- stunnel-users - stunnel.org

stunnel x forwarded not working
by Libindas 05 Nov '13

05 Nov '13

Hi all, We are facing problem with stunnel + HAproxy + Tomcat Client -----> Stunnel-----> HAProxy----> Tomcat { I need get client IP in Tomcat Servers} I have compiled(stunnel-4.32 + stunnel-4.32-xforwarded-for.diff) and installed but not working. Really appreciate your help Thanks Libin

2 1

Trouble sending email via smtp with a particular gmail address
by Brian Morgan 01 Nov '13

01 Nov '13

I'm having trouble sending email through stunnel with our customer service email address. We use google premium services for our hosted email. I can send through stunnel using my own personal account, but when I switch to the cust service account, I get the error: "Failed to send an E-mail through the specified SMTP server [127.0.0.1]: The SMTP server requires a secure connection or the client was not authenticated. The server response was 5.5.1 Authentication Required." And yes, I double/triple checked credentials and can login through the gmail interface with them just fine. I also tried changing the password to a strong password which did not help. gmail settings in stunnel.conf: [gmail-smtp] client = yes accept = 127.0.0.1:259 connect = smtp.gmail.com:465 I also tried port 587 but that produces another error: "Failed to send an E-mail through the specified SMTP server [127.0.0.1]: Failure sending mail." Any ideas?

2 4

Clear LogWindow without Restart stunnel possible?
by Ben Stover 01 Nov '13

01 Nov '13

Can I somehow clear the current LogWindows WITHOUT exit+restarting stunnel?

2 1

Question Regarding Client Installer
by Andrew Smith 29 Oct '13

29 Oct '13

We currently use Stunnel to allow our clients to connect to their Databases that are hosted by us. I think this product is great. However, I am a newbie to Stunnel as our previous resource has passed away. What I would like to know now to do is create an installer for clients machines that have the correct configuration files in etc... I am sure this is pretty easy and I will be able to do it this once I am guided in the correct direction. Thanks in advance! ________________________________ Andrew Smith Support Technical Services Analyst P: 614-875-4910 x109 F: 614-875-4088 E: andrew.smith(a)harriscomputer.com [http://www.harriscomputer.com/images/signatures/HarrisSchools.jpg] [http://www.harriscomputer.com/images/signatures/DivisionofHarris.gif]<http://www.harriscomputer.com/> 6110 Enterprise Parkway Grove City, OH 43123 www.harris-schoolsolutions.com<http://www.harris-schoolsolutions.com> This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.

2 1

Re: [stunnel-users] Is it usual/recommended to have key and cert in ONE stunnel.pem file?
by Ben Stover 29 Oct '13

29 Oct '13

Hello John, thank you for your clarification. Two more additional questions: According to stunnel guide I created a cert + key with the following command: openssl.exe req -new -x509 -days 3650 -nodes -config stunnel.cnf -out stunnelcert.pem -keyout stunnelkey.pem 1.) For what do I need here the -config stunnel.cnf parameter? I am prompted by openssl for the content values during generation anyway. Can stunnel.cnf be seen only as a default value pattern for the created cert during generation? Can I omit this parameter? 2.) After creation of cert+key I have to specify them (as client) in stunnel.conf (with "o") as follows: cert = stunnelcert.pem key = stunnelkey.pem Is this sufficient? Thank you Ben On Mon, Oct 28, 2013 at 06:39:15PM +0100, Ben Stover wrote: > According to some tutorial pages I generated with OpenSSL a (selfsigned) certificate. > > This file stunnel.pem contains the certifictae as well as the private key. > > Is this usual/recommended? Hello John, That sort of falls into the "tragedy waiting to happen" category. The certificate is supposed to be given to clients, and the key belongs to the server and has to be kept private or there's really no point in using SSL. > Or should user put these two parts in two independent files? Yes, absolutely. In fact I suppose you're using Windows or went through some hoop-jumping to combine them, because in "normal" OpenSSL usage the key is generated first and then the certs are requested and signed by the CA (or selfsigning) key. /jl

2 1

VPAT Section 508 Compliance
by Tracy Drake - QI-C 28 Oct '13

28 Oct '13

Hello Stunnel Support! I am seeking a VPAT showing the level Sec 508 compliance so that we can move toward making Stunnel a GSA-approved software. I guess the biggest question is whether or not Stunnel is considered to be section 508 compliant. Please advise as to where/how I can obtain this information. -- Tracy Drake CSM Senior Consultant GSA-FAS FAME Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

1 0

Is it usual/recommended to have key and cert in ONE stunnel.pem file?
by Ben Stover 28 Oct '13

28 Oct '13

According to some tutorial pages I generated with OpenSSL a (selfsigned) certificate. This file stunnel.pem contains the certifictae as well as the private key. Is this usual/recommended? Or should user put these two parts in two independent files? Ben

2 1

Is "fips=no" recommended?
by Ben Stover 25 Oct '13

25 Oct '13

I stunnel.conf there is a parameter fips=no which is currently commented out here. Is it (resp. when is it) recommended to activate this parameter? Ben

