- stunnel-users - stunnel.org

stunnel 5.71 released
by Michał Trojnara 19 Sep '23

19 Sep '23

Dear Users, I have released version 5.71 of stunnel. ### Version 5.71, 2023.09.19, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.1.3. * Bugfixes - Fixed the console output of tstunnel.exe. * Features sponsored by SAE IT-systems - OCSP stapling is requested and verified in the client mode. - Using "verifyChain" automatically enables OCSP stapling in the client mode. - OCSP stapling is always available in the server mode. - An inconclusive OCSP verification breaks TLS negotiation. This can be disabled with "OCSPrequire = no". - Added the "TIMEOUTocsp" option to control the maximum time allowed for connecting an OCSP responder. * Features - Added support for Red Hat OpenSSL 3.x patches. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: f023aae837c2d32deb920831a5ee1081e11c78a5d57340f8e6f0829f031017f5 stunnel-5.71.tar.gz 945df5118473bcbf1ecdc5561fd6f26743c5dd1fd82e1a25199d0fd5c39a9373 stunnel-5.71-win64-installer.exe d511df533bb89464a324b2439e7e04b24b6ce26ecc0e03b67ada307725343d40 stunnel-5.71-android.zip Best regards, Mike

2 1

New machine
by stunnel＠paapnet.nl 16 Sep '23

16 Sep '23

Hello All, Who can help me? Just setup a new Ubuntu 22.04 (server) machine gcc version 11.4.0 (Ubuntu 11.4.0-1ubuntu1~22.04) grabbed stunnel (git) However running into issues (an old linux box runs well with compile) configure runs well: config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tests/Makefile config.status: creating tests/certs/Makefile config.status: creating src/config.h config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success Make bails out: root@dns:/Downloads/stunnel# make CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/bash '/Downloads/stunnel/auto/missing' aclocal-1.16 -I m4 cd . && /bin/bash /Downloads/stunnel/auto/missing automake-1.16 --foreign CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/bash '/Downloads/stunnel/auto/missing' autoconf configure.ac:53: warning: back quotes and double quotes must not be escaped in: Unknown thread model \"${withval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1553: AC_ARG_WITH is expanded from... configure.ac:53: the top level configure.ac:285: warning: back quotes and double quotes must not be escaped in: bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:285: the top level configure.ac:309: warning: back quotes and double quotes must not be escaped in: bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:309: the top level configure.ac:334: warning: back quotes and double quotes must not be escaped in: Bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:334: the top level configure.ac:369: warning: back quotes and double quotes must not be escaped in: Bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:369: the top level configure.ac:4: error: possibly undefined macro: AC_MSG_NOTICE If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. configure.ac:22: error: possibly undefined macro: AC_DEFINE make: *** [Makefile:409: configure] Error 1 aclocal (GNU automake) 1.16.5 autoconf (GNU Autoconf) 2.71 Is active What do I mis here ? Chrs....

1 0

Use of dante socks proxy with Stunnel
by vinesh＠techvinesh.com 15 Sep '23

15 Sep '23

I am deploying connection between on premise database with BI application on cloud. Currently the on premise database connecting via jdbc driver and it not supporting encryption. As per my understanding Stunnel opens port listening on http:127.0.0.1 ( as local) and forward traffic to destination over https using TLSv1.2. I have few question on this , to protect on network level, 1- can I use dante socks proxy along with Stunnel to provide 2 layer of protection? On-prem --- cloud ( 2 layer of protection) -- dante socks ( unencrypted tunnel) -- Stunnel ( e2e Encryption) 2- will it supporting CA other than openSsl

1 0

The stunnel process running on an AWS EC2 instance frequently enters a zombie state.
by sharukh.khan+stunnel＠seclore.com 12 Sep '23

12 Sep '23

We're facing an issue where the stunnel process running on our AWS Ec2 enters a zombie state. This results in the nfs server timeout (We're using EFS). We're running Amazon Linux 2 (Kernel version 4.14.318-241.531) with stunnel version 5.6.4. The configuration for stunnel is stated below: ; Sample stunnel configuration file for Win64 by Michal Trojnara 2002-2022 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) ;debug = info ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later ;securityLevel = 0 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini

2 4

stunnel events
by noel_melvin＠neimanmarcus.com 11 Sep '23

11 Sep '23

We have stunnel running on Windows machine. Just would like to know whether the below events is anything abnormal/critical to be addressed. 2023.09.07 10:10:16 LOG5[7]: Service [Application1] accepted connection from x.x.x.x:1234 2023.09.07 10:10:16 LOG6[7]: Peer certificate not required 2023.09.07 10:10:16 LOG6[7]: No peer certificate received 2023.09.07 10:10:16 LOG6[7]: Session id: (Alphanumeric) 2023.09.07 10:10:16 LOG6[7]: TLS accepted: new session negotiated 2023.09.07 10:10:16 LOG6[7]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-SHA256 (128-bit encryption) 2023.09.07 10:10:16 LOG6[7]: s_connect: connecting x.x.x.x:1234 2023.09.07 10:10:16 LOG5[7]: s_connect: connected x.x.x.x:1234 2023.09.07 10:10:16 LOG6[7]: persistence: x.x.x.x:1234 cached

1 1

Stunnel hangs with static build with openssl 1.1.1c
by eklein＠triple-eye.nl 07 Sep '23

07 Sep '23

I successfully cross compiled and built a static version of stunnel for ARM. It works with stunnel 5.70 and openssl 1.1.1b If however, I try to use openssl 1.1.1c, stunnel hangs. I narrowed the problem down to the following call in compression_init in ssl.c: comp_methods[COMP_NONE]=sk_SSL_COMP_new_null(); The program does not get past this point. I also tried to build with openssl 1.1.1v and 3.0.0, to no avail. I am using the following commands: To build openssl: ./Configure linux-armv4 --prefix=/home/erik/Documents/openssl-1.1.1b/install --openssldir=/home/erik/Documents/openssl-1.1.1b/install threads shared make CC=arm-linux-gnueabi-gcc make install To build stunnel: sed -i 's/^stunnel_LDFLAGS = /&-all-static /' src/Makefile.in export CFLAGS='-Os -fomit-frame-pointer -pipe' ./configure --with-ssl=/home/erik/Documents/openssl-1.1.1b/install --disable-fips --disable-shared --enable-static --disable-silent-rules --build x86_64-pc-linux-gnu --host arm-linux-gnueabi make What is the difference between openssl1.1.1b and 1.1.1c which causes this problem?

1 1

Failover configuration using a proxy
by Daphne Shaw 06 Sep '23

06 Sep '23

Hello! I have a configuration question around failover with stunnel as a https client (that is, "client=yes"). The end goal here is a "Try to connect to host A, if that fails, connect to host B, etc." type of setup. I can do that with multiple connect= options, one per host, and it works as expected: connect=x.x.x.x connect=y.y.y.y connect=z.z.z.z The question I have is around doing the same thing with a proxy. In a proxy configuration, connect= specifies the proxy (https in my case, so "protocol=connect"), and protocolHost= specifies the host that I want to connect to via that proxy. Unfortunately, it seems that protocolHost only allows a single host and cannot be used multiple times, so I can't specify the hosts to failover to. connect=my.proxy.ip protocol=connect protocolhost=x.x.x.x protocolhost=y.y.y.y protocolhost=z.z.z.z That always attempts to connect to z.z.z.z (the last specified host) via the proxy. I am using stunnel 4.56 (stock stunnel from Centos 7), but happy to upgrade if a newer version makes this possible (the manual suggests the latest version works the same way). Any suggestions? I'm sure I could accomplish this by wrapping stunnel in a script that generates a new config file for each failover, but well, I'm hoping to not have to do that. Thanks, Daphne

2 2

Connection abend between Stunnel and multiple clients
by arunprasanna_dhayalavel＠neimanmarcus.com 06 Sep '23

06 Sep '23

Hello All!! We are experiencing multiple transactions initiated from the different clients towards the Stunnel getting reset. We are trying to identify if the below events relate to the issue. If yes, kindly suggest how we can rectify the below. 2023.09.05 09:10:43 LOG6[210]: transfer: s_poll_wait: TIMEOUTidle exceeded: sending reset 2023.09.05 09:10:43 LOG5[210]: Connection reset: 2505 byte(s) sent to TLS, 59 byte(s) sent to socket

