- stunnel-users - stunnel.org

[patch] Systemd socket activation support in daemon mode
by Mark Theunissen 14 May '14

14 May '14

Hi, This patch allows stunnel to be started in daemon mode by systemd's socket activation. This is superior to inetd mode, for all the reasons specified in the stunnel howto. Since systemd is now the default in most of the major Linux distros, it would be great to have this committed upstream. https://gist.github.com/marktheunissen/7ce9426e66aa8f0ec2e1 Example systemd unit files: ### stunnel.socket [Unit] Description=Stunnel socket After=network.target [Socket] ListenStream=9999 ### stunnel.service [Unit] Description=Stunnel service After=network.target [Service] Type=forking ExecStart=stunnel /etc/stunnel/stunnel.conf Thanks, Mark Theunissen

1 1

Re: [stunnel-users] certificate verify failed
by Aaron Haywood 05 May '14

05 May '14

The following is an excerpt from my log's slightly modified to hide company specific data: 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=2, subject=/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2014.05.01 10:11:05 LOG6[5956]: Certificate accepted: depth=2, subject=/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=1, subject=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=######## 2014.05.01 10:11:05 LOG6[5956]: Certificate accepted: depth=1, subject=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=######## 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=0, subject=/O=*.somedomain.com/OU=Domain Control Validated/CN=*.somedomain.com 2014.05.01 10:11:05 LOG3[5956]: CERT: X509_STORE_get1_certs: Peer suddenly disconnected 2014.05.01 10:11:05 LOG4[5956]: Certificate check failed: depth=0, subject=/O=*.somedomain.com/OU=Domain Control Validated/CN=*.somedomain.com 2014.05.01 10:11:05 LOG7[5956]: SSL alert (write): fatal: certificate unknown Respectfully, Aaron Haywood | Systems Administrator [cid:[email protected]] O: 858.614.1547 | M: 858.699.8302 | www.sdhealthconnect.org CONNECT WITH US: Facebook<https://www.facebook.com/SDHealthConnect?filter=1> | Twitter<https://twitter.com/SDHealthConnect> | LinkedIn<http://www.linkedin.com/company/san-diego-health-connect?trk=company_logo> | Google+<https://plus.google.com/u/0/b/112077458420951237937/112077458420951237937/p…> | YouTube<http://www.youtube.com/SDHealthConnect>

1 0

Re: [stunnel-users] certificate verify failed
by Aaron Haywood 05 May '14

05 May '14

Roman, I was wondering if you changed your verify from level 3 to level 2, and if this resolved your peer disconnection error with stunnel. We're experiencing a similar problem but was wondering if anyone out there has resolved this issue already; and if so..how? :) Respectfully, Aaron Haywood | Systems Administrator [cid:[email protected]] O: 858.614.1547 | M: 858.699.8302 | www.sdhealthconnect.org CONNECT WITH US: Facebook<https://www.facebook.com/SDHealthConnect?filter=1> | Twitter<https://twitter.com/SDHealthConnect> | LinkedIn<http://www.linkedin.com/company/san-diego-health-connect?trk=company_logo> | Google+<https://plus.google.com/u/0/b/112077458420951237937/112077458420951237937/p…> | YouTube<http://www.youtube.com/SDHealthConnect>

1 0

New stunnel how-to
by Patrick J. 30 Apr '14

30 Apr '14

Hi all, I've spent some time to write a new stunnel how-to. - Install and configure stunnel on a Raspberry Pi - Run stunnel in a chroot jail - Limit allowed ciphers and force Forward Secrecy - Restrict access to the stunnel server (verify = 3) - Disguise SSH as HTTPS traffic http://stunnel.qnea.net/ Regards from Germany, Patrick

1 1

Error 126 compiling on Mac OS X 10.7.5
by James Brown 29 Apr '14

29 Apr '14

I’ve just tried to install version 5.01 and encountered an error. I had no problems installing 5.01b1 previously. I just thought I’d install the release version. System is running Mac OS X 10.7.5. make ends with a warning, and make install fails: ld: warning: directory not found for option '-L/usr//lib64' Making all in doc make[1]: Nothing to be done for `all'. Making all in tools make[1]: Nothing to be done for `all'. make[1]: Nothing to be done for `all-am'. mail:stunnel-5.01 2 jlbrown$ sudo make install Password: Making install in src ../auto/install-sh -c -d '/usr/local/bin' /bin/sh ../libtool --mode=install /usr/bin/install -c stunnel '/usr/local/bin' libtool: install: /usr/bin/install -c stunnel /usr/local/bin/stunnel ../auto/install-sh -c -d '/usr/local/bin' /usr/bin/install -c stunnel3 '/usr/local/bin' ../auto/install-sh -c -d '/usr/local/lib/stunnel' /bin/sh ../libtool --mode=install /usr/bin/install -c libstunnel.la '/usr/local/lib/stunnel' libtool: install: /usr/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib libtool: install: /usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/libstunnel.la /Users/jlbrown/Downloads/stunnel-5.01: /Users/jlbrown/Downloads/stunnel-5.01: is a directory make[2]: *** [install-pkglibLTLIBRARIES] Error 126 make[1]: *** [install-am] Error 2 make: *** [install-recursive] Error 1 I just used ./configure with no arguments. Any suggestions? Thanks, James.

1 0

Verify=2 and Verification Depth...
by Matt Wise 28 Apr '14

28 Apr '14

It was my understanding that when you have an Stunnel Server configured with 'verify=2', that the client that connects must have a certificate signed by the same CA/SubCA combination that the server does. So for example: - My_Root_Ca (private CA) - Some_Random_Cert.pem - Stunnel_Sub_Ca: - Server.pem - Client.pem - Postgres_Sub_Ca: - Server.pem - postgres_user.pem With the above structure in place (and the stunnel server using Stunnel_Sub_Ca/Server.pem) if someone tried to connect in with the Stunnel_Sub_Ca/Client.pem cert, it would work... but if they tried to connect in with Postgres_Sub_Ca/Server.pem, it wouldn't. Unfortunately we're not seeing that behavior... we're seeing a behavior where *every* cert signed by the overall Root CA is validated. We're able to connect in using Some_Random_Cert.pem, Postgres_Sub_Ca/Server.pem and Postgres_Sub_Ca/postgres_user.pem. This feels wrong ... what am I missing? (We're using Stunnel 4.55 btw) Matt Wise Sr. Systems Architect Nextdoor.com

1 1

ephemeral port limit
by Frank Liu 28 Apr '14

28 Apr '14

Hi, I am trying to use stunnel to add ssl support to my app. My app and linux server are tuned to accept 200k+ connections without a problem. When adding stunnel on the same server, the connection stops when it reaches 64k due to stunnel uses ephemeral ports to connect to my app on the localhost. Any suggestions how to get around this limit? One thing I am thinking of is to add 10 virtual interfaces on loopback: lo0:2, lo0:3, etc with ip 127.0.0.2, 127.0.0.3 etc. Can stunnel be configured to cycle through a pool of ip for outbound connection to my app listening on 127.0.0.1? That would give 10x64k of ephemeral ports. I see stunnel has "local" to specify outgoing ip, but I am not sure if it supports a list of ip or use multiple times. If so, will it round robin the list? Thanks Frank

2 2

Syringe
by Michal Trojnara 21 Apr '14

21 Apr '14

Hi Guys, I'm glad to announce syringe, a service for testing client-side heartbleed. It allows to easily examine most of the obscure TLS clients (for example embedded devices). The service is available online at https://www.stunnel.org:4433/ Best regards, Mike

2 2

hardware random
by ios dev 20 Apr '14

20 Apr '14

Hello. I am using GOST engine and set it as default for ALL. At the same time i want to use hardware RNG from other engine. How can i do this? -- BR, Dev.

1 0

Problem with round robin on stunnel 5.0 and 5.1
by WNSDEV 14 Apr '14

14 Apr '14

When I use either of these two versions of stunnel the round-robin for "connect" only sends connections to the first host listed on the configuration file. However the round-robin works in Stunnel 4.56,4.55,4.54 and 4.53. Anyone else have this issue? Thank you, Pete Sangas ./stunnel -version stunnel 5.00 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1g 7 Apr 2014 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Config file : CApath = /xxx/certs/trusted CAfile = /yyy/cacert.pem ciphers = RC4-SHA debug = daemon.7 pid = /zzz/stunnel.pid options = NO_SSLv2 foreground = yes setgid = gid1 setuid = uid1 delay = no fips=no [stunnel] TIMEOUTidle=86400 verify = 3 cert = /path/servercert.pem accept = 443 failover=rr connect = 10.1.1.50:23 connect = 10.1.1.60:23

2 2

DH not working, although initialized correctly
by Ovidiu Lixandru 14 Apr '14

14 Apr '14

Hello, I'm trying to enable Forward Secrecy. have an stunnel 4.56 instance compiled with authpriv and xforwardedfor patches, configured as follows: sslVersion = all options = NO_SSLv2 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4 renegotiation = no setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 libwrap = no TIMEOUTbusy = 120 xforwardedfor = yes [domain.com] accept = X.X.X.X:443 connect = 127.0.0.1:91 cert = /etc/pki/tls/certs/domain.pem key = /etc/pki/tls/private/domain.key domain.pem contains both the SSL certificate and the DH parameters (generated with "openssl dhparams 2048"). stunnel initializes the DH parameters correctly: 2014.04.14 12:08:18 LOG6[16629:140355580176320]: Initializing service [domain.com] 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Certificate: /etc/pki/tls/certs/domain.pem 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Certificate loaded 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Key file: /etc/pki/tls/private/domain.key 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Private key loaded 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Using DH parameters from /etc/pki/tls/certs/domain.pem 2014.04.14 12:08:18 LOG7[16629:140355580176320]: DH initialized with 2048-bit key 2014.04.14 12:08:18 LOG7[16629:140355580176320]: SSL options set: 0x01000004 When I try to connect using openssl s_client, the connections fails with it unable to negotiate a cipher. On the client side: # openssl s_client -cipher ECDH -tls1 -connect www.domain.com:443 CONNECTED(00000003) 140735113126752:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1256:SSL alert number 40 140735113126752:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1397471905 Timeout : 7200 (sec) Verify return code: 0 (ok) --- On the server side: 2014.04.14 11:57:10 LOG5[9647:140038728394496]: Service [domain.com] accepted connection from X.X.X.X:56678 2014.04.14 11:57:10 LOG7[9647:140038728394496]: SSL state (accept): before/accept initialization 2014.04.14 11:57:10 LOG7[9647:140038728394496]: SNI: no virtual services defined 2014.04.14 11:57:10 LOG7[9647:140038728394496]: SSL alert (write): fatal: handshake failure 2014.04.14 11:57:10 LOG3[9647:140038728394496]: SSL_accept: 1408A0C1: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher 2014.04.14 11:57:10 LOG5[9647:140038728394496]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket The client and the server have the same openssl version (1.0.1e), with the same supported ciphers. I tried different cipher combinations (i.e. "HIGH:!aNULL:!MD5"), but no lock. FWIW, the initial DH cipher list in the stunnel config file works correctly in an SSL nginx instance and openssl s_client negotiates "ECDHE-RSA-AES256-SHA". Any idea what may be wrong with stunnel? Thanks, Ovidiu

1 0

Re: [stunnel-users] Some troubles with PROXY protocol
by Alexey V. Drozdov 13 Apr '14

13 Apr '14

Hi, Mike! In spite of new changes, it's still work incorrect because of init_remote(c) connect to the address from root config section: protocol(c, PROTOCOL_PRE_CONNECT); init_remote(c); <<<<<<<<<< destination address from root section protocol(c, PROTOCOL_PRE_SSL); init_ssl(c); <<<<<<<<<<< switch to target SNI config section only there protocol(c, PROTOCOL_POST_SSL); <<<<<<<<<<< send PROXY protocol to incorrect address Context switch to target section parameters after init_ssl(c) only. /Alexey V. Drozdov e-mail: anyquist(a)yandex.ru

2 2

Connection closed with a turn server backend
by pablo platt 12 Apr '14

12 Apr '14

Hi, I'm trying to tunnel TLS connection to a turn server https://code.google.com/p/rfc5766-turn-server/ The connection is closed with; SSL socket closed on SSL_read I'm using the ubuntu 12.04 package http://packages.ubuntu.com/precise/stunnel4 Am I missing a configuration option in my stunnel config? Please see my config and log bellow. ----------------------------------------------- chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid debug = 7 output = /stunnel.log [ssl] accept = 443 connect = 3478 cert = /etc/stunnel/cert.pem key = /etc/stunnel/key.pem ---------------------------------------------------- 2014.04.12 13:40:15 LOG7[14983:140499885700864]: No limit detected for the number of clients 2014.04.12 13:40:15 LOG7[14983:140499885700864]: signal_pipe: FD=3 allocated (non-blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: signal_pipe: FD=4 allocated (non-blocking mode) 2014.04.12 13:40:15 LOG5[14983:140499885700864]: stunnel 4.42 on x86_64-pc-linux-gnu platform 2014.04.12 13:40:15 LOG5[14983:140499885700864]: Compiled/running with OpenSSL 1.0.1 14 Mar 2012 2014.04.12 13:40:15 LOG5[14983:140499885700864]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 2014.04.12 13:40:15 LOG5[14983:140499885700864]: Reading configuration from file /etc/stunnel/stunnel.conf 2014.04.12 13:40:15 LOG7[14983:140499885700864]: PRNG seeded successfully 2014.04.12 13:40:15 LOG6[14983:140499885700864]: Initializing SSL context for service ssl 2014.04.12 13:40:15 LOG4[14983:140499885700864]: Insecure file permissions on /etc/stunnel/key.pem 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Certificate: /etc/stunnel/cert.pem 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Certificate loaded 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Key file: /etc/stunnel/key.pem 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Private key loaded 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Could not load DH parameters from /etc/stunnel/cert.pem 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Using hardcoded DH parameters 2014.04.12 13:40:15 LOG7[14983:140499885700864]: DH initialized with 2048-bit key 2014.04.12 13:40:15 LOG7[14983:140499885700864]: ECDH initialized with curve prime256v1 2014.04.12 13:40:15 LOG7[14983:140499885700864]: SSL options set: 0x00000004 2014.04.12 13:40:15 LOG6[14983:140499885700864]: SSL context initialized 2014.04.12 13:40:15 LOG5[14983:140499885700864]: Configuration successful 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=5 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=6 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=6 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=7 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=7 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=8 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=8 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=9 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=9 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=10 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: accept socket: FD=11 allocated (non-blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Option SO_REUSEADDR set on accept socket 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Service ssl bound to 0.0.0.0:443 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Service ssl opened FD=11 2014.04.12 13:40:15 LOG7[14989:140499885700864]: Created pid file /stunnel4.pid 2014.04.12 13:40:17 LOG7[14989:140499885700864]: local socket: FD=0 allocated (non-blocking mode) 2014.04.12 13:40:17 LOG7[14989:140499885700864]: Service ssl accepted FD=0 from 192.168.56.1:54561 2014.04.12 13:40:17 LOG7[14989:140499885700864]: local socket: FD=1 allocated (non-blocking mode) 2014.04.12 13:40:17 LOG7[14989:140499885700864]: Service ssl accepted FD=1 from 192.168.56.1:54562 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Service ssl started 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Option TCP_NODELAY set on local socket 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Waiting for a libwrap process 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Acquired libwrap process #0 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Service ssl started 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Option TCP_NODELAY set on local socket 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Waiting for a libwrap process 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Acquired libwrap process #1 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Releasing libwrap process #0 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Released libwrap process #0 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Service ssl permitted by libwrap from 192.168.56.1:54562 2014.04.12 13:40:17 LOG5[14989:140499885692672]: Service ssl accepted connection from 192.168.56.1:54562 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): before/accept initialization 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 read client hello A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write server hello A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write certificate A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write key exchange A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write server done A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 flush data 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Releasing libwrap process #1 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Released libwrap process #1 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Service ssl permitted by libwrap from 192.168.56.1:54561 2014.04.12 13:40:17 LOG5[14989:140499885790976]: Service ssl accepted connection from 192.168.56.1:54561 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): before/accept initialization 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 read client hello A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write server hello A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write certificate A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write key exchange A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write server done A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 flush data 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 read client key exchange A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 read finished A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write session ticket A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write change cipher spec A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write finished A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 flush data 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 items in the session cache 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 client connects (SSL_connect()) 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 client connects that finished 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 client renegotiations requested 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 2 server connects (SSL_accept()) 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 1 server connects that finished 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 server renegotiations requested 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 session cache hits 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 external session cache hits 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 session cache misses 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 session cache timeouts 2014.04.12 13:40:17 LOG6[14989:140499885692672]: SSL accepted: new session negotiated 2014.04.12 13:40:17 LOG6[14989:140499885692672]: Negotiated ciphers: ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD 2014.04.12 13:40:17 LOG7[14989:140499885692672]: remote socket: FD=2 allocated (non-blocking mode) 2014.04.12 13:40:17 LOG6[14989:140499885692672]: connect_blocking: connecting 192.169.56.300:3478 2014.04.12 13:40:17 LOG7[14989:140499885692672]: connect_blocking: s_poll_wait 192.169.56.300:3478: waiting 10 seconds 2014.04.12 13:40:17 LOG5[14989:140499885692672]: connect_blocking: connected 192.169.56.300:3478 2014.04.12 13:40:17 LOG5[14989:140499885692672]: Service ssl connected remote server from 192.169.56.300:59744 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Remote FD=2 initialized 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Option TCP_NODELAY set on remote socket 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 read client key exchange A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 read finished A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write session ticket A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write change cipher spec A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write finished A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 flush data 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 items in the session cache 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 client connects (SSL_connect()) 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 client connects that finished 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 client renegotiations requested 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 2 server connects (SSL_accept()) 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 2 server connects that finished 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 server renegotiations requested 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 session cache hits 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 external session cache hits 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 session cache misses 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 session cache timeouts 2014.04.12 13:40:17 LOG6[14989:140499885790976]: SSL accepted: new session negotiated 2014.04.12 13:40:17 LOG6[14989:140499885790976]: Negotiated ciphers: ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL socket closed on SSL_read 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Sending socket write shutdown 2014.04.12 13:40:17 LOG5[14989:140499885692672]: Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Service ssl finished (1 left) 2014.04.12 13:40:17 LOG7[14989:140499885692672]: str_stats: 0 block(s), 0 byte(s) 2014.04.12 13:40:17 LOG7[14989:140499885790976]: remote socket: FD=1 allocated (non-blocking mode) 2014.04.12 13:40:17 LOG6[14989:140499885790976]: connect_blocking: connecting 192.169.56.300:3478 2014.04.12 13:40:17 LOG7[14989:140499885790976]: connect_blocking: s_poll_wait 192.169.56.300:3478: waiting 10 seconds 2014.04.12 13:40:17 LOG5[14989:140499885790976]: connect_blocking: connected 192.169.56.300:3478 2014.04.12 13:40:17 LOG5[14989:140499885790976]: Service ssl connected remote server from 192.169.56.300:59745 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Remote FD=1 initialized 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Option TCP_NODELAY set on remote socket 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL socket closed on SSL_read 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Sending socket write shutdown 2014.04.12 13:40:17 LOG5[14989:140499885790976]: Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Service ssl finished (0 left) 2014.04.12 13:40:17 LOG7[14989:140499885790976]: str_stats: 0 block(s), 0 byte(s)

