stunnel-users November 2023

7 participants
8 discussions

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

Stunnel load balancing through F5
by caspernetherlands＠gmail.com 05 Dec '23

05 Dec '23

Hello, Was wondering if anyone has tried to setup an HA like setup, specifically active/passive through two Stunnel servers and F5 load balancers. The problem I have is that TCP health checks (active checks) from the F5 are causing session initiation all the way to the 3rd party on the other side and this is causing a lot of unnecessary TCP traffic at the transport layer. The good thing is that the F5 closes these TCP sessions, but the problem is the 3rd party thinks someone is trying to brute force or something. Does anyone know how to maintain the TCP active health checks that the F5 does, but at the same time not cause a session initiation all the way to the 3rd party? Or if it’s not possible to stop the session initiation, would there be any option where something can be adjusted in the stunnel side so that the other side sees only one TCP health check as opposed to multiple every few seconds?

3 3

WG: stunnel core dumps, "SSL3_GET_RECORD:decryption failed or bad record mac"
by Sacha Hottinger 27 Nov '23

27 Nov '23

Hello, We are using stunnel 5.71 on Solaris 10 to tunnel NFS on more than 50 systems. In the past we saw stunnel dumping cores without any errors or hints in the stunnel log file. It was believed to be an OpenSSL 1.x problem. We got an stunnel version with SSL 2.x and 3.x but we had to go back to 1.x because of other problems. We noticed the dumps to happen at regular times and found a script that made NFS requests every 10 Min. After changing the script so there are less NFS requests it was stable. It looked like the problem accumulated over time and a counter or something alike reached its limit which then resulted in the core dump. Then the core dumps started again. It still seems to be related to the amount of requests because the problem occurs on the two NFS Servers with the highest number of connections. This time, we see errors in the stunnel log. The error slightly varies: 2023.10.12 22:05:43 LOG3[10745]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac // There were also a few cases with an additional "internal error". I.e: 2023.10.16 00:23:53 LOG5[2968]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:38270 2023.10.16 00:40:19 LOG3[2968]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.16 00:40:19 LOG3[2967]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.16 00:40:19 LOG5[2968]: Connection reset: 2476 byte(s) sent to TLS, 3324 byte(s) sent to socket 2023.10.16 00:40:19 LOG5[2967]: Connection reset: 2500 byte(s) sent to TLS, 3100 byte(s) sent to socket INTERNAL ERROR: Bad magic at ssl.c, line 192 2023.10.16 00:40:20 LOG6[ui]: Initializing inetd mode configuration // or 2023.10.23 07:33:53 LOG5[62]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:50626 2023.10.23 07:38:37 LOG3[62]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.23 07:38:37 LOG5[62]: Connection reset: 364 byte(s) sent to TLS, 336 byte(s) sent to socket ... 2023.10.23 07:44:37 LOG5[61]: Connection reset: 1704 byte(s) sent to TLS, 2360 byte(s) sent to socket INTERNAL ERROR: Bad magic at OpenSSL, line 0 // or 2023.10.24 08:20:59 LOG5[52]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:43966 2023.10.24 08:56:13 LOG6[52]: Read socket closed (readsocket) ... 2023.10.24 09:00:01 LOG5[53]: Service [tls-nfs-srv] accepted connection from 1.2.3.4:59973 2023.10.24 09:00:01 LOG6[53]: Peer certificate not required 2023.10.24 09:00:01 LOG3[49]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.24 09:00:01 LOG5[49]: Connection reset: 7112 byte(s) sent to TLS, 9188 byte(s) sent to socket INTERNAL ERROR: Dead canary at OpenSSL, line 0 I have attached a file with more details. Although this looks like an OpenSSL problem at first glance, we think it still could be a problem with stunnel. Can you make more out of this data? Do you know a way to log more information about the connections? i.e. not all requests were accepted. What happened here? 2023.11.24 02:50:13 LOG7[359]: 354 server accept(s) requested 2023.11.24 02:50:13 LOG7[359]: 351 server accept(s) succeeded Thank you in advance. Best regards Sasha This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager.

1 0

Proxy an unencrypted Oracle client
by Randall Smith 15 Nov '23

15 Nov '23

I'm trying to determine if it is possible to connect an Oracle client that is not configured for encrypted connections to a TLS or mTLS connected Oracle Autonomous database using an stunnel client connection. First I tested a TLS capable client to verify connectivity. Next I set up stunnel to make the same TLS connection. I have configured stunnel as follows: foreground = yes debug = info [oracle] accept = 127.0.0.1:1521 connect = adb.us-ashburn-1.oraclecloud.com:1521 client = yes Next, I attempted a non-encrypted Oracle database connection to 127.0.0.1:1521, but got the following errors from stunnel: 2023.11.14 10:58:50 LOG6[0]: TLS connected: new session negotiated 2023.11.14 10:58:50 LOG6[0]: TLSv1.2 ciphersuite: AES256-GCM-SHA384 (256-bit encryption) 2023.11.14 10:58:50 LOG3[0]: SSL_read: ../ssl/record/ssl3_record.c:1065: error:14191044:SSL routines:tls1_enc:internal error 2023.11.14 10:58:50 LOG5[0]: Connection reset: 752 byte(s) sent to TLS, 8 byte(s) sent to socket ^C2023.11.14 10:58:57 LOG3[ui]: Received SIGINT; terminating Could this be a configuration issue in stunnel or might there be something in the Oracle database protocol itself that is different for TLS connections that would prevent tunneling?

