sorry to bother,
im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites.
i heard stunnel cant be configured to always forward to the current
site address dynamically, thats why i would use privoxy.
the browser is configured to send to:
127.0.0.1 443
stunnel config has this at the end:
[Tunnel_in]
client = yes
accept = 127.0.0.1:443
connect = 127.0.0.1:8118
verifyChain = yes
CAfile = ca-certs.pem
checkHost = localhost
127.0.0.1:8118 is the privoxy address.
this is what stunnel writes:
LOG5[main]: Configuration successful
LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261
LOG5[0]: s_connect: connected 127.0.0.1:8118
LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262
and the browser infinitely loads, and never loads anything or leaves the page.
if i remove the last 3 lines, its the same just with this line added:
LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks
but it doesnt give an error or anything.
with a configuration like:
[Tunnel_out]
client = no
accept = 127.0.0.1:443
connect = 127.0.0.1:8118
cert = stunnel.pem
this is what it gives:
LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294
LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL
routines:SSL23_GET_CLIENT_HELLO:https proxy request
LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
and browser gives a server not found error immediately. im not even
sure if i should use client or server configuration in a case like
this, but none of them works anyway. all i would need is for my
browser to get the pages decrypted, or at least in less than TLS1.1.
like how on newipnow.com i can access sites with any encryption, since
they are sent to the browser without encryption. the browser just
gives an "unencrypted tunnel" warning, which is how i found stunnel,
and which is exactly what i need, just locally.
8
41
Hi,
I've been using Stunnel for many years without a problem but I just changed my email provider and now my mail client can't send emails.
Receiving via POP is still fine, but sending via SMTP is giving the error "SSL_connect: ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number"
The old SMTP server was on port 465 whereas the new server (hotmail) is on port 587 so that may be the source of the problem.
My config file is quite simple:
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
client = yes
[pop]
accept = 110
connect = outlook.office365.com:995
[smtp]
accept = 25
connect = smtp-mail.outlook.com:587
I just changed the POP and SMTP server details to the new ones. POP is still on port 995 as it was before but SMTP has changed from 465 to 587.
I was running an older version of Stunnel but updating to latest version hasn't helped.
Does anyone have any ideas? I'd hate to have to lose my old Email client which has so many messages stored so it would be great to get it working fully with hotmail.
Thanks!
Graham.
4
3
Good morning guys!
I started using stunnel very recently with GLPI to authenticate to
Google LDAP, and it is working, but with extreme slowness at Login.
Something around 35 seconds. I believe there may be some parameters,
adjustments to make. I'm sending the stunnel.conf configuration below,
as well as the attached log file(txt). Could you give me a suggestion.
Thanks,
Luciano
# stunnel.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
debug = 7
output = /var/log/stunnel4/stunnel.log
[ldap]
client = yes
accept = 127.0.0.1:1636
connect = ldap.google.com:636
cert = /etc/certificates/glpi_ldap.crt
key = /etc/certificates/glpi_ldap.key
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1
0
I have a strange problem connecting from a C++ application using the Paho framework to the stunnel.
The certificates are self signed, and MQTT Explorerr hooks up nicely and validates the certificate when fed with the appropriate ca certificate.
So, stunnel seems to behave nicely on some cases, others not.
The stunnel log shows a SSL_accept: ssl/record/ssl3_record_c:354: errror: 0A00010B:SSL wrong version.
I have tried version 1.1 and 1.2 in the Paho library, both failing with the same error code.
Any ideas or suggestions?
1
0
Michael,
On 12/13/23 15:43, Michael D. Setzer II wrote:
> /var/log/secure
Thank you for your reply, but /var/log is basically empty (meaning very
few files located there). journald has absorbed everything and files are
no longer the way to get logs from systemd-based environments.
The only thing which contains non-trivial information is
/var/log/journal/* which is a bunch of binary files.
My reply below shows how you can get the stunnel-related log messages. I
don't believe they are available through any traditional text-based log
file.
-chris
> On 13 Dec 2023 at 15:37, Christopher Schultz wrote:
>
> Date sent: Wed, 13 Dec 2023 15:37:04 -0500
> To: "'stunnel-users(a)stunnel.org'"
> <stunnel-users(a)stunnel.org>
> From: Christopher Schultz
> <chris(a)christopherschultz.net>
> Subject: [stunnel-users] Re: Getting logs in systemd
> environment
> patches" <stunnel-users.stunnel.org>
>
>> Carter,
>>
>> On 12/13/23 14:53, cbrowne wrote:
>>> Have you tried doing "find / -name stunnel.log -print" as root. I have
>>> found that the log file can be in a number of different locations
>>> depending on the system.
>>
>> There are no files named stunnel.log on my system.