1 0

Bleedingheart Bug in OpenSSL
by Burak Say 11 Apr '14

11 Apr '14

Hello, When do you think you can release a patch to use OpenSSL 1.0.1g instead of 1.0.1f? Thanks, Burak Say

4 5

Re: [stunnel-users] Some troubles with PROXY protocol
by Alexey V. Drozdov 10 Apr '14

10 Apr '14

Hi, Mike! I have analyze your fix and found mistake :( We will switch to target SNI section after init_ssl(c) only, thereby init_remote(c) will be connect to wrong destination. if(!c->opt->option.client && c->opt->protocol<0 #ifndef OPENSSL_NO_TLSEXT && !c->opt->servername_list_head #endif ) { /* server mode and no protocol negotiation needed */ init_ssl(c); init_remote(c); } else { /* client mode or protocol negotiation enabled */ protocol(c, PROTOCOL_PRE_CONNECT); init_remote(c); <<<<<<<<<< Incorrect destination protocol(c, PROTOCOL_PRE_SSL); init_ssl(c); <<<<<<<<<<< switch to target SNI config section only there protocol(c, PROTOCOL_POST_SSL); } /Alexey V. Drozdov e-mail: anyquist(a)yandex.ru

2 1

stunnel 5.01 released
by Michal Trojnara 08 Apr '14

08 Apr '14

Dear Users, I have released version 5.01 of stunnel. The ChangeLog entry: Version 5.01, 2014.04.08, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1g. This version mitigates TLS heartbeat read overrun (CVE-2014-0160). * New features - X.509 extensions added to the created self-signed stunnel.pem. - "FIPS = no" also allowed in non-FIPS builds of stunnel. - Search all certificates with the same subject name for a matching public key rather than only the first one (thx to Leon Winter). - Create logs in the local application data folder if stunnel folder is not writable on Win32. * Bugfixes - close_notify not sent when SSL still has some data buffered. - Protocol negotiation with server-side SNI fixed. - A Mac OS X missing symbols fixed. - Win32 configuration file reload crash fixed. - Added s_pool_free() on exec+connect service retires. - Line-buffering enforced on stderr output. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-5.01.tar.gz: 2565bf58ffe8a612304c64df621105b2e42d6e389e815ed4205dbeec4f3f886b Best regards, Mike

1 0

Re: [stunnel-users] public domain [Patch] Support multiple X509 client certificates with same CN
by Leon Winter 01 Apr '14

01 Apr '14

Hi Michal, > >What license do you need the patch to be? > > Preferably public domain, but any GPL-compatbile and non-copyleft license > should be fine. I hereby release my patches to stunnel for support of muliple client certificates with the same CN into the public domain. Best regards, Leon Winter

2 2

Some troubles with PROXY protocol
by Alexey V. Drozdov 31 Mar '14

31 Mar '14

Hi, I try to use PROXY protocol ability for my virtual server, but this options work for root section only. E.g. it not work for this simple case: [virtual_server] accept = 443 connect = localhost:1081 cert = /etc/stunnel/serverCA.crt key = /etc/stunnel/serverCA.key verify = 2 CAfile = /etc/stunnel/serverCA.crt [server_ru] sni = virtual_server:server.ru cert = /etc/stunnel/server.cer key = /etc/stunnel/server.pem connect = localhost:7000 protocol = proxy <-- option don not work there This problem exist due some code bug: NOEXPORT void client_try(CLI *c) { init_local(c); if(!c->opt->option.client && c->opt->protocol<0) // <-- condition is true in spite of setup protorol=proxy { init_ssl(c); // we'll switch to target section (c->opt) there only! init_remote(c); } else { protocol(c, PROTOCOL_PRE_CONNECT); init_remote(c); protocol(c, PROTOCOL_PRE_SSL); init_ssl(c); protocol(c, PROTOCOL_POST_SSL); } ... Simple adhoc solution work for me: if(!c->opt->option.client && c->opt->protocol<0) // <-- condition is true in spite of setup protorol=proxy { init_ssl(c); init_remote(c); // force initiate PROXY protocol protocol(c, PROTOCOL_PRE_SSL); } It's crutch and not general solution certain. But some code refactoring needs for more correct fix. I think that this bug will be fixed in future versions. Thanks for stunnel! :) /Alexey V. Drozdov e-mail: anyquist(a)yandex.ru

2 1

Build failure of stunned 5.00 under OS X.
by Marius Schamschula 28 Mar '14

28 Mar '14

Hi there, After having built many prior releases of stunned for OS X, I ran into the following issue with version 5.0: /bin/sh ../libtool --tag=CC --mode=link gcc -pthread -fstack-protector -fPIE -g -O2 -Wall -Wextra -Wno-long-long -pedantic -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -lz -lpthread -lwrap libtool: link: gcc -pthread -fstack-protector -fPIE -g -O2 -Wall -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -lz -lpthread -lwrap -pthread ld: warning: directory not found for option '-L/usr/local/ssl/lib64' Undefined symbols for architecture x86_64: "_load_icon_default", referenced from: _parse_global_option in stunnel-options.o "_load_icon_file", referenced from: _parse_global_option in stunnel-options.o ld: symbol(s) not found for architecture x86_64 collect2: ld returned 1 exit status he ewxat same issue under 10.8 and 10.9. Makefile:471: recipe for target 'stunnel' failed make[2]: *** [stunnel] Error 1 make[2]: Leaving directory '/private/tmp/stunnel-5.00/src' Makefile:339: recipe for target 'all' failed make[1]: *** [all] Error 2 make[1]: Leaving directory '/private/tmp/stunnel-5.00/src' Makefile:365: recipe for target 'all-recursive' failed make: *** [all-recursive] Error 1 This is the OS X 10.7 build, but I had the same issue under 10.8 and 10.9. Marius -- Marius Schamschula

1 0

Access to Packet Content
by Michael Carlino (RIT Student) 26 Mar '14

26 Mar '14

Hello stunnel users, I am working with what seems to be the standard stunnel HTTPS configuration. I have two instances of stunnel, one as a client and one as a server. The client accepts connections from a browser. The server sits in front of tomcat. If works like a charm (of course!). What I need to do seems simple, and I will try to keep my description of it generic. In the client stunnel I need to make a small change to the HTTP packet. I need to add some data to it. At the server side I need to access that added data. The server stunnel may close the SSL session based on that data. So, my question is: can I obtain access to the packet before it's encrypted and sent out over SSL? Can I get access to the decrypted packet before it's sent on to tomcat? I know that as a proxy stunnel has to be and tries to be general in nature. I am not concerned (right now) with developing a feature that will become available to others later. I don't mind if my changes make my development version of stunnel single-purpose. My work is academic and proof-of-concept in it's nature. I have collected references and a text book (Network Security with OpenSSL by Viega et al). I will continue to walk through and explore the code. Are there any programmer resources I can obtain? I see the occasional URL in the stunnel source code. I will have to check these URLs. --- I just now pursued http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt, and I see that there is a patch that allows stunnel to do an initial modification to the HTTP request to insert a X-Forwarded-For header. This sounds like what I need to do! I am going to look for that patch. I hope the source code for the patch is available. Please, if anyone has any advice, war stories, criticism, whatever... I would very much appreciate it. Regards.

4 8

Tool Information
by "Cortenai Swoboda Reinbrecht" 14 Mar '14

14 Mar '14

1 0

stunnel.cnf should set keyUsage = keyCertSign
by Athir Nuaimi 11 Mar '14

11 Mar '14

I'm trying to write a go program to connect to an stunnel server and verify the certificate but it fails because the go language requires that self-signed certs have keyCertSign set in the keyUsages. the default stunnel.cnf does not set this. According to the following message thread this is required by RFC 5280. https://groups.google.com/forum/#!msg/golang-nuts/LfLHjVkeSj8/YyP-LSPEytEJ The solution to this is to add 'keyUsage = keyCertSign' to the stunnel.cnf.

3 3

Please allow fips=no even if !USE_FIPS
by Andy Lutomirski 10 Mar '14

10 Mar '14

It's currently impossible to make a stunnel config file that works with reasonable settings on both a USE_FIPS build (e.g. Fedora) and a !USE_FIPS build (e.g. Ubuntu). This is because, if USE_FIPS, fips defaults to "yes" (which is, for most purposes, a serious problem) and, if !USE_FIPS, the setting 'fips=no' prevents stunnel from starting. I've observed this on stunnel 4.53, and it looks like the same issue exists in the source in stunnel 4.56 and 5.00. (Note that, if targetting stunnel 5.00, this is less of an issue, since the default value of 'fips' changed. Nonetheless, it would be nice to accept 'fips=no' to avoid surprises.) Thanks, Andy

1 0

Stunnel Install error on Solaris10 X86
by Ashok Kumar G 10 Mar '14

10 Mar '14

Hi, I am trying to install stunnel-4.56 on my Solaris10 server. configure step completed successfully. But make and make install commands failed miserably. # gzip -dc stunnel-3.8.tar.gz | tar -xvf - # cd stunnel-3.8 # ./configure bash-3.00# make bash: make: command not found bash-3.00# export PATH=/usr/ccs/bin bash-3.00# make bash: line 8: sed: command not found *** Error code 127 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' bash-3.00# make install bash: line 8: sed: command not found *** Error code 127 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo install-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `install-recursive' bash-3.00# bash-3.00# bash-3.00# echo $PATH /usr/ccs/bin ========================================================= * 2nd Try:* ========================================================= bash-3.00# echo $PATH /usr/sbin:/usr/bin bash-3.00# PATH=$PATH:/usr/sbin:/usr/sfw/bin:/usr/ccs/bin bash-3.00# LD_LIBARAY_PATH=/lib:/usr/lib:/usr/local/lib bash-3.00# cd /opt/softwares/stunnel-4.56 bash-3.00# make Making all in src make all-am Making all in doc Making all in tools bash-3.00# make install Making install in src test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin" /bin/bash ../libtool --mode=install ../auto/install-sh -c stunnel '/usr/local/bin' libtool: install: ../auto/install-sh -c stunnel /usr/local/bin/stunnel test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin" ../auto/install-sh -c stunnel3 '/usr/local/bin' test -z "/usr/local/lib/stunnel" || ../auto/install-sh -c -d "/usr/local/lib/stunnel" /bin/bash ../libtool --mode=install ../auto/install-sh -c libstunnel.la'/usr/local/lib/stunnel' libtool: install: ../auto/install-sh -c .libs/libstunnel.so /usr/local/lib/stunnel/libstunnel.so libtool: install: chmod +x /usr/local/lib/stunnel/libstunnel.so libtool: install: ../auto/install-sh -c .libs/libstunnel.lai /usr/local/lib/stunnel/libstunnel.la ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib/stunnel If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - use the `-RLIBDIR' linker flag See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- Making install in doc test -z "/usr/local/share/doc/stunnel" || ../auto/install-sh -c -d "/usr/local/share/doc/stunnel" ../auto/install-sh -c -m 644 stunnel.html stunnel.pl.html stunnel.fr.html '/usr/local/share/doc/stunnel' test -z "/usr/local/share/man/man8" || ../auto/install-sh -c -d "/usr/local/share/man/man8" ../auto/install-sh -c -m 644 stunnel.8 stunnel.pl.8 stunnel.fr.8 '/usr/local/share/man/man8' Making install in tools test -z "/usr/local/etc/stunnel" || ../auto/install-sh -c -d "/usr/local/etc/stunnel" ../auto/install-sh -c -m 644 stunnel.conf-sample '/usr/local/etc/stunnel' if test ! -r /usr/local/etc/stunnel/stunnel.pem; then \ if test -r "/dev/urandom"; then \ dd if="/dev/urandom" of=stunnel.rnd bs=256 count=1; \ RND="-rand stunnel.rnd"; \ else \ RND=""; \ fi; \ /usr//bin/openssl req -new -x509 -days 365 $RND \ -config ./stunnel.cnf \ -out stunnel.pem -keyout stunnel.pem; \ /usr//bin/openssl gendh $RND 1024 >> stunnel.pem; \ /usr//bin/openssl x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ ../auto/install-sh -c -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem; \ rm stunnel.pem; \ fi 1+0 records in 1+0 records out bash: line 7: /usr//bin/openssl: No such file or directory *** Error code 1 make: Fatal error: Command failed for target `install-data-local' Current working directory /opt/softwares/stunnel-4.56/tools *** Error code 1 The following command caused the error: make install-exec-am install-data-am make: Fatal error: Command failed for target `install-am' Current working directory /opt/softwares/stunnel-4.56/tools *** Error code 1 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo install-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `install-recursive' bash-3.00# Can someone please help to resolve the above error. Thanks, Ashok Kumar G