2 1

Verify = 4 Fails Yet Again
by Thomas Eifert 25 Oct '13

25 Oct '13

I've just encountered another situation in which verify = 4 fails on a seemingly valid certificate. Since I've previously posted details regarding this issue, I'm only going to post the certificate here. This is the 3rd certificate I've run across in the past 6 months that fails to verify. Can all 3 of the certificates be faulty, or is there an issue with Stunnel or OpenSSL here? Thomas -----BEGIN CERTIFICATE----- MIIGyTCCBbGgAwIBAgIQC0NHQrtbGPWbZINtfJec1jANBgkqhkiG9w0BAQUFADBm MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5j ZSBDQS0zMB4XDTEzMDYwMzAwMDAwMFoXDTE2MDgxMDEyMDAwMFowgYQxCzAJBgNV BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRIwEAYDVQQHEwlFc2NvbmRpZG8x JjAkBgNVBAoTHUZvcnRlIEludGVybmV0IFNvZnR3YXJlLCBJbmMuMQswCQYDVQQL EwJJVDEXMBUGA1UEAwwOKi5mb3J0ZWluYy5jb20wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDZ8XZFzc6kdJt8WMByc4VPw7Ru4JZ6P+AyZXcLNA/hSih0 Xes5fGjw7oBTyUJWic/FIe397AKkjM8WGtH70EnOv3BzAHzv5ftdhG6UskJmZV7K pokKao+M6AtL0yLyXTDXXF0c7dcUwmQ9lu2LIvyqMCo5RNjaNHPoG+pqxXSN4mSj kSxUsW62p6+qE+uJGBP9HW14DGzE+OBUfB/noC63qMWjYIOWmRX/rIC8H6NyFBWl K0X0yUkxbkc5o/f9DiChCCvzK7RUIiZfDxBKKQ4VZq8+cIHIhHzbziDj2J7Twj2b VeL052E7EjTxRvYIEkyaU2JIbvcLKDzJ1H5vHxpTAgMBAAGjggNSMIIDTjAfBgNV HSMEGDAWgBRQ6nOJ2yn7EI+e5QEg1N55mUiD9zAdBgNVHQ4EFgQUwgLEas/pP7rM UfpMXPrkHEg4SWcwJwYDVR0RBCAwHoIOKi5mb3J0ZWluYy5jb22CDGZvcnRlaW5j LmNvbTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF BwMCMGEGA1UdHwRaMFgwKqAooCaGJGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9j YTMtZzIyLmNybDAqoCigJoYkaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL2NhMy1n MjIuY3JsMIIBxAYDVR0gBIIBuzCCAbcwggGzBglghkgBhv1sAQEwggGkMDoGCCsG AQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9zc2wtY3BzLXJlcG9zaXRv cnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUAcwBlACAAbwBm ACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMAdABp AHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAg AEQAaQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAg AFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAg AHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBu AGQAIABhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBp AG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMHsGCCsGAQUFBwEBBG8wbTAk BggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEUGCCsGAQUFBzAC hjlodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJh bmNlQ0EtMy5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAfaQd sAZueUdpTa/3TBpGPlKRiirlATk4kLgpk08R73hEsbA3LICRA5RbfvBGZ56031Hh rxzU8ZhI8q4kKiLbYawpRw9bzxlX35GW5MwuZiQTY0eL45V2L17Ya+Qi1+zYSAvA ZrkC2IGXUuV+sup+WQ8nx+A+HE0aGBWwCoza8qbrbFc86DrPKaGBqyanSSNQBDOg Jzojg6do31qnrDOc/Sg9fckSOtBTFO3Dqgyv0UiaaimcQE3OOqEeianQ7REE2XIX 96d2iRp5fVxMjx9SCfaD31DIogTbYmrw7+3KEPgU8QNn1RAzjPUkSZxvcO8X/Xue vw2kqH9uZ7dlx7c6CA== -----END CERTIFICATE----- -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 10

Transparent Proxy Source on HPUX 11i
by Jeremy Brock 24 Oct '13

24 Oct '13

Hi All, Are there any plans to make Transparent Mode possible on HPUX? 2013.10.22 16:24:22 LOG5[3607:1]: stunnel 4.56 on ia64-hp-hpux11.23 platform 2013.10.22 16:24:22 LOG5[3607:1]: Compiled/running with OpenSSL 0.9.8y 5 Feb 2013 2013.10.22 16:24:22 LOG5[3607:1]: Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP 2013.10.22 16:24:22 LOG5[3607:1]: Reading configuration from file /ASKPLUS/stunnel/stunnel.conf 2013.10.22 16:24:22 LOG5[3607:1]: Configuration successful 2013.10.22 16:24:47 LOG5[3608:2]: Service [ vsrvtcp ] accepted connection from 192.168.15.6:1169 *2013.10.22 16:24:47 LOG3[3608:2]: Transparent proxy in remote mode is not supported on this platform* 2013.10.22 16:24:47 LOG5[3608:2]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket ~Jeremy -- Jeremy Brock Vital Soft, Inc www.vital-soft.com

2 1

Stunnel Service as other user
by Florian Götz 24 Oct '13

24 Oct '13

Hi Stunnel users, if I use xinetd to start a service I got the possibility to start the service with a dedicated user. For example: service fex { socket_type = stream wait = no type = unlisted protocol = tcp bind = 123.12.1.12 port = 80 cps = 10 2 * user = fex groups = yes server = /home/fex/bin/fexsrv nice = 0 disable = no } I got some kind of webserver (not apache, nginx etc) that needs to be started with xinetd (the example above). This server should get a SSL tunnel. If I use Stunnel in daemon mode (without jails/chroot) and define a service like this: [https] accept = 123.12.1.12:443 exec = /home/fex/bin/fexsrv execargs = fexsrv stunnel TIMEOUTclose = 2 Everything works fine, except that the server now runs as root. Is there a possibility to set a user for a service? Best regards Florian Götz -- Mit freundlichen Grüßen Florian Götz ----------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6232 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

2 1

Username and Password in Clear Text
by Peter K. O'Connor 24 Oct '13

24 Oct '13

Hi, I am using stunnel 4.56 Windows verison. I thought the username and password will *only* be sent to SERVER2, *after* the SSL handshake, with each request. However, the truth is that the Proxy-Authorization header is attached to the request to SERVER1 "CONNECT SERVER2:433 HTTP/1.1", as well. So SERVER1 can see username and password. It is not necessary and safe. Am I missing anything here? Regards, Peter [stunnel] client = yes accept = 127.0.0.1:8080 connect = SERVER1:3128 protocol = connect protocolHost = SERVER2:443 protocolUsername = username protocolPassword = password

2 1

Re: [stunnel-users] Which X.509 certificate types (.crt, .pem, .der .p7c) possible for stunnel and how to import them?
by Ben Stover 24 Oct '13