1 0

error:0A000126 on windows 10
by Stewart Anderson 02 Sep '23

02 Sep '23

Hi, First apologies I posted this question on a google stunnel group, but I realise that does not have much activity, so posting here also. I am trying to get stunnel up and running and getting the error in the subject. The full error text is: "SSL_accept: ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number" I have a simple service which seems to load fine. I have stunnel up at the "server side" on a VM in azure and if I telnet to the VM public address I can see the activity in the stunnel logs on the VM, so I know at least a pipe is open. I can hit the port server side and see the log activity in stunnel also. If I try a telnet to the local stunnel accept port. I see the error above. This is the full log. 2023.08.23 11:01:04 LOG7[service]: Found 1 ready file descriptor(s) 2023.08.23 11:01:04 LOG7[service]: FD=604 ifds=r-x ofds=--- 2023.08.23 11:01:04 LOG7[service]: FD=664 ifds=r-x ofds=r-- 2023.08.23 11:01:04 LOG7[service]: Service [dev-dev-testHarness] accepted (FD=708) from 127.0.0.1:10756 2023.08.23 11:01:04 LOG7[service]: Creating a new thread 2023.08.23 11:01:04 LOG7[service]: New thread created 2023.08.23 11:01:04 LOG7[4]: Service [dev-dev-testHarness] started 2023.08.23 11:01:04 LOG7[4]: Setting local socket options (FD=708) 2023.08.23 11:01:04 LOG7[4]: Option TCP_NODELAY set on local socket 2023.08.23 11:01:04 LOG5[4]: Service [dev-dev-testHarness] accepted connection from 127.0.0.1:10756 2023.08.23 11:01:04 LOG6[4]: Peer certificate not required 2023.08.23 11:01:04 LOG7[4]: TLS state (accept): before SSL initialization 2023.08.23 11:01:04 LOG7[4]: TLS alert (write): fatal: decode error 2023.08.23 11:01:04 LOG3[4]: SSL_accept: ssl/record/rec_layer_s3.c:303: error:0A000126:SSL routines::unexpected eof while reading 2023.08.23 11:01:04 LOG5[4]: Connection reset/closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.08.23 11:01:04 LOG7[4]: Local descriptor (FD=708) closed 2023.08.23 11:01:04 LOG7[4]: Service [dev-dev-testHarness] finished (0 left) What am I missing, I haven't used stunnel for quite a while and previous effort were on linux and I did not see this problem then. Using telnet/TNC as the local test tools and stunnel was installed with bare default installation. The only thing I have done different is to set a config fragment folder to separate services on the sever side and they report as loading fine. any help greatly appreciated. Stu

1 1

Re: Need help setting up new stunnel config
by Mark Foley 01 Sep '23

01 Sep '23

I think I'm confused here. My objective is for requests sent to port 3389 on the Windows 10 machine to be "validated" by stunnel, then passed on to the service listening on that port. Am I mistaken about what stunnel is supposed to do? If not, what would my config look like to accomplish this? I don't see how changing the RDC port would help. Regardless of what port RDC listens on, it's still going to be used by RDC and therefore I don't see why the 'accept' wouldn't continue to fail. Sorry to be so obtuse on this. I just don't get it and haven't found any examples for stunneling to RDC. --Mark -----Original Message----- From: Michael Curran <mike_curran(a)hotmail.com> To: Mark Foley <mfoley(a)novatec-inc.com>, "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Re: Need help setting up new stunnel config Date: Fri, 1 Sep 2023 17:39:25 +0000 Mark -- Your full stanza should look like this [dbserver] accept = <some port> connect = 3389 CAfile = stunnel.pem The IP:PORT was a suggestion for the RDC connection string. If you cannot start RDC with an IP:PORT, then you can change the internal RDC port from 3389 to something else. I have not done this, you will have to review Microsofts site to find out how. If RDC can be changed , but not the RDC connection string then your stanza might look like [dbserver] accept = 3389 connect = <new rdc port> CAfile = stunnel.pem Mike ________________________________ From: Mark Foley <mfoley(a)novatec-inc.com> Sent: Friday, September 1, 2023 1:28 PM To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Re: Need help setting up new stunnel config Michael - thanks for your response. I did not see the "ip:port" syntax you suggested in the stunnel doc, so I just use 'port'. Below is the config I tried: [DBSERVER] connect = 3389 CAfile = stunnel.pem When running I got the following errors: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.70 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.9 30 May 2023 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [DBSERVER] [!] Service [DBSERVER]: TLS server needs a certificate [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [DBSERVER] Notice "TLS server needs a certificate". The installation dialog steps me through creating a certificate which it puts in stunnel.pem. So why this message? I also tried the full pathname to stunnel.pem. --Mark -----Original Message----- From: Michael Curran <michael.curran(a)cosocloud.com> To: Mark Foley <mfoley(a)novatec-inc.com>, "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Need help setting up new stunnel config Date: Fri, 1 Sep 2023 13:12:30 +0000 accept is the port you want them to connect on remotely – which would have to be other than 3389 since it is open already connect would be 3389 I think in the connection string for RDC you can just specify ip:port to connect If you cannot , you can also redesignate the port remote desktop answers on -- Michael Curran Systems Architect| CoSo Cloud D 614.568.2285 | C 614.403.6320 | michael.curran(a)cosocloud.com From: Mark Foley <mfoley(a)novatec-inc.com> Date: Thursday, August 31, 2023 at 11:33 AM To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Need help setting up new stunnel config I used stunnel about 5 years ago and now I want to use it again, but my notes are terrible and I'm having trouble getting started. I want to create a connection between Windows computer on port 3389. The "client" will be some remote Windows computer, perhaps at someone's home office. The "server" will be a Windows workstation at the office. I've installed stunnel 5.70 on a Windows 10 workstation at the office, hostname COMMONW10. I'm at a loss creating the config file on this machine. I have: [COMMONW10] ;client = yes accept = 3389 ;connect = ???:xxxx CAfile = stunnel.pem The stunnel.pem was create when I installed stunnel. I have no idea what the 'connect' line should have. When I run stunnel (clicking on desktop icon) I get: [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [COMMONW10] [ ] Listening file descriptor created (FD=724) [ ] Setting accept socket options (FD=724) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [COMMONW10] to 127.0.0.1:3389: Permission denied (WSAEACCES) (10013) [!] Binding service [COMMONW10] failed [ ] Unbinding service [COMMONW10] [ ] Service [COMMONW10] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [COMMONW10] [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 Server is down I'm assuming the "Permission denied" is because Remote Desktop is already listening on 3389. So, I'm stuck and feeling quite ignorant! Help appreciated. --Mark _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org This is an external email and may have suspicious content. Please take care when clicking links or opening attachments. When in doubt, contact your IT Department. _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org

2 1

Re: Need help setting up new stunnel config
by Mark Foley 01 Sep '23

01 Sep '23

Michael - thanks for your response. I did not see the "ip:port" syntax you suggested in the stunnel doc, so I just use 'port'. Below is the config I tried: [DBSERVER] connect = 3389 CAfile = stunnel.pem When running I got the following errors: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.70 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.9 30 May 2023 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [DBSERVER] [!] Service [DBSERVER]: TLS server needs a certificate [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [DBSERVER] Notice "TLS server needs a certificate". The installation dialog steps me through creating a certificate which it puts in stunnel.pem. So why this message? I also tried the full pathname to stunnel.pem. --Mark -----Original Message----- From: Michael Curran <michael.curran(a)cosocloud.com> To: Mark Foley <mfoley(a)novatec-inc.com>, "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Need help setting up new stunnel config Date: Fri, 1 Sep 2023 13:12:30 +0000 accept is the port you want them to connect on remotely – which would have to be other than 3389 since it is open already connect would be 3389 I think in the connection string for RDC you can just specify ip:port to connect If you cannot , you can also redesignate the port remote desktop answers on -- Michael Curran Systems Architect| CoSo Cloud D 614.568.2285 | C 614.403.6320 | michael.curran(a)cosocloud.com From: Mark Foley <mfoley(a)novatec-inc.com> Date: Thursday, August 31, 2023 at 11:33 AM To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Need help setting up new stunnel config I used stunnel about 5 years ago and now I want to use it again, but my notes are terrible and I'm having trouble getting started. I want to create a connection between Windows computer on port 3389. The "client" will be some remote Windows computer, perhaps at someone's home office. The "server" will be a Windows workstation at the office. I've installed stunnel 5.70 on a Windows 10 workstation at the office, hostname COMMONW10. I'm at a loss creating the config file on this machine. I have: [COMMONW10] ;client = yes accept = 3389 ;connect = ???:xxxx CAfile = stunnel.pem The stunnel.pem was create when I installed stunnel. I have no idea what the 'connect' line should have. When I run stunnel (clicking on desktop icon) I get: [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [COMMONW10] [ ] Listening file descriptor created (FD=724) [ ] Setting accept socket options (FD=724) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [COMMONW10] to 127.0.0.1:3389: Permission denied (WSAEACCES) (10013) [!] Binding service [COMMONW10] failed [ ] Unbinding service [COMMONW10] [ ] Service [COMMONW10] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [COMMONW10] [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 Server is down I'm assuming the "Permission denied" is because Remote Desktop is already listening on 3389. So, I'm stuck and feeling quite ignorant! Help appreciated. --Mark _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org This is an external email and may have suspicious content. Please take care when clicking links or opening attachments. When in doubt, contact your IT Department.

