- stunnel-users - stunnel.org

Memory usage in stunnel-5.63
by roie rachamim 28 Jun '22

28 Jun '22

Hi, I'm running stunnel 5.63 compiled in debian-bullseye inside docker, and i'm trying to understand the allocated memory behavior In a test i'm conducting i'm creating a load towards the stunnel server And the process CPU + memory consumption rises. Once i stop the traffic the CPU goes down but the memory doesn't. Is this expected ? Many Thanks, Roie

2 1

Stunnel's Windows client stopped working in Iran
by landateta＠yahoo.com 26 Jun '22

26 Jun '22

I have a Stunnel server that users connect to from Iran, to circumvent internet censorship. It was working for years but in recent days Stunnel's Windows client has stopped working (maybe due to censorship), but the Android clients like (SSLSocks and SSL Encryptor) do work. So do you have any idea what would be the difference between Windows and Android clients which can help me fix the problem? Any help appreciated.

1 0

Stunnel5.64 Failed to initialize TLS on Windows 7
by White Louis 23 Jun '22

23 Jun '22

Hi All I upgraded Stunnel 5.64, but it got an error about "Failed to initialize TLS." But It works on Windows10/Windows server 2012 with the Stunnel 5.64 and the same configuration Note: The same configuration works with Stunnel5.63 and earlier version on Windows 7. Below is my configuration sslVersion = TLSv1.2 ciphers=HIGH options = NO_SSLv3 [HOST] client = yes accept = 127.0.0.1:59379 connect = remoteIP:Port verify = 3 CAfile = xxx.crt Logs are below: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.1 [ ] No limit detected for the number of clients [.] stunnel 5.64 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.3 3 May 2022 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.1 [.] Reading configuration from file C:\Users\vm\AppData\Local\Temp\0660770671653983902255\stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression enabled: 0 methods [!] PRNG seeded with 0 bytes total [!] PRNG was not seeded with enough random bytes [!] Global options: Failed to initialize TLS [!] Configuration failed [ ] Deallocating temporary section defaults Server is down

