I am faling to connect to gmail. Not sure what that bind error means.
iqbala@ghar:~$ sudo stunnel4
2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes
from /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes
to /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims
sufficient entropy for the PRNG
2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for
service ssmtp
2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on
i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007
2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD
SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be
changed with 'ulimit -n')
2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE
limit for file descriptors
2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on
accept socket
2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to
74.125.93.111:587
2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign
requested address (99)
Here is how my conf file looks like
iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$"
cert = /etc/stunnel/stunnel.pem
foreground = yes
sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
pid = /stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel4/stunnel.log
client = yes
[ssmtp]
accept = smtp.gmail.com:587
connect = 25
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
5
9
Hi,
This may be a little bit off-topic, but does anyone here use stunnel with
pan? My connections to stunnel (in pan) are always refused by libwrap. I was
looking for the right rule to add to /etc/hosts.allow but nothing seems to
work aside from "ALL : ALL" (which is obviously not good) and "nntps:
KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing
to say the least. It mentions that daemon (the first token on any line) is
the name of the daemon running the process, which would be "stunnel" in my
case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The
rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the
group name in stunnel.conf).
What's even more confusing to me is that "nntps : LOCAL" does not work
either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps
: 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as
stunnel so all connections must be coming from localhost. Why do these rules
not trigger?
Either way, I'd like to know the "least permissive" hosts.allow rule that
would allow me to connect to my news provider from pan, and/or whether
"nntps : KNOWN" is a safe option.
Thanks,
Yousef
3
6
Hi,
I'm new to stunnel and I'm trying to troubleshoot why it currently isn't working. When I first set it up and tested it everything worked fine. I rebuilt everything to do it all again and now it's not working. I'm pretty sure I set everything up the same way. I'm trying to get it to work with AWS SES. Here is my stunnel config:
; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2015
; Some options used here may be inadequate for your particular configuration
; This sample file does *not* represent stunnel.conf defaults
; Please consult the manual for detailed description of available options
; **************************************************************************
; * Global options *
; **************************************************************************
; Debugging stuff (may be useful for troubleshooting)
debug = debug
;output = stunnel.log
; Enable FIPS 140-2 mode if needed for compliance
;fips = yes
; Microsoft CryptoAPI engine allows for authentication with private keys
; stored in the Windows certificate store
; Each section using this feature also needs the "engineId = capi" option
;engine = capi
; **************************************************************************
; * Service defaults may also be specified in individual service sections *
; **************************************************************************
; Enable support for the insecure SSLv3 protocol
;options = -NO_SSLv3
; These options provide additional security at some performance degradation
;options = SINGLE_ECDH_USE
;options = SINGLE_DH_USE
; **************************************************************************
; * Include all configuration file fragments from the specified folder *