1 0

Problem TLS connection Outlook 365
by adebelew＠gmail.com 01 Sep '23

01 Sep '23

Hi, I'm trying to connect to Outlook 365 with this setup [office365] client = yes accept = 127.0.0.1:993 connect = outlook.office365.com:993 unfortunately, when from my penthao software, I try to connect with email and password stunnel responds like this: 2023.09.01 09:57:33 LOG5[2]: Service [office365] accepted connection from 127.0.0.1:63027 2023.09.01 09:57:33 LOG5[2]: s_connect: connected 52.98.206.242:993 2023.09.01 09:57:33 LOG5[2]: Service [office365] connected remote server from 192.168.1.228:63028 2023.09.01 09:57:33 LOG5[2]: Connection closed: 258 byte(s) sent to TLS, 160 byte(s) sent to socket could you help me? is it necessary to configure the certificates? How should it be done? Thank you!

1 0

Need help setting up new stunnel config
by Mark Foley 31 Aug '23

31 Aug '23

I used stunnel about 5 years ago and now I want to use it again, but my notes are terrible and I'm having trouble getting started. I want to create a connection between Windows computer on port 3389. The "client" will be some remote Windows computer, perhaps at someone's home office. The "server" will be a Windows workstation at the office. I've installed stunnel 5.70 on a Windows 10 workstation at the office, hostname COMMONW10. I'm at a loss creating the config file on this machine. I have: [COMMONW10] ;client = yes accept = 3389 ;connect = ???:xxxx CAfile = stunnel.pem The stunnel.pem was create when I installed stunnel. I have no idea what the 'connect' line should have. When I run stunnel (clicking on desktop icon) I get: [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [COMMONW10] [ ] Listening file descriptor created (FD=724) [ ] Setting accept socket options (FD=724) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [COMMONW10] to 127.0.0.1:3389: Permission denied (WSAEACCES) (10013) [!] Binding service [COMMONW10] failed [ ] Unbinding service [COMMONW10] [ ] Service [COMMONW10] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [COMMONW10] [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 Server is down I'm assuming the "Permission denied" is because Remote Desktop is already listening on 3389. So, I'm stuck and feeling quite ignorant! Help appreciated. --Mark

1 0

Fail to build stunnel 5.70 for windows using xmingw64
by roierachamim＠gmail.com 30 Aug '23

30 Aug '23

Hi, Trying to build stunnel the following warning showed up: network.c: In function 's_read': network.c:737:44: warning: unknown conversion type character 'l' in format [-Wformat=] s_log(LOG_ERR, "s_read: Received %llu out of requested %llu byte(s)", ^ network.c:737:66: warning: unknown conversion type character 'l' in format [-Wformat=] s_log(LOG_ERR, "s_read: Received %llu out of requested %llu byte(s)", ^ network.c:737:24: warning: too many arguments for format [-Wformat-extra-args] s_log(LOG_ERR, "s_read: Received %llu out of requested %llu byte(s)", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ And one more of the same kind. I wonder how it didn't happen in the official binaries. Are they being built using the instructions in INSTALL.W32 ? Using xmingw-64 ? Roie

2 1

Config stunnel for outgoing mails to Ionos
by a.franken＠management-kommunikation.de 22 Aug '23

22 Aug '23

In these days, our provider Ionos/1&1 starts to accept only encrypted access to its mail server and at least TLS 1.2. There are no problems with incoming mails. In order to be on the safe side with our Win SBS Server 2008 (no comments please!) with outgoing mails, I now have interposed stunnel as recommended many times on the web. This works in principle. Unfortunate exception: In some cases - expecially if the mail recipient has a Microsoft address like @hotmail.de, @live.de, @outlook.com -, sending aborts with error 503 5.5.2 ("Need mail command"). Unfortunately, I'm quite innocent with SMTP, SSL and certificates, but worked hard to create the following stunnel configuration file: socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 client = yes output = C:\Program Files (x86)\stunnel\stunnel.log [smtpionos] accept = localhost:465 connect = smtp.ionos.de:465 verifyChain = yes verifyPeer = yes CAfile = C:\Program Files (x86)\stunnel\config\amakor2022.pem checkHost = remote.management-kommunikation.de protocolHost = smtp.ionos.de protocolAuthentication = login protocolUsername = OUR_USERNAME protocolPassword = OUR_PASSWORD sslVersionMin = TLSv1.2 sslVersionMax = TLSv1.2 delay = yes protocol = smtp amakor2022.pem is the "PositiveSSL" certificate that we acquired for our subdomain remote.management-kommunikation.de. "Our_Username" and "Our_Password" are of course our correct access data. After spending hours searching the web for a solution, does anyone have a tip what's wrong and what to do?

1 2

error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40
by kgpunix＠gmail.com 16 Aug '23

16 Aug '23

error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40

1 0

Passing client IP via stunned to HAProxy
by Ashok Kumar Agrawal 07 Aug '23

07 Aug '23

Hi, Our setup has stunnel and HAproxy running on same server. Our clients (postgresql clients) connect to port where stunnel is listening. Clients are sending encrypted data (setting sslmode=require in pgsql connection options). Stunnel listens to encrypted traffic and writes unencrypted traffic to another port on same host where HAproxy is listening. Then, HAProxy passes this request to one of many postgresql servers. These servers are custom written to implement postgresql protocol. We want IP of the postgresql clients to be captured at the server. HAProxy documentation says that proxy protocol is only way to pass original client IP for non-http traffic. Can you please suggest how we can configure Stunnel to listen to encrypted postgresql client traffic (pgsql protocol) and write unencrypted data to HAProxy instance in proxy protocol. Following are our current configurations for stunnel and HAProxy: Stunnel: foreground = yes debug = 5 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = l:TCP_KEEPIDLE=120 socket = l:TCP_KEEPINTVL=30 socket = l:TCP_KEEPCNT=3 ciphers = HIGH:MEDIUM [postgres-serverB] protocol = pgsql accept = 0.0.0.0:3255 connect = localhost:5433 retry = yes cert = /etc/stunnel/stunnel.crt delay = no sslVersion = TLSv1.2 HAProxy: listen pgsql mode tcp option tcplog bind *:5433 balance leastconn timeout server 1d timeout client 1d option tcp-check option clitcpka server qspgsqlsvr1 host.docker.internal:5432 check Thanks, Ashok

1 0

Oqsprovider support with Openssl 3,x
by mukesh.kochu＠yahoo.com 01 Aug '23

01 Aug '23

hello Team, Anybody knows how to plugin the provider included in the openssl 3.x , to be supported with stunnel , by doing any configuration change or so . To give you guys a background , I compiled a openssl 3.x version and and then compiled liboqs , and build the ops provider support in the openssl 3.x .following the below link. https://github.com/open-quantum-safe/oqs-provider I was under the impression tunnel might support all algorithm which is supported in the openssl version which is used to build the stunnel So I rebuild the same using the pqc supported openssl , but unfortunately not sure how to consume the provider there and or what to be tweaked in he tunnel source code that multiple providers or algorithms will be supported or not . or is it not possible to achieve this without doing a massive source code change ? Appreciate any help on this Regards Mukesh

