main]: FIPS mode disabled 2018.05.14 12:59:22 LOG7[main]: Compression disabled 2018.05.14 12:59:22 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2018.05.14 12:59:22 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2018.05.14 12:59:22 LOG7[main]: PRNG seeded successfully 2018.05.14 12:59:22 LOG6[main]: Initializing service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.05.14 12:59:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, 0x00000000) 2018.05.14 12:59:22 LOG6[main]: Loading certificate from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Certificate loaded from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Loading private key from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Private key loaded from file: stunnel.pem 2018.05.14 12:59:22 LOG7[main]: Private key check succeeded 2018.05.14 12:59:22 LOG5[main]: Configuration successful 2018.05.14 12:59:22 LOG7[main]: Unbinding service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] closed (FD=568) 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] closed 2018.05.14 12:59:22 LOG7[main]: Binding service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Listening file descriptor created (FD=568) 2018.05.14 12:59:22 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] (FD=568) bound to 172.31.41.84:116 2018.05.14 12:59:22 LOG7[main]: Signal pipe is empty 2018.05.14 12:59:34 LOG7[main]: Found 1 ready file descriptor(s) 2018.05.14 12:59:34 LOG7[main]: FD=324 ifds=r-x ofds=--- 2018.05.14 12:59:34 LOG7[main]: Service [pseudo-ssmtp] accepted (FD=584) from 172.31.41.84:53557 2018.05.14 12:59:34 LOG7[main]: Creating a new thread 2018.05.14 12:59:34 LOG7[main]: New thread created 2018.05.14 12:59:34 LOG7[37]: Service [pseudo-ssmtp] started 2018.05.14 12:59:34 LOG7[37]: Option TCP_NODELAY set on local socket 2018.05.14 12:59:34 LOG5[37]: Service [pseudo-ssmtp] accepted connection from 172.31.41.84:53557 2018.05.14 12:59:34 LOG6[37]: failover: round-robin, starting at entry #1 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 212.227.15.158:465 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 212.227.15.158:465: waiting 10 seconds 2018.05.14 12:59:34 LOG5[37]: s_connect: connected 212.227.15.158:465 2018.05.14 12:59:34 LOG5[37]: Service [pseudo-ssmtp] connected remote server from 172.31.41.84:53558 2018.05.14 12:59:34 LOG7[37]: Option TCP_NODELAY set on remote socket 2018.05.14 12:59:34 LOG7[37]: Remote descriptor (FD=552) initialized 2018.05.14 12:59:34 LOG6[37]: SNI: sending servername: smtp.1and1.es 2018.05.14 12:59:34 LOG6[37]: Peer certificate required 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): before/connect initialization 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): SSLv2/v3 write client hello A 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): SSLv3 read server hello A 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=2: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG7[37]: OCSP: Ignoring root certificate 2018.05.14 12:59:34 LOG6[37]: Certificate accepted at depth=2: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=1: C=US, O="thawte, Inc.", CN=thawte SSL CA - G2 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG5[37]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 23.5.251.27:80: waiting 10 seconds 2018.05.14 12:59:34 LOG5[37]: s_connect: connected 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: OCSP: Connected t2.symcb.com:80 2018.05.14 12:59:34 LOG7[37]: OCSP: Response received 2018.05.14 12:59:34 LOG6[37]: OCSP: Status: good 2018.05.14 12:59:34 LOG6[37]: OCSP: This update: May 13 18:15:02 2018 GMT 2018.05.14 12:59:34 LOG6[37]: OCSP: Next update: May 20 18:15:02 2018 GMT 2018.05.14 12:59:34 LOG5[37]: OCSP: Certificate accepted 2018.05.14 12:59:34 LOG6[37]: Certificate accepted at depth=1: C=US, O="thawte, Inc.", CN=thawte SSL CA - G2 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=0: C=DE, ST=Rheinland-Pfalz, L=Montabaur, O=1&1 Internet SE, CN=smtp.1and1.es 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG6[37]: CERT: Host name "smtp.1and1.es" matched with "smtp.1and1.es" 2018.05.14 12:59:34 LOG5[37]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 23.5.251.27:80: waiting 10 seconds 2018.05.14 12:59:35 LOG5[37]: s_connect: connected 23.5.251.27:80 2018.05.14 12:59:35 LOG7[37]: OCSP: Connected tj.symcd.com:80 2018.05.14 12:59:35 LOG7[37]: OCSP: Response received 2018.05.14 12:59:35 LOG6[37]: OCSP: Status: good 2018.05.14 12:59:35 LOG6[37]: OCSP: This update: May 14 01:38:59 2018 GMT 2018.05.14 12:59:35 LOG6[37]: OCSP: Next update: May 21 01:38:59 2018 GMT 2018.05.14 12:59:35 LOG5[37]: OCSP: Certificate accepted 2018.05.14 12:59:35 LOG5[37]: Certificate accepted at depth=0: C=DE, ST=Rheinland-Pfalz, L=Montabaur, O=1&1 Internet SE, CN=smtp.1and1.es 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server certificate A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server key exchange A 2018.05.14 12:59:35 LOG6[37]: Client certificate not requested 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server done A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write client key exchange A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write change cipher spec A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write finished A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 flush data 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read finished A 2018.05.14 12:59:35 LOG7[37]: 1 client connect(s) requested 2018.05.14 12:59:35 LOG7[37]: 1 client connect(s) succeeded 2018.05.14 12:59:35 LOG7[37]: 0 client renegotiation(s) requested 2018.05.14 12:59:35 LOG7[37]: 0 session reuse(s) 2018.05.14 12:59:35 LOG6[37]: TLS connected: new session negotiated 2018.05.14 12:59:35 LOG7[37]: Peer certificate was cached (5543 bytes) 2018.05.14 12:59:35 LOG6[37]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.14 12:59:35 LOG7[37]: Compression: null, expansion: null 2018.05.14 12:59:53 LOG3[36]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2018.05.14 12:59:53 LOG5[36]: Connection closed: 15 byte(s) sent to TLS, 166 byte(s) sent to socket I can't find the error. Thanks in advance for your help. Best regards, Alix

2 5

stunnel-5.44 fails cross compile due to wrong include path in Gentoo....fix available
by Joe Harvell 14 May '18

14 May '18

The src/Makefile.am hardcodes -I/usr/kerberos/include. When cross compiling it should be including -I$(SYSROOT)//usr/kerberos/include. I patched configure.ac and Makefile.am, taking advantage of the existing --with-sysroot configure option. The Gentoo bug report: https://bugs.gentoo.org/654374 The patch to configure.ac and Makefile.am: https://654374.bugs.gentoo.org/attachment.cgi?id=528968 I was unable to find a bug reporting system for stunnel. So I guess this is it. Please source this fix. --- Joe Harvell

1 1

help with tls config in stunnel
by Daniel Trickett 10 May '18

10 May '18

Hi, We are running stunnel 5.44 on Solaris. Our b2b legacy system is using TLS 1.0. We have a supplier who recently switched to TLS 1.2 and we can no longer connect to the site from our b2b. How can I configure stunnel to connect to the supplier site using TLS 1.2? TIA. Dan T This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

How to tell if commuications are encrypted?
by Alex Birchall 10 May '18

10 May '18

Hello, I have Stunnel installed on Windows Server 2008 R2, running as a service. I have it installed as a client on a Windows POS 2009 device. This setup is working, in that the client is operating correctly and using Stunnel. But how can I tell if communications between the Stunnel client and the Stunnel server are being encrypted, rather than Stunnel just doing port forwarding? I did read the client needs to have access to the server's certificate, but at the moment it does not. Alex

2 1

Stunnel to Outlook
by DPS Support 09 May '18

09 May '18

I am trying to get a device on my network to send pop email notifications to my outlook account but can't seem to get it to work. I have enabled the outlook account to accept pop and enabled the client to send them. I'm not sure if I'm missing something or what, any help would be greatly appreciated. Here is my config: debug = info output = stunnel.log [outlook-pop3] client = yes accept = 110 connect = pop-mail.outlook.com:995 [outlook-imap] client = yes accept = 143 connect = imap-mail.outlook.com:993 [outlook-smtp] protocol = smtp client = yes accept = 25 connect = smtp-mail.outlook.com:587 Here is the log as well: 2018.05.08 15:15:03 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.05.08 15:15:03 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.05.08 15:15:03 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.05.08 15:15:03 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.08 15:15:03 LOG5[main]: UTF-8 byte order mark detected 2018.05.08 15:15:03 LOG5[main]: FIPS mode disabled 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-pop3] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-pop3] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-imap] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-imap] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-smtp] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-smtp] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG5[main]: Configuration successful 2018.05.08 15:15:03 LOG5[main]: Logging to C:\Users\dps_engineer\AppData\Local\stunnel.log 2018.05.08 15:15:53 LOG5[0]: Service [outlook-pop3] accepted connection from 126.10.230.254:52629 2018.05.08 15:15:53 LOG6[0]: failover: round-robin, starting at entry #1 2018.05.08 15:15:53 LOG6[0]: s_connect: connecting 40.97.135.130:995 2018.05.08 15:15:53 LOG5[0]: s_connect: connected 40.97.135.130:995 2018.05.08 15:15:53 LOG5[0]: Service [outlook-pop3] connected remote server from 126.10.218.222:60145 2018.05.08 15:15:53 LOG6[0]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:15:53 LOG6[0]: Peer certificate not required 2018.05.08 15:15:54 LOG6[0]: Certificate verification disabled 2018.05.08 15:15:54 LOG6[0]: Certificate verification disabled 2018.05.08 15:15:54 LOG6[0]: Client certificate not requested 2018.05.08 15:15:54 LOG6[0]: TLS connected: new session negotiated 2018.05.08 15:15:54 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:15:55 LOG6[0]: Read socket closed (readsocket) 2018.05.08 15:15:55 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2018.05.08 15:15:55 LOG6[0]: TLS socket closed (SSL_read) 2018.05.08 15:15:55 LOG5[0]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:15:55 LOG5[1]: Service [outlook-smtp] accepted connection from 126.10.230.254:52639 2018.05.08 15:15:55 LOG6[1]: failover: round-robin, starting at entry #2 2018.05.08 15:15:55 LOG6[1]: s_connect: connecting 40.97.162.162:587 2018.05.08 15:15:55 LOG5[1]: s_connect: connected 40.97.162.162:587 2018.05.08 15:15:55 LOG5[1]: Service [outlook-smtp] connected remote server from 126.10.218.222:60147 2018.05.08 15:15:55 LOG6[1]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:15:55 LOG6[1]: Peer certificate not required 2018.05.08 15:15:55 LOG6[1]: Certificate verification disabled 2018.05.08 15:15:55 LOG6[1]: Certificate verification disabled 2018.05.08 15:15:55 LOG6[1]: Empty client CA list 2018.05.08 15:15:55 LOG6[1]: TLS connected: new session negotiated 2018.05.08 15:15:55 LOG6[1]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:00 LOG6[1]: TLS socket closed (SSL_read) 2018.05.08 15:16:00 LOG5[1]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket 2018.05.08 15:16:00 LOG5[2]: Service [outlook-pop3] accepted connection from 126.10.230.254:52644 2018.05.08 15:16:00 LOG6[2]: failover: round-robin, starting at entry #2 2018.05.08 15:16:00 LOG6[2]: s_connect: connecting 40.97.161.50:995 2018.05.08 15:16:00 LOG5[2]: s_connect: connected 40.97.161.50:995 2018.05.08 15:16:00 LOG5[2]: Service [outlook-pop3] connected remote server from 126.10.218.222:60149 2018.05.08 15:16:00 LOG6[2]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:16:00 LOG6[2]: Peer certificate not required 2018.05.08 15:16:00 LOG6[2]: Certificate verification disabled 2018.05.08 15:16:00 LOG6[2]: Certificate verification disabled 2018.05.08 15:16:00 LOG6[2]: Client certificate not requested 2018.05.08 15:16:00 LOG6[2]: TLS connected: new session negotiated 2018.05.08 15:16:00 LOG6[2]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:01 LOG6[2]: TLS socket closed (SSL_read) 2018.05.08 15:16:01 LOG5[2]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:16:01 LOG5[3]: Service [outlook-smtp] accepted connection from 126.10.230.254:52647 2018.05.08 15:16:01 LOG6[3]: failover: round-robin, starting at entry #3 2018.05.08 15:16:01 LOG6[3]: s_connect: connecting 40.97.162.146:587 2018.05.08 15:16:01 LOG5[3]: s_connect: connected 40.97.162.146:587 2018.05.08 15:16:01 LOG5[3]: Service [outlook-smtp] connected remote server from 126.10.218.222:60150 2018.05.08 15:16:01 LOG6[3]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:16:01 LOG6[3]: Peer certificate not required 2018.05.08 15:16:01 LOG6[3]: Certificate verification disabled 2018.05.08 15:16:01 LOG6[3]: Certificate verification disabled 2018.05.08 15:16:01 LOG6[3]: Empty client CA list 2018.05.08 15:16:01 LOG6[3]: TLS connected: new session negotiated 2018.05.08 15:16:01 LOG6[3]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:03 LOG6[cron]: Executing cron jobs 2018.05.08 15:16:03 LOG6[cron]: Cron jobs completed in 0 seconds 2018.05.08 15:16:06 LOG6[3]: TLS socket closed (SSL_read) 2018.05.08 15:16:06 LOG5[3]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket 2018.05.08 15:16:06 LOG5[4]: Service [outlook-pop3] accepted connection from 126.10.230.254:52653 2018.05.08 15:16:06 LOG6[4]: failover: round-robin, starting at entry #3 2018.05.08 15:16:06 LOG6[4]: s_connect: connecting 40.97.134.18:995 2018.05.08 15:16:06 LOG5[4]: s_connect: connected 40.97.134.18:995 2018.05.08 15:16:06 LOG5[4]: Service [outlook-pop3] connected remote server from 126.10.218.222:60153 2018.05.08 15:16:06 LOG6[4]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:16:06 LOG6[4]: Peer certificate not required 2018.05.08 15:16:06 LOG6[4]: Certificate verification disabled 2018.05.08 15:16:06 LOG6[4]: Certificate verification disabled 2018.05.08 15:16:06 LOG6[4]: Client certificate not requested 2018.05.08 15:16:06 LOG6[4]: TLS connected: new session negotiated 2018.05.08 15:16:06 LOG6[4]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:07 LOG6[4]: Read socket closed (readsocket) 2018.05.08 15:16:07 LOG6[4]: SSL_shutdown successfully sent close_notify alert 2018.05.08 15:16:07 LOG6[4]: TLS socket closed (SSL_read) 2018.05.08 15:16:07 LOG5[4]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:16:07 LOG5[5]: Service [outlook-smtp] accepted connection from 126.10.230.254:52656 2018.05.08 15:16:07 LOG6[5]: failover: round-robin, starting at entry #4 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:101::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:101::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:108::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:108::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:cc::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:cc::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:8f::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:8f::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 40.97.161.50:587 2018.05.08 15:16:08 LOG5[5]: s_connect: connected 40.97.161.50:587 2018.05.08 15:16:08 LOG5[5]: Service [outlook-smtp] connected remote server from 126.10.218.222:60158 2018.05.08 15:16:08 LOG6[5]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:16:08 LOG6[5]: Peer certificate not required 2018.05.08 15:16:08 LOG6[5]: Certificate verification disabled 2018.05.08 15:16:08 LOG6[5]: Certificate verification disabled 2018.05.08 15:16:08 LOG6[5]: Empty client CA list 2018.05.08 15:16:08 LOG6[5]: TLS connected: new session negotiated 2018.05.08 15:16:08 LOG6[5]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:13 LOG6[5]: TLS socket closed (SSL_read) 2018.05.08 15:16:13 LOG5[5]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket Sent from Outlook<http://aka.ms/weboutlook>

2 1

Stunnel Time out Error
by Sedick Cloete 07 May '18

07 May '18

HI All, We recently moved our email server from an in-house server to Office 365. We are now in the process of replacing all our XP boxes with Windows 10. One of the boxes are running the email service which collects emails from Office 365, that we have just recently upgraded. This process works on the XP but times out on windows 10. Attached, is the time out the log file. Below is the code I am using: Basic program code * variables ChannelNo = 0 Pop3Server = 'outlook.office365.com' Pop3User = UserName Pop3Pass = Password Pop3Port = '995' ProxYServer = '127.0.0.1' ProxyPort = '110' ProxyDir = 'C:\see4OI\SSL\' ProxyExe = 'stunnel.exe' ProxyCert = 'stunnel.pem' * retreives mail in MIME format Gosub GET_EMAILS return Mail_Rec * ---------------------------------------------------------------------------- ------------- GET_EMAILS: * close previous session If it wasnt closed properly Code = seeClose(ChannelNo) Code = seeRelease() * attach key code Code = seeAttach(1, KeyCode) if Code < 0 then RetFlag = 1 return end * start stunnel Code = seeSetProxySSL(0, 1, ProxyDir, ProxyCert, ProxyExe) If Code < 0 Then RETURN end * connect to email server Code = seePop3ConnectSSL(ChannelNo, ProxyPort, Pop3Port, Pop3Server, Pop3User, Pop3Pass, ProxyServer) If Code < 0 Then RETURN End Your assistance in this regard will be highly appreciated. Thank you. Kind Regards, Logicore SEDICK CLOETE IT Business Consultant Cell: 083 228 7058 Fax: 086 515 9695 email: sedick(a)logicore.co.za If you are not the intended recipient of this communication, please notify the sender immediately. The information and/or attachment contained in this email is confidential and may contain proprietary and/or personal information. It is meant solely for the intended recipient. Access to this email by anyone else is unauthorised. If you are not the intended recipient, any processing of the email or the information contained therein (including disclosure, copying, distribution, storage) or any action taken or omitted in reliance on this, is prohibited and may be unlawful.

2 1

How to configure stunnel client on Mac
by Mark Foley 04 May '18

04 May '18

I've successfully set up stunnel for Windows and Linux clients. Now to set up for Mac. I've gone to the website http://macappstore.org/stunnel/ and followed the instructions there which are: 1. Press Command+Space and type Terminal and press enter/return key. 2. Run in Terminal app: ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" < /dev/null 2> /dev/null and press enter/return key. 3. Run: brew install stunnel And then it says, "Done! You can now use stunnel." Well, not exactly. Where do I put my stunnel.conf and certificate.pem? How do I make stunnel run automatically at boot time? The web instructions aren't very complete. Need additional assistance. THX --Mark

1 1

Stunnel in Windows Failover cluster
by Tobias Gillstöm 27 Apr '18

27 Apr '18

Hi, I'm currently using stunnel in a windows fail over cluster: My problem is that when a fail over occurs stunnel switches too the other node and says that stunnel is running and everything is fine. But when I check the logs for stunnel and the program that uses stunnel, it does not appear to be running or sending any data. In the screenshot you can see my stunnel configuration, in the startup parameters section it says "-service -install" my question is if it shouldn't say "-service -start" instead, has anyone else encountered this problem? And if this is the problem why does the stunnel service install with these parameters?