>>
>> I do not have a specific setting for "output". I was expecting syslog to
>> be used for that purpose without a specific setting. syslog=yes appears
>> to be the default given the man page for stunnel.
>>
>> But your comment got me more interested in exactly what was happening,
>> so I tried /not/ limiting journalctl --follow to a specific service and
>> I can see all kinds of things coming from stunnel:
>>
>>
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready
>> file descriptor(s)
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4
>> events=0x2001 revents=0x0
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11
>> events=0x2001 revents=0x1
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12
>> events=0x2001 revents=0x0
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13
>> events=0x2001 revents=0x0
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14
>> events=0x2001 revents=0x0
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service
>> [ORU-outbound] accepted (FD=3) from ::ffff:20.204.213.204:55455
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Service
>> [ORU-outbound] started
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Setting local
>> socket options (FD=3)
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Option
>> TCP_NODELAY set on local socket
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Service
>> [ORU-outbound] accepted connection from ::ffff:20.204.213.204:55455
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174806]: Peer
>> certificate required
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
>> (accept): before SSL initialization
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
>> (accept): before SSL initialization
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Initializing
>> application specific data for session authenticated
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: SNI: no
>> virtual services defined
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
>> (accept): SSLv3/TLS read client hello
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
>> (accept): SSLv3/TLS write server hello
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
>> (accept): SSLv3/TLS write certificate
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
>> (accept): SSLv3/TLS write key exchange
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
>> (accept): SSLv3/TLS write certificate request
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
>> (accept): SSLv3/TLS write server done
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready
>> file descriptor(s)
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4
>> events=0x2001 revents=0x0
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11
>> events=0x2001 revents=0x1
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12
>> events=0x2001 revents=0x0
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13
>> events=0x2001 revents=0x0
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14
>> events=0x2001 revents=0x0
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service
>> [ORU-outbound] accepted (FD=15) from ::ffff:client.ip:44905
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Service
>> [ORU-outbound] started
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Setting local
>> socket options (FD=15)
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Option
>> TCP_NODELAY set on local socket
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174807]: Service
>> [ORU-outbound] accepted connection from ::ffff:client.ip:44905
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174807]: Peer
>> certificate required
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
>> (accept): before SSL initialization
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
>> (accept): before SSL initialization
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Initializing
>> application specific data for session authenticated
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: SNI: no
>> virtual services defined
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
>> (accept): SSLv3/TLS read client hello
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
>> (accept): SSLv3/TLS write server hello
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
>> (accept): SSLv3/TLS write certificate
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
>> (accept): SSLv3/TLS write key exchange
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
>> (accept): SSLv3/TLS write certificate request
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
>> (accept): SSLv3/TLS write server done
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS alert
>> (read): fatal: certificate unknown
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Remove
>> session callback
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG3[174806]: SSL_accept:
>> ssl/record/rec_layer_s3.c:1605: error:0A000416:SSL routines::sslv3 alert
>> certificate unknown
>> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Connection
>> reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
>>
>> So this probably just comes down to either systemd/journalctl or me
>> being stupid.
>>
>> Instead of asking for the journal/log for the "unit" stunnel (i.e.
>> journalctl -u stunnel), you need instead to ask for the "systelog
>> identifier" called stunnel like this:
>>
>> $ journalctl -t stunnel
>>
>> If you use --follow you get tail -f behavior, which is nice to see
>> what's happening in real-time.
>>
>> -chris
>>
>>> On 12/13/2023 2:39 PM, Christopher Schultz wrote:
>>>> other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears
>>>> the case that I should be able to view the journals using this command:
>>>>
>>>> sudo journalctl --follow -u stunnel.service
>>>>
>>>> But nothing is ever printed there.
>>>
>> _______________________________________________
>> stunnel-users mailing list -- stunnel-users(a)stunnel.org
>> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org
>
>
> +------------------------------------------------------------+
> Michael D. Setzer II - Computer Science Instructor
> (Retired)
> mailto:[email protected]
> mailto:[email protected]
> mailto:[email protected]
> Guam - Where America's Day Begins
> G4L Disk Imaging Project maintainer
> http://sourceforge.net/projects/g4l/
> +------------------------------------------------------------+
>
>
>
2
2
All,
I recently built a server from scratch in Amazon EC2 using Amazon Linux
2023 which is systemd-based.
When having trouble with a client failing to connect to our
stunnel-based service, I tried raising the log level:
debug=7
and restarted the service.
I can't find any indication that the logs are available.
There is no /var/log/stunnel directory. There are none of the usual
files I might expect these logs to be in on other systems (e.g.
/var/log/seure, /var/log/auth, etc.). It appears the case that I should
be able to view the journals using this command:
sudo journalctl --follow -u stunnel.service
But nothing is ever printed there.
Does anyone know how to get logging from stunnel in this kind of
environment?