1 0

can not send
by wizardm＠gmx.de 21 Jul '23

21 Jul '23

hello, I have accounts with gmx, aol and 1&1 (ionos). with gmx and aol I can receive and send. but with 1&1 I can only receive. the stunnel log says "SSL_connect: ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number". in the log of the mail program there is an "error - Unexpected connection termination. Connection lost." what can I do? here is my configuration. [gmx-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmx.net:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmx.net OCSPaia = yes [gmx-smtp] client = yes accept = 127.0.0.1:25 connect = mail.gmx.net:465 verifyChain = yes CAfile = ca-certs.pem checkHost = mail.gmx.net OCSPaia = yes [aol-pop3] client = yes accept = 127.0.0.1:10110 ; protocol = pop3 connect = pop.aol.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.aol.com OCSPaia = yes [aol-smtp] client = yes accept = 127.0.0.1:10025 ; protocol = smtp connect = smtp.aol.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.aol.com OCSPaia = yes [1und1-pop3] client = yes accept = 127.0.0.1:1110 connect = pop.ionos.de:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.ionos.de OCSPaia = yes [1und1-smtp] client = yes accept = 127.0.0.1:1111 connect = smtp.ionos.de:587 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.ionos.de OCSPaia = yes thank you very much

1 0

“latest” alias
by David Richard (CajunD) 16 Jul '23

16 Jul '23

Hi Folks, I have found some older discussions about keeping archives and such, but wanted to ask if you could create an alias that always pointed to the latest version. We were hard-linking to a version in /downloads/ and when version 5.69 was removed a few days ago, some automation on our end broke and (as a result of circumstance) caused an outage while we were trying to fix another problem with a remote dependency. We have altered our script to point to the archive version and added checking to ensure any future problems are handled properly. That being said, we will always want the latest version of your software when we build our machine images. And while you do send an announcement, we have to take additional action on our end to get that new version. A “latest” link would allow us to get the latest version automatically when we perform security updates. Thanks for considering this request. David. --- David Richard cajund(a)gmail.com

4 3

securityLevel doesn't work with OpenSSL 3.0
by Yasuhiro Kimura 14 Jul '23

14 Jul '23

Hello, I'd like to use stunnel to acccess SMTP server that has following configuration parameters. Host: smtp.example.org Port number: smtps (465) Encryption method: SMTP over TLS At first I created following configuration file and run stunnel 5.70 with it on FreeBSD 13.2-RELEASE. ---------------------------------------------------------------------- CApath=/home/yasu/.certs client=yes foreground=yes syslog=no verify=2 [12345] accept=localhost:12345 checkHost=smtp.examle.org connect=smtp.examle.org:465 ---------------------------------------------------------------------- But unfortunately stunnel emits following messages and local-side connection.is closed when I connect to 12345 port of localhost. ---------------------------------------------------------------------- 2023.07.14 12:29:12 LOG5[0]: Service [12345] accepted connection from ::1:14632 2023.07.14 12:29:12 LOG5[0]: s_connect: connected 10.0.0.1:465 2023.07.14 12:29:12 LOG5[0]: Service [12345] connected remote server from 192.168.0.1:14633 2023.07.14 12:29:12 LOG5[0]: Certificate accepted at depth=0: C=JP, ST=Tokyo, L=Ohta-Ku, O=EXAMLE.INC, CN=smtp.examle.org 2023.07.14 12:29:12 LOG3[0]: SSL_connect: /usr/src/crypto/openssl/ssl/t1_lib.c:1146: error:1414D172:SSL routines:tls12_check_peer_sigalg:wrong signature type 2023.07.14 12:29:12 LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket ---------------------------------------------------------------------- So I added setting of securityLevel as following. ---------------------------------------------------------------------- CApath=/home/yasu/.certs client=yes foreground=yes securityLevel=1 syslog=no verify=2 [12345] accept=localhost:12345 checkHost=smtp.examle.org connect=smtp.examle.org:465 ---------------------------------------------------------------------- And now I can successfully access to STMP server through stunnel. Next, I also tried it on FreeBSD 14-CURRENT and surprisingly stunnel 5.70 emits following messages even if 'securityLevel=1' is specified in configuration file. ---------------------------------------------------------------------- 2023.07.14 12:31:12 LOG5[0]: Service [12345] accepted connection from ::1:10838 2023.07.14 12:31:12 LOG5[0]: s_connect: connected 10.0.0.1:465 2023.07.14 12:31:12 LOG5[0]: Service [12345] connected remote server from 192.168.0.11:41449 2023.07.14 12:31:12 LOG3[0]: SSL_connect: /usr/src/crypto/openssl/ssl/statem/extensions.c:894: error:0A000152:SSL routines::unsafe legacy renegotiation disabled 2023.07.14 12:31:12 LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket ---------------------------------------------------------------------- So I also tried on 2 other platforms. a. Cygwin's stunnel.exe (version 5.69) b. tstunnel.exe installed by useing stunnel-5.69-win64-installer.exe And result is that the former works fine and the latter emits same message as FreeBSD 14-CURRENT. According to these result it seems the failure is related to the version of OpenSSL. That is, while FreeBSD 13.2-RELEASE and Cygwin use OpenSSL 1.1.1, FreeBSD 14-CURRENT and stunnel-5.69-win64-installer.exe use OpenSSL 3.0. So does this mean securityLevel option doesn't work with OpenSSL 3.0? Regards. --- Yasuhiro Kimura

2 1

Stunnel is not accepting TLS1.1 anymore?
by Bohnig＠gmx.de 13 Jul '23

13 Jul '23

Hi there, i have a problem (maybe with understanding) with stunnel. I'm using the newest version 5.70 but had this also with 5.66 and 5.69. My goal was to access an Exchange server IIS (on port 443, which understands only TLS1.1 and below) with TLS1.2 and upper. I was able to achieve this with the following config --------------------------- debug = 7 output = stunnel.log [Exserver] accept = 441 connect = 442 cert = stunneldd.pem TIMEOUTclose = 0 [Exclient] client = yes accept = 442 connect = 443 --------------------------- stunneldd.pem i made with openssl req -new -x509 -days 365 -nodes -config openssl.cnf -out stunneldd.pem -keyout stunneldd.pem This is working so far. My problem is, stunnel is no longer accepting TLS1.0 and TLS1.1. I need this for some clients which couldn't talk TLS1.2. But why? All infos i could find (and this was days, not hours) are showing that it should work. Even with the added line sllVerison = all or sslVersionMin = TLSv1 sslVersionMax = TLSv1.3 it ws not accepting TLS1 queries. My steps to confirm this: ------------------------- - install stunnel 5.70 - take the config shown above - make a cert with openssl req -new -x509 -days 365 -nodes -config openssl.cnf -out stunneldd.pem -keyout stunneldd.pem - start stunnel - test it with openssl s_client -connect localhost:441 -tls1_1 -debug stunnel log: ------------ 2023.07.13 09:53:04 LOG7[25]: TLS alert (write): fatal: internal error 2023.07.13 09:53:04 LOG3[25]: SSL_accept: ssl/t1_lib.c:3342: error:0A000076:SSL routines::no suitable signature algorithm I'm thinking, that the bind OpenSSL doesn't support TLS1.1 anymore but the [Exclient] which is talking to Port 443 uses TLS1.1. Or has the cert anything to do with it. I think no, because the andshake failed and that is befor the cert is used? What I'm missing? I want stunnel to accept TLs1.0, TLS1.1. TLS1.2 and upwards on the same port. Would be nice if anybody could help me with this? Many thanks.

1 0

Default destination folder of stunnel-*-win64-installer.exe
by Yasuhiro Kimura 13 Jul '23

13 Jul '23

Hello, If you install stunnel on Windows with stunnel-*-win64-installer.exe, it installs everything under "C:\Program Files (x86)\stunnel" by default. But since it installs 64bit binaries, should default destination folder be "C:\Program Files\stunnel"? Regards.