1 0

Ubuntu 16.04.4 LTS SSLv3 and SSlv2 running stunnel 5.44
by Joe Phillips 25 Apr '18

25 Apr '18

I am running stunnel 5.44 on Ubuntu 16.04.4 LTS with all updates. I cannot get devices to connect using sslv2 or 3. My conf file Options line as seen below : ;Enable support for inecure SSLv3 protocol Options = -NO_SSLv3 Options = -NO_SSLv2 I continuously get error 1408A10B SSL routines: ssl3_get_client_hello:wrong version number Do I not have SSL3 and 2 correctly defined in my conf file? I realize 2 and 3 are no longer secure, but I need to support them while I transition to TLS 1.2 thanks [cid:[email protected]]

2 1

stunnel as a Windows Service
by Paul Muller 20 Apr '18

20 Apr '18

Does anyone have any documentation on how to setup stunnel as a Windows Service? I currently have it installed on a Windows Server 2012 R2 Standard. I noticed that stunnel stops running as soon as I log off of my RDP session on the server. [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

2 1

Rapid subsequent DNS resolution fails within stunnel
by Vincent Deschenes 20 Apr '18

20 Apr '18

Hi, We have had this weird problem for a long time where sometime DNS resolution will fail with this error: Error resolving 'domain name printed here': Neither nodename nor servname known (EAI_NONAME) Today I found out that this will happen when stunnel get 2 calls for the same outgoing endpoint very fast one after the other. One call will work no problem. But if you do 2 one after the other then the second one and all other subsequent will fail. Wait a bit and try again, the first one will pass and then others will fail. DNS resolution on the server (linux) itself work without problem, nslookup in loops no problem. But with stunnel we always have the problem. The only working solution is to add a record to the server host file. Any idea ? Could this be a bug in stunnel ? Thanks, Vincent

1 1

Authentication
by Paul Muller 20 Apr '18

20 Apr '18

When I first setup stunnel, I changed my software to reflect the [gmail-smtp] entries in my configuration file. When I tried to send an email from my application I received the following message: "No Email sent, Error 535-5.7.8 Username and Password not accepted." Then I remarked out the authentication credentials in my software. When I tried to send an email I received the following message: "No Email sent, Error-5.5.1 Authentication Required." My question is, can place my authentication credentials in the "stunnel.conf" file? And if so, where? Thanks, [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

2 2

/etc/hosts setting
by White Little 17 Apr '18

17 Apr '18

Hi All I found a interesting issue with /etc/hosts setting in different Linux system. My stunnel.conf setting like below [HOST] cert = client.crt key = client.key CAfile = server.crt client = yes accept = 10.160.160.88:57853 connect = 10.136.160.21:3520 I would like to connect server 10.136.160.21:3520 via stunnel 10.160.160.88:57853 Part A If my hostname and /etc/hosts setting in different System as followings all will works well 1. CentOS 7 32bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 2. Redhat 7 64bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 3. Ubuntu15.10 64bit $hostname virtual-machine $ cat /etc/hosts 127.0.0.1 localhost 10.136.160.88 virtual-machine Part B. If the "127.0.0.1" include the hostname in /etc/hosts, both CentOS and Fedora will fail, but Ubuntu still work 1. CentOS 7 32bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost* localhost.localdomain* localhost4 localhost4.localdomain4 10.136.160.253 localhost.localdomain 2. Redhat 7 64bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost *localhost.localdomain* localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 3. Ubuntu15.10 64bit $hostname virtual-machine $ cat /etc/hosts 127.0.0.1 localhost *virtual-machine* 10.136.160.88 virtual-machine I think it maybe not a stunnel issue, but I'd like to know why it has different behavior Thanks Jay

2 2

make_test failing
by Ian Bamforth 16 Apr '18

16 Apr '18

Morning, Our CI has been failing since Friday with the same errors seen at https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/stunnel4…. make_test fails on 012_verify_chain and 013_CRL_file. Anyone else seeing the same thing? We run Ubuntu 14.04, stunnel v5.44, automatically applying apt security patches to the OS. My initial assumption is that some dependency of stunnel has been updated, but I've not had chance to find out. We have been using the same version of stunnel since the day it was released without any other problems. Ian

2 2

Invalid certificate in tests, prevents make_test from running
by Ian Bamforth 16 Apr '18

16 Apr '18

Morning, I posted earlier about `make_test` failing, apologies for not replying to that thread but I didn't receive the email myself. I've tracked this down to `tests/certs/CACert.pem` containing an expired certificate - see below output: openssl x509 -in tests/certs/CACert.pem -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha1WithRSAEncryption Issuer: C=pl, O=CA_cert, OU=CA_cert, CN=CA_cert/emailAddress=CA_cert(a)example.com Validity Not Before: Apr 26 18:41:00 2017 GMT Not After : Apr 13 15:45:00 2018 GMT Subject: C=pl, O=CA_cert, OU=CA_cert, CN=CA_cert/emailAddress=CA_cert(a)example.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:af:cc:61:f5:73:2b:49:3c:62:c0:b0:d6:1b:0f: 5e:32:d1:49:48:01:b2:35:36:a8:04:a3:e0:7e:e4: 1d:f9:cb:fe:11:0a:c3:2e:b1:3e:87:4c:b0:72:d7: 73:04:ba:28:c7:2b:b4:67:13:0e:5d:05:7f:67:bd: ba:7f:c5:89:b0:48:d6:21:4b:e8:3a:70:ac:dc:e4: f5:43:c3:c9:57:7f:73:f1:3b:b0:e5:a5:90:44:9f: 6e:c3:2a:f5:ab:e6:15:f3:de:cd:44:23:5e:4f:c2: eb:44:59:6c:f5:76:46:b0:7c:fc:59:df:20:97:0c: 0f:43:ae:df:47:f6:d2:78:fd:c6:be:11:cf:26:a1: 8d:87:74:2f:c9:b5:1b:2b:9d:a4:95:44:0c:54:de: 0c:12:d4:8d:14:57:31:a7:a8:70:11:68:6e:20:3d: 76:c9:c8:45:50:d5:4e:2f:f1:6e:78:25:23:05:45: 6e:7d:11:2a:b3:e8:88:6e:68:29:2c:a2:c2:3d:cf: 41:50:b5:e1:51:8f:8e:f4:36:0f:f5:a8:63:5e:29: 1d:b4:fe:71:43:d0:2a:be:2a:2c:b1:62:c6:b9:bc: 4d:95:80:4e:60:ec:e9:79:92:19:31:9c:b2:00:74: 3b:a1:80:57:b4:22:45:c8:d3:1a:a7:4f:f6:00:12: 35:b7 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha1WithRSAEncryption 97:03:b2:c1:a2:44:8a:2a:9c:1d:3c:cb:61:a6:f9:bc:7f:4f: 21:fc:69:d8:f3:31:7b:4b:e5:2b:34:42:19:03:1a:40:af:fa: 7e:18:93:99:a8:78:cb:32:15:23:75:6e:49:6d:ac:ee:ca:5e: d6:d2:69:5a:b5:4a:13:cd:7c:77:e4:f2:6d:a0:2d:63:2f:62: b5:be:24:ee:12:d7:22:3e:dd:d2:56:07:81:ca:c4:cf:4c:2c: 36:64:32:52:b1:76:76:5f:c7:45:86:b9:34:1a:c7:37:0c:38: ce:8b:20:8b:70:a1:33:a0:e1:3d:ed:9a:26:c0:04:e7:35:c5: 41:ab:bd:f9:cc:10:8d:12:3f:7a:ee:b3:a3:98:35:09:b2:e5: 5f:aa:22:16:7e:18:df:61:ac:3d:30:48:f7:77:41:5c:25:bd: 6f:dc:53:d0:f3:d7:cc:33:f6:77:36:99:0b:e4:8f:3e:83:e4: ca:3a:58:6f:73:55:83:6e:a7:01:b2:21:bf:09:54:28:e3:e0: a5:4f:bd:d7:66:a2:f8:c2:81:6f:0d:aa:ba:6f:7d:a9:cf:6f: 06:a8:a2:b1:5b:3b:f9:7b:89:bf:f5:c4:ed:f0:5e:cf:64:87: 39:84:90:6c:c9:e0:5d:b4:54:ae:a7:6c:e7:b4:2a:29:fe:ab: 62:4f:91:d0 As a (horrible) workaround I've had to skip "make_test" in my CI - if there are any better ideas please let me know! Ian

1 0

Possible memory leak with stunnel reload
by Mark Brookes 06 Apr '18

06 Apr '18

Hi all, we have noticed that when reloading (note reloading not restarting) stunnel it appears to be leaking between 12 and 32 bytes of memory (ish) per reload. There does not need to be any traffic passing through it at the time to view this problem. If its reloaded enough times the system will eventually run out of memory. Unless an stunnel restart if performed inbetween. We are running 5.41 tried with the latest 5.44 and have the same result. We are using openssl 1.0.2j-fips ive tried with 1.0.2n and 1.1.0e (to try and rule out openssl) We are reloading by running: kill -s HUP <pid> The stunnel configuration is - pid = /var/run/stunnel/stunnel.pid debug = 7 syslog = no output = /var/log/stunnel.log socket = a:IP_FREEBIND=yes fips = no sslVersion = all [VIP_Name] cert = /etc/loadbalancer.org/certs/server.pem ciphers = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES accept = 192.168.80.16:443 connect = 127.0.0.5:80 delay = yes options = NO_SSLv3 options = NO_TLSv1 options = DONT_INSERT_EMPTY_FRAGMENTS renegotiation = no local = 192.168.80.16 TIMEOUTclose = 0 The stunnel log file is as follows - 2018.04.03 11:09:59 LOG7[ui]: Clients allowed=62937 2018.04.03 11:09:59 LOG5[ui]: stunnel 5.44 on x86_64-pc-linux-gnu platform 2018.04.03 11:09:59 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j-fips 26 Sep 2016 2018.04.03 11:09:59 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.04.03 11:09:59 LOG7[ui]: errno: (*__errno_location ()) 2018.04.03 11:09:59 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2018.04.03 11:09:59 LOG5[ui]: UTF-8 byte order mark not detected 2018.04.03 11:09:59 LOG5[ui]: FIPS mode disabled 2018.04.03 11:09:59 LOG7[ui]: Compression disabled 2018.04.03 11:09:59 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2018.04.03 11:09:59 LOG7[ui]: PRNG seeded successfully 2018.04.03 11:09:59 LOG6[ui]: Initializing service [VIP_Name] 2018.04.03 11:09:59 LOG7[ui]: Ciphers: ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES 2018.04.03 11:09:59 LOG7[ui]: TLS options: 0x07004804 (+0x07004800, -0x00000000) 2018.04.03 11:09:59 LOG6[ui]: Loading certificate from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Certificate loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Loading private key from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Private key loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG7[ui]: Private key check succeeded 2018.04.03 11:09:59 LOG7[ui]: ECDH initialization 2018.04.03 11:09:59 LOG7[ui]: ECDH initialized with curve prime256v1 2018.04.03 11:09:59 LOG5[ui]: Configuration successful 2018.04.03 11:09:59 LOG7[ui]: Binding service [VIP_Name] 2018.04.03 11:09:59 LOG7[ui]: Listening file descriptor created (FD=6) 2018.04.03 11:09:59 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.04.03 11:09:59 LOG7[ui]: Option IP_FREEBIND set on accept socket 2018.04.03 11:09:59 LOG7[ui]: Service [VIP_Name] (FD=6) bound to 192.168.80.16:443 2018.04.03 11:09:59 LOG7[main]: Created pid file /var/run/stunnel/stunnel.pid 2018.04.03 11:09:59 LOG7[cron]: Cron thread initialized 2018.04.03 11:10:59 LOG6[cron]: Executing cron jobs 2018.04.03 11:10:59 LOG6[cron]: Cron jobs completed in 0 seconds 2018.04.03 11:10:59 LOG7[cron]: Waiting 86400 seconds 2018.04.03 11:11:08 LOG7[main]: Found 1 ready file descriptor(s) 2018.04.03 11:11:08 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.04.03 11:11:08 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.04.03 11:11:08 LOG7[main]: Dispatching signals from the signal pipe 2018.04.03 11:11:08 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2018.04.03 11:11:08 LOG5[main]: Reading configuration from file /etc/stunnel/stunnel.conf 2018.04.03 11:11:08 LOG5[main]: UTF-8 byte order mark not detected 2018.04.03 11:11:08 LOG5[main]: FIPS mode disabled 2018.04.03 11:11:08 LOG7[main]: Compression disabled 2018.04.03 11:11:08 LOG7[main]: Snagged 64 random bytes from /dev/urandom 2018.04.03 11:11:08 LOG7[main]: PRNG seeded successfully 2018.04.03 11:11:08 LOG6[main]: Initializing service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Ciphers: ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES 2018.04.03 11:11:08 LOG7[main]: TLS options: 0x07004804 (+0x07004800, -0x00000000) 2018.04.03 11:11:08 LOG6[main]: Loading certificate from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Certificate loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Loading private key from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Private key loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG7[main]: Private key check succeeded 2018.04.03 11:11:08 LOG7[main]: ECDH initialization 2018.04.03 11:11:08 LOG7[main]: ECDH initialized with curve prime256v1 2018.04.03 11:11:08 LOG5[main]: Configuration successful 2018.04.03 11:11:08 LOG7[main]: Unbinding service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] closed (FD=6) 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] closed 2018.04.03 11:11:08 LOG7[main]: Binding service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Listening file descriptor created (FD=6) 2018.04.03 11:11:08 LOG7[main]: Option SO_REUSEADDR set on accept socket 2018.04.03 11:11:08 LOG7[main]: Option IP_FREEBIND set on accept socket 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] (FD=6) bound to 192.168.80.16:443 2018.04.03 11:11:08 LOG7[main]: Signal pipe is empty Any help would be appreciated. Thanks -- Mark Brookes Loadbalancer.org Ltd. www.loadbalancer.org +44 (0)330 380 1064 mark(a)loadbalancer.org

2 2

Motion and Stunnel Query
by Vidya Govindan 04 Apr '18

04 Apr '18

Hi Everyone, I am trying to work on a video streaming project which uses the motion software to stream images from a usb camera. By default the streaming is done in a non-secure manner. So I installed Stunnel , generated a self signed certificate and I am not using it on top of the motion software to securely stream images. Now, I want to know exactly how Stunnel encrypts/decrypts image data that is generated by motion? I know that motion sends the data on port 8081 and Stunnel tunnels it to another port 8443. I can not understand where exactly the Openssl library functions are used to add the security feature in this scenario. Can anyone with a better understanding throw some light on the same? Thanks & Regards, Vidya

1 0

proxy with authentication
by Andreas Meier 03 Apr '18

03 Apr '18

3 3

First Time Troubles.
by me＠kilosierracharlie.me 22 Mar '18

22 Mar '18

Hello All, I'm trying to configure STunnel4 on Windows to connect to my VPS installed with STunnel, so I can use SSH through a DPI laden network. The configuration works if I try at home, or on a mobile data hotspot, but if I attempt within the DPI network, it does not work, and provides this console output: 2018.03.22 09:30:15 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.03.22 09:30:15 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.03.22 09:30:15 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.03.22 09:30:15 LOG5[main]: Reading configuration from file stunnel.conf 2018.03.22 09:30:15 LOG5[main]: UTF-8 byte order mark detected 2018.03.22 09:30:15 LOG5[main]: FIPS mode disabled 2018.03.22 09:30:15 LOG5[main]: Configuration successful 2018.03.22 09:30:24 LOG5[0]: Service [ssh] accepted connection from 127.0.0.1:65086 2018.03.22 09:30:24 LOG5[0]: s_connect: connected 130.185.251.28:443 2018.03.22 09:30:24 LOG5[0]: Service [ssh] connected remote server from 172.28.1.25:65087 2018.03.22 09:30:25 LOG4[0]: CERT: Certificate not found in local repository 2018.03.22 09:30:25 LOG4[0]: Rejected by CERT at depth=0: CN=130.185.251.28 2018.03.22 09:30:25 LOG3[0]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed 2018.03.22 09:30:25 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket This is the configuration I'm using: [ssh] client = yes accept = 443 connect = 130.185.251.28:443 CAfile = peer-ssh.pem verifyPeer = yes The odd thing, is that if I connect using my mobile data, and then switch over to filtered internet and try again, it works fine, and adds the following lines to the log: 2018.03.22 09:36:46 LOG5[1]: Service [ssh] accepted connection from 127.0.0.1:65237 2018.03.22 09:36:46 LOG5[1]: s_connect: connected 130.185.251.28:443 2018.03.22 09:36:46 LOG5[1]: Service [ssh] connected remote server from 192.168.43.115:65238 2018.03.22 09:36:46 LOG5[1]: Certificate accepted at depth=0: C=GB, ST=Lincolnshire, L=Horncastle, O=N/A, OU=N/A, CN=personal.kilosierracharlie.me, emailAddress=webmaster(a)kilosierracharlie.me Has anyone got any ideas regarding this issue? It's not mission critical, but it's quite annoyingly repetitive! Cheers, Kieran.

1 0

sTunnel client connecting to load balanced URL - stunnel 5.02 on x86-pc-msvc-1500 platform
by Tony 19 Mar '18

19 Mar '18

Hi all, I have a situation where I'm trying to use sTunnel as the client to connect to a service on a secure URL, but the hiccup is that the secure URL is load balanced. If a do an nslookup on the URL, the response comes back as it being an alias. Non-authoritative answer: Name: eu1571393051174.ssl.ondemand.com Address: 155.56.210.164 Aliases: l4884-iflmap.hcisbp.eu1.hana.ondemand.com Looking at the sTunnel log, it resolves to the IP of the server. But the IP itself does not host the service so I'm getting http:503 errors. 2018.03.16 14:44:44 LOG7[18796]: Service [ssl-OSRdev] (FD=564) bound to 0.0.0.0:8085 2018.03.16 14:44:55 LOG7[18796]: Service [ssl-OSRdev] accepted (FD=572) from 192.168.0.22:61093 2018.03.16 14:44:55 LOG7[18796]: Creating a new thread 2018.03.16 14:44:55 LOG7[18796]: New thread created 2018.03.16 14:44:55 LOG7[30864]: Service [ssl-OSRdev] started 2018.03.16 14:44:55 LOG5[30864]: Service [ssl-OSRdev] accepted connection from 192.168.0.22:61093 2018.03.16 14:44:55 LOG6[30864]: s_connect: connecting 155.56.210.164:443 2018.03.16 14:44:55 LOG7[30864]: s_connect: s_poll_wait 155.56.210.164:443: waiting 10 seconds 2018.03.16 14:44:56 LOG5[30864]: s_connect: connected 155.56.210.164:443 2018.03.16 14:44:56 LOG5[30864]: Service [ssl-OSRdev] connected remote server from 192.168.0.32:30269 2018.03.16 14:44:56 LOG7[30864]: Remote socket (FD=588) initialized 2018.03.16 14:44:56 LOG7[30864]: SNI: sending servername: l4884-iflmap.hcisbp.eu1.hana.ondemand.com 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): before/connect initialization 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv2/v3 write client hello A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server hello A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server certificate A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server key exchange A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server certificate request A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server done A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write client certificate A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write client key exchange A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write certificate verify A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write change cipher spec A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write finished A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 flush data 2018.03.16 14:44:57 LOG7[30864]: SSL state (connect): SSLv3 read finished A 2018.03.16 14:44:57 LOG7[30864]: 1 items in the session cache 2018.03.16 14:44:57 LOG7[30864]: 1 client connects (SSL_connect()) 2018.03.16 14:44:57 LOG7[30864]: 1 client connects that finished 2018.03.16 14:44:57 LOG7[30864]: 0 client renegotiations requested 2018.03.16 14:44:57 LOG7[30864]: 0 server connects (SSL_accept()) 2018.03.16 14:44:57 LOG7[30864]: 0 server connects that finished 2018.03.16 14:44:57 LOG7[30864]: 0 server renegotiations requested 2018.03.16 14:44:57 LOG7[30864]: 0 session cache hits 2018.03.16 14:44:57 LOG7[30864]: 0 external session cache hits 2018.03.16 14:44:57 LOG7[30864]: 0 session cache misses 2018.03.16 14:44:57 LOG7[30864]: 0 session cache timeouts 2018.03.16 14:44:57 LOG7[30864]: Peer certificate was cached (3826 bytes) 2018.03.16 14:44:57 LOG6[30864]: SSL connected: new session negotiated 2018.03.16 14:44:57 LOG6[30864]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2018.03.16 14:44:57 LOG6[30864]: Compression: null, expansion: null 2018.03.16 14:44:58 LOG6[30864]: SSL socket closed (SSL_read) 2018.03.16 14:44:58 LOG7[30864]: Sent socket write shutdown 2018.03.16 14:44:58 LOG5[30864]: Connection closed: 1730 byte(s) sent to SSL, 274 byte(s) sent to socket 2018.03.16 14:44:58 LOG7[30864]: Remote socket (FD=588) closed 2018.03.16 14:44:58 LOG7[30864]: Local socket (FD=572) closed 2018.03.16 14:44:58 LOG7[30864]: Service [ssl-OSRdev] finished (0 left) 2018.03.16 14:44:58 LOG7[30864]: str_stats: 3 block(s), 4294962489 data byte(s), 150 control byte(s) 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:413 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:412 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:411 I have tested the service using SoapUI and it works. Is it possible to have sTunnel follow the URL redirection? Regards, Tony

2 1

Re: [stunnel-users] basic usage question
by Mark Foley 19 Mar '18

19 Mar '18

Solved! I've fixed up the various ports and now I am able to connect. For the edification of other list readers I'll summarize. I have a local Linux host acting as firewall/router. It routes requests on port 1234 to port 3389 on a local Linux workstation which is running x11vnc server listening on its local port 5900. I want to connect to this VNC server from a remote vnc viewer. (Why does the router forward to port 3389? Because the workstaion can dual-boot Windows, so the forward works regardless of booted OS.) Remote vnc viewer, stunnel client stunnel.conf: verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [x11vnc] accept = 5900 connect = router.obfuscate.org:1234 Local workstation vnc server, stunnel server stunnel.conf: pid = /var/run/stunnel.pid debug = 7 [x11vnc] accept = 3389 key = /root/privatekey.pem cert = /root/certificate.pem connect = 127.0.0.1:5900 The certificate is self-signed and created on the stunnel/vnc server host using the following commands: openssl genrsa -out privatekey.pem 2048 openssl req -new -x509 -days 365 -key privatekey.pem -out certificate.pem The certificate.pem is copied to the stunnel client host. With x11vnc listening on 5900 on the local workstation and with 'stunnel stunnel.conf' running on both stunnel client (as the normal user) and server hosts, I use the remote vnc viewer, logged in as a normal user, with the connection 127.0.0.1:5900 I'm guessing I could configure my vnc viewers to connect to multiple clients with difference [service] sections, for example: verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [remoteHost1] accept = 5900 connect = router.obfuscate.org:1234 [remoteHost2] accept = 5901 connect = router.obfuscate.org:4321 I haven't tried that, but I will. I futher guess that I could have different CAfiles per server if I moved that directive to the respective service defintions (can someone confirm?), but I haven't tried that either. Thanks especially to Flo Rance for helping me work through this. Now, I have to figure out how to do this from a Windows client! --Mark