2 3

Re: [stunnel-users] [Patch] Support multiple X509 client certificates with same CN
by Leon Winter 10 Mar '14

10 Mar '14

On Mon, Mar 10, 2014 at 06:34:14AM -0400, Brian Wilkins wrote: > You will have to attach appropriate software license as well. Michal may > ask for it I hereby declare my two previously sent patches to be licensed under GPL as according to the license of the stunnel project. Regards, Leon Winter

1 0

[Patch] Support multiple X509 client certificates with same CN
by Leon Winter 10 Mar '14

10 Mar '14

Hi, currently stunnel uses the X509_STORE_get_by_subject () API call to OpenSSL to retrieve the x509 client certificate in the cert_check () method (located in verify.c) to gather the client certificate from the whitelist by the common name (CN) the client presented during the TLS handshake. It then proceeds to compare both certificates bit by bit. This all works rather fine until the very moment you have more than one client certificate with the same CN. The OpenSSL API call will then return any of the certificates with the provided CN (according to internal logic). Other implementations using OpenSSL were aware of this issue and introduced logic to further iterate over the remaining certificates, retrieving any further with the same CN. See for example function X509_STORE_CTX_get1_issuer () and its comment: http://www.opensource.apple.com/source/OpenSSL/OpenSSL-12/openssl/crypto/x5… I patched stunnel 4.53 and adapted the patch to upstream version 5.00 to behave in similar fashion and can report that with these changes stunnel then also supports multiple client certificates sharing the same CN. Feel free to adapt indention as my patches aim for minimal changed lines. Best regards, Leon Winter

1 0

stunnel 5.00 released
by Michal Trojnara 10 Mar '14

10 Mar '14

Dear Users, I have released version 5.00 of stunnel. The ChangeLog entry: stunnel 5.00 disables some features previously enabled by default. Users should review whether the new defaults are appropriate for their particular deployments. Packages maintainers may consider prepending the old defaults for "fips" (if supported by their OpenSSL library), "pid" and "libwrap" to stunnel.conf during automated updates. Version 5.00, 2014.03.06, urgency: HIGH: * Security bugfixes - Added PRNG state update in fork threading (CVE-2014-0016). * New global configuration file defaults - Default "fips" option value is now "no", as FIPS mode is only helpful for compliance, and never for actual security. - Default "pid" is now "", i.e. not to create a pid file at startup. * New service-level configuration file defaults - Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2" due to AlFBPPS attack and bad performance of DH ciphersuites. - Default "libwrap" setting is now "no" to improve performance. * New features - OpenSSL DLLs updated to version 1.0.1f. - zlib DLL updated to version 1.2.8. - autoconf scripts upgraded to version 2.69. - TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode. - New service-level option "redirect" to redirect SSL client connections on authentication failures instead of rejecting them. - New global "engineDefault" configuration file option to control which OpenSSL tasks are delegated to the current engine. Available tasks: ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS, DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1. - New service-level configuration file option "engineId" to select the engine by identifier, e.g. "engineId = capi". - New global configuration file option "log" to control whether to append (the default), or to overwrite log file while (re)opening. - Different taskbar icon colors to indicate the service state. - New global configuration file options "iconIdle", "iconActive", and "iconError" to select status icon on GUI taskbar. - Removed the limit of 63 stunnel.conf sections on Win32 platform. - Installation of a sample certificate was moved to a separate "cert" target in order to allow unattended (e.g. scripted) installations. - Reduced length of the logged thread identifier. It is still based on the OS thread ID, and thus not unique over long periods of time. - Improved readability of error messages printed when stunnel refuses to start due to a critical error. * Bugfixes - LD_PRELOAD Solaris compatibility bug fixed (thx to Norm Jacobs). - CRYPTO_NUM_LOCKS replaced with CRYPTO_num_locks() to improve binary compatibility with diverse builds of OpenSSL (thx to Norm Jacobs). - Corrected round-robin failover behavior under heavy load. - Numerous fixes in the engine support code. - On Win32 platform .rnd file moved from c:\ to the stunnel folder. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-5.00.tar.gz: 88986d52a7ef1aff0cc26fc0a9830361c991baba7ee591d5cf1cc8baef75bc13 Best regards, Mike

3 5

Weird problem starting stunnel
by Matthew Lunnon 05 Mar '14

05 Mar '14

Hello, Can anyone enlighten me on the following: I have installed stunnel up on my Mac (OS X Lion) and it all runs just fine. When I put this on another machine (OS X Mountain Lion) stunnel refuses to start. I include the output and the stunnel.conf file below. We have some experience of stunnel as we have been using it in both client and server mode on Windows and RedHat for years but none of my colleagues can give me much help here. It looks to me like although stunnel is reporting that it is starting with the correct stunnel.conf file it is actually using something else as: 1) no stunnel.log file is created 2) after successfully seeding the PRNG it seems to be Initializing inetd mode and starting as a service when this should be starting in client mode. (The only way I can get it to do something similar on the machine that works is to remove all the service definitions and put in a line service = SERVICE when it blows up but with a slightly different error about needing an end/connection point (not sure the exact error) and then it fails. Even so in this case it will still create an output log in the correct place) My thoughts are that it might be something to do with the installation process of stunnel that hasn't been followed properly or some kind of permissions issue. Apologies if I am being dim but I am at a bit of a loss to explain what is going on here. I do not have direct access to the second machine and am trying to support it over the phone. Thanks for any help. Matthew ========================================================================== = Here is the output: ========================================================================== Last login: Fri Jan 31 10:44:30 on ttys000 Administrator:~ admin$ cd stunnel Administrator:stunnel admin$ stunnel /Users/admin/stunnel/stunnel.conf Clients allowed=125 stunnel 4.56 on x86_64-apple-darwin11.4.2 platform Compiled with OpenSSL 0.9.8r 8 Feb 2011 Running with OpenSSL 0.9.8y 5 Feb 2013 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:SELECT,IPv6 SSL:ENGINE,OCSP Auth:LIBWRAP Reading configuration from file /Users/admin/stunnel/stunnel.conf Compression not enabled Snagged 64 random bytes from /Users/admin/.rnd Wrote 1024 new random bytes to /Users/admin/.rnd PRNG seeded successfully Initializing inetd mode configuration Service [stunnel]: SSL server needs a certificate str_stats: 2 block(s), 45 data byte(s), 116 control byte(s) Administrator:stunnel admin$ ========================================================================== = And here is the stunnel.conf file: ========================================================================== ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2012 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may useful for troubleshooting) debug = 7 ;output = stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no client=yes sslVersion=SSLv3 output=/Users/admin/stunnel/stunnel.log pid=/Users/admin/stunnel/stunnel.pid ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode ;cert = rwa2012.clientkeycert.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! verify = 2 ;verify = 0 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile CAfile = /Users/admin/stunnel/ca.crt ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** [Gounder] cert = /Users/admin/stunnel/gounder20141401011000.pem accept=8128 connect=311.219.292.173:9876 [Gounder IJ] cert = /Users/admin/stunnel/gounder20141401011000.pem accept=9128 connect=311.219.292.173:9875 -- Matthew Lunnon Technical Consultant RWA Ltd. mlunnon(a)rwa-net.co.uk Tel: +44 (0)29 2081 5056 www.rwa-net.co.uk

2 1

Stunnel use with Juniper VPN
by Nancy Shortall 19 Feb '14

19 Feb '14

Looking for help in planning a point to point VPN between a fixed site and a mobile site. The fixed site currently uses Stunnel and the mobile site must use a Juniper VPN SSG 140 hardware VPN device. Would this configuration be possible?

1 0

Re: [stunnel-users] Compatible with windows 8.1?
by peter 08 Feb '14

08 Feb '14

Is the stunnel compatible with windows 8.1? I am having problems after updating to 8.1 Peter

1 0

DNS SSL tunnel
by Quinn Wood 07 Feb '14

07 Feb '14

Woops, starting with the forwarded ports... 192.168.1.100 UDP/5353 -> VM UDP/53 192.168.1.100 TCP/5353 -> VM TCP/53 192.168.1.100 TCP/5667 -> VM TCP/5667 [...] I am able to get DNS replies using both of dig @192.168.1.100 -p 5353 google.com A dig @192.168.1.100 -p 5353 google.com A +tcp But dig times out when I try to use dig @192.168.1.100 -p 53 google.com A The stunnel server log is here: http://sprunge.us/deLY The stunnel client log is here: http://sprunge.us/ScAC Why this is happening? I notice the three connection attempts which seems like it's relevant to the connection resets.

1 0

DNS SSL tunnel
by Quinn Wood 07 Feb '14

07 Feb '14

I am attempting to tunnel DNS traffic over stunnel using socat. I am following a guide[1] by the German Privacy Foundation. The client is my physical machine and the server is a VirtualBox virtual machine with three ports forwarded: 192.168.1.100 53/UDP My configs for stunnel are an exact match to the ones on the guide, and I am able to get a DNS reply using dig @IP [1] https://www.privacyfoundation.de/wiki/SSL-DNS

1 0

Problem in stunnel log
by sawbona＠xsmail.com 06 Feb '14

06 Feb '14

Good morning: This connection was working perfectly well up until yesterday. Now it fails and I get this text in the log: (date/time snipped for brevity's sake) --- LOG5[648:980]: FIPS mode is enabled LOG5[648:980]: Configuration successful LOG5[648:2448]: Service [gmx-POP3-SSL] accepted connection from 127.0.0.1:1212 LOG5[648:2448]: connect_blocking: connected xxx.xxx.xxx.xxx:995 LOG5[648:2448]: Service [gmx-POP3-SSL] connected remote server from 192.168.1.136:1213 LOG4[648:2448]: CERT: Verification error: self signed certificate in certificate chain LOG4[648:2448]: Certificate check failed: depth=2, /C=DE/O=Deutsche Telekom AG/OU=T-TeleSec Trust Center/CN=Deutsche Telekom Root CA 2 LOG3[648:2448]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed LOG5[648:2448]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket --- What has happened? I have not changed anything ... This is the stunnel.conf bit: --- [gmx-POP3-SSL] client = yes accept = 20995 connect = pop.gmx.net:995 CAfile = peer-gmx-POP3-SSL.pem verify = 3 [gmx-smtp-SSL] client = yes accept = 20465 connect = mail.gmx.net:465 [gmx-IMAP-SSL] client = yes accept = 20993 connect = imap.gmx.net:993 --- Is it 'me' or is it 'them'? Thanks in advance for any input. Best regards.

1 0

Stunnel - how to make Google App Engine HTTP into HTTPS ?
by Shamun Toha Md 06 Feb '14

06 Feb '14

I have Google App Engine running in HTTP (port tcp 80), which is a daemon based service it execute back-end some python instances. Now all that works over HTTP , TCP 80, and Google App Engine itself do not have any kind of HTTPS setup, it has to be organized externally. Therefore, the biggest problem is now that how can i use stunnel to resolve this problem please? I have already tried following setup and it does not work at all. 1) if the user visit https://www.mysite.com then he hit stunnel accept=443 after that he is connected with connect=80 but user browser change into http:// instead of remaining in https:// . Which make the whole thing not working $ uname -a Linux server2 2.6.32-358.23.2.el6.x86_64 #1 SMP Wed Oct 16 18:37:12 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux $ cat /etc/stunnel/stunnel.conf pid = /stunnel.pid cert=/etc/stunnel/abyhu.crt CAfile=/etc/stunnel/abyhu.ca key=/etc/stunnel/abyhu.key sslVersion = all ;socket = l:TCP_NODELAY=1 ;socket = r:TCP_NODELAY=1 client=no debug = 7 output = /var/log/stunnel.log [SSL] accept=443 connect=80 TIMEOUTclose = 0 My goal is: when user visit https://www.mysite.com it remain as https not become http:// then it is not solving the problem cause Google app engine do not have HTTPS Thank you. Best regards

3 4

Re: [stunnel-users] cross compiling stunnel-4.21 for ARM
by josealf＠rocketmail.com 03 Feb '14

03 Feb '14

Krinali, Looks like firefox can't connect to port 443 on your target IP. Are you sure there is no firewall enabled on your board? Regards, Jose -----Original Message----- From: Krinali Shah - PES <krinali.shah(a)einfochips.com> Date: Mon, 3 Feb 2014 16:47:39 To: <josealf(a)rocketmail.com> Subject: Re: [stunnel-users] cross compiling stunnel-4.21 for ARM Hi Jose, Thank you so much for your suggestion. Firefox is giving an error like "Problem Loading Page". (Plase find attached snapshot for your reference). Note - I have made sure that there are no proxy settings on firefox. Thanks, Krinali Shah ----- Original Message ----- From: josealf(a)rocketmail.com To: "Krinali Shah - PES" <krinali.shah(a)einfochips.com>, "stunnel-users" <stunnel-users-bounces(a)stunnel.org>, stunnel-users(a)stunnel.org Sent: Monday, February 3, 2014 4:21:49 PM Subject: Re: [stunnel-users] cross compiling stunnel-4.21 for ARM Krimnali, 1. Exactly which error is giving Firefox? It will give you an error if the certificate subject does not match the URL (in this case the IP). And of course, it will also complain if the certificate is self signed and/or the signing CA is unknown. 2. Why are you using such an updated stunnel version? 3. You can use openssl s_client command to troubleshoot. Google for it. Regards, Jose -----Original Message----- From: Krinali Shah - PES <krinali.shah(a)einfochips.com> Sender: "stunnel-users" <stunnel-users-bounces(a)stunnel.org> Date: Mon, 3 Feb 2014 15:34:28 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] cross compiling stunnel-4.21 for ARM _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users --------------------------------------------------------------------------------------------- Notice: This message has been scanned by Trend Micro Mail Security scanner and is believed to be clean --------------------------------------------------------------------------------------------- ************************************************************************************************************************************************************* eInfochips Business Disclaimer : This e-mail message and all attachments transmitted with it are intended solely for the use of the addressee and may contain legally privileged and confidential information. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately by replying to this message and please delete it from your computer. Any views expressed in this message are those of the individual sender unless otherwise stated. Company has taken enough precautions to prevent the spread of viruses. However the company accepts no liability for any damage caused by any virus transmitted by this email. ************************************************************************************************************************************************************* --------------------------------------------------------------------------------------------- Notice: This message has been scanned by Trend Micro Mail Security scanner and is believed to be clean ---------------------------------------------------------------------------------------------

