sorry to bother,
im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites.
i heard stunnel cant be configured to always forward to the current
site address dynamically, thats why i would use privoxy.
the browser is configured to send to:
127.0.0.1 443
stunnel config has this at the end:
[Tunnel_in]
client = yes
accept = 127.0.0.1:443
connect = 127.0.0.1:8118
verifyChain = yes
CAfile = ca-certs.pem
checkHost = localhost
127.0.0.1:8118 is the privoxy address.
this is what stunnel writes:
LOG5[main]: Configuration successful
LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261
LOG5[0]: s_connect: connected 127.0.0.1:8118
LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262
and the browser infinitely loads, and never loads anything or leaves the page.
if i remove the last 3 lines, its the same just with this line added:
LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks
but it doesnt give an error or anything.
with a configuration like:
[Tunnel_out]
client = no
accept = 127.0.0.1:443
connect = 127.0.0.1:8118
cert = stunnel.pem
this is what it gives:
LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294
LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL
routines:SSL23_GET_CLIENT_HELLO:https proxy request
LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
and browser gives a server not found error immediately. im not even
sure if i should use client or server configuration in a case like
this, but none of them works anyway. all i would need is for my
browser to get the pages decrypted, or at least in less than TLS1.1.
like how on newipnow.com i can access sites with any encryption, since
they are sent to the browser without encryption. the browser just
gives an "unencrypted tunnel" warning, which is how i found stunnel,
and which is exactly what i need, just locally.
Hi all,
To make "Stunnel 5.31" work with Gmail, I have to go in security settings
of Gmail and "allow less secure apps to access my account".
Is it mandatory ?
Is it possible to set Stunnel to access Gmail without lowering it security
level ?
How ?
I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider
it as a "less secure app." !
Regards,
Steve
Rebooted (Windows 7, fully patched) today and stunnel wouldn't start, said "Address already in use". Hmm.nothing much has changed. Rebooted again, same. Tinkered a bit, didn't see anything that looked meaningful. Went to look at deleted digests of this list, saw new version out, installed that, now it's happy.
So.a mystery, at least to me; posting in case it helps someone else!
.phsiii
I've seen other having the same issue without resolution so far...
But we do have the same issue:
stunnel[7886]: segfault at 21 ip 00007f70aa1efcea sp 00007f6fa7797978 error 6 in libpthread-2.12.so[7f70aa1e5000+17000]
Any option I try in stunnel 5.55 results the same. Say:
PS C:\Program Files (x86)\stunnel\bin> .\stunnel \path\to\config\file
[ ] Running on Windows 6.2
[ ] No limit detected for the number of clients
[.] stunnel 5.55 on x64-pc-mingw32-gnu platform
[.] Compiled/running with OpenSSL 1.1.1c 28 May 2019
[.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI
[ ] errno: (*_errno())
[ ] GUI message loop initialized
[ ] Running on Windows 6.2
[.] Reading configuration from file stunnel.conf
[.] UTF-8 byte order mark detected
[ ] Compression disabled
[ ] No PRNG seeding was required
[ ] Initializing service [ssh]
[ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK
[ ] TLSv1.3 ciphersuites:
TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
[ ] TLS options: 0x02100004 (+0x00000000, -0x00000000)
[ ] No certificate or private key specified
[:] Service [ssh] needs authentication to prevent MITM attacks
[ ] Initializing service [gmail-imap]
[!] Service [gmail-imap]: TLS server needs a certificate
[ ] Deallocating section defaults
[!] Server is down
Same with
PS C:\Program Files (x86)\stunnel\bin> .\stunnel nonexistent
or
PS C:\Program Files (x86)\stunnel\bin> .\stunnel -help
Regards, Clodoaldo
Hi Jai,
If your proxy supports the HTTP CONNECT method, you can try revising your
settings to this:
[KG_Self-Checkout]
key = client.pem
cert = client.pem
client = yes
accept = 127.0.0.1:5001
connect = wproxy.qut.edu.au:3128
protocolHost = ap01.alma.exlibrisgroup.com:6443
TIMEOUTclose = 0
TIMEOUTconnect = 200
TIMEOUTidle = 86400
sslVersion = TLSv1.2
protocol = connect
Only the connect protocol supports using the protocolHost option.