1 0

`tstunnel -(help|options|version)` outputs garbase with 5.70
by Yasuhiro Kimura 13 Jul '23

13 Jul '23

Hello, With tstunnel.exe installed with stunnel-5.70-win64-installer.exe, `tstunnel -help', `tstunnel -options` and `tstunnel -version` output gabases. The issue doesn't happen with either stunnel 5.70 on Unix or tstunnel.exe installed with stunnel-5.69-win64-installer.exe. Regards. --- Yasuhiro Kimura

1 0

stunnel 5.70 released
by Michal Trojnara 12 Jul '23

12 Jul '23

Dear Users, I have released version 5.70 of stunnel. ### Version 5.70, 2023.07.12, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.9. - OpenSSL FIPS Provider updated to version 3.0.8. * Bugfixes - Fixed TLS socket EOF handling with OpenSSL 3.x. This bug caused major interoperability issues between stunnel built with OpenSSL 3.x and Microsoft's Schannel Security Support Provider (SSP). - Fixed reading certificate chains from PKCS#12 files. * Features - Added configurable delay for the "retry" option. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 7bbc7b9e9a988d76301325db4c110ec360a98ffb8a221c7accbff9c0a8bae2f3 stunnel-5.70.tar.gz c50fb79329ddbf095e65ba8817a0249188aa5b25f15557f8504d8f65876034d9 stunnel-5.70-win64-installer.exe df87f71596ddd8730a5394fd3795b32689664816c0aa87e206e94fdab540f672 stunnel-5.70-android.zip Best regards, Mike

1 0

Cannot open PSKsecrets file
by trashrap22＠gmail.com 11 Jul '23

11 Jul '23

Hi, I am setting up stunnel on my Windows 10 PC, but must be missing something small with the error I am getting: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.69 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.8 7 Feb 2023 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [Sql_Secure_Trek-<port>] [!] Cannot open PSKsecrets file [!] C:\Program Files (x86)\stunnel\config\stunnel.conf:68: "PSKsecrets = "C:\Program Files (x86)\stunnel\config\pskSql.txt"": Failed to read PSK secrets [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [Sql_Secure_Trek-<port>] Server is down Here is my .conf file: ;Global settings: debug = 7 output = stunnel.log sslVersion = all sslVersionMin = TLSv1.2 sslVersionMax = TLSv1.2 [Sql_Secure_Trek-<port>] client = yes accept = 0.0.0.0:<port> connect = <IP>:<port> ciphers = PSK PSKsecrets = "C:\Program Files (x86)\stunnel\config\pskSql.txt" Any ideas?

1 1

stunnel 5.57 crashed while trying to write logs
by phananh.nguyen＠dxc.com 06 Jul '23

06 Jul '23

it crashed at the function log_raw. here is the backtrace == Backtrace #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49 #1 0x0000007f82ed54b4 in __GI_abort () at abort.c:79 #2 0x0000007f82f1f984 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f82fdc660 "%s\n") at ../sysdeps/posix/libc_fatal.c:155 #3 0x0000007f82f273dc in malloc_printerr (str=str@entry=0x7f82fd7bc8 "corrupted double-linked list") at malloc.c:5389 #4 0x0000007f82f27cc8 in unlink_chunk (p=p@entry=0x7f64012260, av=0x7f64000020) at malloc.c:1472 #5 0x0000007f82f27e48 in malloc_consolidate (av=av@entry=0x7f64000020) at malloc.c:4539 #6 0x0000007f82f29df0 in _int_malloc (av=av@entry=0x7f64000020, bytes=bytes@entry=8192) at malloc.c:3727 #7 0x0000007f82f2c5b0 in __libc_calloc (n=<optimized out>, elem_size=<optimized out>) at malloc.c:3448 #8 0x0000007f82f1e41c in __GI___open_memstream (bufloc=bufloc@entry=0x7f72ffc3f8, sizeloc=sizeloc@entry=0x7f72ffc400) at memstream.c:83 #9 0x0000007f82f7d274 in __vsyslog_internal (pri=31, pri@entry=7, fmt=fmt@entry=0x5584b5f930 "%s: %s", ap=..., mode_flags=mode_flags@entry=2) at ../misc/syslog.c:181 #10 0x0000007f82f7d810 in __syslog_chk (pri=pri@entry=7, flag=flag@entry=1, fmt=fmt@entry=0x5584b5f930 "%s: %s") at ../misc/syslog.c:136 #11 0x0000005584b45884 in syslog (__fmt=0x5584b5f930 "%s: %s", __pri=7) at /usr/include/bits/syslog.h:31 #12 log_raw (level=level@entry=7, stamp=stamp@entry=0x7f64003420 "2023.06.16 01:36:58", id=id@entry=0x7f64001120 "LOG7[19]", text=text@entry=0x7f6401b060 "Service [proxy-r] started", opt=<optimized out>, opt=<optimized out>) at ../../stunnel-5.57/src/log.c:263 #13 0x0000005584b45b88 in s_log (level=level@entry=7, format=format@entry=0x5584b5a780 "Service [%s] started") at ../../stunnel-5.57/src/log.c:192 #14 0x0000005584b454e8 in client_main (c=c@entry=0x7f82e30060) at ../../stunnel-5.57/src/client.c:178 #15 0x0000005584b45658 in client_thread (arg=0x7f82e30060) at ../../stunnel-5.57/src/client.c:130 #16 0x0000007f83026e64 in start_thread (arg=0x7fc21e457f) at pthread_create.c:463 #17 0x0000007f82f815dc in thread_start () at ../sysdeps/unix/sysv/linux/aarch64/clone.S:78 == Thread apply all backtrace full

2 4

Using URL Subfolders to redirect traffic to a different service?
by hellmanandrew＠comcast.net 02 Jul '23

02 Jul '23

I want to be able to actually use stunnel as a reverse proxy by running everything through one port. How I want to do that is by using subfolders in a URL like: webpage.net/service1 webpage.net/service2 Basically, every subfolder will redirect to a different IP address or port offered by a server. Just not sure how I should configure this.

