- stunnel-users - stunnel.org

Please Help to configure Stunnel for SHOUTcast
by Frans Rehl 24 Jan '17

24 Jan '17

Hello Stunnel Members I am wondering if any of you can help me to configure stunnel for shoutcast. I have a VPS with Windows Server 2012 R2 and I cannot find the correct configuration for windows server. Can someone help me please? My shoutcast is currently streaming on port 8000 however, I don't understand some part of the configuration, such as; cert -pem and ca-pem Could someone guide me? Best

1 0

Creating tunnel to smtp.office365.com:587
by Andrew Culver 17 Jan '17

17 Jan '17

Hello, This is my first time using stunnel so I'm still learning how it works. This may have already been asked, but I'm not sure what to search for in the archives. We have a number of hosts in private IP space that we'd like to be able to send mail to smtp.office365.com:587. I'm trying to configure stunnel for this purpose. What I'd like is to set up a stunnel instance on a server which will accept TLS connections on port 50025. Stunnel will then connect to smtp.office365.com:587 which also uses TLS. How can I do this? I am able to configure stunnel to accept my connection on 587, but the connection is immediately closed (below). If I add client = yes, then I just get: aculver stunnel # openssl s_client -starttls smtp -connect localhost:50025 CONNECTED(00000003) didn't found starttls in server response, try anyway... Here is my config: aculver stunnel # egrep -v '^;|^$' stunnel.conf ; Sample stunnel configuration file for Unix by Michal Trojnara 2002-2015 setuid = nobody setgid = nogroup pid = /usr/local/var/run/stunnel/stunnel.pid [o365-smtp] accept = 50025 cert = /usr/local/etc/stunnel/stunnel.pem connect = smtp.office365.com:587 verifyChain = yes CApath = /etc/ssl/certs protocol = smtp What am I doing wrong? Here's what I get when I don't have client = yes: aculver stunnel # openssl s_client -starttls smtp -connect localhost:50025 CONNECTED(00000003) depth=0 C = CA, ST = Ontario, L = London, O = The University of Western Ontario, OU = ITS, CN = aculver.ws.its.uwo.ca, emailAddress = aculver(a)uwo.ca verify error:num=18:self signed certificate verify return:1 depth=0 C = CA, ST = Ontario, L = London, O = The University of Western Ontario, OU = ITS, CN = aculver.ws.its.uwo.ca, emailAddress = aculver(a)uwo.ca verify return:1 139954991064736:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1263:SSL alert number 40 139954991064736:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: --- Certificate chain 0 s:/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca i:/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca --- Server certificate -----BEGIN CERTIFICATE----- MIIEJzCCAw+gAwIBAgIJAM0DgGLDIh5lMA0GCSqGSIb3DQEBCwUAMIGpMQswCQYD VQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEPMA0GA1UEBwwGTG9uZG9uMSowKAYD VQQKDCFUaGUgVW5pdmVyc2l0eSBvZiBXZXN0ZXJuIE9udGFyaW8xDDAKBgNVBAsM A0lUUzEeMBwGA1UEAwwVYWN1bHZlci53cy5pdHMudXdvLmNhMR0wGwYJKoZIhvcN AQkBFg5hY3VsdmVyQHV3by5jYTAeFw0xNzAxMTcxODAwNTdaFw0yMDAxMTcxODAw NTdaMIGpMQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEPMA0GA1UEBwwG TG9uZG9uMSowKAYDVQQKDCFUaGUgVW5pdmVyc2l0eSBvZiBXZXN0ZXJuIE9udGFy aW8xDDAKBgNVBAsMA0lUUzEeMBwGA1UEAwwVYWN1bHZlci53cy5pdHMudXdvLmNh MR0wGwYJKoZIhvcNAQkBFg5hY3VsdmVyQHV3by5jYTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAL2A3QEU7ReMc+2dTJdxVnQx33dIomQvO6QOAaFkI9pt XF/UhSBCg3ZD2yZeKe5GQ0+KqSCjuxTZE+BMTIeNUtaFEDr9bMAx0toknm29ve1B wTErWoIjE4yqQ+j/D9JLp4BzBcptz1zaEdvhzzZo2zWVpqHrUHSXzoIELD4xyZyF UgbQ057diKr1fqM7q3ozCofslFGEjWtc8SsfwgToT72g7bRhx8a6F6SSX8afcVx0 hvvC998QbTNUCpJO6GPzWWCsITc3RPMZK3OJsbI4NNBKDZ8eE2NTSkcKjnibRWFx bwCTlSZ5XABQrgXmEO51cx6DBAK/8cV8W2H/VNr9SXkCAwEAAaNQME4wHQYDVR0O BBYEFMPXcnQduKdorSNrFIR1up+a5V7RMB8GA1UdIwQYMBaAFMPXcnQduKdorSNr FIR1up+a5V7RMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAKqmaC+g RD1KEWT2yJit0FRIuwzFYmh/jgQ0ofabWQIuQtyNeqVnATU5FMOmox9MgbbsBanC SBVxuiLsWruk6VTjByHaIPAfsdWVKYMfLXO2Rku8GTp1X0B+HcNxh18tKr9s72rB AmapnD1GrYDAlBBgwQz+Ei1iRz+rqKsPvvJ/IEzZ02uhxV0ZWxBi5gTqAQc+pi3y I8DNBTxev2BMw+YCeNnrH3ryrJ8vKYlUmxE0k2POH1ihlpzdx9jtKC9TKR1kahMP 3lbldSHmW9DWeOfzQZ6NDHADSI698HaYfWQXUqbXjNJsxFb47pnjmyWgKseAT9iw w9nPDtkCmUihuBM= -----END CERTIFICATE----- subject=/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca issuer=/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca --- No client certificate CA names sent --- SSL handshake has read 1741 bytes and written 138 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: Session-ID-ctx: Master-Key: 9B6FC3BBEEADF6673416272CA03FA44A2B10BADB3B843317403C03904F0E45E922EA2581F313BF5282C0A47498E43C8D Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1484680413 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- aculver stunnel # Thanks, Andrew

1 0

Forwarding ip without HAProxy protocol
by John BYaka 06 Jan '17

06 Jan '17

Is it possible to forward real ip in special header? I know about 'protocol=proxy' but for using this i need to implement HAProxy protocol in app.

1 0

Stunnel and tokens on Windows
by stunnel.org＠pepak.net 31 Dec '16

31 Dec '16

Hi! I would very much like to switch my Stunnel setup to use hardware tokens. Stunnel apparently supports that using a PKCS11 engine, but I am having hard luck trying to figure it out for Windows, because 1) my practical experience with tokens is nonexistent at the moment, and 2) there are very few pages with a relevant information (basically, I was only able to find the very ancient http://martlaak.wikia.com/wiki/Stunnel_and_engine_pkcs11 and two russian pages http://forum.rutoken.ru/topic/1639/ and https://habrahabr.ru/post/135369/ which probably do just what I need, but I am not so sure they are applicable to my needs as I do not have a rutoken). I guess I would be satified if someone told me, "yes, these pages are applicable, just buy a xxxtoken instead of rutoken"; I would be happier with a full guide, but I can't expect anyone to write it - with the possible exception of Michal Trojnara's paid support (would that be possible?). Thanks, pepak

1 0

Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 21 Dec '16

21 Dec '16

2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>: > Did not have a look at the code yet, but should it be possible to replace > envvars usage by some keys in the registry on windows platform and/or > %userprofile%/config-file ? > > Anyway, my opinion on the patch is that there is no real interest for > "generic/self-expanding" config file , and it is even dangerous : > I would not trust stunnel if, at run time, its config could be modified by > USER envvars... > which difference between %userprofile%/config-file and USER envvars? both are USER owned and USER controlled. certificate and keys also USER private data. and stunnel started by USER owned by USER. if stunnel started by SYSTEM/ADMIN he uses SYSTEM/ADMIN envvars (if needed), certs, keys, etc. global "generic/self-expanding" config file is ADMIN owned. USER has permissions to substitute some values, restricted by ADMIN.

2 10

problem running stunnel as windows service
by Jeff Saxton 09 Dec '16

09 Dec '16

stunnel 5.38 on x86-pc-msvc-1500 platform compiled/running with OpenSSL 1.0.2j-fips 26 Sep 2016 Windows Server 2012R2 Standard When I try and start the service I get: Windows could not start the Secure Socket Tunneling Protocol Service on the Local Computer. Error: 1079: The account specified for this service is different from the account specified for other services running in the same process. So after a little reading I went into Services->Logon and checked: Allow Service to interact with desktop Same Error So I created an account in the Local Administrators group and gave it logon as a service Same thing Any ideas? -- Jeff Saxton Tanium CELL: +US 650.235.0776

1 0

Using transparent destination option with multiple network interfaces.
by Rodney Lott 08 Dec '16

08 Dec '16

Hi, there. Base server details: - Using the latest stunnel 5.37 - Ubuntu Trusty - The computers communicating with each other use bridged interface addresses that are configured by the clustering software (i.e. to ensure that at least one of the nodes is master and host to some common addresses) - For discussion purposes, let's say that each server has an eth0 and eth1, and that the master node has two additional bridged address (ie. eth0:shared-ip1, eth1:shared-ip2) - The slave nodes will try to connect to eth0:shared-ip1:20001 and eth1:shared-ip2:20001 that are hosted on the master - The master node will also try to connect to these as well, while listening on port 20001 - Not running in a chroot and am running stunnel as stunnel4 user - I have created a working solution using 4 services in the stunnel config and using hard-coded destinations in the iptables rules and the stunnel config. I want to create something more dynamic and versatile. I am trying to insert a stunnel instance between my server application that attempts to connect to its twin on another server, using the bridging addresses. I am trying to avoid hard-coding destination IP addresses in my stunnel configuration file and the iptables rules. I also don't want to have separate rules for each interface. For example, from server A's perspective (i.e. the master node), the desirable sequence of events are: - Attempt to connect to port 20001 using the bridge addresses as destinations (in this case, they would be local interfaces). - Intercept the requests to port 20001 on server A and divert them to port 40000 for encryption (i.e. the local stunnel instance). - Send unencrypted data from stunnel directly to local 20001. At the same time, server B is doing the same, except that the bridge addresses reside on server A and are not local. So, server A would also need to do this: - Intercept external request for port 20001 and send it to stunnel port 40000 for encryption - Send decrypted packets to local port 20001 This same type of sequence would also be happening My stunnel configuration looks like this: fips=yes pid=/var/run/stunnel4/testsrv.pid debug=7 output=/var/log/stunnel4/testsrv.log sslVersion = TLSv1.2 key = <private-key-location> cert = <cert-location> CAfile = <ca-file-location> ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:AES256-GCM-SHA384:AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:AES128-GCM-SHA256:AES128-SHA256 [test-srv] client=yes accept=40000 transparent=destination My iptables rules, base on what I read in the man page, are this: STUNNEL_UID=$(id -u stunnel4) # Redirect any incoming requests to port 20001 iptables -t nat -A PREROUTING -p tcp --dport 20001 ! -i lo -j DNAT --to-destination 127.0.0.1:40000 iptables -A INPUT -p tcp --dport 40000 -j ACCEPT # Redirect any outgoing locally generated requests for 20001 to stunnel port 40000 iptables -t nat -A OUTPUT -p tcp --dport 20001 -m owner ! --uid-owner $STUNNEL_UID -j DNAT --to-destination 127.0.0.1:40000 # Redirect the output of stunnel to the local 20001 port iptables -t nat -A OUTPUT -p tcp --dport 20001 -m owner --uid-owner $STUNNEL_UID -j REDIRECT --to-ports 20001 iptables -t nat -A INPUT -p tcp -d 127.0.0.1 --dport 20001 -j ACCEPT These rules are not completely adequate. For now, I'm just trying to get server A's connection to port 20001 working without having to worry about incoming from server B. When I do this and start stunnel and my process, server A's stuff appears to loop endlessly. I think this is happening because the packets that come out of stunnel, due to the transparency configuration, look exactly the same as the original. If I log stuff using iptables, I see repeat entries like this: nat-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=150.150.242.27 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=20001 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 nat-POSTROUTING: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30542 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30542 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 nat-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=150.150.242.27 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=20001 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 nat-POSTROUTING: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=48828 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=48828 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=269 TOS=0x00 PREC=0x00 TTL=64 ID=48829 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK PSH URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=269 TOS=0x00 PREC=0x00 TTL=64 ID=48829 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK PSH URGP=0 ... As can be seen, line 1 and line 7 are virtually identical. In the stunnel log, I can see that stunnel is receiving multiple requests for port 20001 in rapid succession but is not actually receiving any reply from the final destination. So, if anyone has any ideas, tweaks or suggestions for how to solve this problem or where I am going wrong, I would appreciate it. I can use a static configuration with hard-coded destination IP's but if there is an alternative, I would like to know. I have tried for several days to figure this out and have searched Google extensively, including stunnel-users postings, to figure out how to do this without success. Thanks, Rodney Lott

1 1

setgroups: notowner (1)
by Jones, Russell - NONEMP 08 Dec '16

08 Dec '16

I am working on a project where we are migrating to a new datacenter. The new datacenter will not allow compilers on their servers, so I am unable to do a new stunnel build on the new server. I am attempting to move the stunnel install/executables from the old server to the new one. I got past several errors for libraries not found, but now I am stuck. stunnel process will not start, and gets several messages "setgoups: Not owner (1)" I am not sure what I need to do with permissions, ownership, etc to make this work. log attached Thanks for your help, Russell J. This electronic message transmission contains information from CSRA that may be attorney-client privileged, proprietary or confidential. The information in this message is intended only for use by the individual(s) to whom it is addressed. If you believe you have received this message in error, please contact me immediately and be aware that any use, disclosure, copying or distribution of the contents of this message is strictly prohibited. NOTE: Regardless of content, this email shall not operate to bind CSRA to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of email for such purpose.