1 0

Connection to Outlook O365 owa
by raduci＠gmail.com 09 Jun '22

09 Jun '22

Dear all, I am trying to connect via stunnel to O365 OWA. Configuration file is below: ; Sample stunnel configuration file for Win64 by Michal Trojnara 2002-2022 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later securityLevel = 0 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store [O365] client = yes accept = 192.168.0.225:443 connect = outlook.office.com:443 engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini In the browser (Firefox) I get the below error: Secure Connection Failed An error occurred during a connection to 192.168.0.225. SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. Please contact the website owners to inform them of this problem. Chrome says: 192.168.0.225 sent an invalid response. Try running Windows Network Diagnostics. ERR_SSL_PROTOCOL_ERROR Logs are below: Found 1 ready file descriptor(s) 2022.06.09 15:46:32 LOG7[main]: FD=604 ifds=r-x ofds=r-- 2022.06.09 15:46:32 LOG7[main]: FD=908 ifds=r-x ofds=--- 2022.06.09 15:46:32 LOG7[main]: Dispatching a signal from the signal pipe 2022.06.09 15:46:32 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2022.06.09 15:46:33 LOG6[main]: Initializing inetd mode configuration 2022.06.09 15:46:33 LOG7[main]: Running on Windows 6.2 2022.06.09 15:46:33 LOG5[main]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2022.06.09 15:46:33 LOG5[main]: UTF-8 byte order mark detected 2022.06.09 15:46:33 LOG7[main]: Enabling support for engine "capi" 2022.06.09 15:46:33 LOG6[main]: UI not supported by engine #1 (capi) 2022.06.09 15:46:33 LOG7[main]: Initializing engine #1 (capi) 2022.06.09 15:46:33 LOG6[main]: Engine #1 (capi) initialized 2022.06.09 15:46:33 LOG5[main]: FIPS mode disabled 2022.06.09 15:46:33 LOG6[main]: Compression enabled: 0 methods 2022.06.09 15:46:33 LOG7[main]: No PRNG seeding was required 2022.06.09 15:46:33 LOG6[main]: Initializing service [O365] 2022.06.09 15:46:33 LOG6[main]: User-specified security level set: 0 2022.06.09 15:46:33 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2022.06.09 15:46:33 LOG7[main]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2022.06.09 15:46:33 LOG7[main]: TLS options: 0x2100000 (+0x0, -0x0) 2022.06.09 15:46:33 LOG6[main]: Session resumption enabled 2022.06.09 15:46:33 LOG6[main]: Client certificate engine (capi) enabled 2022.06.09 15:46:33 LOG7[main]: No certificate or private key specified 2022.06.09 15:46:33 LOG4[main]: Service [O365] needs authentication to prevent MITM attacks 2022.06.09 15:46:33 LOG6[main]: DH initialization skipped: client section 2022.06.09 15:46:33 LOG7[main]: ECDH initialization 2022.06.09 15:46:33 LOG7[main]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2022.06.09 15:46:33 LOG5[main]: Configuration successful 2022.06.09 15:46:33 LOG7[main]: Unbinding service [O365] 2022.06.09 15:46:33 LOG7[main]: Service [O365] closed (FD=908) 2022.06.09 15:46:33 LOG7[main]: Service [O365] closed 2022.06.09 15:46:33 LOG7[main]: Deallocating deployed section defaults 2022.06.09 15:46:33 LOG7[main]: Deallocating section [O365] 2022.06.09 15:46:33 LOG5[main]: Logging to C:\Users\radc\AppData\Local\stunnel.log 2022.06.09 15:46:33 LOG7[main]: Binding service [O365] 2022.06.09 15:46:33 LOG7[main]: Listening file descriptor created (FD=1580) 2022.06.09 15:46:33 LOG7[main]: Setting accept socket options (FD=1580) 2022.06.09 15:46:33 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2022.06.09 15:46:33 LOG6[main]: Service [O365] (FD=1580) bound to 192.168.0.225:443 2022.06.09 15:47:19 LOG7[17]: Service [O365] started 2022.06.09 15:47:19 LOG7[17]: Setting local socket options (FD=1624) 2022.06.09 15:47:19 LOG7[main]: FD=604 ifds=r-x ofds=--- 2022.06.09 15:47:19 LOG7[17]: Option TCP_NODELAY set on local socket 2022.06.09 15:47:19 LOG5[17]: Service [O365] accepted connection from 192.168.0.200:55381 2022.06.09 15:47:19 LOG7[main]: FD=1580 ifds=r-x ofds=r-- 2022.06.09 15:47:19 LOG6[17]: failover: priority, starting at entry #0 2022.06.09 15:47:19 LOG7[main]: Service [O365] accepted (FD=1608) from 192.168.0.200:55382 2022.06.09 15:47:19 LOG6[17]: s_connect: connecting 52.98.152.162:443 2022.06.09 15:47:19 LOG7[main]: Creating a new thread 2022.06.09 15:47:19 LOG7[main]: New thread created 2022.06.09 15:47:19 LOG7[18]: Service [O365] started 2022.06.09 15:47:19 LOG7[18]: Setting local socket options (FD=1608) 2022.06.09 15:47:19 LOG7[18]: Option TCP_NODELAY set on local socket 2022.06.09 15:47:19 LOG5[18]: Service [O365] accepted connection from 192.168.0.200:55382 2022.06.09 15:47:19 LOG6[18]: failover: priority, starting at entry #0 2022.06.09 15:47:19 LOG6[18]: s_connect: connecting 52.98.152.162:443 2022.06.09 15:47:19 LOG7[17]: s_connect: s_poll_wait 52.98.152.162:443: waiting 10 seconds 2022.06.09 15:47:19 LOG7[17]: FD=1596 ifds=rwx ofds=--- 2022.06.09 15:47:19 LOG7[18]: s_connect: s_poll_wait 52.98.152.162:443: waiting 10 seconds 2022.06.09 15:47:19 LOG7[18]: FD=1204 ifds=rwx ofds=--- 2022.06.09 15:47:19 LOG5[17]: s_connect: connected 52.98.152.162:443 2022.06.09 15:47:19 LOG5[17]: Service [O365] connected remote server from 10.57.2.17:57847 2022.06.09 15:47:19 LOG7[17]: Setting remote socket options (FD=1596) 2022.06.09 15:47:19 LOG7[17]: Option TCP_NODELAY set on remote socket 2022.06.09 15:47:19 LOG7[17]: Remote descriptor (FD=1596) initialized 2022.06.09 15:47:19 LOG6[17]: SNI: sending servername: outlook.office.com 2022.06.09 15:47:19 LOG6[17]: Peer certificate not required 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): before SSL initialization 2022.06.09 15:47:19 LOG7[17]: Initializing application specific data for session authenticated 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG5[18]: s_connect: connected 52.98.152.162:443 2022.06.09 15:47:19 LOG5[18]: Service [O365] connected remote server from 10.57.2.17:57848 2022.06.09 15:47:19 LOG7[18]: Setting remote socket options (FD=1204) 2022.06.09 15:47:19 LOG7[18]: Option TCP_NODELAY set on remote socket 2022.06.09 15:47:19 LOG7[18]: Remote descriptor (FD=1204) initialized 2022.06.09 15:47:19 LOG6[18]: SNI: sending servername: outlook.office.com 2022.06.09 15:47:19 LOG6[18]: Peer certificate not required 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): before SSL initialization 2022.06.09 15:47:19 LOG7[18]: Initializing application specific data for session authenticated 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS write change cipher spec 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS write change cipher spec 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): TLSv1.3 read encrypted extensions 2022.06.09 15:47:19 LOG6[17]: Certificate verification disabled 2022.06.09 15:47:19 LOG6[17]: Certificate verification disabled 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS read server certificate 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): TLSv1.3 read server certificate verify 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS read finished 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS write finished 2022.06.09 15:47:19 LOG7[17]: 2 client connect(s) requested 2022.06.09 15:47:19 LOG7[17]: 1 client connect(s) succeeded 2022.06.09 15:47:19 LOG7[17]: 0 client renegotiation(s) requested 2022.06.09 15:47:19 LOG7[17]: 0 session reuse(s) 2022.06.09 15:47:19 LOG6[17]: TLS connected: new session negotiated 2022.06.09 15:47:19 LOG6[17]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.06.09 15:47:19 LOG6[17]: Peer temporary key: ECDH, P-384, 384 bits 2022.06.09 15:47:19 LOG7[17]: Compression: null, expansion: null 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): TLSv1.3 read encrypted extensions 2022.06.09 15:47:19 LOG6[18]: Certificate verification disabled 2022.06.09 15:47:19 LOG6[18]: Certificate verification disabled 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS read server certificate 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): TLSv1.3 read server certificate verify 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS read finished 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS write finished 2022.06.09 15:47:19 LOG7[18]: 2 client connect(s) requested 2022.06.09 15:47:19 LOG7[18]: 2 client connect(s) succeeded 2022.06.09 15:47:19 LOG7[18]: 0 client renegotiation(s) requested 2022.06.09 15:47:19 LOG7[18]: 0 session reuse(s) 2022.06.09 15:47:19 LOG6[18]: TLS connected: new session negotiated 2022.06.09 15:47:19 LOG6[18]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.06.09 15:47:19 LOG6[18]: Peer temporary key: ECDH, P-384, 384 bits 2022.06.09 15:47:19 LOG7[18]: Compression: null, expansion: null 2022.06.09 15:47:20 LOG7[17]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[17]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[17]: Initializing application specific data for session authenticated 2022.06.09 15:47:20 LOG7[17]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG7[17]: New session callback 2022.06.09 15:47:20 LOG7[17]: Peer certificate was cached (4822 bytes) 2022.06.09 15:47:20 LOG6[17]: Session id: 8C30BA078B16527A627B472B16BD94469EF8EF2C2B3DC4DE83C9E9DD0454AE89 2022.06.09 15:47:20 LOG7[17]: TLS state (connect): SSLv3/TLS read server session ticket 2022.06.09 15:47:20 LOG7[17]: Remove session callback 2022.06.09 15:47:20 LOG7[17]: TLS alert (write): fatal: decode error 2022.06.09 15:47:20 LOG3[17]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.06.09 15:47:20 LOG5[17]: Connection reset: 517 byte(s) sent to TLS, 505 byte(s) sent to socket 2022.06.09 15:47:20 LOG7[17]: Remote descriptor (FD=1596) closed 2022.06.09 15:47:20 LOG7[17]: Local descriptor (FD=1624) closed 2022.06.09 15:47:20 LOG7[17]: Service [O365] finished (1 left) 2022.06.09 15:47:20 LOG7[main]: Found 1 ready file descriptor(s) 2022.06.09 15:47:20 LOG7[main]: FD=604 ifds=r-x ofds=--- 2022.06.09 15:47:20 LOG7[main]: FD=1580 ifds=r-x ofds=r-- 2022.06.09 15:47:20 LOG7[main]: Service [O365] accepted (FD=1132) from 192.168.0.200:55383 2022.06.09 15:47:20 LOG7[main]: Creating a new thread 2022.06.09 15:47:20 LOG7[main]: New thread created 2022.06.09 15:47:20 LOG7[19]: Service [O365] started 2022.06.09 15:47:20 LOG7[19]: Setting local socket options (FD=1132) 2022.06.09 15:47:20 LOG7[19]: Option TCP_NODELAY set on local socket 2022.06.09 15:47:20 LOG5[19]: Service [O365] accepted connection from 192.168.0.200:55383 2022.06.09 15:47:20 LOG6[19]: failover: priority, starting at entry #0 2022.06.09 15:47:20 LOG6[19]: s_connect: connecting 52.98.152.162:443 2022.06.09 15:47:20 LOG7[19]: s_connect: s_poll_wait 52.98.152.162:443: waiting 10 seconds 2022.06.09 15:47:20 LOG7[19]: FD=848 ifds=rwx ofds=--- 2022.06.09 15:47:20 LOG7[18]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[18]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[18]: Initializing application specific data for session authenticated 2022.06.09 15:47:20 LOG7[18]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG7[18]: New session callback 2022.06.09 15:47:20 LOG7[18]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG6[18]: Session id: 052BDBEAEF57DAF30820ADD1223A0C800EC7C7FBEFC8D6ECAAA50A67383A26F8 2022.06.09 15:47:20 LOG7[18]: TLS state (connect): SSLv3/TLS read server session ticket 2022.06.09 15:47:20 LOG7[18]: Remove session callback 2022.06.09 15:47:20 LOG7[18]: TLS alert (write): fatal: decode error 2022.06.09 15:47:20 LOG3[18]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.06.09 15:47:20 LOG5[18]: Connection reset: 517 byte(s) sent to TLS, 505 byte(s) sent to socket 2022.06.09 15:47:20 LOG7[18]: Remote descriptor (FD=1204) closed 2022.06.09 15:47:20 LOG7[18]: Local descriptor (FD=1608) closed 2022.06.09 15:47:20 LOG7[18]: Service [O365] finished (1 left) 2022.06.09 15:47:20 LOG7[main]: Found 1 ready file descriptor(s) 2022.06.09 15:47:20 LOG7[main]: FD=604 ifds=r-x ofds=--- 2022.06.09 15:47:20 LOG7[main]: FD=1580 ifds=r-x ofds=r-- 2022.06.09 15:47:20 LOG7[main]: Service [O365] accepted (FD=844) from 192.168.0.200:55384 2022.06.09 15:47:20 LOG7[main]: Creating a new thread 2022.06.09 15:47:20 LOG7[main]: New thread created 2022.06.09 15:47:20 LOG7[20]: Service [O365] started 2022.06.09 15:47:20 LOG7[20]: Setting local socket options (FD=844) 2022.06.09 15:47:20 LOG7[20]: Option TCP_NODELAY set on local socket 2022.06.09 15:47:20 LOG5[20]: Service [O365] accepted connection from 192.168.0.200:55384 2022.06.09 15:47:20 LOG6[20]: failover: priority, starting at entry #0 2022.06.09 15:47:20 LOG6[20]: s_connect: connecting 52.98.152.162:443 2022.06.09 15:47:20 LOG7[20]: s_connect: s_poll_wait 52.98.152.162:443: waiting 10 seconds 2022.06.09 15:47:20 LOG7[20]: FD=1120 ifds=rwx ofds=--- 2022.06.09 15:47:20 LOG5[19]: s_connect: connected 52.98.152.162:443 2022.06.09 15:47:20 LOG5[19]: Service [O365] connected remote server from 10.57.2.17:57849 2022.06.09 15:47:20 LOG7[19]: Setting remote socket options (FD=848) 2022.06.09 15:47:20 LOG7[19]: Option TCP_NODELAY set on remote socket 2022.06.09 15:47:20 LOG7[19]: Remote descriptor (FD=848) initialized 2022.06.09 15:47:20 LOG6[19]: SNI: sending servername: outlook.office.com 2022.06.09 15:47:20 LOG6[19]: Peer certificate not required 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): before SSL initialization 2022.06.09 15:47:20 LOG7[19]: Initializing application specific data for session authenticated 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG5[20]: s_connect: connected 52.98.152.162:443 2022.06.09 15:47:20 LOG5[20]: Service [O365] connected remote server from 10.57.2.17:57850 2022.06.09 15:47:20 LOG7[20]: Setting remote socket options (FD=1120) 2022.06.09 15:47:20 LOG7[20]: Option TCP_NODELAY set on remote socket 2022.06.09 15:47:20 LOG7[20]: Remote descriptor (FD=1120) initialized 2022.06.09 15:47:20 LOG6[20]: SNI: sending servername: outlook.office.com 2022.06.09 15:47:20 LOG6[20]: Peer certificate not required 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): before SSL initialization 2022.06.09 15:47:20 LOG7[20]: Initializing application specific data for session authenticated 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS write change cipher spec 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS write change cipher spec 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): TLSv1.3 read encrypted extensions 2022.06.09 15:47:20 LOG6[19]: Certificate verification disabled 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): TLSv1.3 read encrypted extensions 2022.06.09 15:47:20 LOG6[19]: Certificate verification disabled 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS read server certificate 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): TLSv1.3 read server certificate verify 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS read finished 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS write finished 2022.06.09 15:47:20 LOG7[19]: 4 client connect(s) requested 2022.06.09 15:47:20 LOG7[19]: 3 client connect(s) succeeded 2022.06.09 15:47:20 LOG7[19]: 0 client renegotiation(s) requested 2022.06.09 15:47:20 LOG7[19]: 0 session reuse(s) 2022.06.09 15:47:20 LOG6[19]: TLS connected: new session negotiated 2022.06.09 15:47:20 LOG6[19]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.06.09 15:47:20 LOG6[19]: Peer temporary key: ECDH, P-384, 384 bits 2022.06.09 15:47:20 LOG7[19]: Compression: null, expansion: null 2022.06.09 15:47:20 LOG6[20]: Certificate verification disabled 2022.06.09 15:47:20 LOG6[20]: Certificate verification disabled 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS read server certificate 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): TLSv1.3 read server certificate verify 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS read finished 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS write finished 2022.06.09 15:47:20 LOG7[20]: 4 client connect(s) requested 2022.06.09 15:47:20 LOG7[20]: 4 client connect(s) succeeded 2022.06.09 15:47:20 LOG7[20]: 0 client renegotiation(s) requested 2022.06.09 15:47:20 LOG7[20]: 0 session reuse(s) 2022.06.09 15:47:20 LOG6[20]: TLS connected: new session negotiated 2022.06.09 15:47:20 LOG6[20]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.06.09 15:47:20 LOG6[20]: Peer temporary key: ECDH, P-384, 384 bits 2022.06.09 15:47:20 LOG7[20]: Compression: null, expansion: null 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[19]: Initializing application specific data for session authenticated 2022.06.09 15:47:20 LOG7[19]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG7[19]: New session callback 2022.06.09 15:47:20 LOG7[19]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG6[19]: Session id: 3E857D78696F2321EDEE2F622CDB1A050B70B915FB7A6DD37C5DE86EC311534F 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS read server session ticket 2022.06.09 15:47:20 LOG7[19]: Remove session callback 2022.06.09 15:47:20 LOG7[19]: TLS alert (write): fatal: decode error 2022.06.09 15:47:20 LOG3[19]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.06.09 15:47:20 LOG5[19]: Connection reset: 517 byte(s) sent to TLS, 505 byte(s) sent to socket 2022.06.09 15:47:20 LOG7[19]: Remote descriptor (FD=848) closed 2022.06.09 15:47:20 LOG7[19]: Local descriptor (FD=1132) closed 2022.06.09 15:47:20 LOG7[19]: Service [O365] finished (1 left) 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[20]: Initializing application specific data for session authenticated 2022.06.09 15:47:20 LOG7[20]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG7[20]: New session callback 2022.06.09 15:47:20 LOG7[20]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG6[20]: Session id: E65F2E71C3EF8E156FA8FAEB5AD445887573D80ED9889F65524514A6ABC02D99 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS read server session ticket 2022.06.09 15:47:20 LOG7[20]: Remove session callback 2022.06.09 15:47:20 LOG7[20]: TLS alert (write): fatal: decode error 2022.06.09 15:47:20 LOG3[20]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.06.09 15:47:20 LOG5[20]: Connection reset: 517 byte(s) sent to TLS, 505 byte(s) sent to socket 2022.06.09 15:47:20 LOG7[20]: Remote descriptor (FD=1120) closed 2022.06.09 15:47:20 LOG7[20]: Local descriptor (FD=844) closed 2022.06.09 15:47:20 LOG7[20]: Service [O365] finished (0 left) Do you have any ideas?

