sorry to bother,
im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites.
i heard stunnel cant be configured to always forward to the current
site address dynamically, thats why i would use privoxy.
the browser is configured to send to:
127.0.0.1 443
stunnel config has this at the end:
[Tunnel_in]
client = yes
accept = 127.0.0.1:443
connect = 127.0.0.1:8118
verifyChain = yes
CAfile = ca-certs.pem
checkHost = localhost
127.0.0.1:8118 is the privoxy address.
this is what stunnel writes:
LOG5[main]: Configuration successful
LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261
LOG5[0]: s_connect: connected 127.0.0.1:8118
LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262
and the browser infinitely loads, and never loads anything or leaves the page.
if i remove the last 3 lines, its the same just with this line added:
LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks
but it doesnt give an error or anything.
with a configuration like:
[Tunnel_out]
client = no
accept = 127.0.0.1:443
connect = 127.0.0.1:8118
cert = stunnel.pem
this is what it gives:
LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294
LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL
routines:SSL23_GET_CLIENT_HELLO:https proxy request
LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
and browser gives a server not found error immediately. im not even
sure if i should use client or server configuration in a case like
this, but none of them works anyway. all i would need is for my
browser to get the pages decrypted, or at least in less than TLS1.1.
like how on newipnow.com i can access sites with any encryption, since
they are sent to the browser without encryption. the browser just
gives an "unencrypted tunnel" warning, which is how i found stunnel,
and which is exactly what i need, just locally.
8
41
Hi,
Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS.
Thanks for your help in advance!
Here is my configuration so far without TPM:
debug = debug
output = /tmp/stunnel.log
foreground = yes
[mtls_client]
client = yes
accept = 127.0.0.1:12019
sni = server-with-mtls.example.com
checkHost = server-with-mtls.example.com
connect = 1.2.3.4:443
verifyChain = yes
CApath = /etc/ssl/certs/
cert = client.crt
key = client.key
Thanks & br,
Gábor Nyíri,
2
1
I am faling to connect to gmail. Not sure what that bind error means.
iqbala@ghar:~$ sudo stunnel4
2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes
from /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes
to /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims
sufficient entropy for the PRNG
2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for
service ssmtp
2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on
i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007
2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD
SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be
changed with 'ulimit -n')
2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE
limit for file descriptors
2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on
accept socket
2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to
74.125.93.111:587
2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign
requested address (99)
Here is how my conf file looks like
iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$"
cert = /etc/stunnel/stunnel.pem
foreground = yes
sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
pid = /stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel4/stunnel.log
client = yes
[ssmtp]
accept = smtp.gmail.com:587
connect = 25
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
5
9
Hi all,
To make "Stunnel 5.31" work with Gmail, I have to go in security settings
of Gmail and "allow less secure apps to access my account".
Is it mandatory ?
Is it possible to set Stunnel to access Gmail without lowering it security
level ?
How ?
I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider
it as a "less secure app." !
Regards,
Steve
2
1
Is there a check list for implementation of stunnel on RHEL 7
1
0
Hi.
I need to download the latest version of stunnel for AIX, but I can´t find
that
I have the 7.1 AIX version
Can you help me?
Regards.
1
0
Hello!
I have tried to stream to an icecast server through stunnel usung
liquidsoap.
Somewhere the stream gets stuck. I want to where.
Maybe I should have posted this on the Tor mailing list first, since the
traffic is
forwarded through Tor. But before the stream went to Tor, it went through
stunnel.