1 0

Stunnel in inetd mode and PID in logs
by Bruce Guenter 02 Dec '16

02 Dec '16

Hi. I am running stunnel in inetd mode (under tcpserver). Prior to version 5.12 (as far as I can tell), the logs output by stunnel would include the tag LOG#[PID]. As of version 5.12, the logs now say LOG#[main] (and later LOG#[ui]). Is there any way to get the PID back in the logs? I have tried all different choices for the logId configuration option, and it doesn't seem to make a difference there. Thanks. -- Bruce Guenter <bruce(a)untroubled.org> http://untroubled.org/

1 0

Re: [stunnel-users] stunnel 5.38 released
by Javier 26 Nov '16

26 Nov '16

Hi there. Dumb error I just found. Dumb because I just found it and maybe it was earlier among us. Or maybe it is "a feature". But I'd swear it worked as expected in the past. Testing the new SNI option I made a mistake and I had to edit and reload the configuration file. Nothing strange until here. The problem is comming because I load a custom .conf file as "stunnel.exe file.conf" for the server mode, so when a parsing error is found, Stunnel lose the track of the custom .conf file and when you reload the corrected configuration through the "Reload configuration" menu option, it doesn't load the custom .conf but the default stunnel.conf. But before reloading, the "Edit configuration" menu option points correctly to the correct configuration file and opens it to edit. Only "Reload configuration" lose the track of the file. This is happening in the windows environment (just if it wasn't clear enough by the .exe extension ;) ). Windows 2000 (yet). I can't tested versions beyond. Regards.

1 0

Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility
by Jose Alf. 25 Nov '16

25 Nov '16

Jothish, 1. You are using a very outdated version of OpenSSL (openssl 0.9.8 is EOL). I suggest you use a newer, supported version. 2. On a DOS Window, try this:openssl dhparam -rand randfile1;randfile2;randfile3 1024 where randfile1,randfile2.... are existing files or directories to use as entrophy sources. If you're on Linux you can use dd if=/dev/urandom count=2 | openssl dhparam -rand - 1024 This will print something like this:WARNING: can't open config file: c:\openssl-vc/ssl/openssl.cnf Loading 'screen' into random state - done 0 semi-random bytes loaded Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ..+.. bla, bla....++* unable to write 'random state' -----BEGIN DH PARAMETERS----- MIGHAoGBAJJ+QAYkKQd0pG1lxZKDYVZaURkTINQho8CWCUYOMp2ZEwZeMrEv+kjd PVb4Ilnah1TmZQOxu1v8HtSWmKpclhlTDKjmDbhznUFkQhmRGjxXDCfrhnvNI4hV kOB/3lGcWo50ttf+ZqNaXd0lKf9YfnjkRUSUtrHiMRL9CdecxQXbAgEC -----END DH PARAMETERS----- Now, cut from ---BEGIN... all the way to PARAMETERS--- and add it to your cert PEM file. 3. Try again, your check command: openssl dhparam -inform PEM -in ./training_client.pem -check -textShould print something like: DH Parameters: (1024 bit) prime: 00:92:7e:40:06:24:29:07:74:a4:6d:65:c5:92:83: ... 31:12:fd:09:d7:9c:c5:05:db generator: 2 (0x2) DH parameters appear to be ok. -----BEGIN DH PARAMETERS----- MIGHAoGBAJJ+QAYkKQd0pG1lxZKDYVZaURkTINQho8CWCUYOMp2ZEwZeMrEv+kjd ....-----END DH PARAMETERS----- 4. Now, try connecting from SFDC to tibco and let us know. SaludosJose From: "jothish.chokkalingam(a)accenture.com" <jothish.chokkalingam(a)accenture.com> To: josealf(a)rocketmail.com Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org Sent: Thursday, November 24, 2016 6:45 AM Subject: RE: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility #yiv9373448809 #yiv9373448809 -- _filtered #yiv9373448809 {font-family:Wingdings;panose-1:5 0 0 0 0 0 0 0 0 0;} _filtered #yiv9373448809 {panose-1:2 4 5 3 5 4 6 3 2 4;} _filtered #yiv9373448809 {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;} _filtered #yiv9373448809 {font-family:Consolas;panose-1:2 11 6 9 2 2 4 3 2 4;}#yiv9373448809 #yiv9373448809 p.yiv9373448809MsoNormal, #yiv9373448809 li.yiv9373448809MsoNormal, #yiv9373448809 div.yiv9373448809MsoNormal {margin:0in;margin-bottom:.0001pt;font-size:11.0pt;color:black;}#yiv9373448809 a:link, #yiv9373448809 span.yiv9373448809MsoHyperlink {color:#0563C1;text-decoration:underline;}#yiv9373448809 a:visited, #yiv9373448809 span.yiv9373448809MsoHyperlinkFollowed {color:#954F72;text-decoration:underline;}#yiv9373448809 p {margin-right:0in;margin-left:0in;font-size:11.0pt;color:black;}#yiv9373448809 pre {margin:0in;margin-bottom:.0001pt;font-size:10.0pt;color:black;}#yiv9373448809 p.yiv9373448809MsoListParagraph, #yiv9373448809 li.yiv9373448809MsoListParagraph, #yiv9373448809 div.yiv9373448809MsoListParagraph {margin-top:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;font-size:11.0pt;color:black;}#yiv9373448809 span.yiv9373448809HTMLPreformattedChar {font-family:Consolas;color:black;}#yiv9373448809 span.yiv9373448809EmailStyle20 {color:windowtext;}#yiv9373448809 span.yiv9373448809EmailStyle21 {color:#1F497D;}#yiv9373448809 span.yiv9373448809EmailStyle22 {color:#1F497D;}#yiv9373448809 span.yiv9373448809EmailStyle23 {color:#1F497D;}#yiv9373448809 .yiv9373448809MsoChpDefault {font-size:10.0pt;} _filtered #yiv9373448809 {margin:1.0in 1.0in 1.0in 1.0in;}#yiv9373448809 div.yiv9373448809WordSection1 {}#yiv9373448809 _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {}#yiv9373448809 ol {margin-bottom:0in;}#yiv9373448809 ul {margin-bottom:0in;}#yiv9373448809 Jose, For the issue as mentioned in below down mail I am following below two approaches, 1. Move the TLSv1.2 enabled traffic to an intermediate port and then to target port which has TLS1 enabled, in that ssl handshake from intermediate to target port getting below error. While triaging with openssl command, it is observed that the DH parameters are not proper. So we are trying to add the dh parameters C:\Users\robin.johnson\Documents\SSL\SSL>C:\openssl-0.9.8k_X64\bin\openssl dhparam -inform PEM -in ./training_client.pem -check -text unable to load DH parameters 1800:error:0906D06C:PEM routines:PEM_read_bio:no start line:.\crypto\pem\pem_lib.c:650:Expecting: DH PARAMETERS stunnel.logà2016.11.23 23:08:32 LOG3[131]: SSL_connect: 14082174: error:14082174:SSL routines:ssl3_check_cert_and_algorithm:dh key too small 2. Using https service in stunnel traffic is received by TLS V1.1 divert to non ssl enabled port. Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com From: Josealf.rm [mailto:[email protected]] Sent: Thursday, November 24, 2016 4:36 PM To: Chokkalingam, Jothish <jothish.chokkalingam(a)accenture.com> Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility Can you please elaborate? If you want us to help, you need to provide enough information. Regards Jose El 24/11/2016, a las 5:03 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió: Jose, J you are right.i was trying but I thought it will work as a client and it worked as a workaround. But will check for the dh key small error while forwarding the traffic with SSL from intermediate port to another port. Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com From: Josealf.rm [mailto:[email protected]] Sent: Thursday, November 24, 2016 2:48 PM To: Chokkalingam, Jothish <jothish.chokkalingam(a)accenture.com> Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility Jothish, Stunnel in server mode is what you need, with 99.9% confidence. When you write: [https] Accept=443 Connect=local host:80 Client=no Stunnnel will expect TLS connections on port 443 and will forward then to your normal web server running on loopback port 80. Is that clear? Regards, Jose El 24/11/2016, a las 2:29 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió: Is there a way to forward a Secure connection from one port to non secure port using stunnel. I am googling but unable to find. If you have can you let me know Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com From: stunnel-users [mailto:[email protected]]On Behalf Of Carter Browne Sent: Wednesday, November 23, 2016 9:30 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility There are other tools for performing port forwarding with less overhead (I believe tappipe is one), although I make use stunnel to do this extensively. In order forward a secure connection from one port to another is a two step process with stunnel: A sample configuration segment would be: [SFDC reverse in] client = no accept = 8008 connect = localhost:48008 [SFDC reverse out] client = yes accept = localhost:48008 connect = localhost:8009 On 11/23/2016 10:18 AM, Rodney Lott wrote: Hi, there. I'm no stunnel expert, but here's my $0.05 (we have no pennies in Canada anymore ;-) ): - I would try including the key as well as the cert in your stunnel config - I would enable debug on the openssl s_client call to see if it will indicate why it is reseting. Same with your SFDC client to get more info. - Question: is the "WARNING: can't open config file" message below indicative of a permissions or path problem? - Question: Is the stunnel cert and key compatible with the TIBCO server's certificate? They need to be using certs generated from the same key source, don't they? - You might want to fix the SSL version in the stunnel config file (i.e. sslVersion = TLSv1.2) Good luck with your debugging. Rodney On 2016-11-22 07:43 PM, jothish.chokkalingam(a)accenture.com wrote: HI all, There is a problem we have currently connecting tibco client to SFDC sever via TLS v1.2 and that’s solved by using stunnel in client mode. And the communication from SFDC client to tibco server applications w.r.t TLS V1.2 I am unable to solve using stunnel. Below is the configuration in stunnel in server end to divert the traffic from 8008 to 8009, can you help here with the logs is the stunnel configuration is correct or there any missed/need to alter. [SFDC reverse proxy test] debug=7 ;client = yes accept = 8008àport used by sfdc client to connect to TIBCO server connect = localhost:8009 àTibco server that’s running cert = stunnel.pem 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] started 2016.11.23 08:31:56 LOG7[118]: Option TCP_NODELAY set on local socket 2016.11.23 08:31:56 LOG5[118]: Service [SFDC reverse proxy test] accepted connection from 101.167.198.14:54477 2016.11.23 08:31:56 LOG6[118]: Peer certificate not required 2016.11.23 08:31:56 LOG7[118]: SSL state (accept): before/accept initialization 2016.11.23 08:31:56 LOG3[118]: SSL_accept: Peer suddenly disconnected 2016.11.23 08:31:56 LOG5[118]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.11.23 08:31:56 LOG7[118]: Local descriptor (FD=696) closed 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] finished (0 left) PFB the openssl snap shot looks odd C:\Program Files (x86)\stunnel\bin>openssl s_client -connect localhost:8008 -prexit -showcerts WARNING: can't open config file: /devel/win32/openssl/openssl.cnf CONNECTED(0000016C) Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility
by Josealf.rm 24 Nov '16

24 Nov '16

Can you please elaborate? If you want us to help, you need to provide enough information. Regards Jose > El 24/11/2016, a las 5:03 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió: > > Jose, > J you are right.i was trying but I thought it will work as a client and it worked as a workaround. But will check for the dh key small error while forwarding the traffic with SSL from intermediate port to another port. > > Thanks and Regards, > Jothish > TIBCO TSD > Ph. : +91 44 39263958 > Mobile : +91 9884040171 > Support : +91 9962007110 > OC : jothish.chokkalingam > Group mail:- Telstra.psm.tsd.tibco(a)accenture.com > > From: Josealf.rm [mailto:[email protected]] > Sent: Thursday, November 24, 2016 2:48 PM > To: Chokkalingam, Jothish <jothish.chokkalingam(a)accenture.com> > Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility > > Jothish, > > Stunnel in server mode is what you need, with 99.9% confidence. > > When you write: > > [https] > Accept=443 > Connect=local host:80 > Client=no > > Stunnnel will expect TLS connections on port 443 and will forward then to your normal web server running on loopback port 80. > > Is that clear? > > Regards, > Jose > > El 24/11/2016, a las 2:29 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió: > > > Is there a way to forward a Secure connection from one port to non secure port using stunnel. I am googling but unable to find. If you have can you let me know > > Thanks and Regards, > Jothish > TIBCO TSD > Ph. : +91 44 39263958 > Mobile : +91 9884040171 > Support : +91 9962007110 > OC : jothish.chokkalingam > Group mail:- Telstra.psm.tsd.tibco(a)accenture.com > > From: stunnel-users [mailto:[email protected]] On Behalf Of Carter Browne > Sent: Wednesday, November 23, 2016 9:30 PM > To: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility > > There are other tools for performing port forwarding with less overhead (I believe tappipe is one), although I make use stunnel to do this extensively. > > In order forward a secure connection from one port to another is a two step process with stunnel: > > A sample configuration segment would be: > > [SFDC reverse in] > > client = no > > accept = 8008 > > connect = localhost:48008 > > > [SFDC reverse out] > client = yes > accept = localhost:48008 > connect = localhost:8009 > > On 11/23/2016 10:18 AM, Rodney Lott wrote: > Hi, there. > > I'm no stunnel expert, but here's my $0.05 (we have no pennies in Canada anymore ;-) ): > - I would try including the key as well as the cert in your stunnel config > - I would enable debug on the openssl s_client call to see if it will indicate why it is reseting. Same with your SFDC client to get more info. > - Question: is the "WARNING: can't open config file" message below indicative of a permissions or path problem? > - Question: Is the stunnel cert and key compatible with the TIBCO server's certificate? They need to be using certs generated from the same key source, don't they? > - You might want to fix the SSL version in the stunnel config file (i.e. sslVersion = TLSv1.2) > > Good luck with your debugging. > > Rodney > > On 2016-11-22 07:43 PM, jothish.chokkalingam(a)accenture.com wrote: > HI all, > > There is a problem we have currently connecting tibco client to SFDC sever via TLS v1.2 and that’s solved by using stunnel in client mode. And the communication from SFDC client to tibco server applications w.r.t TLS V1.2 I am unable to solve using stunnel. Below is the configuration in stunnel in server end to divert the traffic from 8008 to 8009, can you help here with the logs is the stunnel configuration is correct or there any missed/need to alter. > > [SFDC reverse proxy test] > debug=7 > ;client = yes > accept = 8008àport used by sfdc client to connect to TIBCO server > connect = localhost:8009 àTibco server that’s running > cert = stunnel.pem > 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] started > 2016.11.23 08:31:56 LOG7[118]: Option TCP_NODELAY set on local socket > 2016.11.23 08:31:56 LOG5[118]: Service [SFDC reverse proxy test] accepted connection from 101.167.198.14:54477 > 2016.11.23 08:31:56 LOG6[118]: Peer certificate not required > 2016.11.23 08:31:56 LOG7[118]: SSL state (accept): before/accept initialization > 2016.11.23 08:31:56 LOG3[118]: SSL_accept: Peer suddenly disconnected > 2016.11.23 08:31:56 LOG5[118]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket > 2016.11.23 08:31:56 LOG7[118]: Local descriptor (FD=696) closed > 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] finished (0 left) > > PFB the openssl snap shot looks odd > C:\Program Files (x86)\stunnel\bin>openssl s_client -connect localhost:8008 -prexit -showcerts > WARNING: can't open config file: /devel/win32/openssl/openssl.cnf > CONNECTED(0000016C) > > Thanks and Regards, > Jothish > TIBCO TSD > Ph. : +91 44 39263958 > Mobile : +91 9884040171 > Support : +91 9962007110 > OC : jothish.chokkalingam > Group mail:- Telstra.psm.tsd.tibco(a)accenture.com > > > > This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. > ______________________________________________________________________________________ > > www.accenture.com > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Help in setting stunnel in server mode to over come TLSV2 compatibility
by jothish.chokkalingam＠accenture.com 24 Nov '16