2 1

stunnel started to core dump
by itdo＠cndag.onmicrosoft.com 08 Jun '22

08 Jun '22

Hello all About half a year ago, we started using stunnel on Solaris to secure NFS. The latest available pkg was 5.59 at that time. After a couple of months, stunnel started to core dump on several systems. We updated to the then latest version 5.63. It took again some time until core dumps occurred with 5.63 (still same stack traces). I am aware, that in the meantime 5.64 is out. We are in the process of updating it but it will take some time. Could you please have a look at the below mdb output and tell me if you need any further information to find the root cause? # mdb core.stunnel.339.60001 Loading modules: [ libc.so.1 ld.so.1 ] > ::status debugging core file of stunnel (32-bit) from xxxxxxx file: /opt/csw/bin/stunnel initial argv: /opt/csw/bin/stunnel /etc/opt/csw/stunnel/stunnel.conf start threading model: multi-threaded status: process terminated by SIGSEGV (Segmentation Fault) > $c libssl.so.1.0.0`freelist_extract+0x57(0, 2000000, 14, 42e4db16, 9bd6f8a0, eaf57a5d) > $q In the other dumps, libssl was involved as well. This is the stunnel config: setuid = nobody setgid = nogroup debug = info output = /var/adm/stunnel syslog = no options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 sslVersion=TLSv1.2 renegotiation=no options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = aes192-ctr:aes256-ctr socket = a:TCP_NODELAY=1 socket = a:SO_KEEPALIVE=1 TIMEOUTidle = 300 pid = /tmp/stunnel.pid ;include = /etc/opt/csw/stunnel/conf.d [tls-nfs-srv] accept = 31039 connect = localhost:2049 ciphers = PSK PSKsecrets = /etc/opt/csw/stunnel/psk-s.keys libwrap = yes [tls-nfs-client-1] client = yes accept = localhost:31701 connect = yyyyyy:31039 ciphers = PSK PSKsecrets = /etc/opt/csw/stunnel/psk-c.key libwrap = yes ; vim:ft=dosini Kind regards Sasha This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager.

1 0

stunnel log
by Phillip Parker 29 May '22

29 May '22

I just installed the latest version of stunnel (5.64) but there is no log file. Log file is enabled in .conf but when I run a program I don't get any log output. Help

1 0

recent Problem sending email via Blat
by Phillip Parker 25 May '22

25 May '22

I have been using stunnel and Blat for several years to send emails. Recently all the emails stopped. Interestingly I also use PowerShell to send emails and they all stopped as well. That would seem to point to something external but I have no clue what that might be. I have searched the web and have found several posts talking about (Error: Not a Socket) from Blat log but I have been unable to find a solution. In any event for stunnel I have added below the config file and the log file with debug = 7 enabled and a screen shot of netstat -an. I also believe I am running the latest version of Stunnel and Blat. Just for additional info I have attached my powershell program and the resultant error. Any help on this issue would be greatly appreciated. Incidentally I am not a stunnel or Blat person I just want things to work like they were. ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration sslversion = all ;[Protocol] protocol = smtp [ssmtp] accept = 127.0.0.1:25 connect = smtp.live.com:587 =============================================== 2022.05.21 15:03:04 LOG5[5916:5920]: Reading configuration from file stunnel.conf 2022.05.21 15:03:04 LOG7[5916:5920]: PRNG seeded successfully 2022.05.21 15:03:05 LOG7[5916:5920]: SSL context initialized for service ssmtp 2022.05.21 15:03:05 LOG5[5916:5920]: Configuration successful 2022.05.21 15:03:05 LOG5[5916:5920]: No limit detected for the number of clients 2022.05.21 15:03:05 LOG7[5916:5920]: accept socket: FD=700 allocated (non-blocking mode) 2022.05.21 15:03:05 LOG7[5916:5920]: Option SO_REUSEADDR set on accept socket 2022.05.21 15:03:05 LOG7[5916:5920]: Service ssmtp bound to 127.0.0.1:25 2022.05.21 15:03:05 LOG7[5916:5920]: Service ssmtp opened FD=700 2022.05.21 15:03:05 LOG5[5916:5920]: stunnel 4.36 on x86-pc-mingw32-gnu with OpenSSL 1.0.0d 8 Feb 2 2022.05.21 15:03:05 LOG5[5916:5920]: Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT, IPv6 2022.05.21 15:39:56 LOG7[5916:7748]: local socket: FD=692 allocated (non-blocking mode) 2022.05.21 15:39:56 LOG7[5916:7748]: Service ssmtp accepted FD=692 from 127.0.0.1:62680 2022.05.21 15:39:56 LOG7[5916:7748]: Creating a new thread 2022.05.21 15:39:56 LOG7[5916:7748]: New thread created 2022.05.21 15:39:56 LOG7[5916:11272]: Service ssmtp started 2022.05.21 15:39:56 LOG7[5916:11272]: Option TCP_NODELAY set on local socket 2022.05.21 15:39:56 LOG5[5916:11272]: Service ssmtp accepted connection from 127.0.0.1:62680 2022.05.21 15:39:56 LOG7[5916:11272]: remote socket: FD=740 allocated (non-blocking mode) 2022.05.21 15:39:56 LOG6[5916:11272]: connect_blocking: connecting 204.79.197.212:587 2022.05.21 15:39:56 LOG7[5916:11272]: connect_blocking: s_poll_wait 204.79.197.212:587: waiting 10 seconds 2022.05.21 15:40:06 LOG3[5916:11272]: connect_blocking: s_poll_wait 204.79.197.212:587: TIMEOUTconnect exceeded 2022.05.21 15:40:06 LOG5[5916:11272]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Partial screen shot of netstat -an TCP 127.0.0.1:25 0.0.0.0:0 LISTENING TCP 127.0.0.1:4444 0.0.0.0:0 LISTENING TCP 127.0.0.1:5354 0.0.0.0:0 LISTENING TCP 127.0.0.1:5354 127.0.0.1:53941 ESTABLISHED TCP 127.0.0.1:5354 127.0.0.1:58943 ESTABLISHED TCP 127.0.0.1:8884 0.0.0.0:0 LISTENING TCP 127.0.0.1:9012 0.0.0.0:0 LISTENING TCP 127.0.0.1:27015 0.0.0.0:0 LISTENING TCP 127.0.0.1:33555 0.0.0.0:0 LISTENING TCP 127.0.0.1:42424 0.0.0.0:0 LISTENING TCP 127.0.0.1:53941 127.0.0.1:5354 ESTABLISHED TCP 127.0.0.1:58943 127.0.0.1:5354 ESTABLISHED TCP 127.0.0.1:60485 0.0.0.0:0 LISTENING TCP 127.0.0.1:60961 0.0.0.0:0 LISTENING TCP 127.0.0.1:62433 0.0.0.0:0 LISTENING 2022.05.21 15:40:06 LOG7[5916:11272]: Service ssmtp finished (0 left) 2022.05.21 15:40:06 LOG7[5916:11272]: str_stats: 0 blocks, 0 bytes Blat Log 2022.05.21 15:39:56 (Sat)------------Start of Session----------------- Blat v3.2.19 (build : Nov 18 2017 03:14:35) 32-bit Windows, Full, Unicode Error: Connection to server was dropped. *** Error *** SMTP server error Error: Not a socket. Error: Not a socket. 2022.05.21 15:40:06 (Sat)-------------End of Session------------------

2 1

Unexpected EOF while Reading
by Joe Sterk 24 May '22

24 May '22

Stunnel User, When we upgrade from 5.60 to 5.63 or 5.64 we start to get the unexpected eof while reading on the SSL_accept log. I re-loaded 5.60 and the error went away. Does anyone have any ideas on what to review to solve this issue? [cid:[email protected]] Joe Sterk CIO (Chief Information Officer) [Description: Description: cid:[email protected]] Insurance Services Corp. ? (972) 896-0384 (Mobile) * (707) 303-8105 (Work) * joes(a)QuieTrack.com<mailto:[email protected]>

1 0

Stunnel - TLS error unexpected eof while reading
by rick.gregson＠gmail.com 19 May '22

19 May '22

Hi All, I have recently configured stunnel on a Windows Server, it has been configured using a certificate from our internal CA and appears to be functioning ok. However we have a load balancer that is doing a health check against the service and is polling S-Tunnel availability every 5 seconds each time a poll occurs I am seeing the error posted below in the logs. 2022.05.12 10:22:55 LOG3[4113]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.05.12 10:22:55 LOG5[4113]: Connection reset: 217 byte(s) sent to TLS, 49 byte(s) sent to socket Can I please have some advice on how to stop this error? Thank you Rick

2 3

Getting error "CERT: Pre-verification error: self signed certificate"
by Christopher Schultz 14 May '22