; **************************************************************************
;include = conf.d
; **************************************************************************
; * Service definitions (at least one service has to be defined) *
; **************************************************************************
; ***************************************** Example TLS client mode services
[gmail-pop3]
client = yes
accept = 127.0.0.1:110
connect = pop.gmail.com:995
verify = 2
CAfile = ca-certs.pem
checkHost = pop.gmail.com
OCSPaia = yes
[gmail-imap]
client = yes
accept = 127.0.0.1:143
connect = imap.gmail.com:993
verify = 2
CAfile = ca-certs.pem
checkHost = imap.gmail.com
OCSPaia = yes
[gmail-smtp]
client = yes
accept = 127.0.0.1:25
connect = smtp.gmail.com:465
verify = 2
CAfile = ca-certs.pem
checkHost = smtp.gmail.com
OCSPaia = yes
; Encrypted HTTP proxy authenticated with a client certificate
; located in the Windows certificate store
;[example-proxy]
;client = yes
;accept = 127.0.0.1:8080
;connect = example.com:8443
;engineId = capi
; ***************************************** Example TLS server mode services
;[pop3s]
;accept = 995
;connect = 110
;cert = stunnel.pem
;[imaps]
;accept = 993
;connect = 143
;cert = stunnel.pem
;[ssmtp]
;accept = 465
;connect = 25
;cert = stunnel.pem
; TLS front-end to a web server
;[https]
;accept = 443
;connect = 80
;cert = stunnel.pem
; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel
; Microsoft implementations do not use TLS close-notify alert and thus they
; are vulnerable to truncation attacks
;TIMEOUTclose = 0
; Remote cmd.exe protected with PSK-authenticated TLS
; Create "secrets.txt" containing IDENTITY:KEY pairs
;[cmd]
;accept = 1337
;exec = c:\windows\system32\cmd.exe
;execArgs = cmd.exe
;ciphers = PSK
;PSKsecrets = secrets.txt
; vim:ft=dosini
[smtp-tls-wrapper]
accept = 2525
client = yes
connect = email-smtp.us-east-1.amazonaws.com:2465
delay = yes
Here is the debug from the log file:
2015.12.29 17:42:38 LOG7[main]: No limit detected for the number of clients
2015.12.29 17:42:38 LOG5[main]: stunnel 5.28 on x86-pc-msvc-1500 platform
2015.12.29 17:42:38 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015
2015.12.29 17:42:38 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI
2015.12.29 17:42:38 LOG7[main]: errno: (*_errno())
2015.12.29 17:42:38 LOG5[main]: Reading configuration from file stunnel.conf
2015.12.29 17:42:38 LOG5[main]: UTF-8 byte order mark detected
2015.12.29 17:42:38 LOG5[main]: FIPS mode disabled
2015.12.29 17:42:38 LOG7[main]: Compression disabled
2015.12.29 17:42:38 LOG7[main]: Snagged 64 random bytes from C:/.rnd
2015.12.29 17:42:38 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd
2015.12.29 17:42:38 LOG7[main]: PRNG seeded successfully
2015.12.29 17:42:38 LOG6[main]: Initializing service [gmail-pop3]
2015.12.29 17:42:38 LOG7[ui]: GUI message loop initialized
2015.12.29 17:42:38 LOG7[cron]: Cron thread initialized
2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified
2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000)
2015.12.29 17:42:38 LOG6[main]: Initializing service [gmail-imap]
2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified
2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000)
2015.12.29 17:42:38 LOG6[main]: Initializing service [gmail-smtp]
2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified
2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000)
2015.12.29 17:42:38 LOG6[main]: Initializing service [smtp-tls-wrapper]
2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified
2015.12.29 17:42:38 LOG4[main]: Service [smtp-tls-wrapper] needs authentication to prevent MITM attacks
2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000)
2015.12.29 17:42:38 LOG5[main]: Configuration successful
2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=372)
2015.12.29 17:42:38 LOG7[main]: Service [gmail-pop3] (FD=372) bound to 127.0.0.1:110
2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=376)
2015.12.29 17:42:38 LOG7[main]: Service [gmail-imap] (FD=376) bound to 127.0.0.1:143
2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=380)
2015.12.29 17:42:38 LOG7[main]: Service [gmail-smtp] (FD=380) bound to 127.0.0.1:25
