- stunnel-users - stunnel.org

Re: TLSv1.0 and TLSv1.1 - unable to disable
by Josealf.rm 24 Apr '24

24 Apr '24

1 0

TLSv1.0 and TLSv1.1 - unable to disable
by Alan Flores 23 Apr '24

23 Apr '24

Hello: I have not been able to get STunnel to disable these protocols. In the STunnel.conf file I put in the line sslVersionMin = TLSv1.2 I have disabled these in windows 2019 via reg keys But this has not stopped scans from seeing TLSv1.0 and 1.1 Any help would be appreciated stunnel 5.72 on x64-pc-mingw32-gnu platform Windows server 2019 Compiled/running with OpenSSL 3.2.1 30 Jan 2024 Alan Flores Enterprise Support Specialist Enterprise Application Systems E: Alan.Flores(a)Valpo.edu <http://www.valpo.edu> 1700 Chapel Drive, Valparaiso, IN 46383

1 0

using a socks5 with user/name authentication
by Alberto P 21 Apr '24

21 Apr '24

Hello, I have a vpn service that provides a socks5 proxy using user/pass authentication. Using stunnel would allow me to use the service with other clients that allow for a socks5 proxy but normally no authentication. Could anybody tell me 1) is what I'd like feasible ? 2)How do I provide user/pass to the configuration file ? Your help would be very appreciated ! alberto

1 0

Wondering if process to create the g2.pem file is available?
by Michael D. Setzer II 19 Apr '24

19 Apr '24

Was wondering if the process to create the g2.pem file you shared is available. It does work with changes to the stunnel.conf file for both the smtp1.guam.net and mail.guam.net [guampop] client=yes accept = 127.0.0.1:20996 connect = mail.guam.net:995 debug = 7 verifyChain = yes CApath = /etc/ssl/certs CAfile = /etc/stunnel/g2.pem checkHost = mail.guam.net OCSPaia = yes [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 debug = 7 verifyChain = yes CApath = /etc/ssl/certs CAfile = /etc/stunnel/g2.pem checkHost = smtp1.guam.net OCSPaia = yes Not sure the the g2.pem would work for all time, or has an expiration date. Thanks. +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:[email protected] mailto:[email protected] mailto:[email protected] Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

1 0

Having strange issue with newer kernels? 6.8.
by Michael D. Setzer II 19 Apr '24

19 Apr '24

3 2

unknow TCP service 11702
by tomoyalin＠yahoo.co.jp 18 Apr '24

18 Apr '24

how to solve problem from stunnel config file when using port is not 80 or 443. ( our config tcp service port is 11702)

2 1

Having strange issue with newer kernels? 6.8.
by Michael D. Setzer II 18 Apr '24

18 Apr '24

Having issues with stunnel not working with this settings that have work with previous kernels? [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 connect = smtp1.guam.net:465 debug = 7 verifyChain = yes CApath = /etc/ssl/certs checkHost = mail.guam.net OCSPaia = yes But now changing to [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 connect = smtp1.guam.net:465 debug = 7 Seems to work. systemctl status stunnel. stunnel.service - TLS tunnel for network daemons Loaded: loaded (/usr/lib/systemd/system/stunnel.service; enabled; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: active (running) since Thu 2024-04-18 14:48:15 ChST; 5s ago Process: 15349 ExecStart=/usr/bin/stunnel (code=exited, status=0/SUCCESS) Main PID: 15352 (stunnel) Tasks: 3 (limit: 18938) Memory: 3.6M CPU: 1.618s CGroup: /system.slice/stunnel.service └─15352 /usr/bin/stunnel Apr 18 14:48:14 setzconote.dyndns.org systemd[1]: Starting stunnel.service - TLS tunnel for network daemons... Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: stunnel 5.72 on x86_64-redhat-linux-gnu platform Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,> Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.co> Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: UTF-8 byte order mark not detected Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: FIPS mode disabled Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Configuration successful Apr 18 14:48:15 setzconote.dyndns.org systemd[1]: Started stunnel.service - TLS tunnel for network daemons. Using the longer one gives this after attempting to sent smtp. stunnel.service - TLS tunnel for network daemons Loaded: loaded (/usr/lib/systemd/system/stunnel.service; enabled; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: active (running) since Thu 2024-04-18 14:57:22 ChST; 1min 15s ago Process: 15616 ExecStart=/usr/bin/stunnel (code=exited, status=0/SUCCESS) Main PID: 15619 (stunnel) Tasks: 3 (limit: 18938) Memory: 4.0M CPU: 1.639s CGroup: /system.slice/stunnel.service └─15619 /usr/bin/stunnel Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG4[3]: CERT: Pre-verification error: unable to get local issuer> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG4[3]: Rejected by CERT at depth=0: CN=*.guam.net Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: TLS alert (write): fatal: unknown CA Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG3[3]: SSL_connect: ssl/statem/statem_clnt.c:1889: error:0A0000> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG5[3]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Deallocating application specific data for session conne> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Remote descriptor (FD=16) closed Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: local_rfd/local_wfd reset (FD=3) Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Local descriptor (FD=3) closed Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Service [guamsmtp] finished (0 left) lines 1-23/23 (END) Was using the Fedora stunnel the is 5.71, but downloaded the latest 5.72, but seem to get same results. Had some issues with nvidia drives that work fine with 6.7.11 kernels, but fail with the 6.8.x drivers, so not sure if it is linked to that? +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:[email protected] mailto:[email protected] mailto:[email protected] Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

1 0

stunnel doesn't allow two client certificates with the same Subject DN?
by Christopher Schultz 16 Apr '24

16 Apr '24

Hello, I was recently rotating a certificate for a service and I went through my usual procedure: 1. Generate a new client key+cert; don't place them into service, yet 2. Distribute the new certificate to all my stunnel servers that need to trust it by placing it at the end of each of my servers' CAFile files 3. Restart all stunnel services 4. Swap the old key+cert for the client with the new key+cert 5. Test that all is well I've found that if the Distinguished Name of both the old and new certificate are the same, stunnel will only trust the one that is mentioned /first/ in the CAFile. For example, if the CAFile contains: -----BEGIN CERTIFICATE----- certificate A Serial Number: 12345678 Subject: C=US, OU=Testing, O=Example.com, CN=test -----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE----- certificate B Serial Number: 87654321 Subject: C=US, OU=Testing, O=Example.com, CN=test -----BEGIN CERTIFICATE----- Certificate A will be trusted but Certificate B will not be trusted. The error shown in the logs is: CERT: Pre-verification error: self signed certificate Apr 15 21:33:06 mirth-pcc.chadis.com stunnel[23421]: Certificate check failed: depth=0, /C=US/OU=Testing/O=Example.com/CN=test While the certificates are both self-signed, that should not cause an error. Removing the old certificate from the CAFile or moving it to the bottom of the file resolves the problem. (But of course then Certificate A is no longer trusted despite it appearing in the CAFile.) Is this expected behavior? It would be very helpful if stunnel could support two different certificates with the same Subject DN for these kinds of cert-rotation processes. The alternatives are to always use a new DN each time or to add/remove at the same time which makes rolling-back more difficult. Note that everything else about these certificates is different: serial number, fingerprint, generating-key, etc. It's only the Subject DN that is the same. This is stunnel 4.56 on x86_64-koji-linux-gnu platform, on Amazon Linux 2. Thanks! -chris

2 1

HELO handshake problem (?)
by Ducale Ducale 10 Apr '24

10 Apr '24

In a Windows 10 machine I'm using a tool (Netwrix Service Monitor) with a SMTP notification feature that doesn't support authentication, so I'm using Stunnel 5.72 as a local relay for SMTP2GO (smtp2go.com) with this configuration: [smtp2go] client = yes accept = 127.0.0.1:25 connect = mail.smtp2go.com:2525 protocol = smtp protocolAuthentication = plain protocolHost = cloud.mydomain.com protocolUsername = smtp2go(a)mydomain.com protocolPassword = P@ssw0rd debug = 7 I try both PLAIN and LOGIN as authentication mode, with this is error: LOGIN: " ... TLS connected: new session negotiated TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) Peer temporary key: X25519, 253 bits Compression: null, expansion: null -> HELO cloud.mydomain.com <- 250 mail.smtp2go.com Hello cloud.mydomain.com [x.x.x.x] -> AUTH LOGIN <- 503 AUTH command used when not advertised Remote server does not support LOGIN authentication ... " PLAIN: " ... TLS connected: new session negotiated TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) Peer temporary key: X25519, 253 bits Compression: null, expansion: null -> HELO cloud.mydomain.com <- 250 mail.smtp2go.com Hello cloud.mydomain.com [x.x.x.x] -> AUTH PLAIN ******************************************** <- 503 AUTH command used when not advertised PLAIN Authentication Failed Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Deallocating application specific data for session connect address ... " Can anyone help me solve this problem? Thanks!