The liquidsoap snippet which tries to stream (password,mount name,
stream description and stream name modified:
output.external(id="Tor", fallible=true, reopen_delay=3.0,
%vorbis(quality=0.4 , samplerate=48000, channels=2),
"/usr/bin/oggfwd -n streamname -d 'stream description' localhost 9887
password /mount",
mksafe(buffer(full)))
I had a script which was supposed to pick up this stream and forward it
on a cloud server (passwords etc. modified):
#!/bin/bash
/usr/bin/curl -V http://localhost:9887/mount | \
/usr/bin/torsocks /usr/bin/oggfwd -n streamname -d 'stream description'
superdupersecret.onion 8000 password /mount
#/usr/bin/curl -T - -s --socks5 localhost:9050
http://superdupersecret.onion/mount
exec "/home/per/bin/test.sh"
stunnel.conf on cloud:
setuid = stunnel4
setgid = stunnel4
; PID file is created inside the chroot jail (if enabled)
pid = /var/run/stunnel4/stunnel.pid
; Debugging stuff (may be useful for troubleshooting)
;foreground = yes
debug = info
output = /var/log/stunnel4/stunnel.log
[liquidsoap-client]
client = yes
accept = localhost:8081
connect = mustafejen.se:9998
PSKsecrets = /etc/stunnel/secrets.txt
[hequidtor-client]
connect = localhost:9050
accept = 95.216.184.255:9888
PSKsecrets = /etc/stunnel/secrets.txt
[Deep Web Radio In]
client = yes
accept = 95.216.184.255:9887
connect = localhost:9050
PSKsecrets = /etc/stunnel/secrets.txt
stunnel.conf in my living room:
setuid = stunnel4
setgid = stunnel4
; PID file is created inside the chroot jail (if enabled)
pid = /var/run/stunnel4/stunnel.pid
; Debugging stuff (may be useful for troubleshooting)
;foreground = yes
debug = info
output = /var/log/stunnel4/stunnel.log
[liquidsoap-server]
;client = yes
connect = mustafejen.se:8081
accept = mustafejen.se:9998
PSKsecrets = /etc/stunnel/secrets.txt
[hequidtor-server]
client = yes
accept = localhost:9888
connect = 95.216.184.255:9888
PSKsecrets = /etc/stunnel/secrets.txt
[Deep Web Radio Out]
accept = localhost:9887
connect = 95.216.184.255:9887
PSKsecrets = /etc/stunnel/secrets.txt
Log file from cloud:
2020.01.15 06:25:01 LOG5[main]: Log file reopened
2020.01.15 10:29:22 LOG5[main]: Terminated
2020.01.15 10:29:22 LOG5[ui]: stunnel 5.44 on x86_64-pc-linux-gnu platform
2020.01.15 10:29:22 LOG5[ui]: Compiled with OpenSSL 1.1.0g 2 Nov 2017
2020.01.15 10:29:22 LOG5[ui]: Running with OpenSSL 1.1.1 11 Sep 2018
2020.01.15 10:29:22 LOG5[ui]: Update OpenSSL shared libraries or rebuild
stunnel
2020.01.15 10:29:22 LOG5[ui]: Threading:PTHREAD
Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP
2020.01.15 10:29:22 LOG5[ui]: Reading configuration from file
/etc/stunnel/stunnel.conf
2020.01.15 10:29:22 LOG5[ui]: UTF-8 byte order mark detected
2020.01.15 10:29:22 LOG5[ui]: FIPS mode disabled
2020.01.15 10:29:22 LOG6[ui]: Initializing service [liquidsoap-client]
2020.01.15 10:29:23 LOG6[ui]: PSK identities: 1 retrieved
2020.01.15 10:29:23 LOG6[ui]: Initializing service [hequidtor-client]
2020.01.15 10:29:23 LOG6[ui]: PSK identities: 1 retrieved
2020.01.15 10:29:23 LOG6[ui]: Using dynamic DH parameters
2020.01.15 10:29:23 LOG6[ui]: Initializing service [Deep Web Radio In]
2020.01.15 10:29:23 LOG6[ui]: PSK identities: 1 retrieved
2020.01.15 10:29:23 LOG5[ui]: Configuration successful
Log file from my living room:
2020.01.15 10:20:13 LOG5[ui]: stunnel 5.56 on x86_64-pc-linux-gnu platform
2020.01.15 10:20:13 LOG5[ui]: Compiled/running with OpenSSL 1.1.1d 10
Sep 2019
2020.01.15 10:20:13 LOG5[ui]: Threading:PTHREAD
Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP
2020.01.15 10:20:13 LOG5[ui]: Reading configuration from file
/etc/stunnel/stunnel.conf
2020.01.15 10:20:13 LOG5[ui]: UTF-8 byte order mark detected
2020.01.15 10:20:13 LOG5[ui]: FIPS mode disabled
2020.01.15 10:20:13 LOG6[ui]: PSKsecrets line 1: 40-byte ASCII key
configured for identity "per"