24 Nov '16

HI all, There is a problem we have currently connecting tibco client to SFDC sever via TLS v1.2 and that's solved by using stunnel in client mode. And the communication from SFDC client to tibco server applications w.r.t TLS V1.2 I am unable to solve using stunnel. Below is the configuration in stunnel in server end to divert the traffic from 8008 to 8009, can you help here with the logs is the stunnel configuration is correct or there any missed/need to alter. [SFDC reverse proxy test] debug=7 ;client = yes accept = 8008-->port used by sfdc client to connect to TIBCO server connect = localhost:8009 -->Tibco server that's running cert = stunnel.pem 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] started 2016.11.23 08:31:56 LOG7[118]: Option TCP_NODELAY set on local socket 2016.11.23 08:31:56 LOG5[118]: Service [SFDC reverse proxy test] accepted connection from 101.167.198.14:54477 2016.11.23 08:31:56 LOG6[118]: Peer certificate not required 2016.11.23 08:31:56 LOG7[118]: SSL state (accept): before/accept initialization 2016.11.23 08:31:56 LOG3[118]: SSL_accept: Peer suddenly disconnected 2016.11.23 08:31:56 LOG5[118]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.11.23 08:31:56 LOG7[118]: Local descriptor (FD=696) closed 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] finished (0 left) PFB the openssl snap shot looks odd C:\Program Files (x86)\stunnel\bin>openssl s_client -connect localhost:8008 -prexit -showcerts WARNING: can't open config file: /devel/win32/openssl/openssl.cnf CONNECTED(0000016C) Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

4 4

uninstall.exe
by Michael Curran 22 Nov '16

22 Nov '16

With the distrubuted version of stunnel, there is an uninstall.exe Are there any options for this uninstaller, so I can automate removal and upgrade processes ? Like a /quiet or /Q ?? Which uninstaller application is this based off of?

1 0

Connection failure on IPv4-only box with IPv6-address in RR DNS record
by Michael Weiser 18 Nov '16

18 Nov '16

Hi, the server I connect to using stunnel has just been upgraded to IPv6. In the process an AAAA record was added to its DNS entry. The box I run stunnel on is IPv4-only, meaning, the kernel does not have any IPv6 support at all. The DNS stub resolver is still looking for AAAA records though. Consequently stunnel connections now fail about half of the time with error: 2016.11.18 20:10:57 LOG3[ui]: remote socket: Address family not supported by protocol (97) >From looking at client.c I can see that stunnel supports trying all target addresses in turn but will bail if the socket cannot be created: for(ind_try=0; ind_try<c->connect_addr.num; ind_try++) { c->fd=s_socket(c->connect_addr.addr[ind_cur].sa.sa_family, SOCK_STREAM, 0, 1, "remote socket"); if(c->fd==INVALID_SOCKET) longjmp(c->err, 1); [...] if(s_connect(c, &c->connect_addr.addr[ind_cur], [...] continue; /* next IP */ } [...] return fd; /* success! */ So I guess the problem would go away if I enabled IPv6 in the kernel of my client box: s_socket() would succeed but connect() would fail with ENETUNREACH. But couldn't stunnel just continue with the next IP if s_socket() failed with EAFNOSUPPORT? -- Thanks, Michael

1 0

Deactivate expiry date check, Have CA check with verify = 3
by Mark Shine 18 Nov '16

18 Nov '16

Hello, I would like to setup stunnel but the certificate from my other tunnel is expired. How would I tell stunnel to ignore verification of expiry date of the certificate coming from stunnel client mode to the stunnel server mode? I want to be able to verify the certificate but ignore the expiry date. Not disable cert check all the way I have a stunnel setup by someone else that has done this exact thing but I have no clue how they did it. Stunnel seems to use openssl for the verification so I guess the question should be how to bypass openssl expiry check. Please see the below link for my issue on stackexchange. http://unix.stackexchange.com/questions/323997/stunnel-how-to-ignore-the-ce… [http://cdn.sstatic.net/Sites/unix/img/[email protected]?v=32fb07f7ce26…]<http://unix.stackexchange.com/questions/323997/stunnel-how-to-ignore-the-ce…> Stunnel: How to ignore the cert expiry date<http://unix.stackexchange.com/questions/323997/stunnel-how-to-ignore-the-ce…> unix.stackexchange.com I would like to setup stunnel but the certificate from my other tunnel is expired. How would I tell stunnel to ignore verification of expiry date of the certificate coming from stunnel client mode ...

1 0

Windows builds
by Michael Curran 16 Nov '16

16 Nov '16

Hello -- Are there some solid instructions for building stunnel on windows? I am using Microsoft VS 2015 and the 64-bit compilers -- This is the basic error I am running into, but could be that stunnel wont work with 64-bit? C:\stunnel_build\stunnel-5.36.tar\stunnel-5.36\src>.\makew32.bat W32 ENVIRONMENT OK Microsoft (R) Program Maintenance Utility Version 14.00.24210.0 Copyright (C) Microsoft Corporation. All rights reserved. Detected target: win64 cl /MD /W3 /O2 /nologo /I"\devel\win64\openssl\include" /DUNICODE /D_UNICODE -Fo..\obj\win64\stunnel.obj -c ..\src\stunnel.c stunnel.c c:\stunnel_build\stunnel-5.36.tar\stunnel-5.36\src\common.h(414): fatal error C1083: Cannot open include file: 'openssl/opensslconf.h': No such file or directory NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\BIN\amd64\cl.EXE"' : return code '0x2' Stop.

2 2

Stunnel-5.x on windows 10
by Michael Curran 15 Nov '16

15 Nov '16

I have a method with VS to compile Stunnel as 64-bit for use with Windows Are there any decent instructions for compiling it as 64-bit? Michael Curran | Systems Architect Office: 614-568-2285 Mobile: 614-403-6320 ConnectSolutions | 126 Post St. Ste. 400 | San Francisco, CA 94108

1 0

Assistance needed debugging Stunnel AWS EC2 Interface
by Donald F. Coffin 15 Nov '16

15 Nov '16

I am using stunnel as a proxy to support SoapUI mock services which are used to test an SSL based application. The SoapUI and stunnel proxy are running on an AWS Ubuntu 14.04 EC2 Instance communicating to a Tomcat server running on a second AWS Ubuntu 14.04 EC2 Instance. The target application uses a wildcard SSL Certificate and works successfully when accessed using a desktop browser (Chrome or Firefox). The issue I am encountering is that the stunnel connection logs a "SSL closed on SSL_read" message as soon as the cipher suite is negotiated as shown in the following stunnel.log: 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Clients allowed=2000 2016.11.14 21:34:19 LOG5[5287:140430154716992]: stunnel 4.53 on x86_64-pc-linux-gnu platform 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Compiled with OpenSSL 1.0.1e 11 Feb 2013 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Running with OpenSSL 1.0.1f 6 Jan 2014 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Update OpenSSL shared libraries or rebuild stunnel 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Reading configuration from file /etc/stunnel/stunnel.conf 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Compression not enabled 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Snagged 64 random bytes from /home/ubuntu/.rnd 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Wrote 1024 new random bytes to /home/ubuntu/.rnd 2016.11.14 21:34:19 LOG7[5287:140430154716992]: PRNG seeded successfully 2016.11.14 21:34:19 LOG6[5287:140430154716992]: Initializing service section [resourceServer] 2016.11.14 21:34:19 LOG4[5287:140430154716992]: Insecure file permissions on /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Key file: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Private key loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Verify directory set to /etc/ssl/certs 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Added /etc/ssl/certs revocation lookup directory 2016.11.14 21:34:19 LOG7[5287:140430154716992]: SSL options set: 0x00000004 2016.11.14 21:34:19 LOG6[5287:140430154716992]: Initializing service section [tpserver] 2016.11.14 21:34:19 LOG4[5287:140430154716992]: Insecure file permissions on /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Key file: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Private key loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Verify directory set to /etc/ssl/certs 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Added /etc/ssl/certs revocation lookup directory 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Could not load DH parameters from /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Using hardcoded DH parameters 2016.11.14 21:34:19 LOG7[5287:140430154716992]: DH initialized with 2048-bit key 2016.11.14 21:34:19 LOG7[5287:140430154716992]: ECDH initialized with curve prime256v1 2016.11.14 21:34:19 LOG7[5287:140430154716992]: SSL options set: 0x00000004 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Configuration successful 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Service [resourceServer] (FD=12) bound to 127.0.0.1:8080 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Service [tpserver] (FD=13) bound to 127.0.0.1:8444 2016.11.14 21:34:19 LOG7[5293:140430154716992]: Created pid file /var/run/stunnel4.pid 2016.11.14 21:34:25 LOG7[5293:140430154716992]: Service [resourceServer] accepted (FD=3) from 127.0.0.1:41256 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Service [resourceServer] started 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Waiting for a libwrap process 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Acquired libwrap process #0 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Releasing libwrap process #0 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Released libwrap process #0 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Service [resourceServer] permitted by libwrap from 127.0.0.1:41256 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Service [resourceServer] accepted connection from 127.0.0.1:41256 2016.11.14 21:34:25 LOG6[5293:140430154827520]: connect_blocking: connecting 52.43.245.161:8443 2016.11.14 21:34:25 LOG7[5293:140430154827520]: connect_blocking: s_poll_wait 52.43.245.161:8443: waiting 10 seconds 2016.11.14 21:34:25 LOG5[5293:140430154827520]: connect_blocking: connected 52.43.245.161:8443 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Service [resourceServer] connected remote server from 172.31.44.97:34077 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Remote socket (FD=15) initialized 2016.11.14 21:34:25 LOG7[5293:140430154827520]: SNI: host name: 52.43.245.161 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Starting certificate verification: depth=2, /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 2016.11.14 21:34:25 LOG6[5293:140430154827520]: CERT: Verification not enabled 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Certificate accepted: depth=2, /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Starting certificate verification: depth=1, /C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA 2016.11.14 21:34:25 LOG6[5293:140430154827520]: CERT: Verification not enabled 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Certificate accepted: depth=1, /C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Starting certificate verification: depth=0, /CN=*.greenbuttonalliance.org 2016.11.14 21:34:25 LOG6[5293:140430154827520]: CERT: Verification not enabled 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Certificate accepted: depth=0, /CN=*.greenbuttonalliance.org 2016.11.14 21:34:25 LOG6[5293:140430154827520]: SSL connected: new session negotiated 2016.11.14 21:34:25 LOG6[5293:140430154827520]: Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) 2016.11.14 21:34:25 LOG6[5293:140430154827520]: Compression: null, expansion: null 2016.11.14 21:34:45 LOG7[5293:140430154827520]: SSL closed on SSL_read 2016.11.14 21:34:45 LOG7[5293:140430154827520]: Sent socket write shutdown 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Socket closed on read 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Sending close_notify alert 2016.11.14 21:34:56 LOG6[5293:140430154827520]: SSL_shutdown successfully sent close_notify alert 2016.11.14 21:34:56 LOG5[5293:140430154827520]: Connection closed: 342 byte(s) sent to SSL, 250 byte(s) sent to socket 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Remote socket (FD=15) closed 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Local socket (FD=3) closed 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Service [resourceServer] finished (0 left) The stunnel.conf file contains the following configuration: ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** CApath = /etc/ssl/certs ; ************************************************************************** ; * Logging * ; ************************************************************************** debug = 7 output = /home/ubuntu/Git/energyos/OpenESPI-GreenButtonCMDTest/SOAPUI/stunnel.log ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ************************************************************************** ; * Resource Server * ; ************************************************************************** [resourceServer] accept=localhost:8080 connect=52.43.245.161:8443 ciphers=AES128-SHA client = yes cert=/etc/stunnel/stunnel.pem verify=0 [tpserver] accept=127.0.0.1:8444 connect=localhost:8081 cert=/etc/stunnel/stunnel.pem verify=0 client=no ciphers=AES128-SHA Are there any additional stunnel logging options or debugging techniques you can recommend to help determine why the session is being closed? Does stunnel support wildcard based certificates (i.e. *.greenbuttonalliance.org)? Best regards, Don Donald F. Coffin Technical Manager Green Button Alliance 2335 Dunwoody Crossing Suite E Dunwoody, GA 30338-8221 http://www.greenbuttonalliance.org <http://www.greenbuttonalliance.org/> (949) 636-8571 Mobile