3 3

help configuration for socks5 nordvpn requiring authentication
by Alberto P 10 Apr '24

10 Apr '24

Hello, I would like to use stunnel to use a socks5 server requiring user/pass authentication (nordvpn) with different clients that allow for a socks5 proxy but no authentication. Could someone help me with the configuration (linux or windows is good). In detail, I don't know how to provide user/pass to the configuration, and if it is actually feasible. Any help will be very appreciated !

1 1

Stunnel - Silent switch to change the install directory
by Meena Prabhakaran 27 Mar '24

27 Mar '24

Hi Team, We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. For more details, please have a look at Autonomous Patching for Every Third-Party Windows App (adaptiva.com) (https://adaptiva.com/products/autonomous-patch) We are willing to add the latest stable version of Stunnel product to our catalogue. Downloaded https://www.stunnel.org/downloads/stunnel-5.72-win64-installer.exe We are testing this app on Windows 10 64Bit VM. Please help us on below points: 1. Is there any switch/parameter which can be passed along with "stunnel-5.72-win64-installer.exe" for changing the "Install directory" silently? Tried these switches - /D, /DIR, /APPDIR, /INSTALLDIR, /TARGETDIR, /INSTALLLOCATION Thanks & Regards, Meena Prabhakaran Application Packager, Adaptiva M +91 9080759487 meena.prabhakaran(a)adaptiva.com<mailto:[email protected]> www.adaptiva.com<http://www.adaptiva.com/> Data Protection and Privacy: Your privacy is important to us. We are committed to protecting your personal information and handling it responsibly. For more information on how we process and protect your data, please review our Privacy Policy (https://adaptiva.com/privacy) Confidentiality Notice: Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of Adaptiva. The recipient should check for the presence of viruses, as Adaptiva accepts no liability for any virus transmitted by this email.

3 3

Received trusted client CA list not found
by allmail 16 Mar '24

16 Mar '24

I see this message in the Stunnel (client) logs during SSL handshake with the server The server requires a client certificate which has been configured in the stunnel configuration. The handshake is working fine but I was wondering what exactly does this line mean. From what I found so far, seems like there is a way for the server to specify which CA's it will accept for the client certificate and it can specify them in the ClientCertificate request that it sends This server doesnt send anything like that, so I am guessing that is the reason for this log line? Can someone please confirm? Btw, I see this line only when using TLSv1.3. When I restrict the client to TLSv1.2, I dont see this line. thanks LOG Peer certificate required TLS state (connect): before SSL initialization Initializing application specific data for session authenticated TLS state (connect): SSLv3/TLS write client hello TLS state (connect): SSLv3/TLS write client hello TLS state (connect): SSLv3/TLS read server hello TLS state (connect): TLSv1.3 read encrypted extensions Received trusted client CA list not found TLS state (connect): SSLv3/TLS read server certificate request

1 0

Windows service won't start. ""The Stunnel TLS wrapper service is marked as an interactive service."
by docfxit＠theoffice.la 12 Mar '24

12 Mar '24

This is my log: [code] stunnel 5.72 on x64-pc-mingw32-gnu platform 2024.03.10 10:19:49 LOG5[main]: Compiled/running with OpenSSL 3.2.1 30 Jan 2024 2024.03.10 10:19:49 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2024.03.10 10:19:49 LOG7[main]: errno: (*_errno()) 2024.03.10 10:19:49 LOG6[main]: Initializing inetd mode configuration 2024.03.10 10:19:49 LOG7[main]: Running on Windows 6.2 Windows 10 2024.03.10 10:19:49 LOG5[main]: Reading configuration from file C:\Programs\stunnel\config\stunnel.conf 2024.03.10 10:19:49 LOG5[main]: UTF-8 byte order mark not detected 2024.03.10 10:19:49 LOG5[main]: FIPS mode disabled 2024.03.10 10:19:49 LOG6[main]: Compression disabled 2024.03.10 10:19:49 LOG7[main]: No PRNG seeding was required 2024.03.10 10:19:49 LOG6[main]: Initializing service [pop3_DocfxitGmail] 2024.03.10 10:19:49 LOG7[main]: Initializing context [pop3_DocfxitGmail] 2024.03.10 10:19:49 LOG6[main]: OpenSSL security level is used: 2 2024.03.10 10:19:49 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2024.03.10 10:19:49 LOG7[main]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2024.03.10 10:19:49 LOG7[main]: TLS options: 0x2100000 (+0x0, -0x0) 2024.03.10 10:19:49 LOG6[main]: Session resumption enabled 2024.03.10 10:19:49 LOG7[main]: No certificate or private key specified 2024.03.10 10:19:49 LOG6[main]: No trusted certificates found [/code] I copied a working config from Windows 7 64bit. Running stunnel 5.50

2 1

A conclusive Manual for Web Nursing Classes
by silir10174＠mcuma.com 07 Mar '24

07 Mar '24

[b]A conclusive Manual for Web Nursing Classes[/b] Show (150 words): In the rapidly creating circumstance of preparing, electronic learning has changed into an establishment for overwhelmingly most certain clinical directors searching for flexibility and responsiveness. This wide aide, "Rx for Progress: An unequivocal [url=https://tutorsacademy.co/nurs-fpx-4050-assessment-2-ethical-and-policy-factors-in-care-coordination/]4050 assessment 2[/url] Manual for Electronic Nursing Classes," bounces into the universe of web nursing bearing, offering boundless encounters and strong signs to explore this imperative learning environment. From picking the right program to winning in virtual study corridors, this guide means to empower specific specialists with the data and resources expected to prosper in the online nursing preparing space. I. The Move of Web Nursing Coaching The key piece investigates the making obviousness of electronic nursing programs, uncovering data into the parts that have added to their standing. Look at the flexibility these undertakings offer, the rising interest for remote learning, and such progress in movement that [url=https://tutorsacademy.co/nurs-fpx-4040-assessment-1-nursing-informatics-in-health-care/]nurs 4040 assessment 1[/url] make electronic arranging more open than later in consistent memory. II. Picking the Right Web Nursing Undertaking This part gives an every little push toward turn guide on picking the ideal electronic nursing program. It covers fundamental evaluations like declaration, program reputation, labor force endorsements, and the availability of clinical approaches. Furthermore, it offers tips on researching and standing separated different undertakings from ensure a remarkably arranged fit for individual necessities and goals. III. Investigating Virtual Homerooms Truly analyzing the virtual homeroom is genuine for web nursing students. This part offers significant empowering on utilizing time, as a matter of fact, convincing correspondence with instructors and mates, and utilizing on the web resources. It also addresses typical challenges looked by online students and gives systems to beat them. IV. Controlling Clinical Experiences Clinical experiences are a crucial piece of nursing tutoring. This part examines how web nursing programs coordinate clinical circumstances, orchestrating the meaning of dynamic experience and offering heading on finding fitting entryways locally. It likewise discusses the control of reenactment movement in beating any hindrance among speculation and practice. V. Instruments and Movements for Online Accomplishment To win in electronic nursing classes, students ought to be have a lot of involvement in various contraptions and levels of progress. This part approaches basic programming, stages, and resources that can moreover cultivate the shocking an open door for development. From virtual labs to crafty outline materials, this guide ensures students are outstanding for progress. VI. Vanquishing Challenges and Remaining Invigorated Web learning goes with its own course of action of troubles. This part pays special attention to normal blocks like detachment, time use difficulties, and movement issues. It gives essential clues on extra moved, searching for help, and saving solid areas for an among fun and serious exercises. End Considering everything, "Rx for Progress: A persuading Manual for Electronic Nursing Classes" fills in as a total partner without a doubt clinical managers leaving on their online training experience. By resolving focal issues of view from program decision to overwhelming virtual homerooms, this guide partners with students to thrive in the dynamic and repaying field of electronic nursing training. Outfitted with data and sensible designs, perusers are all set to embrace the doorways and burdens of electronic getting, making game plans for a valuable nursing business.

1 0

Stunnel HA Options
by caspernetherlands＠gmail.com 07 Mar '24

07 Mar '24

Hello folks, I have seen a couple of other posts concerning this question but I am still unclear and wanted to see if there are any new options for 2024. What would the recommended setup for Stunnel look like for HA (high-availability)? All I need is basically to have two servers, one active and another one stand by and be able to fail over to the standby server when the active one becomes unavailable due to hardware failure, bad vmotion etc. Extra point if this setup offers automatic failover to DR as well, meaning failover to a third server that's also on standby in case of catastrophic failures on the first two. This almost looks like a load-balancing solution but not really. I say this because I tried to leverage F5 to accomplish this HA scenario and wasn't successful at it because of the way that the F5 performs active checks so often and how noisy that can be for network perimeter security setups. My main request is the local HA though, I can come up with a solution for DR later on. Any recommendation is appreciated. Thank you in advance!