2 1

Creating CSR for GoDaddy
by John McClymont 15 Mar '18

15 Mar '18

Good Morning, As a novice user of stunnel. I use stunnel to make and encrypted video connection to home security system. I wish to create an SSL certificate request to obtain an SSL from GoDaddy I use the following command openssl req -new -newkey rsa:2048 -nodes -keyout c:\key\private_key.key -out c:\key\request.csr Is this correct? thanks in advance for suggestions

2 1

Re: [stunnel-users] basic usage question
by Mark Foley 15 Mar '18

15 Mar '18

Nitin - sorry, I didn't realize this was a response to my message and I sent a followup message before reading this one. I have your patch in a previous message. I'm not familiar with "patching". Can you give me quickie instructions on doing that, or refer me to a link that explains it? I assume I need to patch the source code, right? If so, I have stunnel version 5.35. Do I need to apply this patch to a more recent version? Are there any other sslVersions stunnel supports? Thanks --Mark -----Original Message----- On Tue, 13 Mar 2018 22:21:24 +0400 Nitin Mutkawoa <jmutkawoa(a)hackers.mu> wrote: > > hello > > Sorry, I was not clear enough in my previous mail. > The patch allows you to specify TLS 1.3 in the configuration file and do a > TLS 1.3 only. > > regards > > Nitin J Mutkawoa > > https://tunnelix.com > https://hackers.mu > > Twitter: @TheTunnelix > > On Tue, Mar 13, 2018 at 3:13 PM, Ma??gorzata Olszówka < > Malgorzata.Olszowka(a)stunnel.org> wrote: > > > I'm also working on TLS 1.3 compatibility with Stunnel. I will reach the > >> mailing list as soon as possible with a tested patch. > >> > > > > Hello Nitin, > > Could you specify what problem do you have with TLS 1.3. > > It works for me: > > > > 2018.03.13 11:39:06 LOG5[ui]: stunnel 5.44 on x86_64-unknown-linux-gnu > > platform > > 2018.03.13 11:39:06 LOG5[ui]: Compiled/running with OpenSSL > > 1.1.1-pre2-dev xx XXX xxxx > > ??? > > 2018.03.13 11:39:23 LOG6[0]: Negotiated TLSv1.3 ciphersuite > > TLS13-AES-256-GCM-SHA384 (256-bit encryption) > > > > > > Regards, > > Ma??gorzata > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > >

1 1

Re: [stunnel-users] basic usage question
by Mark Foley 14 Mar '18

14 Mar '18

Thanks to help from Nitin, I've made a tiny bit of progress with stunnel. I've created the certificates per Nitin's instructions at https://tunnelix.com/securing-mysql-traffic-with-stunnel-in-a-jail-environm… Certificates have permissions 0600. I want to use a VNC client on Linux to connect to a VNC Server also on Linux. In between these two computers I have a Linux router which routes all request to port 1914 to port 3389 on the VNC Server. stunnel on the server is run at the command line by root: 'stunnel /root/stunnel.conf'. Here is my VNC Server computer's stunnel.conf: foreground = yes pid = /var/run/stunnel.pid debug = 7 ; output = /root/stunnel.log output = /dev/stdout [x11vnc] accept = 3389 key = /root/privatekey.pem cert = /root/certificate.pem connect = 127.0.0.1:5900 stunnel on the client is run by a normal user, stunnel $HOME/.stunnel/stunnel.conf. Below is my client stunnel.conf: foreground = yes verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [x11vnc] accept = 5900 connect = mail.ohprs.org:1914 When I run stunnel on the client I get: 2018.03.13 13:21:17 LOG5[ui]: stunnel 5.35 on x86_64-slackware-linux-gnu platform 2018.03.13 13:21:17 LOG5[ui]: Compiled with OpenSSL 1.0.2h 3 May 2016 2018.03.13 13:21:17 LOG5[ui]: Running with OpenSSL 1.0.2n 7 Dec 2017 2018.03.13 13:21:17 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2018.03.13 13:21:17 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2018.03.13 13:21:17 LOG5[ui]: Reading configuration from file /home/mfoley/.stunnel/stunnel.conf 2018.03.13 13:21:17 LOG5[ui]: UTF-8 byte order mark not detected 2018.03.13 13:21:17 LOG5[ui]: FIPS mode disabled 2018.03.13 13:21:17 LOG4[ui]: Service [x11vnc] uses "verify = 2" without subject checks 2018.03.13 13:21:17 LOG4[ui]: Use "checkHost" or "checkIP" to restrict trusted certificates 2018.03.13 13:21:17 LOG5[ui]: Configuration successful On the client, I then run tigerVNCViewer connecting to 127.0.0.1::5900. I get the following messages on the client: 2018.03.13 13:22:03 LOG5[0]: Service [x11vnc] accepted connection from 127.0.0.1:35034 2018.03.13 13:22:03 LOG5[0]: s_connect: connected 98.102.63.107:1914 2018.03.13 13:22:03 LOG5[0]: Service [x11vnc] connected remote server from 192.168.0.17:40512 2018.03.13 13:22:03 LOG3[0]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2018.03.13 13:22:03 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Just guessing, but is it failing with the SSLVersion? Help appreciated. Thanks, Mark

1 1

[PATCH] TLS 1.3 Compatibility
by Nitin Mutkawoa 13 Mar '18

13 Mar '18

Hello, To add TLS 1.3 compatibility on Stunnel, the following patch was applied and tested. --- options.c.orig 2018-03-13 04:06:01.410477727 +0000 +++ options.c 2018-03-13 05:42:51.883782519 +0000 @@ -2675,6 +2675,18 @@ NOEXPORT char *parse_service_option(CMD #else /* defined(OPENSSL_NO_TLS1_2) */ return "TLSv1.2 not supported"; #endif /* !defined(OPENSSL_NO_TLS1_2) */ + } else if(!strcasecmp(arg, "TLSv1.3")) { +#ifndef OPENSSL_NO_TLS1_3 + section->client_method=(SSL_METHOD *)TLS_client_method(); + section->server_method=(SSL_METHOD *)TLS_server_method(); + section->ssl_options_set|= SSL_OP_NO_SSLv2; + section->ssl_options_set|= SSL_OP_NO_SSLv3; + section->ssl_options_set|= SSL_OP_NO_TLSv1; + section->ssl_options_set|= SSL_OP_NO_TLSv1_1; + section->ssl_options_set|= SSL_OP_NO_TLSv1_2; +#else /* defined(OPENSSL_NO_TLS1_3) */ + return "TLSv1.3 not supported"; +#endif #endif /* OPENSSL_API_COMPAT<0x10100000L */ } else return "Incorrect version of TLS protocol"; Please see this link for more info about the test for TLS 1.3 https://gist.github.com/jmutkawoa/c97f5d67ded592f6ad04389a3ade623e Regards Nitin J Mutkawoa https://tunnelix.com https://hackers.mu Twitter: @TheTunnelix

1 0

basic usage question
by Mark Foley 10 Mar '18

10 Mar '18

I'm trying to set up an ssl tunnel for VNC per the instructions at https://www.ibm.com/developerworks/library/l-sslvnc/index.html. I've not gotten very far into the steps. I tried: # stunnel -d 5905 -r 5900 -p /root/combined.pem [ ] Clients allowed=500 [.] stunnel 5.35 on x86_64-slackware-linux-gnu platform [.] Compiled with OpenSSL 1.0.2h 3 May 2016 [.] Running with OpenSSL 1.0.2n 7 Dec 2017 [.] Update OpenSSL shared libraries or rebuild stunnel [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [!] Invalid configuration file name "-d" [!] realpath: No such file or directory (2) [ ] Cron thread initialized I find nothing on the -d, -r or -p options in the manpage. This is my 1st posting to this list. I have very rudimentary skills with ssl, ssh, and certificates, mainly limited to getting certificates from a provider and installing for web and email; and creating public keys for ssh login using ssh-keygen. That's about it, so I'm pretty much a certified newbie. Help getting past the starting gate would be greatly appreciated. THX --Mark

1 0

[PATCH] Spectre v2 Vulnerability Mitigations
by Nitin Mutkawoa 07 Mar '18

07 Mar '18

Hello To prevent any leakage (Spectre v2) from a compromised VM on same physical host, this patch would mitigate the impact. --- configure.ac.orig 2018-03-04 01:46:55.877067173 +0400 +++ configure.ac 2018-03-04 01:49:26.422625147 +0400 @@ -101,6 +101,11 @@ if test "$GCC" = yes; then fi AX_APPEND_COMPILE_FLAGS([-D_FORTIFY_SOURCE=2]) +# Spectre v2 mitigations +AX_APPEND_COMPILE_FLAGS([-mfunction-return=thunk]) +AX_APPEND_COMPILE_FLAGS([-mindirect-branch=thunk]) + AC_MSG_NOTICE([**************************************** libtool]) LT_INIT([disable-static]) AC_SUBST([LIBTOOL_DEPS]) Kind regards, Nitin J Mutkawoa https://tunnelix.com https://hackers.mu

1 0

Re: [stunnel-users] Connect using TLS with public Web Server
by peter＠easthope.ca 06 Mar '18

06 Mar '18

From: Carlos Castro <carlos.castro.guerrero(a)gmail.com> Date: Fri, 2 Feb 2018 12:04:08 +0100 > I have older application and now I need connect with external server HTTPS > using TLS . My application doesn't support with TLS and I think use Stunnel > to connect with this Server HTTPS. Same requirement here. Have you tried this configuration? ; yourhost:/etc/stunnel4/stunnel.conf ... [https] client = yes accept = 443 transparent = destination Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca https://en.wikibooks.org/wiki/Medical_Suction_Machines https://en.wikibooks.org/wiki/Oberon

3 6

Stunnel in server mode with certificate from the Windows Certificate Store
by merlin＠mp3merlin.net 06 Mar '18

06 Mar '18

Hello, I'm trying to use stunnel in server mode with certificates from the Windows Certificate Store. I have a basic configuration which is working with a PEM certificate file and I'm trying to get it to use a cert via the CAPI engine. Here is my basic (working) config: debug = debug output = C:\stunnel\stunnel.log options = -NO_SSLv3 [https] accept = 443 connect = 80 cert = stunnel.pem Here is my config using the CAPI engine: debug = debug output = C:\stunnel\stunnel.log engine = capi engineCtrl = debug_level:2 engineCtrl = debug_file:c:\stunnel\capi.log engineCtrl = store_flags:1 engineCtrl = list_certs options = -NO_SSLv3 [https] accept = 443 connect = 80 engineId = capi However stunnel does not seem to find a certificate to use: [...] 2018.03.06 10:22:05 LOG7[main]: Enabling support for engine "capi" 2018.03.06 10:22:05 LOG7[main]: Executing engine control command debug_level:2 2018.03.06 10:22:05 LOG7[main]: Executing engine control command debug_file:c:\stunnel\capi.log 2018.03.06 10:22:05 LOG7[main]: Executing engine control command store_flags:1 2018.03.06 10:22:05 LOG7[main]: Executing engine control command list_certs 2018.03.06 10:22:05 LOG7[main]: Initializing engine #1 (capi) 2018.03.06 10:22:05 LOG6[main]: Engine #1 (capi) initialized [...] 2018.03.06 10:22:05 LOG6[main]: Initializing service [https] 2018.03.06 10:22:05 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.03.06 10:22:05 LOG7[main]: TLS options: 0x01004004 (+0x03004000, -0x02000000) 2018.03.06 10:22:05 LOG7[main]: No certificate or private key specified [...] And I have no certificates listed in the CAPI debug log: Setting debug level to 2 Setting debug file to c:\stunnel\capi.log Setting flags to 1 Listing certs for store MY Opening certificate store MY capi_cert_get_fname When I load the engine via OpenSSL, I can see that a certificate is present in the store: C:\stunnel\bin>openssl.exe engine -t dynamic -pre "SO_PATH:C:\stunnel\engines\capi.dll" -pre LOAD -post store_flags:1 -post store_name:MY -post list_certs WARNING: can't open config file: /devel/win32/openssl/openssl.cnf (dynamic) Dynamic engine loading support [Success]: SO_PATH:C:\stunnel\engines\capi.dll [Success]: LOAD Loaded: (capi) CryptoAPI ENGINE [ available ] [Success]: store_flags:1 Certificate 0 Friendly Name "test" Subject: CN = test Issuer: CN = test [Success]: list_certs This certificate (and the associated private key) has been generated via the IIS Manager console and I have imported it in the Local Computer Store (with the private key). Does anybody have any idea what I am missing to get this to work ? I can provide more logs and run more tests if necessary. I'm using Stunnel 5.44 on Windows 2008 R2. I tried with an older version (5.40) but same problem. Thanks. Kevin

1 0

Re: [stunnel-users] Re: Connect using TLS with public Web Server
by Carlos Castro 06 Mar '18

06 Mar '18

Hi All , it's mandatory for use stunnel wich the infrastructure has client stunnel and server stunnel ?? Or I can have client stunnel vs Web server HTTPS without stunnel server , only web server https . I newbie in stunnel , but i think is mandatory install stunnel in both sites , that's is correct? Regards On 05/03/18 20:23, Carlos Castro wrote: > > Thanks @Mike > > If possible use Squid + stunnel to solve the problem with host > header? The application is very very old . > > Thanks > > > On 05/03/18 20:06, Mike Spooner wrote: >> >> The problem is the "Host: ..." header that is being sent to the >> remote server. You need to configure 127.0.0.1:19021 as a proxy in >> your app (and curl) and then have the app (curl) fetch >> https://ctm.omego.net >> >> >> Not sure how to do that in curl, but search the curl manpage for any >> mentions of "proxy". >> >> -- Mike Spooner >> >> --------- Original Message --------- >> *From*: Carlos Castro >> *Date*: Mon Mar 05 12:28:15 GMT+00:00 2018 >> *Subject*: Re: [stunnel-users] Connect using TLS with public Web Server >> Hello >> >> Thanks @Peter >> >> >> Yes , my application not support TLS and I need the application connect >> using TLS , for this i using stunnel (i hope) >> >> When I make curl -v http://127.0.0.1:19021 : >> >> curl -v http://127.0.0.1:19201 >> * Rebuilt URL to: http://127.0.0.1:19201/ >> * Trying 127.0.0.1... >> * Connected to 127.0.0.1 (127.0.0.1) port 19201 (#0) >> > GET / HTTP/1.1 >> > Host: 127.0.0.1:19201 >> > User-Agent: curl/7.47.0 >> > Accept: */* >> > >> * HTTP 1.0, assume close after body >> < HTTP/1.0 400 Bad Request >> < Server: AkamaiGHost >> < Mime-Version: 1.0 >> < Content-Type: text/html >> < Content-Length: 208 >> < Expires: Mon, 05 Mar 2018 12:25:53 GMT >> < Date: Mon, 05 Mar 2018 12:25:53 GMT >> < Connection: close >> >> The web ctm.omgeo.net only works in mode HTTPS , . >> >> Thanks Peter >> >> >> On 05/03/18 13:22, Peter Pentchev wrote: >> > On Mon, Mar 05, 2018 at 12:32:41PM +0100, Carlos Castro wrote: >> >> Hello , >> >> >> >> Thanks @Peter >> >> >> >> I'm trying to configure to connect with my PC to this Public server >> >> https://ctm.omgeo.net using TLS1.2 but i don't can. >> >> >> >> I'm need setup stunnel for old application doesn't support TLS , >> and this >> >> application need connect with this public server to send data. >> >> >> >> >> >> I'm using the Peter config , but nothing . I try this config : >> >> >> >> [omgeo] >> >> client = yes >> >> accept = 127.0.0.1:19201 >> >> connect = ctm.omgeo.net:443 >> >> verify = 2 >> >> CApath = /etc/ssl/certs/ >> >> >> >> >> >> I'm using Curl to try connect , I'm recive this error >> >> >> >> /etc/ssl/certs# curl -v https://127.0.0.1:19201 >> > Maybe I'm reading this wrong, but if your client application does not >> > support TLS, then it won't speak HTTPS, it would speak plain HTTP. >> > That's what the configuration you're using does - it tells stunnel to >> > run in client mode, i.e. something will connect to stunnel using >> > an unencrypted connection and stunnel will connect to a TLS server >> > (in this case an HTTPS server). >> > >> > So what happens when you try almost the same query, but with the "http" >> > scheme instead of the "https" one? >> > >> > curl -v http://127.0.0.1:19201 >> > >> > G'luck, >> > Peter >> > >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

Client cert auth ?
by Brian Ipsen 27 Feb '18

27 Feb '18

Hi I am trying to see if I can get stunnel to authenticate using a client certificate towards a F5 setup - but I am having trouble getting it to work. Certificates are issued froma Microsoft PKI - where the F5 checks validity via an OCSP responder. In my stunnel config file, I have: [F5Cert] client=yes accept = 127.0.0.1:1598 connect = F5test.xxx.dk:443 delay = yes CAFile = GlobalSign-cert-Chain.pem Cert = BaaSClientCertificatePlain.pem key = BaaSClientCertificatePlain.key verify = 2 In the CAFile, I have the root CA and issuing certificate from GlobalSign - which have created the SSL certificate being used on the F5 (server side). Cert and Key points to the certificate and private key from my internal Microsoft based PKI.. But should the certificate chain from my internal PKI be listed somewhere as well ? Is this the way to do it - and is stunnel capable of handling client certificate validation ? Regards Brian

3 2

Question on reconnection after TCP RST
by Chawla, Vikas 27 Feb '18

27 Feb '18

Hi, We ran into an issue where stunnel after TCP RST from server, retries to re-establish connection after 5 seconds with exponential back off. Wanted to check if there is configuration parameter for us to modify the reconnection time to be a lower number. Thanks, Vikas

1 0

[PATCH] Address already in use (98) when binding to localhost
by Christian Kujau 06 Feb '18

06 Feb '18

Hi, I reported the following to the Fedora bugtracker[0], but only then realized that this happens with the upstream version too. In short: since stunnel 5.44 I am no longer able to have stunnel bind to localhost, when "localhost" is literally mentioned in the configuration file: $ cat stunnel.test [test] client = yes protocol = smtp accept = localhost:12345 connect = localhost:2025 $ stunnel-5.44 stunnel.test [...] [ ] Binding service [test] [ ] Listening file descriptor created (FD=6) [ ] Option SO_REUSEADDR set on accept socket [ ] Service [test] (FD=6) bound to 127.0.0.1:12345 [ ] Listening file descriptor created (FD=7) [ ] Option SO_REUSEADDR set on accept socket [!] bind: Address already in use (98) [!] Error binding service [test] to 127.0.0.1:12345 [ ] Unbinding service [test] [ ] Service [test] closed (FD=6) [ ] Service [test] closed When using "127.0.0.1" or "::1" instead of "localhost" in the configuration file, stunnel-5.44 works. However, then one can only connect to either the IPv4 _or_ the IPv6 address, depending on what's configured. With stunnel-5.43 and "accept=localhost:12345" both IPv4 and IPv6 was available. I suspect that this is related to the following change log entry for 5.44: > Default accept address restored to INADDR_ANY. I have attached a patch to revert that (?) change and also included a test script that fails on my system when the patch is not applied. I see "Version 5.45" already mention in the changelog on the website, but now download yet? Thanks, Christian. [0] https://bugzilla.redhat.com/show_bug.cgi?id=1542361 -- BOFH excuse #424: operation failed because: there is no message for this error (#1014)

1 0

Re: [stunnel-users] stunnel.log not generated in window server 2012 R2
by Zhang, Joanne 02 Feb '18

02 Feb '18

Hello. I installed a Stunnel-5.44-win32 on a Window Server 2012 R2 box. I am using it in client mode only as it is required by the Vendor. It works fine, I can connect to my Vendor's server via Stunnel . However, I don't see any stunnel.log generated when it is run as a service and I searched the entire directory on the server. I know the output path is working . As when I run Stunnel GUI Start, the log is created in the output folder specified in the conf file. Have anyone seen this problem before please? Here is my setting for stunnel.conf that relates to the debug log. debug = 7 output = C:\Program Files (x86)\stunnel\stunnel.log Thanks very much for your help ahead. Joanne _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

1 0

Connect using TLS with public Web Server
by Carlos Castro 02 Feb '18

02 Feb '18

Hi All, I have older application and now I need connect with external server HTTPS using TLS . My application doesn't support with TLS and I think use Stunnel to connect with this Server HTTPS. Wich is the mode I should choose to configurate this connection ? Proxy mode? or like examples created over gmail in default configuration File? The external server , is public server for all people ? should be necesary special certs ? or whit predeterminate certs inside windows (for use IE, chroome , firefox etc..etcc) is necesary ? Many thanks Regards