(BTW, *I* am able to connect to this service, so I know it's running,
etc. This is only a logging-problem, not an stunnel-isnt-working problem.)
Thanks,
-chris
2
1
Carter,
On 12/13/23 14:53, cbrowne wrote:
> Have you tried doing "find / -name stunnel.log -print" as root. I have
> found that the log file can be in a number of different locations
> depending on the system.
There are no files named stunnel.log on my system.
I do not have a specific setting for "output". I was expecting syslog to
be used for that purpose without a specific setting. syslog=yes appears
to be the default given the man page for stunnel.
But your comment got me more interested in exactly what was happening,
so I tried /not/ limiting journalctl --follow to a specific service and
I can see all kinds of things coming from stunnel:
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready
file descriptor(s)
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4
events=0x2001 revents=0x0
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11
events=0x2001 revents=0x1
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12
events=0x2001 revents=0x0
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13
events=0x2001 revents=0x0
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14
events=0x2001 revents=0x0
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service
[ORU-outbound] accepted (FD=3) from ::ffff:20.204.213.204:55455
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Service
[ORU-outbound] started
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Setting local
socket options (FD=3)
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Option
TCP_NODELAY set on local socket
Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Service
[ORU-outbound] accepted connection from ::ffff:20.204.213.204:55455
Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174806]: Peer
certificate required
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
(accept): before SSL initialization
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
(accept): before SSL initialization
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Initializing
application specific data for session authenticated
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: SNI: no
virtual services defined
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
(accept): SSLv3/TLS read client hello
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
(accept): SSLv3/TLS write server hello
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
(accept): SSLv3/TLS write certificate
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
(accept): SSLv3/TLS write key exchange
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
(accept): SSLv3/TLS write certificate request
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state
(accept): SSLv3/TLS write server done
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready
file descriptor(s)
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4
events=0x2001 revents=0x0
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11
events=0x2001 revents=0x1
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12
events=0x2001 revents=0x0
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13
events=0x2001 revents=0x0
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14
events=0x2001 revents=0x0
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service
[ORU-outbound] accepted (FD=15) from ::ffff:client.ip:44905
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Service
[ORU-outbound] started
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Setting local
socket options (FD=15)
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Option
TCP_NODELAY set on local socket
Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174807]: Service
[ORU-outbound] accepted connection from ::ffff:client.ip:44905
Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174807]: Peer
certificate required
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
(accept): before SSL initialization
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
(accept): before SSL initialization
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Initializing
application specific data for session authenticated
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: SNI: no
virtual services defined
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
(accept): SSLv3/TLS read client hello
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
(accept): SSLv3/TLS write server hello
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
(accept): SSLv3/TLS write certificate
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
(accept): SSLv3/TLS write key exchange
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
(accept): SSLv3/TLS write certificate request
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state
(accept): SSLv3/TLS write server done
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS alert
(read): fatal: certificate unknown
Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Remove
session callback
Dec 13 20:31:00 example.com stunnel[300695]: LOG3[174806]: SSL_accept:
ssl/record/rec_layer_s3.c:1605: error:0A000416:SSL routines::sslv3 alert
certificate unknown
Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Connection
reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
So this probably just comes down to either systemd/journalctl or me
being stupid.
Instead of asking for the journal/log for the "unit" stunnel (i.e.
journalctl -u stunnel), you need instead to ask for the "systelog
identifier" called stunnel like this:
$ journalctl -t stunnel
If you use --follow you get tail -f behavior, which is nice to see
what's happening in real-time.
-chris
> On 12/13/2023 2:39 PM, Christopher Schultz wrote:
>> other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears
>> the case that I should be able to view the journals using this command:
>>
>> sudo journalctl --follow -u stunnel.service
>>
>> But nothing is ever printed there.
>
1
0
Hi all
I was wondering if there is a way to connect multiple stunnel clients running on different machines to the same stunnel server service, also running on a different machine.
All the clients must connect to the same server port.
I have tried it with my current config but I haven't been able to make it work, is this even possible??
Thanks,
Esteban.