2020.01.15 10:20:13 LOG6[ui]: Initializing service [liquidsoap-server]
2020.01.15 10:20:13 LOG6[ui]: PSK identities: 1 retrieved
2020.01.15 10:20:13 LOG6[ui]: DH initialization not needed
2020.01.15 10:20:13 LOG6[ui]: PSKsecrets line 1: 40-byte ASCII key
configured for identity "per"
2020.01.15 10:20:13 LOG6[ui]: Initializing service [hequidtor-server]
2020.01.15 10:20:13 LOG6[ui]: PSK identities: 1 retrieved
2020.01.15 10:20:13 LOG6[ui]: PSKsecrets line 1: 40-byte ASCII key
configured for identity "per"
2020.01.15 10:20:13 LOG6[ui]: Initializing service [Deep Web Radio Out]
2020.01.15 10:20:13 LOG6[ui]: PSK identities: 1 retrieved
2020.01.15 10:20:13 LOG6[ui]: DH initialization not needed
2020.01.15 10:20:13 LOG5[ui]: Configuration successful
2020.01.15 10:20:13 LOG6[ui]: Service [liquidsoap-server] (FD=9) bound
to 10.0.0.6:9998
2020.01.15 10:20:13 LOG6[ui]: Service [hequidtor-server] (FD=10) bound
to ::1:9888
2020.01.15 10:20:13 LOG6[ui]: Service [hequidtor-server] (FD=11) bound
to 127.0.0.1:9888
2020.01.15 10:20:13 LOG6[ui]: Service [Deep Web Radio Out] (FD=12) bound
to ::1:9887
2020.01.15 10:20:13 LOG6[ui]: Service [Deep Web Radio Out] (FD=13) bound
to 127.0.0.1:9887
2020.01.15 10:20:13 LOG6[cron]: Executing cron jobs
2020.01.15 10:20:13 LOG6[cron]: Cron jobs completed in 0 seconds
2020.01.15 10:32:56 LOG5[0]: Service [Deep Web Radio Out] accepted
connection from ::1:44732
2020.01.15 10:32:56 LOG6[0]: Peer certificate not required
2020.01.15 10:32:56 LOG3[0]: SSL_accept:
../ssl/record/ssl3_record.c:331: error:1408F10B:SSL
routines:ssl3_get_record:wrong version number
2020.01.15 10:32:56 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:32:56 LOG5[1]: Service [Deep Web Radio Out] accepted
connection from ::1:44734
2020.01.15 10:32:56 LOG6[1]: Peer certificate not required
2020.01.15 10:32:56 LOG3[1]: SSL_accept:
../ssl/record/ssl3_record.c:321: error:1408F09C:SSL
routines:ssl3_get_record:http request
2020.01.15 10:32:56 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:32:56 LOG5[2]: Service [Deep Web Radio Out] accepted
connection from ::1:44736
2020.01.15 10:32:56 LOG6[2]: Peer certificate not required
2020.01.15 10:32:56 LOG3[2]: SSL_accept: ../ssl/t1_lib.c:2719:
error:14201076:SSL routines:tls_choose_sigalg:no suitable signature
algorithm
2020.01.15 10:32:56 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:33:44 LOG5[3]: Service [Deep Web Radio Out] accepted
connection from ::1:44760
2020.01.15 10:33:44 LOG6[3]: Peer certificate not required
2020.01.15 10:33:44 LOG3[3]: SSL_accept:
../ssl/record/ssl3_record.c:331: error:1408F10B:SSL
routines:ssl3_get_record:wrong version number
2020.01.15 10:33:44 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:33:44 LOG5[4]: Service [Deep Web Radio Out] accepted
connection from ::1:44762
2020.01.15 10:33:44 LOG6[4]: Peer certificate not required
2020.01.15 10:33:44 LOG3[4]: SSL_accept:
../ssl/record/ssl3_record.c:321: error:1408F09C:SSL
routines:ssl3_get_record:http request
2020.01.15 10:33:44 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:33:44 LOG5[5]: Service [Deep Web Radio Out] accepted
connection from ::1:44764
2020.01.15 10:33:44 LOG6[5]: Peer certificate not required
2020.01.15 10:33:44 LOG3[5]: SSL_accept: ../ssl/t1_lib.c:2719:
error:14201076:SSL routines:tls_choose_sigalg:no suitable signature
algorithm
2020.01.15 10:33:44 LOG5[5]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:34:50 LOG5[6]: Service [Deep Web Radio Out] accepted
connection from ::1:44788
2020.01.15 10:34:50 LOG6[6]: Peer certificate not required
2020.01.15 10:34:50 LOG3[6]: SSL_accept:
../ssl/record/ssl3_record.c:331: error:1408F10B:SSL
routines:ssl3_get_record:wrong version number
2020.01.15 10:34:50 LOG5[6]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:34:50 LOG5[7]: Service [Deep Web Radio Out] accepted
connection from ::1:44790
