stunnel-users September 2023

15 participants
16 discussions

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

stunnel events
by noel_melvin＠neimanmarcus.com 02 Oct '23

02 Oct '23

Whats the difference between Connection closed: : 2505 byte(s) sent to TLS, 59 byte(s) sent to socket and Connection closed: : 0 byte(s) sent to TLS, 0 byte(s) sent to socket we can see these kind of variations in the stunnel logs. if its 0 bytes doest it mean that client didnt send any data/packet to stunnel server? Need help

1 1

Java jdk.disabled.NamedCurves
by Randy Curry 27 Sep '23

27 Sep '23

Hello, We are making a Rest API to an endpoint that uses stunnel for their proxy. We recently upgraded our integration engine and it's running Java AdoptOpenJDK 11.0.15. Since we've upgraded we can only successfully make one or two POST API calls then we get an error: Caused by: java.io.IOException: Error writing to server I did some research and found this version of Java has disabled named curves, part of it's Elliptic-curve cryptography. Is there any known issues with stunnel and the version of Java that's being used or the disabled named curves? Thank you, Randy Curry Senior Integration Services Architect [cid:[email protected]] [cid:[email protected]][email protected]<mailto:[email protected]> [cid:[email protected]] 919.588.1036 [cid:[email protected]] www.mihin.org<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.mihin.org&d=DwQGaQ&…> [cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_MiHIN&d=Dw…>[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.youtube.com_user_M…>[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…> Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by returning the e-mail and destroying all copies of the original message.

1 0

stunnel 5.71 released
by Michał Trojnara 19 Sep '23

19 Sep '23

Dear Users, I have released version 5.71 of stunnel. ### Version 5.71, 2023.09.19, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.1.3. * Bugfixes - Fixed the console output of tstunnel.exe. * Features sponsored by SAE IT-systems - OCSP stapling is requested and verified in the client mode. - Using "verifyChain" automatically enables OCSP stapling in the client mode. - OCSP stapling is always available in the server mode. - An inconclusive OCSP verification breaks TLS negotiation. This can be disabled with "OCSPrequire = no". - Added the "TIMEOUTocsp" option to control the maximum time allowed for connecting an OCSP responder. * Features - Added support for Red Hat OpenSSL 3.x patches. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: f023aae837c2d32deb920831a5ee1081e11c78a5d57340f8e6f0829f031017f5 stunnel-5.71.tar.gz 945df5118473bcbf1ecdc5561fd6f26743c5dd1fd82e1a25199d0fd5c39a9373 stunnel-5.71-win64-installer.exe d511df533bb89464a324b2439e7e04b24b6ce26ecc0e03b67ada307725343d40 stunnel-5.71-android.zip Best regards, Mike

2 1

New machine
by stunnel＠paapnet.nl 16 Sep '23

16 Sep '23

Hello All, Who can help me? Just setup a new Ubuntu 22.04 (server) machine gcc version 11.4.0 (Ubuntu 11.4.0-1ubuntu1~22.04) grabbed stunnel (git) However running into issues (an old linux box runs well with compile) configure runs well: config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tests/Makefile config.status: creating tests/certs/Makefile config.status: creating src/config.h config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success Make bails out: root@dns:/Downloads/stunnel# make CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/bash '/Downloads/stunnel/auto/missing' aclocal-1.16 -I m4 cd . && /bin/bash /Downloads/stunnel/auto/missing automake-1.16 --foreign CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/bash '/Downloads/stunnel/auto/missing' autoconf configure.ac:53: warning: back quotes and double quotes must not be escaped in: Unknown thread model \"${withval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1553: AC_ARG_WITH is expanded from... configure.ac:53: the top level configure.ac:285: warning: back quotes and double quotes must not be escaped in: bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:285: the top level configure.ac:309: warning: back quotes and double quotes must not be escaped in: bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:309: the top level configure.ac:334: warning: back quotes and double quotes must not be escaped in: Bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:334: the top level configure.ac:369: warning: back quotes and double quotes must not be escaped in: Bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:369: the top level configure.ac:4: error: possibly undefined macro: AC_MSG_NOTICE If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. configure.ac:22: error: possibly undefined macro: AC_DEFINE make: *** [Makefile:409: configure] Error 1 aclocal (GNU automake) 1.16.5 autoconf (GNU Autoconf) 2.71 Is active What do I mis here ? Chrs....

