stunnel-users March 2019

13 participants
14 discussions

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Stunnel & Gmail security
by BOXI31 TEST 17 Oct '20

17 Oct '20

Hi all, To make "Stunnel 5.31" work with Gmail, I have to go in security settings of Gmail and "allow less secure apps to access my account". Is it mandatory ? Is it possible to set Stunnel to access Gmail without lowering it security level ? How ? I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider it as a "less secure app." ! Regards, Steve

2 1

Is there a Win32 installer that supports sslVersionMin = TLS1.2?
by kent loving 01 Apr '19

01 Apr '19

I need to run a client on Win XP that connects to a server using TLS 1.2 or higher. Jose Alf posted that he made a test build of 5.50 in a win32 installer but uses OpenSSL 1.0.2p. And it does not seem to be official. The changelog says version 5.49, which has a win32 installer, also uses OpenSSL 1.0.2p. I can't tell if it supports TLS1.2. The man page implies I need OpenSSL 1.1.1 to get the sslVersionMin option. And, OpenSSL says v1.0.2 support ends in 9 months. Any advice is appreciated. Thanks, Kent Loving

3 2

OpenVPN with stunnel
by Heikki Lavaste 25 Mar '19

25 Mar '19

Hi, To bypass the office firewall to access home server, I'm trying to run openvpn over port 443 with stunnel. I managed to get to this point: Log on client side 2019.03.22 22:15:13 LOG5[38]: Connection closed: 352 byte(s) sent to TLS, 2067 byte(s) sent to socket 2019.03.22 22:15:19 LOG5[39]: Service [openvpn] accepted connection from 127.0.0.1:51265 2019.03.22 22:15:19 LOG5[39]: s_connect: connected x.x.x.x:443 2019.03.22 22:15:19 LOG5[39]: Service [openvpn] connected remote server from x.x.x.x:51266 2019.03.22 22:15:19 LOG5[39]: Connection closed: 352 byte(s) sent to TLS, 2067 byte(s) sent to socket Log on server side: Mar 22 22:21:54 ssh-server-heikki stunnel[2797]: LOG5[2797:140127128753920]: connect_blocking: connected 127.0.0.1:8443 Mar 22 22:21:54 ssh-server-heikki stunnel[2797]: LOG5[2797:140127128753920]: Service [openvpn] connected remote server from 127.0.0.1:49366 Mar 22 22:21:54 ssh-server-heikki stunnel[2797]: LOG5[2797:140127128753920]: Connection closed: 2067 byte(s) sent to SSL, 352 byte(s) sent to socket Config: Client [openvpn] client = yes accept = localhost:1337 connect = x.x.x.xg:443 cert = C:\Users\heikki_lavaste\Documents\stunnel\stunnel.pem verifyChain = yes verify = 2 CAfile = C:\Users\heikki_lavaste\Documents\stunnel\ca-cert.pem checkHost = stunnel.heikki-lab.local sslVersion = TLSv1 Server chroot = /var/run/stunnel sslVersion = TLSv1 pid = /stunnel.pid setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = /etc/stunnel/stunnel.pem [openvpn] accept = 443 connect = localhost:8443 cert = /etc/stunnel/stunnel.pem The issue is probably nothing to do with stunnel but if somebody can help me figure this out, that'd be appreciated. Kind Regards Heikki

2 1

ERR_SSL_VERSION_INTERFERENCE on Google Chrome v 73.0.3683.86 and stunnel v5.51b1
by Kolan Koala 25 Mar '19

25 Mar '19

I cannot get TLS 1.3 to work with Chrome. TLS 1.3 works fine in firefox quantum v 66.0.1 over the same hardware, so this is not caused by middleboxes. It is a fault with stunnel or Chrome. ERR_SSL_VERSION_INTERFERENCE error occurs in Chrome and will not connect. For now the solution is to turn off TLS v1.3 in stunnel configuration and force TLS v1.2, but this is not a long term solution. Does anyone have a solution to use TLS 1.3 with chrome and stunnel together? Kolan

1 0

No more Win32 stunnel?
by John Hall 21 Mar '19

21 Mar '19

I've only just discovered that stunnel is seemingly no longer being updated for Win32; at any rate there has been no version 5.50 released for Win32. It would have been nice if there had been an announcement to that effect, as until now I was only subscribed to the announcements mailing list and had thus been in blissful ignorance. (For some reason I never saw ANY announcement for 5.50 - in fact I still seem to be on 5.47.) Given that there are a number of ports to different OSs by various people, is there any chance that someone might supply a Win32 port for future versions? (Sadly I lack the knowledge to do that myself.) -- John Hall