1 0

rpmbuild errors using stunnel.spec
by Wiest, Damian 07 Nov '16

07 Nov '16

I noticed a few issues with the stunnel.spec file included with the distribution that I wanted to report. I'm building on an Amazon Linux host. There appears to be a bad date entry in the changelog section, warning: bogus date in %changelog: Sun Jun 24 2000 Brian Hatch <bri(a)stunnel.org> Sunday is the 25th? The stunnel.init and stunnel.logrotate files are being installed from the rpmbuild/SOURCES/ directory and not rpmbuild/BUILD/stunnel-5.37/tools/. Copying the files from the build area and retrying resolves this. stunnel.spec:Source1: %{name}.init stunnel.spec:Source2: %{name}.logrotate ... stunnel.spec:%{__install} -p -m0755 %{SOURCE1} $RPM_BUILD_ROOT%{_initrddir}/%{name} stunnel.spec:%{__install} -p -m0644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/%{name} + /usr/bin/install -p -m0755 /home/ec2-user/rpmbuild/SOURCES/stunnel.init /home/ec2-user/rpmbuild/BUILDROOT/stunnel-5.37-1.amzn1.x86_64/etc/rc.d/init.d/stunnel /usr/bin/install: cannot stat '/home/ec2-user/rpmbuild/SOURCES/stunnel.init': No such file or directory + /usr/bin/install -p -m0644 /home/ec2-user/rpmbuild/SOURCES/stunnel.logrotate /home/ec2-user/rpmbuild/BUILDROOT/stunnel-5.37-1.amzn1.x86_64/etc/logrotate.d/stunnel /usr/bin/install: cannot stat '/home/ec2-user/rpmbuild/SOURCES/stunnel.logrotate': No such file or directory rpmbuild also complains that the files under /usr/share/doc/stunnel/ are unpackaged. I added %{_docdir}/* at the end of the files section to correct this. -Damian -- Confidentiality Notice: This e-mail transmission may contain confidential or legally privileged information that is intended only for the individual or entity named in the e-mail address. If you have received this communication in error, please notify me by return e-mail, and destroy this communication and all copies thereof, including any attachments. Apervita ® is a registered trademark of Apervita Inc.

1 0

Bulk Requests - Stunnel throwing exceptions
by Lakshmi Narayana Lanka 03 Nov '16

03 Nov '16

Hello, I'm using Stunnel infront of a TCP/IP connection. When we receive bulk requests simultaneously it starts throwing exceptions. Is it something by design with Stunnel? -- Thanks & Regards, Lakshmi N Lanka

2 4

Use SNI
by Benjamin Hartwich 31 Oct '16

31 Oct '16

Hi, I´ve found the SNI parameter at stunnel, but it doesn´t work at my Ubuntu 16.04. My goal is, to use one dfn cert for the stunnel cert, which has 4 hostnames. This cert is on both servers. At the client server this cert works, because at the cert this is first hostname. At the second server I use the same cert, but it can´t be verified, because stunnel doesn´t recognize the correct hostname from the cert. Can anyone send me an example for a working SNI configuration? My Configs: Server one: client = yes cert = /etc/stunnel/cert.pem service = test debug = debug output = /var/log/stunnel4/stunnel.log foreground = no sslVersion = TLSv1 options = NO_SSLv3 options = NO_SSLv2 CAfile = /etc/ssl/web/chain.pem verify = 2 socket = r:TCP_NODELAY=1 [app1] accept = localhost:8090 connect = 10.1.2.1:8085´ ----- Server 2 (fails): client = no cert = /etc/stunnel/cert.pem service = test debug = debug output = /var/log/stunnel4/stunnel.log sslVersion = TLSv1 options = NO_SSLv3 options = NO_SSLv2 foreground = no CAfile = /etc/ssl/web/chain.pem verify = 2 socket = l:TCP_NODELAY=1 [ajp] accept = 8085 connect = 127.0.0.1:8009 --- Error: 2016.10.31 15:01:40 LOG7[9]: SNI: no virtual services defined 2016.10.31 15:01:40 LOG4[9]: CERT: Pre-verification error: unsupported certificate purpose Regards, Benjamin Hartwich Referat Basisdienste Zentrum für Informationstechnologie und Medienmanagement Universität Passau Innstr. 33, 94032 Passau Telefon +49 (0)851/509-3285, Telefax +49 (0)851/509-1802 E-Mail: benjamin.hartwich(a)uni-passau.de

1 0

Running Stunnel 5.23 as multiple windows services
by David Jones 25 Oct '16

25 Oct '16

Hi, I'm trying to run stunnel as a windows service. I have used the stunnel -install and one service has successfully been setup. We now have a need to run a second instance of stunnel and so that we are able to stop/start this instance and not affect the connectivity of the other one we would like to install it as a separate service. On an older version of stunnel we simply named the stunnel.exe differently and it ran both services separately. But with 5.23 it is not allowing us to do so. Coming up the error "CreateService: error 1073: The specified service already exists". I've tried adding service = into the .conf file and also using service= on the command line for the install but nothing works. So what have I missed? Thanks David Config: Service = Stunnel_TLS_Generic CApath = ./ debug=7 #debug = 1 output = TLS_Generic.log # Use it for client mode client = yes # Service-level configuration [Service_Name] options = NO_SSLv2 options = NO_SSLv3 sslVersion = TLSv1 accept = 20002 connect = URLtoserver:443

1 0

Re: [stunnel-users] JHH re: Server down? [GishPuppy]
by gmane.bl4＠gishpuppy.com 20 Oct '16

20 Oct '16

John H Hoffmann wrote: > upgraded to latest sTunnel v 5.36. > > In restarting sTunnel I immediately got a > 'server down' error > > [ ] Service [pop3s] (FD=432) bound to 0.0.0.0:995 > > > [!] bind: Permission denied (WSAEACCES) (10013) > > [!] Error binding service [comcast-pop3] to 127.0.0.1:995 > You probably have in the stunnel.conf something similar to: [pop3s] accept=995 {...} [comcast-pop3] accept=127.0.0.1:995 {...} accept=995 == 0.0.0.0:995 == (all localhost IPv4 addresses):995 Which includes 127.0.0.1:995 When the [comcast-pop3] service tries to bind to port 995 it fails because it is already bound at the [pop3s] service. Gishpuppy | To change the delivery settings for this email, click here: http://www.gishpuppy.com/cgi-bin/[email protected]

2 1

JHH re: Server down?
by John H Hoffmann | 847.998.6198 18 Oct '16

18 Oct '16

Hi .. I have been having spotty access to my main ISP email account the last two days so I upgraded to latest sTunnel v 5.36. I use sTunnel to help get emails from my ISP, Comcast, to load into an older version of GoldMine CRM. sTunnel has worked like a charm since 09/2013. In restarting sTunnel I immediately got a 'server down' error, log included below. Ideas? Suggestions? [ ] Cron thread initialized [ ] Running on Windows 6.1 [ ] No limit detected for the number of clients [.] stunnel 5.36 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2i-fips 22 Sep 2016 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [pop3s] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [imaps] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [ssmtp] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [comcast-pop3] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [comcast-pop3] needs authentication to prevent MITM attacks [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [ ] Initializing service [comcast-smtp] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [comcast-smtp] needs authentication to prevent MITM attacks [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=432) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [pop3s] (FD=432) bound to 0.0.0.0:995 [ ] Listening file descriptor created (FD=436) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [imaps] (FD=436) bound to 0.0.0.0:993 [ ] Listening file descriptor created (FD=440) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [ssmtp] (FD=440) bound to 0.0.0.0:465 [ ] Listening file descriptor created (FD=444) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [!] bind: Permission denied (WSAEACCES) (10013) [!] Error binding service [comcast-pop3] to 127.0.0.1:995 [ ] Closing service [pop3s] [ ] Service [pop3s] closed (FD=432) [ ] Service [pop3s] closed [ ] Closing service [imaps] [ ] Service [imaps] closed (FD=436) [ ] Service [imaps] closed [ ] Closing service [ssmtp] [ ] Service [ssmtp] closed (FD=440) [ ] Service [ssmtp] closed [ ] Closing service [comcast-pop3] [ ] Service [comcast-pop3] closed [ ] Closing service [comcast-smtp] [ ] Service [comcast-smtp] closed [!] Server is down Respectfully, John John H Hoffmann

2 1

Stunnel stops on Windows Server 2012
by Sam Ash 03 Oct '16

03 Oct '16

I've upgraded Stunnel from 5.35 to 5.36 on a server running windows server 2012. Since the upgrade it appears to stop running once i log out. I installed it as a service and set the service start to automatic. It has no problems running when someone is logged into the server. I'm not sure what i changed when i updated the version. Thanks

1 0

No cert?
by Dave Gradwell 27 Sep '16

27 Sep '16

Is there any way to configure a Stunnel server so that it doesn’t require a cert at all? I implement peer authentication using other means; I just want session encryption from Stunnel. Ideally, I’d like keys to be generated on-the-fly for each new connection. I don’t mind if this takes a few seconds… Thanks, Dave.

1 0

Re: [stunnel-users] Hangs when connecting -- advice pls
by Scott McKeown 21 Sep '16

21 Sep '16

Hi Guys, To me this looks like a cipher issue. There are a few options that you can try to resolve this if it is. I would try adding the following lines into your STunnel Configuration file: delay = yes options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = CIPHER_SERVER_PREFERENCE options = DONT_INSERT_EMPTY_FRAGMENTS Delay will delay and DNS lookups that maybe actioned by the request (not normally needed but I always include if for sanity sake) The three 'options' sections turn off all the known problematic cipher lists if you need a key that is in one of these block feel free to remove that directive but I think a good start would be to leave the 'NO_SSLv3' option in place The 'CIPHER_SERVER_PREFERENCE' option will make set whether the client is allowed to renegotiat the ciphers that are to be used between the client and the server process. And finally 'DONT_INSERT_EMPTY_FRAGMENTS' will mitigate an issue in the CBC ciphers that was in the SSLv3 and TLS1.0 cipher lists again I only include it for sanity sake now but its better to have than to go without. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 (24x7) Tel (US) - +1 888.867.9504 (Toll Free)(24x7)

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 146, Issue 10
by Hon Quach 16 Sep '16