4 5

possible typo in manpage imap example
by alisonatwork＠outlook.com 05 Mar '24

05 Mar '24

Hi, It's possible that I am missing something obvious, but I was reading the manpage today and it seems like the example suggesting how to configure an email client for tunneled imap is incorrect. It suggests that the user configure their client to connect to port 119, but then the example stunnel config shows accept = 143. If this is indeed incorrect, I think the following files need to be modified to change 119 to 143: doc/stunnel.8.in doc/stunnel.html.in doc/stunnel.pl.8.in doc/stunnel.pl.html.in doc/stunnel.pl.pod.in doc/stunnel.pod.in Regards, Alison

1 0

Succeeding in Nursing Academia: The Critical Impact of Online Course Assistance on Academic Triumph
by towim42830＠artgulin.com 04 Mar '24

04 Mar '24

Introduction: In the dynamic landscape of education, the demand for online courses has witnessed an unprecedented surge, especially in fields like nursing. The flexibility and accessibility offered by online learning platforms have made education more attainable for individuals balancing work, family, and other commitments nurs fpx 4050 assessment 2. However, the rigorous nature of nursing programs can pose challenges for students, leading many to seek assistance with their coursework. In this blog, we will explore the growing trend of students turning to online course help and paying someone to do their online classes, particularly in the realm of nursing paper writing services. The Rise of Online Nursing Education: The allure of online nursing education lies in its flexibility, allowing aspiring nurses to pursue their dreams without sacrificing their current commitments. With the increasing popularity of online nursing programs, students are presented with a unique set of challenges. Balancing clinical experiences, theoretical coursework, and other responsibilities can be overwhelming, prompting students to explore options for additional support. The Need for Academic Assistance: Nursing programs often require students to delve into complex topics, complete extensive research, and submit well-crafted papers. The pressure to excel in both practical and theoretical aspects of nursing education can be daunting, leading some students to seek online course help. The question then arises – is it ethical to pay someone to do my online class or assist with nursing paper writing services? Understanding the Ethical Dilemma: The ethical considerations surrounding seeking academic assistance are complex. On one hand, students argue that external support enables them to focus on practical experiences and hands-on learning. On the other hand, critics argue that outsourcing coursework undermines the integrity of education and the development of essential skills nurs-fpx 4060 assessment 1. Navigating the Online Course Help Landscape: For those considering online course help, it is crucial to approach the situation with caution and a clear understanding of the ethical implications. Many online platforms and services claim to provide assistance with nursing paper writing services, but it is essential to discern between legitimate support and services that may compromise academic integrity. Choosing Reputable Services: When seeking online course help for nursing paper writing services, it is imperative to choose reputable and ethical service providers. These services should prioritize academic honesty, transparency, and the development of students' critical thinking skills. Thoroughly researching and vetting potential service providers can help students make informed decisions. The Role of Academic Support Services: Rather than viewing online course help as a shortcut, students should consider these services as valuable supplements to their learning journey. Academic support services can offer guidance, feedback, and assistance in understanding complex nursing concepts. This collaborative approach allows students to enhance their skills while meeting the demands of their coursework chamberlain nurse executive track. Developing Essential Skills: While online course help can provide support, it is essential for students to actively engage with the material and develop the critical skills necessary for a successful nursing career. Ethical academic support services aim to empower students, encouraging them to take an active role in their education and fostering a sense of responsibility for their learning outcomes. Balancing Priorities: The decision to seek online course help should be accompanied by a realistic assessment of one's priorities and capabilities. Nursing students juggling multiple responsibilities may find that strategic use of academic support services can help them maintain a healthy work-life balance while excelling in their coursework. The Impact on Future Nursing Practice: Aspiring nurses must recognize that the skills and knowledge acquired during their education directly impact their ability to provide quality patient care in the future. While online course help can provide temporary relief, it is crucial for students to actively engage with the material and strive for a deep understanding of nursing concepts. Conclusion: The landscape of nursing education is evolving, with online courses offering unprecedented flexibility for students. As the demand for nursing professionals continues to grow, the need for academic support services, including nursing paper writing services, is likely to persist online class help. However, students must approach online course help with a balanced perspective, understanding the ethical considerations and prioritizing the development of essential skills. By navigating the online course help landscape responsibly, nursing students can enhance their learning experience and prepare for a successful and fulfilling career in healthcare.

1 0

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

How to use best config to secure stunnel?
by sephrrr＠gmail.com 27 Feb '24

27 Feb '24

Irans goverment start to detect stunnel with openvpn tunnel. how to avoid this? is there any updates for stunnel for this problem?

1 0

Windows 2022 tunnel client issues
by Mark Weishaar 23 Feb '24

23 Feb '24

Hello, I’m working on replacing an older Windows server that uses stunnel 5.71 to connect to an Oracle database running on a Linux box. I can communicate just fine with the older Windows machine and another Linux box; however, when I try to connect with the stunnel 5.72 on the Windows 2022 server, I keep running into issues and the connection is forcibly closed. Old Windows server: stunnel 5.71 New Windows 2022 server: stunnel 5.72 (I also tried 5.71 and 5.62 just to rule things out Oracle db server: stunnel 5.72 Other Linux server: stunnel 5.72 My stunnel.conf file is very basic, but this is what is working from my other Windows server (running stunnel 5.71): debug = 7 [oracle15211] client = yes accept = 127.0.0.1:15211 connect = 172.28.125.52:15211 Below is the log with debug level 7… the only issue that I’m seeing is the “transfer() loop executes not transferring any data” message that baffles me but I’m not sure if that’s the cause of my issues or not: 2024.02.23 11:10:21 LOG7[0]: Service [oracle15211] started 2024.02.23 11:10:21 LOG7[0]: Setting local socket options (FD=768) 2024.02.23 11:10:21 LOG7[0]: Option TCP_NODELAY set on local socket 2024.02.23 11:10:21 LOG5[0]: Service [oracle15211] accepted connection from 127.0.0.1:49750 2024.02.23 11:10:21 LOG6[0]: s_connect: connecting 172.28.125.52:15211 2024.02.23 11:10:21 LOG7[0]: s_connect: s_poll_wait 172.28.125.52:15211: waiting 10 seconds 2024.02.23 11:10:21 LOG7[0]: FD=780 ifds=rwx ofds=--- 2024.02.23 11:10:21 LOG5[0]: s_connect: connected 172.28.125.52:15211 2024.02.23 11:10:21 LOG5[0]: Service [oracle15211] connected remote server from 172.28.112.245:49751 2024.02.23 11:10:21 LOG7[0]: Setting remote socket options (FD=780) 2024.02.23 11:10:21 LOG7[0]: Option TCP_NODELAY set on remote socket 2024.02.23 11:10:21 LOG7[0]: Remote descriptor (FD=780) initialized 2024.02.23 11:10:21 LOG6[0]: SNI: sending servername: 172.28.125.52 2024.02.23 11:10:21 LOG6[0]: Peer certificate not required 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): before SSL initialization 2024.02.23 11:10:21 LOG7[0]: Initializing application specific data for session authenticated 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): TLSv1.3 read encrypted extensions 2024.02.23 11:10:21 LOG6[0]: CERT: Certificate verification disabled 2024.02.23 11:10:21 LOG6[0]: CERT: Certificate verification disabled 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): TLSv1.3 read server certificate verify 2024.02.23 11:10:21 LOG7[0]: OCSP stapling: Client callback called 2024.02.23 11:10:21 LOG6[0]: OCSP: Certificate chain verification disabled 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2024.02.23 11:10:21 LOG7[0]: 1 client connect(s) requested 2024.02.23 11:10:21 LOG7[0]: 1 client connect(s) succeeded 2024.02.23 11:10:21 LOG7[0]: 0 client renegotiation(s) requested 2024.02.23 11:10:21 LOG7[0]: 0 session reuse(s) 2024.02.23 11:10:21 LOG6[0]: TLS connected: new session negotiated 2024.02.23 11:10:21 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2024.02.23 11:10:21 LOG6[0]: Peer temporary key: X25519, 253 bits 2024.02.23 11:10:21 LOG7[0]: Compression: null, expansion: null 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSL negotiation finished successfully 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSL negotiation finished successfully 2024.02.23 11:10:21 LOG7[0]: Initializing application specific data for session authenticated 2024.02.23 11:10:21 LOG7[0]: Deallocating application specific data for session connect address 2024.02.23 11:10:21 LOG7[0]: New session callback 2024.02.23 11:10:21 LOG7[0]: Peer certificate was cached (1375 bytes) 2024.02.23 11:10:21 LOG6[0]: Session id: B36502A30B16F61EFE3A13B7BAA73BBCD57C2C6DB838FFC7CDFDE9BF7D8607A0 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read server session ticket 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSL negotiation finished successfully 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSL negotiation finished successfully 2024.02.23 11:10:21 LOG7[0]: Initializing application specific data for session authenticated 2024.02.23 11:10:21 LOG7[0]: New session callback 2024.02.23 11:10:21 LOG7[0]: Deallocating application specific data for session connect address 2024.02.23 11:10:21 LOG6[0]: Session id: 7FC6ABDCD70443FE70736F725F90792FAC2692FD9AD8F54A3F0443C2403C9A0C 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read server session ticket 2024.02.23 11:10:21 LOG3[0]: transfer() loop executes not transferring any data 2024.02.23 11:10:21 LOG3[0]: please report the problem to Michal.Trojnara(a)stunnel.org<mailto:[email protected]> 2024.02.23 11:10:21 LOG3[0]: stunnel 5.72 on x64-pc-mingw32-gnu platform 2024.02.23 11:10:21 LOG3[0]: Compiled/running with OpenSSL 3.2.1 30 Jan 2024 2024.02.23 11:10:21 LOG3[0]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2024.02.23 11:10:21 LOG7[0]: errno: (*_errno()) 2024.02.23 11:10:21 LOG3[0]: protocol=TLSv1.3, SSL_pending=0, SSL_has_pending=0 2024.02.23 11:10:21 LOG3[0]: sock_open_rd=Y, sock_open_wr=Y 2024.02.23 11:10:21 LOG3[0]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2024.02.23 11:10:21 LOG3[0]: sock_can_rd=n, sock_can_wr=n 2024.02.23 11:10:21 LOG3[0]: ssl_can_rd=n, ssl_can_wr=n 2024.02.23 11:10:21 LOG3[0]: read_wants_read=Y, read_wants_write=n 2024.02.23 11:10:21 LOG3[0]: write_wants_read=n, write_wants_write=n 2024.02.23 11:10:21 LOG3[0]: shutdown_wants_read=n, shutdown_wants_write=n 2024.02.23 11:10:21 LOG3[0]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) 2024.02.23 11:10:21 LOG5[0]: Connection reset: 685 byte(s) sent to TLS, 381 byte(s) sent to socket 2024.02.23 11:10:21 LOG7[0]: remote_fd reset (FD=780) 2024.02.23 11:10:21 LOG7[0]: Remote descriptor (FD=780) closed 2024.02.23 11:10:21 LOG7[0]: local_rfd/local_wfd reset (FD=768) 2024.02.23 11:10:21 LOG7[0]: Local descriptor (FD=768) closed 2024.02.23 11:10:21 LOG7[0]: Service [oracle15211] finished (0 left) Any help is greatly appreciated! Thank you, Mark