24 Oct '13

Assume I have already an *.pem cert (for SMTP over STARTTLS transfer). Where (in whcih directory) should I put this cert file? Ben On Fri, 18 Oct 2013 12:35:25 +0000, Eckert, Doug wrote: >You can use OpenSSL to convert between formats (to .pem for STunnel) >https://support.ssl.com/Knowledgebase/Article/View/19/0/der-vs-crt-vs-cer-v… >You can also use openssl to strip the key's passphrase. This is handy for automatic starting (init/cron/at) of STunnel without having it prompt for the passphrase. > $ openssl rsa -in source.pem -out target.pem >-----Original Message----- >From: stunnel-users [mailto:[email protected]] On Behalf Of Ben Stover >Sent: Friday, October 18, 2013 3:21 AM >To: Stunnel Users >Subject: [stunnel-users] Which X.509 certificate types (.crt, .pem, .der .p7c) possible for stunnel and how to import them? >Which X.509 certificate types (e.g. .crt, .pem, .der .p7c) are possible for stunnel? >Assume I have got such a certificate as separate file (and not retrieved by OpenSSL). >How do I import it into stunnel? >Do I have to just copy it into (which ?) directory? >Does the certifcate file name have to have a certain pattern? >Or is stunnel smart enough to read and analyze the content independently from filename? >Thank you >Ben >_______________________________________________ >stunnel-users mailing list >stunnel-users(a)stunnel.org >https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Which X.509 certificate types (.crt, .pem, .der .p7c) possible for stunnel and how to import them?
by Ben Stover 18 Oct '13

18 Oct '13

Which X.509 certificate types (e.g. .crt, .pem, .der .p7c) are possible for stunnel? Assume I have got such a certificate as separate file (and not retrieved by OpenSSL). How do I import it into stunnel? Do I have to just copy it into (which ?) directory? Does the certifcate file name have to have a certain pattern? Or is stunnel smart enough to read and analyze the content independently from filename? Thank you Ben

2 1

How to setup most detailed error log (for one service?
by Ben Stover 17 Oct '13

17 Oct '13

currently I have specified in *.conf file debug = 7 Is this the most detailed log output possible? I miss somehow the transfer protocol lines (what is sent and what received) How do I get this? Is it possible to setup debug = 3 as global variable and to define debug = 7 for just ONE particular service? Ben

2 1

stunnel server communicating external client IP addresses through to a TCP server for logging purposes
by Simner, John 17 Oct '13

17 Oct '13

Hi, We have recently used stunnel on the phone as a server to encrypt the communication between an external client and a TCP server on the phone. There is a requirement for the phone to log every external client access. Is there any way for stunnel to include the IP address of the external client when setting up an new TCP connection to the local TCP server? Thank you for your assistance and I look forward to your responses. Thanks.. John John Simner BSc(Hons) MSc CEng. MIET Software Engineer Unify Enterprise Communications Ltd. Devices Development K Block, Technology Drive, Beeston, Nottingham, NG9 1LA Tel.: +44 (0) 19088 17378 Email: john.simner(a)unify.com <mailto:[email protected]> www.unify.co.uk<http://www.unify.co.uk/> Follow us: [Social_media_icons] <http://www.unify.com/social-media> Unify Enterprise Communications Limited. Registered Office: Brickhill Street, Willen Lake, Milton Keynes, MK15 0DJ Registered No: 5903714, England. This email contains confidential information and is for the exclusive use of the addressee. If you are not the addressee then any distribution, copying, or use of this email is prohibited. If received in error, please advise the sender and delete immediately. We accept no liability for any loss or damage suffered by any person arising from use of this email.

2 1

How to get the remote mail server certificate before/at first connect?
by Ben Stover 17 Oct '13

17 Oct '13

When I connect from my local mail client (e.g. Thunderbird) the first time (!) with a remote mail server through STARTTLS for a SMTP session then at first a server certificate is delivered. On the Thunderbird email client side a popup appears which prompts me to confirm the remote server certificate. Only AFTER this confirmation I am able to send email through this STARTTLS SMTP connection. Ok. Now lets switch to another scenario where a non-default email client (=NOT Thunderbird) want to send emails through stunnel to the remote mail server. Everything is setup in stunnel.conf and propriatary email client. But how do I get the remote server certificate (for stunnel)? Is there an option in stunnel.conf to receive and auto-accept the delivered server certificate at first? Where is it stored? Can I extract certificate from Thunderbird and import it to stunnel? Ben

2 1

Re: [stunnel-users] EXTERNAL: How to setup stunnel für SMTP over STARTTL S (and not pure SSL)?
by Bucci, David G 16 Oct '13

16 Oct '13

The protocol directive determines what Stunnel does during the connection setup. "protocol = smtp" tells Stunnel to use STARTTLS semantics for the connection to the server, as described in RFC2487 (similarly to how "protocol = imap" tells it to use STARTTLS for IMAP, per RFC 2595). -----Original Message----- From: Ben Stover [mailto:[email protected]] Sent: Wednesday, October 16, 2013 11:08 AM To: Stunnel Users Cc: Bucci, David G Subject: RE: EXTERNAL: How to setup stunnel für SMTP over STARTTL S (and not pure SSL)? Sorry, I went to the webpage with the link you mentioned. There I searched for STARTTLS but NO (!) occurence was found. What does protocol (here = smtp) to do with the security handshare type (here = STARTTLS). On Wed, 16 Oct 2013 13:10:29 +0000, Bucci, David G wrote: >Oh, meant to add - look at the "protocol" option, documented here: http://www.stunnel.org/static/stunnel.html >-----Original Message----- >From: Bucci, David G >Sent: Wednesday, October 16, 2013 8:54 AM >To: 'Ben Stover'; Stunnel Users >Subject: RE: EXTERNAL: How to setup stunnel für SMTP over STARTTLS (and not pure SSL)? >https://www.stunnel.org/pipermail/stunnel-users/2011-April/003060.html >Yes, it's supported. (you'll get a cert error on that connect, ironically) >-----Original Message----- >From: stunnel-users [mailto:[email protected]] On Behalf Of Ben Stover >Sent: Wednesday, October 16, 2013 5:56 AM >To: Stunnel Users >Subject: EXTERNAL: How to setup stunnel für SMTP over STARTTLS (and not pure SSL)? >Assume my mailbox provider offers only SMTP delivery over STARTTLS (and not pure SSL). >How do I have configure stunnel to cope with this protocol? >Lets say the remote smtp server would be >smtp.foobar.com:587 >How would a service section in conf file look like? >Thank you >Ben >_______________________________________________ >stunnel-users mailing list >stunnel-users(a)stunnel.org >https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] EXTERNAL: How to setup stunnel für SMTP over STARTTL S (and not pure SSL)?
by Michal Trojnara 16 Oct '13