1 0

cross compiling stunnel-4.21 for ARM
by Krinali Shah - PES 03 Feb '14

03 Feb '14

----- Forwarded Message ----- From: "Krinali Shah - PES" <krinali.shah(a)einfochips.com> To: stunnel-users(a)stunnel.org Sent: Monday, February 3, 2014 3:04:44 PM Subject: cross compiling stunnel-4.21 for ARM Hi All, I have thttpd server cross-compiled for my ARM based embedded board. Now I want to add the support for https services on my board, so I think of using stunnel with openssl. I have already download source code of openssl and cross compiled it, for linux-arm. I have downloaded stunnel-4.21 and followed the steps as mentioned below. 1. create stunnel.pem file inside /etc/ssl/certs/stunnel.pem 2. create stunnel.conf file inside /etc/stunnel/stunnel.conf with following parameters. cert = /etc/ssl/certs/stunnel.pem key = /etc/ssl/certs/stunnel.pem chroot = /var/run/stunnel setuid = stunnel4 setgid = stunnel4 debug = 7 pid = /stunnel.pid setuid = stunnel setgid = stunnel socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 compression = rle output = /var/log/stunnel4/stunnel.log client = no [https] accept = 10.103.2.104:443 connect = 127.0.0.1:8080 TIMEOUTclose = 0 2. ./configure --prefix=/home/stunnel --host=arm-linux --enable-shared --with-ssl=/home 3. changed CC, RANLIB and STRIP environment variables for cross compilation in Makefile. 4. make 5. sudo make install The cross-compiled binary stunnel is installed. When I run the binary on board, it does not show any error. Following debug messages are seen on screen. 1969.12.31 21:19:54 LOG6[1154:1073842296]: Compression enabled using rle method 1969.12.31 21:19:54 LOG7[1154:1073842296]: RAND_status claims sufficient entropG 1969.12.31 21:19:54 LOG7[1154:1073842296]: PRNG seeded successfully 1969.12.31 21:19:54 LOG7[1154:1073842296]: Certificate: /etc/ssl/certs/stunnel.m 1969.12.31 21:19:54 LOG7[1154:1073842296]: Certificate loaded 1969.12.31 21:19:54 LOG7[1154:1073842296]: Key file: /etc/ssl/certs/stunnel.pem 1969.12.31 21:19:54 LOG7[1154:1073842296]: Private key loaded 1969.12.31 21:19:54 LOG7[1154:1073842296]: SSL context initialized for service s But, If I try to request https service from web browser (Firefox) ie, https://server_ip it gives me error. Meaning https server is not started correctly, still something is missing. Please guide me if you have any clues. Any help would be highly appreciated. Thanks, Krinali Shah ************************************************************************************************************************************************************* eInfochips Business Disclaimer : This e-mail message and all attachments transmitted with it are intended solely for the use of the addressee and may contain legally privileged and confidential information. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately by replying to this message and please delete it from your computer. Any views expressed in this message are those of the individual sender unless otherwise stated. Company has taken enough precautions to prevent the spread of viruses. However the company accepts no liability for any damage caused by any virus transmitted by this email. ************************************************************************************************************************************************************* --------------------------------------------------------------------------------------------- Notice: This message has been scanned by Trend Micro Mail Security scanner and is believed to be clean ---------------------------------------------------------------------------------------------

2 1

Connect to Outlook.com SMTP with stunnel
by Tenhult Server 30 Jan '14

30 Jan '14

Hi, i'm trying to send mail with the help of stunnel but i get STARTTLS expected, what is wrong with my setup? File: stunnel.conf [outlook-smtp] protocol = smtp accept = 127.0.0.1:25 connect = smtp-mail.outlook.com:587 Log 2014.01.26 13:59:03 LOG5[1536]: stunnel 5.00 on x86-pc-msvc-1500 platform 2014.01.26 13:59:03 LOG5[1536]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 ... ... 2014.01.26 13:59:16 LOG6[2428]: Server-mode smtp protocol negotiations started 2014.01.26 13:59:16 LOG7[2428]: RFC 2487 detected 2014.01.26 13:59:16 LOG7[2428]: <- 220 BLU0-SMTP180.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Sun, 26 Jan 2014 04:59:07 -0800 2014.01.26 13:59:16 LOG7[2428]: -> 220 BLU0-SMTP180.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Sun, 26 Jan 2014 04:59:07 -0800 + stunnel 2014.01.26 13:59:16 LOG7[2428]: <- EHLO Fredrik-Laptop 2014.01.26 13:59:16 LOG7[2428]: -> 250-EHLO Fredrik-Laptop Welcome 2014.01.26 13:59:16 LOG7[2428]: -> 250 STARTTLS 2014.01.26 13:59:16 LOG7[2428]: <- MAIL FROM: <mymail(a)live.com> 2014.01.26 13:59:16 LOG3[2428]: STARTTLS expected 2014.01.26 13:59:16 LOG5[2428]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.01.26 13:59:16 LOG7[2428]: Remote socket (FD=520) closed 2014.01.26 13:59:16 LOG7[2428]: Local socket (FD=540) closed 2014.01.26 13:59:16 LOG7[2428]: Service [outlook-smtp] finished (0 left) Fredrik

2 1

Specifying a username and password
by Allen Crist 30 Jan '14

30 Jan '14

I have a scanner that only has an smtp address and port #. There is no option to specify a username and password. Is there a way to configure STunnel to assist with this? Regards, Allen -- Allen Crist, Owner A+ | Network+ | Security+ | MCITP/MCSA: Windows Server 2008 *CCW Technology Computer Repair*Serving Home & Small Business Customers since 2008 (801)410-0203 http://www.ccwtech.com http://www.facebook.com/CCWTechnology

1 0

Filename is not cached for later editing
by Javier 24 Jan '14

24 Jan '14

Hi, Scenario in Windows. I found today that, when you specify a configuration file different from the standard file name, you can't edit it through "Configuration>Edit stunnel.conf". Stunnel tries to edit stunnel.conf, and, if not found, creates a new one through notepad. This doesn't affect to the reload function, where the configuration file specified is used for reload. Also, this is not important, because in most cases is used the default file name, but maybe could be implemented the ability to change those menu options to display the current configuration file name used instead the standard. Let's say we use a configuration file named xxx.conf. The menu may change to "Edit xxx.conf" and "Reload xxx.conf" instead "Edit stunnel.conf" and "Reload stunnel.conf". This may be interesting for when we have several services installed and identify them better. Regards.

4 9

Additional certificate (like openssl s_server -dkey/-dcert)
by Lapo Luchini 24 Jan '14

24 Jan '14

Is it possible to configure STunnel to support "additional" certificate like OpenSSL s_Server's -dkey/-dcert parameters, in order to support ECDSA in addition to RSA on the same connection? -- Lapo Luchini - http://lapo.it/ “Two can keep a secret if one is dead.” (anonymous)

2 1

SSL communication is unestablishable by stunnel.
by take＠kasaneiro.jp 24 Jan '14

24 Jan '14

stunnel is used in order to use SMTPs/POPs, when using the e-mail software Mew. However, the following logs come out, emacs solidifies and communication is impossible. How is it repaired if it carries out? Please let me know if you please. Computer environment Apple MacBook Pro (Mid 2012), Mac OS X 10.9.2 GNU (Cocoa)Emacs 24.3.50.1 (x86_64-apple-darwin13.0.0, NS apple-appkit- 1265.00) Mew 6.5 Stunnel 4.56 --- <SSL/TLS: > 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Clients allowed=125 2014.01.23 23:30:26 LOG5[15311:140735163843344]: stunnel 4.56 on x86_64- apple-darwin13.0.0 platform 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Compiled/running with OpenSSL 0.9.8y 5 Feb 2013 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Threading:PTHREAD Sockets:SELECT,IPv6 SSL:ENGINE,OCSP 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Reading configuration from file /var/folders/tc/0dm70kl977x3_rcfkldrzz3h0000gn/T/take15307AeS/ mew1530708i 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Compression not enabled 2014.01.23 23:30:26 LOG7[15311:140735163843344]: PRNG seeded successfully 2014.01.23 23:30:26 LOG6[15311:140735163843344]: Initializing service [ 8840] 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Verify directory set to /Users/take/.certs 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Added /Users/take/. certs revocation lookup directory 2014.01.23 23:30:26 LOG7[15311:140735163843344]: SSL options set: 0x00000004 2014. <SSL/TLS: > 01.23 23:30:26 LOG5[15311:140735163843344]: Configuration successful 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Service [8840] (FD=7) bound to 127.0.0.1:8840 2014.01.23 23:30:26 LOG7[15311:140735163843344]: No pid file being created <SSL/TLS: > 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Service [8840] accepted (FD=3) from 127.0.0.1:56364 2014.01.23 23:30:26 LOG7[15311:4558856192]: Service [8840] started 2014.01.23 23:30:26 LOG5[15311:4558856192]: Service [8840] accepted connection from 127.0.0.1:56364 2014.01.23 23:30:26 LOG6[15311:4558856192]: connect_blocking: connecting 127.0.0.1:99 2014.01.23 23:30:26 LOG7[15311:4558856192]: connect_blocking: s_poll_ wait 127.0.0.1:995: waiting 10 seconds 2014.01.23 23:30:26 LOG3[15311:4558856192]: connect_blocking: connect 127.0.0.1:995: Connection refused (61) 2014.01.23 23:30:26 LOG5[15311:4558856192]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.01.23 23:30:26 LOG7[15311:4558856192]: Local socket (FD=3) closed 2014.01.23 23:30:26 LOG7[15311:4558856192]: Service [8840] finished (0 left)

2 1

OCSP Responders in AIA extension
by Ender Erel 22 Jan '14

22 Jan '14

Hi All, Does stunnel check the OCSP responders found in a certificate's AIA field? I am asking this because in the following e-mail from back 2008, the sender mentions a patch that implements this functionality. The patch is included with the mail but I don't think it is included in the later versions of stunnel. Does this mean OCSP responders inside a certificate are ignored? I also want to ask another thing. When using verify = 3 in client mode, which file is used to check the received certificate? Is it the CAfile? If so, would it work like this: - I manually opened a connection to a server outside stunnel, downloaded the server's certificate, and closed the connection. - I saved this certificate to a file, and wrote the path of this file in the stunnel configuration file (CAfile = /mycerts/tmpcert.pem,verify=3). - I started stunnel and initiated a connection to the server. Would the connection be successful? Would it be the right way to use verify=3? Kind Regards, Ender Erel

2 3

disabling compression
by James Bardin 22 Jan '14

22 Jan '14

Hi, The stunnel man page states that compression is off by default, but It seems that is no longer the case. (the changelog states that version 4.5.1 sets compression as "not disabled by default") The config options don't seem to accept any parameters to disable compression. Is there any way to disable it via openssl options? Thanks! -jim

2 2

Question about 'delay = yes' and DNS cache
by John Chow 16 Jan '14

16 Jan '14

Hey Everyone, I have a question about the *delay = yes* config flag and whether or not it caches the resolved IP after the initial connection? To give context, I want my load balancer (Haproxy) to forward requests to an app on Heroku, and I'm using stunnel on my LB box to proxy to Heroku via HTTPS. Since the IP for my app's endpoint could potentially change (60s DNS TTL), stunnel caching resolved IPs would be a problem. Thanks, John -- John Chow Software Engineer Fundly

2 1

Silent install on windows ?
by Brian Ipsen 16 Jan '14

16 Jan '14

Hi I have been searching through google, and from the result there, it should be possible to install stunnel silently on Windows using a /S switch.... I have tried this with the stunnel-4.56-installer.exe package - but it doesn't seem to work..... Can anyone tell me how to install stunnel silently - with no user interaction at all ? Regards /Brian

2 1

Multiple OCPSs
by Ender Erel 16 Jan '14

16 Jan '14

Hi All, We want to use multiple OCSP servers, but the way I see it we can specify only one OCSP server in the configuration file. Is there any other way to do this? Regards, Ender

2 1

Extra listeneres running that loop back to each other.
by Keith Knapp 15 Jan '14

15 Jan '14

Hi, Every time I start stunnel two unexplainable things happen. 1. The settings in my .conf file are not implemented and I have checked them syntactically. 2. I use TCPView and can see two established connections associated with the stunnel process, but they are *not* in my .conf file - Every time I restart the service the two connections reappear but are associated with different ports. - Furthermore the connections loop back on each other; meaning that the remote port of the one connection is the local port of the other connection (and vice-versa). - Are these supposed to be there? I have done a fresh install of the newest version of stunnel. Keith

1 0

Re: connect error 0 running on ARM platform
by FX35 15 Jan '14

15 Jan '14

> Message: 1 > Date: Tue, 14 Jan 2014 12:19:47 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] Fwd: Re: connect error 0 running on ARM > platform > Message-ID: <52D51D53.5030106(a)mirt.net> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > FWX wrote: >> errno is not updated ... >> >> So errno doen't reflect the real value. >> >> Map file of stunnel programm shows _errno_localion(), as you wrote. >> >> Perhaps is there a bug in uClib ? > > Something like this one: > http://www.mail-archive.com/[email protected]/msg05640.html > http://www.mail-archive.com/[email protected]/msg05641.html > or: > http://www.mail-archive.com/[email protected]/msg09301.html > ? > > It indeed looks like uclibc and stunnel use a different errno... > > Mike > > Thank you, Mike, I think you're right. It's ok using mode fork rather than pthread. Regards, FWX.

1 0

newbie question
by Ted Roeloffzen 15 Jan '14

15 Jan '14

Hello All, I'm new to STunnel and installed and setup STunnel. When someone tried to connect I get the following items in the log. SSL accepted: new session negotiated Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 FD 8 in non-blocking mode SL-test>Instelling connecting 127.0.0.1:8890 connect_wait: waiting 10 seconds connect_wait: connected Remote FD=8 initialized SSL alert (read): warning: close notify SSL closed on SSL_read Socket write shutdown SSL write shutdown SSL alert (write): warning: close notify SSL_shutdown successfully sent close_notify Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket SL-test>Instelling finished (0 left) As I'm reading this, there was an established connection but the connection party disconnected, for some reason or another. There was no data sent, but there also was no real error. Is this assumption correct or am I missing something? kind regards, Ted

1 0

Re: [stunnel-users] connect error 0 running on ARM platform
by FX35 14 Jan '14

14 Jan '14

> Message: 3 > Date: Fri, 10 Jan 2014 15:27:10 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] connect error 0 running on ARM platform > Message-ID: <52D0033E.1060109(a)mirt.net> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > On 01/09/2014 06:02 PM, FX35 wrote: >> Running stunnel 4.56 or 5.00 on an ARM platform (ARM926EJ) with Linux >> 2.6.36.4, I encounter the following error : the call to connect() >> return -1, but errno is set to 0 ! >> >> If stunnel is configured to use fork mode instead of pthread mode, >> the problem disapear. >> >> So it seems there is a problem, cross-compiling the program, with >> errno or __errno_location() in the program generated with pthread. >> >> I add the definition of _REENTRANT, without success ... >> >> (See $H1 at http://pauillac.inria.fr/~xleroy/linuxthreads/faq.html) >> >> Is somebody meet the same error ? > > The errno definition in the Android framework (as an example of > Linux/ARM platform) is: > > /* internal function returning the address of the thread-specific > errno */ > extern volatile int* __errno(void); > > /* a macro expanding to the errno l-value */ > #define errno (*__errno()) > > > It seems okay. > > How do you reproduce this problem? What are the stunnel debug logs when > it happens? > > Mike Hello Mike, It seems that the errno variable is not correcly set/updated in C library, using pthread mode. Sample: errno = -1; ret = connect(...); if( ret == -1 ) { printf("errno=%d\n",errno); } will displays value -1 for errno, not EINPROGRESS or EWOULDBLOCK ! errno is not updated ... So errno doen't reflect the real value. Map file of stunnel programm shows _errno_localion(), as you wrote. Perhaps is there a bug in uClib ? Here is the result of ldd command: # ldd stunnel libssl.so.1.0.0 => /usr/lib/libssl.so.1.0.0 (0x400f3000) libcrypto.so.1.0.0 => /usr/lib/libcrypto.so.1.0.0 (0x4013d000) libz.so.1 => /usr/lib/libz.so.1 (0x4027c000) libdl.so.0 => /lib/libdl.so.0 (0x4029b000) libutil.so.0 => /lib/libutil.so.0 (0x4009e000) libpthread.so.0 => /lib/libpthread.so.0 (0x400a7000) libc.so.0 => /lib/libc.so.0 (0x402a6000) libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x400c6000) ld-uClibc.so.0 => /lib/ld-uClibc.so.0 (0x4008f000) Thanks for help. Regards, FWX.

2 1

connect error 0 running on ARM platform
by FX35 10 Jan '14

10 Jan '14

Hello, Running stunnel 4.56 or 5.00 on an ARM platform (ARM926EJ) with Linux 2.6.36.4, I encounter the following error : the call to connect() return -1, but errno is set to 0 ! If stunnel is configured to use fork mode instead of pthread mode, the problem disapear. So it seems there is a problem, cross-compiling the program, with errno or __errno_location() in the program generated with pthread. I add the definition of _REENTRANT, without success ... (See $H1 at http://pauillac.inria.fr/~xleroy/linuxthreads/faq.html) Is somebody meet the same error ? Thanks for help. FWX.