1 0

Re (2): Relationship to Netfilter.
by peter＠easthope.ca 26 Jan '18

26 Jan '18

From: Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> Date: Thu, 25 Jan 2018 18:23:58 +0100 > If it was in this diagram, it would be a 'local process' on the > application layer. So, two softwares, netfilter and stunnel, in a computer system. stunnel in the OSI application layer and netfilter in the protocol, network and link layers. That's a relationship. > Obviously nowhere. (Stunnel is not related to the Linux Netfilter.). Depends on your personal definition of a relationship. Thanks for explaining, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca https://en.wikibooks.org/wiki/Medical_Suction_Machines https://en.wikibooks.org/wiki/Oberon

1 0

Relationship to Netfilter.
by Peter Easthope 25 Jan '18

25 Jan '18

Where is stunnel in this diagram? https://en.wikipedia.org/wiki/Netfilter#/media/File:Netfilter-packet-flow.s… Thanks, ... Peter E. -- Telephone 1 360 639 0202 or +13606390202. Bcc: peter at easthope.ca http://easthope.ca/Shop.html

2 1

stunnel + mjpeg_streamer issue
by Akos Schneemaier 23 Jan '18

23 Jan '18

HI stunnel users, i hope somebody have an idea what is going wrong in my config: I am runnung debian on an arm box with kernel 4.4.89 and stunnel 5.44. I use mjpeg_streamer to stream webcam images. mjpeg streamer is attaches to port 8080 for http, but for external access connection goes through stunnel on port 2970. The problem is when i connect to mjpeg streamer to get a snapshot via stunnel i receive a broken image 8 time out of 10: https:/ipaddress:2970/?action=snapshot. When i do this via http:/ipaddress:8080/?action=snapshot everything works fine. it seems when image size is below ~11k then it works fine with stunnel, when the size goes above then the chance to receive a broken image increases with stunnel, normal image size is around 22k. Futuremore when i connect to the mjpeg stream of mjpeg stream then everything works fine even over stunnel https:/ipaddress:2970/?action=stream Here is the service config file: pid=/tmp/cam.pid ;foreground=yes ;debug=7 [cam0] cert = /etc/letsencrypt/live/..../fullchain.pem key = /etc/letsencrypt/live/..../privkey.pem sslVersion = all client = no accept = 2970 connect = 8080 [cam1] cert = /etc/letsencrypt/live/..../fullchain.pem key = /etc/letsencrypt/live/..../privkey.pem sslVersion = all client = no accept = 2971 connect = 8081 [cam2] cert = /etc/letsencrypt/live/..../fullchain.pem key = /etc/letsencrypt/live/..../privkey.pem sslVersion = all client = no accept = 2972 connect = 8082 Any ideas welcome! Thanks

1 0

Update on my stunnel problems
by Phil Smith III 21 Jan '18

21 Jan '18

As I'm sure all of you were thinking, the localhost vs. 127.0.0.1 shouldn't have made a difference, and probably didn't: that was across two different machines, as I'd had to switch horses mid-stream (always a bad idea, I realize). Mind you, both machines are the same hardware, same OS, etc. And the 127.0.0.1 version started working on the first machine after a while; I suspect I was seeing Cox's authentication server problems muddying the waters-it has that problem from time to time. BTW, I did check, and I have localhost entries for both IPv4 and IPv6 in my hosts file. This morning when I finally got access to my wife's machine, I installed stunnel with the same config that was working on machine#2 and changed Eudora to point to localhost. I could see Eudora happily connecting to stunnel, but then nothing happened. After the usual checking everything, I decided to try port 1110 instead of 110 for one of the POP accounts. That necessitated closing and reopening Eudora so I could hack the .ini file. After doing so, it worked. Then I changed the other accounts to localhost and they kept working. "Odd", sez I: "I haven't changed them to port 1110!" Still not sure how they were working, since localhost is definitely not serving port 110 that I know of. As my wife was getting antsy about getting her machine back, I didn't investigate further (wish I'd had time): I just changed the stunnel port back to 110, put the one account back to 110, restarted Eudora and refreshed the stunnel config.and all is now working fine. So something was stuck in an old setting, but that doesn't explain either why it was connecting to stunnel but not getting past it, or how it was going to localhost 110 and still working. In any case, it's functioning beautifully (in time for the Wednesday shutdown of non-encrypted POP), and I share this in case it helps someone else down the line! I don't care about SMTP, as I don't use Cox's SMTP anyway. Thanks again for all the helpful suggestions. There wasn't any single "Aha!" moment, but they all helped lead me to the happy place. .phsiii

1 0

Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Now that's interesting. Note that the failed nslookup looked v6-ish. I wonder if Cox is doing some v6 stuff that I don't know about! -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Vincent Deschenes Sent: Thursday, January 18, 2018 1:17 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 >From my experience, this relates to IPv4 vs IPv6. 127.0.0.1 is explicitly V4. While localhost can be V6. Vincent Deschenes -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca Sent: Thursday, 18 January 2018 1:08 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Huh. It does have it. But why didn’t 127.0.0.1 work, I wonder? From: stunnel-users [mailto:[email protected]] On Behalf Of Carter Browne Sent: Thursday, January 18, 2018 2:11 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 You should check your hosts file in \windows\system32\drivers\etc. Make sure it has an entry: 127.0.0.1 localhost The text claims it doesn't need it, but it doesn't hurt to have it, and I'm not sure I totally believe the text. Carter On 1/18/2018 1:55 PM, Phil Smith III wrote: Oh, the logging works--it just doesn't like it there in the file. I have it earlier and it's fine. -------------- C:\Users\phsiii>ls -ld \temp\stunnel-log.txt -rw-r--r-- 1 phsiii None 266835 Jan 18 08:52 \temp\stunnel-log.txt # That's Cygwin ls -- remember, this is Windows 7 C:\Users\phsiii>nslookup localhost Server: UnKnown Address: 2001:4860:4860::8888 *** UnKnown can't find localhost: No response from server # Windows nslookup (per "which nslookup") -------------- Odd. -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca <mailto:[email protected]> Sent: Thursday, January 18, 2018 1:13 PM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <mailto:[email protected]> <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P.

1 0

Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Oh, the logging works--it just doesn't like it there in the file. I have it earlier and it's fine. -------------- C:\Users\phsiii>ls -ld \temp\stunnel-log.txt -rw-r--r-- 1 phsiii None 266835 Jan 18 08:52 \temp\stunnel-log.txt # That's Cygwin ls -- remember, this is Windows 7 C:\Users\phsiii>nslookup localhost Server: UnKnown Address: 2001:4860:4860::8888 *** UnKnown can't find localhost: No response from server # Windows nslookup (per "which nslookup") -------------- Odd. -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 1:13 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

2 1

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Well, I'm stunned (pun intended): while the output= wasn't accepted (it said it wasn't valid there), changing 127.0.0.1 to localhost seems to have fixed it! -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 12:20 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > Here's my stunnel.conf, with blank lines and comments removed: > client = yes > output = C:\temp\stunnel-log.txt > taskbar = yes > debug = 7 > [POP3 Incoming] > protocol = pop3 > accept = 127.0.0.1:1110 > connect = pop.cox.net:995 > protocol = smtp > accept = 127.0.0.1:25 > connect = smtp.cox.net:465 Here it worked for POP3 immediately. Not needed for SMTP. https://en.wikibooks.org/wiki/Oberon/Oberon#Receiving_and_Sending_Email Before using 1110, check. netstat -tulpn | grep 1110 Correct id, passwd and port are in the MUA? Separate configurations for POP3 and SMTP. Troubleshoot one at a time. "protocol" shouldn't be necessary. Try this. [POP3] client = yes output = C:\temp\stunnel-log.txt accept = localhost:1110 connect = pop.cox.net:995 Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: Andrew Culver <aculver(a)uwo.ca> Date: Thu, 18 Jan 2018 11:39:20 -0500 > Some protocols use a protocol-specific command to begin TLS negotiation > (STARTTLS for SMTP and POP3), so stunnel needs to know how (and be told) to > use that command. Phil, General troubleshooting rule, always try for a most elementary, ordinary case before resorting to a special case. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

P.s. From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > protocol = pop3 The stunnel(8) manual has this. "protocol = PROTO application protocol to negotiate TLS This option enables initial, protocol-specific negotiation of the TLS encryption." Is there any need for protocol-specific negotiation? Why? Stunnel provides a tunnel and POP3 works inside. That's all. Try the configuration without the protocol option. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

2 1

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Right, I had done that: >Yes, I have protocol = pop3 and protocol = smtp; I’ve tried >commenting them out individually, no change that I can see. The doc really isn't clear about why you'd want/need these, by the way. But your earlier suggestion (localhost instead of 127.0.0.1) seems to have worked. Still a mystery. I'll be tinkering on machine2 tonight, and then will try on the wife's machine! -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 9:51 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7 P.s. From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > protocol = pop3 The stunnel(8) manual has this. "protocol = PROTO application protocol to negotiate TLS This option enables initial, protocol-specific negotiation of the TLS encryption." Is there any need for protocol-specific negotiation? Why? Stunnel provides a tunnel and POP3 works inside. That's all. Try the configuration without the protocol option. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > Here's my stunnel.conf, with blank lines and comments removed: > client = yes > output = C:\temp\stunnel-log.txt > taskbar = yes > debug = 7 > [POP3 Incoming] > protocol = pop3 > accept = 127.0.0.1:1110 > connect = pop.cox.net:995 > protocol = smtp > accept = 127.0.0.1:25 > connect = smtp.cox.net:465 Here it worked for POP3 immediately. Not needed for SMTP. https://en.wikibooks.org/wiki/Oberon/Oberon#Receiving_and_Sending_Email Before using 1110, check. netstat -tulpn | grep 1110 Correct id, passwd and port are in the MUA? Separate configurations for POP3 and SMTP. Troubleshoot one at a time. "protocol" shouldn't be necessary. Try this. [POP3] client = yes output = C:\temp\stunnel-log.txt accept = localhost:1110 connect = pop.cox.net:995 Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Cox has been warning us that as of next week, we need to use encrypted POP and SMTP. I have two reasons to use stunnel now: 1) I use the K9 Bayesian email proxy for spam filtering, and it doesn't do TLS 2) My wife still uses Eudora and doesn't want to switch, and while Eudora allegedly supports TLS, it's not trivial to make it work (and Cox certainly won't help) Thus stunnel looks like an ideal solution. But after tinkering for a few hours on two machines, I'm stumped. While I can type an SMTP or POP transaction in my sleep, I'm not so good at typing a TLS handshake, so I'm using Outlook 2013 as my test platform (and that's what I'll be using myself later anyway). I setup a new account, point to the right ports on 127.0.0.1, and the test times out, with: Log onto incoming mail server (POP3): The operation timed out waiting for a response from the receiving (POP) server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP). Send test e-mail message: The operation timed out waiting for a response from the sending (SMTP) server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP). Here's my stunnel.conf, with blank lines and comments removed: client = yes output = C:\temp\stunnel-log.txt taskbar = yes debug = 7 [POP3 Incoming] protocol = pop3 accept = 127.0.0.1:1110 connect = pop.cox.net:995 protocol = smtp accept = 127.0.0.1:25 connect = smtp.cox.net:465 Yes, that's port 1110, since K9 is using 110. Shouldn't matter, right? (As long as I point the client at 1110, obviously!) Yes, I have protocol = pop3 and protocol = smtp; I've tried commenting them out individually, no change that I can see. Yes, I'm running stunnel explicitly, not as a service-I found threads suggesting that it just doesn't work as a service on Windows 7 for some reason (and in fact beat my head against that wall for a while first). And here's the stunnel log: 2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1 2018.01.17 21:29:24 LOG7[main]: No limit detected for the number of clients 2018.01.17 21:29:24 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.01.17 21:29:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.01.17 21:29:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.01.17 21:29:24 LOG7[main]: errno: (*_errno()) 2018.01.17 21:29:24 LOG7[ui]: GUI message loop initialized 2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1 2018.01.17 21:29:24 LOG5[main]: Reading configuration from file stunnel.conf 2018.01.17 21:29:24 LOG5[main]: UTF-8 byte order mark not detected 2018.01.17 21:29:24 LOG5[main]: FIPS mode disabled 2018.01.17 21:29:24 LOG7[main]: Compression disabled 2018.01.17 21:29:24 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2018.01.17 21:29:24 LOG7[main]: Wrote 0 new random bytes to C:/.rnd 2018.01.17 21:29:24 LOG7[main]: PRNG seeded successfully 2018.01.17 21:29:24 LOG6[main]: Initializing service [POP3 Incoming] 2018.01.17 21:29:24 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.01.17 21:29:24 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2018.01.17 21:29:24 LOG7[main]: No certificate or private key specified 2018.01.17 21:29:24 LOG4[main]: Service [POP3 Incoming] needs authentication to prevent MITM attacks 2018.01.17 21:29:24 LOG5[main]: Configuration successful 2018.01.17 21:29:24 LOG7[main]: Binding service [POP3 Incoming] 2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=460) 2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=460) bound to 127.0.0.1:1110 2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=464) 2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=464) bound to 127.0.0.1:25 2018.01.17 21:29:24 LOG7[cron]: Cron thread initialized 2018.01.17 21:29:50 LOG7[main]: Found 1 ready file descriptor(s) 2018.01.17 21:29:50 LOG7[main]: FD=424 ifds=r-x ofds=--- 2018.01.17 21:29:50 LOG7[main]: FD=460 ifds=r-x ofds=r-- 2018.01.17 21:29:50 LOG7[main]: Service [POP3 Incoming] accepted (FD=488) from 127.0.0.1:54855 2018.01.17 21:29:50 LOG7[main]: Creating a new thread 2018.01.17 21:29:50 LOG7[main]: New thread created 2018.01.17 21:29:50 LOG7[0]: Service [POP3 Incoming] started 2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on local socket 2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] accepted connection from 127.0.0.1:54855 2018.01.17 21:29:50 LOG6[0]: failover: round-robin, starting at entry #1 2018.01.17 21:29:50 LOG6[0]: s_connect: connecting 68.6.19.8:465 2018.01.17 21:29:50 LOG7[0]: s_connect: s_poll_wait 68.6.19.8:465: waiting 10 seconds 2018.01.17 21:29:50 LOG5[0]: s_connect: connected 68.6.19.8:465 2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] connected remote server from 192.168.1.17:54856 2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.01.17 21:29:50 LOG7[0]: Remote descriptor (FD=508) initialized 2018.01.17 21:30:24 LOG6[cron]: Executing cron jobs 2018.01.17 21:30:24 LOG6[cron]: Cron jobs completed in 0 seconds 2018.01.17 21:30:24 LOG7[cron]: Waiting 86400 seconds 2018.01.17 21:31:05 LOG7[main]: Found 1 ready file descriptor(s) 2018.01.17 21:31:05 LOG7[main]: FD=424 ifds=r-x ofds=--- 2018.01.17 21:31:05 LOG7[main]: FD=460 ifds=r-x ofds=--- 2018.01.17 21:31:05 LOG7[main]: Service [POP3 Incoming] accepted (FD=528) from 127.0.0.1:54891 2018.01.17 21:31:05 LOG7[main]: Creating a new thread 2018.01.17 21:31:05 LOG7[main]: New thread created 2018.01.17 21:31:05 LOG7[1]: Service [POP3 Incoming] started 2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on local socket 2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] accepted connection from 127.0.0.1:54891 2018.01.17 21:31:05 LOG6[1]: failover: round-robin, starting at entry #0 2018.01.17 21:31:05 LOG6[1]: s_connect: connecting 146.20.147.245:995 2018.01.17 21:31:05 LOG7[1]: s_connect: s_poll_wait 146.20.147.245:995: waiting 10 seconds 2018.01.17 21:31:05 LOG5[1]: s_connect: connected 146.20.147.245:995 2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] connected remote server from 192.168.1.17:54892 2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on remote socket 2018.01.17 21:31:05 LOG7[1]: Remote descriptor (FD=336) initialized 2018.01.17 21:34:05 LOG3[1]: Unexpected socket close (s_read) 2018.01.17 21:34:05 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.01.17 21:34:05 LOG7[1]: Remote descriptor (FD=336) closed 2018.01.17 21:34:05 LOG7[1]: Local descriptor (FD=528) closed 2018.01.17 21:34:05 LOG7[1]: Service [POP3 Incoming] finished (1 left) 2018.01.17 21:34:05 LOG7[1]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2018.01.17 21:34:05 LOG7[1]: str_stats: 32 byte(s) at ..\src\network.c:680 2018.01.17 21:34:50 LOG6[0]: s_read: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2018.01.17 21:34:50 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.01.17 21:34:50 LOG7[0]: Remote descriptor (FD=508) closed 2018.01.17 21:34:50 LOG7[0]: Local descriptor (FD=488) closed 2018.01.17 21:34:50 LOG7[0]: Service [POP3 Incoming] finished (0 left) 2018.01.17 21:34:50 LOG7[0]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2018.01.17 21:34:50 LOG7[0]: str_stats: 32 byte(s) at ..\src\network.c:680 It looks like it connects, but then just sits there?! I see these: No certificate or private key specified Service [POP3 Incoming] needs authentication to prevent MITM attacks but that's during startup. Or are those significant? I feel like I'm one setting away from having this all work.! Thanks in advance for any suggestions. -- ...phsiii

1 0

TLS socket closed (SSL_write) with unsent byte(s)
by Cotswold Group - Stephen Murray 16 Jan '18

16 Jan '18

Hi All, We use stunnel to send emails from our scanners to our hosted mail provider (that now only accept TLS connections). This has been working well for a number of years, but just recently the scanners (all Lexmark) have sporadically been giving errors of 'connection failed'. If I check the stunnel logs, the failed send has an extra line in of TLS socket closed (SSL_write) with 418 unsent byte(s) Below are 2 examples, 59 was sent successfully, 60 was not. 2018.01.16 14:37:24 LOG5[59]: Service [fasthosts-smtp] accepted connection from 10.226.174.95:11473 2018.01.16 14:37:24 LOG5[59]: s_connect: connected 213.171.216.50:465 2018.01.16 14:37:24 LOG5[59]: Service [fasthosts-smtp] connected remote server from 10.226.150.9:52577 2018.01.16 14:37:24 LOG5[59]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.01.16 14:37:24 LOG5[59]: s_connect: connected 23.55.155.27:80 2018.01.16 14:37:24 LOG5[59]: OCSP: Certificate accepted 2018.01.16 14:37:24 LOG5[59]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.01.16 14:37:25 LOG5[59]: s_connect: connected 23.55.155.27:80 2018.01.16 14:37:25 LOG5[59]: OCSP: Certificate accepted 2018.01.16 14:37:25 LOG5[59]: Certificate accepted at depth=0: C=GB, ST=Gloucestershire, L=Gloucester, O=Fasthosts Internet Limited, OU=NOC, CN=smtp.livemail.co.uk 2018.01.16 14:37:29 LOG5[59]: Connection closed: 167106 byte(s) sent to TLS, 376 byte(s) sent to socket 2018.01.16 14:38:19 LOG5[60]: Service [fasthosts-smtp] accepted connection from 10.226.174.95:11483 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 213.171.216.50:465 2018.01.16 14:38:19 LOG5[60]: Service [fasthosts-smtp] connected remote server from 10.226.150.9:52620 2018.01.16 14:38:19 LOG5[60]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 23.55.155.27:80 2018.01.16 14:38:19 LOG5[60]: OCSP: Certificate accepted 2018.01.16 14:38:19 LOG5[60]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 23.55.155.27:80 2018.01.16 14:38:19 LOG5[60]: OCSP: Certificate accepted 2018.01.16 14:38:19 LOG5[60]: Certificate accepted at depth=0: C=GB, ST=Gloucestershire, L=Gloucester, O=Fasthosts Internet Limited, OU=NOC, CN=smtp.livemail.co.uk 2018.01.16 14:38:24 LOG3[60]: TLS socket closed (SSL_write) with 418 unsent byte(s) 2018.01.16 14:38:24 LOG5[60]: Connection reset: 964 byte(s) sent to TLS, 392 byte(s) sent to socket Has anyone come across this before? Our mail provider has send limits in place of 50 every 10 minutes, but I am confident we are not reaching those amounts. Any help appreciated. Regards, Stephen

1 0

Connecting a HTTP browser to a HTTPS server.
by peter＠easthope.ca 12 Jan '18

12 Jan '18

Hello, I'm interested to configure stunnel to allow my local non-TLS Web browser to receive pages from a remote server providing only HTTPS. This section of https://www.stunnel.org/static/stunnel.html appears relevant. transparent = none | source | destination | both (Unix only) enable transparent proxy support on selected platforms ... destination The original destination is used instead of the connect option. A service section for transparent destination may look like this: [transparent] client = yes accept = <stunnel_port> transparent = destination This configuration requires iptables setup to work, possibly in /etc/rc.local or equivalent file. ... For a connect target installed on a remote host: /sbin/iptables -I INPUT -i eth0 -p tcp --dport <stunnel_port> -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport <redirected_port> \ -i eth0 -j DNAT --to-destination <local_ip>:<stunnel_port> The transparent destination option is currently only supported on Linux. ==================================== Substitution of parameters for my context gives these configurations.. [transparent] client = yes accept = 127.0.0.1:954 transparent = destination /sbin/iptables -I INPUT -i eth0 -p tcp --dport 954 -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport 443 \ -i eth0 -j DNAT --to-destination 127.0.0.1:954 The non-TLS browser would address http://www.stunnel.org:954/ and receive the page from https://www.stunnel.org:443/. According to Wikipedia, 954 is not assigned. The browser would continue to receive the page http://www.website.org/ without involvement of stunnel or iptables. Plausible? Thanks, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Versions
by Editor 04 Jan '18

