- stunnel-users - stunnel.org

Re: [stunnel-users] Stunnel as windows service doesn't start on restart.
by josealf＠rocketmail.com 22 Sep '14

22 Sep '14

John. Looks fine to me. Same configuration works in my Windows 7 64 bits. I have no access to Windows Server 2008 R2, but I would expect it to work the same. What are you securing with stunnel?... Perhaps the service you are securing is starting after stunnel? -----Original Message----- From: John Smith <java.dev.mtl(a)gmail.com> Date: Mon, 22 Sep 2014 11:09:21 To: Jose Diaz<josealf(a)rocketmail.com> Subject: Re: [stunnel-users] Stunnel as windows service doesn't start on restart. SERVICE_NAME: stunnel TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\Program Files (x86)\stunnel\stunnel.exe" -service -install LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Stunnel SSL wrapper DEPENDENCIES : TCPIP SERVICE_START_NAME : LocalSystem On 22 September 2014 11:02, John Smith <java.dev.mtl(a)gmail.com> wrote: > After reboot? > > On 22 September 2014 10:11, <josealf(a)rocketmail.com> wrote: > >> >> Interesting. Please execute >> >> sc qc stunnel >> >> And post the output. >> >> >> >> -----Original Message----- >> From: John Smith <java.dev.mtl(a)gmail.com> >> Sender: "stunnel-users" <stunnel-users-bounces(a)stunnel.org> >> Date: Mon, 22 Sep 2014 09:54:10 >> To: Michal Trojnara<Michal.Trojnara(a)mirt.net> >> Cc: <stunnel-users(a)stunnel.org> >> Subject: Re: [stunnel-users] Stunnel as windows service doesn't start on >> restart. >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> >> >> >

2 3

stunnel beta (5.04b1) is available for testing
by Michal Trojnara 22 Sep '14

22 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys, Please feel free to try the beta version I just made available for download: https://www.stunnel.org/downloads/beta/stunnel-5.04b1.tar.gz https://www.stunnel.org/downloads/beta/stunnel-5.04b1-installer.exe The list of changes includes most of the issues recently discussed on the stunnel-users mailing list and more. * New features - Support for local mode ("exec" option) on Win32. - A more explicit service description provided for the Windows SCM (thx to Pierre Delaage). - TCP/IP dependency added for NT service in order to (hopefully) prevent initialization failure at boot time. - FIPS canister updated to version 2.0.8 in the Win32 binary build. * Bugfixes - load_icon_default() modified to return copies of default icons instead of the original resources to prevent the resources from being destroyed. - Reportedly more compatible values used for the dwDesiredAccess parameter of the CreateFile() function (thx to Pierre Delaage). - Partially merged UNICODE compilation fixes (thx to Pierre Delaage). - Partially merged Windows CE patches (thx to Pierre Delaage). - Fixed typos in stunnel.init.in and vc.mak. - Fixed incorrect memory allocation statistics update in str_realloc(). - Missing REMOTE_PORT environmental variable is provided to processes spawned with "exec" on Unix platforms. - Taskbar icon is no longer disabled for NT service. Some basic examples for local mode ("exec" option) on Windows: ; Service based on a command-line tool [netstat] accept = 8015 exec = c:\windows\system32\netstat.exe execargs = netstat -a ; Remote cmd.exe protected with SSL ; Certificate-based authentication needs to be configured here! [cmd] accept = 1337 exec = c:\windows\system32\cmd.exe Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQYYkoACgkQ/NU+nXTHMtGmfwCfSdHFmK8q5IRcS/CoFmYMZ40G zUEAoNUrIp0KAJ4+0LPwx+/1lJG6q2q/ =aSXM -----END PGP SIGNATURE-----

3 11

Support for PSK
by Thomas Conté 21 Sep '14

21 Sep '14

Hello everyone, In the context of an embedded project, I have developed a lightweight, PolarSSL-based TLS-PSK client running on an Arduino board. Now I am looking for a generic server-side solution to connect the TLK-PSK client to a few Web services living in various app servers (Node.JS, IIS, and others). Since PSK support is not widespread, I am thinking about using stunnel as a generic front-end to these services. I have done a quick-and-dirty POC of adding PSK support to stunnel and it looks like this could be done with minor modifications, e.g. adding a call to SSL_CTX_set_psk_server_callback and the corresponding callback to ctx.c. Right now the psk_key and psk_identity values are hard-coded, so of course those need to be added to the configuration file. Is the community interested in further work in that area? Or is PSK support already in the stunnel roadmap? Cheers, -- Thomas Conté.