2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=384)
2015.12.29 17:42:38 LOG7[main]: Service [smtp-tls-wrapper] (FD=384) bound to 0.0.0.0:2525
2015.12.29 17:43:25 LOG7[main]: Found 1 ready file descriptor(s)
2015.12.29 17:43:25 LOG7[main]: FD=332 ifds=r-x ofds=---
2015.12.29 17:43:25 LOG7[main]: FD=372 ifds=r-x ofds=---
2015.12.29 17:43:25 LOG7[main]: FD=376 ifds=r-x ofds=---
2015.12.29 17:43:25 LOG7[main]: FD=380 ifds=r-x ofds=---
2015.12.29 17:43:25 LOG7[main]: Service [smtp-tls-wrapper] accepted (FD=444) from 127.0.0.1:49510
2015.12.29 17:43:25 LOG7[main]: Creating a new thread
2015.12.29 17:43:25 LOG7[main]: New thread created
2015.12.29 17:43:25 LOG7[0]: Service [smtp-tls-wrapper] started
2015.12.29 17:43:25 LOG5[0]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:49510
2015.12.29 17:43:25 LOG6[0]: failover: round-robin, starting at entry #0
2015.12.29 17:43:25 LOG6[0]: s_connect: connecting 54.243.71.143:2465
2015.12.29 17:43:25 LOG7[0]: s_connect: s_poll_wait 54.243.71.143:2465: waiting 10 seconds
2015.12.29 17:43:25 LOG5[0]: s_connect: connected 54.243.71.143:2465
2015.12.29 17:43:25 LOG5[0]: Service [smtp-tls-wrapper] connected remote server from 172.31.49.212:49511
2015.12.29 17:43:25 LOG7[0]: Remote descriptor (FD=468) initialized
2015.12.29 17:43:25 LOG6[0]: SNI: sending servername: email-smtp.us-east-1.amazonaws.com
2015.12.29 17:43:25 LOG7[0]: SSL state (connect): before/connect initialization
2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A
2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server hello A
2015.12.29 17:43:25 LOG6[0]: Certificate verification disabled
2015.12.29 17:43:25 LOG6[0]: Certificate verification disabled
2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server certificate A
2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A
2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server done A
2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A
2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A
2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 write finished A
2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 flush data
2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server session ticket A
2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read finished A
2015.12.29 17:43:25 LOG7[0]: 1 client connect(s) requested
2015.12.29 17:43:25 LOG7[0]: 1 client connect(s) succeeded
2015.12.29 17:43:25 LOG7[0]: 0 client renegotiation(s) requested
2015.12.29 17:43:25 LOG7[0]: 0 session reuse(s)
2015.12.29 17:43:25 LOG6[0]: SSL connected: new session negotiated
2015.12.29 17:43:25 LOG7[0]: Peer certificate was cached (3667 bytes)
2015.12.29 17:43:25 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption)
2015.12.29 17:43:25 LOG7[0]: Compression: null, expansion: null
2015.12.29 17:43:36 LOG7[0]: SSL alert (read): warning: close notify
2015.12.29 17:43:36 LOG6[0]: SSL closed (SSL_read)
2015.12.29 17:43:36 LOG7[0]: Sent socket write shutdown
2015.12.29 17:43:38 LOG6[cron]: Executing cron jobs
2015.12.29 17:43:38 LOG6[cron]: Cron jobs completed in 0 seconds
2015.12.29 17:43:38 LOG7[cron]: Waiting 86400 seconds
2015.12.29 17:44:36 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.29 17:44:36 LOG5[0]: Connection closed: 995 byte(s) sent to SSL, 397 byte(s) sent to socket
2015.12.29 17:44:36 LOG7[0]: Remote descriptor (FD=468) closed
2015.12.29 17:44:36 LOG7[0]: Local descriptor (FD=444) closed
2015.12.29 17:44:36 LOG7[0]: Service [smtp-tls-wrapper] finished (0 left)
I've searched the web for that TIMEOUTclose message and haven't come up with a solution. I've also attached a packet capture. Any suggestions would be helpful.
Thanks!
Mike
1
0
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Dear Users,
I have released version 5.28 of stunnel.
This is a bugfix release. I highly recommend upgrading your stunnel.
The ChangeLog entry:
Version 5.28, 2015.12.11, urgency: HIGH
* New features
- Build matrix (.travis.yml) extended with ./configure options.
- mingw.mak updated to build tstunnel.exe (thx to Jose Alf.).
* Bugfixes
- Fixed incomplete initialization.
- Fixed UCONTEXT threading on OSX.
- Fixed exit codes for information requests (as
in "stunnel -version" or "stunnel -help").