2020.01.15 10:34:50 LOG6[7]: Peer certificate not required
2020.01.15 10:34:50 LOG3[7]: SSL_accept:
../ssl/record/ssl3_record.c:321: error:1408F09C:SSL
routines:ssl3_get_record:http request
2020.01.15 10:34:50 LOG5[7]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:34:50 LOG5[8]: Service [Deep Web Radio Out] accepted
connection from ::1:44792
2020.01.15 10:34:50 LOG6[8]: Peer certificate not required
2020.01.15 10:34:50 LOG3[8]: SSL_accept: ../ssl/t1_lib.c:2719:
error:14201076:SSL routines:tls_choose_sigalg:no suitable signature
algorithm
2020.01.15 10:34:50 LOG5[8]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:48:17 LOG5[9]: Service [Deep Web Radio Out] accepted
connection from ::1:44854
2020.01.15 10:48:17 LOG6[9]: Peer certificate not required
2020.01.15 10:48:17 LOG3[9]: SSL_accept:
../ssl/record/ssl3_record.c:325: error:1408F09B:SSL
routines:ssl3_get_record:https proxy request
2020.01.15 10:48:17 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:48:17 LOG5[10]: Service [Deep Web Radio Out] accepted
connection from ::1:44856
2020.01.15 10:48:17 LOG6[10]: Peer certificate not required
2020.01.15 10:48:17 LOG3[10]: SSL_accept:
../ssl/record/ssl3_record.c:325: error:1408F09B:SSL
routines:ssl3_get_record:https proxy request
2020.01.15 10:48:17 LOG5[10]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:48:32 LOG5[11]: Service [Deep Web Radio Out] accepted
connection from ::1:44858
2020.01.15 10:48:32 LOG6[11]: Peer certificate not required
2020.01.15 10:48:32 LOG3[11]: SSL_accept:
../ssl/record/ssl3_record.c:325: error:1408F09B:SSL
routines:ssl3_get_record:https proxy request
2020.01.15 10:48:32 LOG5[11]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:48:32 LOG5[12]: Service [Deep Web Radio Out] accepted
connection from ::1:44860
2020.01.15 10:48:32 LOG6[12]: Peer certificate not required
2020.01.15 10:48:32 LOG3[12]: SSL_accept:
../ssl/record/ssl3_record.c:325: error:1408F09B:SSL
routines:ssl3_get_record:https proxy request
2020.01.15 10:48:32 LOG5[12]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:49:01 LOG5[13]: Service [Deep Web Radio Out] accepted
connection from ::1:44864
2020.01.15 10:49:01 LOG6[13]: Peer certificate not required
2020.01.15 10:49:01 LOG3[13]: SSL_accept:
../ssl/record/ssl3_record.c:325: error:1408F09B:SSL
routines:ssl3_get_record:https proxy request
2020.01.15 10:49:01 LOG5[13]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:49:01 LOG5[14]: Service [Deep Web Radio Out] accepted
connection from ::1:44866
2020.01.15 10:49:01 LOG6[14]: Peer certificate not required
2020.01.15 10:49:01 LOG3[14]: SSL_accept:
../ssl/record/ssl3_record.c:325: error:1408F09B:SSL
routines:ssl3_get_record:https proxy request
2020.01.15 10:49:01 LOG5[14]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:57:28 LOG5[15]: Service [Deep Web Radio Out] accepted
connection from ::1:44914
2020.01.15 10:57:28 LOG6[15]: Peer certificate not required
2020.01.15 10:57:28 LOG3[15]: SSL_accept:
../ssl/record/ssl3_record.c:331: error:1408F10B:SSL
routines:ssl3_get_record:wrong version number
2020.01.15 10:57:28 LOG5[15]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:57:28 LOG5[16]: Service [Deep Web Radio Out] accepted
connection from ::1:44916
2020.01.15 10:57:28 LOG6[16]: Peer certificate not required
2020.01.15 10:57:28 LOG3[16]: SSL_accept:
../ssl/record/ssl3_record.c:321: error:1408F09C:SSL
routines:ssl3_get_record:http request
2020.01.15 10:57:28 LOG5[16]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 10:57:28 LOG5[17]: Service [Deep Web Radio Out] accepted
connection from ::1:44918
2020.01.15 10:57:28 LOG6[17]: Peer certificate not required
2020.01.15 10:57:28 LOG3[17]: SSL_accept: ../ssl/t1_lib.c:2719:
error:14201076:SSL routines:tls_choose_sigalg:no suitable signature
algorithm
