August 2022 - stunnel-users

Enter-passphrase dialog broken
by Johann Hörmann 15 Aug '22

15 Aug '22

Hi, since stunnel 5.62 it does not take the passphrase for a client key anymore, instead it gives a 'bad decrypt' log at once. It is the same behaviour at Debian/sid Distro as well as with Windows10. Up to stunnel 5.61 the same stunnel.conf is accepted and the key gets loaded. Here is the top of our stunnel.conf: cert = /home/regula/cert.pem key = /home/regula/cert.key client = yes [-- snip --] Calling stunnel at the bash: $ stunnel stunnel.conf [-- snip --] [ ] Loading certificate from file: /home/regula/cert.pem [ ] Certificate loaded from file: /home/regula/cert.pem [ ] Loading private key from file: /home/regula/cert.key [!] error queue: ../ssl/ssl_rsa.c:384: error:0A080009:SSL routines::PEM lib [!] error queue: ../crypto/pkcs12/p12_decr.c:86: error:11800074:PKCS12 routines::pkcs12 cipherfinal error [!] error queue: ../providers/implementations/ciphers/ciphercommon_block.c:124: error:1C800064:Provider routines::bad decrypt [!] error queue: ../crypto/pkcs12/p12_decr.c:86: error:11800074:PKCS12 routines::pkcs12 cipherfinal error [!] SSL_CTX_use_PrivateKey_file: ../providers/implementations/ciphers/ciphercommon_block.c:124: error:1C800064:Provider routines::bad decrypt [!] Service [guacamole]: Failed to initialize TLS context [!] Configuration failed [-- snip --] $ ls -lh *pem *key -r-------- 1 regula regula 3,4K 22. Jun 16:52 cert.key -r-------- 1 regula regula 2,2K 22. Jun 16:45 cert.pem openssl does show the enter passphrase dialog and displays the private key: $ $ openssl rsa -in cert.key Enter pass phrase for cert.key: writing RSA key -----BEGIN PRIVATE KEY----- [-- snip --] -----END PRIVATE KEY----- ~$ dpkg -l|grep openssl ii openssl 3.0.4-2 amd64 Secure Sockets Layer toolkit - cryptographic utility ~$ dpkg -l|grep stunnel ii stunnel4 3:5.63-1+b1 amd64 Universal SSL tunnel for network daemons Why is there a different behaviour between openssl and stunnel > 5.61 in loading a private key file? Regards, Johann -- https://www.hoermann-solutions.com

2 1

RTMP Stream from Milesight Camera to RTMPS server through stunnel
by nxcloudtest2021＠gmail.com 11 Aug '22

11 Aug '22

I am new to Stunnel and I would like to know how to push my RTMP Milesight Camera stream to Stunnel and then push it to my RTMP stream site here: rtmps://stream.mywebsite.com:1936/static/KI I tried modifying the method that would push a stream to nginx, then Stunnel, then Facebook, but it doesn't work for me. May I know what steps I should take to push my RTMP Milesight stream to Stunnel? Would nginx be necessary for this?

1 0

IMAP and SMTP user filtering
by snechiporus＠gmail.com 08 Aug '22

08 Aug '22

Hello all, I rebuilt Stunnel from source (Ubuntu 20.040 and now I am trying to add user filtering for IMAP and SMTP protocols. The purpose is following: I have non-SSL device that does not have permanent IP address (connected to mobile internet and its IP may change any time). This device should connect to Stunnel running on the server in Internet (not local network) to receive email from Gmail account. To prevent abuse I have to allow only one user (let's say, xxxxxx(a)gmail.com) to connect to my Stunnel instance. Is it possible? What part of code should I modify? Thank you

1 0

stunnel to the computer's IP address works, 127.0.0.1 fails
by Alan C. Bonnici 06 Aug '22

06 Aug '22

Hi, I setup a newly installed Windows 10 computer with STunnel. The same exact command using the IP address of the computer (eg 192.168.1.xxx) works while 127.0.0.1 fails. The config is set to listen on port only. What could be the problem? Thanks

1 0

Windows capi engine clarification
by raduci＠gmail.com 04 Aug '22

04 Aug '22

Dear all, I have a question related to capi engine: if stunnel is installed on a windows machine and capi tunnel is selected, which certificate is used to connect to secured server? Stunnel server machine certificate or client's certificate connecting through stunnel server? thank you!

1 0

Re: stunnel 5.65 released
by Jeff WIeland 02 Aug '22

02 Aug '22

Dennis Preiser wrote: > > On Mon, Jul 18, 2022 at 09:09:54AM +0200, Dennis Preiser wrote: >> On Sun, Jul 17, 2022 at 09:55:05PM +0200, Michał Trojnara via stunnel-users wrote: >>> I have released version 5.65 of stunnel. >> Unfortunately, it does not build here: >> >> | client.c:1514:11: error: use of undeclared identifier 'environ' >> >> I think this is caused by the following change in src/client.c (5.64 -> >> 5.65): >> >> | @@ -1396,7 +1399,9 @@ NOEXPORT SOCKET connect_local(CLI *c) { >> | >> | #else /* standard Unix version */ >> | >> | +#ifndef HAVE_UNISTD_H >> | extern char **environ; >> | +#endif >> | >> | NOEXPORT SOCKET connect_local(CLI *c) { /* spawn local process */ >> | int fd[2], pid; >> >> unistd.h is present on the system and thus HAVE_UNISTD_H is defined: >> >> | % grep 'HAVE_UNISTD_H' src/config.h >> | #define HAVE_UNISTD_H 1 >> >> My system: >> >> | % sw_vers >> | ProductName: macOS >> | ProductVersion: 12.4 >> | BuildVersion: 21F79 > Is there any chance this will be fixed? > > Dennis > _______________________________________________ > stunnel-users mailing list -- stunnel-users(a)stunnel.org > To unsubscribe send an email to stunnel-users-leave(a)stunnel.org I have the same problem with Solaris 10 on SPARC. -- Jeff Wieland, UNIX Systems Administrator Purdue University IT Infrastructure Services UNIX Platforms

1 0