3
4
07 Dec '23
Hi All,
I can ssh to my VM with terminal etc. However my stunnel has something stopping the packet flow? What could be the problem and what should I check / troubleshoot:
client log file:
2023.12.07 07:21:05 LOG7[0]: Service [Sql_Silicon] started
2023.12.07 07:21:05 LOG7[0]: Setting local socket options (FD=636)
2023.12.07 07:21:05 LOG7[0]: Option TCP_NODELAY set on local socket
2023.12.07 07:21:05 LOG5[0]: Service [Sql_Silicon] accepted connection from 127.0.0.1:50474
2023.12.07 07:21:05 LOG6[0]: s_connect: connecting <IP>:<Port>
2023.12.07 07:21:05 LOG7[0]: s_connect: s_poll_wait <IP>:<Port>: waiting 10 seconds
2023.12.07 07:21:05 LOG7[0]: FD=676 ifds=rwx ofds=---
2023.12.07 07:21:15 LOG3[0]: s_connect: s_poll_wait <IP>:<Port>: TIMEOUTconnect exceeded
2023.12.07 07:21:15 LOG3[0]: No more addresses to connect
2023.12.07 07:21:15 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
2023.12.07 07:21:15 LOG7[0]: local_rfd/local_wfd reset (FD=636)
2023.12.07 07:21:15 LOG7[0]: Local descriptor (FD=636) closed
2023.12.07 07:21:15 LOG7[0]: Service [Sql_Silicon] finished (0 left)
My VM is a linux server, on startup of stunnel I get this concerning message which might be the cause?
However, I checked and stunnel4:stunnel4 has permissions on the folder and psk file.
2023.12.07 07:40:45 LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/pskSQL_.txt
server log file on start service:
2023.12.07 07:40:45 LOG7[ui]: Clients allowed=500
2023.12.07 07:40:45 LOG5[ui]: stunnel 5.56 on x86_64-pc-linux-gnu platform
2023.12.07 07:40:45 LOG5[ui]: Compiled with OpenSSL 1.1.1k 25 Mar 2021
2023.12.07 07:40:45 LOG5[ui]: Running with OpenSSL 1.1.1w 11 Sep 2023
2023.12.07 07:40:45 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP
2023.12.07 07:40:45 LOG7[ui]: errno: (*__errno_location ())
2023.12.07 07:40:45 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf
2023.12.07 07:40:45 LOG5[ui]: UTF-8 byte order mark not detected
2023.12.07 07:40:45 LOG5[ui]: FIPS mode disabled
2023.12.07 07:40:45 LOG7[ui]: Compression disabled
2023.12.07 07:40:45 LOG7[ui]: No PRNG seeding was required
2023.12.07 07:40:45 LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/pskSQL_.txt
2023.12.07 07:40:45 LOG6[ui]: PSKsecrets line 1: 64-byte hexadecimal key configured for identity "siliconServer"
2023.12.07 07:40:45 LOG6[ui]: Initializing service [SQL-<port>]
2023.12.07 07:40:45 LOG6[ui]: PSK identities: 1 retrieved
2023.12.07 07:40:45 LOG7[ui]: Ciphers: PSK
2023.12.07 07:40:45 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256
2023.12.07 07:40:45 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000)
2023.12.07 07:40:45 LOG7[ui]: No certificate or private key specified
2023.12.07 07:40:45 LOG6[ui]: DH initialization needed for DHE-PSK-AES256-GCM-SHA384
2023.12.07 07:40:45 LOG7[ui]: DH initialization
2023.12.07 07:40:45 LOG7[ui]: No certificate available to load DH parameters
2023.12.07 07:40:45 LOG6[ui]: Using dynamic DH parameters
2023.12.07 07:40:45 LOG7[ui]: ECDH initialization
2023.12.07 07:40:45 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384
2023.12.07 07:40:45 LOG5[ui]: Configuration successful
2023.12.07 07:40:45 LOG7[ui]: Binding service [SQL-<port>]
2023.12.07 07:40:45 LOG7[ui]: Listening file descriptor created (FD=9)
2023.12.07 07:40:45 LOG7[ui]: Setting accept socket options (FD=9)
2023.12.07 07:40:45 LOG7[ui]: Option SO_REUSEADDR set on accept socket
2023.12.07 07:40:45 LOG6[ui]: Service [SQL-<port>] (FD=9) bound to <IP>:<port>
2023.12.07 07:40:45 LOG5[ui]: Switched to chroot directory: /var/lib/stunnel4/
2023.12.07 07:40:45 LOG7[main]: Created pid file /stunnel.pid
2023.12.07 07:40:45 LOG7[cron]: Cron thread initialized
2023.12.07 07:40:45 LOG6[cron]: Executing cron jobs
2023.12.07 07:40:45 LOG5[cron]: Updating DH parameters
2
1
Hello,
Was wondering if anyone has tried to setup an HA like setup, specifically active/passive through two Stunnel servers and F5 load balancers.
The problem I have is that TCP health checks (active checks) from the F5 are causing session initiation all the way to the 3rd party on the other side and this is causing a lot of unnecessary TCP traffic at the transport layer. The good thing is that the F5 closes these TCP sessions, but the problem is the 3rd party thinks someone is trying to brute force or something.
Does anyone know how to maintain the TCP active health checks that the F5 does, but at the same time not cause a session initiation all the way to the 3rd party? Or if it’s not possible to stop the session initiation, would there be any option where something can be adjusted in the stunnel side so that the other side sees only one TCP health check as opposed to multiple every few seconds?
3
3