Cox has been warning us that as of next week, we need to use encrypted POP
and SMTP. I have two reasons to use stunnel now:
1) I use the K9 Bayesian email proxy for spam filtering, and it doesn't
do TLS
2) My wife still uses Eudora and doesn't want to switch, and while
Eudora allegedly supports TLS, it's not trivial to make it work (and Cox
certainly won't help)
Thus stunnel looks like an ideal solution. But after tinkering for a few
hours on two machines, I'm stumped.
While I can type an SMTP or POP transaction in my sleep, I'm not so good at
typing a TLS handshake, so I'm using Outlook 2013 as my test platform (and
that's what I'll be using myself later anyway). I setup a new account, point
to the right ports on 127.0.0.1, and the test times out, with:
Log onto incoming mail server (POP3): The operation timed out waiting for a
response from the receiving (POP) server. If you continue to receive this
message, contact your server administrator or Internet service provider
(ISP).
Send test e-mail message: The operation timed out waiting for a response
from the sending (SMTP) server. If you continue to receive this message,
contact your server administrator or Internet service provider (ISP).
Here's my stunnel.conf, with blank lines and comments removed:
client = yes
output = C:\temp\stunnel-log.txt
taskbar = yes
debug = 7
[POP3 Incoming]
protocol = pop3
accept = 127.0.0.1:1110
connect = pop.cox.net:995
protocol = smtp
accept = 127.0.0.1:25
connect = smtp.cox.net:465
Yes, that's port 1110, since K9 is using 110. Shouldn't matter, right? (As
long as I point the client at 1110, obviously!)
Yes, I have protocol = pop3 and protocol = smtp; I've tried commenting them
out individually, no change that I can see.
Yes, I'm running stunnel explicitly, not as a service-I found threads
suggesting that it just doesn't work as a service on Windows 7 for some
reason (and in fact beat my head against that wall for a while first).
And here's the stunnel log:
2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1
2018.01.17 21:29:24 LOG7[main]: No limit detected for the number of clients
2018.01.17 21:29:24 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform
2018.01.17 21:29:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2
Nov 2017
2018.01.17 21:29:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6
TLS:ENGINE,FIPS,OCSP,PSK,SNI
2018.01.17 21:29:24 LOG7[main]: errno: (*_errno())
2018.01.17 21:29:24 LOG7[ui]: GUI message loop initialized
2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1
2018.01.17 21:29:24 LOG5[main]: Reading configuration from file stunnel.conf
2018.01.17 21:29:24 LOG5[main]: UTF-8 byte order mark not detected
2018.01.17 21:29:24 LOG5[main]: FIPS mode disabled
2018.01.17 21:29:24 LOG7[main]: Compression disabled
2018.01.17 21:29:24 LOG7[main]: Snagged 64 random bytes from C:/.rnd
2018.01.17 21:29:24 LOG7[main]: Wrote 0 new random bytes to C:/.rnd
2018.01.17 21:29:24 LOG7[main]: PRNG seeded successfully
2018.01.17 21:29:24 LOG6[main]: Initializing service [POP3 Incoming]
2018.01.17 21:29:24 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2
2018.01.17 21:29:24 LOG7[main]: TLS options: 0x03000004 (+0x03000000,
-0x00000000)
2018.01.17 21:29:24 LOG7[main]: No certificate or private key specified
2018.01.17 21:29:24 LOG4[main]: Service [POP3 Incoming] needs authentication
to prevent MITM attacks
2018.01.17 21:29:24 LOG5[main]: Configuration successful
2018.01.17 21:29:24 LOG7[main]: Binding service [POP3 Incoming]
2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=460)
2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept
socket
2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=460) bound to
127.0.0.1:1110
2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=464)
2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept
socket
2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=464) bound to