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hashes:
9a25b87b1ef0c08fa3d796edce07b4408e6a8acece23de2eb7ee9285b78852b5
stunnel-5.28.tar.gz
020b5bd8a97a1da91e9b379c0d2fa8a14606402e2b0c1eb9191fe99c7f4665f9
stunnel-5.28-installer.exe
0af65879343b37bcda89dbbde51f6cfde016a044a533f7bdec229f4e1ec25eb9
stunnel-5.28-android.zip
Best regards,
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJWarN7AAoJEC78f/DUFuAUKhcQAJ62DQW+GMpAmtggO42LhaEj
NcAdpgYvCAJnemRnTj+YMHHAGGIn7MY7VQZVzIIHL0y4CS6yy8kg1WVQeDgxS7PM
zil/CViLayNQUnEaUSpoD3yFlb5i6wqofPa5/ohObAvUwTejN/XtOlyT6OMTEovF
ZWWLsqYnVTCkbrY1Usu9DNRlSWaCgGeqL5ZqhbiJHk7hDHIH5Yy8KXKw3dVuOxBZ
86uYNH0WW3qNHKJrI1z70cA+18c6Kab5/4NnzzmWG+TyYCVVLL8JVkahEHhCX5mc
yBYcMyBrSkrUoS++IdEZtOKYjwxfiEFdre0junC1m5DqtbOc+vWcvqZRGUfCszHK
bg4LlCoNs6VhaAFzY9dyXKWqFP+HvH1cqcVcagCaofcdAEaFrwP4dqwUUBKCT44z
JNhEzyrI6+coGq92SZUeSiko2bj+rQWDf3s5pY+zWQVvUe12rTo427Mhbge3sBhQ
QykwMsihtrP9s25YkDQHqlpBV85W3axq/O2veb15QlbETDM6eGfnMCFjqhxpBBMO
sSgHOr9E1E4pxN4kcokPhwKizxSe0EHVQYM27qGfNXJkzVAvHE+mz0WR2kMPpjT5
N6th9lOMgrjXGo6aTBQO3DIEkw+BB0C9OVWnNXMWqmUnsKp80QVeZKZXgK5c2t1y
Y8e0W7HH2xdaQemUQp+n
=GrPO
-----END PGP SIGNATURE-----
3
3
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Hi Guys,
I have found a serious bug in stunnel 5.27. The bug results in
incomplete (partial) service initialization.
The bugfix 5.28 release is scheduled for tomorrow.
Best regards,
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJWac5NAAoJEC78f/DUFuAUcRUP/A1dOJW8Sag4YRfxnOZfW6bt
SouaKMkFQDkQkLrZzQkUhkOFL35DNmesvA+HgCSp+StO/TagcLA34ZrpR355qcZ7
QjEXYftagy85c7DjDek4CU9vfb9u3J3kTcvhtpy6l5CPYV0TWCjApk438xk+saOn
xItijYRVcpHbSUof0/E99Gb9mZ3qiI4AVkdSHT4qw3GV8GCdo9R66cHBNDKsYQy1
XWe7VJCEmXw9n0bmj2Soi1TWlU39Q2GcostWK2GuH9fzFyGqnde7RbMHeJ9KYvY/
oSnMjCRblJtoRn4Ucw/1FuOdEZSalpRuPSarmhKCkgc+tKgkK6mvhSbILUbwOMLL
hO2nWbMrOhLOlu4UnM32A1djWQCiVRxTO87IAkd5jTTz8sNLCoJHqzcirug68Kjy
ljuNf/A/LhkimkfCvZtY5ErMP6TzJ37iaXhaGRLZLoZtK75yKggXnJcJUAEI8ggI
RR/mArBHyHG3IwcfdMt4a+AJvsHOJAApCB+0uCGwJnfnuqHJ41Z6WEHuwpBitN/0
4nTGLoOBOyUX/cnrpsx9FLxRdCKAVbGoebXBM5sA9qhCDskp7MMDUFU1pVER5QbZ
VKzCpIdeyGKKvCOA5WiNOt3bBBmOGJKB4CXYyMEyDAbr8SL2FTNo5nJ2iUO/2iaU
6a5MITgIc1C6GacMauvo
=rb0T
-----END PGP SIGNATURE-----
3
3
Re: [stunnel-users] How do I use the Stunnel download on android?
by Research | FrenchFlorida 09 Dec '15
by Research | FrenchFlorida 09 Dec '15
09 Dec '15
Thanks for the reply.
I'm not sure what " statically linked ELF executable for Android/ARM" means yet, but I will look it up. ;)
Since I sent the message I did a lot of digging that yielded me very little details. In fact I only came a cross a few mentions that stunnel could be used on android but no examples of how that was implemented. After a vague hint I managed to deduced how the file worked, but it took me a little more independent research to understand how to make it, at least execute. I'm not new to linux but am new to android so not as familiar to how the system works in general.
I did see that an android app was on your todo list. In the meanwhile however, may I suggest a little howto for Android that could get a user started in using the app. Stunnel is an amazing application and since I was able to figure it out I made myself a guide on how to set it up (Minus actually creating the configuration) so that I can at least know how to execute stunnel.