2 1

stunnel 5.04 released
by Michal Trojnara 21 Sep '14

21 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.04 of stunnel. The ChangeLog entry: Version 5.04, 2014.09.21, urgency: LOW: * New features - Support for local mode ("exec" option) on Win32. - Support for UTF-8 config file and log file. - Win32 UTF-16 build (thx to Pierre Delaage for support). - Support for Unicode file names on Win32. - A more explicit service description provided for the Windows SCM (thx to Pierre Delaage). - TCP/IP dependency added for NT service in order to prevent initialization failure at boot time. - FIPS canister updated to version 2.0.8 in the Win32 binary build. * Bugfixes - load_icon_default() modified to return copies of default icons instead of the original resources to prevent the resources from being destroyed. - Partially merged Windows CE patches (thx to Pierre Delaage). - Fixed typos in stunnel.init.in and vc.mak. - Fixed incorrect memory allocation statistics update in str_realloc(). - Missing REMOTE_PORT environmental variable is provided to processes spawned with "exec" on Unix platforms. - Taskbar icon is no longer disabled for NT service. - Fixed taskbar icon initialization when commandline options are specified. - Reportedly more compatible values used for the dwDesiredAccess parameter of the CreateFile() function (thx to Pierre Delaage). - A number of minor Win32 GUI bugfixes and improvements. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: ee9702e073cb8d5940a1310ae171a38d3264f1ce3b087160728bbbcf5710cec1 stunnel-5.04.tar.gz 045145b4e6ef66d29774b558837bd693a0dbab9f7295586da9e5f0de4c5a7481 stunnel-5.04-installer.exe d1bc5c00278f31c64ad4a601d9e398b21284777f9079e91b8cbaef1e8e91f538 stunnel-5.04-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQfAqsACgkQ/NU+nXTHMtH1cACeLEi7tFSEoxYJCfZROeaTLD4J +8sAoKK+l/6Bjl2sLwPRTcmw/Vj4+PYy =F0H9 -----END PGP SIGNATURE-----

1 0

GnuTLS port
by Max 20 Sep '14

20 Sep '14

Pardon if that was asked before, but are there port of stunnel to GnuTLS available somewhere? With recent fallout from heartbleed I'm looking into getting rid of openssl (besides I've never liked the license anyway :) and stunnel is one of the very few programs which got dependency on it. cheers, Max.

2 1

stunnel beta (5.04b2) is available for testing
by Michal Trojnara 19 Sep '14

19 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys, Please feel free to try the second beta version: https://www.stunnel.org/downloads/beta/stunnel-5.04b2.tar.gz https://www.stunnel.org/downloads/beta/stunnel-5.04b2-installer.exe I have finished implementing Win32 UNICODE support. The following planned features depend on UNICODE support: - Non-ASCII path names (this is already partially implemented) - UTF8 stunnel.conf - Windows CE GUI stunnel 5.04b2 also fixes missing taskbar icon when stunnel is executed with commandline switches (for example "stunnel -help"). Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQcnAcACgkQ/NU+nXTHMtHOnQCeJFPogmAyhDFQ+CoLT17nhd1I CSIAni1tOnInyScnXwB/d876RF0o9YYt =PJ+o -----END PGP SIGNATURE-----

1 0

400 - Bad Request
by j nasty 17 Sep '14

17 Sep '14

I'm trying to access a web service endpoint using sTunnel to handle all the SSL traffic. For my other connection setups this works perfectly fine. But for this one particular client I'm getting a 400 - Bad Request Error. Client Configuration looks like this: [Connection1] client = yes accept = 127.0.0.1:9006 connect = server.com:443 Response I get back is: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>400 Bad Request</title> </head><body> <h1>Bad Request</h1> <p>Your browser sent a request that this server could not understand.<br /> Reason: You're speaking plain HTTP to an SSL-enabled server port.<br /> Instead use the HTTPS scheme to access this URL, please.<br /> <blockquote>Hint: <a href="https://server.com/"><b>https://server.com/</b></a></blockquote></p> </body></html> Is there a setting configuration I can use so that sTunnel redirects to https://server.com instead of server.com:443? Thanks in advance, Jake