127.0.0.1:25
2018.01.17 21:29:24 LOG7[cron]: Cron thread initialized
2018.01.17 21:29:50 LOG7[main]: Found 1 ready file descriptor(s)
2018.01.17 21:29:50 LOG7[main]: FD=424 ifds=r-x ofds=---
2018.01.17 21:29:50 LOG7[main]: FD=460 ifds=r-x ofds=r--
2018.01.17 21:29:50 LOG7[main]: Service [POP3 Incoming] accepted (FD=488)
from 127.0.0.1:54855
2018.01.17 21:29:50 LOG7[main]: Creating a new thread
2018.01.17 21:29:50 LOG7[main]: New thread created
2018.01.17 21:29:50 LOG7[0]: Service [POP3 Incoming] started
2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on local socket
2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] accepted connection
from 127.0.0.1:54855
2018.01.17 21:29:50 LOG6[0]: failover: round-robin, starting at entry #1
2018.01.17 21:29:50 LOG6[0]: s_connect: connecting 68.6.19.8:465
2018.01.17 21:29:50 LOG7[0]: s_connect: s_poll_wait 68.6.19.8:465: waiting
10 seconds
2018.01.17 21:29:50 LOG5[0]: s_connect: connected 68.6.19.8:465
2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] connected remote server
from 192.168.1.17:54856
2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on remote socket
2018.01.17 21:29:50 LOG7[0]: Remote descriptor (FD=508) initialized
2018.01.17 21:30:24 LOG6[cron]: Executing cron jobs
2018.01.17 21:30:24 LOG6[cron]: Cron jobs completed in 0 seconds
2018.01.17 21:30:24 LOG7[cron]: Waiting 86400 seconds
2018.01.17 21:31:05 LOG7[main]: Found 1 ready file descriptor(s)
2018.01.17 21:31:05 LOG7[main]: FD=424 ifds=r-x ofds=---
2018.01.17 21:31:05 LOG7[main]: FD=460 ifds=r-x ofds=---
2018.01.17 21:31:05 LOG7[main]: Service [POP3 Incoming] accepted (FD=528)
from 127.0.0.1:54891
2018.01.17 21:31:05 LOG7[main]: Creating a new thread
2018.01.17 21:31:05 LOG7[main]: New thread created
2018.01.17 21:31:05 LOG7[1]: Service [POP3 Incoming] started
2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on local socket
2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] accepted connection
from 127.0.0.1:54891
2018.01.17 21:31:05 LOG6[1]: failover: round-robin, starting at entry #0
2018.01.17 21:31:05 LOG6[1]: s_connect: connecting 146.20.147.245:995
2018.01.17 21:31:05 LOG7[1]: s_connect: s_poll_wait 146.20.147.245:995:
waiting 10 seconds
2018.01.17 21:31:05 LOG5[1]: s_connect: connected 146.20.147.245:995
2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] connected remote server
from 192.168.1.17:54892
2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on remote socket
2018.01.17 21:31:05 LOG7[1]: Remote descriptor (FD=336) initialized
2018.01.17 21:34:05 LOG3[1]: Unexpected socket close (s_read)
2018.01.17 21:34:05 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2018.01.17 21:34:05 LOG7[1]: Remote descriptor (FD=336) closed
2018.01.17 21:34:05 LOG7[1]: Local descriptor (FD=528) closed
2018.01.17 21:34:05 LOG7[1]: Service [POP3 Incoming] finished (1 left)
2018.01.17 21:34:05 LOG7[1]: str_stats: 1 block(s), 32 data byte(s), 58
control byte(s)
2018.01.17 21:34:05 LOG7[1]: str_stats: 32 byte(s) at ..\src\network.c:680
2018.01.17 21:34:50 LOG6[0]: s_read: s_poll_wait: TIMEOUTbusy exceeded:
sending reset
2018.01.17 21:34:50 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2018.01.17 21:34:50 LOG7[0]: Remote descriptor (FD=508) closed
2018.01.17 21:34:50 LOG7[0]: Local descriptor (FD=488) closed
2018.01.17 21:34:50 LOG7[0]: Service [POP3 Incoming] finished (0 left)
2018.01.17 21:34:50 LOG7[0]: str_stats: 1 block(s), 32 data byte(s), 58
control byte(s)
2018.01.17 21:34:50 LOG7[0]: str_stats: 32 byte(s) at ..\src\network.c:680
It looks like it connects, but then just sits there?!
I see these:
No certificate or private key specified
Service [POP3 Incoming] needs authentication to prevent MITM attacks
but that's during startup. Or are those significant?
I feel like I'm one setting away from having this all work.!
Thanks in advance for any suggestions.
--
...phsiii