2 1

What checks are made for verify=2
by Ender Erel 10 Jan '14

10 Jan '14

Hi All, I have been searching the web for information on what checks are made for verify=2 but I can't find any detailed information. What exactly goes on when I use verify=2 in client mode? Does stunnel only check if the certificate is signed by a valid CA? Or are any other X.509 attributes checked? Does it disallow settings like "CA=true"? I would really appreciate it if someone could point me where I can find about details of various verify levels. Thanks, Ender Erel

1 0

Stunnel cuts off message
by bernabei＠infinito.it 09 Jan '14

09 Jan '14

Hi,     I'd like to know why Stunnel cuts off messages. I use stunnel both the client and server side,the problem is that my client receives only a cutted off responce from the server,whose size turns out to be 18 KB. Hope an answer Thanks Chiara Bernabei

2 1

Error starting STunnel
by Ted Roeloffzen 09 Jan '14

09 Jan '14

Hi All, I've installed and configured my STunnel. But it won't start. The error i'm getting is: PEM_read_bio:no start line I use the certificate isn't valid, but it's a certificate that i received from a third party and should be correct. Do i have to add something to or alter the certificate so that STUnnel can work with it? kind regards, Ted

2 1

Stunnel should allow TLS v1.1, 1.2 in fips mode
by Douglas Harris (M) 07 Jan '14

07 Jan '14

Currently, stunnel only allows "sslVersion = TLSv1" when "fips = yes". TLSv1.1 and TLSv1.2 should also be permissible values for sslVersion in fips mode. -Doug

2 1

Invitation to connect on LinkedIn
by Manjula Hettiarachchi 30 Dec '13

30 Dec '13

LinkedIn ------------ stunnel, I'd like to add you to my professional network on LinkedIn. - Manjula Manjula Hettiarachchi CTO at UGEN Sri Lanka Confirm that you know Manjula Hettiarachchi: https://www.linkedin.com/e/7575ev-hptlhkon-2z/isd/18944228150/nRr0DNUW/?hs=… -- You are receiving Invitation to Connect emails. Click to unsubscribe: http://www.linkedin.com/e/7575ev-hptlhkon-2z/vyS7IfxEDIThLYYA4jSpNuY0D7kTJI… (c) 2012 LinkedIn Corporation. 2029 Stierlin Ct, Mountain View, CA 94043, USA.

1 0

After upgrading OpenSSL, stunnel times out trying to receive emails
by James Brown 23 Dec '13

23 Dec '13

I've upgraded the OpenSSL on my test mail server, and recompiled Stunnel. Now when Stunnel receives an email it gets stuck on the "SSL state (accept): before/accept initialization" step and times out after a few minutes. Log: 2013.12.24 10:42:58 LOG7[86137:140735299320160]: Service [ssmtp] accepted (FD=3) from 192.168.1.10:54839 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] started 2013.12.24 10:42:58 LOG7[86137:4392841216]: Waiting for a libwrap process 2013.12.24 10:42:58 LOG7[86137:4392841216]: Acquired libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Releasing libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Released libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] permitted by libwrap from 192.168.1.10:54839 2013.12.24 10:42:58 LOG5[86137:4392841216]: Service [ssmtp] accepted connection from 192.168.1.10:54839 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): before/accept initialization 2013.12.24 10:42:58 LOG7[86137:4392841216]: SNI: no virtual services defined 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 read client hello A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 write server hello A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 write certificate A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 write key exchange A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 write server done A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 flush data 2013.12.24 10:42:58 LOG3[86137:4392841216]: SSL_accept: Peer suddenly disconnected 2013.12.24 10:42:58 LOG5[86137:4392841216]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.12.24 10:42:58 LOG7[86137:4392841216]: Local socket (FD=3) closed 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] finished (0 left) 2013.12.24 10:42:58 LOG7[86137:140735299320160]: Service [ssmtp] accepted (FD=3) from 192.168.1.10:54840 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] started 2013.12.24 10:42:58 LOG7[86137:4392841216]: Waiting for a libwrap process 2013.12.24 10:42:58 LOG7[86137:4392841216]: Acquired libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Releasing libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Released libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] permitted by libwrap from 192.168.1.10:54840 2013.12.24 10:42:58 LOG5[86137:4392841216]: Service [ssmtp] accepted connection from 192.168.1.10:54840 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): before/accept initialization 2013.12.24 10:47:58 LOG6[86137:4392841216]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.12.24 10:47:58 LOG5[86137:4392841216]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.12.24 10:47:58 LOG7[86137:4392841216]: Local socket (FD=3) closed 2013.12.24 10:47:58 LOG7[86137:4392841216]: Service [ssmtp] finished (0 left) Any suggestions? It was working fine before I upgraded OpenSSL to 1.00e. System is a Mac OS X 10.7.5 box. Thanks, James.

1 0

Error on attempt to launch Stunnel
by Tracy Drake - QI-C 20 Dec '13

20 Dec '13

Hello! I wonder if you can offer insight as to the significance of the following error on attempt to launch the new 4.56 Stunnel... [image: Inline image 1] Perhaps it was simply a botched/incomplete installation but I wanted to reach out before just attempting a reinstall. Thanks in advance! -- Tracy Drake CSM Senior Consultant GSA-FAS FAME Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

2 1

Stunnel client cuts off the responce of the server
by bernabei＠infinito.it 19 Dec '13

19 Dec '13

Hi,  I use stunnel both the client and server side, but I have problem with server responces because my client app receive only a cut off responce from the server,whose size turns out to be 18 KB. I'd like to know if the BUFFSIZE constant is the maximum size of the message that a client can read.  What if the server sends a message that is bigger than the buffer size? the remaining byte are ignored? if so, how can I do?   Waiting for an answer Thanks in advance Chiara Bernabei

1 0

Reload configuration file in Windows service
by David O'Riva 17 Dec '13

17 Dec '13

Hi, Is there a command line method for instructing stunnel to reload its configuration file when running as a Windows service? I'm trying to use stunnel to replace MySQL's abysmal SSL support on a box that has no GUI interface at all (it will never be logged into interactively). I've poked through the source, and on Windows it looks like the only way to pass signals to it is through a private pipe that is created by and for the stunnel process. Also, does anyone know offhand if existing connections are left unmolested when a configuration reload happens? For production use, I really need to be able to update certs and add and remove components (stunnel services, I guess) without disturbing connections that are in progress. Thanks! -Dave

1 0

Re: [stunnel-users] stunnel and Pegasus Mail
by sawbona＠flashmail.com 16 Dec '13

16 Dec '13

Hello: Thanks to all for your input. Much appreciated. On 15 Dec 2013 at 11:03, you wrote: To: sawbona(a)flashmail.com, Subject: Re: [stunnel-users] stunnel and Pegasus Mail > Just an added note. You need to restart the stunnel ... Yes. I was aware of that. > ... load it as part of the startup process. I have installed it to run as a service so that's what it does. > I would assume you are using windows ... Yes. =-/ > ... so would have to use the task manager to end the task ... Not needed. I have a taskbar icon that on left-click brings up a menu which, among other options, has one to edit and another one to reload the *.conf file. > You need to use a different set of ports for the gmx setup. That did it. =-) I have changed the configuration and it's working perfectly. I did not see the need to do this (maybe not read the manual often enough) but as the log file did not indicate any problems ... LOG5[1796:1960]: Reading configuration from file stunnel.conf LOG5[1796:1960]: FIPS mode is enabled LOG5[1796:1960]: Configuration successful ... I guessed it was something more complex. It would be nice if stunnel had the capability of showing (via the log file) an essential configuration mistake such as two POP3, SMTP or IMAP servers listening on the same ports. Once again, thanks for your input. Cheers, CIV PD: I am able to download mail from gmx.net serves via POP3 using Pegasus Mail and stunnel with no problems whatsoever. Sending mail requires the use of the POP3 userID/PW.

1 0

stunnel and Calypso and GMX: Anyone out there where stunnel works with Calypso?
by greeksalad 16 Dec '13

16 Dec '13

Hallo Everybody! Thanks for 2 replies, which replied, that mail.gmx.net:465 is not a propper ssl server: well, i tried with another email client (Opera), sending AUTH PLAIN and AUTH LOGIN and both worked. So I tried all possible configs in Calypso to get a successful smtp login, but it fails everytime with the same err.msg(see below) The funny thing is, the getting mail, login pop.gmx.net:995 works perfect via stunnel, but smtp fails.... So I want to ask, if there is anyone out there, who works successully with CALYPSO, stunnel and GMX-Provider?? In case, please tell me your settings - would be great! Thanks Johann my last question: ------ trying hard to get stunnel worked with Calypso email client! When I only check emails, it works via stunnel at ssl port 995. But sending email fails with following message from Calypso: *** Sending pending mail from account xyz(a)gmx.net' @ 13.12.2013 01:54 *** Connecting to: '127.0.0.1' -> Successful Logging into the SMTP server as: "xxx" The server does not support any secure password authentication providers Disconnecting -> Successful Failed to send one or more pending messages. Smtp.c[287] Smtp.dll the config file via stunnel looks so: cert = stunnel.pem [gmx-pop3] client = yes accept = 127.0.0.1:108 connect = pop.gmx.net:995 [gmx-smtp] client = yes accept = 127.0.0.1:107 connect = mail.gmx.net:465 the mailserver- config of Calypso is so: pop3: 127.0.0.1 port 108 smtp: 127.0.0.1 port 107 smtp authentication method: user pop account.... So, I am really out of ideas to get the very best email client of the world - CALYPSO - running to send emails via ssl connection, wich my provider forces me to send via ssl from 1.jan.2014... Anyone can help? thanks allot! johann

3 2

stunnel and Pegasus Mail
by sawbona＠flashmail.com 15 Dec '13

15 Dec '13

Hello: I recently came across stunnel as a solution (THE solution) to Pegasus Mail 4.63 having some sort of incompatibility with SSL versions in use at gmx.de and xsmail.com mail services. As I was absolutely unwilling to let go of my trusty PMailo, stunnel proved to be a godsend. =-) At first the problem was with xsmail only and after setting up stunnel everything went along perfectly well, no problems whatsoever. Now, gmx.de is enforcing the use of SSL on ports 993, 995 and 465 instead of 110, 25 and 143 so I edited my stunnel.conf accordingly. --- ;*********************************************************************** ;Configured service ;*********************************************************************** ;Pegasus Mail ;SSL connections to XSMail's servers ;Reason: there's some incompat between PMail 4.63 and SSL - 01/11/2013 [xsmail-POP3-SSL] client = yes accept = 10995 connect = mail.messagingengine.com:995 [xsmail-smtp-SSL] client = yes accept = 10465 connect = mail.messagingengine.com:465 [xsmail-IMAP-SSL] client = yes accept = 10993 connect = mail.messagingengine.com:993 ;Pegasus Mail ;SSL connections to GMX's servers ;Reason: there's some incompat between PMail 4.63 and SSL - 01/11/2013 [gmx-POP3-SSL] client = yes accept = 10995 connect = pop.gmx.net:995 [gmx-smtp-SSL] client = yes accept = 10465 connect = mail.gmx.net:465 [gmx-IMAP-SSL] client = yes accept = 10993 connect = imap.gmx.net:993 --- The issue at hand is that stunnel in not working properly now. This is the log file for a successful connection to xsmail: --- 2013.12.14 17:15:08 LOG5[500:284]: Service [xsmail-POP3-SSL] accepted connection from 127.0.0.1:1182 2013.12.14 17:15:08 LOG5[500:284]: connect_blocking: connected 66.111.4.51:995 2013.12.14 17:15:08 LOG5[500:284]: Service [xsmail-POP3-SSL] connected remote server from 192.168.1.102:1183 2013.12.14 17:15:10 LOG5[500:284]: Connection closed: 58 byte(s) sent to SSL, 112 byte(s) sent to socket --- And this is the log file for a (failed) connection to gmx: --- 2013.12.14 17:17:15 LOG5[500:452]: Service [xsmail-POP3-SSL] accepted connection from 127.0.0.1:1184 2013.12.14 17:17:15 LOG5[500:452]: connect_blocking: connected 66.111.4.52:995 2013.12.14 17:17:15 LOG5[500:452]: Service [xsmail-POP3-SSL] connected remote server from 192.168.1.102:1185 2013.12.14 17:17:21 LOG5[500:452]: Connection closed: 36 byte(s) sent to SSL, 126 byte(s) sent to socket --- The PMail trace is this as follows: [*] Connection established to 127.0.0.1 >> 0016 +OK POP3 ready << 0015 USER 14067985 >> 0005 +OK << 0015 PASS XXXXXXXX >> 0083 -ERR You must use your full username of the form yourusername(a)domain.tld to login Figures ... It is attempting to connect to gmx with xsmail credentials. As youcan see, for some strange reason it is connecting to gmx with xsmail settings. Must be a *.conf file problem but I am at a loss as to what is gong on Any ideas? Thanks in advance, CIV

2 2

stunnel and Calypso: pop3 works, smtp error!
by greeksalad 13 Dec '13

13 Dec '13

Hallo Everybody! trying hard to get stunnel worked with Calypso email client! When I only check emails, it works via stunnel at ssl port 995. But sending email fails with following message from Calypso: *** Sending pending mail from account xyz(a)gmx.net' @ 13.12.2013 01:54 *** Connecting to: '127.0.0.1' -> Successful Logging into the SMTP server as: "xxx" The server does not support any secure password authentication providers Disconnecting -> Successful Failed to send one or more pending messages. Smtp.c[287] Smtp.dll the config file via stunnel looks so: cert = stunnel.pem [gmx-pop3] client = yes accept = 127.0.0.1:108 connect = pop.gmx.net:995 [gmx-smtp] client = yes accept = 127.0.0.1:107 connect = mail.gmx.net:465 the mailserver- config of Calypso is so: pop3: 127.0.0.1 port 108 smtp: 127.0.0.1 port 107 smtp authentication method: user pop account.... So, I am really out of ideas to get the very best email client of the world - CALYPSO - running to send emails via ssl connection, wich my provider forces me to send via ssl from 1.jan.2014... Anyone can help? thanks allot! johann

3 2

Client Authentication - Configuring Service Definition
by j nasty 10 Dec '13

10 Dec '13

Hello Everyone, I’m attempting to consume a web service that requires I authenticate the client using certificates. I was given a (.pfx) certificate locked with a password by the 3rd party vendor. I know I need to convert the current certificate I have into a (.pem) certificate, which I’ll use the openssl tools to accomplish this. I’m a bit new to SSL and network security, thus I’m not entirely sure if I should only be creating a client certificate from the original (.pfx) file or if a server certificate will also need to get created. I used the command: “pkcs12 –in certificate.pfx –out certificate.pem –nodes (–clcerts/-cacerts)” to create my pem certificate. Here is my current configuration: [SSLconnection] debug = 7 CAfile = certificate.pem client = yes verify = 2 accept = 127.0.0.1:9001 connect = web.service.com:443 And the log: (I obscured some information identity information) 2013.12.10 09:36:41 LOG5[9776:8488]: stunnel 4.56 on x86-pc-msvc-1500 platform 2013.12.10 09:36:41 LOG5[9776:8488]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 2013.12.10 09:36:41 LOG5[9776:8488]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2013.12.10 09:36:41 LOG5[9776:8488]: Reading configuration from file stunnel.conf 2013.12.10 09:36:41 LOG5[9776:8488]: FIPS mode is enabled 2013.12.10 09:36:41 LOG5[9776:8488]: Configuration successful 2013.12.10 09:36:44 LOG5[9776:9024]: Service [SSLconnection] accepted connection from 127.0.0.1:60659 2013.12.10 09:36:44 LOG5[9776:9024]: connect_blocking: connected web.service.com:443 2013.12.10 09:36:44 LOG5[9776:9024]: Service [SSLconnection] connected remote server from 192.168.50.211:60660 2013.12.10 09:36:44 LOG5[9776:9024]: Certificate accepted: depth=1, /C=US/O=Entrust, Inc./OU=www.entrust.net/rpa is incorporated by reference/OU=(c) 2009 Entrust, Inc./CN=Entrust Certification Authority - L1C 2013.12.10 09:36:44 LOG5[9776:9024]: Certificate accepted: depth=1, /C=US/O=Entrust, Inc./OU=www.entrust.net/rpa is incorporated by reference/OU=(c) 2009 Entrust, Inc./CN=Entrust Certification Authority - L1C 2013.12.10 09:36:44 LOG4[9776:9024]: CERT: Certificate not found in local repository 2013.12.10 09:36:44 LOG4[9776:9024]: Certificate check failed: depth=0, /C=US/ST=Texas/L=Austin/O=OName/CN=web.service.com 2013.12.10 09:36:44 LOG3[9776:9024]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2013.12.10 09:36:44 LOG5[9776:9024]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Looks like my problem is stemming from "Certificate not found in local repository"? Thank you in advance for any assistance, Jake

1 0

connect error 0 running on ARM platform
by FX35 10 Dec '13

10 Dec '13

Hello, Running stunnel 4?56 on an ARM platform (ARM926EJ) with Linux 2.6.36.4, I encounter the following error : the call to connect() return -1, but errno is set to 0 ! Is somebody meet the same error ? Is the problem in stunnel program ? An other application, using non blocking call to connect() run correctly. Thanks for help. FWX.