16 Oct '13

On 10/16/2013 05:07 PM, Ben Stover wrote: > Sorry, I went to the webpage with the link you mentioned. > There I searched for STARTTLS but NO (!) occurence was found. This is because STARTTLS is not a separate protocol, but rather an option (usually an extension) of various protocols that can negotiate SSL/TLS encryption. http://en.wikipedia.org/wiki/STARTTLS Mike

2 1

Re: [stunnel-users] EXTERNAL: How to setup stunnel für SMTP over STARTTLS (and not pure SSL)?
by Bucci, David G 16 Oct '13

16 Oct '13

https://www.stunnel.org/pipermail/stunnel-users/2011-April/003060.html Yes, it's supported. (you'll get a cert error on that connect, ironically) -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Ben Stover Sent: Wednesday, October 16, 2013 5:56 AM To: Stunnel Users Subject: EXTERNAL: How to setup stunnel für SMTP over STARTTLS (and not pure SSL)? Assume my mailbox provider offers only SMTP delivery over STARTTLS (and not pure SSL). How do I have configure stunnel to cope with this protocol? Lets say the remote smtp server would be smtp.foobar.com:587 How would a service section in conf file look like? Thank you Ben _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 1

Disable support for insecure SSLv2 protocol but allow for ONE service
by Ben Stover 16 Oct '13

16 Oct '13

When I try to connect to one of my mailboxes I get a return: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket What does that mean? in stunnel.conf I set the global parameter: options = NO_SSLv2 This works in general. But for the mentioned email provider it could mean that he allows only SSLv2. Is this the reason? Where is described what is inscure at SSLv2? How can I allow for that particular email provider SSLv2 but disallow for all others? Ben

4 3

Writing "hello" to log window when entering a certain service section?
by Ben Stover 15 Oct '13

15 Oct '13

Assume an (unknown) client on my computer connects through stunnel to a remote server. As soon as this local client connects local stunnel the stunnel should write a user specified string line to the log window (if possible in bold letters). Can I define this with a syntax similar to: [gmail-pop3] client = yes output = "hello outgoing alert gmail port 1109" accept = 127.0.0.1:1109 connect = pop.gmail.com:995 Thank you Peter

2 1

An issue with chroot, mail.pem and OmniOS/illumos (SunOS)
by Olaf Marzocchi 13 Oct '13

13 Oct '13

Dear all, I have been trying to set up stunnel to encrypt a SMTP connection. The config of the encryption should be fine, I used it already on another OS, but I cannot get stunnel to start on my home server, based on OmniOS (kernel illumos), identified as "SunOS". This is my config: ---- chroot = /opt/omni/var/lib/stunnel/ ; Chroot jail can be escaped if setuid option is not used setuid = nobody setgid = nogroup ;pid = /opt/omni/var/lib/stunnel/stunnel.pid ; Certificate/key is needed in server mode and optional in client mode cert = /opt/omni/etc/stunnel/mail.pem ;key = /opt/omni/etc/stunnel/mail.pem [smtp-tls-wrapper] accept = localhost:11125 client = yes connect = ssl0.ovh.net:465 ;delay = yes ---- and the directories mentioned have the following permissions: ---- OmniOS-Xeon:~ $ ls -al /opt/omni/etc/stunnel/ total 28 drwxr-xr-x 2 root bin 5 Sep 24 23:26 . drwxr-xr-x 5 root bin 6 Sep 23 23:53 .. -rw------- 1 root bin 3050 Sep 24 23:25 mail.pem -rw-r--r-- 1 stunnel stunnel 3247 Oct 13 22:56 stunnel.conf -rw-r--r-- 1 root bin 2997 Sep 23 23:53 stunnel.conf-sample OmniOS-Xeon:~ $ ls -al /opt/omni/var/lib/ total 9 drwxr-xr-x 3 root bin 3 Sep 23 23:53 . drwxr-xr-x 4 root bin 4 Sep 23 23:53 .. drwx------ 2 stunnel stunnel 2 Sep 23 23:53 stunnel ---- The service is started from the SMF facility provided by Solaris/OmniOS/... that launches as root/root the following: /opt/omni/bin/stunnel /opt/omni/etc/stunnel/stunnel.conf On execution I get the following error message: … Initializing service section [smtp-tls-wrapper] Certificate: /opt/omni/etc/stunnel/mail.pem Error reading certificate file: /opt/omni/etc/stunnel/mail.pem error queue: 140DC002: error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib error queue: 20074002: error:20074002:BIO routines:FILE_CTRL:system lib SSL_CTX_use_certificate_chain_file: 200100D: error:0200100D:system library:fopen:Permission denied str_stats: 9 block(s), 1032 data byte(s), 522 control byte(s) … I must be overlooking something but I cannot see my mistake. Could you please help me? Thank you very much in advance! Olaf Marzocchi

1 0

stunnel behind http proxy server, only working for port 443
by Heng Su 09 Oct '13