14 May '22

All, I'm running stunnel 4.56 as a server on Linux, as I have been doing for a while. I require clients to connect using their own client certs and yesterday one of them expired. The client generated a new certificate and sent it to me to install, and I'm getting the error in the subject. Version details: $ sudo stunnel -help stunnel 4.56 on x86_64-koji-linux-gnu platform Compiled/running with OpenSSL 1.0.2k-fips 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP I have set verify=4 because I expect to place the exact certificate for every client into my CAFile. This has been working for years, and when I connect using openssl s_client, I can see which client certificates the server advertises it will allow to connect, and they reflect what I expect. The server certificate is also self-signed, so I copied that into the CAFile and I'm able to connect with openssl s_client using that certificate. So I think the problem can't be that the client's certificate is self-signed. So, to recap: 1. stunnel in server mode 2. CAFile points to a collection of PEM certs 3. verify=4 4. I can connect with my own valid, trusted, self-signed certificate 5. Client cannot connect with their valid, trusted, self-signed cert Any ideas? (Note: the client DOES appear to be using their new certificate, though I can only see the subject text which could be the same, yet with a different actual certificate.) Here is the debug(7) output from an attempted connection: : Starting certificate verification: depth=0, [subject] : CERT: Pre-verification error: self signed certificate : Certificate check failed: depth=0, [subject] : SSL alert (write): fatal: unknown CA : SSL_accept: 14089086: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed : Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Thanks, -chris

1 1

Is stunnel really compliant with RFC 2487 / RFC 3207 ?
by Javier 13 May '22

13 May '22

Hi, first of all, I still use a 32-bit release (the latest, I think), so maybe things have changed on Stunnel since. But the statement that the protocol smtp option for a service is compliant with RFC 2487, should be 3207 (it is from 2002!), has been in the docs for ages, even in the latest version, 5.64: *** smtp Based on RFC 2487 - SMTP Service Extension for Secure SMTP over TLS *** Long ago I tested the protocol=smtp options as both, clients and server service, and I noticed that, and I think I told here to the list confirming it (maybe for some user using it on client mode), the option implied STARTTLS. Back then I didn't pay much attention to it. BUT the other day I was re-testing for a server service (own mail server sometimes I run) and... I said to my self that this shouldn't be like it was and well, I read the RFC and what tells is the following: *** A publicly-referenced SMTP server MUST NOT require use of the STARTTLS extension in order to deliver mail locally. This rule prevents the STARTTLS extension from damaging the interoperability of the Internet's SMTP infrastructure. A publicly-referenced SMTP server is an SMTP server which runs on port 25 of an Internet host listed in the MX record (or A record if an MX record is not present) for the domain name on the right hand side of an Internet mail address. *** https://datatracker.ietf.org/doc/html/rfc3207#section-4 So, if we use Stunnel to provide THE OPTION of secure TLS connections to other MTAs (MTA to MTA, or server to server) we are against the RFC itself as every connection to port 25 must be encrypted, or nothing, because, as Stunnel is the door to the port and only accepts the STARTTLS command, without redirecting any data to the mail server, no traffic on plain text reaches the server. Acting as a MSA (users - servers) there is no problem because, even if it hadn't/hasn't been widely supported, there are two ports 587 for plain text and 465 for TLS. So Stunnel could be set up to listen on 465 port only, directly accepting TLS sessions or after STARTTLS command (rejecting, in this case, those that don't want a secure channel). We have told several times, specially to newcomers (asking for http proxy, basically), that Stunnel isn't proxy, and it isn't, but in the case of a mail server it should act as is if we use it for a MTA mail server. It acts as is sending the welcome message from the mail server to the other MTA, but once the other MTA doesn't send a STARTTLS command, it closes the connection when, actually, what should do is pass all the dialog between MTAs. I think that is what Stunnel should do. And when just passing messages from mail server to the other MTA, just disable the logging for that connection. After all, the mail severs have already their own logs and there is no reason to log it on Stunnel, nor on the log screen/Stunnel window. Maybe just a line like "redirecting connection to the mail server". Said all the above, do latest versions behave differently? Do you think is a change that should be made to Stunnel to comply with the RFC, if on latest versions don't do yet, or am I wrong somewhere in my statement? Regards. P.S.: MTA: Mail Transfer Agent MSA: Mail Submission Agent MUA: Mail User Agent

3 5

GMail and OAuth 2.0
by Colin Knight 12 May '22

12 May '22

I’ve received an email from Google advising that it will no longer be able to login to Gmail with older third party apps using just username/password. Minimum login security requirements for software are now OAuth 2.0 or similar. I’m using an iPhone to post this which won’t be affected but my laptop uses POP3 collection via Foxmail and Stunnel. I must have continued access to mail on my laptop so will I have to dump Gmail or does Stunnel use OAuth 2.0 (it’s not in my config file.) Advice appreciated.

2 1

stunnel 5.64 released
by Michał Trojnara 06 May '22

06 May '22

Dear Users, I have released version 5.64 of stunnel. This release only includes Windows fixes and improvements. ### Version 5.64, 2022.05.06, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.0.3. * New features - Updated the pkcs11 engine for Windows. * Bugfixes - Removed the SERVICE_INTERACTIVE_PROCESS flag in "stunnel -install". Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: eebe53ed116ba43b2e786762b0c2b91511e7b74857ad4765824e7199e6faf883 stunnel-5.64.tar.gz 600e76b52a86b21f97a1af13734fdd2226c26646bb77f5f9f074ba3d5755f024 stunnel-5.64-win64-installer.exe 391db6166b22a6648fd1f1df584c13ade61c93f620e46b12ebb30b643e61d2d3 stunnel-5.64-android.zip Best regards, Mike

1 0

Handling AUTH LOGIN for SMTP
by reaperunknown＠live.com 22 Apr '22

22 Apr '22

Hello everyone. Perhaps I'm a little new with Stunnel but, I've successfully used it to get an old EarthLink MailStation compatible with GMail SMTP and POP mail. Kind of neat. That said, I wish to use Outlook, but going through the SMTP process manually via Telnet, I've found that the SMTP requires you issue "AUTH LOGIN" command, and give the username and password in Base64. If I do this manually, I can send SMTP mail all day. However, this unit is old enough that I don't think it knows how to do anything with SMTP auth. It also looks like Outlook doesn't turn SMTP auth off for Outlook.com personal accounts. Is there any way that I've missed to have Stunnel handle the AUTH LOGIN part of the SMTP process, so that device that can't, doesn't have to? Thanks!

2 1

Force PSK Authentication
by gerhard＠ats.hacktic.nl 19 Apr '22

19 Apr '22

Hi stunnel-users, Is there a way to force PSK Authentication? Current behavior is that if the client has no PSK Authentication configured, no authentication is performed and the connection proceeds even when the server has this configured: ciphers = PSK PSKsecrets = mypsk.txt Is this expected behavior? Is there a way to enforce PSK, in other words block clients without PSK Authentication? Thanks

2 1

Windows service won't start. ""The Stunnel TLS wrapper service is marked as an interactive service."
by robert.croteau＠quest.com 15 Apr '22

15 Apr '22

Window 10 LTCS (1089): "The Stunnel TLS wrapper service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly." looks like starting with version 5.61, this above error appears in the System Event log. I've given a quick glance at the changes from 5.60 to 5.61 and there a lot of them. From the release notes, seems that windows services code might have been affected: New features for the Windows platform - Added client mode allowing authenticated users to view logs, reconfigure and terminate running stunnel services. - Added support for multiple GUI and service instances distinguised by the location of stunnel.conf. On GitHub, I also noticed that in the source code for src/ui_win_gui.c the service is created as follows: service=CreateService(scm, SERVICE_NAME, SERVICE_DISPLAY_NAME, SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS, SERVICE_AUTO_START, SERVICE_ERROR_NORMAL, service_path, NULL, NULL, TEXT("TCPIP\0"), NULL, NULL);ui_win_gui.c at around line 1622 the SERVICE_INTERACTIVE_PROCESS flag is set Is this flag necessary? I guess that would be the culprit. my reason to upgrade is because of the CVE-2022-0778 OpenSSL vulnerability anyone has a workaround for this? Microsoft has fully disabled Interactive Service Detection starting with Windows 10 Build 1803 and Windows Server 2016 and 2019. So, it looks like that that Interactive services are no longer allowed and this can't be circumvented by changing some registry setting like it seems it was possible before. thank you

3 5

issue with vendor trying to use proxy for tls
by Daniel Trickett 14 Apr '22

14 Apr '22

Hi stunnelers, We have a supplier which we are attempting punchout to ecommerce site. We use the url http://local-val.dc-clic.com:8899/punchout/request/0fd1ef2b-d09a-441d-b161-… to initiate punchout. The host local-val.dc.clic.com routes to our local host, where stunnel is listening on port 8899. Our config file contains the following below. accept = local-val.dc-clic.com:8899 connect = val.dc-clic.com:443 The application fails to connect and is trying to connect using the incorrect url. Error Code: 202 Supplier Site Does Not Respond Unable to send the Login Request XML. Supplier Login URL: http://local-val.dc-clic.com:8899/punchout/request/0fd1ef2b-d09a-441d-b161-… We use stunnel as tls proxy for various suppliers and have been encountering more issues lately. I am feeling that the long string after the request is causing an issue for stunnel, but unclear to us. Our understanding is stunnel will open the connection to https:// val.dc-clic.com:443/punchout/request/0fd1ef2b-d09a-441d-b161-5ada0e226b80. Stunnel log indicates that a connection is opened to val.dc-clic.com. Any help appreciated! Thanks and best regards Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here: merckgroup.com/privacy-statement-countries<https://www.merckgroup.com/en/privacy-statement/privacy-statement-countries…>

1 0

stunnel log message
by Daniel Trickett 01 Apr '22

01 Apr '22

Hello all, Happy Friday! Hope I can get some clarification on this entry from the stunnel log. The below shows up in our log, our input to stunnel is SSLv3. Is that all this is referring to? TLS state (connect): SSLv3 Thanks for your reply! Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here: merckgroup.com/privacy-statement-countries<https://www.merckgroup.com/en/privacy-statement/privacy-statement-countries…>

1 0

Stunnel version 5.63 and openssl 3.0.2 CA signature digest algorithm too weak
by c t browne 30 Mar '22

30 Mar '22

I upgraded to version 5.63 on openssl 3.02 and received a CA signature digest algorithm too week error. I tried setting the securityLevel to 2 and also to 1 and the error did not go away. I have no way to change the certificate on the remove system. Is there an way around this problem? Thanks, Carter

2 2

Can parent proxy see what's going through stunnel
by mingheng wang 28 Mar '22

28 Mar '22

Hi community, I'm using stunnel behind my company proxy like this: protocol=connect connect=proxy.ourcompany.com:3128 protocolHost=myownproxy.net:443 Since I notice that our company seems to be intercepting HTTPS because my web browser sometimes sees our company's certificate instead of the real websites'. So I want to make sure if the company proxy can see what's going through stunnel. Thanks in advance.