1 0

Use of dante socks proxy with Stunnel
by vinesh＠techvinesh.com 15 Sep '23

15 Sep '23

I am deploying connection between on premise database with BI application on cloud. Currently the on premise database connecting via jdbc driver and it not supporting encryption. As per my understanding Stunnel opens port listening on http:127.0.0.1 ( as local) and forward traffic to destination over https using TLSv1.2. I have few question on this , to protect on network level, 1- can I use dante socks proxy along with Stunnel to provide 2 layer of protection? On-prem --- cloud ( 2 layer of protection) -- dante socks ( unencrypted tunnel) -- Stunnel ( e2e Encryption) 2- will it supporting CA other than openSsl

1 0

The stunnel process running on an AWS EC2 instance frequently enters a zombie state.
by sharukh.khan+stunnel＠seclore.com 12 Sep '23

12 Sep '23

We're facing an issue where the stunnel process running on our AWS Ec2 enters a zombie state. This results in the nfs server timeout (We're using EFS). We're running Amazon Linux 2 (Kernel version 4.14.318-241.531) with stunnel version 5.6.4. The configuration for stunnel is stated below: ; Sample stunnel configuration file for Win64 by Michal Trojnara 2002-2022 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) ;debug = info ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later ;securityLevel = 0 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini

2 4

stunnel events
by noel_melvin＠neimanmarcus.com 11 Sep '23

11 Sep '23

We have stunnel running on Windows machine. Just would like to know whether the below events is anything abnormal/critical to be addressed. 2023.09.07 10:10:16 LOG5[7]: Service [Application1] accepted connection from x.x.x.x:1234 2023.09.07 10:10:16 LOG6[7]: Peer certificate not required 2023.09.07 10:10:16 LOG6[7]: No peer certificate received 2023.09.07 10:10:16 LOG6[7]: Session id: (Alphanumeric) 2023.09.07 10:10:16 LOG6[7]: TLS accepted: new session negotiated 2023.09.07 10:10:16 LOG6[7]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-SHA256 (128-bit encryption) 2023.09.07 10:10:16 LOG6[7]: s_connect: connecting x.x.x.x:1234 2023.09.07 10:10:16 LOG5[7]: s_connect: connected x.x.x.x:1234 2023.09.07 10:10:16 LOG6[7]: persistence: x.x.x.x:1234 cached

1 1

Stunnel hangs with static build with openssl 1.1.1c
by eklein＠triple-eye.nl 07 Sep '23

07 Sep '23

I successfully cross compiled and built a static version of stunnel for ARM. It works with stunnel 5.70 and openssl 1.1.1b If however, I try to use openssl 1.1.1c, stunnel hangs. I narrowed the problem down to the following call in compression_init in ssl.c: comp_methods[COMP_NONE]=sk_SSL_COMP_new_null(); The program does not get past this point. I also tried to build with openssl 1.1.1v and 3.0.0, to no avail. I am using the following commands: To build openssl: ./Configure linux-armv4 --prefix=/home/erik/Documents/openssl-1.1.1b/install --openssldir=/home/erik/Documents/openssl-1.1.1b/install threads shared make CC=arm-linux-gnueabi-gcc make install To build stunnel: sed -i 's/^stunnel_LDFLAGS = /&-all-static /' src/Makefile.in export CFLAGS='-Os -fomit-frame-pointer -pipe' ./configure --with-ssl=/home/erik/Documents/openssl-1.1.1b/install --disable-fips --disable-shared --enable-static --disable-silent-rules --build x86_64-pc-linux-gnu --host arm-linux-gnueabi make What is the difference between openssl1.1.1b and 1.1.1c which causes this problem?

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users September 2023