2020.01.15 10:57:28 LOG5[17]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:24:24 LOG5[18]: Service [Deep Web Radio Out] accepted
connection from ::1:45012
2020.01.15 11:24:24 LOG6[18]: Peer certificate not required
2020.01.15 11:24:24 LOG3[18]: SSL_accept:
../ssl/record/ssl3_record.c:331: error:1408F10B:SSL
routines:ssl3_get_record:wrong version number
2020.01.15 11:24:24 LOG5[18]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:24:24 LOG5[19]: Service [Deep Web Radio Out] accepted
connection from ::1:45014
2020.01.15 11:24:24 LOG6[19]: Peer certificate not required
2020.01.15 11:24:24 LOG3[19]: SSL_accept:
../ssl/record/ssl3_record.c:321: error:1408F09C:SSL
routines:ssl3_get_record:http request
2020.01.15 11:24:24 LOG5[19]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:24:24 LOG5[20]: Service [Deep Web Radio Out] accepted
connection from ::1:45016
2020.01.15 11:24:24 LOG6[20]: Peer certificate not required
2020.01.15 11:24:24 LOG3[20]: SSL_accept: ../ssl/t1_lib.c:2719:
error:14201076:SSL routines:tls_choose_sigalg:no suitable signature
algorithm
2020.01.15 11:24:24 LOG5[20]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:25:16 LOG5[21]: Service [Deep Web Radio Out] accepted
connection from ::1:45038
2020.01.15 11:25:16 LOG6[21]: Peer certificate not required
2020.01.15 11:25:16 LOG3[21]: SSL_accept:
../ssl/record/ssl3_record.c:331: error:1408F10B:SSL
routines:ssl3_get_record:wrong version number
2020.01.15 11:25:16 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:25:16 LOG5[22]: Service [Deep Web Radio Out] accepted
connection from ::1:45040
2020.01.15 11:25:16 LOG6[22]: Peer certificate not required
2020.01.15 11:25:16 LOG3[22]: SSL_accept:
../ssl/record/ssl3_record.c:321: error:1408F09C:SSL
routines:ssl3_get_record:http request
2020.01.15 11:25:16 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:25:16 LOG5[23]: Service [Deep Web Radio Out] accepted
connection from ::1:45042
2020.01.15 11:25:16 LOG6[23]: Peer certificate not required
2020.01.15 11:25:16 LOG3[23]: SSL_accept: ../ssl/t1_lib.c:2719:
error:14201076:SSL routines:tls_choose_sigalg:no suitable signature
algorithm
2020.01.15 11:25:16 LOG5[23]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:28:38 LOG5[24]: Service [Deep Web Radio Out] accepted
connection from ::1:45070
2020.01.15 11:28:38 LOG6[24]: Peer certificate not required
2020.01.15 11:28:38 LOG3[24]: SSL_accept:
../ssl/record/ssl3_record.c:331: error:1408F10B:SSL
routines:ssl3_get_record:wrong version number
2020.01.15 11:28:38 LOG5[24]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:28:38 LOG5[25]: Service [Deep Web Radio Out] accepted
connection from ::1:45072
2020.01.15 11:28:38 LOG6[25]: Peer certificate not required
2020.01.15 11:28:38 LOG3[25]: SSL_accept:
../ssl/record/ssl3_record.c:321: error:1408F09C:SSL
routines:ssl3_get_record:http request
2020.01.15 11:28:38 LOG5[25]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:28:38 LOG5[26]: Service [Deep Web Radio Out] accepted
connection from ::1:45074
2020.01.15 11:28:38 LOG6[26]: Peer certificate not required
2020.01.15 11:28:38 LOG3[26]: SSL_accept: ../ssl/t1_lib.c:2719:
error:14201076:SSL routines:tls_choose_sigalg:no suitable signature
algorithm
2020.01.15 11:28:38 LOG5[26]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:30:06 LOG5[27]: Service [Deep Web Radio Out] accepted
connection from ::1:45096
2020.01.15 11:30:06 LOG6[27]: Peer certificate not required
2020.01.15 11:30:06 LOG3[27]: SSL_accept:
../ssl/record/ssl3_record.c:331: error:1408F10B:SSL
routines:ssl3_get_record:wrong version number
2020.01.15 11:30:06 LOG5[27]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:30:06 LOG5[28]: Service [Deep Web Radio Out] accepted
connection from ::1:45098
2020.01.15 11:30:06 LOG6[28]: Peer certificate not required
2020.01.15 11:30:06 LOG3[28]: SSL_accept:
../ssl/record/ssl3_record.c:321: error:1408F09C:SSL