Since I already did the research I offer you my very unorganized primer on how to set it up below. Perhaps it would be useful for some to have a better version of this doc on the site, and if not, well at least a well determined person can find this topic in the mailing list, because there will be only one other topic with the word "Android" in the title so it can perhaps get a user out of jam more quickly without.
Here is my guide:
-----------------------------
Chances are that "It is a statically linked ELF executable for Android/ARM." Means that within the stunnel-android.zip resides one file, and that file is the executable file for stunnel. It is in fact the defacto program that under linux you would see in /etc/local/bin/stunnel if that was where you installed it.
This means that the requirements to use this file are as such:
1. Your phone probably needs to be rooted
2. You will need access to a terminal on your phone (Terminal Emulator)
3. There is no "APP" to run stunnel it is a command line file
There are probably two reasons you would want to use stunnel on your phone.
1. You are an app developer that wants to use stunnel to connect one part of your app to something else, and therefore will incorporate this script within your app. I don't know how to make apps yet so that's probably as useful as I can make the description for you.
2. You are a user that has already used stunnel on your machine and wants to use it on your phone too. [The rest of the guide assumes this is the case.]
Assuming the latter, what do you need to do to get it running?
1. Move the stunnel application to your phone.
2. As you would do in linux open the terminal
3. Run stunnel like a command
If you get an error message saying it is not executable, or that permission is denied it is because of one of two things.
Maybe you need to mark the file as executable
Chmod +x ./stunnel
Terminal Emulator's chmod does not understand "+x" so you will have to change the permission to
Chmod 700 ./stunnel
700 means Read-Write-Execute for the user. If it doesn't work try 770 and 777
However you are likely to still receive that error on some phones. (I'm guessing, just because it happened to my phone I am not assuming it will happen to all phones.)
Some phones forbid there to be an executable script within the /sdcard/ directory. Therefore you have to move it somewhere else.
I don’t know where the proper place for such a file is, I moved mine to /system/bin/ therefore the script is callable by /system/bin/stunnel
Another Caveat!! My phone's /system folder is not writable!! Therefore before you can even move the file you need to make the system folder writable:
mount -o rw,remount /system
Once moved needs to be made readonly again:
mount -o ro,remount /system
So In summary, here is a step-by-step of what might work in getting the script to an executable state on Android:
1. Root phone
2. install terminal emulator
3. get stunnel script onto your phone somehow
4. mount -o rw,remount /system
5. cp /sdcard/Download/stunnel /system/bin/stunnel
6. chown 700 /system/bin/stunnel
7. mount -o ro,remount /system
8. /system/bin/stunnel /path/to/conf/file*
Now as if you are on linux you should probably** be able to run stunnel.
*I haven't tested it out with conf files yet.
** I'm able to run stunnel --version so stunnel in and of itself is "working"
-----------------------------
If this guide is any good to you guys, please feel free to use, I would love to contribute in some way. :)
Thanks!
-Cotex
-----Original Message-----
From: stunnel-users [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org
Sent: Tuesday, December 08, 2015 7:00 PM
To: stunnel-users(a)stunnel.org
Subject: stunnel-users Digest, Vol 137, Issue 10
Send stunnel-users mailing list submissions to
stunnel-users(a)stunnel.org
To subscribe or unsubscribe via the World Wide Web, visit
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
or, via email, send a message with subject or body 'help' to
stunnel-users-request(a)stunnel.org
You can reach the person managing the list at
stunnel-users-owner(a)stunnel.org
When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..."
Today's Topics:
1. Re: How do I use the Stunnel download on android?
(Michal Trojnara)
----------------------------------------------------------------------
Message: 1
Date: Mon, 7 Dec 2015 16:14:05 +0100
From: Michal Trojnara <Michal.Trojnara(a)mirt.net>
To: stunnel-users(a)stunnel.org
Subject: Re: [stunnel-users] How do I use the Stunnel download on
android?
Message-ID: <5665A23D.8050408(a)mirt.net>
Content-Type: text/plain; charset=utf-8
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Hi cotex,
It is a statically linked ELF executable for Android/ARM.
It is only useful for people who customize their Android, and not for end-users.