2 1

Re: [stunnel-users] Stunnel Windows Server 2008 R2
by Pierre DELAAGE 01 Sep '14

01 Sep '14

Ok, thank you very much. I am pushing our mails to the forum, just in case it may help someone. Yours sincerely Pierre Le 01/09/2014 00:53, 541401(a)gmail.com a écrit : > Sorry for my lack of clarity. > > Your patched 5.02 works as a service. The official 5.03 does not work > as a service. > > > On 31.Aug.14 15:13, Pierre DELAAGE wrote: >> Hello, >> Thanks for the feedback. >> >> So...are you saying that it is now working with MY patched 502 and >> NOT with the official 503 (except for the "not configured msg") ? >> >> Or, finally, are you saying that they work the same, my patched 502 >> and the official 503 ? >> >> Yours sincerely >> Pierre >> >> >> >> Le 31/08/2014 22:46, 541401(a)gmail.com a écrit : >>> Hello Pierre, >>> >>> Today I downloaded the file you sent. I installed 5.03 on the server >>> (replacing 4.35), copied your 5.02 executable over the 5.03 exe. >>> >>> I then copied the 4.35 conf file into the 5.03 directory and finally >>> I installed and started the service. The service installed and ran, >>> but there was a message on the notification window saying it was not >>> configured. >>> >>> HOWEVER, I believe that message was wrong because the service works >>> just fine. I was able to send email from the Event log, through the >>> Windows virtual SMTP server and finally on through a gmail account! >>> >>> I did have to uncheck the service option "allow to interact with >>> desktop" because Server 2008 R2 will not allow a service to interact >>> with the desktop. >>> >>> Thank you very much, I am sorry it took a couple of days to do this >>> and report back to you! >>> >>> >>> On 29.Aug.14 07:38, Pierre DELAAGE wrote: >>>> Hello, >>>> have you tried the patched 502 version I sent you last week ? >>>> Regards >>>> Pierre >>>> >>>> Le 28 août 2014 à 21:20, "541401(a)gmail.com" <541401(a)gmail.com> a >>>> écrit : >>>> >>>>> Hopefully you were smarter than I and didn't piss away several >>>>> hours trying to solve the issue before turning to this forum? I >>>>> felt kind of foolish for wasting so much time trying to fix it on >>>>> my own. >>>>> >>>>> On 28.Aug.14 10:50, WNSDEV wrote: >>>>>> Hi, >>>>>> >>>>>> I ran into the same problem with Stunnel 5.03 on Windows 7 and >>>>>> downgrading >>>>>> to V 4.35 fixed it. Is there a new version to address this issue >>>>>> going to >>>>>> be available at some point? >>>>>> >>>>>> Thanks, >>>>>> Pete >>>>>> >>>>>> -----Original Message----- >>>>>> From: 541401(a)gmail.com [mailto:[email protected]] >>>>>> Sent: Thursday, August 21, 2014 4:43 PM >>>>>> To: stunnel-users(a)stunnel.org >>>>>> Subject: [stunnel-users] Stunnel Windows Server 2008 R2 >>>>>> >>>>>> I have installed stunnel 5.03 on Windows Server 2008 R2 X64. >>>>>> When I run it >>>>>> as an application it works perfectly. When I install and run the >>>>>> service, >>>>>> it starts but the start notice window, title bar, says Stunnel >>>>>> 5.03 win32 (not configured). It appears that the stunnel service >>>>>> is not >>>>>> reading the stunnel.conf. >>>>>> >>>>>> If anyone has any suggestions how I can successfully run stunnel >>>>>> as a >>>>>> service, I would be very appreciative. >>>>>> >>>>>> Thank you! >>>>>> _______________________________________________ >>>>>> stunnel-users mailing list >>>>>> stunnel-users(a)stunnel.org >>>>>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>>>>> >>>>>> _______________________________________________ >>>>>> stunnel-users mailing list >>>>>> stunnel-users(a)stunnel.org >>>>>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>>>>> >>>>> >>>>> _______________________________________________ >>>>> stunnel-users mailing list >>>>> stunnel-users(a)stunnel.org >>>>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>>> >>> >>> >> >> > >

1 0

Stunnel Windows Server 2008 R2
by 541401＠gmail.com 29 Aug '14

29 Aug '14

I have installed stunnel 5.03 on Windows Server 2008 R2 X64. When I run it as an application it works perfectly. When I install and run the service, it starts but the start notice window, title bar, says Stunnel 5.03 win32 (not configured). It appears that the stunnel service is not reading the stunnel.conf. If anyone has any suggestions how I can successfully run stunnel as a service, I would be very appreciative. Thank you!

5 12

SSL Server Allows Anonymous Authentication Vulnerability
by Michael Curran 25 Aug '14

25 Aug '14

I am looking at this vulnerability reported from McAfee -- but we use stunnel to secure our communications and not the application directly. Are these settings that I can make within the stunnel config -- or something comparable? SSLProtocol -ALL +SSLv3 +TLSv1 SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

2 2