1 0

Re: Silent installation is not working for Stunnel v5.71
by Josealf.rm 10 Nov '23

10 Nov '23

Hi Pavan, AFAIK, there is no option to customise the components when you do a silent install. You get all components. If someone knows better, let me know. Regards Jose > On 9/11/2023, at 1:09 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: > > Hi Jose, > > Gentle Reminder !! > > Can we get an update on this. > > Regards, > PavanReddy. > > -----Original Message----- > From: Pavan Reddy > Sent: Tuesday, November 7, 2023 10:17 AM > To: Josealf.rm <josealf(a)rocketmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: RE: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Jose, > > I have re-attached the snapshots for your reference. > > Regards, > PavanReddy. > > -----Original Message----- > From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Thursday, November 2, 2023 4:49 PM > To: Pavan Reddy <pavan.reddy(a)adaptiva.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Pavan, > > Sorry, I don’t see the snapshots/customizations you talk about. > > Regards > Jose > >> On 30/10/2023, at 7:19 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: >> >> Hi Team, >> >> Could you please provide an update on this. >> >> Regards, >> PavanReddy. >> >> -----Original Message----- >> From: Pavan Reddy >> Sent: Wednesday, October 25, 2023 3:08 PM >> To: Josealf.rm <josealf(a)rocketmail.com> >> Cc: stunnel-users(a)stunnel.org >> Subject: RE: [stunnel-users] Silent installation is not working for >> Stunnel v5.71 >> >> Hi Team, >> >> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. >> For more details you may refer https://adaptiva.com/products/autonomous-patch. We are willing to add Stunnel 5.71 product to our catalogue. >> >> Application is installing silently by using /S. >> >> While installing the application we found these customizations. And I am attaching the snapshots. >> >> Could you please have a look and help us to handle these customizations with silent properties. >> >> Regards, >> PavanReddy. >> >> -----Original Message----- >> From: Josealf.rm <josealf(a)rocketmail.com> >> Sent: Monday, October 23, 2023 4:50 PM >> To: Meta Email <meta(a)adaptiva.com> >> Cc: stunnel-users(a)stunnel.org >> Subject: Re: [stunnel-users] Silent installation is not working for >> Stunnel v5.71 >> >> [Some people who received this message don't often get email from >> josealf(a)rocketmail.com. Learn why this is important at >> https://aka.ms/LearnAboutSenderIdentification ] >> >> Stunnel uses an NSIS based installer. Try using /S instead of -quiet. >> >> -quiet is a switch for stunnel.exe, not for the installer and is used to configure stunnel as a service. >> >> >> Regards >> Jose >> >>>> On 23/10/2023, at 3:30 AM, Meta Adaptiva via stunnel-users <stunnel-users(a)stunnel.org> wrote: >>> >>> Hi Team, >>> >>> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. >>> https://ada/ >>> p%2F&data=05%7C01%7Cpavan.reddy%40adaptiva.com%7C1d6b0f9facd740f536d4 >>> 08dbdb959b24%7C1264bc823da147f88a41e4c19cdc7499%7C0%7C0%7C63834520784 >>> 7265891%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiL >>> CJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=hWcJe3nMjxuwIPz9M >>> ee9qKT5xCAi6ubmK3l%2FIu45e94%3D&reserved=0 >>> tiva.com%2Fproducts%2Fautonomous-patch&data=05%7C01%7Cpavan.reddy%40a >>> d >>> aptiva.com%7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e >>> 4 >>> c19cdc7499%7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWI >>> j >>> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7 >>> C >>> %7C%7C&sdata=Vp%2FDHnulu3OEo%2BBnEnt5EY4GQfThzGQ5SC75YK%2Bb3V0%3D&res >>> e >>> rved=0 >>> >>> We have downloaded the binary from below URL – >>> https://www/. >>> stunnel.org%2Fdownloads.html&data=05%7C01%7Cpavan.reddy%40adaptiva.co >>> m >>> %7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4c19cdc749 >>> 9 >>> %7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjA >>> w >>> MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sd >>> a >>> ta=kIsTmj%2Bx3fIiPWKL85BDKJ8yN2K%2FKk077dWHsb82Q9M%3D&reserved=0 >>> >>> We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. >>> Could you please help us to install the application silently. >>> _______________________________________________ >>> stunnel-users mailing list -- stunnel-users(a)stunnel.org To >>> unsubscribe send an email to stunnel-users-leave(a)stunnel.org >> >> Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email. > > Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email.