04 Jan '18

Hi: On the various repo sites for Redhat-CentOS-Oracle Linux, etc., they are only providing version 4.29 of stunnel. Is there anyway to push them an updated version? I normally use these repo providers: Oracle Linux repo EPEL 6 Repo rpmforce Repo In the end, I tried to compile the latest version on Linux but I get this somewhat cryptic message about a TLS installation directory. I never had this issue before but to be honest, I normally used Solaris (8-9-10) in the past. "Could not find your TLS library installation dir Use --with-ssl option to fix this problem" I tried pointing it at /usr/bin/openssl and also at /usr/lib64/openssl without any luck. Sorry for bothering the list if this has been answered in the past. Thanks. Kevin

2 1

Re: [stunnel-users] outgoing mail solution?
by Parker Brooks 02 Jan '18

02 Jan '18

Douglas, it worked! Thank you! I had not turned on gmail's allow less secure apps, so my first try netted this 2018.01.02 09:00:27 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.01.02 09:00:27 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.01.02 09:00:27 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.01.02 09:00:27 LOG5[main]: Reading configuration from file stunnel.conf 2018.01.02 09:00:27 LOG5[main]: UTF-8 byte order mark not detected 2018.01.02 09:00:27 LOG5[main]: FIPS mode disabled 2018.01.02 09:00:27 LOG5[main]: Configuration successful 2018.01.02 09:03:09 LOG5[0]: Service [gmail-smtp] accepted connection from 127.0.0.1:1046 2018.01.02 09:03:09 LOG5[0]: s_connect: connected 173.194.78.108:587 2018.01.02 09:03:09 LOG5[0]: Service [gmail-smtp] connected remote server from 192.168.1.103:1047 2018.01.02 09:03:09 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/gsr2" 2018.01.02 09:03:10 LOG5[0]: s_connect: connected 172.217.12.78:80 2018.01.02 09:03:10 LOG5[0]: OCSP: Certificate accepted 2018.01.02 09:03:10 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/GTSGIAG3" 2018.01.02 09:03:10 LOG5[0]: s_connect: connected 172.217.12.78:80 2018.01.02 09:03:10 LOG5[0]: OCSP: Certificate accepted 2018.01.02 09:03:10 LOG5[0]: Certificate accepted at depth=0: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com 2018.01.02 09:03:10 LOG3[0]: PLAIN Authentication Failed 2018.01.02 09:03:10 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket my monitoring s/w showed To = xxxxxx(a)gmail.com Connecting to mail server... 127.0.0.1 E-mail Failed. Error: 25058 / [10057] Socket is not connected 1/2/2018 9:03:10 AM there was a security alert from gmail with the instructions to enabling the less secure apps. turned it on and tried again... 2018.01.02 09:17:45 LOG5[1]: Service [gmail-smtp] accepted connection from 127.0.0.1:1050 2018.01.02 09:17:45 LOG5[1]: s_connect: connected 173.194.78.109:587 2018.01.02 09:17:45 LOG5[1]: Service [gmail-smtp] connected remote server from 192.168.1.103:1051 2018.01.02 09:17:47 LOG5[1]: Connection closed: 306 byte(s) sent to TLS, 508 byte(s) sent to socket again, thank you! On Tue, Jan 2, 2018 at 7:35 AM, Harris, Douglas (SSC/SPC) < douglas.harris(a)canada.ca> wrote: > Try this… > > > > [gmail-smtp] > > client = yes > > accept = 127.0.0.1:25 > > connect = smtp.gmail.com:587 <http://smtp.gmail.com:465> > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = smtp.gmail.com > > OCSPaia = yes > > protocol = smtp > > protocolUsername = [your gmail userid] > > protocolPassword = [your gmail password] > > > > > > > > > > *From:* stunnel-users [mailto:[email protected]] *On > Behalf Of *Parker Brooks > *Sent:* January 2, 2018 12:34 AM > *To:* stunnel-users(a)stunnel.org > *Subject:* [stunnel-users] outgoing mail solution? > > > > hello and happy new year! > > > > it seemed this question has been asked before in various ways, however > with the frequent version updates i'm still unclear if stunnel is meant as > a fix to my issue. > > > > i have a outdated home monitoring program running on a winxp box. when an > error occurs it sends an email. it's setup screen (besides the destination > email field) only have a) smtp server, b) undeliverable email address and > c) port # fields to configure. > > > > my workaround for several years (when port 25 became blocked or needed > authetication) has been to use LOApost but they've recently ceased. that > program, also running in the background, and if i understand correctly > acted as a local host. i configured the monitoring program's smtp for > 127.0.0.1 and LOApost did the rest > > > > other searches suggest cloud solutions like sendgrid and authsmtp. but > those sites need a login/ password with the outgoing message. perhaps this > is where i'm getting confused between the differences of SSL and smtp > authentication? > > > > i have gotten gsuite's restricted smtp server to work, but i hoped stunnel > would provide a better solution (ability to send besides gmail/ gsuite > addresses). > > > > below are my conf and log files of my attempt. again, i can't tell if i've > missed a step, or if this is not intended to work. > > > > PS: i've also tried to understand if this feature is on the todo list? > > tia, > > parker > > > > stunnel.conf > > > > [gmail-pop3] > > client = yes > > accept = 127.0.0.1:110 > > connect = pop.gmail.com:995 > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = pop.gmail.com > > OCSPaia = yes > > > > [gmail-imap] > > client = yes > > accept = 127.0.0.1:143 > > connect = imap.gmail.com:993 > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = imap.gmail.com > > OCSPaia = yes > > > > [gmail-smtp] > > client = yes > > accept = 127.0.0.1:25 > > connect = smtp.gmail.com:465 > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = smtp.gmail.com > > OCSPaia = yes > > > > log file > > > > 2017.12.31 16:22:45 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform > > 2017.12.31 16:22:45 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips > 2 Nov 2017 > > 2017.12.31 16:22:45 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 > TLS:ENGINE,FIPS,OCSP,PSK,SNI > > 2017.12.31 16:22:45 LOG5[main]: Reading configuration from file > stunnel.conf > > 2017.12.31 16:22:45 LOG5[main]: UTF-8 byte order mark not detected > > 2017.12.31 16:22:45 LOG5[main]: FIPS mode disabled > > 2017.12.31 16:22:45 LOG5[main]: Configuration successful > > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] accepted connection from > 127.0.0.1:1141 > > 2017.12.31 16:25:03 LOG5[0]: s_connect: connected 173.194.67.108:465 > > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] connected remote server > from 192.168.1.103:1142 > > 2017.12.31 16:25:03 LOG5[0]: OCSP: Connecting the AIA responder " > http://ocsp.pki.goog/gsr2" > > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > > 2017.12.31 16:25:04 LOG5[0]: OCSP: Connecting the AIA responder " > http://ocsp.pki.goog/GTSGIAG3" > > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > > 2017.12.31 16:25:04 LOG5[0]: Certificate accepted at depth=0: C=US, > ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com > > 2017.12.31 16:25:04 LOG5[0]: Connection closed: 55 byte(s) sent to TLS, > 514 byte(s) sent to socket > > > > > > and this is what shows up on my monitoring program log file... > > > > To = xxxxxx(a)gmail.com > > Connecting to mail server... 127.0.0.1 > > Sending message... > > E-mail Failed. Error: 20162 / 530 5.5.1 https://support.google.com/ > mail/?p=WantAuthError 51sm9558225oti.10 - gsmtp > > 12/31/2017 4:25:04 PM >

1 0

Re: [stunnel-users] outgoing mail solution?
by Josealf.rm 02 Jan '18

02 Jan '18

Cool! I was not aware that stunnel fully supported SMTP authentication. Thanks Parker! Saludos Jose Alfredo Diaz > On Jan 2, 2018, at 8:35 AM, Harris, Douglas (SSC/SPC) <douglas.harris(a)canada.ca> wrote: > > Try this… > > [gmail-smtp] > client = yes > accept = 127.0.0.1:25 > connect = smtp.gmail.com:587 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = smtp.gmail.com > OCSPaia = yes > protocol = smtp > protocolUsername = [your gmail userid] > protocolPassword = [your gmail password] > > > > > From: stunnel-users [mailto:[email protected]] On Behalf Of Parker Brooks > Sent: January 2, 2018 12:34 AM > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] outgoing mail solution? > > hello and happy new year! > > it seemed this question has been asked before in various ways, however with the frequent version updates i'm still unclear if stunnel is meant as a fix to my issue. > > i have a outdated home monitoring program running on a winxp box. when an error occurs it sends an email. it's setup screen (besides the destination email field) only have a) smtp server, b) undeliverable email address and c) port # fields to configure. > > my workaround for several years (when port 25 became blocked or needed authetication) has been to use LOApost but they've recently ceased. that program, also running in the background, and if i understand correctly acted as a local host. i configured the monitoring program's smtp for 127.0.0.1 and LOApost did the rest > > other searches suggest cloud solutions like sendgrid and authsmtp. but those sites need a login/ password with the outgoing message. perhaps this is where i'm getting confused between the differences of SSL and smtp authentication? > > i have gotten gsuite's restricted smtp server to work, but i hoped stunnel would provide a better solution (ability to send besides gmail/ gsuite addresses). > > below are my conf and log files of my attempt. again, i can't tell if i've missed a step, or if this is not intended to work. > > PS: i've also tried to understand if this feature is on the todo list? > tia, > parker > > stunnel.conf > > [gmail-pop3] > client = yes > accept = 127.0.0.1:110 > connect = pop.gmail.com:995 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = pop.gmail.com > OCSPaia = yes > > [gmail-imap] > client = yes > accept = 127.0.0.1:143 > connect = imap.gmail.com:993 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = imap.gmail.com > OCSPaia = yes > > [gmail-smtp] > client = yes > accept = 127.0.0.1:25 > connect = smtp.gmail.com:465 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = smtp.gmail.com > OCSPaia = yes > > log file > > 2017.12.31 16:22:45 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform > 2017.12.31 16:22:45 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 > 2017.12.31 16:22:45 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI > 2017.12.31 16:22:45 LOG5[main]: Reading configuration from file stunnel.conf > 2017.12.31 16:22:45 LOG5[main]: UTF-8 byte order mark not detected > 2017.12.31 16:22:45 LOG5[main]: FIPS mode disabled > 2017.12.31 16:22:45 LOG5[main]: Configuration successful > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] accepted connection from 127.0.0.1:1141 > 2017.12.31 16:25:03 LOG5[0]: s_connect: connected 173.194.67.108:465 > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] connected remote server from 192.168.1.103:1142 > 2017.12.31 16:25:03 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gsr2" > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > 2017.12.31 16:25:04 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/GTSGIAG3" > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > 2017.12.31 16:25:04 LOG5[0]: Certificate accepted at depth=0: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com > 2017.12.31 16:25:04 LOG5[0]: Connection closed: 55 byte(s) sent to TLS, 514 byte(s) sent to socket > > > and this is what shows up on my monitoring program log file... > > To = xxxxxx(a)gmail.com > Connecting to mail server... 127.0.0.1 > Sending message... > E-mail Failed. Error: 20162 / 530 5.5.1 https://support.google.com/mail/?p=WantAuthError 51sm9558225oti.10 - gsmtp > 12/31/2017 4:25:04 PM > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

outgoing mail solution?
by Parker Brooks 02 Jan '18

02 Jan '18

hello and happy new year! it seemed this question has been asked before in various ways, however with the frequent version updates i'm still unclear if stunnel is meant as a fix to my issue. i have a outdated home monitoring program running on a winxp box. when an error occurs it sends an email. it's setup screen (besides the destination email field) only have a) smtp server, b) undeliverable email address and c) port # fields to configure. my workaround for several years (when port 25 became blocked or needed authetication) has been to use LOApost but they've recently ceased. that program, also running in the background, and if i understand correctly acted as a local host. i configured the monitoring program's smtp for 127.0.0.1 and LOApost did the rest other searches suggest cloud solutions like sendgrid and authsmtp. but those sites need a login/ password with the outgoing message. perhaps this is where i'm getting confused between the differences of SSL and smtp authentication? i have gotten gsuite's restricted smtp server to work, but i hoped stunnel would provide a better solution (ability to send besides gmail/ gsuite addresses). below are my conf and log files of my attempt. again, i can't tell if i've missed a step, or if this is not intended to work. PS: i've also tried to understand if this feature is on the todo list? tia, parker stunnel.conf [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes log file 2017.12.31 16:22:45 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2017.12.31 16:22:45 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2017.12.31 16:22:45 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.12.31 16:22:45 LOG5[main]: Reading configuration from file stunnel.conf 2017.12.31 16:22:45 LOG5[main]: UTF-8 byte order mark not detected 2017.12.31 16:22:45 LOG5[main]: FIPS mode disabled 2017.12.31 16:22:45 LOG5[main]: Configuration successful 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] accepted connection from 127.0.0.1:1141 2017.12.31 16:25:03 LOG5[0]: s_connect: connected 173.194.67.108:465 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] connected remote server from 192.168.1.103:1142 2017.12.31 16:25:03 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/gsr2" 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted 2017.12.31 16:25:04 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/GTSGIAG3" 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted 2017.12.31 16:25:04 LOG5[0]: Certificate accepted at depth=0: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com 2017.12.31 16:25:04 LOG5[0]: Connection closed: 55 byte(s) sent to TLS, 514 byte(s) sent to socket and this is what shows up on my monitoring program log file... To = xxxxxx(a)gmail.com Connecting to mail server... 127.0.0.1 Sending message... E-mail Failed. Error: 20162 / 530 5.5.1 https://support.google.com/ mail/?p=WantAuthError 51sm9558225oti.10 - gsmtp 12/31/2017 4:25:04 PM

3 2

Updating stunnel 5.43 to 5.44 fails on Win7prof(32)
by tagtraeumer 15 Dec '17

15 Dec '17

Hello, removing compression = zlib did fix the starting issue for v5.44, update worked, thanks. Is 'deflate' affected too? Is compression recommended at this stage of mail processing? Thanks once more, regards! > Hello, > The compression is not recommended with TLS because of the CRIME or > BREACH attacks. > From stunnel v 5.44 in Windows the zlib compression is not supported. > So you should remove the option: > compression = zlib > > If you want to use this compression, please place the file zlib1.dll > (from the previous version) in the stunnel / bin directory. > > Best regards, > Malgorzata

1 0

Updating stunnel 5.43 to 5.44 fails on Win7prof(32)
by tagtraeumer 14 Dec '17

14 Dec '17

Hello, I did try updating stunnel 5.43 to 5.44 on a Win7prof (32bit) system, but it fails... Log before update (v5.43): 2017.12.14 20:46:39 LOG5[main]: stunnel 5.43 on x86-pc-msvc-1500 platform 2017.12.14 20:46:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2017.12.14 20:46:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.12.14 20:46:39 LOG5[main]: Reading configuration from file stunnel.conf 2017.12.14 20:46:39 LOG5[main]: UTF-8 byte order mark detected 2017.12.14 20:46:39 LOG6[main]: UI not supported by engine #1 (capi) 2017.12.14 20:46:39 LOG6[main]: Engine #1 (capi) initialized 2017.12.14 20:46:39 LOG5[main]: FIPS mode disabled 2017.12.14 20:46:39 LOG6[main]: Compression enabled: 2 method(s) 2017.12.14 20:46:39 LOG6[main]: Initializing service [HostEurope_SMTPs] 2017.12.14 20:46:39 LOG6[main]: Loading certificate from file: stunnel.pem 2017.12.14 20:46:39 LOG6[main]: Certificate loaded from file: stunnel.pem 2017.12.14 20:46:39 LOG6[main]: Loading private key from file: stunnel.pem 2017.12.14 20:46:39 LOG6[main]: Private key loaded from file: stunnel.pem 2017.12.14 20:46:39 LOG4[main]: Service [HostEurope_SMTPs] uses "verifyChain" without subject checks 2017.12.14 20:46:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2017.12.14 20:46:39 LOG5[main]: Configuration successful Log after 5.44 update: Pls refer to screenshot at: https://imgur.com/hCOKES7 "Invalid configuration file" errno: (*_errno()) stunnel.conf:65: ["name"]: Failed to initialize TLS How to solve this issue? Thx + regards!

1 0

Exception 40000015 STATUS_FATAL_APP_EXIT
by alexwaskilledfriendlyfire＠gmail.com 11 Dec '17

11 Dec '17

Hello Stunnel-users, Well, I have a problem with latest stunnel-5.44-win32 build. Both GUI and console versions won't to start throwing unhandled exception: tstunnel.exe: Problem signature: Problem Event Name: APPCRASH Application Name: tstunnel.exe Application Version: 0.0.0.0 Application Timestamp: 5a18f4f5 Fault Module Name: tstunnel.exe Fault Module Version: 0.0.0.0 Fault Module Timestamp: 5a18f4f5 Exception Code: 40000015 Exception Offset: 0000e43d OS Version: 6.1.7601.2.1.0.256.4 Locale ID: 1049 Additional Information 1: 57b4 Additional Information 2: 57b4bc5bbe66a065d3bc087357c09646 Additional Information 3: f6bb Additional Information 4: f6bb7b9b6fcf2c5cdb238bc389e9ede9 And GUI version stunnel.exe: --------------------------- Microsoft Visual C++ Runtime Library --------------------------- Runtime Error! Program: C:\Progs\Stunnel\bin\stunnel.exe This application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information. --------------------------- OK --------------------------- Problem signature: Problem Event Name: APPCRASH Application Name: stunnel.exe Application Version: 5.44.0.0 Application Timestamp: 5a18f4f3 Fault Module Name: stunnel.exe Fault Module Version: 5.44.0.0 Fault Module Timestamp: 5a18f4f3 Exception Code: 40000015 Exception Offset: 0000e43d OS Version: 6.1.7601.2.1.0.256.4 Locale ID: 1049 Additional Information 1: 2de9 Additional Information 2: 2de98e0ccee9cc0b77f8fe3f51196ec8 Additional Information 3: 42db Additional Information 4: 42db6f5f1de1e71ee661917dbb7cc0c8 Completely fresh isntallation (or deleting config folder) doesn't solve my problem. My OS is legal Windows 7 x64 with latest updates. There are screenshots just for case. https://i.imgur.com/N1kPI9J.jpg https://i.imgur.com/CqMXWtx.jpg Probably I missing some DLL or service running but it's not an option to turn everything ON (and copy every single DLL ever made to my PC) to determine which one is not running. Probably it's something else. I need help. Thanks. -- Best regards, Alexwaskilledfriendlyfire mailto:[email protected]

2 3

[patch] Fix build with LibreSSL
by Piotr Kubaj 06 Dec '17

06 Dec '17

Building against LibreSSL currently fails. Could you commit this patch? It builds fine on FreeBSD 11.1-RELEASE against LibreSSL 2.6.3. Since it doesn't change anything for OpenSSL, it should build against it too. -- ______________________________________ / A nickel ain't worth a dime anymore. \ | | \ -- Yogi Berra / -------------------------------------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || ||

1 0

possibility to delay connect to host
by Paavo Sild 04 Dec '17

04 Dec '17

Hello! I am a bit new to stunnel and while I tried to search the message archive I did not find any possible reference to the issue I try to solve. I am running a bit older version of stunnel as a simple reverse proxy. It accepts incoming TLS connection and opens clear TCP connection to a host specified by "connect" parameter in config. I wander - it is possible to delay the opening of TCP connection to a host until the actual data is received from client? I haven't found any reference to such a possibility in stunnel but thought that it worth to ask from community. The issue is that due to the nature of traffic there are instances then client negotiates the SSL connection but there is no actual data to be sent by the client. By opening the connection to host only when actual data is present would filter out unnecessary connections towards the application. Anybody had such an issue to solve? -- rgds, Paavo Sild --------------------- paavo.sild(a)estcard.ee ---------------------

1 0

routines:ssl3_read_bytes:sslv3 alert certificate unknown
by Ziad Badawi 04 Dec '17

04 Dec '17

Greetings, I am trying to capture clear text pcaps from client (browser) - server (java appserver) traffic. The java appserver is jboss using https. I'm running jboss and stunnel on the same machine. # stunnel.conf debug = 3 foreground = yes [jboss] client = yes cert= stunnel.pem # generated using makecert.sh accept = 1234 connect = 127.0.0.1:443 Version: stunnel 5.44 on x86_64-pc-linux-gnu platform Compiled/running with OpenSSL 1.0.2k-fips 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:!DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none When I try to test it usng firefox by browsing to https://localhost:1234, FF returns "Secure Connection Failed" and stunnel spits 2017.12.01 20:35:10 LOG3[0]: SSL_connect: 14094416: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown What am I missing / doing wrong? Regards Z