1 0

Stunnel aborted the workflow silently in half way
by ygaochn＠amazon.com 25 Mar '22

25 Mar '22

Hey stunnel-users, We are using stunnel as the encryption transit between our NFS client and server. Recently we detected that the stunnel aborted the workflow silently in half way for unknown reason. We'd like to understand what could be the potential reason that cause the issue. Stunnel version: 4.56/5.56, below logs are for 4.56, 5.56 is from customer report without detail log Occurance #1: 2022.03.17 02:19:58 LOG7[1105:139990955783936]: connect_blocking: s_poll_wait IP:PORT: waiting 10 seconds # -> There should be a `TIMEOUTconnect exceeded` failure if the connection failed, but there is no info about how is the waiting going on, there is no log further 2022.03.17 02:56:09 LOG7[1105:139990955789440]: Dispatching signals from the signal pipe Occurance #2: 2022.03.23 16:10:49 LOG6[19003:140551554406144]: CERT: Host name "**" matched with "**" # Aborted again, this is the handshake phase 2022.03.23 16:56:09 LOG7[19003:140551554411648]: Dispatching signals from the signal pipe From the PCAP of the #2 occurance, there is no client side cert and key send to server side, so we can rule out the network issue. 8510 2022-03-23 16:09:47.660910 A B TLSv1.2 5507 Server Hello, Certificate[Packet size limited during capture] 8511 2022-03-23 16:09:47.660919 B A TCP 68 38390 → 2049 [ACK] Seq=340 Ack=5440 Win=57472 Len=0 TSval=698509941 TSecr=1821371384 ... No other client side packet send to server side afterwards, server side are waiting Does anyone encounter this before? I searched the archive but there is no similar issue. What could cause stunnel swallow all the subsequent workflow? Thanks.

1 0

Fix the expansion of @sysconfdir@ in the sample config file
by Peter Pentchev 19 Mar '22

19 Mar '22

Hi, Thanks a lot for writing and maintaining stunnel over the years! What do you think about the attached trivial patch that makes sure @sysconfdir@ is expanded correctly in the sample config file? If something should go wrong with the attachment, it is also available at: https://salsa.debian.org/debian/stunnel/-/blob/master/debian/patches/05-sam… Thanks in advance, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)debian.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

the stunnel stops showing the ssl after a few hours of operation
by Daniel Cordero Gonzalez 18 Mar '22

18 Mar '22

I send an image of the error presented by the stunnel

1 0

the stunnel stops showing the ssl after a few hours of operation
by daniel＠hostingtico.com 18 Mar '22

18 Mar '22

hello, thank you very much for the opportunity to humbly ask for help, I had a server with centos 6 for approximately 3 years and the stunnel never gave me any problem, I recently changed my server with centos 7 but now after a few hours of being active it stops showing the ssl in the ports that I have configured to show shoutcast when viewing the stunnel status: service stunnel status after a few hours it shows most of the result in red and there it does not show the shoutcast in ssl, after giving restart: service stunnel restart everything returns to normal but before 6 hours the problem returns, Could someone give me a light to solve this problem, I'm running the latest version of stunnel my stunnel.conf: client=no [Orto] accept=7000 connect=208.77.20.179:8006 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [radio] accept=7002 connect=208.77.20.179:9942 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [Metro] accept=7004 connect=208.77.20.179:8014 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [arrge] accept=7006 connect=208.77.20.179:8016 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [radio2] accept=7008 connect=208.77.20.179:9932 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [Radiored] accept=7010 connect=208.77.20.179:8023 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2

1 0

stunnel error message
by Stephen McQuaid 18 Mar '22

18 Mar '22

Hello, I am getting the following error message in stunnel 2022.03.18 14:27:01 LOG3[0]: SSL_read (s_ssl_read_eof): Operation would block (WSAEWOULDBLOCK) (10035) 2022.03.18 14:27:01 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket But when I send a second email immediately after the first one, it goes through ok, does anyone know how to resolve this please?? Regards, Stephen McQuaid Local I.T. Office, Dublin, Ireland Henkel dx - creating the next [Ein Bild, das Schild, Ende, sitzend, Front enth?lt. Automatisch generierte Beschreibung] Office : +353-1-4046338 Mobile: +353-87-2470012 stephen.mcquaid(a)henkel.com<mailto:[email protected]> www.henkeldx.com<http://www.henkeldx.com/> Have a question visit Digital Business Norden<https://henkelgroup.sharepoint.com/teams/IBSNITInfoPortal/SitePages/IBS-Nor…>

1 0

stunnel 5.63 released
by Michał Trojnara 15 Mar '22

15 Mar '22

Dear Users, I have released version 5.63 of stunnel. ### Version 5.63, 2022.03.15, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.2. * New features - Updated stunnel.spec to support bash completion. * Bugfixes - Fixed a PRNG initialization crash (thx to Gleydson Soares). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c74c4e15144a3ae34b8b890bb31c909207301490bd1e51bfaaa5ffeb0a994617 stunnel-5.63.tar.gz 723f54c28073f17b1ac095a2ab9922735c69f73fba6144a5c68cc160dc673b10 stunnel-5.63-win64-installer.exe c77850c39dfb42f95d26d4f5830a261a95c3785d8c39bdd9f28764ba43ee1d7d stunnel-5.63-android.zip Best regards, Mike

1 0

src/ssl.c:319 - RAND_get_rand_method() may return NULL
by Gleydson Soares 03 Mar '22

03 Mar '22

Hello, The following patch avoids crashess. In src/ssl.c:prng_init(), the RAND_get_rand_method() may return NULL so strict the check to skip PRNG initialization. Diff inline below, against 5.62 gsoares --- ssl.c.orig Thu Mar 3 16:10:39 2022 +++ ssl.c Thu Mar 3 16:13:17 2022 @@ -354,7 +354,7 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *global) { const RAND_METHOD *meth=RAND_get_rand_method(); /* skip PRNG initialization when no seeding methods are available */ - if(meth->status==NULL || meth->add==NULL) { + if(meth==NULL || meth->status==NULL || meth->add==NULL) { s_log(LOG_DEBUG, "No PRNG seeding methods"); return 0; /* success */ }

1 0

Error -63 when connecting to Office 365 to retrieve emails
by sedick＠logicore.co.za 01 Mar '22

01 Mar '22

Hi All, A problem started recently with error -63 when connecting to office 365 server to retrieve emails. The code I am using are as follows: * variables ChannelNo = 0 Pop3Server = 'outlook.office365.com' Pop3User = UserName Pop3Pass = Password Pop3Port = '995' ProxYServer = '127.0.0.1' ProxyPort = '110' ProxyDir = 'C:\see4OI\SSL\' ProxyExe = 'stunnel.exe' ProxyCert = 'stunnel.pem' * retreives mail in MIME format Gosub GET_EMAILS return Mail_Rec * ----------------------------------------------------------------------------------------- GET_EMAILS: * close previous session If it wasnt closed properly Code = seeClose(ChannelNo) Code = seeRelease() * attach key code Code = seeAttach(1, KeyCode) if Code < 0 then RetFlag = 1 return end * start stunnel Code = seeSetProxySSL(0, 1, ProxyDir, ProxyCert, ProxyExe) If Code < 0 Then RETURN end * connect to email server Code = seePop3ConnectSSL(ChannelNo, ProxyPort, Pop3Port, Pop3Server, Pop3User, Pop3Pass, ProxyServer) If Code < 0 Then RETURN End Help urgently required please. Stunnel version 5.42 with a special exception for OpenSSL Kind Regards, Sedick

1 0

SmtpConnectSSL question
by sportman7＠netzero.com 28 Feb '22

28 Feb '22

When I use SmtpConectSSL I establish the SSL connection but Stunnel opens a Stunnel window. I would like the connection to run without this window. Anyone know how I can stop the window from opening? Is there a setting in .conf or a parameter for SmtpConnectSSL I need?