1 0

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

Re: Silent installation is not working for Stunnel v5.71
by Josealf.rm 02 Nov '23

02 Nov '23

Hi Pavan, Sorry, I don’t see the snapshots/customizations you talk about. Regards Jose > On 30/10/2023, at 7:19 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: > > Hi Team, > > Could you please provide an update on this. > > Regards, > PavanReddy. > > -----Original Message----- > From: Pavan Reddy > Sent: Wednesday, October 25, 2023 3:08 PM > To: Josealf.rm <josealf(a)rocketmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: RE: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Team, > > We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. > For more details you may refer https://adaptiva.com/products/autonomous-patch. We are willing to add Stunnel 5.71 product to our catalogue. > > Application is installing silently by using /S. > > While installing the application we found these customizations. And I am attaching the snapshots. > > Could you please have a look and help us to handle these customizations with silent properties. > > Regards, > PavanReddy. > > -----Original Message----- > From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Monday, October 23, 2023 4:50 PM > To: Meta Email <meta(a)adaptiva.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > [Some people who received this message don't often get email from josealf(a)rocketmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] > > Stunnel uses an NSIS based installer. Try using /S instead of -quiet. > > -quiet is a switch for stunnel.exe, not for the installer and is used to configure stunnel as a service. > > > Regards > Jose > >> On 23/10/2023, at 3:30 AM, Meta Adaptiva via stunnel-users <stunnel-users(a)stunnel.org> wrote: >> >> Hi Team, >> >> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. >> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fadap >> tiva.com%2Fproducts%2Fautonomous-patch&data=05%7C01%7Cpavan.reddy%40ad >> aptiva.com%7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4 >> c19cdc7499%7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIj >> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C >> %7C%7C&sdata=Vp%2FDHnulu3OEo%2BBnEnt5EY4GQfThzGQ5SC75YK%2Bb3V0%3D&rese >> rved=0 >> >> We have downloaded the binary from below URL – >> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww. >> stunnel.org%2Fdownloads.html&data=05%7C01%7Cpavan.reddy%40adaptiva.com >> %7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4c19cdc7499 >> %7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAw >> MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sda >> ta=kIsTmj%2Bx3fIiPWKL85BDKJ8yN2K%2FKk077dWHsb82Q9M%3D&reserved=0 >> >> We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. >> Could you please help us to install the application silently. >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe >> send an email to stunnel-users-leave(a)stunnel.org > > Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email.

1 0

two stunnels in the local network
by alessandro.deliperi＠ichnobyte.it 02 Nov '23

02 Nov '23

Hi everyone, this is my first question. I have successfully configured a stunnel (A) that does the job of it. I need to configure a second stunnel (B) that works in a more hidden network. When B connects to A, which connects to public mail server X I get a time out error. I bring you the logs, I think it is related to the fact that both stunnel servers are trying to establish a TLS session. Is there a way to solve? 2023.11.02 08:42:10 LOG7[0]: Option TCP_NODELAY set on local socket 2023.11.02 08:42:10 LOG5[0]: Service [smtp-tls] accepted connection from 192.168.0.109:46078 2023.11.02 08:42:10 LOG6[0]: s_connect: connecting 192.168.180.10:25 2023.11.02 08:42:10 LOG7[0]: s_connect: s_poll_wait 192.168.180.10:25: waiting 10 seconds 2023.11.02 08:42:10 LOG7[0]: FD=6 events=0x2001 revents=0x0 2023.11.02 08:42:10 LOG7[0]: FD=11 events=0x2005 revents=0x0 2023.11.02 08:42:10 LOG5[0]: s_connect: connected 192.168.180.10:25 2023.11.02 08:42:10 LOG5[0]: Service [smtp-tls] connected remote server from 192.168.0.23:41156 2023.11.02 08:42:10 LOG7[0]: Setting remote socket options (FD=11) 2023.11.02 08:42:10 LOG7[0]: Option TCP_NODELAY set on remote socket 2023.11.02 08:42:10 LOG7[0]: Remote descriptor (FD=11) initialized 2023.11.02 08:42:10 LOG7[0]: <- 220 mailservers 2023.11.02 08:42:10 LOG7[0]: -> 220 mailservers 2023.11.02 08:42:10 LOG7[0]: -> EHLO localhost 2023.11.02 08:42:11 LOG7[0]: <- 250-email-smtp.posta 2023.11.02 08:42:11 LOG7[0]: <- 250-8BITMIME 2023.11.02 08:42:11 LOG7[0]: <- 250-STARTTLS 2023.11.02 08:42:11 LOG7[0]: <- 250-AUTH PLAIN LOGIN 2023.11.02 08:42:11 LOG7[0]: <- 250 Ok 2023.11.02 08:42:11 LOG7[0]: -> STARTTLS 2023.11.02 08:42:11 LOG7[0]: <- 503 TLS not available due to temporary reason: TLS already active 2023.11.02 08:42:11 LOG3[0]: Remote server is not RFC 2487 compliant 2023.11.02 08:42:11 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users November 2023