2 2

Stunnel 5.43 problem
by Carter Browne 15 Nov '17

15 Nov '17

When running stunnel 5.43 on Linux 4.14 (arm), accept = port only listens on 127.0.0.1:port. I don't know if other operating systems are affected. Carter

1 0

Re: [stunnel-users] TLS "translation" & 2-way auth
by Igor Gatis 15 Nov '17

15 Nov '17

It would be nice to know whether it is actually possible to achieve this with stunnel. If not, is there any other tool I could use or combine? On Nov 13, 2017 08:58, "Igor Gatis" <igorgatis(a)gmail.com> wrote: Yep, that's exactly what I'm seeking for help here. If we can abstract the 2-way bit for a second, I'd call this a "certificate transcription" TLS tunnel. On Thu, Nov 9, 2017 at 5:19 PM, Vincent Deschenes <vdeschenes(a)stelvio.com> wrote: > Ho, > > But that does not account for the A ->[TLS] ->B part. > > I believe that my sample will listen for unencrypted connection only. > > > > > > *From:* stunnel-users [mailto:[email protected]] *On > Behalf Of *Vincent Deschenes > *Sent:* Thursday, 9 November 2017 3:16 PM > *To:* Igor Gatis <igorgatis(a)gmail.com>; stunnel-users(a)stunnel.org > *Subject:* Re: [stunnel-users] TLS "translation" & 2-way auth > > > > You need to have a section in your config file which listen for requests > but also have the “client = yes” option with a cert and key like this: > > > > [http_a_to_c] > > client = yes > > accept = port_number_to_listen_on_server_b > > connect = server_c_address:443 > > cert = certificate.crt > > key = private.key > > > > > > cert and key are the certificate and private key server B uses to identify > itself on server C. > > You could also add more options to specify a trustore to specify which > cert coming from server C server B will trust, otherwise server B will > simply allow the connection. > > > > Good Luck > > > > > > *From:* stunnel-users [mailto:[email protected] > <stunnel-users-bounces(a)stunnel.org>] *On Behalf Of *Igor Gatis > *Sent:* Thursday, 9 November 2017 1:14 PM > *To:* stunnel-users(a)stunnel.org > *Subject:* [stunnel-users] TLS "translation" & 2-way auth > > > > Consider scenario below: > > > > Server A ==TLS==> Server B ==TLS+2WayAuth==> Server C > > > > Server A needs to connect to Server C through Server B which runs Stunnel. > Server C requires 2-way authentication. I have full control over Server A > and Server B and Server C belongs to a third-party. > > > > What does Stunnel config should look like? > > >

3 2

Re: [stunnel-users] Possible stunnel 5.43 bug ?
by Bezspam 15 Nov '17

15 Nov '17

Hello, The patch fixed the problem. Thank you very much! Best regards, Bez Spam Sent with [ProtonMail](https://protonmail.com) Secure Email. > -------- Original Message -------- > Subject: Re: [stunnel-users] Possible stunnel 5.43 bug ? > Local Time: November 15, 2017 7:15 AM > UTC Time: November 15, 2017 7:15 AM > From: Michal.Trojnara(a)stunnel.org > To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> > > On 11/14/2017 01:33 PM, Bezspam wrote: > >> Is this a bug or expected behaviour? >> Best regards, >> Bez Spam >> >> Dear Bez, >> >> I confirm this is a bug. A patch that fixes it is: >> ftp://ftp.stunnel.org/stunnel/accept.patch >> >> There will be a bugfix release of stunnel later this week. >> >> Best regards, >> Mike > > --------------------------------------------------------------- > > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Ubuntu 16.04 problem
by Carter Browne 14 Nov '17

14 Nov '17

I have a very confusing problem with stunnel on Ubuntu. I have a configuration file that I have used in both Windows and Arch Linux. In the Arch version, I use a single file with all the certificates for the partner systems, in the Windows version I use a capath directory. I have tried both here and I always get the response "tlsv1 alert unknown ca". The beginning of the stunnel.conf file is below. Any hints would be appreciated. Carter cert = /etc/stunnel/xxxxxxx.pem key = /etc/stunnel/xxxxxxx.pem fips = no # Enable client mode client = yes ; Some security enhancements for UNIX systems - comment them out on Win32 #chroot = /var/run/stunnel/ #setuid = stunnel #setgid = stunnel ; PID is created inside chroot jail pid = /etc/stunnel/stunnel.pid ; Some performance tunings # Debug and Foreground are for testing socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Uncomment for debugging stunnel problems debug = 5 output = /etc/stunnel/stunnel.log ##foreground = yes ; NO SSLv2 options = NO_SSLv3 sslVersion = all Ciphers = ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA # # Uncomment and modify the CAFile to point to your ca.txt file #CAFile = /etc/stunnel/all.pem CAPath = /etc/stunnel/capath #CAPath = @sysconfdir/ssl/certs # Uncomment and modify the verify to enable CA validation # verifyChain = no VerifyPeer = yes

1 0

Possible stunnel 5.43 bug ?
by Bezspam 14 Nov '17

14 Nov '17

Hello, I use stunnel on FreeBSD 11.1. I install it from ports. Yesterday I updated to stunnel 5.43. However it stopped working. I investigated the problem and found the issue- instead on all network interfaces, "accept" listens on 127.0.0.1 : sockstat -4 USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS stunnel stunnel 43945 7 tcp4 127.0.0.1:2222 *:* stunnel stunnel 43945 8 tcp4 127.0.0.1:3128 *:* stunnel stunnel 43945 9 tcp4 127.0.0.1:8080 *:* stunnel stunnel 43945 10 tcp4 127.0.0.1:1616 *:* A workaround is to modify "accept = 0.0.0.0:3128" explicitly to listen on 0.0.0.0. Is this a bug or expected behaviour? Best regards, Bez Spam

2 1

TLS "translation" & 2-way auth
by Igor Gatis 13 Nov '17

13 Nov '17

Consider scenario below: Server A ==TLS==> Server B ==TLS+2WayAuth==> Server C Server A needs to connect to Server C through Server B which runs Stunnel. Server C requires 2-way authentication. I have full control over Server A and Server B and Server C belongs to a third-party. What does Stunnel config should look like?

2 3

Email Solution Needed
by Jon Kinne 11 Nov '17

11 Nov '17

I am running Windows 7, 32-bit and I have an email problem I'm trying to solve. I will describe what I need to do and hopefully someone can tell me if stunnel will solve it or if not, where else I might find a solution. I need to send emails out of a database program called Sage Act. It requires that the outgoing SMTP server be on port 25, and be named "smtp.xxx..." My ISP (Charter) blocks port 25, and their SMTP server is called "mobile.charter.net" on port 587. I need to have a way to enter an address like "SMTP.charter.net" (Port 25) in ACT, and when I send that email, it actually goes to "mobile.charter.net" or perhaps my gmail SMTP server on port 587 (Charter) or whatever port the gmail SMTP server requires. I'll certainly appreciate any help anyone can offer me. Thanks, Jon

1 0

Running Stunnel GUI as a service
by Stunnel User999 11 Nov '17

11 Nov '17

Hi, I'm running stunnel 5.43 on Windows 2012 R2 server and trying to run stunnel GUI as a service. Whenever I close my user session, it shuts down the GUI service. Installing the Stunnel TLS Wrapper Windows service does not seem to start the GUI service. How to run GUI in the background as a service? Any information is highly appreciated. Thanks, SN

1 0

Tunnelblick over stunnel - connects but does not work
by Anton Kantsel 10 Nov '17

10 Nov '17

Hi! As OpenVPN seems to become banned in increasing number of countries, I had to look for a way to foil DPI. Wrapping OpenVPN traffic into stunnel SSL-secured connection seems promising but... On Windows machine it really works just fine. But on macOS it connects, but then no surfing or other Internet application works whatsoever. Looks like DNS problem but may be it's different... Moreover, in 40 secs or so Tunnelblick disconnects with message "2017-11-10 00:08:54 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting. 2017-11-10 00:09:30 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's IP address after connecting". Then it tries to connect again but never succeeds and cycles forever. Please find stunnel config and Tunnelblik full log below. Would appreciate any help! [STUNNEL] $ stunnel -version stunnel 5.23 on x86_64-apple-darwin14.5.0 platform Compiled with OpenSSL 0.9.8zd 8 Jan 2015 Running with OpenSSL 0.9.8zh 14 Jan 2016 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = HIGH:+3DES:+DH:!aNULL:!SSLv2 curve = prime256v1 debug = notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none stunnel.conf file: cert=stunnel.pem options=NO_SSLv2 [openvpn] client=yes accept=localhost:989 connect=X.X.X.X:990 [TUNNELBLICK] *Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4 (build 4900); prior version 3.7.3 (build 4880); Standard user git commit 0f68fae3cabe6b2ebdc9fbb3054232074c03bbfb Configuration client2_pc_stunnel "Sanitized" condensed configuration file for /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk: client dev tun proto tcp remote 127.0.0.1 989 resolv-retry infinite nobind persist-key persist-tun verb 3 remote-cert-tls server keepalive 10 120 tls-client key-direction 1 <ca> [Security-related line(s) omitted] </ca> <cert> [Security-related line(s) omitted] </cert> <key> [Security-related line(s) omitted] </key> <tls-auth> [Security-related line(s) omitted] </tls-auth> ================================================================================ XXX ================================================================================ There are no unusual files in client2_pc_stunnel.tblk ================================================================================ Configuration preferences: useDNS = 1 -notMonitoringConnection = 0 -resetPrimaryInterfaceAfterDisconnect = 1 -routeAllTrafficThroughVpn = 1 -runMtuTest = 0 -doNotFlushCache = 0 -useRouteUpInsteadOfUp = 1 -openvpnVersion = - -notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0 -keepConnected = 1 -lastConnectionSucceeded = 1 -prependDomainNameToSearchDomains = 1 ================================================================================ Wildcard preferences: -notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0 ================================================================================ Program preferences: skipWarningAboutNonAdminUpdatingTunnelblick = 1 skipWarningThatIPANotFetchedBeforeConnection = 1 skipWarningThatInternetIsNotReachable = 1 skipWarningAboutPlacingIconNearTheSpotlightIcon = 1 placeIconInStandardPositionInStatusBar = 0 launchAtNextLogin = 1 notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0 tunnelblickVersionHistory = ( "3.7.4 (build 4900)", "3.7.3 (build 4880)", "3.7.2a (build 4851)", "3.7.2 (build 4850)", "3.7.1b (build 4813)", "3.7.1a (build 4812)", "3.7.1 (build 4811)", "3.7.0 (build 4790)", "3.6.9 (build 4685)", "3.6.8 (build 4625)" ) statusDisplayNumber = 0 lastLaunchTime = 531944638.592689 showConnectedDurations = 1 lastLanguageAtLaunchWasRTL = 0 connectionWindowDisplayCriteria = showWhenConnecting maxLogDisplaySize = 102400 lastConnectedDisplayName = client2_pc_stunnel keyboardShortcutIndex = 1 updateCheckAutomatically = 1 NSWindow Frame SettingsSheetWindow = 367 167 829 524 0 0 1280 777 NSWindow Frame ConnectingWindow = 469 442 389 187 0 0 1280 777 NSWindow Frame SUStatusFrame = 624 664 400 129 0 0 1600 877 NSWindow Frame SUUpdateAlert = 516 363 620 392 0 0 1600 877 NSWindow Frame ListingWindow = 64 330 500 422 0 0 1280 777 detailsWindowFrameVersion = 4900 detailsWindowFrame = {{48, 0}, {1232, 777}} detailsWindowLeftFrame = {{0, 0}, {224, 659}} detailsWindowViewIndex = 0 detailsWindowConfigurationsTabIdentifier = log leftNavSelectedDisplayName = client2_pc_stunnel AdvancedWindowTabIdentifier = whileConnected haveDealtWithOldTunTapPreferences = 1 haveDealtWithOldLoginItem = 1 SUEnableAutomaticChecks = 1 SUFeedURL = https://www.tunnelblick.net/appcast-s.rss SUScheduledCheckInterval = 86400 SUSendProfileInfo = 1 SULastCheckTime = 2017-11-09 18:24:28 +0000 SULastProfileSubmissionDate = 2017-11-08 18:10:57 +0000 SUHasLaunchedBefore = 1 WebKitDefaultFontSize = 11 WebKitStandardFont = .AppleSystemUIFont askedUserIfOKToCheckThatIPAddressDidNotChangeAfterConnection = 1 haveDealtWithSparkle1dot5b6 = 1 tunnelblickdHash = 004cdba8e08abd144bc48409040bc80e29c12ee9741ed7d73754f51d2547f7ea tunnelblickdPlistHash = ce400d395d1801b003398461b5420021f4d591822783a04b79b2f43956d28620 updateSendProfileInfo = 1 ================================================================================ Tunnelblick Log: *Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4 (build 4900); prior version 3.7.3 (build 4880) 2017-11-10 00:08:03 *Tunnelblick: Attempting connection with client2_pc_stunnel; Set nameserver = 769; monitoring connection 2017-11-10 00:08:03 *Tunnelblick: openvpnstart start client2_pc_stunnel.tblk 1337 769 0 3 0 1099696 -ptADGNWradsgnw 2.4.4-libressl-2.5.5 2017-11-10 00:08:03 *Tunnelblick: openvpnstart log: OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line): /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.4-libressl-2.5.5/openvpn --daemon --log /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-Sclient2_pc_stunnel.tblk-SContents-SResources-Sconfig.ovpn.769_0_3_0_1099696.1337.openvpn.log --cd /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk/Contents/Resources --setenv IV_GUI_VER "net.tunnelblick.tunnelblick 4900 3.7.4 (build 4900)" --verb 3 --config /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk/Contents/Resources/config.ovpn --verb 3 --cd /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk/Contents/Resources --management 127.0.0.1 1337 --management-query-passwords --management-hold --redirect-gateway def1 --script-security 2 --route-up /Applications/Tunnelblick.app/Contents/Resources/ client.up.tunnelblick.sh -9 -d -f -m -p -r -w -ptADGNWradsgnw --down /Applications/Tunnelblick.app/Contents/Resources/ client.down.tunnelblick.sh -9 -d -f -m -p -r -w -ptADGNWradsgnw 2017-11-10 00:08:03 OpenVPN 2.4.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Nov 2 2017 2017-11-10 00:08:03 library versions: LibreSSL 2.5.5, LZO 2.10 2017-11-10 00:08:03 MANAGEMENT: TCP Socket listening on [AF_INET] 127.0.0.1:1337 2017-11-10 00:08:03 Need hold release from management interface, waiting... 2017-11-10 00:08:03 MANAGEMENT: Client connected from [AF_INET] 127.0.0.1:1337 2017-11-10 00:08:03 *Tunnelblick: openvpnstart starting OpenVPN 2017-11-10 00:08:04 *Tunnelblick: Established communication with OpenVPN 2017-11-10 00:08:04 MANAGEMENT: CMD 'pid' 2017-11-10 00:08:04 MANAGEMENT: CMD 'state on' 2017-11-10 00:08:04 MANAGEMENT: CMD 'state' 2017-11-10 00:08:04 MANAGEMENT: CMD 'bytecount 1' 2017-11-10 00:08:04 MANAGEMENT: CMD 'hold release' 2017-11-10 00:08:04 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2017-11-10 00:08:04 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication 2017-11-10 00:08:04 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication 2017-11-10 00:08:04 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:989 2017-11-10 00:08:04 Socket Buffers: R=[131072->131072] S=[131072->131072] 2017-11-10 00:08:04 Attempting to establish TCP connection with [AF_INET] 127.0.0.1:989 [nonblock] 2017-11-10 00:08:04 MANAGEMENT: >STATE:1510254484,TCP_CONNECT,,,,,, 2017-11-10 00:08:04 TCP connection established with [AF_INET]127.0.0.1:989 2017-11-10 00:08:04 TCP_CLIENT link local: (not bound) 2017-11-10 00:08:04 TCP_CLIENT link remote: [AF_INET]127.0.0.1:989 2017-11-10 00:08:04 MANAGEMENT: >STATE:1510254484,WAIT,,,,,, 2017-11-10 00:08:07 MANAGEMENT: >STATE:1510254487,AUTH,,,,,, 2017-11-10 00:08:07 TLS: Initial packet from [AF_INET]127.0.0.1:989, sid=db4e0f35 f615606b 2017-11-10 00:08:07 VERIFY OK: depth=1, C=UZ, ST=UZ, L=XXX, O=XXX, OU=VPNUnit, CN=XXX <http://talk.ingichkimetals.com>, name=EasyRSA, emailAddress=XXX 2017-11-10 00:08:07 VERIFY KU OK 2017-11-10 00:08:07 Validating certificate extended key usage 2017-11-10 00:08:07 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication 2017-11-10 00:08:07 VERIFY EKU OK 2017-11-10 00:08:07 VERIFY OK: depth=0, C=UZ, ST=UZ, L=XXX, O=IngMet, OU=VPNUnit, CN=server, name=EasyRSA, emailAddress=XXX 2017-11-10 00:08:08 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA 2017-11-10 00:08:08 [server] Peer Connection Initiated with [AF_INET] 127.0.0.1:989 2017-11-10 00:08:09 MANAGEMENT: >STATE:1510254489,GET_CONFIG,,,,,, 2017-11-10 00:08:09 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) 2017-11-10 00:08:10 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway local def1,route 10.0.26.0 255.255.255.0,dhcp-option DNS 10.0.26.1,route 10.0.26.1,topology net30,ping 10,ping-restart 120,ifconfig 10.0.26.10 10.0.26.9,peer-id 0,cipher AES-256-GCM' 2017-11-10 00:08:10 OPTIONS IMPORT: timers and/or timeouts modified 2017-11-10 00:08:10 OPTIONS IMPORT: --ifconfig/up options modified 2017-11-10 00:08:10 OPTIONS IMPORT: route options modified 2017-11-10 00:08:10 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified 2017-11-10 00:08:10 OPTIONS IMPORT: peer-id set 2017-11-10 00:08:10 OPTIONS IMPORT: adjusting link_mtu to 1626 2017-11-10 00:08:10 OPTIONS IMPORT: data channel crypto options modified 2017-11-10 00:08:10 Data Channel: using negotiated cipher 'AES-256-GCM' 2017-11-10 00:08:10 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2017-11-10 00:08:10 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2017-11-10 00:08:10 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16) 2017-11-10 00:08:10 Opened utun device utun1 2017-11-10 00:08:10 do_ifconfig, tt->did_ifconfig_ipv6_setup=0 2017-11-10 00:08:10 MANAGEMENT: >STATE:1510254490,ASSIGN_IP,,10.0.26.10,,,, 2017-11-10 00:08:10 /sbin/ifconfig utun1 delete ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address 2017-11-10 00:08:10 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure 2017-11-10 00:08:10 /sbin/ifconfig utun1 10.0.26.10 10.0.26.9 mtu 1500 netmask 255.255.255.255 up 2017-11-10 00:08:10 /sbin/route add -net 0.0.0.0 10.0.26.9 128.0.0.0 add net 0.0.0.0: gateway 10.0.26.9 2017-11-10 00:08:10 /sbin/route add -net 128.0.0.0 10.0.26.9 128.0.0.0 add net 128.0.0.0: gateway 10.0.26.9 2017-11-10 00:08:10 MANAGEMENT: >STATE:1510254490,ADD_ROUTES,,,,,, 2017-11-10 00:08:10 /sbin/route add -net 10.0.26.0 10.0.26.9 255.255.255.0 add net 10.0.26.0: gateway 10.0.26.9 2017-11-10 00:08:10 /sbin/route add -net 10.0.26.1 10.0.26.9 255.255.255.255 add net 10.0.26.1: gateway 10.0.26.9 ********************************************** Start of output from client.up.tunnelblick.sh Retrieved from OpenVPN: name server(s) [ 10.0.26.1 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ] Not aggregating ServerAddresses because running on OS X 10.6 or higher Prepending 'openvpn' to search domains '' because the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was selected Saved the DNS and SMB configurations so they can be restored Changed DNS ServerAddresses setting from '172.20.10.1' to '10.0.26.1' Changed DNS SearchDomains setting from '' to 'openvpn' Changed DNS DomainName setting from '' to 'openvpn' Did not change SMB NetBIOSName setting of '' Did not change SMB Workgroup setting of '' Did not change SMB WINSAddresses setting of '' DNS servers '10.0.26.1' will be used for DNS queries when the VPN is active NOTE: The DNS servers do not include any free public DNS servers known to Tunnelblick. This may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems. Flushed the DNS cache via dscacheutil /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil Notified mDNSResponder that the DNS cache was flushed Setting up to monitor system configuration with process-network-changes End of output from client.up.tunnelblick.sh ********************************************** 2017-11-10 00:08:13 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this 2017-11-10 00:08:13 Initialization Sequence Completed 2017-11-10 00:08:13 MANAGEMENT: >STATE:1510254493,CONNECTED,SUCCESS,10.0.26.10,127.0.0.1,989,127.0.0.1,50665 2017-11-10 00:08:14 *Tunnelblick: No 'connected.sh' script to execute 2017-11-10 00:08:54 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting. 2017-11-10 00:09:30 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's IP address after connecting. 2017-11-10 00:10:13 [server] Inactivity timeout (--ping-restart), restarting 2017-11-10 00:10:13 SIGUSR1[soft,ping-restart] received, process restarting 2017-11-10 00:10:13 MANAGEMENT: >STATE:1510254613,RECONNECTING,ping-restart,,,,, 2017-11-10 00:10:14 *Tunnelblick: No 'reconnecting.sh' script to execute 2017-11-10 00:10:14 MANAGEMENT: CMD 'hold release' 2017-11-10 00:10:14 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2017-11-10 00:10:14 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:989 2017-11-10 00:10:14 Socket Buffers: R=[131072->131072] S=[131072->131072] 2017-11-10 00:10:14 Attempting to establish TCP connection with [AF_INET] 127.0.0.1:989 [nonblock] 2017-11-10 00:10:14 MANAGEMENT: >STATE:1510254614,TCP_CONNECT,,,,,, 2017-11-10 00:10:15 TCP connection established with [AF_INET]127.0.0.1:989 2017-11-10 00:10:15 TCP_CLIENT link local: (not bound) 2017-11-10 00:10:15 TCP_CLIENT link remote: [AF_INET]127.0.0.1:989 2017-11-10 00:10:15 MANAGEMENT: >STATE:1510254615,WAIT,,,,,, 2017-11-10 00:10:24 Connection reset, restarting [-1] 2017-11-10 00:10:24 SIGUSR1[soft,connection-reset] received, process restarting 2017-11-10 00:10:24 MANAGEMENT: >STATE:1510254624,RECONNECTING,connection-reset,,,,, 2017-11-10 00:10:24 *Tunnelblick: No 'reconnecting.sh' script to execute 2017-11-10 00:10:24 MANAGEMENT: CMD 'hold release' 2017-11-10 00:10:24 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2017-11-10 00:10:24 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:989 2017-11-10 00:10:24 Socket Buffers: R=[131072->131072] S=[131072->131072] 2017-11-10 00:10:24 Attempting to establish TCP connection with [AF_INET] 127.0.0.1:989 [nonblock] 2017-11-10 00:10:24 MANAGEMENT: >STATE:1510254624,TCP_CONNECT,,,,,, 2017-11-10 00:10:25 TCP connection established with [AF_INET]127.0.0.1:989 2017-11-10 00:10:25 TCP_CLIENT link local: (not bound) 2017-11-10 00:10:25 TCP_CLIENT link remote: [AF_INET]127.0.0.1:989 2017-11-10 00:10:25 MANAGEMENT: >STATE:1510254625,WAIT,,,,,, 2017-11-10 00:10:32 *Tunnelblick: Disconnecting; notification window disconnect button pressed 2017-11-10 00:10:33 *Tunnelblick: No 'pre-disconnect.sh' script to execute 2017-11-10 00:10:33 *Tunnelblick: Disconnecting using 'kill' 2017-11-10 00:10:33 event_wait : Interrupted system call (code=4) 2017-11-10 00:10:33 /sbin/route delete -net 10.0.26.0 10.0.26.9 255.255.255.0 delete net 10.0.26.0: gateway 10.0.26.9 2017-11-10 00:10:33 /sbin/route delete -net 10.0.26.1 10.0.26.9 255.255.255.255 delete net 10.0.26.1: gateway 10.0.26.9 2017-11-10 00:10:33 /sbin/route delete -net 0.0.0.0 10.0.26.9 128.0.0.0 delete net 0.0.0.0: gateway 10.0.26.9 2017-11-10 00:10:33 /sbin/route delete -net 128.0.0.0 10.0.26.9 128.0.0.0 delete net 128.0.0.0: gateway 10.0.26.9 2017-11-10 00:10:33 Closing TUN/TAP interface 2017-11-10 00:10:33 /Applications/Tunnelblick.app/Contents/Resources/ client.down.tunnelblick.sh -9 -d -f -m -p -r -w -ptADGNWradsgnw utun1 1500 1623 10.0.26.10 10.0.26.9 init ********************************************** Start of output from client.down.tunnelblick.sh Cancelled monitoring of system configuration changes Restored the DNS and SMB configurations Flushed the DNS cache via dscacheutil /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil Notified mDNSResponder that the DNS cache was flushed Resetting primary interface 'en0' via networksetup -setairportpower en0 off/on... End of output from client.down.tunnelblick.sh ********************************************** 2017-11-10 00:10:36 SIGTERM[hard,] received, process exiting 2017-11-10 00:10:36 MANAGEMENT: >STATE:1510254636,EXITING,SIGTERM,,,,, 2017-11-10 00:10:36 *Tunnelblick: No 'post-disconnect.sh' script to execute 2017-11-10 00:10:36 *Tunnelblick: Expected disconnection occurred. ================================================================================ "Sanitized" full configuration file client dev tun proto tcp remote 127.0.0.1 989 resolv-retry infinite nobind persist-key persist-tun verb 3 remote-cert-tls server keepalive 10 120 tls-client key-direction 1 <ca> [Security-related line(s) omitted] </ca> <cert> [Security-related line(s) omitted] </cert> <key> [Security-related line(s) omitted] </key> <tls-auth> [Security-related line(s) omitted] </tls-auth> ================================================================================ ifconfig output: lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384 options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP> inet 127.0.0.1 netmask 0xff000000 inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 nd6 options=201<PERFORMNUD,DAD> gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280 stf0: flags=0<> mtu 1280 en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 ether 60:03:08:a6:ca:5a inet 172.20.10.2 netmask 0xfffffff0 broadcast 172.20.10.15 media: autoselect status: active en1: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500 options=60<TSO4,TSO6> ether 72:00:01:d9:43:00 media: autoselect <full-duplex> status: inactive en2: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500 options=60<TSO4,TSO6> ether 72:00:01:d9:43:01 media: autoselect <full-duplex> status: inactive p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304 ether 02:03:08:a6:ca:5a media: autoselect status: inactive awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484 ether c2:f1:c7:85:b6:9d inet6 fe80::c0f1:c7ff:fe85:b69d%awdl0 prefixlen 64 scopeid 0x8 nd6 options=201<PERFORMNUD,DAD> media: autoselect status: active bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 options=63<RXCSUM,TXCSUM,TSO4,TSO6> ether 72:00:01:d9:43:00 Configuration: id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0 maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200 root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0 ipfilter disabled flags 0x2 member: en1 flags=3<LEARNING,DISCOVER> ifmaxaddr 0 port 5 priority 0 path cost 0 member: en2 flags=3<LEARNING,DISCOVER> ifmaxaddr 0 port 6 priority 0 path cost 0 media: <unknown type> status: inactive utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000 inet6 fe80::6c50:d369:e570:bf02%utun0 prefixlen 64 scopeid 0xa nd6 options=201<PERFORMNUD,DAD> ================================================================================ Console Log: 2017-11-09 23:23:57 Tunnelblick[1595] Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4 (build 4900) 2017-11-09 23:23:57 Tunnelblick[1595] Warning: preferences contain unknown preference 'PMPrintingExpandedStateForPrint2' 2017-11-09 23:23:57 Tunnelblick[1595] Warning: preferences contain unknown preference 'userAgreementVersionAgreedTo' 2017-11-10 00:08:54 Tunnelblick[1595] currentIPInfo(Name): IP address info could not be fetched within 35.4 seconds; the error was 'Error Domain=NSURLErrorDomain Code=-1001 "The request timed out." UserInfo={NSUnderlyingError=0x60800024a200 {Error Domain=kCFErrorDomainCFNetwork Code=-1001 "The request timed out." UserInfo={NSErrorFailingURLStringKey=https://tunnelblick.net/ipinfo, NSErrorFailingURLKey=https://tunnelblick.net/ipinfo, _kCFStreamErrorCodeKey=-2102, _kCFStreamErrorDomainKey=4, NSLocalizedDescription=The request timed out.}}, NSErrorFailingURLStringKey= https://tunnelblick.net/ipinfo, NSErrorFailingURLKey= https://tunnelblick.net/ipinfo, _kCFStreamErrorDomainKey=4, _kCFStreamErrorCodeKey=-2102, NSLocalizedDescription=The request timed out.}'; the response was '(null)' 2017-11-10 00:09:30 Tunnelblick[1595] currentIPInfo(Address): IP address info could not be fetched within 35.5 seconds; the error was 'Error Domain=NSURLErrorDomain Code=-1001 "The request timed out." UserInfo={NSUnderlyingError=0x60000044cea0 {Error Domain=kCFErrorDomainCFNetwork Code=-1001 "The request timed out." UserInfo={NSErrorFailingURLStringKey=http://205.233.73.116/ipinfo, NSErrorFailingURLKey=http://205.233.73.116/ipinfo, _kCFStreamErrorCodeKey=-2102, _kCFStreamErrorDomainKey=4, NSLocalizedDescription=The request timed out.}}, NSErrorFailingURLStringKey= http://205.233.73.116/ipinfo, NSErrorFailingURLKey= http://205.233.73.116/ipinfo, _kCFStreamErrorDomainKey=4, _kCFStreamErrorCodeKey=-2102, NSLocalizedDescription=The request timed out.}'; the response was '(null)'