09 Oct '13

Hi All, I try to connect to my stunnel server, however, only port 443 is working. For other ports are not working. Does it mean my company's proxy server is blocking SSL communication on all ports except 443? ( I am a newbie, just assuming stunnel always working with SSL even for 80 port, if I am wrong please point me out, thank you) Is there any other way to bypass the proxy server without SSL communication? Or internal proxy server can always detect tunnel actions if there is non-SSL protocol ? below is my configuration file for client side. /etc/stunnel/stunnel.conf ------------------START-------------------------- [https1] accept = 80 protocol = connect protocolAuthentication = basic protocolHost = myvpsserver-ip:80 protocolUsername = myname protocolPassword = p@ssw0rd connect = company-proxyserver:8080 [https2] accept = 443 protocol = connect protocolAuthentication = basic protocolHost = myvpsserver-ip:443 protocolUsername = myname protocolPassword = p@ssw0rd connect = company-proxyserver:8080 ----------------------------END--------------------------------------------- ---------------------------Tunnel PORT 80 ----------------------------- 2013.10.08 14:18:43 LOG7[10601:3078687600]: TCP_NODELAY option set on remote socket 2013.10.08 14:18:43 LOG5[10601:3078687600]: Negotiations for connect (client side) started 2013.10.08 14:18:43 LOG7[10601:3078687600]: -> CONNECT my-remote-server-ip:80 HTTP/1.1 2013.10.08 14:18:43 LOG7[10601:3078687600]: -> Host: my-remote-server-ip:80 2013.10.08 14:18:43 LOG7[10601:3078687600]: -> Proxy-Authorization: basic c3VoZW5nOlBAc3N3MHJk 2013.10.08 14:18:43 LOG7[10601:3078687600]: -> 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- HTTP/1.1 403 Forbidden 2013.10.08 14:18:43 LOG3[10601:3078687600]: CONNECT request rejected 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- Cache-Control: no-cache 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- Pragma: no-cache 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- Content-Type: text/html; charset=utf-8 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- Proxy-Connection: close 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- Connection: close 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- Content-Length: 725 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- 2013.10.08 14:18:43 LOG5[10601:3078687600]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket ---------------------------Tunnel PORT 443 ----------------------------- 2013.10.08 14:42:00 LOG7[10601:3078687600]: TCP_NODELAY option set on remote socket 2013.10.08 14:42:00 LOG5[10601:3078687600]: Negotiations for connect (client side) started 2013.10.08 14:42:00 LOG7[10601:3078687600]: -> CONNECT my-remote-server-ip:443 HTTP/1.1 2013.10.08 14:42:00 LOG7[10601:3078687600]: -> Host: my-remote-server-ip:443 2013.10.08 14:42:00 LOG7[10601:3078687600]: -> Proxy-Authorization: basic c3VoZW5nOlBAc3N3MHJk 2013.10.08 14:42:00 LOG7[10601:3078687600]: -> 2013.10.08 14:42:00 LOG7[10601:3078687600]: <- HTTP/1.1 200 Connection established 2013.10.08 14:42:00 LOG6[10601:3078687600]: CONNECT request accepted 2013.10.08 14:42:00 LOG7[10601:3078687600]: <- 2013.10.08 14:42:00 LOG5[10601:3078687600]: Protocol negotiations succeeded -- Thanks & Best Regards, Su Heng

2 2

Stunnel North American FTP Down?
by Thomas Eifert 07 Oct '13

07 Oct '13

This evening, I'm unable to access the North American Stunnel FTP site. If I go in with Filezilla in passive mode, I can do a directory listing, but the directory is empty. If I use the browser by clicking on the FTP link on the stunnel web page, I get an error 550 Failed to change directory. I was able to access the European site, however. Enjoy the day. -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 2

IP Address on hte Destination
by Stewart Anderson 03 Oct '13

03 Oct '13

Hi, When a source address connects to a remote destination, via stunnel, what IP address is visible to the destination as the source address? The address of the source or the host where stunnel is running? I see some settings for transparency but I just have a plain connect= for my services. My source and stunnel are on different servers. Cheers Stu This message is confidential. It may also contain privileged information. The contents of this e-mail and any attachments are intended for the named addressee only. Unless you are the named addressee or authorised to receive the e-mail of the named addressee you may not disclose, use or copy the contents of the e-mail. If you are not the person for whom the message was intended, please notify the sender immediately at Bradford Teaching Hospitals NHS Foundation Trust and delete the material from your computer. You must not use the message for any other purpose, nor disclose its contents to any person other than the intended recipient. Bradford Teaching Hospitals NHS Foundation Trust does not accept responsibility for this message and any views or opinions contained in this e-mail are solely those of the author unless expressly stated otherwise.

1 0

Issue with TCPmon and Stunnel
by Odays 01 Oct '13

01 Oct '13

Hi all. I need to configure TCPMon+Stunnel to capture the request/response message in the communication with a web services using https. So I download stunnel-4.56-installer.exe and install it. In TCPMon I put that it listen in port 7777 and redirect to port 1234. In Stunnel I put this configuration: client=yes verify=0 [my-https] accept = 127.0.0.1:1234 connect = webservices_server:443 TIMEOUTclose = 0 When i run the scenario I see this log: 2013.09.30 16:12:57 LOG7[8612:6032]: Service [my-https] started 2013.09.30 16:12:57 LOG5[8612:6032]: Service [my-https] accepted connection from 127.0.0.1:51759 2013.09.30 16:12:57 LOG7[8612:6032]: SSL state (accept): before/accept initialization *2013.09.30 16:12:57 LOG3[8612:6032]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request* 2013.09.30 16:12:57 LOG5[8612:6032]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.09.30 16:12:57 LOG7[8612:6032]: Local socket (FD=448) closed 2013.09.30 16:12:57 LOG7[8612:6032]: Service [my-https] finished (0 left) Any idea about this error? Thanks. -- Este mensaje le ha llegado mediante el servicio de correo electronico que ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema Nacional de Salud. La persona que envia este correo asume el compromiso de usar el servicio a tales fines y cumplir con las regulaciones establecidas Infomed: http://www.sld.cu/

3 2

Generic/general mechanism to forward mail servername, login, port from client to stunnel
by Ben Stover 27 Sep '13

27 Sep '13

Refering to my last posting I want to ask a related question: I read in the past somewhere that I can access stunnel from my local email client in more generic way: At first: stunnel always listens AUTOMATICALLY by default on port 127.0.0.1:9999 für incoming request and forwards the prepared/modified request to the outside world. The core parameter are NOT specified in the .conf file but by the User ID which is passed by the local client to local stunnel service. The syntax is as follows: userid=<servername>/<remotes-ssl-tls-port>/<loginname> Example: userid=pop.mail.yahoo.com/995/myname123 So as soon as stunnel receives at 127.0.0.1:9999 an incoming local connect he accepts the following userid string and tokenize it into the three parts. Given these three tokens stunnel is able to connect in the second step the remote mail server WITHOUT any further need of specification in the .conf file. Do I remember this correct? Is this mechanism described somewhere in detail? Thank you Ben

1 0

PATCH: multiple SNI options per slave section
by David Owen 27 Sep '13

27 Sep '13

Hello and thank you for stunnel! After switching from my web-server's built-in SSL support, I now have a much more secure system and SNI, too! In stunnel(8), I read this about the sni option: "sni option can also be specified more than once within a single slave service." However, I couldn't get it to work, and reading the source code verified that only one sni option is tracked per section. So, I present my patch to allow multiple sni options. It enables configurations like these: [https] ... [group1] sni = https:a.example.org sni = https:b.example.org ... [group2] sni = https:c.example.org sni = https:d.example.org ... If you have a naming scheme that doesn't lend itself to the wildcard matching already supported, this can cut your config size quite a bit. DETAILS The sni option for any section was originally tracked in the section->sni member (a string). Now, a linked-list of sni options is added to the section structure, with every sni option being appended to the end. For server setup, each slave section walks over its list, splitting each sni option and adding that slave section to the master's slave list. Splitting options and adding slaves to masters works as before, but now the slave section iterates over a list instead of referencing a single string. For client setup, each slave section checks that it has either no sni options, or exactly one. Multiple sni options results in an error. If exactly one option is found, it is copied to the old sni field of the section struct. The old sni field has been renamed to servername_to_request, as it is now used only in client mode, and this makes its purpose more clear. When no sni option is found, servername_to_request is initialized from the protocolHost or connect options, as before. I hope this patch is useful to others. Please let me know how I can make it acceptable for inclusing in the stunnel distribution. Thanks, David