3 4

Verify peer immediately
by Phillip Hellewell 21 Mar '19

21 Mar '19

Hi, I have verifyPeer = yes in my client stunnel.conf. Is there any way to make it verify the peer right away instead of waiting until a connection is made (to the accept port)? I run stunnel with foreground = yes and would like it to exit right away if the peer doesn't have the appropriate cert/key. Thanks, Phillip

1 0

stunnel become non-non responsive and very sluggish
by Joe Phillips 18 Mar '19

18 Mar '19

I have 5.30 running on Ubuntu workstation. It has become sluggish and almost non responsive at times. I captured this in the log the other day...no source, no destination address. Maybe got stuck in a loop? Have to restart Ubuntu to clear it up. stunnel2@stunnel2:~$ /etc/init.d/stunnel4 restart [....] Restarting stunnel4 (via systemctl): stunnel4.serviceFailed to restart stunnel4.service: Access denied See system logs and 'systemctl status stunnel4.service' for details. failed! stunnel2@stunnel2:~$ sudo tail -f -n 100 /var/log/stunnel.log sudo: unable to resolve host stunnel2: Connection timed out [sudo] password for stunnel2: 2019.03.13 04:06:14 LOG5[1149140]: Connection reset: 34440 byte(s) sent to SSL, 4886 byte(s) sent to socket 2019.03.13 04:38:56 LOG5[1142702]: Connection reset: 2362 byte(s) sent to SSL, 1225 byte(s) sent to socket 2019.03.13 05:09:32 LOG5[1137283]: Connection reset: 23006 byte(s) sent to SSL, 3977 byte(s) sent to socket 2019.03.13 05:51:57 LOG5[1109534]: Connection reset: 33953 byte(s) sent to SSL, 16755 byte(s) sent to socket 2019.03.13 05:58:36 LOG5[1139715]: Connection reset: 25039 byte(s) sent to SSL, 3944 byte(s) sent to socket 2019.03.13 06:25:12 LOG5[1137757]: Connection reset: 2863 byte(s) sent to SSL, 1329 byte(s) sent to socket 2019.03.13 06:49:19 LOG5[1137393]: Connection reset: 26536 byte(s) sent to SSL, 14839 byte(s) sent to socket 2019.03.13 06:51:35 LOG5[1137344]: Connection reset: 28968 byte(s) sent to SSL, 12986 byte(s) sent to socket 2019.03.13 07:10:28 LOG5[1137343]: Connection reset: 28655 byte(s) sent to SSL, 7632 byte(s) sent to socket 2019.03.13 07:30:52 LOG5[1136403]: Connection reset: 25466 byte(s) sent to SSL, 6767 byte(s) sent to socket 2019.03.13 07:35:33 LOG5[1141675]: Connection reset: 28637 byte(s) sent to SSL, 15044 byte(s) sent to socket 2019.03.13 07:39:21 LOG5[1121823]: Connection reset: 47442 byte(s) sent to SSL, 67336 byte(s) sent to socket 2019.03.13 07:39:58 LOG5[1148822]: Connection reset: 25003 byte(s) sent to SSL, 9295 byte(s) sent to socket 2019.03.13 07:40:29 LOG5[1127468]: Connection reset: 57030 byte(s) sent to SSL, 73806 byte(s) sent to socket 2019.03.13 07:46:08 LOG5[1107655]: Connection reset: 84608 byte(s) sent to SSL, 125726 byte(s) sent to socket 2019.03.13 07:49:49 LOG5[1140561]: Connection reset: 27344 byte(s) sent to SSL, 11112 byte(s) sent to socket 2019.03.13 07:59:23 LOG5[1106646]: Connection reset: 9970 byte(s) sent to SSL, 5355 byte(s) sent to socket 2019.03.13 08:01:27 LOG5[1143613]: Connection reset: 26733 byte(s) sent to SSL, 8993 byte(s) sent to socket 2019.03.13 08:02:28 LOG5[1141251]: Connection reset: 49897 byte(s) sent to SSL, 62187 byte(s) sent to socket 2019.03.13 08:03:11 LOG5[1139045]: Connection reset: 24669 byte(s) sent to SSL, 4580 byte(s) sent to socket 2019.03.13 08:05:13 LOG5[1137322]: Connection reset: 39408 byte(s) sent to SSL, 33428 byte(s) sent to socket 2019.03.13 08:07:56 LOG5[1151696]: Connection reset: 