16 Sep '16

Can I be please removed from the mailing list? Sent from my iPhone > On Sep 16, 2016, at 12:14 PM, stunnel-users-request(a)stunnel.org wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: compilation error with stunnel-5.35 (Josealf.rm) > 2. Re: compilation error with stunnel-5.35 (Viorel Panaite) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 16 Sep 2016 13:04:09 -0500 > From: "Josealf.rm" <josealf(a)rocketmail.com> > To: Viorel Panaite <Viorel.Panaite(a)tecsys.com> > Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> > Subject: Re: [stunnel-users] compilation error with stunnel-5.35 > Message-ID: <6CE9A3F0-EE74-4CF0-ACCE-C5941B6B40A2(a)rocketmail.com> > Content-Type: text/plain; charset="utf-8" > > > Visorel, > > Did you compile OpenSSL yourself? Did you enable shared library support? > Maybe you system is picking system installed OpenSSL headers (0.9.8) instead of the new ones. > > Regards > Jose > > > Enviado desde mi iPhone >> El 16/09/2016, a las 9:39 a.m., Viorel Panaite <Viorel.Panaite(a)tecsys.com> escribió: >> >> I downloaded stunnel-5.35 and I’m trying to compile using openssl-1.0.2h on RedHat EL linux 5.4 >> >> I get this error when I’m trying to compile them together, >> >> Configure log >> ./configure --prefix=/apps/stunnel/535 --with-ssl=/apps/openssl/1.0.2h/ >> ……………………. >> hecking for broken poll() implementation... no >> checking for pipe2... no >> checking for accept4... no >> configure: **************************************** optional features >> checking whether to enable IPv6 support... yes (default) >> checking whether to enable FIPS support... autodetecting >> checking whether to enable systemd socket activation support... autodetecting >> checking for library containing sd_listen_fds... no >> configure: systemd library not found >> checking whether to enable TCP wrappers support... autodetecting >> checking for hosts_access in -lwrap... yes >> configure: libwrap support enabled >> configure: **************************************** SSL >> checking for compiler sysroot... / >> checking for SSL directory... /apps/openssl/1.0.2h/ >> checking for FIPS_mode_set... yes >> configure: FIPS support enabled >> configure: **************************************** write the results >> checking that generated files are newer than configure... done >> configure: creating ./config.status >> config.status: creating Makefile >> config.status: creating src/Makefile >> config.status: creating doc/Makefile >> config.status: creating tools/Makefile >> config.status: creating src/config.h >> config.status: src/config.h is unchanged >> config.status: executing depfiles commands >> config.status: executing libtool commands >> configure: **************************************** success >> >> make log >> >> [root@mybox stunnel-5.35]# make >> Making all in src >> make[1]: Entering directory `/apps/stunnel/stunnel-5.35/src' >> make all-am >> make[2]: Entering directory `/apps/stunnel/stunnel-5.35/src' >> CCLD stunnel >> /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libssl.a when searching for -lssl >> /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libcrypto.a when searching for -lcrypto >> stunnel-client.o: In function `client_run': >> /apps/stunnel/stunnel-5.35/src/client.c:201: undefined reference to `ERR_remove_thread_state' >> stunnel-options.o: In function `parse_service_option': >> /apps/stunnel/stunnel-5.35/src/options.c:2669: undefined reference to `TLSv1_2_client_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2670: undefined reference to `TLSv1_2_server_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2662: undefined reference to `TLSv1_1_client_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2663: undefined reference to `TLSv1_1_server_method' >> stunnel-ctx.o: In function `auth_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:442: undefined reference to `SSL_CTX_set_psk_server_callback' >> stunnel-ctx.o: In function `context_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:133: undefined reference to `SSL_CTX_set_client_cert_engine' >> stunnel-ctx.o: In function `auth_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:440: undefined reference to `SSL_CTX_set_psk_client_callback' >> stunnel-ctx.o: In function `conf_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:376: undefined reference to `SSL_CONF_CTX_new' >> /apps/stunnel/stunnel-5.35/src/ctx.c:381: undefined reference to `SSL_CONF_CTX_set_ssl_ctx' >> /apps/stunnel/stunnel-5.35/src/ctx.c:382: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:383: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:385: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:392: undefined reference to `SSL_CONF_cmd' >> /apps/stunnel/stunnel-5.35/src/ctx.c:420: undefined reference to `SSL_CONF_CTX_finish' >> /apps/stunnel/stunnel-5.35/src/ctx.c:422: undefined reference to `SSL_CONF_CTX_free' >> stunnel-ctx.o: In function `ecdh_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:351: undefined reference to `EC_KEY_new_by_curve_name' >> /apps/stunnel/stunnel-5.35/src/ctx.c:359: undefined reference to `EC_KEY_free' >> stunnel-ctx.o: In function `conf_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:414: undefined reference to `SSL_CONF_CTX_free' >> /apps/stunnel/stunnel-5.35/src/ctx.c:409: undefined reference to `SSL_CONF_CTX_free' >> /apps/stunnel/stunnel-5.35/src/ctx.c:425: undefined reference to `SSL_CONF_CTX_free' >> stunnel-ctx.o: In function `servername_cb': >> /apps/stunnel/stunnel-5.35/src/ctx.c:229: undefined reference to `SSL_get_servername' >> /apps/stunnel/stunnel-5.35/src/ctx.c:253: undefined reference to `SSL_set_SSL_CTX' >> stunnel-verify.o: In function `ocsp_request': >> /apps/stunnel/stunnel-5.35/src/verify.c:499: undefined reference to `OCSP_CERTID_dup' >> stunnel-verify.o: In function `ocsp_get_response': >> /apps/stunnel/stunnel-5.35/src/verify.c:614: undefined reference to `OCSP_sendreq_new' >> /apps/stunnel/stunnel-5.35/src/verify.c:625: undefined reference to `OCSP_REQ_CTX_add1_header' >> /apps/stunnel/stunnel-5.35/src/verify.c:629: undefined reference to `OCSP_REQ_CTX_add1_header' >> /apps/stunnel/stunnel-5.35/src/verify.c:634: undefined reference to `OCSP_REQ_CTX_set1_req' >> /apps/stunnel/stunnel-5.35/src/verify.c:641: undefined reference to `OCSP_sendreq_nbio' >> /apps/stunnel/stunnel-5.35/src/verify.c:668: undefined reference to `OCSP_REQ_CTX_free' >> stunnel-verify.o: In function `cert_check_subject': >> /apps/stunnel/stunnel-5.35/src/verify.c:299: undefined reference to `X509_check_host' >> stunnel-verify.o: In function `ocsp_check': >> /apps/stunnel/stunnel-5.35/src/verify.c:457: undefined reference to `X509_get1_ocsp' >> stunnel-verify.o: In function `cert_check_subject': >> /apps/stunnel/stunnel-5.35/src/verify.c:312: undefined reference to `X509_check_email' >> /apps/stunnel/stunnel-5.35/src/verify.c:323: undefined reference to `X509_check_ip_asc' >> stunnel-verify.o: In function `cert_check_local': >> /apps/stunnel/stunnel-5.35/src/verify.c:356: undefined reference to `X509_STORE_get1_certs' >> stunnel-sthreads.o: In function `sthreads_init': >> /apps/stunnel/stunnel-5.35/src/sthreads.c:287: undefined reference to `CRYPTO_THREADID_set_callback' >> stunnel-sthreads.o: In function `threadid_func': >> /apps/stunnel/stunnel-5.35/src/sthreads.c:268: undefined reference to `CRYPTO_THREADID_set_numeric' >> collect2: ld returned 1 exit status >> make[2]: *** [stunnel] Error 1 >> make[2]: Leaving directory `/apps/stunnel/stunnel-5.35/src' >> make[1]: *** [all] Error 2 >> make[1]: Leaving directory `/apps/stunnel/stunnel-5.35/src' >> make: *** [all-recursive] Error 1 >> >> Thanks for your help. >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

compilation error with stunnel-5.35
by Viorel Panaite 16 Sep '16

16 Sep '16

I downloaded stunnel-5.35 and I'm trying to compile using openssl-1.0.2h on RedHat EL linux 5.4 I get this error when I'm trying to compile them together, Configure log ./configure --prefix=/apps/stunnel/535 --with-ssl=/apps/openssl/1.0.2h/ ......................... hecking for broken poll() implementation... no checking for pipe2... no checking for accept4... no configure: **************************************** optional features checking whether to enable IPv6 support... yes (default) checking whether to enable FIPS support... autodetecting checking whether to enable systemd socket activation support... autodetecting checking for library containing sd_listen_fds... no configure: systemd library not found checking whether to enable TCP wrappers support... autodetecting checking for hosts_access in -lwrap... yes configure: libwrap support enabled configure: **************************************** SSL checking for compiler sysroot... / checking for SSL directory... /apps/openssl/1.0.2h/ checking for FIPS_mode_set... yes configure: FIPS support enabled configure: **************************************** write the results checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating src/config.h config.status: src/config.h is unchanged config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success make log [root@mybox stunnel-5.35]# make Making all in src make[1]: Entering directory `/apps/stunnel/stunnel-5.35/src' make all-am make[2]: Entering directory `/apps/stunnel/stunnel-5.35/src' CCLD stunnel /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libssl.a when searching for -lssl /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libcrypto.a when searching for -lcrypto stunnel-client.o: In function `client_run': /apps/stunnel/stunnel-5.35/src/client.c:201: undefined reference to `ERR_remove_thread_state' stunnel-options.o: In function `parse_service_option': /apps/stunnel/stunnel-5.35/src/options.c:2669: undefined reference to `TLSv1_2_client_method' /apps/stunnel/stunnel-5.35/src/options.c:2670: undefined reference to `TLSv1_2_server_method' /apps/stunnel/stunnel-5.35/src/options.c:2662: undefined reference to `TLSv1_1_client_method' /apps/stunnel/stunnel-5.35/src/options.c:2663: undefined reference to `TLSv1_1_server_method' stunnel-ctx.o: In function `auth_init': /apps/stunnel/stunnel-5.35/src/ctx.c:442: undefined reference to `SSL_CTX_set_psk_server_callback' stunnel-ctx.o: In function `context_init': /apps/stunnel/stunnel-5.35/src/ctx.c:133: undefined reference to `SSL_CTX_set_client_cert_engine' stunnel-ctx.o: In function `auth_init': /apps/stunnel/stunnel-5.35/src/ctx.c:440: undefined reference to `SSL_CTX_set_psk_client_callback' stunnel-ctx.o: In function `conf_init': /apps/stunnel/stunnel-5.35/src/ctx.c:376: undefined reference to `SSL_CONF_CTX_new' /apps/stunnel/stunnel-5.35/src/ctx.c:381: undefined reference to `SSL_CONF_CTX_set_ssl_ctx' /apps/stunnel/stunnel-5.35/src/ctx.c:382: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:383: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:385: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:392: undefined reference to `SSL_CONF_cmd' /apps/stunnel/stunnel-5.35/src/ctx.c:420: undefined reference to `SSL_CONF_CTX_finish' /apps/stunnel/stunnel-5.35/src/ctx.c:422: undefined reference to `SSL_CONF_CTX_free' stunnel-ctx.o: In function `ecdh_init': /apps/stunnel/stunnel-5.35/src/ctx.c:351: undefined reference to `EC_KEY_new_by_curve_name' /apps/stunnel/stunnel-5.35/src/ctx.c:359: undefined reference to `EC_KEY_free' stunnel-ctx.o: In function `conf_init': /apps/stunnel/stunnel-5.35/src/ctx.c:414: undefined reference to `SSL_CONF_CTX_free' /apps/stunnel/stunnel-5.35/src/ctx.c:409: undefined reference to `SSL_CONF_CTX_free' /apps/stunnel/stunnel-5.35/src/ctx.c:425: undefined reference to `SSL_CONF_CTX_free' stunnel-ctx.o: In function `servername_cb': /apps/stunnel/stunnel-5.35/src/ctx.c:229: undefined reference to `SSL_get_servername' /apps/stunnel/stunnel-5.35/src/ctx.c:253: undefined reference to `SSL_set_SSL_CTX' stunnel-verify.o: In function `ocsp_request': /apps/stunnel/stunnel-5.35/src/verify.c:499: undefined reference to `OCSP_CERTID_dup' stunnel-verify.o: In function `ocsp_get_response': /apps/stunnel/stunnel-5.35/src/verify.c:614: undefined reference to `OCSP_sendreq_new' /apps/stunnel/stunnel-5.35/src/verify.c:625: undefined reference to `OCSP_REQ_CTX_add1_header' /apps/stunnel/stunnel-5.35/src/verify.c:629: undefined reference to `OCSP_REQ_CTX_add1_header' /apps/stunnel/stunnel-5.35/src/verify.c:634: undefined reference to `OCSP_REQ_CTX_set1_req' /apps/stunnel/stunnel-5.35/src/verify.c:641: undefined reference to `OCSP_sendreq_nbio' /apps/stunnel/stunnel-5.35/src/verify.c:668: undefined reference to `OCSP_REQ_CTX_free' stunnel-verify.o: In function `cert_check_subject': /apps/stunnel/stunnel-5.35/src/verify.c:299: undefined reference to `X509_check_host' stunnel-verify.o: In function `ocsp_check': /apps/stunnel/stunnel-5.35/src/verify.c:457: undefined reference to `X509_get1_ocsp' stunnel-verify.o: In function `cert_check_subject': /apps/stunnel/stunnel-5.35/src/verify.c:312: undefined reference to `X509_check_email' /apps/stunnel/stunnel-5.35/src/verify.c:323: undefined reference to `X509_check_ip_asc' stunnel-verify.o: In function `cert_check_local': /apps/stunnel/stunnel-5.35/src/verify.c:356: undefined reference to `X509_STORE_get1_certs' stunnel-sthreads.o: In function `sthreads_init': /apps/stunnel/stunnel-5.35/src/sthreads.c:287: undefined reference to `CRYPTO_THREADID_set_callback' stunnel-sthreads.o: In function `threadid_func': /apps/stunnel/stunnel-5.35/src/sthreads.c:268: undefined reference to `CRYPTO_THREADID_set_numeric' collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/apps/stunnel/stunnel-5.35/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/apps/stunnel/stunnel-5.35/src' make: *** [all-recursive] Error 1 Thanks for your help.