1 0

Re: tunnel for IMAP/SMTP
by Eberhard 13 Feb '22

13 Feb '22

Just saying -- if something is deprecated it does not mean you MUST stop using it. Use an older version of the software. You can of course have both -- put the older version in one place and the newer one in another. Configure your system to use whichever version you need. The habit of always updating "just because" is sometimes not good for you 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com https://www.facebook.com/groups/286143052248115 -----Original Message----- From: Germano Massullo <germano.massullo(a)gmail.com> On Behalf Of Caterpillar Sent: Saturday, February 12, 2022 7:18 AM To: Josealf.rm <josealf(a)rocketmail.com> Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: tunnel for IMAP/SMTP Il 10/02/22 01:56, Josealf.rm ha scritto: > OK, I see you’re using stunnel only on your client and it looks you’re > connecting using TLS 1.0 which is deprecated. > > My proposed solution runs stunnel on your server and aims to implement > a front end proxy to the imap/smtp product. This can give you the > support for new TLS versions and no need to run stunnel on your clients. No, I don't have access to the mail server machine. I just installed stunnel on a localhost VM, then lowered the VM minimum accepted TLS to 1.0, and then run Thunderbird from host machine. The latter will connect to the stunnel running in the VM _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org

1 0

tunnel for IMAP/SMTP
by Caterpillar 12 Feb '22

12 Feb '22

Good day. I need to be able to use Thunderbird to connect to a mail server (IMAP/SMTP) that has an obsolete TLS version (1.1) and I don't want to low the TLS minimum version on my computers. For this need I would like to use stunnel between Thunderbid clients and the mail server. I tried to use tutorial [1] plus "sslVersion = all" option, but I think the guide is quite incomplete. Do you have any other guide/tutoral that is more complete? Thank you [1]: https://petermolnar.com/secure-smtp-and-imap-sessions-with-stunnel/

3 4

stunnel (5.62 and 5.59) causing high load...
by erik＠baigar.de 06 Feb '22

06 Feb '22

Hi there, I was running stunnel successfully for many years (4.26 with older openssl) wrapping http and imap and upgraded for security reasons to openssl 1.1.1 with stunnel 5.59. The platform is somewhat exotic: SPARC Solaris 10 using gcc 3.4.6. The stunnel works for imap and https without problems for some time but after heavy load conditions it starts consuming 100% CPU load although it still works. In this case it is not the DH computation as no ciphers depending on that one are used: 2022.02.06 11:56:33 LOG6[ui]: DH initialization skipped: no DH ciphersuites On the life machine it happens e.g. after some script based port scan attacks and in a way to trigger the phenomenon I found, that running a cipher enumberate for example triggers the "high-load" state. Running nmap 7.80 the command doing the job is nmap --script ssl-enum-ciphers -p PORT SERVER-IP Checking the log-file (level 7) the end of the logfile after such a burst of acitity with the stunnel ennding up at 100% CPU load looks like that: 2022.02.06 14:23:17 LOG7[39]: Deallocating application specific data for session connect address 2022.02.06 14:23:17 LOG7[39]: linger (local): Invalid argument (22) 2022.02.06 14:23:17 LOG7[39]: Local descriptor (FD=22) closed 2022.02.06 14:23:17 LOG7[39]: Service [imaps] finished (6 left) 2022.02.06 14:23:14 LOG7[main]: FD=4 events=0x1 revents=0x1 2022.02.06 14:23:17 LOG7[main]: FD=11 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=12 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=13 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=14 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: Dispatching a signal from the signal pipe 2022.02.06 14:23:17 LOG7[main]: Processing SIGCHLD 2022.02.06 14:23:17 LOG7[main]: Retrieving pid statuses with waitpid() 2022.02.06 14:23:17 LOG7[main]: Retrieving pid statuses with waitpid() - DONE Remarkable is that some imaps (we named the IMAP service to be wrapped imaps) still seem to remain active (6 left). The last entry always is the one with the waitpid() and to be sure that it is not the while loop in that one (stunnel.c) I added an additional log entry "DONE" in the source whenever the routine is left - so it is not that easy. The workaround currently is a script monitoring the CPU usage of stunnel and killing/restarting it if >80% for extended period of time is observed, but that can just be a temporary solution. Any ideas what to try/debug locating the reason for the problem? Thanks, Erik. P.S. Experimenting with the timeouts does not alter the phenomenon. P.P.S. Here the active lines of the config file (deleted comments and unused lines to remove clutter): cert = /usr/local/etc/stunnel/stunnel.pem sslVersion = all chroot = /var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [imaps] accept = 14310 connect = 143 local = 127.0.0.1

1 0

Re: stunnel 5-15 minute outages
by Eberhard 05 Feb '22

05 Feb '22

I a hate to sound like a broken record – why not at least try inetd mode for a few days? If nothing else it will tell you if it is stunnel (either server issues or problems with continuing running programs) with little cost to you to try it. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com> Sent: Saturday, February 5, 2022 3:01 AM To: john.robertson.arnold(a)gmail.com Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: stunnel 5-15 minute outages We haven't taken any actions yet. We have so far believed that it was a network side issue, so we have been looking hard at the network devices and getting vendor cases open. We have been looking at packet captures to see if we can figure it out. We haven't found anything that points to the network, but still looking at that. Do you happen to have any load balancers in front of stunnel? I plan to recommend some changes to stunnel suggested in this thread. Thanks, and sorry you are facing this same issue. On Fri, Feb 4, 2022 at 11:36 PM <john.robertson.arnold(a)gmail.com <mailto:[email protected]> > wrote: I second your problem! We are experiencing what sounds like the same issue. We have had 8 outages since November. They come in pairs, roughly 48 hours apart. Each outage is between 10-12 minutes, then self resolves. I literally just came to this thread tonight while troubleshooting the latest outage. Did the suggestion in the thread work for you? _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org <mailto:[email protected]> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org <mailto:[email protected]> -- Steve Clement steve3279(a)gmail.com <mailto:[email protected]> 614-632-7380

1 0

Re: stunnel 5-15 minute outages
by Eberhard 05 Feb '22

05 Feb '22

Which is why my advice is “strange.” We support so many Unix versions with thousands of users of various capabilities. I don’t want to have to learn secret tricks – especially as they change with versions of the O/S. So I use inetd – all the same on every O/S and always works. I see no reason not to do this unless you have a belief that there is a performance issue with it, which is possible I suppose but I suspect completely unlikely in modern computers. Further, inetd is running anyway so the server part is hardly affected by stunnel whereas if you use stunnel in server mode it has overhead … so a real picky person would do performance analysis and it still may be more efficient to use inetd depending on server overhead. Which is like different by O/S and computer hardware and … I worry about performance only when it actually matters. I’d rather concern myself with reliable with less maintenance on my part. My primary O/S is AIX which is stone reliable and requires little fussing with – hence using AIX to do the server part (inetd) makes my life easier. And probably 95% of the people here will disagree with me and that is fine because there is no “right” answer, just choices. I just think some people dismiss inetd out of hand because they were told a decade or two ago (I am old 😊 ) that performance was an issue and that remains the legend. And, I have helped several people overcome issues by changing to inetd, especially those with little experience in server management and/or O/S settings like Danny did (good job!). So please don’t flame me people – this is just explaining why one might consider using inetd mode, not making a case to always use it. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Danny Clowes <danny0809881(a)gmail.com> Sent: Friday, February 4, 2022 1:21 PM To: Eric Eberhard <flash(a)vicsmba.com> Cc: Steve Clement <steve3279(a)gmail.com>; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re: stunnel 5-15 minute outages Hi, Ive been using stunnel on number of servers for very long time over all experience has been very good not had any issues or concerns with the stunnel they never crash always online. Ive just tested stunnel on debian 11 it's working brilliant. The Linux system do have limitations in place and the client will only allow so many connections before it will close down say can't take anymore connections however I edited the Linux server remove limitation in place. These where teething issues when started to use stunnel. If anyone interested I would provide hidden scrects how make stunnel work like dream. On Fri, 4 Feb 2022, 19:04 Eberhard, <flash(a)vicsmba.com <mailto:[email protected]> > wrote: I will give you strange advice assuming you are on Unix of some flavor. Use inetd. It always works or the O/S does not work 😊 It then becomes the actual server and a new instance of stunnel is fired for every connection. I use it because it is the most reliable way and takes no server software management. There is an old argument against this – it is in theory has less performance when a correction is created. I say theoretical as modern computers are so fast that creating a process millions of times does not stress a machine. I run 100s of millions of connections daily on a single computer and have zero performance issues. I also have zero issues like you described and I always had them before. Even if you do have an issue it would only affect one connection. Because each connection is unique. From your description it is the server process having an issue or perhaps some of the children not getting “clean” as they keep them running in a loop. With inetd it does it’s business and ends. There are no cross-connection or server issues. I give this advice several times a year and may ¼ take it and thank me. The rest mock the idea citing the theoretical performance difference (without even trying it) and continue to struggle. This is not just an issue with this version. Many versions have had trouble with running in a loop like that – memory management, variables not cleared, etc. And remember openssl is tied to this as well. The other thing I would recommend (also weird) is using static links. That way an install of say a new openssl (where your encryption issue appears to be now) won’t affect you. There is no way anyone is testing the software with every version of every O/S with every version of openssl. If you do a static link and have a working version, no need to change. Until a new TLS comes out or something but you can control that well when you have a static link. And that, BTW, theoretically loads faster. The program is much bigger but in need not load dynamic libraries from all over the place when it is fired up. Let me know what you find out and do 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com <mailto:[email protected]> > Sent: Friday, February 4, 2022 4:52 AM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] stunnel 5-15 minute outages Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com <mailto:[email protected]> 614-632-7380 _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org <mailto:[email protected]> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org <mailto:[email protected]>

3 2

stunnel 5-15 minute outages
by Steve Clement 05 Feb '22

05 Feb '22

Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com 614-632-7380

2 2

Re: stunnel 5-15 minute outages
by Eberhard 04 Feb '22

04 Feb '22

I will give you strange advice assuming you are on Unix of some flavor. Use inetd. It always works or the O/S does not work 😊 It then becomes the actual server and a new instance of stunnel is fired for every connection. I use it because it is the most reliable way and takes no server software management. There is an old argument against this – it is in theory has less performance when a correction is created. I say theoretical as modern computers are so fast that creating a process millions of times does not stress a machine. I run 100s of millions of connections daily on a single computer and have zero performance issues. I also have zero issues like you described and I always had them before. Even if you do have an issue it would only affect one connection. Because each connection is unique. From your description it is the server process having an issue or perhaps some of the children not getting “clean” as they keep them running in a loop. With inetd it does it’s business and ends. There are no cross-connection or server issues. I give this advice several times a year and may ¼ take it and thank me. The rest mock the idea citing the theoretical performance difference (without even trying it) and continue to struggle. This is not just an issue with this version. Many versions have had trouble with running in a loop like that – memory management, variables not cleared, etc. And remember openssl is tied to this as well. The other thing I would recommend (also weird) is using static links. That way an install of say a new openssl (where your encryption issue appears to be now) won’t affect you. There is no way anyone is testing the software with every version of every O/S with every version of openssl. If you do a static link and have a working version, no need to change. Until a new TLS comes out or something but you can control that well when you have a static link. And that, BTW, theoretically loads faster. The program is much bigger but in need not load dynamic libraries from all over the place when it is fired up. Let me know what you find out and do 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com> Sent: Friday, February 4, 2022 4:52 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel 5-15 minute outages Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com <mailto:[email protected]> 614-632-7380

2 1

Use Stunnel with CMD
by gilaguigui＠gmail.com 02 Feb '22

02 Feb '22

Hi, I am trying to use stunnel with CMD (as a service) I get pop up message for each command (service installed \ service stopped etc.) the command in CMD: stunnel.exe -install\ -uninstall.... how can I disable it? run stunnel with no pop up? thanks GG.