1 0

Dynamic DNS
by alstar＠maybenot.work 20 Feb '24

20 Feb '24

Hi, I'm running Stunnel on Linux. It needs to connect to a dynamic IP address (by domain name). The DNS is updated automatically. I noticed that the last time the address changed, Stunnel stopped working. A ping from the machine produced the correct address but Stunnel was using the old one. Will a reload work?

4 6

stunnel 5.72 released
by Michał Trojnara 05 Feb '24

05 Feb '24

Dear Users, I have released version 5.72 of stunnel. ### Version 5.72, 2024.02.04, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.2.1. * Bugfixes - Fixed SSL_CTX_new() errors handling. - Fixed OPENSSL_NO_PSK builds. - Android build updated for NDK r23c. - stunnel.nsi updated for Debian 12. - Fixed tests with OpenSSL older than 1.0.2. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 3d532941281ae353319735144e4adb9ae489a10b7e309c58a48157f08f42e949 stunnel-5.72.tar.gz 1037c53f8ab590c2f3001e54cf381c3ea4225e9670b03870191383060e6851e7 stunnel-5.72-win64-installer.exe 668161b90034820198c456b4137ed3680d6fd49d4de920d51e499b84538f63d3 stunnel-5.72-android.zip Best regards, Mike

1 0

error:0A00010B:SSL routines::wrong version number
by Graham Lang 18 Dec '23

18 Dec '23

Hi, I've been using Stunnel for many years without a problem but I just changed my email provider and now my mail client can't send emails. Receiving via POP is still fine, but sending via SMTP is giving the error "SSL_connect: ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number" The old SMTP server was on port 465 whereas the new server (hotmail) is on port 587 so that may be the source of the problem. My config file is quite simple: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [pop] accept = 110 connect = outlook.office365.com:995 [smtp] accept = 25 connect = smtp-mail.outlook.com:587 I just changed the POP and SMTP server details to the new ones. POP is still on port 995 as it was before but SMTP has changed from 465 to 587. I was running an older version of Stunnel but updating to latest version hasn't helped. Does anyone have any ideas? I'd hate to have to lose my old Email client which has so many messages stored so it would be great to get it working fully with hotmail. Thanks! Graham.

4 3

stunnel - slowness
by Luciano Bonifácio 15 Dec '23

15 Dec '23

Good morning guys! I started using stunnel very recently with GLPI to authenticate to Google LDAP, and it is working, but with extreme slowness at Login. Something around 35 seconds. I believe there may be some parameters, adjustments to make. I'm sending the stunnel.conf configuration below, as well as the attached log file(txt). Could you give me a suggestion. Thanks, Luciano # stunnel.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - debug = 7 output = /var/log/stunnel4/stunnel.log [ldap] client = yes accept = 127.0.0.1:1636 connect = ldap.google.com:636 cert = /etc/certificates/glpi_ldap.crt key = /etc/certificates/glpi_ldap.key - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

1 0

Paho connection to stunnel
by jesramsing＠hotmail.com 15 Dec '23

15 Dec '23

I have a strange problem connecting from a C++ application using the Paho framework to the stunnel. The certificates are self signed, and MQTT Explorerr hooks up nicely and validates the certificate when fed with the appropriate ca certificate. So, stunnel seems to behave nicely on some cases, others not. The stunnel log shows a SSL_accept: ssl/record/ssl3_record_c:354: errror: 0A00010B:SSL wrong version. I have tried version 1.1 and 1.2 in the Paho library, both failing with the same error code. Any ideas or suggestions?

1 0

Re: Getting logs in systemd environment
by Christopher Schultz 13 Dec '23

13 Dec '23

Michael, On 12/13/23 15:43, Michael D. Setzer II wrote: > /var/log/secure Thank you for your reply, but /var/log is basically empty (meaning very few files located there). journald has absorbed everything and files are no longer the way to get logs from systemd-based environments. The only thing which contains non-trivial information is /var/log/journal/* which is a bunch of binary files. My reply below shows how you can get the stunnel-related log messages. I don't believe they are available through any traditional text-based log file. -chris > On 13 Dec 2023 at 15:37, Christopher Schultz wrote: > > Date sent: Wed, 13 Dec 2023 15:37:04 -0500 > To: "'stunnel-users(a)stunnel.org'" > <stunnel-users(a)stunnel.org> > From: Christopher Schultz > <chris(a)christopherschultz.net> > Subject: [stunnel-users] Re: Getting logs in systemd > environment > patches" <stunnel-users.stunnel.org> > >> Carter, >> >> On 12/13/23 14:53, cbrowne wrote: >>> Have you tried doing "find / -name stunnel.log -print" as root. I have >>> found that the log file can be in a number of different locations >>> depending on the system. >> >> There are no files named stunnel.log on my system. >> >> I do not have a specific setting for "output". I was expecting syslog to >> be used for that purpose without a specific setting. syslog=yes appears >> to be the default given the man page for stunnel. >> >> But your comment got me more interested in exactly what was happening, >> so I tried /not/ limiting journalctl --follow to a specific service and >> I can see all kinds of things coming from stunnel: >> >> >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready >> file descriptor(s) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 >> events=0x2001 revents=0x1 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service >> [ORU-outbound] accepted (FD=3) from ::ffff:20.204.213.204:55455 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Service >> [ORU-outbound] started >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Setting local >> socket options (FD=3) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Option >> TCP_NODELAY set on local socket >> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Service >> [ORU-outbound] accepted connection from ::ffff:20.204.213.204:55455 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174806]: Peer >> certificate required >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Initializing >> application specific data for session authenticated >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: SNI: no >> virtual services defined >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS read client hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write server hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write certificate >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write key exchange >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write certificate request >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write server done >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready >> file descriptor(s) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 >> events=0x2001 revents=0x1 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service >> [ORU-outbound] accepted (FD=15) from ::ffff:client.ip:44905 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Service >> [ORU-outbound] started >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Setting local >> socket options (FD=15) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Option >> TCP_NODELAY set on local socket >> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174807]: Service >> [ORU-outbound] accepted connection from ::ffff:client.ip:44905 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174807]: Peer >> certificate required >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Initializing >> application specific data for session authenticated >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: SNI: no >> virtual services defined >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS read client hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write server hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write certificate >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write key exchange >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write certificate request >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write server done >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS alert >> (read): fatal: certificate unknown >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Remove >> session callback >> Dec 13 20:31:00 example.com stunnel[300695]: LOG3[174806]: SSL_accept: >> ssl/record/rec_layer_s3.c:1605: error:0A000416:SSL routines::sslv3 alert >> certificate unknown >> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Connection >> reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket >> >> So this probably just comes down to either systemd/journalctl or me >> being stupid. >> >> Instead of asking for the journal/log for the "unit" stunnel (i.e. >> journalctl -u stunnel), you need instead to ask for the "systelog >> identifier" called stunnel like this: >> >> $ journalctl -t stunnel >> >> If you use --follow you get tail -f behavior, which is nice to see >> what's happening in real-time. >> >> -chris >> >>> On 12/13/2023 2:39 PM, Christopher Schultz wrote: >>>> other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears >>>> the case that I should be able to view the journals using this command: >>>> >>>> sudo journalctl --follow -u stunnel.service >>>> >>>> But nothing is ever printed there. >>> >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org >> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org > > > +------------------------------------------------------------+ > Michael D. Setzer II - Computer Science Instructor > (Retired) > mailto:[email protected] > mailto:[email protected] > mailto:[email protected] > Guam - Where America's Day Begins > G4L Disk Imaging Project maintainer > http://sourceforge.net/projects/g4l/ > +------------------------------------------------------------+ > > >