1 0

help
by Seray Tokadli 26 Jun '23

26 Jun '23

Hello, I am trying to configure stunnel on windows (version 5.69) I am using the capi engine with below conf. I am sending the logs to logstash and not sure if it is working or not. My questions are: 1) I dont see anything in the log after initializing the service. When it sends the logs through stunnel, should i see an entry in the logs? 2) When using capi engine, should i limit the ssl version still ? in your website i see that the tls version supposed to be limited but is it an old info? 3) in your website again it mentions that i should specify the security level to zero for capi engine, is it also a valid info? if yes, do i need to set it in global section or service level? https://www.stunnel.org/config_windows.html fips = yes taskbar = yes engine = capi output = C:\Logs\stunnel\stunnel.log debug = debug [logging_service_for_filebeat] engineId = capi client = yes accept = {{ stunnel_logging_port_filebeat }} delay = yes connect = {{ logstash_vip }}:{{ stunnel_logging_port_filebeat }} ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256 sessionCacheSize = 5000 sessionCacheTimeout = 300 socket = l:TCP_NODELAY=1 # the only FIPS 140-2 compliant protocol sslVersion = TLSv1.2 CApath = <ca path> verifyChain = yes checkHost = <ca host> verify = 2 Log: 023.06.26 14:37:39 LOG6[service]: Initializing inetd mode configuration 2023.06.26 14:37:39 LOG7[service]: Running on Windows 6.2 2023.06.26 14:37:39 LOG7[service]: No limit detected for the number of clients 2023.06.26 14:37:39 LOG5[service]: stunnel 5.69 on x64-pc-mingw32-gnu platform 2023.06.26 14:37:39 LOG5[service]: Compiled/running with OpenSSL 3.0.8 7 Feb 2023 2023.06.26 14:37:39 LOG5[service]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2023.06.26 14:37:39 LOG7[service]: errno: (*_errno()) 2023.06.26 14:37:39 LOG6[service]: Initializing inetd mode configuration 2023.06.26 14:37:39 LOG7[service]: Running on Windows 6.2 2023.06.26 14:37:39 LOG5[service]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2023.06.26 14:37:39 LOG5[service]: UTF-8 byte order mark not detected 2023.06.26 14:37:39 LOG7[service]: Enabling support for engine "capi" 2023.06.26 14:37:39 LOG6[service]: Logging not supported by engine #1 (capi) 2023.06.26 14:37:39 LOG6[service]: UI not supported by engine #1 (capi) 2023.06.26 14:37:39 LOG7[service]: Initializing engine #1 (capi) 2023.06.26 14:37:39 LOG6[service]: Engine #1 (capi) initialized 2023.06.26 14:37:39 LOG5[service]: FIPS provider enabled 2023.06.26 14:37:39 LOG5[service]: FIPS mode enabled 2023.06.26 14:37:39 LOG6[service]: Compression disabled 2023.06.26 14:37:39 LOG7[service]: No PRNG seeding was required 2023.06.26 14:37:39 LOG6[service]: Initializing service [logging_service_for_filebeat] 2023.06.26 14:37:39 LOG6[service]: stunnel default security level set: 2 2023.06.26 14:37:39 LOG7[service]: Ciphers: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256 2023.06.26 14:37:39 LOG7[service]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.06.26 14:37:39 LOG7[service]: TLS options: 0x2100000 (+0x0, -0x0) 2023.06.26 14:37:39 LOG6[service]: Session resumption enabled 2023.06.26 14:37:39 LOG6[service]: Client certificate engine (capi) enabled 2023.06.26 14:37:39 LOG7[service]: No certificate or private key specified 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA:xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA:xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: DH initialization skipped: client section 2023.06.26 14:37:39 LOG7[service]: ECDH initialization 2023.06.26 14:37:39 LOG7[service]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.06.26 14:37:39 LOG6[service]: Initializing service [logging_service_for_winlogbeat] 2023.06.26 14:37:39 LOG6[service]: stunnel default security level set: 2 2023.06.26 14:37:39 LOG7[service]: Ciphers: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256 2023.06.26 14:37:39 LOG7[service]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.06.26 14:37:39 LOG7[service]: TLS options: 0x2100000 (+0x0, -0x0) 2023.06.26 14:37:39 LOG6[service]: Session resumption enabled 2023.06.26 14:37:39 LOG6[service]: Client certificate engine (capi) enabled 2023.06.26 14:37:39 LOG7[service]: No certificate or private key specified 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: DH initialization skipped: client section 2023.06.26 14:37:39 LOG7[service]: ECDH initialization 2023.06.26 14:37:39 LOG7[service]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.06.26 14:37:39 LOG5[service]: Configuration successful 2023.06.26 14:37:39 LOG7[service]: Deallocating deployed section defaults 2023.06.26 14:37:39 LOG7[service]: Binding service [logging_service_for_filebeat] 2023.06.26 14:37:39 LOG7[service]: Listening file descriptor created (FD=632) 2023.06.26 14:37:39 LOG7[service]: Setting accept socket options (FD=632) 2023.06.26 14:37:39 LOG7[service]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.06.26 14:37:39 LOG6[service]: Service [logging_service_for_filebeat] (FD=632) bound to 0.0.0.0:10300 2023.06.26 14:37:39 LOG7[service]: Binding service [logging_service_for_winlogbeat] 2023.06.26 14:37:39 LOG7[service]: Listening file descriptor created (FD=648) 2023.06.26 14:37:39 LOG7[service]: Setting accept socket options (FD=648) 2023.06.26 14:37:39 LOG7[service]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.06.26 14:37:39 LOG6[service]: Service [logging_service_for_winlogbeat] (FD=648) bound to 0.0.0.0:10301 2023.06.26 14:37:39 LOG6[service]: Accepting new connections 2023.06.26 14:37:39 LOG7[per-second]: Per-second thread initialized 2023.06.26 14:37:39 LOG7[per-day]: Per-day thread initialized 2023.06.26 14:37:39 LOG6[per-day]: Executing per-day jobs 2023.06.26 14:37:39 LOG6[per-day]: Per-day jobs completed in 0 seconds 2023.06.26 14:37:39 LOG7[per-day]: Waiting 86400 seconds -- Seray TOKADLI KILIÇ +420778116052

1 0

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 21 Jun '23

21 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

2 7

help configuring stunnel with ssl ceritificate
by Andrei 20 Jun '23

20 Jun '23

Hello! I'm trying to configure stunnel with an ssl certificate. I have the certificate (.p12 format) from the site owners, installed it in the Personal folder of the current user and local machine. Before installing stunnel I had to select the certificate in the browser when accessing the site. With this configuration [sts] client = yes accept = 127.0.0.1:42354 connect = y7m2zq.its:443 key = E:\!Work\ cert_.pem CAfile = E:\!Work\ cert_.pem verify=0 the stunnel starts but I get a `No required SSL certificate was sent`when accessing from the browser. If I use this config [sts] client = yes accept = 127.0.0.1:42354 connect = y7m2zq.its:443 cert = E:\!Work\cert_.p12 key = E:\!Work\cert_.pem CAfile = E:\!Work\cert_.pem verify=0 the stunnel will not start PKCS12_parse: crypto/evp/evp_fetch.c:373: error:0308010C:digital envelope routines::unsupported LOG3[main]: Service [sts]: Failed to initialize TLS context Please help. I would like to be able to open the site without choosing the certificate. Thank you!

2 1

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 20 Jun '23

20 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

1 0

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 20 Jun '23

20 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

1 0

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 20 Jun '23

20 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

1 0

Inbound and outbound connection on same PC?
by trashrap22＠gmail.com 15 Jun '23

15 Jun '23

Hi, I have a linux PC that now successfully runs a stunnel client connection with a remote server. I now want to be able to access sql server on that linux PC from a remote Windows PC. What I would like to gather information on: 1. Can the client configuration of stunnel on the linux PC be used for a second connection from the remote windows PC to access data (sql server)? 2. Thus, what differentiates a client from a server - a server can have multiple connections and provides data? A client can't? 3. What is the correct route I should take? Regards,

3 3

Reading HSM Pincode from file and passing it to Stunnel/OpenSSL
by Andreas Heijdendael 30 May '23

30 May '23

Hi there, I'm running into an issue. I'm trying to run stunnel on my new Ubuntu 22.04 system whereas before I was running it on Windows. Thing is, on the Windows system I had to compile stunnel manually as I need to read an encrypted file on the filesystem that contains the user-pin for my HSM. On Windows, that worked. On Ubuntu I'm having issues with the C11 _s functions (like sscanf_s and the likes). ChatGTP suggested using clang compiler, but I have not clue on how to do that. Of enabling C11 Annex K support in Ubuntu (no such thing, apparently).... Is there anybody here that makes use of these _s functions in their code on Ubuntu 22.04? Or explain how to use these functions in gcc? Or compile stunnel (+ additional code) using Clang. Thanks!! Andreas

1 0

ssl3 wrong version number
by trashrap22＠gmail.com 18 May '23

18 May '23

I get the following error running 'sudo service stunnel4 status' : LOG3[0]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number is that merely a mismatch between openSSL versions used by client and server? I have tried changing the config file options, also with no specification since the default according to stunnel.org is: options = NO_SSLv2 options = NO_SSLv3 I have tried (service level option): sslVersion = TLSv1 Same error. When running sudo service stunnel4 status after start: May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP May 12 08:22:45 user-Linux stunnel4[16616]: Starting TLS tunnels: /etc/stunnel/stunnel.conf: started May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf May 12 08:22:45 user-Linux systemd[1]: Started LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons). May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: UTF-8 byte order mark not detected May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: FIPS mode disabled May 12 08:22:45 user-Linux stunnel[16630]: LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/psk.txt May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: Configuration successful May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: Switched to chroot directory: /var/lib/stunnel4/ May 12 08:22:45 user-Linux stunnel[16632]: LOG5[cron]: Updating DH parameters After trying to make a connection via FIX connection: May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Service [**redacted**] started May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Setting local socket options (FD=3) May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Option TCP_NODELAY set on local socket May 12 08:28:04 user-Linux stunnel[16798]: LOG5[0]: Service [**redacted**] accepted connection from 127.0.0.1:51954 May 12 08:28:04 user-Linux stunnel[16798]: LOG6[0]: Peer certificate not required May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: TLS state (accept): before SSL initialization May 12 08:28:04 user-Linux stunnel[16798]: LOG3[0]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number May 12 08:28:04 user-Linux stunnel[16798]: LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Local descriptor (FD=3) closed May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Service [**redacted**] finished (0 left)