2 2

Hangs when connecting -- advice pls
by Dave Gradwell 14 Sep '16

14 Sep '16

My Stunnel client gets to this point, then hangs indefinitely: SSL state (connect): SSLv2/v3 write client hello A Is this a fault with Stunnel or is it something I’m doing wrong Full client-side output: """"""""""""""""""" Last login: Wed Sep 14 06:50:40 on ttys004 Daves-MBP-2016:~ dave$ /Users/dave/Desktop/stunnel-test/stunnel /Users/dave/Desktop/stunnel-test/stunnel-sender.conf 2016.09.14 06:54:35 LOG7[ui]: Clients allowed=125 2016.09.14 06:54:35 LOG7[cron]: Cron thread initialized 2016.09.14 06:54:35 LOG5[ui]: stunnel 5.35 on x86_64-apple-darwin15.4.0 platform 2016.09.14 06:54:35 LOG5[ui]: Compiled with OpenSSL 0.9.8zd 8 Jan 2015 2016.09.14 06:54:35 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016 2016.09.14 06:54:35 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2016.09.14 06:54:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI 2016.09.14 06:54:35 LOG7[ui]: errno: (*__error()) 2016.09.14 06:54:35 LOG5[ui]: Reading configuration from file /Users/dave/Desktop/stunnel-test/stunnel-sender.conf 2016.09.14 06:54:35 LOG5[ui]: UTF-8 byte order mark not detected 2016.09.14 06:54:35 LOG7[ui]: Compression disabled 2016.09.14 06:54:35 LOG7[ui]: Snagged 64 random bytes from /Users/dave/.rnd 2016.09.14 06:54:35 LOG7[ui]: Wrote 1024 new random bytes to /Users/dave/.rnd 2016.09.14 06:54:35 LOG7[ui]: PRNG seeded successfully 2016.09.14 06:54:35 LOG6[ui]: Initializing inetd mode configuration 2016.09.14 06:54:35 LOG6[ui]: Loading certificate from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Certificate loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Loading private key from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG4[ui]: Insecure file permissions on /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Private key loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG7[ui]: Private key check succeeded 2016.09.14 06:54:35 LOG4[ui]: Service [stunnel] needs authentication to prevent MITM attacks 2016.09.14 06:54:35 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.09.14 06:54:35 LOG5[ui]: Configuration successful 2016.09.14 06:54:35 LOG7[ui]: Service [stunnel] started 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] accepted connection 2016.09.14 06:54:35 LOG6[ui]: failover: round-robin, starting at entry #0 2016.09.14 06:54:35 LOG6[ui]: s_connect: connecting ::1:874 2016.09.14 06:54:35 LOG7[ui]: s_connect: s_poll_wait ::1:874: waiting 10 seconds 2016.09.14 06:54:35 LOG5[ui]: s_connect: connected ::1:874 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] connected remote server from ::1:51362 2016.09.14 06:54:35 LOG7[ui]: Option TCP_NODELAY set on remote socket 2016.09.14 06:54:35 LOG7[ui]: Remote descriptor (FD=3) initialized 2016.09.14 06:54:35 LOG6[ui]: SNI: sending servername: localhost 2016.09.14 06:54:35 LOG6[ui]: Peer certificate not required 2016.09.14 06:54:35 LOG7[ui]: SSL state (connect): before/connect initialization 2016.09.14 06:54:35 LOG7[ui]: SSL state (connect): SSLv2/v3 write client hello A ^C Daves-MBP-2016:~ dave$ """"""""""""""""""" My stunnel-sender.conf: """"""""""""""""""" debug = 7 output = /Users/dave/Desktop/stunnel-test/sender-stunnel-output.log foreground = yes client = yes connect = localhost:874 cert = /Users/dave/Desktop/stunnel-test/cert.pem verify = 0 """"""""""""""""""" My stunnel-receiver.conf: """"""""""""""""""" debug = 7 output = /Users/dave/Desktop/stunnel-test/receiver-stunnels-output.log pid = /Users/dave/Desktop/stunnel-test/stunnel-rsyncd-stunnels.pid cert = /Users/dave/Desktop/stunnel-test/cert.pem verify = 0 delay = yes exec = /Users/dave/Desktop/stunnel-test/rsync execArgs = -vvvv --daemon --server --config=/Users/dave/Desktop/stunnel-test/stunnel-rsyncd.conf . foreground = yes client = no """"""""""""""""""" My receiver-error.log: """"""""""""""""""" 2016.09.14 06:54:35 LOG7[ui]: Clients allowed=125 2016.09.14 06:54:35 LOG7[cron]: Cron thread initialized 2016.09.14 06:54:35 LOG5[ui]: stunnel 5.35 on x86_64-apple-darwin15.4.0 platform 2016.09.14 06:54:35 LOG5[ui]: Compiled with OpenSSL 0.9.8zd 8 Jan 2015 2016.09.14 06:54:35 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016 2016.09.14 06:54:35 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2016.09.14 06:54:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI 2016.09.14 06:54:35 LOG7[ui]: errno: (*__error()) 2016.09.14 06:54:35 LOG5[ui]: Reading configuration from file /Users/dave/Desktop/stunnel-test/stunnel-receiver.conf 2016.09.14 06:54:35 LOG5[ui]: UTF-8 byte order mark not detected 2016.09.14 06:54:35 LOG7[ui]: Compression disabled 2016.09.14 06:54:35 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2016.09.14 06:54:35 LOG7[ui]: PRNG seeded successfully 2016.09.14 06:54:35 LOG6[ui]: Initializing inetd mode configuration 2016.09.14 06:54:35 LOG6[ui]: Loading certificate from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Certificate loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Loading private key from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG4[ui]: Insecure file permissions on /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Private key loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG7[ui]: Private key check succeeded 2016.09.14 06:54:35 LOG7[ui]: DH initialization 2016.09.14 06:54:35 LOG7[ui]: Using DH parameters from /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: 2048-bit DH parameters loaded 2016.09.14 06:54:35 LOG7[ui]: ECDH initialization 2016.09.14 06:54:35 LOG7[ui]: ECDH initialized with curve prime256v1 2016.09.14 06:54:35 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.09.14 06:54:35 LOG5[ui]: Configuration successful 2016.09.14 06:54:35 LOG7[ui]: Service [stunnel] started 2016.09.14 06:54:35 LOG7[ui]: Option TCP_NODELAY set on local socket 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] accepted connection from ::1:51362 2016.09.14 06:54:35 LOG6[ui]: Peer certificate not required 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): before/accept initialization 2016.09.14 06:54:35 LOG7[ui]: SNI: no virtual services defined 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 read client hello A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write server hello A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write certificate A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write certificate request A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 flush data 2016.09.14 06:54:40 LOG3[ui]: SSL_accept: Peer suddenly disconnected 2016.09.14 06:54:40 LOG5[ui]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.14 06:54:40 LOG7[ui]: Deallocating application specific data for addr index 2016.09.14 06:54:40 LOG7[ui]: Service [stunnel] finished (0 left) """"""""""""""""""" The server-side-Stunnel is invoked via launchd using this LaunchDaemon (but this seems to be working okay — I think): """"""""""""""""""" <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Disabled</key> <false/> <key>StandardErrorPath</key> <string>/Users/dave/Desktop/stunnel-test/receiver-error.log</string> <key>StandardOutPath</key> <string>/Users/dave/Desktop/stunnel-test/receiver-out.log</string> <key>Label</key> <string>com.stunnel.test</string> <key>ProgramArguments</key> <array> <string>/Users/dave/Desktop/stunnel-test/stunnel</string> <string>/Users/dave/Desktop/stunnel-test/stunnel-receiver.conf</string> </array> <key>inetdCompatibility</key> <dict> <key>Wait</key> <false/> </dict> <key>Sockets</key> <dict> <key>Listeners</key> <dict> <key>SockServiceName</key> <string>874</string> <key>SockType</key> <string>stream</string> </dict> </dict> </dict> </plist> """"""""""""""""""" I’ve looked at the output of bash-3.2# tcpdump -i all -XX -xx -vv port 874 but this didn’t give me any obvious clues. I can send it if it’s useful but I’ve omitted it for now as it’s long. I’ve reproduced the same hang on Mac OS X 10.11 and 10.6. I’ve recompiled Stunnel in 10.11 and 10.9 environments but still get this same hang. Any advice appreciated.. — Dave.

1 0

Re: [stunnel-users] stunnel 5.x no answer in server mode?
by Ulli Horlacher 14 Sep '16

14 Sep '16

On Tue 2016-09-13 (22:25), Micha?? Trojnara wrote: > On 13.09.2016 20:35, Ulli Horlacher wrote: > >> It is impossible to say anything without analysis of the executed fexsrv > >> program. > > > > The problem cannot be in fexsrv, because it works with stunnel 4.27 > > What is the point of sending an email to the mailing list when you > ignore our effort to help you? Where do I ignore help? > fexsrv terminates immediately with exit code 1. No. It does not start at all, so it does not terminate. fexsrv logs everything and when running with stunnel 5.x the log file is empty. But meanwhile I found the error: stunnel 5.x needs the a full path for the exec statement: exec = /usr/bin/perl For stunnel 4.x it was sufficent to use: exec = perl -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<45835cd9-b239-d80c-38a0-3f978132e40e(a)stunnel.org>

2 1

Errors in log
by Mark Hannig 13 Sep '16

13 Sep '16

Can you please help me. Stunnel has been working fine for months and I just started getting these errors in the last day or two. Thank you: 2016.09.11 13:43:38 LOG5[10]: Service [ssmtp] accepted connection from 46.101.193.127:33818 2016.09.11 13:43:40 LOG3[10]: SSL_accept: Peer suddenly disconnected 2016.09.11 13:43:40 LOG5[10]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 13:43:40 LOG5[11]: Service [ssmtp] accepted connection from 46.101.193.127:34154 2016.09.11 13:43:40 LOG3[11]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:ssl3_get_client_hello:wrong version number 2016.09.11 13:43:40 LOG5[11]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 13:43:40 LOG5[12]: Service [ssmtp] accepted connection from 46.101.193.127:34254 2016.09.11 13:43:42 LOG3[12]: s_connect: connect 127.0.0.1:25: Connection refused (WSAECONNREFUSED) (10061) 2016.09.11 13:43:42 LOG5[12]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 17:22:39 LOG5[13]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:58020 2016.09.11 17:22:39 LOG5[13]: s_connect: connected 52.35.228.26:465 2016.09.11 17:22:39 LOG5[13]: Service [smtp-tls-wrapper] connected remote server from 172.31.10.223:58021 2016.09.11 17:22:40 LOG5[13]: Connection closed: 7072 byte(s) sent to SSL, 369 byte(s) sent to socket 2016.09.11 17:22:40 LOG5[14]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:58022 2016.09.11 17:22:40 LOG5[14]: s_connect: connected 52.35.58.187:465 2016.09.11 17:22:40 LOG5[14]: Service [smtp-tls-wrapper] connected remote server from 172.31.10.223:58023 2016.09.11 17:22:40 LOG5[14]: Connection closed: 7302 byte(s) sent to SSL, 361 byte(s) sent to socket -- Mark F. Hannig mhannig(a)gmail.com

2 2

Re: [stunnel-users] stunnel 5.x no answer in server mode?
by Ulli Horlacher 13 Sep '16

13 Sep '16

On Tue 2016-09-13 (12:10), Ma??gorzata Olszówka wrote: > > I use stunnel as a https proxy for my own http server (*). > > > > The server mode of stunnel 5.x does not work any more. > > It accepts the connection and then immediatelly closes it without sending > > back any data. > > stunnel 4.x is working fine (for many years!), with the same configuration. > > The client receives no data at all, the connection is closed by the server > > (stunnel). > > > > As I wrote: with stunnel 4.27 everything works as expected. Does stunnel > > 5.x need another configuration? > > The log messages show, that the child process terminated with code 1. > This is the point where you should start looking for the cause. The client fexsrv does not start at all with stunnel 5.x, whereas with stunnel 4.27 everything works fine. > It is impossible to say anything without analysis of the executed fexsrv > program. The problem cannot be in fexsrv, because it works with stunnel 4.27 -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<f0622f17-fd11-bdb8-4a82-9665463c0d64(a)olszowka.net>

1 0

Upgrade from 5.03 to 5.35
by Hon Quach 07 Sep '16

07 Sep '16

Hi, When I perform the upgrade the stunnel service won't start, it tries to load the pem files but it is failing. I noticed when I install stunnel on my test system, the conf file is different from the version 5.03. I'm looking for documentation a on how to perform a clean upgrade but I'm having difficulty finding that information. Thanks! Sent from my iPhone

1 0

stunnel 5.x no answer in server mode?
by Ulli Horlacher 31 Aug '16

31 Aug '16

I use stunnel as a https proxy for my own http server (*). The server mode of stunnel 5.x does not work any more. It accepts the connection and then immediatelly closes it without sending back any data. stunnel 4.x is working fine (for many years!), with the same configuration. Here is my (test) config which shows the problem (host is Ubuntu 16.04): root@xerus:/tmp# cat stunnel.conf pid = /tmp/stunnel.pid output = /home/fex/spool/stunneld.log debug = debug fips = no foreground = yes [https] accept = 443 cert = /home/fex/etc/stunnel.pem sslVersion = all TIMEOUTclose = 1 exec = perl execargs = perl -T /home/fex/bin/fexsrv stunnel root@xerus:/tmp# /opt/stunnel-5.35/bin/stunnel stunnel.conf 2016.08.30 18:58:55 LOG7[ui]: Clients allowed=500 2016.08.30 18:58:55 LOG5[ui]: stunnel 5.35 on x86_64-unknown-linux-gnu platform 2016.08.30 18:58:55 LOG5[ui]: Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 2016.08.30 18:58:55 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.08.30 18:58:55 LOG7[ui]: errno: (*__errno_location ()) 2016.08.30 18:58:55 LOG5[ui]: Reading configuration from file /tmp/stunnel.conf 2016.08.30 18:58:55 LOG5[ui]: UTF-8 byte order mark not detected 2016.08.30 18:58:55 LOG5[ui]: FIPS mode disabled 2016.08.30 18:58:55 LOG7[ui]: Compression disabled 2016.08.30 18:58:55 LOG7[ui]: Snagged 64 random bytes from /root/.rnd 2016.08.30 18:58:55 LOG7[ui]: Wrote 1024 new random bytes to /root/.rnd 2016.08.30 18:58:55 LOG7[ui]: PRNG seeded successfully 2016.08.30 18:58:55 LOG6[ui]: Initializing service [https] 2016.08.30 18:58:55 LOG6[ui]: Loading certificate from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Certificate loaded from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Loading private key from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Private key loaded from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG7[ui]: Private key check succeeded 2016.08.30 18:58:55 LOG7[ui]: DH initialization 2016.08.30 18:58:55 LOG7[ui]: Using DH parameters from /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: 1024-bit DH parameters loaded 2016.08.30 18:58:55 LOG7[ui]: ECDH initialization 2016.08.30 18:58:55 LOG7[ui]: ECDH initialized with curve prime256v1 2016.08.30 18:58:55 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.08.30 18:58:55 LOG5[ui]: Configuration successful 2016.08.30 18:58:55 LOG7[ui]: Listening file descriptor created (FD=7) 2016.08.30 18:58:55 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2016.08.30 18:58:55 LOG7[ui]: Service [https] (FD=7) bound to 0.0.0.0:443 2016.08.30 18:58:55 LOG7[ui]: Created pid file /tmp/stunnel.pid (here comes the https client connect) 2016.08.30 18:59:20 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.30 18:59:20 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2016.08.30 18:59:20 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2016.08.30 18:59:20 LOG7[ui]: Service [https] accepted (FD=3) from 127.0.0.1:44166 2016.08.30 18:59:20 LOG7[0]: Service [https] started 2016.08.30 18:59:20 LOG7[0]: Option TCP_NODELAY set on local socket 2016.08.30 18:59:20 LOG5[0]: Service [https] accepted connection from 127.0.0.1:44166 2016.08.30 18:59:20 LOG6[0]: Peer certificate not required 2016.08.30 18:59:20 LOG7[0]: SSL state (accept): before/accept initialization 2016.08.30 18:59:20 LOG7[0]: SNI: no virtual services defined 2016.08.30 18:59:20 LOG7[0]: New session callback 2016.08.30 18:59:20 LOG7[0]: 1 server accept(s) requested 2016.08.30 18:59:20 LOG7[0]: 1 server accept(s) succeeded 2016.08.30 18:59:20 LOG7[0]: 0 server renegotiation(s) requested 2016.08.30 18:59:20 LOG7[0]: 0 session reuse(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache item(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache fill-up(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache miss(es) 2016.08.30 18:59:20 LOG7[0]: 0 external session cache hit(s) 2016.08.30 18:59:20 LOG7[0]: 0 expired session(s) retrieved 2016.08.30 18:59:20 LOG6[0]: SSL accepted: new session negotiated 2016.08.30 18:59:20 LOG6[0]: No peer certificate received 2016.08.30 18:59:20 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-SHA256 (128-bit encryption) 2016.08.30 18:59:20 LOG7[0]: Compression: null, expansion: null 2016.08.30 18:59:20 LOG6[0]: Local mode child started (PID=30833) 2016.08.30 18:59:20 LOG7[0]: Option TCP_NODELAY set on remote socket 2016.08.30 18:59:20 LOG7[0]: Remote descriptor (FD=11) initialized 2016.08.30 18:59:20 LOG6[0]: Read socket closed (readsocket) 2016.08.30 18:59:20 LOG7[0]: Sending close_notify alert 2016.08.30 18:59:20 LOG7[0]: SSL alert (write): warning: close notify 2016.08.30 18:59:20 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2016.08.30 18:59:20 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.30 18:59:20 LOG7[ui]: FD=4 events=0x2001 revents=0x1 2016.08.30 18:59:20 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2016.08.30 18:59:20 LOG7[ui]: Dispatching signals from the signal pipe 2016.08.30 18:59:20 LOG7[ui]: Processing SIGCHLD 2016.08.30 18:59:20 LOG6[ui]: Child process 30833 finished with code 1 2016.08.30 18:59:20 LOG7[ui]: Signal pipe is empty 2016.08.30 18:59:20 LOG3[0]: socket fd: Broken pipe (32) 2016.08.30 18:59:20 LOG6[0]: writesocket: Socket is closed 2016.08.30 18:59:20 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 23 byte(s) sent to socket 2016.08.30 18:59:20 LOG7[0]: Remote descriptor (FD=11) closed 2016.08.30 18:59:20 LOG7[0]: Local descriptor (FD=3) closed 2016.08.30 18:59:20 LOG7[0]: Service [https] finished (0 left) The client receives no data at all, the connection is closed by the server (stunnel). As I wrote: with stunnel 4.27 everything works as expected. Does stunnel 5.x need another configuration? (*) http://fex.rus.uni-stuttgart.de/ -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<20160831074057.GA13703(a)rus.uni-stuttgart.de>