A proper Android GUI is on my TODO list:
https://www.stunnel.org/sdf_todo.html
Best regards,
Mike
On 04.12.2015 11:02, Research | FrenchFlorida wrote:
> In the download section of the site, there is a zip for android.
>
> Inside this file is a single file, without any extention.
>
> How do I install this, I have found no documentation anywhere on the
> web.
>
>
>
> Can anybody guide me, or give me a hint. Is this something I do on the
> phone, or that I do from the computer first?
>
>
>
> -cotex
>
>
>
> _______________________________________________ stunnel-users mailing
> list stunnel-users(a)stunnel.org
> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJWZaI9AAoJEC78f/DUFuAUJiAQAKYo2XM39WbeebhZlYa4pER2
hYfCkybWypYlOdiqRo5UGthG4SD/G74MXMJNR5ggKiApW6YBe4/Q983hKMWRSbp6
X803HQPyN8BxwnkZM9tzAcCh57SQXH/Y+VjTD9necLK9bOMMZlZsWg5u3TSp9qP1
jpV7+5NkMlID0KaKzpjaw+ruIY1zwmBUDrs0xT713TEZnVvaqhFDv2vYB8szG0p0
fe5Ppm/ZU/7vWMbFO8eWsWj6TpeoVpq2EI/4iK7VbnCVnSEosJi/C4C5nZ3GrcTv
xRk0xDK9I733FfBTmHU5Dkzx6fcDqFekWyea+qYT+JhOmtRqdnyrQM0OCRv3z/b/
fOv36zkuru6DhoO1El2QwQOZlTqFnWYfgvfYDWI1zeIMCSz/qqpn5ojQXk7i87zH
cMVG9whVZGWf0DXjwRo9/cHkmjdX46UA5FZwhxADY6Atu9OtdEabTcbNj6BPPh8Q
xX7GNEgRFnbZsz50wqZbZJZfE4ticWFkLH37eT7z3WeEU8+HdFk1w24JNGFaZt3H
GcJ6TN6/fMTkQP2ch0l0X2vXhWLkBh5puYOVBnsnKKUl8UUzeGa1T3OJAnKJF07Q
0mtP6lyPtuEGy9vUiP+2h0yIICJD1IGhEdkEm3xWJcagp3XJ+0PFN5Mo2juDfg4S
FHvDTHxF4/y4PQodabav
=+omM
-----END PGP SIGNATURE-----
------------------------------
Subject: Digest Footer
_______________________________________________
stunnel-users mailing list
stunnel-users(a)stunnel.org
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
------------------------------
End of stunnel-users Digest, Vol 137, Issue 10
**********************************************
1
0
Hi,
while testing the upgrade from stunnel 5.26 to stunnel 5.27 on
Solaris, one of the tools I use reported that SSL compression was
now supported/possible on connections to an stunnel 5.27 instance;
this was not the case with 5.26 or earlier.
Unfortunately, it is not possible to demonstrate this using openssl
as client, I found this using TestSSLServer, which is java-based and
available from http://www.bolet.org/TestSSLServer/.
With 5.26:
| $ java -jar TestSSLServer.jar $server 443
| Supported versions: TLSv1.2
| Deflate compression: no
| Supported cipher suites (ORDER IS NOT SIGNIFICANT):
| TLSv1.2
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
| ----------------------
| Server certificate(s):
| 4c57045b3f8f9cdd6f487e59a5b008ccb9d38693: CN=***, OU=***, O=***, C=***
| ----------------------
| Minimal encryption strength: strong encryption (96-bit or more)
| Achievable encryption strength: strong encryption (96-bit or more)
| BEAST status: protected
| CRIME status: protected
Note: "Deflate compression: no", "CRIME status: protected"
With 5.27:
| $ java -jar /prod/certmon2/bin/TestSSLServer.jar $server 443
| Supported versions: TLSv1.2
| Deflate compression: YES
| Supported cipher suites (ORDER IS NOT SIGNIFICANT):
| TLSv1.2
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
| ----------------------
| Server certificate(s):
| 4c57045b3f8f9cdd6f487e59a5b008ccb9d38693: CN=***, OU=***, O=***, C=***
| ----------------------
| Minimal encryption strength: strong encryption (96-bit or more)
| Achievable encryption strength: strong encryption (96-bit or more)
| BEAST status: protected
| CRIME status: vulnerable
With 5.27, I get "Deflate compression: YES" and "CRIME status: vulnerable".