If this isn't supported by your proxy, you can try using Privoxy or Polipo
between stunnel and your proxy. Socat is another option as well.
Andrew Krause
Schaumburg Township District Library
-----Original Message-----
At QUT Library we use Stunnel to encrypt SIP2 (ie. book borrowing) traffic
from the self-checkout machines through to the Alma library services
platform (as per
https://developers.exlibrisgroup.com/alma/integrations/stunnel/ )
Our self-checkout machines run Windows 10 and are allowed limited internet
access to two hosts (cloud.fetechgroup.com and ap01.alma.exlibrisgroup.com)
via our institution's Squid proxy and I have our current WinHTTP proxy
settings:
Proxy Server(s) : wproxy.qut.edu.au:3128
Bypass List : *.qut.edu.au
The proxy server settings are set for all protocols (HTTP, HTTPS, secure and
FTP) and I've confirmed that web browser and the FE Technologies software is
routing via wproxy.qut.edu.au. However Stunnel is still trying to connect
to Alma directly. Our stunnel.conf is as follows (just FYI, the FE Tech
software points to 127.0.0.1:5001 as our library services platform address):
[KG_Self-Checkout]
key = client.pem
cert = client.pem
client = yes
accept = 127.0.0.1:5001
connect = ap01.alma.exlibrisgroup.com:6443
TIMEOUTclose = 0
TIMEOUTconnect = 200
TIMEOUTidle = 86400
sslVersion = TLSv1.2
Is there a way to force Stunnel to either respect the WinHTTP settings or
configure it to route traffic to wproxy.qut.edu.au:3128 before initiating
the connect = hostname:port?
I did try protocolHost as follows, but I'm probably misunderstanding how it
works https://www.stunnel.org/static/stunnel.html#SERVICE-LEVEL-OPTIONS
[KG_Self-Checkout]
key = client.pem
cert = client.pem
client = yes
accept = 127.0.0.1:5001
connect = wproxy.qut.edu.au:3128
protocolHost = ap01.alma.exlibrisgroup.com:6443
TIMEOUTclose = 0
TIMEOUTconnect = 200
TIMEOUTidle = 86400
sslVersion = TLSv1.2
Any advice or assistance gratefully accepted, and apologies if this is a
silly question - I'm just a librarian trying to make this thing work.
Thanks,
Jai Parker | Information Access Librarian
QUT Library | Division of Administrative Services
QUT | Kelvin Grove | D Block, Level 1 | Victoria Park Rd Kelvin Grove QLD
4059
P: 07 3138 3381 | E: lib.infoaccess at qut.edu.au<mailto:lib.infoaccess at
qut.edu.au> | www.qut.edu.au<http://www.qut.edu.au/>
ABN: 83 791 724 622 | CRICOS No. 00213J
From: Mark Brookes <mark(a)loadbalancer.org>
To: Francois Robinette <frobinette(a)hotmail.com>
>> OpenSSL 1.1.0k x Stunnel interaction... See tag 5.56b1Thanks. Can't find the 5.56b1 tag. Is it on a fork?https://github.com/mtrojnar/stunnel/network/members
BTW. I had difficulty linking stunnel-5.56 (static) with OpenSSL 1.1.1d (static) as well.
>> The stunnel guys have worked tirelessly to get this resolved. Its an
>> interaction of openssl 1.1.0k and Stunnel. I think essentially openssl
>> is doing something strange. They came up with a fix and its currently>> in the https://www.stunnel.org/downloads/beta/stunnel-5.56b1.tar.gz
>> beta. You should give it a try and see if its resolves your issue.
On Thu, 7 Nov 2019 at 19:36, Francois Robinette <frobinette(a)hotmail.com> wrote:
>
> I've seen other having the same issue without resolution so far...
> But we do have the same issue:
>
> stunnel[7886]: segfault at 21 ip 00007f70aa1efcea sp 00007f6fa7797978 error 6 in libpthread-2.12.so[7f70aa1e5000+17000]
>