1 0

newbie - sTunnel examples and users archive searching
by Attila Horvath 10 Dec '13

10 Dec '13

All I'm new to sTunnel and tunneling in general. Have a couple of quick questions... [1] It's been *many* years since I've used or subscribed to mailman. Is there a way of searching the mail archives online for specific topics and/or keywords without downloading everything so previously asked questions aren't repeated ad nauseam? [2] I have a specific need which I believe sTunnel will solve but not sure how to go about it. I want to access a machine that is behind a restrictive firewall from outside the network to perform perform remote desktop control. The firewall permits HTTP, HTTPS protocols and some similar common protocols. However, I do not have access to the firewall server ergo have no control/say over which ports are blocked or forwarded. I have heard about HTTP hole punching via ssl and http-tunnel - eg: http://sebsauvage.net/punching/. It sounds like sTunnel is similar/identical. Can someone point me to specific examples on how to use sTunnel as well as any examples that might satisfy my need? Is proxy server necessary to accomplish this? To date I've been using Teamviewer to access/control my machine(s) in conjunction with things like AdVOR, TOR, or UltraSurf. While these are excellent applications and their free use are limited, I do not expect this will last forever. I prefer to use and trust 'open source' applications where/when I can. Much appreciated and thank you in advance. Attila

1 0

error invalid stunnel.conf - No limit of clients
by Christian Huber 09 Dec '13

09 Dec '13

Hi, I just installed stunnel for my email programm courier. I edited the stunnel.conf as followed but am unfortunatly becoming the message from stunnel: invalid stunnel.conf No limit detected for the number of clients stunnel 4.56 on x86-pc-msvc-1500 platform Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D07808C: error:2D07808C:FIPS routines:FIPS_module_mode_set:unsupported platform Line 11: "[POP3 T-Online]": Failed to initialize SSL Server is down my stunnel.conf is as followed: # GLOBAL OPTIONS client = yes output = stunnel-log.txt debug=4 taskbar = yes # SERVICE-LEVEL OPTIONS [POP3 T-Online] accept = 127.0.0.1:108 connect = securepop.t-online.de:995 [SMTP T-Online] accept = 127.0.0.1:107 connect = securesmtp.t-online.de:587 [POP3 web.de] accept = 127.0.0.1:106 connect = pop3.web.de:995 [SMTP web.de] accept = 127.0.0.1:105 connect = smtp.web.de:587 [POP3 STRATO] accept = 127.0.0.1:104 connect = pop3.strato.de:995 [SMTP STRATO] accept = 127.0.0.1:103 connect = smtp.strato.de:465 [POP3 GMX ] accept = 127.0.0.1:102 connect = pop.gmx.net:995 [SMTP GMX ] accept = 127.0.0.1:101 connect = mail.gmx.net:465 ___________________ Would be nice if someone could tell me what is wrong! Greetings Christian Huber

3 3

t-online, web.de E-mail with Courier
by Christian Huber 08 Dec '13

08 Dec '13

Hi, stunnel is now working with the fips=no global option without error! My e-mail programm courier is working with the servers from strato and gmx! But with t-online it is not working at the moment! I can not login into the pop3 server! >From courier I get the message: Sendrecv.c[229] Pop3.dll recv() failed WINSOCK Error: Connection reset. (The mail server terminated the connection. With web.de I can login into the pop3 server and receive mails. But sending mails is not sucessfull! >From courier I get the message: Sendrecv.c[188] Smtp.dll recv(MSG_PEEK) failed WINSOCK Error: Connection reset. (The mail server terminated the connection. Would be nice if someone has a solution! My stunnel.conf: # GLOBAL OPTIONS client = yes fips=no output = stunnel-log.txt debug=4 taskbar = yes # SERVICE-LEVEL OPTIONS [POP3 T-Online] accept = 127.0.0.1:108 connect = securepop.t-online.de:995 [SMTP T-Online] accept = 127.0.0.1:107 connect = securesmtp.t-online.de:587 [POP3 web.de] accept = 127.0.0.1:106 connect = pop3.web.de:995 [SMTP web.de] accept = 127.0.0.1:105 connect = smtp.web.de:587 [POP3 STRATO] accept = 127.0.0.1:104 connect = pop3.strato.de:995 [SMTP STRATO] accept = 127.0.0.1:103 connect = smtp.strato.de:465 [POP3 GMX ] accept = 127.0.0.1:102 connect = pop.gmx.net:995 [SMTP GMX ] accept = 127.0.0.1:101 connect = mail.gmx.net:465

1 0

stunnel domain name resolution bug
by David Slachta 07 Dec '13

07 Dec '13

I'm new to the mailing lists so I hope it's the correct way to report a bug. There's an issue with resolving domain names. I'm connecting an stunnel client to a server that sits on a computer which IP address is dynamic. Therefore I'm using a dyndns for the IP address of the server. When the IP address of the server is changed, the stunnel client doesn't update the name resolution of the dyndns name and tries to connect to the old IP which is of course unsuccessful. This can be resolved only by exiting and starting stunnel client again when a new domain name resolution is made. Would it be possible to add a functionality to the stunnel that wouldn't cache the name resolution but try to resolve the domain names every time there's a connection request? I'm using a Windows OS for both server and client, not sure if that makes a difference. Thanks! David

2 1

Re: [stunnel-users] stunnel domain name resolution bug
by Brian Wilkins 06 Dec '13

06 Dec '13

Sent you traffic from Sept 19th from Trojnara. May be helpful On Dec 6, 2013 6:11 PM, "Brian Wilkins" <bwilkins(a)gmail.com> wrote: > See my forward > On Dec 6, 2013 5:53 PM, "David Slachta" <elpin(a)volny.cz> wrote: > >> I'm new to the mailing lists so I hope it's the correct way to report a >> bug. >> >> There's an issue with resolving domain names. I'm connecting an stunnel >> client to a server that sits on a computer which IP address is dynamic. >> Therefore I'm using a dyndns for the IP address of the server. When the IP >> address of the server is changed, the stunnel client doesn't update the >> name resolution of the dyndns name and tries to connect to the old IP which >> is of course unsuccessful. This can be resolved only by exiting and >> starting stunnel client again when a new domain name resolution is made. >> >> Would it be possible to add a functionality to the stunnel that wouldn't >> cache the name resolution but try to resolve the domain names every time >> there's a connection request? >> >> I'm using a Windows OS for both server and client, not sure if that makes >> a difference. >> >> Thanks! >> David >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >>

1 0

Hostname verification, support for, and patches
by fslama＠comcast.net 06 Dec '13

06 Dec '13

After scouring the net I've found several isolated discussions regarding stunnel hostname validation. And also some patches that seem to implement hostname validation: https://www.stunnel.org/pipermail/stunnel-users/2010-March/002613.html I have a requirement to have stunnel (4.56) validate client certificates and their identity by comparing the its CNAME against the source address. I recall reading one response (which I can't find at the moment) from Marzena Trojnara indicating that this feature won't be supported. If so, can you explain the rational? Are there sanctioned patches out there today? Regards, -Fred

4 3

setup stunnel problem
by edu.bit.es＠gmail.com 20 Nov '13

20 Nov '13

Hi everybody, I'm absolutely new in stunnel. I came around because of a post in the google forums about making Symantec System Recovery mail through smtp.gmail.com. Symantec is not capable of doing SSL/TLS so I need a solution like stunnel. But I've an issue: it doesn't seem to work :) I installed the program ok, and configured in the following way: cert=stunnel.pem socket = l:TCP_NODELAY=1 socket= r:TCP_NODELAY=1 [gmail-smtp] client=yes accept:127.0.0.1:25 connect= smtp.gamil.com:465 EOF The server is listening on port 127.0.0.1:25 but when I do a telnet to that port gives an error and doesn't seem to tunnel me to smtp.gmail.com. On the other hand, I configured outlook to use that tunnel but gives an error stating it can reach the smtp server. What am I doing wrong? Should I change the TLS version? Best regards and thanks in advance.

2 7

Stunnel with gmail not working on RHEL 6.4
by André Luís 17 Nov '13

17 Nov '13

Hello, I am trying to setup stunnel to send email using gmail smtp server trough Oracle Database. I first tested on my windows machine. I installed and configured stunnel and it worked fine.But now I tried to do the same on our server (RHEL 6.4) and it doesn't work. I can successfuly telnet the 25 port: [root@server1 stunnel]# telnet localhost 25Trying 127.0.0.1...Connected to localhost.Escape character is '^]'.220 mx.google.com ESMTP so2sm18740691pbc.5 - gsmtp When I send the email, i receive this error: SMTP permanent error: 534 5.7.14 54 ef10sm21262349pac.1 - gsmtp anyone have any idea? the stunnel.conf: pid = /stunnel.pidoutput = /var/log/stunnel.logcompression = zlibsslVersion = alloptions = NO_SSLv2debug = 7 [gmail-smtp]client = yesaccept = localhost:25connect = smtp.gmail.com:465 Here is the Stunnel log:2013.11.17 15:58:34 LOG7[23729:139952118699968]: gmail-smtp accepted FD=13 from 127.0.0.1:560892013.11.17 15:58:34 LOG7[23729:139952118695680]: gmail-smtp started2013.11.17 15:58:34 LOG7[23729:139952118695680]: FD 13 in non-blocking mode2013.11.17 15:58:34 LOG7[23729:139952118695680]: Waiting for a libwrap process2013.11.17 15:58:34 LOG7[23729:139952118695680]: Acquired libwrap process #02013.11.17 15:58:34 LOG7[23729:139952118695680]: Releasing libwrap process #02013.11.17 15:58:34 LOG7[23729:139952118695680]: Released libwrap process #02013.11.17 15:58:34 LOG7[23729:139952118695680]: gmail-smtp permitted by libwrap from 127.0.0.1:560892013.11.17 15:58:34 LOG5[23729:139952118695680]: gmail-smtp accepted connection from 127.0.0.1:560892013.11.17 15:58:34 LOG7[23729:139952118695680]: FD 14 in non-blocking mode2013.11.17 15:58:34 LOG6[23729:139952118695680]: connect_blocking: connecting 74.125.129.108:4652013.11.17 15:58:34 LOG7[23729:139952118695680]: connect_blocking: s_poll_wait 74.125.129.108:465: waiting 10 seconds2013.11.17 15:58:34 LOG5[23729:139952118695680]: connect_blocking: connected 74.125.129.108:4652013.11.17 15:58:34 LOG5[23729:139952118695680]: gmail-smtp connected remote server from 172.31.22.161:510672013.11.17 15:58:34 LOG7[23729:139952118695680]: Remote FD=14 initialized2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): before/connect initialization2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv2/v3 write client hello A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read server hello A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read server certificate A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read server done A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 write client key exchange A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 write change cipher spec A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 write finished A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 flush data2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read server session ticket A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read finished A2013.11.17 15:58:34 LOG7[23729:139952118695680]: 1 items in the session cache2013.11.17 15:58:34 LOG7[23729:139952118695680]: 1 client connects (SSL_connect())2013.11.17 15:58:34 LOG7[23729:139952118695680]: 1 client connects that finished2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 client renegotiations requested2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 server connects (SSL_accept())2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 server connects that finished2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 server renegotiations requested2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 session cache hits2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 external session cache hits2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 session cache misses2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 session cache timeouts2013.11.17 15:58:34 LOG6[23729:139952118695680]: SSL connected: new session negotiated2013.11.17 15:58:34 LOG6[23729:139952118695680]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA12013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL socket closed on SSL_read2013.11.17 15:58:34 LOG7[23729:139952118695680]: Socket write shutdown2013.11.17 15:58:34 LOG5[23729:139952118695680]: Connection closed: 90 bytes sent to SSL, 860 bytes sent to socket2013.11.17 15:58:34 LOG7[23729:139952118695680]: gmail-smtp finished (0 left)2013.11.17 16:01:01 LOG7[23729:139952118699968]: gmail-smtp accepted FD=13 from 127.0.0.1:561202013.11.17 16:01:01 LOG7[23729:139952118695680]: gmail-smtp started2013.11.17 16:01:01 LOG7[23729:139952118695680]: FD 13 in non-blocking mode2013.11.17 16:01:01 LOG7[23729:139952118695680]: Waiting for a libwrap process2013.11.17 16:01:01 LOG7[23729:139952118695680]: Acquired libwrap process #02013.11.17 16:01:01 LOG7[23729:139952118695680]: Releasing libwrap process #02013.11.17 16:01:01 LOG7[23729:139952118695680]: Released libwrap process #02013.11.17 16:01:01 LOG7[23729:139952118695680]: gmail-smtp permitted by libwrap from 127.0.0.1:561202013.11.17 16:01:01 LOG5[23729:139952118695680]: gmail-smtp accepted connection from 127.0.0.1:561202013.11.17 16:01:01 LOG7[23729:139952118695680]: FD 14 in non-blocking mode2013.11.17 16:01:01 LOG6[23729:139952118695680]: connect_blocking: connecting 74.125.129.109:4652013.11.17 16:01:01 LOG7[23729:139952118695680]: connect_blocking: s_poll_wait 74.125.129.109:465: waiting 10 seconds2013.11.17 16:01:01 LOG5[23729:139952118695680]: connect_blocking: connected 74.125.129.109:4652013.11.17 16:01:01 LOG5[23729:139952118695680]: gmail-smtp connected remote server from 172.31.22.161:569712013.11.17 16:01:01 LOG7[23729:139952118695680]: Remote FD=14 initialized2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): before/connect initialization2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 write client hello A2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read server hello A2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read finished A2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 write change cipher spec A2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 write finished A2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 flush data2013.11.17 16:01:01 LOG7[23729:139952118695680]: 1 items in the session cache2013.11.17 16:01:01 LOG7[23729:139952118695680]: 2 client connects (SSL_connect())2013.11.17 16:01:01 LOG7[23729:139952118695680]: 2 client connects that finished2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 client renegotiations requested2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 server connects (SSL_accept())2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 server connects that finished2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 server renegotiations requested2013.11.17 16:01:01 LOG7[23729:139952118695680]: 1 session cache hits2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 external session cache hits2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 session cache misses2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 session cache timeouts2013.11.17 16:01:01 LOG6[23729:139952118695680]: SSL connected: previous session reused2013.11.17 16:01:02 LOG7[23729:139952118695680]: SSL socket closed on SSL_read2013.11.17 16:01:02 LOG7[23729:139952118695680]: Socket write shutdown2013.11.17 16:01:02 LOG5[23729:139952118695680]: Connection closed: 241 bytes sent to SSL, 825 bytes sent to socket2013.11.17 16:01:02 LOG7[23729:139952118695680]: gmail-smtp finished (0 left) Thanks a lot

1 0

Weird tunneling eMule's web interface
by Javier 17 Nov '13

17 Nov '13

Hi there, lets see: When I setup a server for the eMule's web interface and I access with the browser through https, the result is that the web interface never fully loads. When I setup a server for the web interface and a client connecting to that server and I access with the browser through http and with help of the client, the web interface loads without problems. Ok, at this point you think... "maybe the browser doesn't understand stunnel server at first instance for some reason... and needs the client to have a good SSL connection". So, we complicate things.... ;-) I made the following scenario because, sometimes, you can't use a client in the remote computer (where is not the web interface, if you are lost what with I'm telling). So, now we setup a server for the web interface, a client that connects to the server and a new server that connects to the client to serve to the remote browser... and... happens the same as the first example, as if it was only one server serving the web interface: it never fully loads. (I know, this scenario was quite weird :-P ). In case it was the browser I checked max connections, pipelining, etc, (allowing crazy max connection limits) but that didn't help on success :-( No matter of what web browser I use, they all do the same. They create between 7 to 15 connections with stunnel (sometimes more, others less) and nothing else. With the help of the client, all is smooth with over 150 connections. I tried too to create an html file "similar" to the web interface with the same resources (basically loads of images and therefore requests per second) and with my own web server and, in this case, there was no drama at all. The browsers connect to the stunnel server with over 190 connections in an eye blink and without of an stunnel client. At this point, I'm quite lost :-S Why doesn't load the web interface connecting directly to the stunnel server but does with the help of a client? Any ideas? Probably is the built-in web server of eMule, but it doesn't give problems when there is no stunnel in between or when using an stunnel client to connect to that stunnel server :S If you use eMule, test it and tell me if it works for you. Regards. P.S.: I hope you understood all because, even for me, has been confusing to explain.