1 0

New to stunnel! Need help connecting to a REST API
by Tim Townsend 18 Jan '22

18 Jan '22

Hello! I need help! We have an integration from an ERP package to a REST API (Avatax) that will soon be requiring TLS 1.2 connections. Our tech platform does not have built-in support for TLS 1.2, so I'm hoping to be able to use stunnel to make that happen. Where do I start? What would the conf file section look like for this? I don't see this directly discussed in the documentation. Any help appreciated! [cid:[email protected]] Tim Townsend Programmer Earnest & Associates * Profitability Improvement Specialists Voice: 410.766.6076<tel:+14107666076> ext 210 Email: tim.townsend(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/>

1 0

stunnel 5.62 released
by Michał Trojnara 17 Jan '22

17 Jan '22

Dear Users, I have released version 5.62 of stunnel. ### Version 5.62, 2022.01.17, urgency: MEDIUM * New features - Added a bash completion script. * Bugfixes - Fixed a transfer() loop bug. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 9cf5bb949022aa66c736c1326554cca27d0641605a6370274edc4951eb5bd339 stunnel-5.62.tar.gz fbfcc5759344bcafff9ff3bc6cf56c7fb75cb1244b76d4934c5d9a3eb7eee32d stunnel-5.62-win64-installer.exe 4b52ed6e4bb8293fdefb10ee8c271400a8c1749254a11b674ff690eae00b3c5e stunnel-5.62-android.zip Best regards, Mike

1 0

Re: stunnel 5.61transfer() loop executes not transferring any data Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket inetd mode
by Roberto CORRADO 17 Jan '22

17 Jan '22

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Mike, Good job! Stunnel 5.62 beta 1 work fine! """ 2022.01.16 22:08:47 LOG6[ui]: Initializing inetd mode configuration 2022.01.16 22:08:47 LOG5[ui]: stunnel 5.62 on i586-slackware-linux-gnu platform 2022.01.16 22:08:47 LOG5[ui]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2022.01.16 22:08:47 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2022.01.16 22:08:47 LOG6[ui]: Initializing inetd mode configuration 2022.01.16 22:08:47 LOG5[ui]: Reading configuration from file /etc/stunnel/imaps.conf 2022.01.16 22:08:47 LOG5[ui]: UTF-8 byte order mark not detected 2022.01.16 22:08:47 LOG5[ui]: FIPS mode disabled 2022.01.16 22:08:47 LOG6[ui]: Compression enabled: 0 methods 2022.01.16 22:08:47 LOG6[ui]: stunnel default security level set: 2 2022.01.16 22:08:47 LOG6[ui]: Session resumption enabled 2022.01.16 22:08:47 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: DH initialization needed for DHE-RSA-AES256-GCM-SHA384 2022.01.16 22:08:47 LOG6[ui]: 4096-bit DH parameters loaded 2022.01.16 22:08:47 LOG5[ui]: Configuration successful 2022.01.16 22:08:47 LOG5[0]: Service [stunnel] accepted connection from 10.19.79.235:41136 2022.01.16 22:08:47 LOG6[0]: Peer certificate not required 2022.01.16 22:08:47 LOG6[0]: No peer certificate received 2022.01.16 22:08:47 LOG6[0]: Session id: 65640462303D0DA1CD16CAB4977F22B04FFB74693150104FC69AB9FBDC48AED9 2022.01.16 22:08:47 LOG6[0]: No peer certificate received 2022.01.16 22:08:47 LOG6[0]: Session id: B9505D917FA6F2E9C8A0EF14D6E4B01C3ED54599271D93E325ED7412CA2AC5F3 2022.01.16 22:08:47 LOG6[0]: TLS accepted: new session negotiated 2022.01.16 22:08:47 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.01.16 22:08:47 LOG6[0]: Peer temporary key: X25519, 253 bits 2022.01.16 22:08:47 LOG6[0]: Local mode child started (PID=16984) 2022.01.16 22:08:47 LOG6[0]: TLS closed (SSL_read) 2022.01.16 22:08:47 LOG6[0]: Read socket closed (readsocket) 2022.01.16 22:08:47 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2022.01.16 22:08:47 LOG5[0]: Connection closed: 979 byte(s) sent to TLS, 128 byte(s) sent to socket """ Thanks a lot! - -Roberto -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAmHkjDoACgkQWVOoL214ZeGntwCbBtV1G/J2uThR06ftFC+F2XTP KeQAnjnCTOrk26zzcsNsCOQoWg54MWhD =alm2 -----END PGP SIGNATURE----- ----- Original Message ----- Sent: Sunday, January 16, 2022 9:52 PM Michał Trojnara wrote: > Hi Roberto, > > Could you try https://www.stunnel.org/downloads/beta/stunnel-5.62b1.tar.gz ? > > Best regards, > Mike

2 1

I NEED A HELP TO SETUP THE SSL/TLS EMAILS SUPPORT
by Muj 01 Jan '22

01 Jan '22

HI TECHNICAL SUPPORT, FIRSTLY, I AM APOLOGIZING TO YOU FOR WRITING WITH LARGE CAPS ONLY, IT IS BECAUSE RECENTLY I GOT A BRAIN STROKE AND AM NOT RECOVERED YET. AS FOR MY ISSUE, TO UNDERSTAND IT BETTER, THE FOLLOWING IS MY INFO. - I HAVE AN OLD WINDOWS-XP 32BIT OS. - I AM USING TERABYTE 2.99 TO BACKUP AND RESTORE MY OS, BUT LOOSING MANY EMAILS BECAUSE TERABYTE IS NO LONGER SUPPORTING 2.99 VERSION. THEY SUPPORT RESTORING ALL EMAILS BEGINNING FROM 3 VERSION. THEREFORE, THEY HAVE RECOMMENDED ME TO CONTACT YOU DIRECTLY. NOW WHAT I DID SO FAR. - I DOWNLOADED AND INSTALLED YOUR STUNNEL 4.53 - AFTER AUTOMATIC SETTING, EDITING STUNNEL.CONF FILE, MAKING SOME CHANGES IN IT AND SAVING IT, THE SERVER WENT DOWN. ATTACHED PLEASE FIND STUNNEL.CONF TXT FILE. - BECAUSE THE SERVER WENT DOWN, I TRIED TO DOWNLOAD AND INSTALL STUNNEL AGAIN, BUT ALWAYS GOT THE SAME ERROR MESSAGE.PLEASE CAN YOU HELP ME WITH THIS ISSUE? - I HAVE 3 POP3 EMAIL ACCOUNTS AND 1 IMAP. ALL REQUIRE A CONNECTION SECURITY SSL/TLS. *PLEASE, I NEED TO KNOW HOW **TO COMPLETELY REMOVE THE CURRENT STUNNEL PROGRAM AND AFTER THAT, WHAT STUNNEL VERSION I SHOULD **DOWNLOAD AGAIN **TO BE ABLE TO SET IT UP*. AFTER A SUCCESSFUL NEW INSTALLATION I WOULD GIVE YOU MORE NEEDED INFO FOR SETTING UP MY EMAILS. PLEASE LET ME KNOW IN YOUR BEST CONVENIENCE AND HAVE A BEAUTIFUL NEW YEAR 2022. KIND REGARDS, MARTIN

1 0

stunnel 5.61transfer() loop executes not transferring any data Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket inetd mode
by Roberto CORRADO 29 Dec '21

29 Dec '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 """ 2021.12.28 14:03:40 LOG6[ui]: Initializing inetd mode configuration 2021.12.28 14:03:40 LOG5[ui]: stunnel 5.61 on i586-slackware-linux-gnu platform 2021.12.28 14:03:40 LOG5[ui]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2021.12.28 14:03:40 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.12.28 14:03:40 LOG6[ui]: Initializing inetd mode configuration 2021.12.28 14:03:40 LOG5[ui]: Reading configuration from file /etc/stunnel/imaps.conf 2021.12.28 14:03:40 LOG5[ui]: UTF-8 byte order mark not detected 2021.12.28 14:03:40 LOG5[ui]: FIPS mode disabled 2021.12.28 14:03:40 LOG6[ui]: Compression enabled: 0 methods 2021.12.28 14:03:40 LOG6[ui]: stunnel default security level set: 2 2021.12.28 14:03:40 LOG6[ui]: Session resumption enabled 2021.12.28 14:03:40 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: DH initialization skipped: no DH ciphersuites 2021.12.28 14:03:40 LOG5[ui]: Configuration successful 2021.12.28 14:03:40 LOG5[0]: Service [stunnel] accepted connection from 127.0.0.1:40876 2021.12.28 14:03:40 LOG6[0]: Peer certificate not required 2021.12.28 14:03:40 LOG6[0]: No peer certificate received 2021.12.28 14:03:40 LOG6[0]: Session id: 0E092C2715D12901219C3E0F54DFA029F7C50040C7EC8F8C88211BA6883B9D1F 2021.12.28 14:03:40 LOG6[0]: No peer certificate received 2021.12.28 14:03:40 LOG6[0]: Session id: 26CFB9D13C499CE27C4ED1575FDF3FB2604C616418BA6068849B49EF75AF2162 2021.12.28 14:03:40 LOG6[0]: TLS accepted: new session negotiated 2021.12.28 14:03:40 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2021.12.28 14:03:40 LOG6[0]: Peer temporary key: X25519, 253 bits 2021.12.28 14:03:40 LOG6[0]: Local mode child started (PID=4997) 2021.12.28 14:03:40 LOG3[0]: transfer() loop executes not transferring any data 2021.12.28 14:03:40 LOG3[0]: please report the problem to Michal.Trojnara(a)stunnel.org 2021.12.28 14:03:40 LOG3[0]: stunnel 5.61 on i586-slackware-linux-gnu platform 2021.12.28 14:03:40 LOG3[0]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2021.12.28 14:03:40 LOG3[0]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.12.28 14:03:40 LOG3[0]: protocol=TLSv1.3, SSL_pending=0, SSL_has_pending=0 2021.12.28 14:03:40 LOG3[0]: sock_open_rd=Y, sock_open_wr=Y 2021.12.28 14:03:40 LOG3[0]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2021.12.28 14:03:40 LOG3[0]: sock_can_rd=n, sock_can_wr=n 2021.12.28 14:03:40 LOG3[0]: ssl_can_rd=n, ssl_can_wr=n 2021.12.28 14:03:40 LOG3[0]: read_wants_read=Y, read_wants_write=n 2021.12.28 14:03:40 LOG3[0]: write_wants_read=n, write_wants_write=Y 2021.12.28 14:03:40 LOG3[0]: shutdown_wants_read=n, shutdown_wants_write=n 2021.12.28 14:03:40 LOG3[0]: socket input buffer: 154 byte(s), TLS input buffer: 0 byte(s) 2021.12.28 14:03:40 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket """ """ debug = info output = /var/log/stunnel-imaps.log cert = /etc/stunnel/stunnel.pem exec = /usr/sbin/imapd execargs = imapd sslVersion = all options = NO_SSLv2 options = NO_SSLv3 """ -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAmHLE48ACgkQWVOoL214ZeFpYwCfe+qv09KWSfjNixhhcb5MJbr2 yAkAoKOyXZJwnKddSXYzIhbi7k1yPkoU =oGR+ -----END PGP SIGNATURE-----