2 2

Getting logs in systemd environment
by Christopher Schultz 13 Dec '23

13 Dec '23

All, I recently built a server from scratch in Amazon EC2 using Amazon Linux 2023 which is systemd-based. When having trouble with a client failing to connect to our stunnel-based service, I tried raising the log level: debug=7 and restarted the service. I can't find any indication that the logs are available. There is no /var/log/stunnel directory. There are none of the usual files I might expect these logs to be in on other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears the case that I should be able to view the journals using this command: sudo journalctl --follow -u stunnel.service But nothing is ever printed there. Does anyone know how to get logging from stunnel in this kind of environment? (BTW, *I* am able to connect to this service, so I know it's running, etc. This is only a logging-problem, not an stunnel-isnt-working problem.) Thanks, -chris

2 1

Re: Getting logs in systemd environment
by Christopher Schultz 13 Dec '23

13 Dec '23

Carter, On 12/13/23 14:53, cbrowne wrote: > Have you tried doing "find / -name stunnel.log -print" as root. I have > found that the log file can be in a number of different locations > depending on the system. There are no files named stunnel.log on my system. I do not have a specific setting for "output". I was expecting syslog to be used for that purpose without a specific setting. syslog=yes appears to be the default given the man page for stunnel. But your comment got me more interested in exactly what was happening, so I tried /not/ limiting journalctl --follow to a specific service and I can see all kinds of things coming from stunnel: Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready file descriptor(s) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 events=0x2001 revents=0x1 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service [ORU-outbound] accepted (FD=3) from ::ffff:20.204.213.204:55455 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Service [ORU-outbound] started Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Setting local socket options (FD=3) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Option TCP_NODELAY set on local socket Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Service [ORU-outbound] accepted connection from ::ffff:20.204.213.204:55455 Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174806]: Peer certificate required Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Initializing application specific data for session authenticated Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: SNI: no virtual services defined Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS read client hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write server hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write certificate Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write key exchange Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write certificate request Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write server done Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready file descriptor(s) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 events=0x2001 revents=0x1 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service [ORU-outbound] accepted (FD=15) from ::ffff:client.ip:44905 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Service [ORU-outbound] started Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Setting local socket options (FD=15) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Option TCP_NODELAY set on local socket Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174807]: Service [ORU-outbound] accepted connection from ::ffff:client.ip:44905 Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174807]: Peer certificate required Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Initializing application specific data for session authenticated Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: SNI: no virtual services defined Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS read client hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write server hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write certificate Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write key exchange Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write certificate request Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write server done Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS alert (read): fatal: certificate unknown Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Remove session callback Dec 13 20:31:00 example.com stunnel[300695]: LOG3[174806]: SSL_accept: ssl/record/rec_layer_s3.c:1605: error:0A000416:SSL routines::sslv3 alert certificate unknown Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket So this probably just comes down to either systemd/journalctl or me being stupid. Instead of asking for the journal/log for the "unit" stunnel (i.e. journalctl -u stunnel), you need instead to ask for the "systelog identifier" called stunnel like this: $ journalctl -t stunnel If you use --follow you get tail -f behavior, which is nice to see what's happening in real-time. -chris > On 12/13/2023 2:39 PM, Christopher Schultz wrote: >> other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears >> the case that I should be able to view the journals using this command: >> >> sudo journalctl --follow -u stunnel.service >> >> But nothing is ever printed there. >

1 0

Connect multiple clients to one server port
by egig＠gmv.com 12 Dec '23

12 Dec '23

Hi all I was wondering if there is a way to connect multiple stunnel clients running on different machines to the same stunnel server service, also running on a different machine. All the clients must connect to the same server port. I have tried it with my current config but I haven't been able to make it work, is this even possible?? Thanks, Esteban.

3 4

Accepted connection and then TIMEOUTconnection exceeded:
by trashrap22＠gmail.com 07 Dec '23

07 Dec '23

Hi All, I can ssh to my VM with terminal etc. However my stunnel has something stopping the packet flow? What could be the problem and what should I check / troubleshoot: client log file: 2023.12.07 07:21:05 LOG7[0]: Service [Sql_Silicon] started 2023.12.07 07:21:05 LOG7[0]: Setting local socket options (FD=636) 2023.12.07 07:21:05 LOG7[0]: Option TCP_NODELAY set on local socket 2023.12.07 07:21:05 LOG5[0]: Service [Sql_Silicon] accepted connection from 127.0.0.1:50474 2023.12.07 07:21:05 LOG6[0]: s_connect: connecting <IP>:<Port> 2023.12.07 07:21:05 LOG7[0]: s_connect: s_poll_wait <IP>:<Port>: waiting 10 seconds 2023.12.07 07:21:05 LOG7[0]: FD=676 ifds=rwx ofds=--- 2023.12.07 07:21:15 LOG3[0]: s_connect: s_poll_wait <IP>:<Port>: TIMEOUTconnect exceeded 2023.12.07 07:21:15 LOG3[0]: No more addresses to connect 2023.12.07 07:21:15 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.12.07 07:21:15 LOG7[0]: local_rfd/local_wfd reset (FD=636) 2023.12.07 07:21:15 LOG7[0]: Local descriptor (FD=636) closed 2023.12.07 07:21:15 LOG7[0]: Service [Sql_Silicon] finished (0 left) My VM is a linux server, on startup of stunnel I get this concerning message which might be the cause? However, I checked and stunnel4:stunnel4 has permissions on the folder and psk file. 2023.12.07 07:40:45 LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/pskSQL_.txt server log file on start service: 2023.12.07 07:40:45 LOG7[ui]: Clients allowed=500 2023.12.07 07:40:45 LOG5[ui]: stunnel 5.56 on x86_64-pc-linux-gnu platform 2023.12.07 07:40:45 LOG5[ui]: Compiled with OpenSSL 1.1.1k 25 Mar 2021 2023.12.07 07:40:45 LOG5[ui]: Running with OpenSSL 1.1.1w 11 Sep 2023 2023.12.07 07:40:45 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2023.12.07 07:40:45 LOG7[ui]: errno: (*__errno_location ()) 2023.12.07 07:40:45 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2023.12.07 07:40:45 LOG5[ui]: UTF-8 byte order mark not detected 2023.12.07 07:40:45 LOG5[ui]: FIPS mode disabled 2023.12.07 07:40:45 LOG7[ui]: Compression disabled 2023.12.07 07:40:45 LOG7[ui]: No PRNG seeding was required 2023.12.07 07:40:45 LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/pskSQL_.txt 2023.12.07 07:40:45 LOG6[ui]: PSKsecrets line 1: 64-byte hexadecimal key configured for identity "siliconServer" 2023.12.07 07:40:45 LOG6[ui]: Initializing service [SQL-<port>] 2023.12.07 07:40:45 LOG6[ui]: PSK identities: 1 retrieved 2023.12.07 07:40:45 LOG7[ui]: Ciphers: PSK 2023.12.07 07:40:45 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.12.07 07:40:45 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2023.12.07 07:40:45 LOG7[ui]: No certificate or private key specified 2023.12.07 07:40:45 LOG6[ui]: DH initialization needed for DHE-PSK-AES256-GCM-SHA384 2023.12.07 07:40:45 LOG7[ui]: DH initialization 2023.12.07 07:40:45 LOG7[ui]: No certificate available to load DH parameters 2023.12.07 07:40:45 LOG6[ui]: Using dynamic DH parameters 2023.12.07 07:40:45 LOG7[ui]: ECDH initialization 2023.12.07 07:40:45 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.12.07 07:40:45 LOG5[ui]: Configuration successful 2023.12.07 07:40:45 LOG7[ui]: Binding service [SQL-<port>] 2023.12.07 07:40:45 LOG7[ui]: Listening file descriptor created (FD=9) 2023.12.07 07:40:45 LOG7[ui]: Setting accept socket options (FD=9) 2023.12.07 07:40:45 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2023.12.07 07:40:45 LOG6[ui]: Service [SQL-<port>] (FD=9) bound to <IP>:<port> 2023.12.07 07:40:45 LOG5[ui]: Switched to chroot directory: /var/lib/stunnel4/ 2023.12.07 07:40:45 LOG7[main]: Created pid file /stunnel.pid 2023.12.07 07:40:45 LOG7[cron]: Cron thread initialized 2023.12.07 07:40:45 LOG6[cron]: Executing cron jobs 2023.12.07 07:40:45 LOG5[cron]: Updating DH parameters