2 1

TLS alert (read): warning: close notify
by trashrap22＠gmail.com 18 May '23

18 May '23

Hi All, Hopefully the last question with my struggles! Stunnel connects and the initial TLS connection works - but then it seems the client or server (I am client) does not trust the psk key? Any ideas? Note - part of the previous issue was creating a 64B/512b PSK and NOT a 32/B/256b psk. I created that key and shared it with the server. See below line referencing 256bit encryption? May 18 16:34:38 user-Linux stunnel: LOG5[0]: Service [** redacted **] connected remote server from ** redacted ** May 18 16:34:38 user-Linux stunnel: LOG7[0]: Setting remote socket options (FD=11) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Option TCP_NODELAY set on remote socket May 18 16:34:38 user-Linux stunnel: LOG7[0]: Remote descriptor (FD=11) initialized May 18 16:34:38 user-Linux stunnel: LOG6[0]: SNI: sending servername: ** redacted ** May 18 16:34:38 user-Linux stunnel: LOG6[0]: Peer certificate not required May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): before SSL initialization May 18 16:34:38 user-Linux stunnel: LOG7[0]: Initializing application specific data for session authenticated May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write client hello May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write client hello May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server hello May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange May 18 16:34:38 user-Linux stunnel: LOG6[0]: Client certificate not requested May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server done May 18 16:34:38 user-Linux stunnel: LOG6[0]: PSK client configured for identity "client" May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write finished May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write finished May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server session ticket May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read finished May 18 16:34:38 user-Linux stunnel: LOG7[0]: New session callback May 18 16:34:38 user-Linux stunnel: LOG6[0]: No peer certificate received May 18 16:34:38 user-Linux stunnel: LOG6[0]: Session id: ***** redacted **** May 18 16:34:38 user-Linux stunnel: LOG7[0]: 1 client connect(s) requested May 18 16:34:38 user-Linux stunnel: LOG7[0]: 1 client connect(s) succeeded May 18 16:34:38 user-Linux stunnel: LOG7[0]: 0 client renegotiation(s) requested May 18 16:34:38 user-Linux stunnel: LOG7[0]: 0 session reuse(s) May 18 16:34:38 user-Linux stunnel: LOG6[0]: TLS connected: new session negotiated May 18 16:34:38 user-Linux stunnel: LOG6[0]: TLSv1.2 ciphersuite: ECDHE-PSK-CHACHA20-POLY1305 (256-bit encryption) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Compression: null, expansion: null May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS alert (read): warning: close notify May 18 16:34:38 user-Linux stunnel: LOG6[0]: TLS closed (SSL_read) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Sent socket write shutdown May 18 16:34:38 user-Linux stunnel: LOG6[0]: Read socket closed (readsocket) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Sending close_notify alert May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS alert (write): warning: close notify May 18 16:34:38 user-Linux stunnel: LOG6[0]: SSL_shutdown successfully sent close_notify alert May 18 16:34:38 user-Linux stunnel: LOG5[0]: Connection closed: 98 byte(s) sent to TLS, 0 byte(s) sent to socket May 18 16:34:38 user-Linux stunnel: LOG7[0]: Remote descriptor (FD=11) closed May 18 16:34:38 user-Linux stunnel: LOG7[0]: Local descriptor (FD=3) closed May 18 16:34:38 user-Linux stunnel: LOG7[0]: Service [*redacted*]finished (0 left)

1 0

chroot jail on debian 11 for stunnel steps?
by trashrap22＠gmail.com 11 May '23

11 May '23

Does someone have all the steps in order to setup a chroot jail on debian 11 OS - I have followed [this](https://manpages.debian.org/testing/stunnel4/stunnel.8.en.html) mostly - but think I am going to miss some differences to Debian 11 and go down a rabbit hole. Anyone have done it on Debian 11 care to share the steps?

3 3

Re: stunnel not starting
by Christopher Schultz 10 May '23

10 May '23

Hello, On 5/10/23 00:28, d3rIIIe15ter Tier wrote: > Please advise why you strongly advise running stunnel in a chroot jail? Because: 1. It's insanely easy to do (it literally IS just "chroot=/path/to/jail") and 2. If there is a problem with stunnel (e.g. security issue), the amount of damage an attacker can do is significantly limited -chris > On Tue, May 9, 2023 at 5:59 PM Christopher Schultz > <chris(a)christopherschultz.net <mailto:[email protected]>> wrote: > > Hello, > > On 5/9/23 11:13, d3rIIIe15ter Tier wrote: > > After giving access to var/log/secure/stunnel.log, I now get logs! > > > > There I get the following error: > > > > Cannot create pid file /var/run/stunnel4.pid > > create: Permission denied (13) > > What is the euid of the stunnel process? Does it have access to that > path? Are you using a chroot jail? (You should be.) Does that path > exist > in the chroot jail? Can the stunnel user write to that path? > > -chris > > > On Tue, May 9, 2023 at 4:34 PM d3rIIIe15ter Tier > <trashrap22(a)gmail.com <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>>> wrote: > > > > You are right... bad mistake. > > > > Now I get: cannot open log file - which I am sure is a > permission > > thing since I need to use sudo to be able to write to that file. > > Any ideas further? > > > > On Tue, May 9, 2023 at 4:21 PM Christopher Schultz > > <chris(a)christopherschultz.net > <mailto:[email protected]> > <mailto:[email protected] > <mailto:[email protected]>>> > > wrote: > > > > Hello, > > > > On 5/9/23 10:17, d3rIIIe15ter Tier wrote: > > > I have tried changing the location to > > > > > > var/log/stunnel4/stunnel.log > > > var/log/stunnel4/stunnelLog > > > var/log/secure/ > > > var/log/secure/stunnel.log > > > etc/stunnel/stunnel.log > > > etc/stunnel/stunnelLog > > > > > > don't know how to fix it yet... > > I don't think the *value* is the problem. The problem is that > > you have > > defined "output" somewhere that isn't valid, such as within a > > specific > > service's section instead of as a global setting. > > > > -chris > > > > > On Tue, May 9, 2023 at 3:54 PM Christopher Schultz > > > <chris(a)christopherschultz.net > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>>> wrote: > > > > > > Hello, > > > > > > On 5/9/23 09:40, trashrap22(a)gmail.com > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>>> > > > wrote: > > > > Hi, I am on Debian - when I run "sudo stunnel > > stunnel.conf" I > > > get the following output: > > > > > > > > [ ] Clients allowed=500 > > > > [.] stunnel 5.56 on x86_64-pc-linux-gnu platform > > > > [.] Compiled with OpenSSL 1.1.1k 25 Mar 2021 > > > > [.] Running with OpenSSL 1.1.1n 15 Mar 2022 > > > > [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD > > > TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP > > > > [ ] errno: (*__errno_location ()) > > > > [.] Reading configuration from file > > /etc/stunnel/stunnel.conf > > > > [.] UTF-8 byte order mark not detected > > > > [.] FIPS mode disabled > > > > [ ] Compression disabled > > > > [ ] No PRNG seeding was required > > > > [!] /etc/stunnel/stunnel.conf:24: "output = > > /tmp/stunnel.log": > > > Specified option name is not valid here > > > > [ ] Deallocating section defaults > > > > > > > > When I run "sudo netstat -tulnp | grep -i > stunnel" I > > also get no > > > output - which means that stunnel is not starting up? > > > > > > The log message seems pretty specific to me. Maybe you > > should fix that? > > > > > > -chris > > > _______________________________________________ > > > stunnel-users mailing list -- > stunnel-users(a)stunnel.org <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > To unsubscribe send an email to > > stunnel-users-leave(a)stunnel.org > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > > > _______________________________________________ > > stunnel-users mailing list -- stunnel-users(a)stunnel.org > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > To unsubscribe send an email to > stunnel-users-leave(a)stunnel.org <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > _______________________________________________ > stunnel-users mailing list -- stunnel-users(a)stunnel.org > <mailto:[email protected]> > To unsubscribe send an email to stunnel-users-leave(a)stunnel.org > <mailto:[email protected]> >

1 0

stunnel not starting
by trashrap22＠gmail.com 09 May '23

09 May '23

Hi, I am on Debian - when I run "sudo stunnel stunnel.conf" I get the following output: [ ] Clients allowed=500 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled with OpenSSL 1.1.1k 25 Mar 2021 [.] Running with OpenSSL 1.1.1n 15 Mar 2022 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [!] /etc/stunnel/stunnel.conf:24: "output = /tmp/stunnel.log": Specified option name is not valid here [ ] Deallocating section defaults When I run "sudo netstat -tulnp | grep -i stunnel" I also get no output - which means that stunnel is not starting up?