1 0

Proxy HTTPS via stunnel without any certificates on proxy/stunnel box
by Gary Chodos 25 Sep '13

25 Sep '13

Greetings, We are trying to decide between SNIProxy and stunnel for the following task: - Client browser hits https://foo.bar.org, which resolves to an IP that corresponds to the stunnel machine listening on 443. - stunnel "forwards" (sorry if this is not the correct technical term) the connection to a different machine, specified by a different IP address, which is also configured to believe it is foo.bar.org and actually has a web server listening on 443 and houses the SSL key/cert. - when stunnel hits the end server, the latter sees the stunnel IP address as source, not the original user's (who initiated the web request for https://foo.bar.org) I believe this is default behavior, but just noting it for completeness. Is it possible to accomplish this (stunnel listening on and connecting to https endpoints) without housing any certs/keys on the stunnel machine itself, because we want the second server to deal with all that and we do not have access to those keys anyway. And of course, the users which go to the https://foo.bar.org should not see any cert mismatches as a result of loading https://foo.bar.org which, for the user, will resolve to the stunnel/proxy IP, rather than the end server which actually had a running web server and keys/cert. Sorry if the above detail is insufficient; do let me know. Thanks for your help. Gary

2 2

Port assignment in .conf file for local email client unique?
by Ben Stover 25 Sep '13

25 Sep '13

Assume I want to connect from my local email client to two (!) remote email servers The corresponding instructions in .conf file looks like (my guess): [smtps-firstacct] accept = 127.0.0.1:259 connect = smtps.myisp1.com:465 [smtps-secondacct] accept = 127.0.0.1:259 connect = smtps.myisp2.com:465 Questions: 1.) a configuration like above with the same "accept" port 259 is NOT possible because stunnel does not know to which remote email server he has to connect. To distinguish two different remote email server I always have to select TWO different accept-ports like [smtps-firstacct] accept = 127.0.0.1:259 connect = smtps.myisp1.com:465 [smtps-secondacct] accept = 127.0.0.1:258 connect = smtps.myisp2.com:465 Correct? 2.) Can I use arbitrary accept-ports like 1242 or 23199 or is there a port range from I have to select one? 3.) Moreover assume I want to make the SSL connection transparent can I select an accept-port 25? 4.) I read somewhere that I have always to specify in email client for POP3/SMTP an address 127.0.0.1:9999 and NOT 127.0.0.1:259 in order to connect to local stunnel service. Because local stunnel service is always listening on port 9999. Is this correct? Thank you Ben

2 2

One "client=yes" instruction per .conf file sufficient?
by Ben Stover 25 Sep '13

25 Sep '13

Is one client=yes instruction line per conf file enough? Does is mean all instructions in current .conf file belong to a client configuration or does it mean only the following command (=lines below) are intended for client usage? Ben

2 1

postgres protocol
by Robert Bernier 21 Sep '13

21 Sep '13

Hi, I've been looking at using stunnel connecting it directly to postgres. As per the man page, https://www.stunnel.org/static/stunnel.html, I was able to get postgres version 8.3 working. However, I've not suceeded using postgres version 9.2. Any insights would be appreciated. Thanks -- Robert Bernier PostgreSQL Business Intelligence Analyst robert7390(a)comcast.net http://www.linkedin.com/pub/robert-bernier/69/6a6/921 http://beknown.com/robert-bernier

1 0

Difference between verify=2, 3 and 4
by Nikolaus Rath 20 Sep '13

20 Sep '13

Hello, Thanks for writing stunnel, it looks like a great tool! I have, however, a really hard time understanding the difference between verify=2,3 and 4. In the manpage, I found verify = level verify peer certificate level 0 - request and ignore peer certificate level 1 - verify peer certificate if present level 2 - verify peer certificate level 3 - verify peer with locally installed certificate level 4 - ignore CA chain and only verify peer certificate default - no verify Levels 0-2 seem pretty clear cut, but then it becomes confusing for me. First, I do not understand how level 3 differs from level2. What does "against a locally installed certificate" mean? It seems to me that I certainly need to have a local copy of the trusted CAs even in level 2 -- at least I hope that they aren't somehow build in to stunnel. But there is also just one CApath option, so will that be used for level 2 or level 3? For level 4, the "ignore the CA chain" path is fine -- but where do I put the peer certificates that I'm willing to accept? CApath seems wrong, but cert is already used for the server's own certificate... Best, -Nikolaus -- »Time flies like an arrow, fruit flies like a Banana.« PGP fingerprint: 5B93 61F8 4EA2 E279 ABF6 02CF A9AD B7F8 AE4E 425C

6 13

Looking for a tech talk speaker on Secure Networking
by Chris Westin 16 Sep '13

16 Sep '13

I organize the speakers for the SF Bay Area Large-Scale Production Engineering meetup (http://www.meetup.com/SF-Bay-Area-Large-Scale-Production-Engineering/ ; take a look at the "PAST" tab to see the kinds of events we've had). For our event on Thursday October 17, 2013, I'm looking for speakers on the topic of "Secure Networking" (event: http://www.meetup.com/SF-Bay-Area-Large-Scale-Production-Engineering/events… ). As you can see from looking at our past events, I pick a topic, and then try to get 2-3 talks on that topic. Talks are usually 20-25 minutes long. This is a technical audience, and they don't appreciate a marketing pitch. They're eager to get into the nuts and bolts of the topic, including demos, code samples, and architecture. If you're going to be in the Bay Area then, and would be interested in giving a talk, please let me know here, or (preferably) through meetup.com. Thanks, Chris Westin

1 0

Re: [stunnel-users] IRC-Reconnect failed with "[10053] Software caused connection abort"(mIRC) and "SSL_connect: Peer suddenly disconnected"(tstunnel.exe)
by ralf29587＠gmx.de 13 Sep '13

13 Sep '13

Could some admin please remove my uploaded VCard and either my Name or my E-Mail-Adress shown on stunnel.org ?? Thanks a million!