1 0

Re: [stunnel-users] Web browsing over stunnel
by Osvald Brko 08 Nov '17

08 Nov '17

> From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Tuesday, November 7, 2017 10:41 AM > To: Peter Pentchev > Cc: Osvald Brko; stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Web browsing over stunnel > Osvald, > Peter made a very clear explanation. Note that your connect statement should be something like: > connect=104.239.213.7:443 > And you should test using something like: > http://www.stunnel.net:8888/ O.K., I understand it. www.stunnel.org still refuse connection (see below), but I was able to open www.wikipedia.org: http://www.wikipedia.org:8888/ [https_test] client = yes accept = 127.0.0.1:8888 connect = 91.198.174.192:443 #127.0.0.1 localhost #127.0.0.1 www.stunnel.org 127.0.0.1 www.wikipedia.org But of course I am not able to use any web link, and I can see only default main page without any path. So stunnel is completely unusable for web browsing, I am right? O.B. ===== http://www.stunnel.org:8888/ [https_test] client = yes accept = 127.0.0.1:8888 connect = 207.192.69.165:443 #127.0.0.1 localhost 127.0.0.1 www.stunnel.org #127.0.0.1 www.wikipedia.org 2017.11.07 15:51:37 LOG7[main]: Service [https_test] (FD=260) bound to 127.0.0.1:8888 2017.11.07 15:51:37 LOG7[cron]: Cron thread initialized 2017.11.07 15:51:53 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.07 15:51:53 LOG7[main]: FD=232 ifds=r-x ofds=--- 2017.11.07 15:51:53 LOG7[main]: FD=248 ifds=r-x ofds=--- 2017.11.07 15:51:53 LOG7[main]: Service [https_test] accepted (FD=300) from 127.0.0.1:3197 2017.11.07 15:51:53 LOG7[main]: Creating a new thread 2017.11.07 15:51:53 LOG7[main]: New thread created 2017.11.07 15:51:53 LOG7[0]: Service [https_test] started 2017.11.07 15:51:53 LOG7[0]: Option TCP_NODELAY set on local socket 2017.11.07 15:51:53 LOG5[0]: Service [https_test] accepted connection from 127.0.0.1:3197 2017.11.07 15:51:53 LOG6[0]: s_connect: connecting 207.192.69.165:443 2017.11.07 15:51:53 LOG7[0]: s_connect: s_poll_wait 207.192.69.165:443: waiting 10 seconds 2017.11.07 15:51:53 LOG5[0]: s_connect: connected 207.192.69.165:443 2017.11.07 15:51:53 LOG5[0]: Service [https_test] connected remote server from XX.XXX.XXX.XXX:3198 2017.11.07 15:51:53 LOG7[0]: Option TCP_NODELAY set on remote socket 2017.11.07 15:51:53 LOG7[0]: Remote descriptor (FD=320) initialized 2017.11.07 15:51:53 LOG6[0]: SNI: sending servername: 207.192.69.165 2017.11.07 15:51:53 LOG6[0]: Peer certificate not required 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): before/connect initialization 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server certificate A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server key exchange A 2017.11.07 15:51:53 LOG6[0]: Client certificate not requested 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server done A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 write finished A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 flush data 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server session ticket A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read finished A 2017.11.07 15:51:53 LOG7[0]: 1 client connect(s) requested 2017.11.07 15:51:53 LOG7[0]: 1 client connect(s) succeeded 2017.11.07 15:51:53 LOG7[0]: 0 client renegotiation(s) requested 2017.11.07 15:51:53 LOG7[0]: 0 session reuse(s) 2017.11.07 15:51:53 LOG6[0]: TLS connected: new session negotiated 2017.11.07 15:51:53 LOG7[0]: Peer certificate was cached (7519 bytes) 2017.11.07 15:51:53 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.07 15:51:53 LOG7[0]: Compression: null, expansion: null 2017.11.07 15:51:58 LOG7[0]: TLS alert (read): warning: close notify 2017.11.07 15:51:58 LOG6[0]: TLS closed (SSL_read) 2017.11.07 15:51:58 LOG7[0]: Sent socket write shutdown 2017.11.07 15:51:59 LOG3[0]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2017.11.07 15:51:59 LOG5[0]: Connection reset: 483 byte(s) sent to TLS, 429 byte(s) sent to socket 2017.11.07 15:51:59 LOG7[0]: Remote descriptor (FD=320) closed 2017.11.07 15:51:59 LOG7[0]: Local descriptor (FD=300) closed 2017.11.07 15:51:59 LOG7[0]: Service [https_test] finished (0 left)

2 2

Re: [stunnel-users] stunnel 5.43 released
by Ian Bamforth 07 Nov '17

07 Nov '17

Hi, I'm having trouble installing the new release on Ubuntu 14.04. The command I'm running is: execute ./configure --with-ssl=/usr/local/openssl-1.1.0g && make && make check && sudo make install I get this output: 15:13:06 stunnel 5.43 on x86_64-pc-linux-gnu platform 15:13:06 Compiled/running with OpenSSL 1.1.0g 2 Nov 2017 15:13:06 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 15:13:06 15:13:06 test 010_require_cert ok 15:13:06 test 011_verify_peer ok 15:13:06 test 012_verify_chain ok 15:13:06 test 013_CRL_file failed 15:13:06 error logs logs/013_CRL_file.log 15:13:06 test 014_PSK_secrets ok 15:13:06 test 015_p12_cert ok 15:13:06 test 020_IPv6 skipped 15:13:06 test 021_FIPS skipped 15:13:06 test 030_simple_execute ok 15:13:06 test 031_redirect ok 15:13:06 test 032_no_redirect ok 15:13:06 test 033_redirect_exec ok 15:13:06 test 034_no_redirect_exec ok 15:13:06 test 035_SNI ok 15:13:06 test 036_no_SNI ok 15:13:06 test 037_failover_prio1 failed 15:13:06 error logs logs/037_failover_prio1.log 15:13:06 test 038_failover_prio2 failed 15:13:06 error logs logs/038_failover_prio2.log 15:13:06 test 039_failover_rr ok 15:13:06 test 040_reload ok 15:13:06 test 110_failure_require_cert ok 15:13:06 test 111_failure_verify_peer ok 15:13:06 test 112_failure_verify_chain ok 15:13:06 test 113_failure_CRL_file ok 15:13:06 test 114_failure_PSK_secrets ok 15:13:06 test 120_failure_no_cert ok 15:13:06 test 121_failure_wrong_config ok 15:13:06 summary: success 21, skip 2, fail 3 15:13:06 ./make_test finished 15:13:06 make[2]: Leaving directory `/opt/stunnel/stunnel-5.43/tests' 15:13:06 make[1]: Leaving directory `/opt/stunnel/stunnel-5.43/tests' 15:13:06 STDERR: make[2]: *** [check-local] Error 1 15:13:06 make[1]: *** [check-am] Error 2 15:13:06 make: *** [check-recursive] Error 1 15:13:06 ---- End output of ./configure --with-ssl=/usr/local/openssl-1.1.0g && make && make check && sudo make install ---- 15:13:06 Ran ./configure --with-ssl=/usr/local/openssl-1.1.0g && make && make check && sudo make install returned 2 This was working until the new release (we were on 5.42), is there some change required? Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division W: www.tracsis.com www.tracsisops.com Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error. -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: 05 November 2017 23:03 To: stunnel-users(a)stunnel.org; stunnel-announce(a)stunnel.org; openssl-users(a)openssl.org Subject: [stunnel-users] stunnel 5.43 released Dear Users, I have released version 5.43 of stunnel. Version 5.43, 2017.11.05, urgency: LOW * New features - OpenSSL DLLs updated to version 1.0.2m. - Android build updated to OpenSSL 1.1.0g. - Allow for multiple "accept" ports per section. - Self-test framework (make check). - Added config load before OpenSSL init (thx to Dmitrii Pichulin). - OpenSSL 1.1.0 support for Travis CI. - OpenSSL 1.1.1-dev compilation fixes. * Bugfixes - Fixed a memory fault on Solaris. - Fixed round-robin failover in the FORK threading model. - Fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown(). - Minor fixes of the logging subsystem. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 05915babf705a0494886a72a7367913d403d07fc908ebb7b380d639e2d8bcee2 stunnel-5.43.tar.gz 5249479d295f482ecac9cd3d5c89c0e5d41ae6ff8e265d4634ecfd8761834201 stunnel-5.43-win32-installer.exe e628fa7027d19bf4f0a62392f9dc042d97959498c292e13ebdf30c65a545dd6d stunnel-5.43-android.zip Best regards, Mike

1 0

Web browsing over stunnel
by Osvald Brko 02 Nov '17

02 Nov '17

Hello, I try to use stunnel for web browsing (https), and I am not successful. (While mail client against IMAP server works fine). Can anybody give me a hint what to try? The situation: Windows XP SP3, MSIE 8 (or Firefox 43.0.1. for check), stunnel 5.42 stunnel.conf : debug = 7 [https_test] client = yes accept = 127.0.0.1:8888 connect = www.stunnel.org:443 http://127.0.0.1:8888/ -> Error HTTP 404 Not Found 2017.11.02 13:01:50 LOG7[main]: Running on Windows 5.1 2017.11.02 13:01:50 LOG7[main]: No limit detected for the number of clients 2017.11.02 13:01:50 LOG5[main]: stunnel 5.42 on x86-pc-msvc-1500 platform 2017.11.02 13:01:50 LOG5[main]: Compiled/running with OpenSSL 1.0.2l-fips 25 May 2017 2017.11.02 13:01:50 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.11.02 13:01:50 LOG7[main]: errno: (*_errno()) 2017.11.02 13:01:50 LOG7[ui]: GUI message loop initialized 2017.11.02 13:01:50 LOG7[main]: Running on Windows 5.1 2017.11.02 13:01:50 LOG5[main]: Reading configuration from file stunnel.conf 2017.11.02 13:01:50 LOG5[main]: UTF-8 byte order mark detected 2017.11.02 13:01:50 LOG5[main]: FIPS mode disabled 2017.11.02 13:01:50 LOG7[main]: Compression disabled 2017.11.02 13:01:50 LOG7[main]: PRNG seeded successfully 2017.11.02 13:01:50 LOG6[main]: Initializing service [XXXXXX-imap] 2017.11.02 13:01:50 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.11.02 13:01:50 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.11.02 13:01:50 LOG7[main]: No certificate or private key specified 2017.11.02 13:01:50 LOG6[main]: Initializing service [https_test] 2017.11.02 13:01:50 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.11.02 13:01:50 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.11.02 13:01:50 LOG7[main]: No certificate or private key specified 2017.11.02 13:01:50 LOG4[main]: Service [https_test] needs authentication to prevent MITM attacks 2017.11.02 13:01:50 LOG5[main]: Configuration successful 2017.11.02 13:01:50 LOG7[main]: Listening file descriptor created (FD=236) 2017.11.02 13:01:50 LOG7[main]: Service [XXXXXX-imap] (FD=236) bound to 127.0.0.1:143 2017.11.02 13:01:50 LOG7[main]: Listening file descriptor created (FD=260) 2017.11.02 13:01:50 LOG7[main]: Service [https_test] (FD=260) bound to 127.0.0.1:8888 2017.11.02 13:01:50 LOG7[cron]: Cron thread initialized 2017.11.02 13:02:11 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.02 13:02:11 LOG7[main]: FD=236 ifds=r-x ofds=--- 2017.11.02 13:02:11 LOG7[main]: FD=248 ifds=r-x ofds=--- 2017.11.02 13:02:11 LOG7[main]: Service [https_test] accepted (FD=304) from 127.0.0.1:3424 2017.11.02 13:02:11 LOG7[main]: Creating a new thread 2017.11.02 13:02:11 LOG7[main]: New thread created 2017.11.02 13:02:11 LOG7[0]: Service [https_test] started 2017.11.02 13:02:11 LOG7[0]: Option TCP_NODELAY set on local socket 2017.11.02 13:02:11 LOG5[0]: Service [https_test] accepted connection from 127.0.0.1:3424 2017.11.02 13:02:11 LOG6[0]: s_connect: connecting 207.192.69.165:443 2017.11.02 13:02:11 LOG7[0]: s_connect: s_poll_wait 207.192.69.165:443: waiting 10 seconds 2017.11.02 13:02:11 LOG5[0]: s_connect: connected 207.192.69.165:443 2017.11.02 13:02:11 LOG5[0]: Service [https_test] connected remote server from XX.XXX.XXX.XXX:3425 2017.11.02 13:02:11 LOG7[0]: Option TCP_NODELAY set on remote socket 2017.11.02 13:02:11 LOG7[0]: Remote descriptor (FD=320) initialized 2017.11.02 13:02:11 LOG6[0]: SNI: sending servername: www.stunnel.org 2017.11.02 13:02:11 LOG6[0]: Peer certificate not required 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): before/connect initialization 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server certificate A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server key exchange A 2017.11.02 13:02:11 LOG6[0]: Client certificate not requested 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server done A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 write finished A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 flush data 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server session ticket A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read finished A 2017.11.02 13:02:11 LOG7[0]: 1 client connect(s) requested 2017.11.02 13:02:11 LOG7[0]: 1 client connect(s) succeeded 2017.11.02 13:02:11 LOG7[0]: 0 client renegotiation(s) requested 2017.11.02 13:02:11 LOG7[0]: 0 session reuse(s) 2017.11.02 13:02:11 LOG6[0]: TLS connected: new session negotiated 2017.11.02 13:02:11 LOG7[0]: Peer certificate was cached (7519 bytes) 2017.11.02 13:02:11 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.02 13:02:11 LOG7[0]: Compression: null, expansion: null 2017.11.02 13:02:16 LOG7[0]: TLS alert (read): warning: close notify 2017.11.02 13:02:16 LOG6[0]: TLS closed (SSL_read) 2017.11.02 13:02:16 LOG7[0]: Sent socket write shutdown 2017.11.02 13:02:21 LOG3[0]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2017.11.02 13:02:21 LOG5[0]: Connection reset: 565 byte(s) sent to TLS, 399 byte(s) sent to socket 2017.11.02 13:02:21 LOG7[0]: Remote descriptor (FD=320) closed 2017.11.02 13:02:21 LOG7[0]: Local descriptor (FD=304) closed 2017.11.02 13:02:21 LOG7[0]: Service [https_test] finished (0 left) 2017.11.02 13:02:50 LOG6[cron]: Executing cron jobs 2017.11.02 13:02:50 LOG6[cron]: Cron jobs completed in 0 seconds 2017.11.02 13:02:50 LOG7[cron]: Waiting 86400 seconds