4 7

Update newest version
by sportman7＠netzero.com 05 May '23

05 May '23

Have used Stunnel for years. To update I normally download the latest version and copy the files (DLL, exe, etc.) to my client's computers. But I tried this with latest update and I must be missing something as my app is not able to use this version. Went back to previous version but really need to know how to deliver the update to a client's computer. Thanks for any ideas on this.

2 2

stunnel and Google LDAP
by matt.colwell＠sduhsd.net 01 May '23

01 May '23

Hi, I'm trying to setup stunnel as a proxy to Google Workplace's LDAP service. I followed the instructions located here: https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3… I've set the up on Ubuntu 22.04.2 LTS When attempting to connect I get the following error: SSL_read: ../ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading Connection reset: 217 byte(s) sent to TLS, 164 byte(s) sent to socket What might be my issue here? thanks

1 0

error starting / restarting /etc/init.d/stunnel4 on debian
by trashrap22＠gmail.com 28 Apr '23

28 Apr '23

Hi, I am not getting any stunnel logs. Though my syslog gives me the info below. The stunnel4 file in /usr/bin/ is empty? Apr 28 15:18:01 User-Linux systemd[1]: Starting LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)... Apr 28 15:18:01 User-Linux stunnel4[30850]: Starting TLS tunnels: /etc/stunnel/stunnel.conf: Apr 28 15:18:01 User-Linux stunnel4[30864]: /sbin/start-stop-daemon: unable to start /usr/bin/stunnel4 (Exec format error) Apr 28 15:18:01 User-Linux stunnel4[30850]: failed Apr 28 15:18:01 User-Linux stunnel4[30850]: You should check that you have specified the pid= in you configuration file

4 4

Is there installing instructions for Stunnel on Debian ?
by trashrap22＠gmail.com 26 Apr '23

26 Apr '23

Hi, I don't see installing instructions for Linux or rather for Debian specifically anywhere ?

4 4

FW: Help with disabling SSLv3
by Eberhard 14 Mar '23

14 Mar '23

Actually I think the SSLv3 in the log is a lie - as this is also in the log just before the below: TLS state (connect): before/connect initialization TLS state (connect): SSLv3 write client hello A TLS state (connect): SSLv3 read server hello A So I am thinking the eliptic curve stuff is more likely the issue? Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 _____________________________________________ From: Eberhard <flash(a)vicsmba.com> Sent: Tuesday, March 14, 2023 9:15 AM To: 'stunnel-users(a)stunnel.org' <stunnel-users(a)stunnel.org> Subject: Help with disabling SSLv3 Importance: High I am suddenly getting errors from Fedex: TLS state (connect): SSLv3 read server certificate A error queue: 1408D010: error:1408D010:SSL routines:ssl3_get_key_exchange:EC lib error queue: 100AE081: error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group error queue: 100AF003: error:100AF003:elliptic curve routines:EC_GROUP_NEW_FROM_DATA:BN lib SSL_connect: 3078072: error:03078072:bignum routines:BN_EXPAND_INTERNAL:bignum too long My .conf file says: output = /tmp/fedex.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ws.fedex.com:443 ;connect = gateway.fedex.com:443 ;connect = wssha1ends12172016.fedex.com:443 sslVersion = TLSv1.2 options = NO_SSLv3 sslVersionMin = TLSv1.2 CAfile = /usr/local/ssl/certs/cacert.pem It is a very old version of stunnel but I cannot upgrade as this is a 15 year old AIX (IBM) computer stunnel 5.44 on powerpc-ibm-aix4.3.3.0 platform Compiled/running with OpenSSL 1.0.2 22 Jan 2015 Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI Invalid configuration file name "--version" realpath: No such file or directory (2) Yet the log implies I am still trying SSLv3. Any ideas? Thanks in advance. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115

2 1

Help with disabling SSLv3
by Eberhard 14 Mar '23

14 Mar '23

I am suddenly getting errors from Fedex: TLS state (connect): SSLv3 read server certificate A error queue: 1408D010: error:1408D010:SSL routines:ssl3_get_key_exchange:EC lib error queue: 100AE081: error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group error queue: 100AF003: error:100AF003:elliptic curve routines:EC_GROUP_NEW_FROM_DATA:BN lib SSL_connect: 3078072: error:03078072:bignum routines:BN_EXPAND_INTERNAL:bignum too long My .conf file says: output = /tmp/fedex.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ws.fedex.com:443 ;connect = gateway.fedex.com:443 ;connect = wssha1ends12172016.fedex.com:443 sslVersion = TLSv1.2 options = NO_SSLv3 sslVersionMin = TLSv1.2 CAfile = /usr/local/ssl/certs/cacert.pem It is a very old version of stunnel but I cannot upgrade as this is a 15 year old AIX (IBM) computer stunnel 5.44 on powerpc-ibm-aix4.3.3.0 platform Compiled/running with OpenSSL 1.0.2 22 Jan 2015 Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI Invalid configuration file name "--version" realpath: No such file or directory (2) Yet the log implies I am still trying SSLv3. Any ideas? Thanks in advance. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115

1 0

Stunnel Installation.
by nathan.king＠unpredictableporridge.co.uk 12 Mar '23

12 Mar '23

Hello, New stunnel user here - or trying to ne! I manage a streaming service using both SHOUT and Icecast servers, on a Widows 10 platform. Have been hit by the update to the G/Chrome browser, and while the Website is secure, the streams are not. There is limited support for S.S.L. for Icecast, but none for SHOUTcast. Was recommended to use S.S.L., but apparently the OpenSSL library isn't downloaded for Widows, only Linux, so have tried using Debian 11, which have installed within VirtualBox. However, have had no luck making the connection. Happened to read in another tutorial that if stunnel isn't installed on the same Computer, as the Playout system and encoder - use B.U.T.T., and Sound Empire Caster - one has to have stunnel installed on both Computers? Is the above true? EIther way,, would appreciate some advice on how to resolve this issue, and am new to stunnel, and only a basic knowledge of Debian. Thanks for your help with this issue. Cheers.

3 8

stunnel as server dont connect to endpoint
by mahdi.section8＠gmail.com 05 Mar '23

05 Mar '23

hello everyone i have a setup of openvpn + stunnel stunnel(client) in a server stunnel(server) + openvpn in another server both were working fine until i moved the second server to another one i moved all openvpn and stunnel files to new one but even though its same stunnel it dont work properly i even compiled latest 5.69 version thinking it was a bug this is my stunnel config: setuid = root setgid = root [openvpn] cert=/etc/stunnel/cert.pem key=/etc/stunnel/key.pem accept = 0.0.0.0:1381 connect = 127.0.0.1:1194 its so simple yet idk whats the problem, cause in the logs i only see from stunnel that a connection from ip x accepted but nothing else saying that it connected to 127.0.0.1:1194 its just accepting connections and nothing more like it forgot there is a connect option there. but i confirm openvpn is correct as i tested with netcat and openvpn showed up in logs saying there is a connection but somehow stunnel dont connect to 127.0.0.1:1194 its crazy that either i forgot something or misconfig of stunnel cause its so simple and its not working

2 2

stunnel 5.69 released
by Michał Trojnara 04 Mar '23

04 Mar '23

Dear Users, I have released version 5.69 of stunnel. ### Version 5.69, 2023.03.04, urgency: MEDIUM * New features - Improved logging performance with the "output" option. - Improved file read performance on the WIN32 platform. - DH and kDHEPSK ciphersuites removed from FIPS defaults. - Set the LimitNOFILE ulimit in stunnel.service to allow for up to 10,000 concurrent clients. * Bugfixes - Fixed the "CApath" option on the WIN32 platform by applying https://github.com/openssl/openssl/pull/20312. - Fixed stunnel.spec used for building rpm packages. - Fixed tests on some OSes and architectures by merging Debian 07-tests-errmsg.patch (thx to Peter Pentchev). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 1ff7d9f30884c75b98c8a0a4e1534fa79adcada2322635e6787337b4e38fdb81 stunnel-5.69.tar.gz 66c4f3bbb94c4a274f2e8e98e3d44e74c0460d6494986f0a94b9b8becdc63cc3 stunnel-5.69-win64-installer.exe 74813a0be13270b5348fc4bc7c16ada668d151773be19f404db1176b7e22aafc stunnel-5.69-android.zip Best regards, Mike

1 0