1 0

stunnel accept a t3 connection?
by Scott Sikorski 10 Sep '13

10 Sep '13

I am curious if stunnel can support listening for an incoming t3 connection? I am having difficulty getting t3s to work between WebSphere and WebLogic for API calls and am curious if an alternative such as stunnel will work. I have stunnel installed betwen a client and the destination host, but the client doesn't seem to want to accept a t3://127.0.0.1:14010 connection but when I change this to http://127.0.0.1:14010 it works fine. Anything you can share would be appreciated. Mostly, if it will never work, that would be nice to know as to not spend more time troubleshooting. Best Regards, Scott Sikorski scottgsikorski(a)yahoo.com

2 1

Fullduplex in stunnel
by Krzysztof Kwiatkowski 07 Sep '13

07 Sep '13

Hi, I'm planning to use stunnel to do stress testing of my application. I decided to use stunnel because I've noticed that full-duplex has been added to version 3.2 (around 1999) and my application handles high throughput. AFAIK Stunnel uses openssl. Also I know that openssl doesn't handle fullduplex traffic very well. In fact without any tricks, half-duplex is most what I could get from openssl. As the full-duplex feature has been added to stunnel in 1999 (so long time ago) can you confirm that it is still there and full-duplex is still supported? If it is a case, how it is possible that stunnel handles fullduplex? Krzysztof Kwiatkowski

2 1

IRC-Reconnect failed with "[10053] Software caused connection abort"(mIRC) and "SSL_connect: Peer suddenly disconnected"(tstunnel.exe)
by ralf29587＠gmx.de 03 Sep '13

03 Sep '13

Hi, I have a problem using stunnel with mIRC: I was using a pretty old version of stunnel.exe that was packed with a mIRC script and could be ran as a command-line-only application without a configuration file (supplying all necessary informations parameters). I know that current mIRC version have their own ssl support, but I prefer an old version without because it has much better performance. The old one was used by "stunnel.exe -c -d localhost:<localport> -r <irc-server-ip>:<irc-server-port>" in command line and "/server localhost:<localport>" in irc. A few of my servers stopped supporting an old ssl version, this old stunnel.exe is no longer compatible to the new (open)ssl dll files and so I had to upgrade to the most recent version of stunnel - and I have some problems make it run properly. Here you can see my configuration file (stunnel.conf): ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2012 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may useful for troubleshooting) ;debug = 7 ;output = stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode ;cert = stunnel.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; Example SSL server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ; Example SSL client mode services ;[gmail-pop3] ;client = yes ;accept = 127.0.0.1:110 ;connect = pop.gmail.com:995 ;[gmail-imap] ;client = yes ;accept = 127.0.0.1:143 ;connect = imap.gmail.com:993 ;[gmail-smtp] ;client = yes ;accept = 127.0.0.1:25 ;connect = smtp.gmail.com:465 ; Example SSL front-end to a web server ;[https] ;accept = 443 ;connect = 80 ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL ; Microsoft implementations do not use SSL close-notify alert and thus ; they are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; vim:ft=dosini [abjects] client = yes accept = 127.0.0.1:7001 connect = irc.abjects.net:9999 [Elite-IRC] client = yes accept = 127.0.0.1:7002 connect = SpeedSpace-IRC.eu:6697 [BodenTruppe] client = yes accept = 127.0.0.1:7003 connect = boden-truppe.zapto.org:7001 [LinkNet] client = yes accept = 127.0.0.1:7004 connect = irc.link-net.nl:7000 The first connect always works properly (as shown in the log below): 2013.09.03 12:30:45 LOG5[10696:9140]: stunnel 4.56 on x86-pc-msvc-1500 platform 2013.09.03 12:30:45 LOG5[10696:9140]: Compiled/running with OpenSSL 1.0.1e-fips11 Feb 2013 2013.09.03 12:30:45 LOG5[10696:9140]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2013.09.03 12:30:45 LOG5[10696:9140]: Reading configuration from file stunnel.conf 2013.09.03 12:30:45 LOG5[10696:9140]: FIPS mode is enabled 2013.09.03 12:30:45 LOG5[10696:9140]: Configuration successful 2013.09.03 12:30:53 LOG5[10696:10756]: Service [abjects] accepted connection from 127.0.0.1:3397 2013.09.03 12:30:53 LOG5[10696:10756]: connect_blocking: connected 188.126.73.62:9999 2013.09.03 12:30:53 LOG5[10696:10756]: Service [abjects] connected remote server from 192.168.1.10:3398 2013.09.03 12:30:54 LOG5[10696:14396]: Service [LinkNet] accepted connection from 127.0.0.1:3399 2013.09.03 12:30:54 LOG5[10696:14396]: connect_blocking: connected 194.126.217.98:7000 2013.09.03 12:30:54 LOG5[10696:14396]: Service [LinkNet] connected remote server from 192.168.1.10:3400 2013.09.03 12:30:54 LOG5[10696:2916]: Service [BodenTruppe] accepted connectionfrom 127.0.0.1:3401 2013.09.03 12:30:54 LOG5[10696:2916]: connect_blocking: connected 178.254.22.94:7001 2013.09.03 12:30:54 LOG5[10696:2916]: Service [BodenTruppe] connected remote server from 192.168.1.10:3402 2013.09.03 12:30:54 LOG5[10696:12260]: Service [Elite-IRC] accepted connection from 127.0.0.1:3403 2013.09.03 12:30:54 LOG5[10696:12260]: connect_blocking: connected 62.75.235.122:6697 2013.09.03 12:30:54 LOG5[10696:12260]: Service [Elite-IRC] connected remote server from 192.168.1.10:3404 But when I try to reconnect, it doesn't work for 2 of my 4 servers This is an example for what happens to Elite-IRC: 2013.09.03 12:32:22 LOG5[10696:12260]: Connection closed: 1972 byte(s) sent to SSL, 26903 byte(s) sent to socket 2013.09.03 12:32:23 LOG5[10696:17168]: Service [Elite-IRC] accepted connection from 127.0.0.1:3429 2013.09.03 12:32:23 LOG5[10696:17168]: connect_blocking: connected 62.75.235.122:6697 2013.09.03 12:32:23 LOG5[10696:17168]: Service [Elite-IRC] connected remote server from 192.168.1.10:3430 2013.09.03 12:32:23 LOG3[10696:17168]: SSL_connect: Peer suddenly disconnected 2013.09.03 12:32:23 LOG5[10696:17168]: Connection reset: 0 byte(s) sent to SSL,0 byte(s) sent to socket The frist line shows the manual disconnect occured by executing "/server localhost:7002" in mIRC. The second line shows the new incoming connection from my mIRC. The third line? ... I got no clue why it has to block anything. The fourth line: Successfully connected to IRC-Server? And then the fifth line occurs. I'm not sure if I interpret it right, but for some reason tstunnel.exe is kicking out my connected mIRC client which makes mIRC to tell me "[10053] Software caused connection abort". The whole lines in mIRC are: [12:34pm] * Connect retry #1 localhost (7003) ------------------------------------------------------------ [12:34pm] * [10053] Software caused connection abort ------------------------------------------------------------ [12:34pm] * Disconnected By the way, I have packed libeay32.dll, ssleay32.dll, stunnel.conf and tstunnel.exe in a subdir in mIRC directory and I'm starting it using "tstunnel.exe stunnel.conf" When this error occurs, I have to kill tstunnel.exe and start it again - then everything works fine again. For 1 of 4 servers, I also had this error with the old command-line stunnel.exe and I just wrote a script killing (only this) stunnel.exe and restarting it when this mIRC error occurs. Unfortunately this is no longer possible when tstunnel.exe is using a configuration file and one process is managing all connections. Is there any way I can fix this? (Maybe by fixing the logout of my local mIRC from my local tstunnel.exe?) Best regards