1 0

Issue with stunnel over squid
by Mike McPhee 30 Aug '16

30 Aug '16

Hello, I have a windows machine running as a stunnel client that establishes a session but then, when launching an SSH session to my loopback crashes. Putty reports that the "Server unexpectedly closed the network connection." Here are the logs: 2016.08.30 16:06:08 LOG5[main]: Reading configuration from file stunnel.conf 2016.08.30 16:06:08 LOG5[main]: UTF-8 byte order mark detected 2016.08.30 16:06:08 LOG5[main]: FIPS mode disabled 2016.08.30 16:06:08 LOG4[main]: Service [squid] needs authentication to prevent MITM attacks 2016.08.30 16:06:08 LOG5[main]: Configuration successful 2016.08.30 16:06:17 LOG5[2]: Service [squid] accepted connection from 127.0.0.1:55791 2016.08.30 16:06:17 LOG5[2]: s_connect: connected 10.5.8.74:8888 2016.08.30 16:06:17 LOG5[2]: Service [squid] connected remote server from 10.5.8.69:55792 2016.08.30 16:06:17 LOG5[2]: Connection closed: 28 byte(s) sent to SSL, 0 byte(s) sent to socket Here is the server-side stunnel.conf: sslVersion = all options = NO_SSLv2 client = no cert = /etc/stunnel/server.pem pid = /var/run/stunnel.pid output = /var/log/stunnel [squid] accept = 8888 connect = 127.0.0.1:3128 cert = /etc/stunnel/stunnel.pem [openvpn] client = no accept = 993 connect = 34567 Here is the client side (Windows 7): cert = stunnel.pem client = yes [squid] accept = 127.0.0.1:8080 connect = 10.5.8.74:8443 I seem to be negotiating all of the appropriate keys, openvpn and squid3 are verified running, and have iptables configured, so I am not sure what I am missing. Can anyone assist? Thanks in advance! Mike

1 0

-reopen for Ubuntu?
by mguyre＠comcast.net 24 Aug '16

24 Aug '16

Are there any plans to add the -reopen functionality to other operating systems? Thanks Mike

1 0

[Stunnel] [Android x86] Compilation
by John Fisherman 22 Aug '16

22 Aug '16

Dear all, I am currently trying to make stunnel work for an Android x86 architecture. The android binary found on the stunnel official website is not supported on x86 architecture, so I'd like to cross-compile it myself using the 'configure' options. I did not find much informations about this around the web, could you give me some advices or at least tell me if it is possible to make Stunnel work on an Android x86 device ? Thanks in advance, Regards, - John

1 0

Stunnel exits with timeout
by SP 19 Aug '16

19 Aug '16

Summary of problem (configuration and log details below): I am attempting to configure Stunnel to run a pop3s service on our server so that users can retrieve email securely. Stunnel is started as a systemctl service. If I include both the following in the stunnel.conf: accept = mail.myserver.net:995 connect = localhost:110 then systemctl will exit immediately with: Service [pop3s]: Each service must define two endpoints stunnel.service: Control process exited, code=exited status=1 Failed to start SSL tunnel for network daemons. If I comment the connect to 110 then it will start and hang then eventually timeout: stunnel.service: Failed with result 'timeout'. Below is my stunnel.conf and log excerpt from the start with the connect to 110 commented out. I would greatly appreciate any advice. ---stunnel.conf setuid = nobody setgid = nobody pid = /usr/local/var/lib/stunnel/var/run/stunnel.pid foreground = yes ;debug = info debug = 7 sslVersion = TLSv1.2 output = /usr/local/var/lib/stunnel/var/log/stunnel.log ;ciphers = HIGH:MEDIUM:+DH:!SSLv2:!aNULL:+SHA256:+SHA1:+MD5 ciphers = HIGH:+3DES:+DH:!aNULL:!SSLv2 transparent = yes delay = no fips = no compression = deflate client = no [pop3s] accept = mail.myserver.net:995 ;connect = localhost:110 cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem exec = /usr/local/sbin/gnu-pop3d execargs = --debug=000 --mdn --timeout=60 --ipv6 ----log excerpt ----- 2016.08.17 15:08:55 LOG7[ui]: Clients allowed=500 2016.08.17 15:08:55 LOG5[ui]: stunnel 5.35 on x86_64-unknown-linux-gnu platform 2016.08.17 15:08:55 LOG5[ui]: Compiled/running with OpenSSL 1.0.2h 3 May 2016 2016.08.17 15:08:55 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.08.17 15:08:55 LOG7[ui]: errno: (*__errno_location ()) 2016.08.17 15:08:55 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2016.08.17 15:08:55 LOG5[ui]: UTF-8 byte order mark not detected 2016.08.17 15:08:55 LOG7[cron]: Cron thread initialized 2016.08.17 15:08:55 LOG5[ui]: FIPS mode disabled 2016.08.17 15:08:55 LOG6[ui]: Compression enabled: 1 method(s) 2016.08.17 15:08:55 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2016.08.17 15:08:55 LOG7[ui]: PRNG seeded successfully 2016.08.17 15:08:55 LOG6[ui]: Initializing service [pop3s] 2016.08.17 15:08:55 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG7[ui]: Private key check succeeded 2016.08.17 15:08:55 LOG7[ui]: DH initialization 2016.08.17 15:08:55 LOG7[ui]: Could not load DH parameters from /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Using dynamic DH parameters 2016.08.17 15:08:55 LOG7[ui]: ECDH initialization 2016.08.17 15:08:55 LOG7[ui]: ECDH initialized with curve prime256v1 2016.08.17 15:08:55 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.08.17 15:08:55 LOG5[ui]: Configuration successful 2016.08.17 15:08:55 LOG7[ui]: Listening file descriptor created (FD=7) 2016.08.17 15:08:55 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2016.08.17 15:08:55 LOG7[ui]: Service [pop3s] (FD=7) bound to 60.62.114.105:995 2016.08.17 15:08:55 LOG6[cron]: Executing cron jobs 2016.08.17 15:08:55 LOG7[ui]: Created pid file /usr/local/var/lib/stunnel/var/run/stunnel.pid 2016.08.17 15:08:55 LOG5[cron]: Updating DH parameters 2016.08.17 15:10:01 LOG5[cron]: DH parameters updated 2016.08.17 15:10:01 LOG6[cron]: Cron jobs completed in 66 seconds 2016.08.17 15:10:01 LOG7[cron]: Waiting 86334 seconds 2016.08.17 15:10:25 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.17 15:10:25 LOG7[ui]: FD=4 events=0x2001 revents=0x1 2016.08.17 15:10:25 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2016.08.17 15:10:25 LOG7[ui]: Dispatching signals from the signal pipe 2016.08.17 15:10:25 LOG7[ui]: Processing SIGNAL_TERMINATE 2016.08.17 15:10:25 LOG5[ui]: Terminated 2016.08.17 15:10:25 LOG7[ui]: Closing service [pop3s] 2016.08.17 15:10:25 LOG7[ui]: Service [pop3s] closed (FD=7) 2016.08.17 15:10:25 LOG7[ui]: Service [pop3s] closed 2016.08.17 15:10:25 LOG7[ui]: removing pid file /usr/local/var/lib/stunnel/var/run/stunnel.pid

2 6

Logging Issues Causing Crash?
by Randall LeJeune 08 Aug '16

08 Aug '16

Hello all, Has anyone experienced a full log file causing stunnel issues in the past? We tried upgrading from 4.56 to 5.17 and the upgrade seemed to go fine at first, but a day or so later we began to have some disconnects. Later we downgraded to 5.01 which worked OK at first, but then we ran into the same kinds of problems again after a few days. We eventually put the stunnel.log file on a separate filesystem, but I am curious, has anyone else experienced any issues like this? Thanks, Randy

3 2

Config was working. Now it isn't after reboot
by Lee Savidge 02 Aug '16

02 Aug '16

I just reinstalled stunnel the latest version. When running I went through the creation of the pem file. I put in UK for the country code and the company name and put a . for everything else. It finished, I start the GUI and it works. I edited the config file to comment out the gmail IMAP section and reload it and it was fine. I rebooted, now it tells me tehre is an error in the config file. Why? I keep getting this problem. Rebooting seems to break the config somehow. Log shows this when stunnel starts: [ ] Cron thread initialized [ ] Running on Windows 6.1 [ ] No limit detected for the number of clients [.] stunnel 5.35 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2h-fips 3 May 2016 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [gmail-pop3] [ ] No certificate or private key specified [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [ ] Initializing service [gmail-smtp] [ ] No certificate or private key specified [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=388) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [gmail-pop3] (FD=388) bound to 127.0.0.1:110 [ ] Listening file descriptor created (FD=392) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [!] bind: Permission denied (WSAEACCES) (10013) [!] Error binding service [gmail-smtp] to 127.0.0.1:25 [ ] Closing service [gmail-pop3] [ ] Service [gmail-pop3] closed (FD=388) [ ] Service [gmail-pop3] closed [ ] Closing service [gmail-smtp] [ ] Service [gmail-smtp] closed [!] Server is down [ ] Executing cron jobs [ ] Cron jobs completed in 0 seconds [ ] Waiting 86400 seconds The config file contains this: debug = debug output = stunnel.log [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes I have pasted in only the stuff that isn't commented out. Why does this not work after a reboot? It makes no sense. -- =-----------------= Lee Savidge =-----------------= --

2 2

Installation problem on Windows 2003
by Tom Eberhard 01 Aug '16

01 Aug '16

Hello stunnel-users: I'm trying to install stunnel 5.35 on a Windows 2003 box, 32-bit. The installer runs to completion, but we get an error from SimpleFC: SimpleFC::AddApplication failed to add stunnel What is causing this error to come up, and what do I have to do to fix it? Googling just showed that SimpleFC is a plugin to interact with the Windows Firewall. Thanks, Tom This e-mail is intended solely for the person or entity to which it is addressed and may contain confidential and/or privileged information. Any review, dissemination, copying, printing or other use of this e-mail by persons or entities other than the addressee is prohibited. If you have received this e-mail in error, please contact the sender immediately and delete the material from any computer.