routines:ssl3_get_record:http request
2020.01.15 11:30:06 LOG5[28]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:30:06 LOG5[29]: Service [Deep Web Radio Out] accepted
connection from ::1:45100
2020.01.15 11:30:06 LOG6[29]: Peer certificate not required
2020.01.15 11:30:06 LOG3[29]: SSL_accept: ../ssl/t1_lib.c:2719:
error:14201076:SSL routines:tls_choose_sigalg:no suitable signature
algorithm
2020.01.15 11:30:06 LOG5[29]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:32:34 LOG5[30]: Service [Deep Web Radio Out] accepted
connection from ::1:45136
2020.01.15 11:32:34 LOG6[30]: Peer certificate not required
2020.01.15 11:32:34 LOG3[30]: SSL_accept:
../ssl/record/ssl3_record.c:331: error:1408F10B:SSL
routines:ssl3_get_record:wrong version number
2020.01.15 11:32:34 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:32:34 LOG5[31]: Service [Deep Web Radio Out] accepted
connection from ::1:45138
2020.01.15 11:32:34 LOG6[31]: Peer certificate not required
2020.01.15 11:32:34 LOG3[31]: SSL_accept:
../ssl/record/ssl3_record.c:321: error:1408F09C:SSL
routines:ssl3_get_record:http request
2020.01.15 11:32:34 LOG5[31]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2020.01.15 11:32:34 LOG5[32]: Service [Deep Web Radio Out] accepted
connection from ::1:45140
2020.01.15 11:32:34 LOG6[32]: Peer certificate not required
2020.01.15 11:32:34 LOG3[32]: SSL_accept: ../ssl/t1_lib.c:2719:
error:14201076:SSL routines:tls_choose_sigalg:no suitable signature
algorithm
2020.01.15 11:32:34 LOG5[32]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
1
0
I'm working on openvpn over stunnel. My configuration can work with windows and linux. both are stunnel4.
But it never work out in android. I have ubuntu18.04 and set as stunnel4 server side.
I try to get connected with android stunnel: SSLSocks<https://github.com/comp500/SSLSocks/releases/tag/0.0.17-beta>, which should be compiled with stunnel5. It simply not work.
I got "NETWORK_EOF_ERROR" time to time.
If I remove stunnel tunnel, it will just work. So I think it's stunnel5 to stunnel4 issue. But how to avaoid such issue?
Best Regards
Robin
1
0
15 Jan '20
I'm testing openvpn over stunnel4 and I found a weird issue: I have to restart my Ubuntu 18.04 to be able to start the stunnel service. Don't know why I couldn't start the service dicrectly by :
Systemctl start stunnel4
OS: Ubuntu 18.04
#>apt install stunnel4
and generate a conf like this:
cert=/etc/stunnel/server.crt
key=/etc/stunnel/server.key
[openvpn-localhost]
accept = 8443
connect = 127.0.0.1:11000
Now start the service:
#>systemctl start stunnel4
#>systemctl status stunnel4
stunnel4.service - LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)
Loaded: loaded (/etc/init.d/stunnel4; generated)
Active: active (exited) since Wed 2020-01-15 14:40:11 CST; 10min ago
Docs: man:systemd-sysv-generator(8)
Tasks: 0 (limit: 4915)
CGroup: /system.slice/stunnel4.service
Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ systemd[1]: Starting LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)...
Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ stunnel4[3583]: TLS tunnels disabled, see /etc/default/stunnel4
Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ systemd[1]: Started LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons).
Why it exited? But after reboot, same command will just work. Is it a bug?
I want to find a way to start it directly after installation. Please help!
Best Regards
Robin
1
0
Dear Support,
For captioned, I adopted stunnel server and client socket protection in pcs
cluster. I want to stop pacemaker cluster service by command "pcs cluster
stop --all" and stop master node in master node servet but the down process
is hang up when stunnel server process started, could you help to tell me
what's problem and how to fix this problem?
Best regards
Tony
1
0