1 0

stunnel server configuration requirement to handle CBC protection
by Simner, John 13 Nov '13

13 Nov '13

Hi, Having recently used stunnel on the phone as a server to encrypt the communication between an external client and a simple TCP server socket on the phone, one of the clients have raised the following.... Phone resets a TLS conection from client, when CBC protection is enabled on tomcat server. The phone syslog shows: Oct 28 14:26:14 10 user.crit syslog: CommsChannelExtenderRx(28881): ./src/CommsChannelExtenderRx.cpp:186 Header section invalid To prevent a SSL/TLS BEAST attack (CVE-2011-3389) Oracle Java (JSSE) has implemented a CBC protection which can be set with System Property jsse.enableCBCProtection. The default value is true. What was done: Start client and connect it with a phone. The TLS connection is established, but then the phone resets the connection, and client is not working. When I set jsse.enableCBCProtection to false at the tomcat server, the phone accepts the connection and client is working. To prevent man-in-the-middle attacks, the phone should be able to handle the fragmented TLS block when CBC protection is activated on the client tomcat server. I have been unable to find the appropriate stunnel configuration item to support this. Please could you inform me how this is handled through stunnel. Thank you for your assistance and I look forward to your responses. Thanks.. John John Simner BSc(Hons) MSc CEng. MIET Software Engineer Unify Enterprise Communications Ltd. Devices Development K Block, Technology Drive, Beeston, Nottingham, NG9 1LA Tel.: +44 (0) 19088 17378 Email: john.simner(a)unify.com <mailto:[email protected]> www.unify.co.uk<http://www.unify.co.uk/> Follow us: [Social_media_icons] <http://www.unify.com/social-media> Unify Enterprise Communications Limited. Registered Office: Brickhill Street, Willen Lake, Milton Keynes, MK15 0DJ Registered No: 5903714, England. This email contains confidential information and is for the exclusive use of the addressee. If you are not the addressee then any distribution, copying, or use of this email is prohibited. If received in error, please advise the sender and delete immediately. We accept no liability for any loss or damage suffered by any person arising from use of this email.

4 10

Patch for Start TLS for LDAP clients (RFC 2830)
by Bart Dopheide 07 Nov '13

07 Nov '13

Hi, I noticed that latest/greatest stunnel does not support the Start TLS operation for LDAP (RFC2830). Yet, I need it in my organisation as a quick workaround. After fiddling with OpenLDAP, tracing, and reading RFC 2830 a bit, I patched stunnel 4.56 and the patch has not failed me yet. But I must remark that I am no LDAP expert, nor an certified stunnel hacker. So, I will submit this patch as a first suggestion. Will you consider the feature request of implementing the Start TLS feature as described in RFC 2830? Cheers, Bart Dopheide My patch suggestion is: dopheideb@anguish:/tmp$ diff -aur stunnel-4.56 stunnel-4.56-ldap-starttls-patch diff -aur stunnel-4.56/src/protocol.c stunnel-4.56-ldap-starttls-patch/src/protocol.c --- stunnel-4.56/src/protocol.c 2013-03-13 14:41:16.000000000 +0100 +++ stunnel-4.56-ldap-starttls-patch/src/protocol.c 2013-11-05 11:19:10.388365359 +0100 @@ -53,6 +53,7 @@ static void imap_client(CLI *); static void imap_server(CLI *); static void nntp_client(CLI *); +static void openldap_client(CLI *); static void connect_server(CLI *); static void connect_client(CLI *); @@ -82,6 +83,7 @@ {"pop3", {{PROTOCOL_PRE_SSL, pop3_server}, {PROTOCOL_PRE_SSL, pop3_client}}}, {"imap", {{PROTOCOL_PRE_SSL, imap_server}, {PROTOCOL_PRE_SSL, imap_client}}}, {"nntp", {{PROTOCOL_NONE, NULL}, {PROTOCOL_PRE_SSL, nntp_client}}}, + {"openldap",{{PROTOCOL_NONE, NULL}, {PROTOCOL_PRE_SSL, openldap_client}}}, {"connect", {{PROTOCOL_PRE_CONNECT, connect_server}, {PROTOCOL_PRE_SSL, connect_client}}}, {NULL, {{PROTOCOL_NONE, NULL}, {PROTOCOL_NONE, NULL}}} }; @@ -513,6 +515,88 @@ str_free(line); } +/**************************************** LDAP, RFC 2830 */ + +u8 ldap_startssl_message[0x1d + 2] = +{ + 0x30, /* tag = UNIVERSAL SEQUENCE */ + 0x1d, /* len = 29 (the remaining number of bytes in this message) */ + 0x02, /* messageID */ + 0x01, /* len = 1 */ + 0x01, /* value = 1 (this is messageID 1) */ + /* --- */ + 0x77, /* protocolOp = APPLICATION (23) (=ExtendedRequest) + * 0b01xxxxxx => APPLICATION + * 0bxx1xxxxx => ? + * 0xxxx10111 => 23 + */ + 0x18, /* len = 24 */ + 0x80, /* type = requstName? */ + 0x16, /* len = 22 */ + /* OID: 1.3.6.1.4.1.1466.20037 (=LDAP_START_TLS_OID)*/ + '1', '.', + '3', '.', + '6', '.', + '1', '.', + '4', '.', + '1', '.', + '1', '4', '6', '6', '.', + '2', '0', '0', '3', '7' + /* No requestValue, as per RFC2830 (in 2.1: "The requestValue field is absent") */ +}; +static void openldap_client(CLI *c) { + u8 buffer[1]; + u8 ldap_response[256]; + + s_log(LOG_DEBUG, "Requesting LDAP Start TLS"); + write_blocking(c, c->remote_fd.fd, ldap_startssl_message, ldap_startssl_message[1] + 2); + + read_blocking(c, c->remote_fd.fd, buffer, 1); + if(buffer[0] != 0x30) { + s_log(LOG_ERR, "start tag is not UNIVERSAL SEQUENCE"); + longjmp(c->err, 1); + } + + s_log(LOG_DEBUG, "Reading LDAP message size (1 byte)."); + read_blocking(c, c->remote_fd.fd, buffer, 1); + + s_log(LOG_DEBUG, "Reading LDAP message (%u byte(s))", buffer[0]); + read_blocking(c, c->remote_fd.fd, ldap_response, buffer[0]); + + if(ldap_response[0] != 0x02) { + s_log(LOG_ERR, "LDAP response does not start with type messageID"); + longjmp(c->err, 1); + } + if(ldap_response[1] != 0x01) { + s_log(LOG_ERR, "This is not an extendedResp(1)"); + longjmp(c->err, 1); + } + if(ldap_response[2] != 0x01) { + s_log(LOG_ERR, "Non-matching messageID"); + longjmp(c->err, 1); + } + if(ldap_response[3] != 0x78) { + s_log(LOG_ERR, "This is not a protocolOp for APPLICATION ExtendedResponse"); + longjmp(c->err, 1); + } + if(ldap_response[4] != 0x07) { + s_log(LOG_ERR, "Expected 0x07 indicating extendedResp is 7 bytes long"); + longjmp(c->err, 1); + } + if(ldap_response[5] != 0x0a) { + s_log(LOG_ERR, "This is not an extendedResp"); + longjmp(c->err, 1); + } + if(ldap_response[6] != 0x01) { + s_log(LOG_ERR, "This is not an extendedResp"); + longjmp(c->err, 1); + } + if(ldap_response[7] != 0x00) { + s_log(LOG_ERR, "This is not resultCode success"); + longjmp(c->err, 1); + } +} + /**************************************** connect */ static void connect_server(CLI *c) { dopheideb@anguish:/tmp$

3 2

stunnel x forwarded not working
by Libindas 05 Nov '13

05 Nov '13

Hi all, We are facing problem with stunnel + HAproxy + Tomcat Client -----> Stunnel-----> HAProxy----> Tomcat { I need get client IP in Tomcat Servers} I have compiled(stunnel-4.32 + stunnel-4.32-xforwarded-for.diff) and installed but not working. Really appreciate your help Thanks Libin

2 1

Trouble sending email via smtp with a particular gmail address
by Brian Morgan 01 Nov '13

01 Nov '13

I'm having trouble sending email through stunnel with our customer service email address. We use google premium services for our hosted email. I can send through stunnel using my own personal account, but when I switch to the cust service account, I get the error: "Failed to send an E-mail through the specified SMTP server [127.0.0.1]: The SMTP server requires a secure connection or the client was not authenticated. The server response was 5.5.1 Authentication Required." And yes, I double/triple checked credentials and can login through the gmail interface with them just fine. I also tried changing the password to a strong password which did not help. gmail settings in stunnel.conf: [gmail-smtp] client = yes accept = 127.0.0.1:259 connect = smtp.gmail.com:465 I also tried port 587 but that produces another error: "Failed to send an E-mail through the specified SMTP server [127.0.0.1]: Failure sending mail." Any ideas?

2 4

Clear LogWindow without Restart stunnel possible?
by Ben Stover 01 Nov '13

01 Nov '13

Can I somehow clear the current LogWindows WITHOUT exit+restarting stunnel?

2 1

Question Regarding Client Installer
by Andrew Smith 29 Oct '13

29 Oct '13

We currently use Stunnel to allow our clients to connect to their Databases that are hosted by us. I think this product is great. However, I am a newbie to Stunnel as our previous resource has passed away. What I would like to know now to do is create an installer for clients machines that have the correct configuration files in etc... I am sure this is pretty easy and I will be able to do it this once I am guided in the correct direction. Thanks in advance! ________________________________ Andrew Smith Support Technical Services Analyst P: 614-875-4910 x109 F: 614-875-4088 E: andrew.smith(a)harriscomputer.com [http://www.harriscomputer.com/images/signatures/HarrisSchools.jpg] [http://www.harriscomputer.com/images/signatures/DivisionofHarris.gif]<http://www.harriscomputer.com/> 6110 Enterprise Parkway Grove City, OH 43123 www.harris-schoolsolutions.com<http://www.harris-schoolsolutions.com> This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.

2 1

Re: [stunnel-users] Is it usual/recommended to have key and cert in ONE stunnel.pem file?
by Ben Stover 29 Oct '13

29 Oct '13

Hello John, thank you for your clarification. Two more additional questions: According to stunnel guide I created a cert + key with the following command: openssl.exe req -new -x509 -days 3650 -nodes -config stunnel.cnf -out stunnelcert.pem -keyout stunnelkey.pem 1.) For what do I need here the -config stunnel.cnf parameter? I am prompted by openssl for the content values during generation anyway. Can stunnel.cnf be seen only as a default value pattern for the created cert during generation? Can I omit this parameter? 2.) After creation of cert+key I have to specify them (as client) in stunnel.conf (with "o") as follows: cert = stunnelcert.pem key = stunnelkey.pem Is this sufficient? Thank you Ben On Mon, Oct 28, 2013 at 06:39:15PM +0100, Ben Stover wrote: > According to some tutorial pages I generated with OpenSSL a (selfsigned) certificate. > > This file stunnel.pem contains the certifictae as well as the private key. > > Is this usual/recommended? Hello John, That sort of falls into the "tragedy waiting to happen" category. The certificate is supposed to be given to clients, and the key belongs to the server and has to be kept private or there's really no point in using SSL. > Or should user put these two parts in two independent files? Yes, absolutely. In fact I suppose you're using Windows or went through some hoop-jumping to combine them, because in "normal" OpenSSL usage the key is generated first and then the certs are requested and signed by the CA (or selfsigning) key. /jl

2 1

VPAT Section 508 Compliance
by Tracy Drake - QI-C 28 Oct '13

28 Oct '13

Hello Stunnel Support! I am seeking a VPAT showing the level Sec 508 compliance so that we can move toward making Stunnel a GSA-approved software. I guess the biggest question is whether or not Stunnel is considered to be section 508 compliant. Please advise as to where/how I can obtain this information. -- Tracy Drake CSM Senior Consultant GSA-FAS FAME Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

1 0

Is it usual/recommended to have key and cert in ONE stunnel.pem file?
by Ben Stover 28 Oct '13

28 Oct '13

According to some tutorial pages I generated with OpenSSL a (selfsigned) certificate. This file stunnel.pem contains the certifictae as well as the private key. Is this usual/recommended? Or should user put these two parts in two independent files? Ben

2 1

Is "fips=no" recommended?
by Ben Stover 25 Oct '13

25 Oct '13

I stunnel.conf there is a parameter fips=no which is currently commented out here. Is it (resp. when is it) recommended to activate this parameter? Ben

2 1

Verify = 4 Fails Yet Again
by Thomas Eifert 25 Oct '13

25 Oct '13

I've just encountered another situation in which verify = 4 fails on a seemingly valid certificate. Since I've previously posted details regarding this issue, I'm only going to post the certificate here. This is the 3rd certificate I've run across in the past 6 months that fails to verify. Can all 3 of the certificates be faulty, or is there an issue with Stunnel or OpenSSL here? Thomas -----BEGIN CERTIFICATE----- MIIGyTCCBbGgAwIBAgIQC0NHQrtbGPWbZINtfJec1jANBgkqhkiG9w0BAQUFADBm MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5j ZSBDQS0zMB4XDTEzMDYwMzAwMDAwMFoXDTE2MDgxMDEyMDAwMFowgYQxCzAJBgNV BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRIwEAYDVQQHEwlFc2NvbmRpZG8x JjAkBgNVBAoTHUZvcnRlIEludGVybmV0IFNvZnR3YXJlLCBJbmMuMQswCQYDVQQL EwJJVDEXMBUGA1UEAwwOKi5mb3J0ZWluYy5jb20wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDZ8XZFzc6kdJt8WMByc4VPw7Ru4JZ6P+AyZXcLNA/hSih0 Xes5fGjw7oBTyUJWic/FIe397AKkjM8WGtH70EnOv3BzAHzv5ftdhG6UskJmZV7K pokKao+M6AtL0yLyXTDXXF0c7dcUwmQ9lu2LIvyqMCo5RNjaNHPoG+pqxXSN4mSj kSxUsW62p6+qE+uJGBP9HW14DGzE+OBUfB/noC63qMWjYIOWmRX/rIC8H6NyFBWl K0X0yUkxbkc5o/f9DiChCCvzK7RUIiZfDxBKKQ4VZq8+cIHIhHzbziDj2J7Twj2b VeL052E7EjTxRvYIEkyaU2JIbvcLKDzJ1H5vHxpTAgMBAAGjggNSMIIDTjAfBgNV HSMEGDAWgBRQ6nOJ2yn7EI+e5QEg1N55mUiD9zAdBgNVHQ4EFgQUwgLEas/pP7rM UfpMXPrkHEg4SWcwJwYDVR0RBCAwHoIOKi5mb3J0ZWluYy5jb22CDGZvcnRlaW5j LmNvbTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF BwMCMGEGA1UdHwRaMFgwKqAooCaGJGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9j YTMtZzIyLmNybDAqoCigJoYkaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL2NhMy1n MjIuY3JsMIIBxAYDVR0gBIIBuzCCAbcwggGzBglghkgBhv1sAQEwggGkMDoGCCsG AQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9zc2wtY3BzLXJlcG9zaXRv cnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUAcwBlACAAbwBm ACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMAdABp AHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAg AEQAaQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAg AFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAg AHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBu AGQAIABhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBp AG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMHsGCCsGAQUFBwEBBG8wbTAk BggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEUGCCsGAQUFBzAC hjlodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJh bmNlQ0EtMy5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAfaQd sAZueUdpTa/3TBpGPlKRiirlATk4kLgpk08R73hEsbA3LICRA5RbfvBGZ56031Hh rxzU8ZhI8q4kKiLbYawpRw9bzxlX35GW5MwuZiQTY0eL45V2L17Ya+Qi1+zYSAvA ZrkC2IGXUuV+sup+WQ8nx+A+HE0aGBWwCoza8qbrbFc86DrPKaGBqyanSSNQBDOg Jzojg6do31qnrDOc/Sg9fckSOtBTFO3Dqgyv0UiaaimcQE3OOqEeianQ7REE2XIX 96d2iRp5fVxMjx9SCfaD31DIogTbYmrw7+3KEPgU8QNn1RAzjPUkSZxvcO8X/Xue vw2kqH9uZ7dlx7c6CA== -----END CERTIFICATE----- -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 10

