November 2015 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Upcoming stunnel 5.27 release
by Michal Trojnara 01 Dec '15

01 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Guys, stunnel 5.27 will be made available on 3rd December. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWXHz/AAoJEC78f/DUFuAUcxAQAK5PrsoU4i0n25IYfFnuGWm/ R9Y4BJKO6/4+VHjRN9Yi4gJb0t7QpVxYQH9RuQAYVWp5RYeYqnxyb55m5iZ5IYBl V5ke5+DjTtPpMuTDShLz9BkL01lyrw8c+mwLy1IZM4nUgAQHyWp4lgcKgKukoY6N DYxloE5GmWW3ylGLAJUFlcVZmNayo8pmmVeWLbhsCRt0OyFJbrS8XUcVviZVcxAD q3Lly63NFC0Nsl+5MGmKxO8sRCu3UW0WkT4P5MbJr2f5b9AuTlrBmBNZ/fmyPAV9 5/LvAc5vdh9DwJEgGF3yvFqdFghR8TNuGNqBJaDn5pk+6rmc0qNeQkFFsq0CRX34 jSwNCl0A0SuXp4YGPTOFK9rp8bKjxq5VDUAGa6OyEhd92H2pSLxDA/aJqlY6f1vs MZQb6az60lrUq1JNnoYeUfO9AFMCFpqyFV4kqmfUOlnJox99JbZ5/U38CeaO9n8P tIz7jgijYRDK6itaCuf1QaWJxCU5S7yCUL1dtyi2nTDTvrG8WmTr93SniyGXScix fXIIb4Aa7mg3/p9J9TFONzxw0CySj/32ZBIgiLAWcAaa1Gnuy3+ARSAu1U6t9to8 Unnzppd1B7qn0qk1QANtktz4JAu63FUg7RSPHFt8+nLcABtslkjHdcVvzGl3F02k zjYq9bMufBOqlCDctGQO =rtq3 -----END PGP SIGNATURE-----

2 1

Failover behavior with stunnel
by Thireus 30 Nov '15

30 Nov '15

Hi, I have a couple of questions regarding failover with stunnel: 1. I would like to know if there is a way to use failover with two servers with two different set of TLS cert/key. The following rule doesn't work, because the cert and key parameters are overwritten, but it shows what I would like to achieve: [failover] accept = 127.0.0.1:4441 <http://127.0.0.1:4441/> cert = cert_1.cert key = key_1.pem connect = server-1:1234 cert = cert_2.cert key = key_2.pem connect = server-2:1234 2. On the same topic, I would like to know if there is an option that could open the local port (accept) only when the connection (connect) is established? The problem I'm facing is that I use a PAC profile with failover on several stunnel entries: "return PROXY 127.0.0.1:4441 <http://127.0.0.1:4441/>; PROXY 127.0.0.1:4442 <http://127.0.0.1:4442/>; PROXY 127.0.0.1:4443 <http://127.0.0.1:4443/>;". However, when one of the remote server is down (i.e. server-1), it is not easily detected by web-browsers (Chrome does not seem to detect it well), and so instead of switching to the next PROXY, it simply dies on the first one. If the port 4441 relative to server-1 (which is unavailable) was closed, then the webrowser could easily detect it and switch to the second server with port 4442. 3. Is there another way to tweak stunnel behavior when a remote server is down? I'm thinking about a couple of things, like being able to switch to a different rule set: [failover1] accept = 127.0.0.1:4441 <http://127.0.0.1:4441/> cert = cert_1.cert key = key_1.pem connect = server-1:1234 connect = 127.0.0.1:4442 <http://127.0.0.1:4442/> ; This is failover2 [failover2] accept = 127.0.0.1:4442 <http://127.0.0.1:4442/> cert = cert_2.cert key = key_2.pem connect = server-2:1234 Or maybe there are some options that I'm not aware of to timeout connections more efficiently: so that Chrome (or other clients using HTTP proxies) will immediately know that stunnel cannot connect to the remote server and so that the proxy is down. Thank you for your help. Cheers, Thireus.

2 3

Where is stunnel.exe ?
by Manu Egen 25 Nov '15

25 Nov '15

Hello, Can you tell me from which stunnel version, the "bin" folder and the "config" folder appeared ? The change is between the version 4.53 and 5.26, but which one ? Thanks a lot for the answer Best regards, Manu

1 0

syslog communication using TLS with the help of stunnel
by Girish Kumar 24 Nov '15

24 Nov '15

Dear All, Currently we are using syslog communication without any security. That is using UDP protocol with the server listening on port number 514. This is unsecure. I want to use syslog over TLS that is over TCP . As of now in my project syslogd daemon is used. I am planning to use stunnel to achieve this. I have few questions. Please clarify * To support stunnel, syslogd should be on TCP and not on UDP? * Is stunnel is a daemon ? * My understanding is syslogd forwards messages to the stunnel local portal at port 61514. The local stunnel forwards data via the network to port 60514 to its remote peer. * I assume stunnel-5.26(stunnel-5.26.tar.gz) is the latest version and this can be used on linux Regards, Girish

2 1

A trivial patch for two minor typos in 5.26
by Peter Pentchev 19 Nov '15

19 Nov '15

Hi, Once again, thanks a lot for taking care of stunnel! Attached is a trivial patch for two minor typo fixes. Thanks in advance for looking over it :) G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)FreeBSD.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

OCSP stapling
by Joó Ádám 17 Nov '15

17 Nov '15

Hi, The website and the documentation does not indicate and a Google search does not give any relevant results, so I would like to ask if Stunnel supports OCSP stapling? Thank you, Ádám

2 1

STunnel 5.22
by Deepak Subbanarasimha 17 Nov '15

17 Nov '15

Is STunnel 5.22 supported on Windows 2003 server? Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:[email protected]> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

1 0