2 1

Stunnel load balancing through F5
by caspernetherlands＠gmail.com 05 Dec '23

05 Dec '23

Hello, Was wondering if anyone has tried to setup an HA like setup, specifically active/passive through two Stunnel servers and F5 load balancers. The problem I have is that TCP health checks (active checks) from the F5 are causing session initiation all the way to the 3rd party on the other side and this is causing a lot of unnecessary TCP traffic at the transport layer. The good thing is that the F5 closes these TCP sessions, but the problem is the 3rd party thinks someone is trying to brute force or something. Does anyone know how to maintain the TCP active health checks that the F5 does, but at the same time not cause a session initiation all the way to the 3rd party? Or if it’s not possible to stop the session initiation, would there be any option where something can be adjusted in the stunnel side so that the other side sees only one TCP health check as opposed to multiple every few seconds?

3 3

Connection failed: no suitable signature algorithm
by Martin K. 01 Dec '23

01 Dec '23

I'm trying to understand this error: SSL_accept: ssl/t1_lib.c:2827: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm How can I fix that? Is it because of the openssl version? I'm using Stunnel 5.71 on both sides. The server-side stunnel is built from source.

1 0

WG: stunnel core dumps, "SSL3_GET_RECORD:decryption failed or bad record mac"
by Sacha Hottinger 27 Nov '23

27 Nov '23

Hello, We are using stunnel 5.71 on Solaris 10 to tunnel NFS on more than 50 systems. In the past we saw stunnel dumping cores without any errors or hints in the stunnel log file. It was believed to be an OpenSSL 1.x problem. We got an stunnel version with SSL 2.x and 3.x but we had to go back to 1.x because of other problems. We noticed the dumps to happen at regular times and found a script that made NFS requests every 10 Min. After changing the script so there are less NFS requests it was stable. It looked like the problem accumulated over time and a counter or something alike reached its limit which then resulted in the core dump. Then the core dumps started again. It still seems to be related to the amount of requests because the problem occurs on the two NFS Servers with the highest number of connections. This time, we see errors in the stunnel log. The error slightly varies: 2023.10.12 22:05:43 LOG3[10745]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac // There were also a few cases with an additional "internal error". I.e: 2023.10.16 00:23:53 LOG5[2968]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:38270 2023.10.16 00:40:19 LOG3[2968]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.16 00:40:19 LOG3[2967]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.16 00:40:19 LOG5[2968]: Connection reset: 2476 byte(s) sent to TLS, 3324 byte(s) sent to socket 2023.10.16 00:40:19 LOG5[2967]: Connection reset: 2500 byte(s) sent to TLS, 3100 byte(s) sent to socket INTERNAL ERROR: Bad magic at ssl.c, line 192 2023.10.16 00:40:20 LOG6[ui]: Initializing inetd mode configuration // or 2023.10.23 07:33:53 LOG5[62]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:50626 2023.10.23 07:38:37 LOG3[62]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.23 07:38:37 LOG5[62]: Connection reset: 364 byte(s) sent to TLS, 336 byte(s) sent to socket ... 2023.10.23 07:44:37 LOG5[61]: Connection reset: 1704 byte(s) sent to TLS, 2360 byte(s) sent to socket INTERNAL ERROR: Bad magic at OpenSSL, line 0 // or 2023.10.24 08:20:59 LOG5[52]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:43966 2023.10.24 08:56:13 LOG6[52]: Read socket closed (readsocket) ... 2023.10.24 09:00:01 LOG5[53]: Service [tls-nfs-srv] accepted connection from 1.2.3.4:59973 2023.10.24 09:00:01 LOG6[53]: Peer certificate not required 2023.10.24 09:00:01 LOG3[49]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.24 09:00:01 LOG5[49]: Connection reset: 7112 byte(s) sent to TLS, 9188 byte(s) sent to socket INTERNAL ERROR: Dead canary at OpenSSL, line 0 I have attached a file with more details. Although this looks like an OpenSSL problem at first glance, we think it still could be a problem with stunnel. Can you make more out of this data? Do you know a way to log more information about the connections? i.e. not all requests were accepted. What happened here? 2023.11.24 02:50:13 LOG7[359]: 354 server accept(s) requested 2023.11.24 02:50:13 LOG7[359]: 351 server accept(s) succeeded Thank you in advance. Best regards Sasha This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager.

1 0

Proxy an unencrypted Oracle client
by Randall Smith 15 Nov '23

15 Nov '23

I'm trying to determine if it is possible to connect an Oracle client that is not configured for encrypted connections to a TLS or mTLS connected Oracle Autonomous database using an stunnel client connection. First I tested a TLS capable client to verify connectivity. Next I set up stunnel to make the same TLS connection. I have configured stunnel as follows: foreground = yes debug = info [oracle] accept = 127.0.0.1:1521 connect = adb.us-ashburn-1.oraclecloud.com:1521 client = yes Next, I attempted a non-encrypted Oracle database connection to 127.0.0.1:1521, but got the following errors from stunnel: 2023.11.14 10:58:50 LOG6[0]: TLS connected: new session negotiated 2023.11.14 10:58:50 LOG6[0]: TLSv1.2 ciphersuite: AES256-GCM-SHA384 (256-bit encryption) 2023.11.14 10:58:50 LOG3[0]: SSL_read: ../ssl/record/ssl3_record.c:1065: error:14191044:SSL routines:tls1_enc:internal error 2023.11.14 10:58:50 LOG5[0]: Connection reset: 752 byte(s) sent to TLS, 8 byte(s) sent to socket ^C2023.11.14 10:58:57 LOG3[ui]: Received SIGINT; terminating Could this be a configuration issue in stunnel or might there be something in the Oracle database protocol itself that is different for TLS connections that would prevent tunneling?

1 0

Re: Silent installation is not working for Stunnel v5.71
by Josealf.rm 10 Nov '23

10 Nov '23

Hi Pavan, AFAIK, there is no option to customise the components when you do a silent install. You get all components. If someone knows better, let me know. Regards Jose > On 9/11/2023, at 1:09 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: > > Hi Jose, > > Gentle Reminder !! > > Can we get an update on this. > > Regards, > PavanReddy. > > -----Original Message----- > From: Pavan Reddy > Sent: Tuesday, November 7, 2023 10:17 AM > To: Josealf.rm <josealf(a)rocketmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: RE: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Jose, > > I have re-attached the snapshots for your reference. > > Regards, > PavanReddy. > > -----Original Message----- > From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Thursday, November 2, 2023 4:49 PM > To: Pavan Reddy <pavan.reddy(a)adaptiva.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Pavan, > > Sorry, I don’t see the snapshots/customizations you talk about. > > Regards > Jose > >> On 30/10/2023, at 7:19 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: >> >> Hi Team, >> >> Could you please provide an update on this. >> >> Regards, >> PavanReddy. >> >> -----Original Message----- >> From: Pavan Reddy >> Sent: Wednesday, October 25, 2023 3:08 PM >> To: Josealf.rm <josealf(a)rocketmail.com> >> Cc: stunnel-users(a)stunnel.org >> Subject: RE: [stunnel-users] Silent installation is not working for >> Stunnel v5.71 >> >> Hi Team, >> >> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. >> For more details you may refer https://adaptiva.com/products/autonomous-patch. We are willing to add Stunnel 5.71 product to our catalogue. >> >> Application is installing silently by using /S. >> >> While installing the application we found these customizations. And I am attaching the snapshots. >> >> Could you please have a look and help us to handle these customizations with silent properties. >> >> Regards, >> PavanReddy. >> >> -----Original Message----- >> From: Josealf.rm <josealf(a)rocketmail.com> >> Sent: Monday, October 23, 2023 4:50 PM >> To: Meta Email <meta(a)adaptiva.com> >> Cc: stunnel-users(a)stunnel.org >> Subject: Re: [stunnel-users] Silent installation is not working for >> Stunnel v5.71 >> >> [Some people who received this message don't often get email from >> josealf(a)rocketmail.com. Learn why this is important at >> https://aka.ms/LearnAboutSenderIdentification ] >> >> Stunnel uses an NSIS based installer. Try using /S instead of -quiet. >> >> -quiet is a switch for stunnel.exe, not for the installer and is used to configure stunnel as a service. >> >> >> Regards >> Jose >> >>>> On 23/10/2023, at 3:30 AM, Meta Adaptiva via stunnel-users <stunnel-users(a)stunnel.org> wrote: >>> >>> Hi Team, >>> >>> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. >>> https://ada/ >>> p%2F&data=05%7C01%7Cpavan.reddy%40adaptiva.com%7C1d6b0f9facd740f536d4 >>> 08dbdb959b24%7C1264bc823da147f88a41e4c19cdc7499%7C0%7C0%7C63834520784 >>> 7265891%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiL >>> CJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=hWcJe3nMjxuwIPz9M >>> ee9qKT5xCAi6ubmK3l%2FIu45e94%3D&reserved=0 >>> tiva.com%2Fproducts%2Fautonomous-patch&data=05%7C01%7Cpavan.reddy%40a >>> d >>> aptiva.com%7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e >>> 4 >>> c19cdc7499%7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWI >>> j >>> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7 >>> C >>> %7C%7C&sdata=Vp%2FDHnulu3OEo%2BBnEnt5EY4GQfThzGQ5SC75YK%2Bb3V0%3D&res >>> e >>> rved=0 >>> >>> We have downloaded the binary from below URL – >>> https://www/. >>> stunnel.org%2Fdownloads.html&data=05%7C01%7Cpavan.reddy%40adaptiva.co >>> m >>> %7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4c19cdc749 >>> 9 >>> %7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjA >>> w >>> MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sd >>> a >>> ta=kIsTmj%2Bx3fIiPWKL85BDKJ8yN2K%2FKk077dWHsb82Q9M%3D&reserved=0 >>> >>> We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. >>> Could you please help us to install the application silently. >>> _______________________________________________ >>> stunnel-users mailing list -- stunnel-users(a)stunnel.org To >>> unsubscribe send an email to stunnel-users-leave(a)stunnel.org >> >> Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email. > > Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email.