Transparent Proxy Source on HPUX 11i
by Jeremy Brock 24 Oct '13

24 Oct '13

Hi All, Are there any plans to make Transparent Mode possible on HPUX? 2013.10.22 16:24:22 LOG5[3607:1]: stunnel 4.56 on ia64-hp-hpux11.23 platform 2013.10.22 16:24:22 LOG5[3607:1]: Compiled/running with OpenSSL 0.9.8y 5 Feb 2013 2013.10.22 16:24:22 LOG5[3607:1]: Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP 2013.10.22 16:24:22 LOG5[3607:1]: Reading configuration from file /ASKPLUS/stunnel/stunnel.conf 2013.10.22 16:24:22 LOG5[3607:1]: Configuration successful 2013.10.22 16:24:47 LOG5[3608:2]: Service [ vsrvtcp ] accepted connection from 192.168.15.6:1169 *2013.10.22 16:24:47 LOG3[3608:2]: Transparent proxy in remote mode is not supported on this platform* 2013.10.22 16:24:47 LOG5[3608:2]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket ~Jeremy -- Jeremy Brock Vital Soft, Inc www.vital-soft.com

2 1

Stunnel Service as other user
by Florian Götz 24 Oct '13

24 Oct '13

Hi Stunnel users, if I use xinetd to start a service I got the possibility to start the service with a dedicated user. For example: service fex { socket_type = stream wait = no type = unlisted protocol = tcp bind = 123.12.1.12 port = 80 cps = 10 2 * user = fex groups = yes server = /home/fex/bin/fexsrv nice = 0 disable = no } I got some kind of webserver (not apache, nginx etc) that needs to be started with xinetd (the example above). This server should get a SSL tunnel. If I use Stunnel in daemon mode (without jails/chroot) and define a service like this: [https] accept = 123.12.1.12:443 exec = /home/fex/bin/fexsrv execargs = fexsrv stunnel TIMEOUTclose = 2 Everything works fine, except that the server now runs as root. Is there a possibility to set a user for a service? Best regards Florian Götz -- Mit freundlichen Grüßen Florian Götz ----------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6232 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

2 1

Username and Password in Clear Text
by Peter K. O'Connor 24 Oct '13

24 Oct '13

Hi, I am using stunnel 4.56 Windows verison. I thought the username and password will *only* be sent to SERVER2, *after* the SSL handshake, with each request. However, the truth is that the Proxy-Authorization header is attached to the request to SERVER1 "CONNECT SERVER2:433 HTTP/1.1", as well. So SERVER1 can see username and password. It is not necessary and safe. Am I missing anything here? Regards, Peter [stunnel] client = yes accept = 127.0.0.1:8080 connect = SERVER1:3128 protocol = connect protocolHost = SERVER2:443 protocolUsername = username protocolPassword = password

2 1

Re: [stunnel-users] Which X.509 certificate types (.crt, .pem, .der .p7c) possible for stunnel and how to import them?
by Ben Stover 24 Oct '13

24 Oct '13

Assume I have already an *.pem cert (for SMTP over STARTTLS transfer). Where (in whcih directory) should I put this cert file? Ben On Fri, 18 Oct 2013 12:35:25 +0000, Eckert, Doug wrote: >You can use OpenSSL to convert between formats (to .pem for STunnel) >https://support.ssl.com/Knowledgebase/Article/View/19/0/der-vs-crt-vs-cer-v… >You can also use openssl to strip the key's passphrase. This is handy for automatic starting (init/cron/at) of STunnel without having it prompt for the passphrase. > $ openssl rsa -in source.pem -out target.pem >-----Original Message----- >From: stunnel-users [mailto:[email protected]] On Behalf Of Ben Stover >Sent: Friday, October 18, 2013 3:21 AM >To: Stunnel Users >Subject: [stunnel-users] Which X.509 certificate types (.crt, .pem, .der .p7c) possible for stunnel and how to import them? >Which X.509 certificate types (e.g. .crt, .pem, .der .p7c) are possible for stunnel? >Assume I have got such a certificate as separate file (and not retrieved by OpenSSL). >How do I import it into stunnel? >Do I have to just copy it into (which ?) directory? >Does the certifcate file name have to have a certain pattern? >Or is stunnel smart enough to read and analyze the content independently from filename? >Thank you >Ben >_______________________________________________ >stunnel-users mailing list >stunnel-users(a)stunnel.org >https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Which X.509 certificate types (.crt, .pem, .der .p7c) possible for stunnel and how to import them?
by Ben Stover 18 Oct '13

18 Oct '13

Which X.509 certificate types (e.g. .crt, .pem, .der .p7c) are possible for stunnel? Assume I have got such a certificate as separate file (and not retrieved by OpenSSL). How do I import it into stunnel? Do I have to just copy it into (which ?) directory? Does the certifcate file name have to have a certain pattern? Or is stunnel smart enough to read and analyze the content independently from filename? Thank you Ben

2 1

How to setup most detailed error log (for one service?
by Ben Stover 17 Oct '13

17 Oct '13

currently I have specified in *.conf file debug = 7 Is this the most detailed log output possible? I miss somehow the transfer protocol lines (what is sent and what received) How do I get this? Is it possible to setup debug = 3 as global variable and to define debug = 7 for just ONE particular service? Ben

2 1

stunnel server communicating external client IP addresses through to a TCP server for logging purposes
by Simner, John 17 Oct '13

17 Oct '13

Hi, We have recently used stunnel on the phone as a server to encrypt the communication between an external client and a TCP server on the phone. There is a requirement for the phone to log every external client access. Is there any way for stunnel to include the IP address of the external client when setting up an new TCP connection to the local TCP server? Thank you for your assistance and I look forward to your responses. Thanks.. John John Simner BSc(Hons) MSc CEng. MIET Software Engineer Unify Enterprise Communications Ltd. Devices Development K Block, Technology Drive, Beeston, Nottingham, NG9 1LA Tel.: +44 (0) 19088 17378 Email: john.simner(a)unify.com <mailto:[email protected]> www.unify.co.uk<http://www.unify.co.uk/> Follow us: [Social_media_icons] <http://www.unify.com/social-media> Unify Enterprise Communications Limited. Registered Office: Brickhill Street, Willen Lake, Milton Keynes, MK15 0DJ Registered No: 5903714, England. This email contains confidential information and is for the exclusive use of the addressee. If you are not the addressee then any distribution, copying, or use of this email is prohibited. If received in error, please advise the sender and delete immediately. We accept no liability for any loss or damage suffered by any person arising from use of this email.

2 1

How to get the remote mail server certificate before/at first connect?
by Ben Stover 17 Oct '13

17 Oct '13

When I connect from my local mail client (e.g. Thunderbird) the first time (!) with a remote mail server through STARTTLS for a SMTP session then at first a server certificate is delivered. On the Thunderbird email client side a popup appears which prompts me to confirm the remote server certificate. Only AFTER this confirmation I am able to send email through this STARTTLS SMTP connection. Ok. Now lets switch to another scenario where a non-default email client (=NOT Thunderbird) want to send emails through stunnel to the remote mail server. Everything is setup in stunnel.conf and propriatary email client. But how do I get the remote server certificate (for stunnel)? Is there an option in stunnel.conf to receive and auto-accept the delivered server certificate at first? Where is it stored? Can I extract certificate from Thunderbird and import it to stunnel? Ben

2 1

Re: [stunnel-users] EXTERNAL: How to setup stunnel für SMTP over STARTTL S (and not pure SSL)?
by Bucci, David G 16 Oct '13

16 Oct '13

The protocol directive determines what Stunnel does during the connection setup. "protocol = smtp" tells Stunnel to use STARTTLS semantics for the connection to the server, as described in RFC2487 (similarly to how "protocol = imap" tells it to use STARTTLS for IMAP, per RFC 2595). -----Original Message----- From: Ben Stover [mailto:[email protected]] Sent: Wednesday, October 16, 2013 11:08 AM To: Stunnel Users Cc: Bucci, David G Subject: RE: EXTERNAL: How to setup stunnel für SMTP over STARTTL S (and not pure SSL)? Sorry, I went to the webpage with the link you mentioned. There I searched for STARTTLS but NO (!) occurence was found. What does protocol (here = smtp) to do with the security handshare type (here = STARTTLS). On Wed, 16 Oct 2013 13:10:29 +0000, Bucci, David G wrote: >Oh, meant to add - look at the "protocol" option, documented here: http://www.stunnel.org/static/stunnel.html >-----Original Message----- >From: Bucci, David G >Sent: Wednesday, October 16, 2013 8:54 AM >To: 'Ben Stover'; Stunnel Users >Subject: RE: EXTERNAL: How to setup stunnel für SMTP over STARTTLS (and not pure SSL)? >https://www.stunnel.org/pipermail/stunnel-users/2011-April/003060.html >Yes, it's supported. (you'll get a cert error on that connect, ironically) >-----Original Message----- >From: stunnel-users [mailto:[email protected]] On Behalf Of Ben Stover >Sent: Wednesday, October 16, 2013 5:56 AM >To: Stunnel Users >Subject: EXTERNAL: How to setup stunnel für SMTP over STARTTLS (and not pure SSL)? >Assume my mailbox provider offers only SMTP delivery over STARTTLS (and not pure SSL). >How do I have configure stunnel to cope with this protocol? >Lets say the remote smtp server would be >smtp.foobar.com:587 >How would a service section in conf file look like? >Thank you >Ben >_______________________________________________ >stunnel-users mailing list >stunnel-users(a)stunnel.org >https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] EXTERNAL: How to setup stunnel für SMTP over STARTTL S (and not pure SSL)?
by Michal Trojnara 16 Oct '13

16 Oct '13

On 10/16/2013 05:07 PM, Ben Stover wrote: > Sorry, I went to the webpage with the link you mentioned. > There I searched for STARTTLS but NO (!) occurence was found. This is because STARTTLS is not a separate protocol, but rather an option (usually an extension) of various protocols that can negotiate SSL/TLS encryption. http://en.wikipedia.org/wiki/STARTTLS Mike

2 1

Re: [stunnel-users] EXTERNAL: How to setup stunnel für SMTP over STARTTLS (and not pure SSL)?
by Bucci, David G 16 Oct '13

16 Oct '13

https://www.stunnel.org/pipermail/stunnel-users/2011-April/003060.html Yes, it's supported. (you'll get a cert error on that connect, ironically) -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Ben Stover Sent: Wednesday, October 16, 2013 5:56 AM To: Stunnel Users Subject: EXTERNAL: How to setup stunnel für SMTP over STARTTLS (and not pure SSL)? Assume my mailbox provider offers only SMTP delivery over STARTTLS (and not pure SSL). How do I have configure stunnel to cope with this protocol? Lets say the remote smtp server would be smtp.foobar.com:587 How would a service section in conf file look like? Thank you Ben _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 1

Disable support for insecure SSLv2 protocol but allow for ONE service
by Ben Stover 16 Oct '13

16 Oct '13

When I try to connect to one of my mailboxes I get a return: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket What does that mean? in stunnel.conf I set the global parameter: options = NO_SSLv2 This works in general. But for the mentioned email provider it could mean that he allows only SSLv2. Is this the reason? Where is described what is inscure at SSLv2? How can I allow for that particular email provider SSLv2 but disallow for all others? Ben

4 3

Writing "hello" to log window when entering a certain service section?
by Ben Stover 15 Oct '13

15 Oct '13

Assume an (unknown) client on my computer connects through stunnel to a remote server. As soon as this local client connects local stunnel the stunnel should write a user specified string line to the log window (if possible in bold letters). Can I define this with a syntax similar to: [gmail-pop3] client = yes output = "hello outgoing alert gmail port 1109" accept = 127.0.0.1:1109 connect = pop.gmail.com:995 Thank you Peter

2 1

An issue with chroot, mail.pem and OmniOS/illumos (SunOS)
by Olaf Marzocchi 13 Oct '13

13 Oct '13

Dear all, I have been trying to set up stunnel to encrypt a SMTP connection. The config of the encryption should be fine, I used it already on another OS, but I cannot get stunnel to start on my home server, based on OmniOS (kernel illumos), identified as "SunOS". This is my config: ---- chroot = /opt/omni/var/lib/stunnel/ ; Chroot jail can be escaped if setuid option is not used setuid = nobody setgid = nogroup ;pid = /opt/omni/var/lib/stunnel/stunnel.pid ; Certificate/key is needed in server mode and optional in client mode cert = /opt/omni/etc/stunnel/mail.pem ;key = /opt/omni/etc/stunnel/mail.pem [smtp-tls-wrapper] accept = localhost:11125 client = yes connect = ssl0.ovh.net:465 ;delay = yes ---- and the directories mentioned have the following permissions: ---- OmniOS-Xeon:~ $ ls -al /opt/omni/etc/stunnel/ total 28 drwxr-xr-x 2 root bin 5 Sep 24 23:26 . drwxr-xr-x 5 root bin 6 Sep 23 23:53 .. -rw------- 1 root bin 3050 Sep 24 23:25 mail.pem -rw-r--r-- 1 stunnel stunnel 3247 Oct 13 22:56 stunnel.conf -rw-r--r-- 1 root bin 2997 Sep 23 23:53 stunnel.conf-sample OmniOS-Xeon:~ $ ls -al /opt/omni/var/lib/ total 9 drwxr-xr-x 3 root bin 3 Sep 23 23:53 . drwxr-xr-x 4 root bin 4 Sep 23 23:53 .. drwx------ 2 stunnel stunnel 2 Sep 23 23:53 stunnel ---- The service is started from the SMF facility provided by Solaris/OmniOS/... that launches as root/root the following: /opt/omni/bin/stunnel /opt/omni/etc/stunnel/stunnel.conf On execution I get the following error message: … Initializing service section [smtp-tls-wrapper] Certificate: /opt/omni/etc/stunnel/mail.pem Error reading certificate file: /opt/omni/etc/stunnel/mail.pem error queue: 140DC002: error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib error queue: 20074002: error:20074002:BIO routines:FILE_CTRL:system lib SSL_CTX_use_certificate_chain_file: 200100D: error:0200100D:system library:fopen:Permission denied str_stats: 9 block(s), 1032 data byte(s), 522 control byte(s) … I must be overlooking something but I cannot see my mistake. Could you please help me? Thank you very much in advance! Olaf Marzocchi

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users