23577 byte(s) sent to SSL, 5415 byte(s) sent to socket 2019.03.13 08:11:12 LOG5[1136170]: Connection reset: 64684 byte(s) sent to SSL, 36839 byte(s) sent to socket 2019.03.13 08:11:55 LOG5[1141693]: Connection reset: 22826 byte(s) sent to SSL, 5186 byte(s) sent to socket 2019.03.13 08:15:30 LOG5[1140377]: Connection reset: 42452 byte(s) sent to SSL, 39471 byte(s) sent to socket 2019.03.13 08:18:29 LOG5[1154893]: Connection reset: 21190 byte(s) sent to SSL, 3096 byte(s) sent to socket 2019.03.13 08:22:14 LOG5[1153488]: Connection reset: 23506 byte(s) sent to SSL, 5081 byte(s) sent to socket 2019.03.13 08:24:34 LOG5[1153167]: Connection reset: 46285 byte(s) sent to SSL, 8378 byte(s) sent to socket 2019.03.13 08:26:25 LOG5[1145557]: Connection reset: 26015 byte(s) sent to SSL, 6055 byte(s) sent to socket 2019.03.13 08:29:34 LOG5[1030096]: Connection reset: 89657 byte(s) sent to SSL, 120807 byte(s) sent to socket 2019.03.13 08:30:36 LOG5[1081623]: Connection reset: 51409 byte(s) sent to SSL, 50378 byte(s) sent to socket 2019.03.13 08:32:23 LOG5[1149449]: Connection reset: 28329 byte(s) sent to SSL, 12655 byte(s) sent to socket 2019.03.13 08:32:33 LOG5[1106312]: Connection reset: 52138 byte(s) sent to SSL, 58239 byte(s) sent to socket 2019.03.13 08:33:46 LOG5[1137325]: Connection reset: 36900 byte(s) sent to SSL, 29750 byte(s) sent to socket 2019.03.13 08:36:35 LOG5[1145147]: Connection reset: 31740 byte(s) sent to SSL, 21114 byte(s) sent to socket 2019.03.13 08:38:59 LOG5[1133239]: Connection reset: 44816 byte(s) sent to SSL, 18743 byte(s) sent to socket 2019.03.13 08:41:04 LOG5[1148129]: Connection reset: 32191 byte(s) sent to SSL, 20525 byte(s) sent to socket 2019.03.13 08:43:55 LOG5[1150567]: Connection reset: 27989 byte(s) sent to SSL, 12627 byte(s) sent to socket 2019.03.13 08:47:21 LOG5[1146666]: Connection reset: 29242 byte(s) sent to SSL, 13836 byte(s) sent to socket 2019.03.13 08:49:26 LOG5[main]: Terminated 2019.03.13 08:58:32 LOG5[ui]: stunnel 5.30 on x86_64-pc-linux-gnu platform 2019.03.13 08:58:32 LOG5[ui]: Compiled/running with OpenSSL 1.0.2g 1 Mar 2016 2019.03.13 08:58:32 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2019.03.13 08:58:32 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2019.03.13 08:58:32 LOG5[ui]: UTF-8 byte order mark detected 2019.03.13 08:58:32 LOG5[ui]: FIPS mode disabled 2019.03.13 08:58:36 LOG5[ui]: Configuration successful [UMC Color Logo - small]<http://www.universalmoney.com/> Joe Phillips SVP-IT 15301 W. 87th Street Parkway, Suite 215 Lenexa, KS 66219 Corp Office 913.831.2055 Direct via Cell 913.927.5691 www.universalmoney.com

2 1

(no subject)
by Vijay Raghavan P 05 Mar '19

05 Mar '19

Hi, I have to create tunnel between server and client. Client have proxy configured in between. So i use below in /etc/stunnel/stunnel.config pid = /var/run/stunnel.pid cert = /home/client.crt key = /home/client.key options = NO_SSLv2 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes CAfile=/home/**chain.pem verify=2 [test] protocol = connect accept = 127.0.0.1:10000 protocolHost = server.xxxx.com:443 connect = <PROXYIP>:<PROXY port> protocolUsername = user1 protocolPassword = password protocolAuthentication = Basic then i bring up the service. With above configuration connection works file. Now i don't want proxy password to be clear text in this case. Any pointers plz Thanks, Vj

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users March 2019