1 0

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

Re: Silent installation is not working for Stunnel v5.71
by Josealf.rm 02 Nov '23

02 Nov '23

Hi Pavan, Sorry, I don’t see the snapshots/customizations you talk about. Regards Jose > On 30/10/2023, at 7:19 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: > > Hi Team, > > Could you please provide an update on this. > > Regards, > PavanReddy. > > -----Original Message----- > From: Pavan Reddy > Sent: Wednesday, October 25, 2023 3:08 PM > To: Josealf.rm <josealf(a)rocketmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: RE: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Team, > > We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. > For more details you may refer https://adaptiva.com/products/autonomous-patch. We are willing to add Stunnel 5.71 product to our catalogue. > > Application is installing silently by using /S. > > While installing the application we found these customizations. And I am attaching the snapshots. > > Could you please have a look and help us to handle these customizations with silent properties. > > Regards, > PavanReddy. > > -----Original Message----- > From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Monday, October 23, 2023 4:50 PM > To: Meta Email <meta(a)adaptiva.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > [Some people who received this message don't often get email from josealf(a)rocketmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] > > Stunnel uses an NSIS based installer. Try using /S instead of -quiet. > > -quiet is a switch for stunnel.exe, not for the installer and is used to configure stunnel as a service. > > > Regards > Jose > >> On 23/10/2023, at 3:30 AM, Meta Adaptiva via stunnel-users <stunnel-users(a)stunnel.org> wrote: >> >> Hi Team, >> >> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. >> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fadap >> tiva.com%2Fproducts%2Fautonomous-patch&data=05%7C01%7Cpavan.reddy%40ad >> aptiva.com%7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4 >> c19cdc7499%7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIj >> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C >> %7C%7C&sdata=Vp%2FDHnulu3OEo%2BBnEnt5EY4GQfThzGQ5SC75YK%2Bb3V0%3D&rese >> rved=0 >> >> We have downloaded the binary from below URL – >> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww. >> stunnel.org%2Fdownloads.html&data=05%7C01%7Cpavan.reddy%40adaptiva.com >> %7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4c19cdc7499 >> %7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAw >> MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sda >> ta=kIsTmj%2Bx3fIiPWKL85BDKJ8yN2K%2FKk077dWHsb82Q9M%3D&reserved=0 >> >> We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. >> Could you please help us to install the application silently. >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe >> send an email to stunnel-users-leave(a)stunnel.org > > Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email.

1 0

two stunnels in the local network
by alessandro.deliperi＠ichnobyte.it 02 Nov '23

02 Nov '23

Hi everyone, this is my first question. I have successfully configured a stunnel (A) that does the job of it. I need to configure a second stunnel (B) that works in a more hidden network. When B connects to A, which connects to public mail server X I get a time out error. I bring you the logs, I think it is related to the fact that both stunnel servers are trying to establish a TLS session. Is there a way to solve? 2023.11.02 08:42:10 LOG7[0]: Option TCP_NODELAY set on local socket 2023.11.02 08:42:10 LOG5[0]: Service [smtp-tls] accepted connection from 192.168.0.109:46078 2023.11.02 08:42:10 LOG6[0]: s_connect: connecting 192.168.180.10:25 2023.11.02 08:42:10 LOG7[0]: s_connect: s_poll_wait 192.168.180.10:25: waiting 10 seconds 2023.11.02 08:42:10 LOG7[0]: FD=6 events=0x2001 revents=0x0 2023.11.02 08:42:10 LOG7[0]: FD=11 events=0x2005 revents=0x0 2023.11.02 08:42:10 LOG5[0]: s_connect: connected 192.168.180.10:25 2023.11.02 08:42:10 LOG5[0]: Service [smtp-tls] connected remote server from 192.168.0.23:41156 2023.11.02 08:42:10 LOG7[0]: Setting remote socket options (FD=11) 2023.11.02 08:42:10 LOG7[0]: Option TCP_NODELAY set on remote socket 2023.11.02 08:42:10 LOG7[0]: Remote descriptor (FD=11) initialized 2023.11.02 08:42:10 LOG7[0]: <- 220 mailservers 2023.11.02 08:42:10 LOG7[0]: -> 220 mailservers 2023.11.02 08:42:10 LOG7[0]: -> EHLO localhost 2023.11.02 08:42:11 LOG7[0]: <- 250-email-smtp.posta 2023.11.02 08:42:11 LOG7[0]: <- 250-8BITMIME 2023.11.02 08:42:11 LOG7[0]: <- 250-STARTTLS 2023.11.02 08:42:11 LOG7[0]: <- 250-AUTH PLAIN LOGIN 2023.11.02 08:42:11 LOG7[0]: <- 250 Ok 2023.11.02 08:42:11 LOG7[0]: -> STARTTLS 2023.11.02 08:42:11 LOG7[0]: <- 503 TLS not available due to temporary reason: TLS already active 2023.11.02 08:42:11 LOG3[0]: Remote server is not RFC 2487 compliant 2023.11.02 08:42:11 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

1 0

Suppressing warnings
by Ian Pilcher 31 Oct '23

31 Oct '23

I am using stunnel (along with an Apache reverse proxy) to enable my browser to connect to my old managed switches. An example configuration looks like this: debug = warning syslog = yes [switch1] client = yes accept = 127.0.0.1:8081 connect = 192.168.4.1:443 verifyChain = yes checkHost = switch1.example.com CAfile = /etc/pki/ca-trust/source/anchors/example-com-ca.crt sslVersion = TLSv1 ciphers = DHE-RSA-AES256-SHA options = ALLOW_UNSAFE_LEGACY_RENEGOTIATION securityLevel = 1 OCSPrequire = no Everything is working, but I'm seeing a lot of warnings in my system log: OCSP: No OCSP stapling response received transfer: s_poll_wait: TIMEOUTclose exceeded: closing Are there any settings that I can use to suppress these warnings? Thanks! -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

1 0

TLSV1.0
by Stefano Pelli 27 Oct '23

27 Oct '23

Dear all, as my first post, I am asking a confirmation: is TLS ver 1.0 still supported by stunnel (unfortunately, I need that deprecated version to access a server)? It all worked fine, then I upgraded to Kubuntu 22.04 and for some reason that broke the support of this protocol. I get the connection closed right after trying to open it. Before upgrading all was working without a hitch. Since then (1 year ago), I have been looking for solutions and trying all sorts of fixes by changing stunnel.conf, but with no success. Can you be so kind to give me some info about this and if possible a remedy until the server gets updated (not under my control)? Thank you in advance, Stefano

3 3

Re: TLSV1.0
by Stefano Pelli 26 Oct '23

26 Oct '23

At 04:26 AM 10/26/2023, Thomas Ward via stunnel-users wrote: >This is not an STunnel issue but an OpenSSL libraries/defaults issue. Thank you Thomas. After your input I made some more tests. Following advice founf in the net, I had already included: >[system_default_sect] >CipherString = DEFAULT@SECLEVEL=1 in openssl.cnf But still it would not work through stunnel. Today I tried a connection directly from openssl and I managed to succesfully initiate and conclude a proper POP3 dialog with the culprit server. Then, looking at the messages from openssl, I saw that the connection was established, as expected, by TLSV1 and AES256-SHA protocol. Therefore, I tried to force this in the relevant section of stunnel.conf: >ciphers = AES256-SHA But with the same result when trying to open the connection through stunnel (5.71) >telnet 127.0.1.1 110 >Trying 127.0.1.1... >Connected to 127.0.1.1. >Escape character is '^]'. >Connection closed by foreign host. With the other servers I can this way estblish a POP3 dialog, as I managed directly through openssl. What am I missing here? Thank you for any addition insights! Stefano

1 0

Silent installation is not working for Stunnel v5.71
by meta＠adaptiva.com 23 Oct '23

23 Oct '23

Hi Team, We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. https://adaptiva.com/products/autonomous-patch We have downloaded the binary from below URL – https://www.stunnel.org/downloads.html We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. Could you please help us to install the application silently.