Server OS: Solaris 10/SPARC or Solaris 11/SPARC (others not tested)
OpenSSL: 1.0.1p or 1.0.1q (others not tested)
Client: TestSSLServer
Both stunnel and OpenSSL are self-compiled using Solaris Studio 12.4.
The stunnel.conf in question:
sslVersion = TLSv1.2
ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256
cert = test1.crt
key = test1.key
verify = 2
[test]
client = no
accept = A.B.C.D:443
connect = 127.0.0.1:8080
The scanner from SSL Labs should be able to check this as well, but
I do not have the neccessary modern Python available. I will check
if I can reproduce the problem on something a little more mainstream
than Solaris 10/11 over the weekend.
--
2
1
In the download section of the site, there is a zip for android.
Inside this file is a single file, without any extention.
How do I install this, I have found no documentation anywhere on the web.
Can anybody guide me, or give me a hint. Is this something I do on the
phone, or that I do from the computer first?
-cotex
2
1
Hi All,
Stunnel expects TCP-based syslog. Please let me know whether syslogd of busybox supports TCP communication.
The busybox version is 1.24.1
If it doesn't support , can it be enhanced to support TCP communication
Regards,
Girish
1
1
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Dear Users,
I have released version 5.27 of stunnel.
The ChangeLog entry:
Version 5.27, 2015.12.03, urgency: MEDIUM
* Security bugfixes
- OpenSSL DLLs updated to version 1.0.2e.
https://www.openssl.org/news/secadv_20151203.txt
* New features
- Automated build testing configured with .travis.yml.
- Added reading server certificates from hardware engines.
For example: cert = id_45
- Only attempt to use potentially harmful compiler or linker
options if gcc was detected.
- /opt/csw added to the OpenSSL directory lookup list.
- mingw.mak updates (thx to Jose Alf.).
- TODO list updated.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hashes:
7474e986710e88a5cc3330b6b1762f9449f01eccf826fa0f97e56d064c05ead3
stunnel-5.27.tar.gz
04b11dea9a29e7a16d46b2c4e6c66a5ca6f588abb29a827dcca2c6f6456eb4c6
stunnel-5.27-installer.exe
76e4297212eaa99a674191f3e955ec3959abcdd0c081d2df0ce8786a577a6883
stunnel-5.27-android.zip
Best regards,
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJWYG/VAAoJEC78f/DUFuAUKloP/jRcbtEuSpiLbFTg2hQqJcZf
T6C6x+pCRDqefPZMQNgN5HIU9TBUAm1dGNH3KxRqrfCTlYKnhqafDoj66fsQe6sm
vUDOxxxwCcKBZaiO4II5cLxd05d9GX9FnI86GBfiztSX0nr2wMLu1EdKHdTO2R5s
VXsjRl1ey2X0ukhzQ+gsD2bOf2tz0gkCjrcoAZZyGqBE+Zy3hMGSlK8mXeTfU8Of
ygUT+nEcUmQb+zbEBrJCp+Q2TP0dMzXSgpKz67toH1wJJ85iTpxqPa6L6LcKwHXd
kA2c75Y7HXmc4C+eKpXessifbHTHdJXbsF4ZOc06IxIg2+v47Fqqz13sL2rMKdYQ
aldOP7NiOyCxywjQ3bZElvF8f8Q1RJz/+qMKG0QEWwe1cRHmDOweZ2BrqsBsZNbE
Pxx2lavAqRruREL9PnL12mH/u9e0SBIaXsgmN1xo9IvaVy98K9+VL23m2GpXeVMp
cPGOtfwX2M0NWRIU6keQ8FOqszuP0A7CSFTKwmM2/ZGNjPOk00/NCJk9qchyqZcr
8RDnkMOknvqEp5Uf0PWpBafK0yUps7aPwyTQX9SQ8uvz3ra/30ghkpEyAeIeEP3p
Y5DqlSXupIbPAmUw3fNblU7E7SgflPP4LXF8oznLUkWFmPpR/wPUiHC1EnEOGtEQ
GHF3H9CS1fr51rPm0UaK
=hfT6
-----END PGP SIGNATURE-----
1
0