1 0

Client-side SNI
by Vincent Deschenes 01 Aug '16

01 Aug '16

Hi, Anyone know if there is anything special to do to get ServerName sent when using stunnel in client mode to be able to connect to SNI enabled server? Using latest version of stunnel and openssl. Will stunnel use the name specified in the "connect=" config ? Thanks, Regards, Vincent Deschenes Ing. PMP Director of Operations Stelvio Inc. (+1) 514-281-8570

1 2

stunnel only sends some emails, not all, and only on second attempt
by Martin Jaquess 28 Jul '16

28 Jul '16

Hi I'm using the latest Stunnel (5.35), running under Windows Server 2000, to download emails from Outlook(Office365)/Outlook 2016 to another email client called OfficeTalk which only supports unencrypted POP3, so it can't access Outlook directly. First problem is that although most emails are downloaded without problem, some stubbornly and consistently refuse to be downloaded. This omission doesn't seem related to attachments, encoding, size, date, or anything else that I can see. Has anyone else experienced this or have any idea why it might be happening?? Second problem is that the first download doesn't produce anything, but if I run the request again, it works - the only difference in the log files is the IP addresses I'd greatly appreciate any advice on this - I've checked the threads but can't find anything similar. Many thanks in advance Martin Config file for all attempts is:debug=7 output = c:\program files\stunnel\stunnel.log [outlook-pop3] client = yes accept = 127.0.0.1:110 connect = outlook.office365.com:995 Logfile for successful download of one email is:12:49:50 LOG7[cron]: Cronthread initialized12:49:50 LOG7[main]: Runningon Windows 5.012:49:50 LOG7[main]: No limitdetected for the number of clients12:49:50 LOG5[main]: stunnel5.35 on x86-pc-msvc-1500 platform12:49:50 LOG5[main]:Compiled/running with OpenSSL 1.0.2h-fips 3 May 201612:49:50 LOG5[main]:Threading:WIN32 Sockets:SELECT,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI12:49:50 LOG7[main]: errno:(*_errno())12:49:50 LOG7[ui]: GUImessage loop initialized12:49:50 LOG7[main]: Runningon Windows 5.012:49:50 LOG5[main]: Reading configurationfrom file stunnel.conf12:49:50 LOG5[main]: UTF-8byte order mark detected12:49:50 LOG5[main]: FIPSmode disabled12:49:50 LOG7[main]:Compression disabled12:49:50 LOG7[main]: Snagged64 random bytes from C:/.rnd12:49:50 LOG7[main]: Wrote1024 new random bytes to C:/.rnd12:49:50 LOG7[main]: PRNGseeded successfully12:49:50 LOG6[main]:Initializing service [outlook-pop3]12:49:50 LOG7[main]: Nocertificate or private key specified12:49:50 LOG4[main]: Service[outlook-pop3] needs authentication to prevent MITM attacks12:49:50 LOG7[main]: SSLoptions: 0x03000004 (+0x03000000, -0x00000000)12:49:50 LOG5[main]:Configuration successful12:49:50 LOG7[main]:Listening file descriptor created (FD=344)12:49:50 LOG7[main]: Service[outlook-pop3] (FD=344) bound to 127.0.0.1:11012:49:53 LOG7[main]: Found 1ready file descriptor(s)12:49:53 LOG7[main]: FD=204ifds=r-x ofds=---12:49:53 LOG7[main]: Service[outlook-pop3] accepted (FD=356) from 127.0.0.1:380112:49:53 LOG7[main]: Creatinga new thread12:49:53 LOG7[main]: Newthread created12:49:53 LOG7[0]: Service[outlook-pop3] started12:49:53 LOG7[0]: OptionTCP_NODELAY set on local socket12:49:53 LOG5[0]: Service[outlook-pop3] accepted connection from 127.0.0.1:380112:49:53 LOG6[0]: failover:round-robin, starting at entry #112:49:53 LOG6[0]: s_connect:connecting 132.245.224.162:99512:49:53 LOG7[0]: s_connect:s_poll_wait 132.245.224.162:995: waiting 10 seconds12:49:53 LOG5[0]: s_connect:connected 132.245.224.162:99512:49:53 LOG5[0]: Service[outlook-pop3] connected remote server from 192.168.15.102:380212:49:53 LOG7[0]: OptionTCP_NODELAY set on remote socket12:49:53 LOG7[0]: Remotedescriptor (FD=380) initialized12:49:53 LOG6[0]: SNI:sending servername: outlook.office365.com12:49:53 LOG6[0]: Peercertificate not required12:49:53 LOG7[0]: SSL state(connect): before/connect initialization12:49:53 LOG7[0]: SSL state(connect): SSLv2/v3 write client hello A12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server hello A12:49:53 LOG6[0]: Certificateverification disabled12:49:53 LOG6[0]: Certificateverification disabled12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server certificate A12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server key exchange A12:49:53 LOG6[0]: Clientcertificate not requested12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server done A12:49:53 LOG7[0]: SSL state(connect): SSLv3 write client key exchange A12:49:53 LOG7[0]: SSL state(connect): SSLv3 write change cipher spec A12:49:53 LOG7[0]: SSL state(connect): SSLv3 write finished A12:49:53 LOG7[0]: SSL state(connect): SSLv3 flush data12:49:53 LOG7[0]: SSL state(connect): SSLv3 read finished A12:49:53 LOG7[0]: 1 client connect(s) requested12:49:53 LOG7[0]: 1 client connect(s) succeeded12:49:53 LOG7[0]: 0 client renegotiation(s) requested12:49:53 LOG7[0]: 0 session reuse(s)12:49:53 LOG6[0]: SSLconnected: new session negotiated12:49:53 LOG7[0]: Peercertificate was cached (4882 bytes)12:49:53 LOG6[0]: NegotiatedTLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption)12:49:53 LOG7[0]:Compression: null, expansion: null12:49:54 LOG6[0]: Read socketclosed (readsocket)12:49:54 LOG7[0]: Sendingclose_notify alert12:49:54 LOG7[0]: SSL alert(write): warning: close notify12:49:54 LOG6[0]:SSL_shutdown successfully sent close_notify alert12:49:54 LOG7[main]: Found 1ready file descriptor(s)12:49:54 LOG7[main]: FD=204ifds=r-x ofds=---12:49:54 LOG7[main]: Service[outlook-pop3] accepted (FD=404) from 127.0.0.1:380312:49:54 LOG7[main]: Creatinga new thread12:49:54 LOG7[main]: Newthread created12:49:54 LOG7[1]: Service[outlook-pop3] started12:49:54 LOG7[1]: OptionTCP_NODELAY set on local socket12:49:54 LOG5[1]: Service[outlook-pop3] accepted connection from 127.0.0.1:380312:49:54 LOG6[1]: failover:round-robin, starting at entry #212:49:54 LOG6[1]: s_connect:connecting 132.245.212.98:99512:49:54 LOG7[1]: s_connect:s_poll_wait 132.245.212.98:995: waiting 10 seconds12:49:54 LOG6[0]: SSL socketclosed (SSL_read)12:49:54 LOG7[0]: Sent socketwrite shutdown12:49:54 LOG5[0]: Connectionclosed: 67 byte(s) sent to SSL, 11900 byte(s) sent to socket12:49:54 LOG7[0]: Remotedescriptor (FD=380) closed12:49:54 LOG7[0]: Local descriptor(FD=356) closed12:49:54 LOG7[0]: Service[outlook-pop3] finished (1 left)12:49:54 LOG5[1]: s_connect:connected 132.245.212.98:99512:49:54 LOG5[1]: Service[outlook-pop3] connected remote server from 192.168.15.102:380412:49:54 LOG7[1]: OptionTCP_NODELAY set on remote socket12:49:54 LOG7[1]: Remotedescriptor (FD=428) initialized12:49:54 LOG6[1]: SNI:sending servername: outlook.office365.com12:49:54 LOG6[1]: Peercertificate not required12:49:54 LOG7[1]: SSL state(connect): before/connect initialization12:49:54 LOG7[1]: SSL state(connect): SSLv3 write client hello A12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server hello A12:49:54 LOG6[1]: Certificateverification disabled12:49:54 LOG6[1]: Certificateverification disabled12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server certificate A12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server key exchange A12:49:54 LOG6[1]: Clientcertificate not requested12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server done A12:49:54 LOG7[1]: SSL state(connect): SSLv3 write client key exchange A12:49:54 LOG7[1]: SSL state(connect): SSLv3 write change cipher spec A12:49:54 LOG7[1]: SSL state(connect): SSLv3 write finished A12:49:54 LOG7[1]: SSL state(connect): SSLv3 flush data12:49:54 LOG7[1]: SSL state(connect): SSLv3 read finished A12:49:54 LOG7[1]: 2 client connect(s) requested12:49:54 LOG7[1]: 2 client connect(s) succeeded12:49:54 LOG7[1]: 0 client renegotiation(s) requested12:49:54 LOG7[1]: 0 session reuse(s)12:49:54 LOG6[1]: SSLconnected: new session negotiated12:49:54 LOG7[1]:Deallocating application specific data for addr index12:49:54 LOG6[1]: NegotiatedTLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption)12:49:54 LOG7[1]:Compression: null, expansion: null12:49:56 LOG6[1]: Read socketclosed (readsocket)12:49:56 LOG7[1]: Sendingclose_notify alert12:49:56 LOG7[1]: SSL alert(write): warning: close notify12:49:56 LOG6[1]:SSL_shutdown successfully sent close_notify alert12:49:56 LOG6[1]: SSL socketclosed (SSL_read)12:49:56 LOG7[1]: Sent socketwrite shutdown12:49:56 LOG5[1]: Connectionclosed: 67 byte(s) sent to SSL, 11884 byte(s) sent to socket12:49:56 LOG7[1]: Remotedescriptor (FD=428) closed12:49:56 LOG7[1]: Localdescriptor (FD=404) closed12:49:56 LOG7[1]: Service[outlook-pop3] finished (0 left)

1 0

HTTPS proxy tunnel. ssl handshake failure
by Kirill Franko 22 Jul '16

22 Jul '16

1 1

AiX 7.1 TL3 SP6 - Stunnel Memory Usages grows after 24 hours
by Benjamin, Earl 19 Jul '16

19 Jul '16

Hello Everyone, I am running Stunnel-5.29 in AiX 7.1 TL3 SP6. I have added the DH param to the bottom of my CERT file. After approximately 24 hours or so the Stunnel CPU usage jumps to about 50% and after a few days to about 90%. Is there a configuration setting I've missed or compile option I need to consider? Thanks for your assistance in advance. Below is a cleaned up version of my config file. -Earl ------------------------------------------------- ; Verify peer certificate verify = 2 ; Certificate/key is needed in server mode and in client mode cert = /Server-certificate-all.pem key = /Server-certificate-all.pem CAfile = /all_root_ca.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = TLSv1 ; PID path pid = /etc/oraserver_stunnel.pid ; Turn off Nagle algorithm socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Debug level debug = 2 ; Use it for client mode client = no ; Ciphers ciphers = DHE-RSA-AES256-SHA ; Service-level configuration [ oraserver_DB ] accept = 15210 connect = server:1622 [ oraserver_ASM ] accept = 15211 connect = server:1621 This message and any attachments are solely for the use of intended recipients. The information contained herein may include trade secrets, protected health or personal information, privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you are not an intended recipient, you are hereby notified that you received this email in error, and that any review, dissemination, distribution or copying of this email and any attachment is strictly prohibited. If you have received this email in error, please contact the sender and delete the message and any attachment from your system. Thank you for your cooperation

1 0

Man in the middle attack possibility
by Abhinav Srivastava 19 Jul '16

19 Jul '16

Hi, I'm trying to use stunnel to provide encryption for my application to server communication. Server is already ssl aware. I configured my app to talk to localhost:xyz, and configured stunnel in client mode to relay traffic from localhost:<xyz> to actual service. The stunnel to service ssl protocol would use the server certificate, as server is already ssl aware. For any reason if stunnel is not running it would become possible for a non-elevated attacker/malware to spin up a tcp server listening to xyz, essentially taking advantage of my re-configuration of app to talk to localhost:xyz, and spoof the actual server. Even if my app to server protocol had some anti-spoofing mechanism say e.g., reverse CHAP, the malware can easily relay the challenge and response by using the actual service. In my case the actual app is iscsi initiator software that is not in my control and cant be modified, while the server is an iscsi tcp server which I am free to modify. Are there any guidance/best practices around preventing this attack with stunnel? Thanks Abhinav

1 0

Client certificates now required by default?
by Wiest, Damian 07 Jul '16

07 Jul '16

After building stunnel 5.34 from source I noticed that my old config (5.22) was not working. [dwiest@716161-compute2 ~]$ sudo ./stunnel /etc/stunnel/stunnel.conf 2016.07.07 14:07:41 LOG5[ui]: stunnel 5.34 on x86_64-unknown-linux-gnu platform 2016.07.07 14:07:41 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 2016.07.07 14:07:41 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2016.07.07 14:07:41 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2016.07.07 14:07:41 LOG5[ui]: UTF-8 byte order mark not detected 2016.07.07 14:07:41 LOG5[ui]: FIPS mode disabled 2016.07.07 14:07:41 LOG5[ui]: Configuration successful 2016.07.07 14:07:41 LOG5[cron]: Updating DH parameters 2016.07.07 14:07:42 LOG5[0]: Service [rabbitmq] accepted connection from 192.168.237.81:49535 2016.07.07 14:07:42 LOG3[0]: SSL_accept: Peer suddenly disconnected 2016.07.07 14:07:42 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.07.07 14:07:42 LOG5[1]: Service [rabbitmq] accepted connection from 192.168.237.81:49536 2016.07.07 14:07:42 LOG3[1]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate But I haven't enabled client certificate verification! [dwiest@716161-compute2 ~]$ sudo grep verify /etc/stunnel/stunnel.conf ; verify = 2 I have to explicitly set verify to 0 or 1 in order to connect without a client cert. Is this intentional? The documentation suggests that by default no verification should be taking place. -Damian -- Confidentiality Notice: This e-mail transmission may contain confidential or legally privileged information that is intended only for the individual or entity named in the e-mail address. If you have received this communication in error, please notify me by return e-mail, and destroy this communication and all copies thereof, including any attachments. Apervita ® is a registered trademark of Apervita Inc.

1 0

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6