2 1

Re: Silent installation is not working for, Stunnel v5.71
by Miroslav Geisselreiter 23 Oct '23

23 Oct '23

Hi, we use /S switch which works for us for a long time. Miroslav Geisselreiter > Message: 1 > Date: Mon, 23 Oct 2023 08:30:30 -0000 > From: meta(a)adaptiva.com > Subject: [stunnel-users] Silent installation is not working for > Stunnel v5.71 > To: stunnel-users(a)stunnel.org > Message-ID: <169804983049.1982.1603425052292506533(a)stunnel.org> > Content-Type: text/plain; charset="utf-8" > > Hi Team, > > We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. > https://adaptiva.com/products/autonomous-patch > > We have downloaded the binary from below URL – > https://www.stunnel.org/downloads.html > > We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. > Could you please help us to install the application silently. >

1 0

Re: How do I hide my browsing?
by Eberhard 21 Oct '23

21 Oct '23

Exactly! If people could get around the Forti products that easily they would not have the reputation they have! Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 From: Thomas Ward via stunnel-users <stunnel-users(a)stunnel.org> Sent: Friday, October 20, 2023 6:11 AM To: Jason Long <hack3rcon(a)yahoo.com>; Stewart Anderson via Stunnel-users <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Re: How do I hide my browsing? Stunnel is not a VPN, so no it can't "hide your browsing". Hiding your browsing needs more than just stunnel because of how DNS and other components for browsing work. Question 2 is beyond the scope of stunnel's list to answer. This said: If you have to ask how to hide your browsing that means you're violating your network's use policies, and with Fortinet and Fortigate in line it sounds like you're on a workplace network. Just don't use your workplace network for whatever shady stuff you're concerned about them finding you doing. Sent from my Galaxy -------- Original message -------- From: Jason Long via stunnel-users <stunnel-users(a)stunnel.org <mailto:[email protected]> > Date: 10/20/23 09:05 (GMT-05:00) To: Stewart Anderson via Stunnel-users <stunnel-users(a)stunnel.org <mailto:[email protected]> > Subject: [stunnel-users] How do I hide my browsing? Hello, In an internal network, they monitor web browsing through firewalls (Fortinet and FortiGate). I have two questions: 1- Can I use Stunnel to hide my browsing? 2- Can they capture usernames and passwords for email and other websites? Thank you.

3 4

How do I hide my browsing?
by Jason Long 20 Oct '23

20 Oct '23

Hello,In an internal network, they monitor web browsing through firewalls (Fortinet and FortiGate). I have two questions: 1- Can I use Stunnel to hide my browsing? 2- Can they capture usernames and passwords for email and other websites? Thank you.

3 2

stunnel cmvp number
by Seray Tokadli 09 Oct '23

09 Oct '23

Hi, for our company i need to find the cvmp number for stunnel however I am not able to find it. Is there anyone who can help me with that? https://csrc.nist.gov/projects/cryptographic-module-validation-program/vali… I could not find stunnel here. -- Seray TOKADLI KILIÇ +420778116052

2 1

Re: stunnel smtp tls frontend server/proxy for remote backend postfix
by James Thornton 09 Oct '23

09 Oct '23

The direction is mail sent from an external email address to stunnel (running on google cloud) for delivery to a postfix mailbox running on a local network. I posted this question on serverfault ( https://serverfault.com/questions/1145279/stunnel-smtp-tls-frontend-server-…) and someone said the problem may be either stunnel strips the ip and/or the the sender is trying to switch to TLS on postfix, not realizing the TLS connection has already been made by stunnel. On Sat, Oct 7, 2023 at 9:22 AM Stewart Anderson <stuson_2000(a)yahoo.co.uk> wrote: > Client and server will both negotiate SSL. Your server mode is presenting > a certificate. > > It's not clear from your config /text which direction your traffic is > going !! > > If it's incoming from Google to your postfix server then server mode is > correct. Stunnel will negotiate the SSL and then forward to postfix in > clear. If the handshake isn't happening, have you put Google's cert in > your CA certs somewhere? > > What confuses it for me is the Google internal IP reference. If you are > getting traffic from Google then stunnel would need to be accepting on the > host where stunnel is, so only a port is required in the accept. This can > be on a machine in your DMZ or behind a firewall, e.g. on or close to your > postfix server. > > Hope that helps. > > > > > Stewart > stuson_2000(a)yahoo.co.uk > > On 6 October 2023 05:51:14 "james(a)jamesthornton.com" < > james(a)jamesthornton.com> wrote: > > I'm running stunnel in server mode and listening on port 587 and trying to >> connect to a remote postfix server running on port 25. >> >> NB: the two servers are connected via zerortier, which may or may no be >> relevant to the issue. >> >> DEBUG = 7 >> >> [ssmtp] >> protocol = smtp >> accept = google_cloud_internal_ip:587 >> connect = remote_zerotier_postfix_ip:25 >> cert = /etc/stunnel/domain.pem >> >> I thought this would set up stunnel to handle the TLS handshake and >> terminate the TLS connection, while proxing to the backend postfix server >> without requiring postfix to worry about TLS. But I'm getting LOG3[0]: >> STARTTLS expected when stunnel tries to connect to postfix. If I put >> stunnel in client mode, then it doesn't negotiate the incoming TLS >> (right?). >> >> What am I missing? >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org >> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org >> > > -- James Thornton, *http://electricspeed.com <http://electricspeed.com>*

2 1

stunnel smtp tls frontend server/proxy for remote backend postfix
by james＠jamesthornton.com 06 Oct '23

06 Oct '23

I'm running stunnel in server mode and listening on port 587 and trying to connect to a remote postfix server running on port 25. NB: the two servers are connected via zerortier, which may or may no be relevant to the issue. DEBUG = 7 [ssmtp] protocol = smtp accept = google_cloud_internal_ip:587 connect = remote_zerotier_postfix_ip:25 cert = /etc/stunnel/domain.pem I thought this would set up stunnel to handle the TLS handshake and terminate the TLS connection, while proxing to the backend postfix server without requiring postfix to worry about TLS. But I'm getting LOG3[0]: STARTTLS expected when stunnel tries to connect to postfix. If I put stunnel in client mode, then it doesn't negotiate the incoming TLS (right?). What am I missing?

1 0

stunnel events
by noel_melvin＠neimanmarcus.com 02 Oct '23

02 Oct '23

Whats the difference between Connection closed: : 2505 byte(s) sent to TLS, 59 byte(s) sent to socket and Connection closed: : 0 byte(s) sent to TLS, 0 byte(s) sent to socket we can see these kind of variations in the stunnel logs. if its 0 bytes doest it mean that client didnt send any data/packet to stunnel server? Need help

1 1

Java jdk.disabled.NamedCurves
by Randy Curry 27 Sep '23

27 Sep '23

Hello, We are making a Rest API to an endpoint that uses stunnel for their proxy. We recently upgraded our integration engine and it's running Java AdoptOpenJDK 11.0.15. Since we've upgraded we can only successfully make one or two POST API calls then we get an error: Caused by: java.io.IOException: Error writing to server I did some research and found this version of Java has disabled named curves, part of it's Elliptic-curve cryptography. Is there any known issues with stunnel and the version of Java that's being used or the disabled named curves? Thank you, Randy Curry Senior Integration Services Architect [cid:[email protected]] [cid:[email protected]][email protected]<mailto:[email protected]> [cid:[email protected]] 919.588.1036 [cid:[email protected]] www.mihin.org<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.mihin.org&d=DwQGaQ&…> [cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_MiHIN&d=Dw…>[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.youtube.com_user_M…>[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…> Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by returning the e-mail and destroying all copies of the original message.

1 0