1 0

Problem: eMail over SMTP on port 587 accepted without error but not forwarded
by Ben Stover 02 Nov '17

02 Nov '17

After a long time of successful usage of stunnel on a Windows 7 system I experienced now permanent problems with sending messages from my local email client over stunnel + SMTP to the remote smtp-server on port 587. Again: my local client+stunnel setup is/was untouched. When I send now messages to remote port 587 (as before) they are silently accepted but NOT forwarded to the final destination. No error messages was returned. The only thing I could imagine is that the webhoster changed the mail server certificate. How does stunnel handle this scenario? Do I have to tell stunnel that the remote certificate changed? how? Receiving eMails through POP3 on port 995 works. WebHoster has no clue what the reason is. The (anonymized) log below shows the transfer Any help is welcomed. Thank you Peter 2017.11.02 13:03:51 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.02 13:03:51 LOG7[main]: FD=388 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=464 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=468 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=472 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=476 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=480 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=484 ifds=r-x ofds=r-- 2017.11.02 13:03:51 LOG7[main]: FD=488 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=492 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=496 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=500 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=504 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=508 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=512 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=516 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=520 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=524 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=528 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: Service [mail-smtp] accepted (FD=904) from 127.0.0.1:47872 2017.11.02 13:03:51 LOG7[main]: Creating a new thread 2017.11.02 13:03:51 LOG7[main]: New thread created 2017.11.02 13:03:51 LOG7[537]: Service [mail-smtp] started 2017.11.02 13:03:51 LOG7[537]: Option TCP_NODELAY set on local socket 2017.11.02 13:03:51 LOG5[537]: Service [mail-smtp] accepted connection from 127.0.0.1:47872 2017.11.02 13:03:51 LOG6[537]: s_connect: connecting 195.54.77.83:587 2017.11.02 13:03:51 LOG7[537]: s_connect: s_poll_wait 195.54.77.83:587: waiting 10 seconds 2017.11.02 13:03:51 LOG5[537]: s_connect: connected 195.54.77.83:587 2017.11.02 13:03:51 LOG5[537]: Service [mail-smtp] connected remote server from 192.168.0.10:47873 2017.11.02 13:03:51 LOG7[537]: Option TCP_NODELAY set on remote socket 2017.11.02 13:03:51 LOG7[537]: Remote descriptor (FD=876) initialized 2017.11.02 13:03:51 LOG7[537]: <- 220 foobar.testserver.com ESMTP Postfix 2017.11.02 13:03:51 LOG7[537]: -> 220 foobar.testserver.com ESMTP Postfix 2017.11.02 13:03:51 LOG7[537]: -> EHLO localhost 2017.11.02 13:03:51 LOG7[537]: <- 250-foobar.testserver.com 2017.11.02 13:03:51 LOG7[537]: <- 250-PIPELINING 2017.11.02 13:03:51 LOG7[537]: <- 250-SIZE 104857600 2017.11.02 13:03:51 LOG7[537]: <- 250-ETRN 2017.11.02 13:03:51 LOG7[537]: <- 250-STARTTLS 2017.11.02 13:03:51 LOG7[537]: <- 250-ENHANCEDSTATUSCODES 2017.11.02 13:03:51 LOG7[537]: <- 250-8BITMIME 2017.11.02 13:03:51 LOG7[537]: <- 250 DSN 2017.11.02 13:03:51 LOG7[537]: -> STARTTLS 2017.11.02 13:03:51 LOG7[537]: <- 220 2.0.0 Ready to start TLS 2017.11.02 13:03:51 LOG6[537]: SNI: sending servername: foobar.testserver.com 2017.11.02 13:03:51 LOG6[537]: Peer certificate not required 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): before/connect initialization 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write client hello A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server hello A 2017.11.02 13:03:51 LOG6[537]: Certificate verification disabled 2017.11.02 13:03:51 LOG6[537]: Certificate verification disabled 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server certificate A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server key exchange A 2017.11.02 13:03:51 LOG6[537]: Client certificate not requested 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server done A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write client key exchange A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write finished A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 flush data 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server session ticket A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read finished A 2017.11.02 13:03:51 LOG7[537]: 2 client connect(s) requested 2017.11.02 13:03:51 LOG7[537]: 2 client connect(s) succeeded 2017.11.02 13:03:51 LOG7[537]: 0 client renegotiation(s) requested 2017.11.02 13:03:51 LOG7[537]: 0 session reuse(s) 2017.11.02 13:03:51 LOG6[537]: TLS connected: new session negotiated 2017.11.02 13:03:51 LOG7[537]: Deallocating application specific data for session connect address 2017.11.02 13:03:51 LOG6[537]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.02 13:03:51 LOG7[537]: Compression: null, expansion: null 2017.11.02 13:03:52 LOG6[537]: Read socket closed (readsocket) 2017.11.02 13:03:52 LOG7[537]: Sending close_notify alert 2017.11.02 13:03:52 LOG7[537]: TLS alert (write): warning: close notify 2017.11.02 13:03:52 LOG6[537]: SSL_shutdown successfully sent close_notify alert 2017.11.02 13:03:52 LOG7[537]: TLS alert (read): warning: close notify 2017.11.02 13:03:52 LOG6[537]: TLS closed (SSL_read) 2017.11.02 13:03:52 LOG7[537]: Sent socket write shutdown 2017.11.02 13:03:52 LOG5[537]: Connection closed: 2954 byte(s) sent to TLS, 337 byte(s) sent to socket 2017.11.02 13:03:52 LOG7[537]: Remote descriptor (FD=876) closed 2017.11.02 13:03:52 LOG7[537]: Local descriptor (FD=904) closed 2017.11.02 13:03:52 LOG7[537]: Service [mailo-smtp] finished (0 left)

1 0

Re: [stunnel-users] How to distinguish stunnel definition between SMTP through SSL-TLS vs. STARTTLS?
by Harris, Douglas (SSC/SPC) 26 Oct '17

26 Oct '17

> Ok, if I specify > > protocol=smtp > > what does that mean: "Connect through SSL-TLS protocol" or "connect through STARTTLS protocol"? That means connect using STARTTLS. > It seems to me that I ALWAYS have to specify "protocol=smtp" for ALL smtp-server connects. You don't. If you are not using STARTTLS you don't specify "protocol=". > Is this done only by port number 465 vs 587? No. > That would mean there is a hidden configuration by convention! Indeed. That would be bad. > What if the webhoster would set up a special mail server at port 8888? Then you would specify port 8888 in your "connect=" config

1 0

How to distinguish stunnel definition between SMTP through SSL-TLS vs. STARTTLS?
by Ben Stover 26 Oct '17

26 Oct '17

As yyou know there are two types of letting a local email client connect to remote secured SMTP server: 1.) through SSL-TLS and 2.) through STARTTLS How do I distinguish betwen these connection types in the stunnel.conf setup file? In a previous post I was told to look at the "protocol" parameter. Ok, if I specify protocol=smtp what does that mean: "Connect through SSL-TLS protocol" or "connect through STARTTLS protocol"? It seems to me that I ALWAYS have to specify "protocol=smtp" for ALL smtp-server connects. The stunnel documentation does not explain how to setup the *.conf file for each of the variants. Is this done only by port number 465 vs 587? That would mean there is a hidden configuration by convention! What if the webhoster would set up a special mail server at port 8888? Ben

1 0

stunnel and TLS1.2 for IE
by Thomas GMX 20 Oct '17

20 Oct '17

Hello. I have successfully configured my email client (Outlook 2010) to my provider with TLS1.2 via stunnel running as a service. config: debug = 5 engine = capi [freenet-pop3s] client = yes EngineID = capi accept = localhost:2110 connect = mx.freenet.de:995 [freenet-smpts] client = yes EngineID = capi accept = localhost:2025 connect = mx.freenet.de:465 That was no problem. But at this point I am wondering if it is possible and how I can configure stunnel so that "all" https traffic from Internet Explorer is going through stunnel and connect to internet with highest secure level supported. Not only to one specific server (connect = xyz.net) but to all servers given in IE address. By now I guess that I have to set IE so that it uses a https-proxy at "localhost:xxx" with stunnel config "accept = localhost:xxx". But how is stunnel config for "connect x.x.x.x:443" that it connect to the right server in internet I specified in IE address line? Can someone give me a hint? Or impossible? Thanks a lot Thomas

2 1

Connection setup for STARTTLS vs. SSL/TLS for POP3/SMTP mail servers?
by Ben Stover 20 Oct '17

20 Oct '17

In stunnels *.conf file I can specify the mail server name and the port for a connection. How can I tell stunnel to use STARTTLS as connect type? How can I tell stunnel to use SSL/TLS as connect type? Does stunnel support both connect types at all or only one? Is the connect type for SMTP completely determined by port e.g.: STARTTLS over port 587 and SSL/TLS over port 465 or can both connect types use both ports? Assume I do not get the supported connect type information from my webhoster: How can I find it out from my (client) side? What are there error messages? Ben

2 1

Stunnel on Android 7.x not working?
by John Appleseed 14 Oct '17

14 Oct '17

Hello, I have trouble with stunnel on Android 7.x.. I'm trying to connect to OpenVPN server through SSL tunneling with stunnel. On phone I'm using stunnel installed in Termux and OpenVPN. Everything is correctly configured, Im using the same config on other devices in same network and it works perfectly. I tried it with different devices with Android 7.x and it is not working at all :( Immediately after succesful connection I am receiving: TLS fd: Software caused connection abort (103) TLS socket closed (SSL_read) And it is still reconnecting again and again with the same error. I also tried it with stunnel downloaded directly from stunnel.org site.. Anyone with new Android who have working stunnel? Where can be the problem? Example stunnel.conf on Android: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = debug [openvpn] client = yes accept = 1337 connect = *****.ddns.net:993 cert = /path/to/stunnel.pem and on server: chroot = /var/lib/stunnel4 pid = /stunnel.pid output = /stunnel.log setuid = stunnel4 setgid = stunnel4 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [openvpn] client = no accept = 993 connect = 127.0.0.1:1194 cert = /etc/stunnel/stunnel.pem Example stunnel.log is in attachment. Thank you very much

1 0

No certificate or private key specified
by Hugo Darley 12 Oct '17

12 Oct '17

Hi, After overcoming some initial more obvious problems I have still been unable to get this client's stunnel configured correctly. "No certificate or private key specified" - is this significant? Stunnel.conf looks like the below: debug = 2 output = stunnel.log CAfile=.\ca-verisign.crt client=yes verify=0 sslVersion = TLSv1.2 options = NO_SSLv2 options = NO_SSLv3 [TRD] accept=16002 connect= our.ip.com:443 [INV] accept=16003 connect= our.ip.com:443 Stunnel output log below 2017.10.12 10:53:22 LOG7[main]: Found 1 ready file descriptor(s) 2017.10.12 10:53:22 LOG7[main]: FD=276 ifds=r-x ofds=--- 2017.10.12 10:53:22 LOG7[main]: FD=284 ifds=r-x ofds=--- 2017.10.12 10:53:22 LOG7[main]: Dispatching signals from the signal pipe 2017.10.12 10:53:22 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2017.10.12 10:53:22 LOG7[main]: Running on Windows 6.1 2017.10.12 10:53:22 LOG5[main]: Reading configuration from file stunnel.conf 2017.10.12 10:53:22 LOG5[main]: UTF-8 byte order mark detected 2017.10.12 10:53:22 LOG5[main]: FIPS mode disabled 2017.10.12 10:53:22 LOG7[main]: Compression disabled 2017.10.12 10:53:22 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2017.10.12 10:53:22 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2017.10.12 10:53:22 LOG7[main]: PRNG seeded successfully 2017.10.12 10:53:22 LOG6[main]: Initializing service [TRD] 2017.10.12 10:53:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.10.12 10:53:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.10.12 10:53:22 LOG7[main]: No certificate or private key specified 2017.10.12 10:53:22 LOG4[main]: Service [TRD] needs authentication to prevent MITM attacks 2017.10.12 10:53:22 LOG6[main]: Initializing service [INV] 2017.10.12 10:53:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.10.12 10:53:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.10.12 10:53:22 LOG7[main]: No certificate or private key specified 2017.10.12 10:53:22 LOG4[main]: Service [INV] needs authentication to prevent MITM attacks 2017.10.12 10:53:22 LOG5[main]: Configuration successful 2017.10.12 10:53:22 LOG7[main]: Closing service [TRD] 2017.10.12 10:53:22 LOG7[main]: Service [TRD] closed (FD=284) 2017.10.12 10:53:22 LOG7[main]: Service [TRD] closed 2017.10.12 10:53:22 LOG7[main]: Closing service [INV] 2017.10.12 10:53:22 LOG7[main]: Service [INV] closed (FD=276) 2017.10.12 10:53:22 LOG7[main]: Service [INV] closed We tried giving the certification a hard location but still it seems unable to find it. Is there anything in the cfg you can see missing? Bearing in mind this is standard cfg for our clients connecting in. Kind regards, Hugo Darley The information contained in and accompanying this communication is strictly confidential and intended solely for the use of the intended recipient(s). If you have received it by mistake please let us know by reply and then delete it from your system; you should not copy the message or disclose its content to anyone. MarketAxess reserves the right to monitor the content of emails sent to or from its systems. Any comments or statements made are not necessarily those of MarketAxess. For more information, please visit www.marketaxess.com. MarketAxess Europe Limited is authorised and regulated by the UK Financial Conduct Authority, registered in England no. 4017610, registered office at 5 Aldermanbury Square, London EC2V 7HR. Telephone (020) 7709 3100. MarketAxess Corporation is regulated in the USA by the SEC and FINRA, incorporated in Delaware, executive offices at 299 Park Avenue, New York, NY 10171. Telephone (1) 212 813 6000.

1 0

OpenService: Error 1060: The specified service does not exist as an installed service.
by Hugo Darley 09 Oct '17

09 Oct '17

User has recently installed v5.4.2 on a windows machine and gets this error: [cid:[email protected]] Downloaded the .exe file from the website, installed into a D: drive folder (not the C: program files x86 folder), edited the config file to what we have advised countless users in the past and added the verisign crt to the same folder. Has reinstalled a couple of times to no avail. I have searched on the net for help but nothing specific to STunnel. Can anyone advise? Many thanks Hugo The information contained in and accompanying this communication is strictly confidential and intended solely for the use of the intended recipient(s). If you have received it by mistake please let us know by reply and then delete it from your system; you should not copy the message or disclose its content to anyone. MarketAxess reserves the right to monitor the content of emails sent to or from its systems. Any comments or statements made are not necessarily those of MarketAxess. For more information, please visit www.marketaxess.com. MarketAxess Europe Limited is authorised and regulated by the UK Financial Conduct Authority, registered in England no. 4017610, registered office at 5 Aldermanbury Square, London EC2V 7HR. Telephone (020) 7709 3100. MarketAxess Corporation is regulated in the USA by the SEC and FINRA, incorporated in Delaware, executive offices at 299 Park Avenue, New York, NY 10171. Telephone (1) 212 813 6000.

1 1

Re: [stunnel-users] Need some info
by Heinsbroek, Peter 09 Oct '17

09 Oct '17

I know. I have a module that reads and writes the pin encrypted from/into a disk file. Till stunnel 5.38 it worked via engine_pkcs and now I try to build it into stunnel. I works ,but the only thing now is where to store the pin after decrypting it. __________________ With regards Peter Heinsbroek Tel. +31 (0)88 265 9869 -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Malgorzata Olszówka Sent: Thursday, October 05, 2017 3:03 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Need some info W dniu 05.10.2017 o 14:39, Heinsbroek, Peter pisze: > How can I get the pin info from the config file entry “engineCtrl = > PIN:12345” into a variable in the ctx.c source With regards, Peter > Heinsbroek SQL & Unix Administrator Hello Peter, This is an example pin to the SoftHSM token. Regards, Malgorzata Olszowka _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Professional support agreement
by alper erbakan 07 Oct '17

07 Oct '17

Hi, I am trying to find a company that willing to glve professional support for stunnel Windows version. I tried to reach from stunnel.org e-mail addresses is not working. Would you please help? Best regards iPhone'umdan gönderildi

2 1

Comments on daily DH Parameters regeneration...
by Taed Wynnell 06 Oct '17

06 Oct '17

We've been experiencing pain due to the daily STunnel regeneration of the DH Parameters. On our single-core machines in the field, this process will use 100% of the CPU for possibly an extended time. This interferes with other tasks that the machine is intended for. What's odd is that this process time ranges wildly, ranging from as low as 3 seconds to 90 minutes, even on the same machine. We see this behavior on all (thousands) of our machines, now that we know what to look for (the "Cron jobs completed in" trace in stunnel.log). We now know that we can set the DH Parameters in the configuration file, and that's what we'll be doing going forward. (Unless someone has another idea to offer.) I'd like to suggest some ideas for the future since I've seen on the mailing list that there are others who have run into this issue: * If the DH Parameter regeneration would run at Idle priority instead of Normal priority, it would not be nearly as noticeable, in that the CPU usage would still be there, but it wouldn't impact other services. The recomputation may be done in a separate thread, if so, this is straight-forward. * If there were a configuration file parameter to specify the regeneration interval. It would default to 24 hours (which is the current behavior), but could be set to a longer interval, a shorter interval for extreme security, or even to never. STunnel would still regenerate at the time of the service starting, unless a fixed DH is found in the configuration file. If a fixed DH were specified in the configuration file, that would avoid the service start computation and the interval would default to never. If both a fixed DH and the interval were specified in the configuration file, it would use the specified interval and recompute only after that interval.

1 0

Need some info
by Heinsbroek, Peter 05 Oct '17

05 Oct '17

How can I get the pin info from the config file entry “engineCtrl = PIN:12345” into a variable in the ctx.c source With regards, Peter Heinsbroek SQL & Unix Administrator Tel. +31 (0)88 265 9869 Mob. +31 6 5375 3244 Werner von Siemensstraat 3 2712 PN Zoetermeer, Nederland Org. unit B&PS-BTN/NL-TS-PS Central Unit 04 Email peter.heinsbroek(a)atos.net<mailto:[email protected]> Web www.nl.atos.net<UrlBlockedError.aspx> Atos IT Solutions and Services B.V. Comm. Register The Hague no. 27380688 This e-mail is intended exclusively for the addressee(s), and may not be forwarded or made available for use to any person other than the addressee(s). If you are not the intended recipient, please notify the sender thereof and destroy/delete the message. The sender disclaims any liability as regards (the content of) this e-mail. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0