1 0

Config to only listen when connect port is up
by roartysa＠gmail.com 23 Dec '21

23 Dec '21

Is there a config flag that can be set in the conf file that will tell stunnel to listen on the https accept port only when the connect port is up and listening? The issue i am trying to address is when a load balancer talks to a server, I need to make sure the port that stunnel redirects to is healthy. Right now the load balancer will send traffic to the port all the time regardless of the health of the port that stunnel redirects the traffic to.

2 1

stunnel 5.61 released
by Michał Trojnara 22 Dec '21

22 Dec '21

Dear Users, I have released version 5.61 of stunnel. ### Version 5.61, 2021.12.22, urgency: LOW * New features sponsored by the University of Maryland - Added new "protocol = capwin" and "protocol = capwinctrl" configuration file options. * New features for the Windows platform - Added client mode allowing authenticated users to view logs, reconfigure and terminate running stunnel services. - Added support for multiple GUI and service instances distinguised by the location of stunnel.conf. - Improved log window scrolling. - Added a new 'Pause auto-scroll' GUI checkbox. - Double click on the icon tray replaced with single click. - OpenSSL DLLs updated to version 3.0.1. * Other new features - Rewritten the testing framework in python (thx to Peter Pentchev for inspiration and initial framework). - Added support for missing SSL_set_options() values. - Updated stunnel.spec to support RHEL8. * Bugfixes - Fixed OpenSSL 3.0 build. - Fixed reloading configuration with "systemctl reload stunnel.service". - Fixed incorrect messages logged for OpenSSL errors. - Fixed printing IPv6 socket option defaults on FreeBSD. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 91ea0ca6482d8f7e7d971ee64ab4f86a2817d038a372f0893e28315ef2015d7a stunnel-5.61.tar.gz 19c5ff1f4101af1e69585328303c14249db2ec9063542101ca31edb6f6cc502f stunnel-5.61-win64-installer.exe 928ec94690564498bf523228946b2cdc90c7e346d6f0baf1f71b76cbe769b96c stunnel-5.61-android.zip Best regards, Mike

1 0

Log4j Vulnerability
by Tracy Drake - IQGC-C 17 Dec '21

17 Dec '21

Hello! Can you please tell me if Stunnel uses log4j and/or if it is vulnerable to it? Your feedback would be greatly appreciated! Thanks in advance! -- *TRACY DRAKE | CSM URSA/Infoconnect Training and Support* GSA COMET Hale Bopp Contract Work Phone: 704-253-5193 | Email: tracy.drake(a)gsa.gov

2 1

issue with connection sending cxml out
by Daniel Trickett 08 Dec '21

08 Dec '21

Hi, We are trying to send a cxml message from an old app using ssl_v3 to a client server using tls 1.2. We negotiate a connection and then the below happens. Any thoughts? This is on our test server. 2021.12.08 14:26:55 LOG6[12]: TLS connected: new session negotiated 2021.12.08 14:26:55 LOG6[12]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2021.12.08 14:26:55 LOG7[12]: Compression: null, expansion: null 2021.12.08 14:26:55 LOG7[12]: TLS alert (read): warning: close notify <<< 2021.12.08 14:26:55 LOG6[12]: TLS closed (SSL_read) 2021.12.08 14:26:55 LOG7[12]: Sent socket write shutdown 2021.12.08 14:26:55 LOG6[12]: Read socket closed (readsocket) 2021.12.08 14:26:55 LOG7[12]: Sending close_notify alert 2021.12.08 14:26:55 LOG7[12]: TLS alert (write): warning: close notify 2021.12.08 14:26:55 LOG6[12]: SSL_shutdown successfully sent close_notify alert 2021.12.08 14:26:55 LOG5[12]: Connection closed: 10187 byte(s) sent to TLS, 561 byte(s) sent to socket Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here emdgroup.com/en/privacy-statement.html<https://www.emdgroup.com/en/privacy-statement.html>

1 0

Revert automatically to https
by cnocera＠hyhat.com 08 Dec '21

08 Dec '21

With stunnel, is there a way for the website to automatically revert to https by just typing in the url without https:// in front of it?

1 0

Insecure file permissions on /etc/ssl/private.key
by jose isaias cabrera 29 Nov '21

29 Nov '21

Greetings! I have duckduckgo'ed and I have not found an answer, but what should be the permissions for the private key since the stunnel is giving me a warning/error regarding that: ... [ ] Loading private key from file: /etc/ssl/private.key [:] Insecure file permissions on /etc/ssl/private.key [ ] Private key loaded from file: /etc/ssl/private.key ... this is that I have set: jic@web:~$ ls -l /etc/ssl/private.key -rw-r--r-- 1 root www-data 1702 Oct 13 02:54 /etc/ssl/private.key the www-data is the user that runs the website. All is running well, apparently, but, I would like to set the correct permission on the private.key file. Thanks for your support. josé -- What if eternity is real? Where will you spend it? Hmmmm...

4 6

Althttpd web server setup using ZeroSSL
by jose isaias cabrera 29 Nov '21

29 Nov '21

Greetings! I have the ssl files from ZeroSSL, and I am trying to set up https using stunnel4 on an ubuntu server. I am new to https, I would love some of your help setting this up. Here is what I have done so far: 1. Installed Althttpd and http is working fine on the home network and from the external network. 2. I have installed stunnel4 on the ubuntu server jcabrera@selva:~$ stunnel -v [ ] Clients allowed=500 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled with OpenSSL 1.1.1c 28 May 2019 [.] Running with OpenSSL 1.1.1f 31 Mar 2020 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [!] Invalid configuration file name "-v" [!] realpath: No such file or directory (2) [ ] Deallocating section defaults 3. I have placed the ZeroSSl ssl files on the ssl directory as per ZeroSSL instructions jcabrera@selva:~$ ls -l /etc/ssl/*.crt -rw-r--r-- 1 root root 2431 Oct 20 16:27 /etc/ssl/ca_bundle.crt -rw-r--r-- 1 root root 2354 Oct 20 16:31 /etc/ssl/certificate.crt root@selva:/home/jcabrera# ls -l /etc/ssl/private/*.key -rw-r--r-- 1 root root 1702 Oct 20 16:33 /etc/ssl/private/private.key 4. Created the the /etc/stunnel/stunnel.conf file with these entries: root@selva:/home/jcabrera# cat /etc/stunnel/stunnel.conf cert = /etc/ssl/certificate.crt key = /etc/ssl/private/private.key \[https\] accept = :::443 TIMEOUTclose = 0 exec = /usr/bin/althttpd execargs = /usr/bin/althttpd -logfile ~/www/http.log -root ~/www -user www-data -https 1 And, I don't know what else to do. Any help would be greatly appreciated. Thanks. josé -- What if eternity is real? Where will you spend it? Hmmmm...

2 3

Office 365 connections stopped working
by Ben Bazian 26 Nov '21

26 Nov '21

This has been working for years and recently stopped. I am a novice here. Can someone look at this and please tell me what is happening? It is an old server that does not support TLS so we put Stunnel in front of it. I am sure the version of stunnel is pretty old. Maybe a TLS level issue? 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG6[21968:139797665822784]: Initializing service [SMTP Outgoing] 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG6[21968:139797665822784]: Initializing service [IMAP] 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG5[21968:139797665822784]: Configuration successful 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [POP3 Incoming] (FD=12) bound to 0.0.0.0:110 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [SMTP Outgoing] (FD=13) bound to 0.0.0.0:25 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [IMAP] (FD=14) bound to 0.0.0.0:143 2021.10.26 14:47:30 LOG7[21974:139797665822784]: Created pid file /var/run/stunnel.pid 2021.10.26 14:48:30 LOG7[21974:139797665822784]: Service [IMAP] accepted (FD=3) from 10.55.3.159:1852 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] started 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Waiting for a libwrap process 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Acquired libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Releasing libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Released libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] permitted by libwrap from 10.55.3.159:1852 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Service [IMAP] accepted connection from 10.55.3.159:1852 2021.10.26 14:48:30 LOG6[21974:139797665818368]: connect_blocking: connecting 52.96.87.226:993 2021.10.26 14:48:30 LOG7[21974:139797665818368]: connect_blocking: s_poll_wait 52.96.87.226:993: waiting 10 seconds 2021.10.26 14:48:30 LOG5[21974:139797665818368]: connect_blocking: connected 52.96.87.226:993 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Service [IMAP] connected remote server from 10.55.3.200:51358 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Remote socket (FD=16) initialized 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SNI: sending servername: outlook.office365.com 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SSL state (connect): before/connect initialization 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SSL state (connect): SSLv3 write client hello A 2021.10.26 14:48:30 LOG3[21974:139797665818368]: SSL_connect: Peer suddenly disconnected 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Remote socket (FD=16) closed 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Local socket (FD=3) closed 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] finished (0 left)

4 5