2 1

stunnel 4.56 to 4.50 on andriod
by Ronald Ning 03 Sep '13

03 Sep '13

Anyone have any luck running stunnel on android? I'm running the stock JB 4.2.2. I've tried every stunnel version from 4.50 to 4.56. When I try to run: root@andriod: /system/bin/stunnel stunnel.conf -> stunnel root@andriod: netstat -a netstat doesn't show the listening port: My stunnel.conf is this: client = yes debug = 7 [ssh] accept=2222 connect=myserver.com:22

2 1

Init script
by Alan Chester 29 Aug '13

29 Aug '13

Hello, I am currently working on using stunnel. I was wondering what everyones thoughts were on the creation of an init script for stunnel. This would help insure that the connections are brought up after a reboot. Or what is the best way to go about handling this? Thanks, Alan

2 1

no certificate available safari browser
by Scott McKeown 28 Aug '13

28 Aug '13

Hi Libin, If possible can you send over your STunnel config file but my guess would be that you would need to include your Root CA and Intermediate CA certificates into your PEM file. I would check to see what https://www.ssllabs.com/ssltest/analyze.html says about your certificates another quick test would be to have a look at http://www.digicert.com/help/ to see what they also say about the certificate chains. ~Scott Hi all, > > Sever OS: Linux/Centos 5.9 > SSLServer: Stunnel > ErrorMessage: no certificate available > CertType: SSL Web Server Certificate > Client Browser: Safari 5.1. > Client OS: OS X Lion > > When i am trying to hit the URL on safari browser it shows me the messages > "no certificate available" > No certificate meet the application . However, the same link is working > for all other browsers. Moreover, we have checked the stunnel logs, but > couldn't able to get any thing from the logs. > > Apache HTTPS config we have option *SSLVerifyClient none *in Stunnel I > have tried all option non of thing working. > * > * > Please help me.* * > > Thanks > Libin -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

3 2

stunnel 4.56 and 4.55 are not working on Android 4.3.1
by Mohsin Mirza 28 Aug '13

28 Aug '13

I tried both version of stunnel for android on Nexus 4 Build JWR66Y, Is it have to anything to do with SELinux or MAC secuirty model introduce by 4.3 It was working in initial 4.3 build OTA. root@mako:/system/bin # ./sh -c /system/xbin/stunnel root@mako:/system/bin # ________________________________________Disclaimer: This email and any attachments may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately by email and destroy this email. Any unauthorized copying, dissemination, disclosure or distribution of the material in this email is strictly forbidden. Unless expressly stated to the contrary, the sender of this email is not authorized by MBC to make any representations, negotiations or enter into any agreement on behalf of MBC. This e-mail message and any attached files have been scanned for the presence of computer viruses. However, it is the responsibility of the recipient to ensure that it is virus free; we accept no responsibility for any loss or damage arising in any way from its use.________________________________________

1 0

no certificate available safari browser
by Libindas 27 Aug '13

27 Aug '13

Hi Michal, Sever OS: Linux/Centos 5.9 SSLServer: Stunnel ErrorMessage: no certificate available CertType: SSL Web Server Certificate Client Browser: Safari 5.1. Client OS: OS X Lion When i am trying to hit the URL on safari browser it shows me the messages "no certificate available" No certificate meet the application . However, the same link is working for all other browsers. Moreover, we have checked the stunnel logs, but couldn't able to get any thing from the logs. Apache HTTPS config we have option *SSLVerifyClient none *in Stunnel I have tried all option non of thing working. * * Please help me.* * Thanks Libin

1 1

Re: [stunnel-users] Build failure for ARM32 with Yocto
by Ludolf Holzheid 23 Aug '13

23 Aug '13

On Thu, 2013-08-22 15:44:43 +0100, Laszlo Papp wrote: > On Thu, Aug 22, 2013 at 3:34 PM, Ludolf Holzheid < > lholzheid(a)bihl-wiedemann.de> wrote: > > > On Thu, 2013-08-22 14:43:55 +0100, Laszlo Papp wrote: > > > Here you can find the log file in question for details: > > > > > > [..] > > > > > > In file included from /usr//include/features.h:324:0, > > > from /usr//include/pthread.h:23, > > > from common.h:158, > > > from str.c:38: > > > > > /home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/sysroots/foo/usr/include/bits/predefs.h:23:3: > > > error: #error "Never use <bits/predefs.h> directly; include > > <stdc-predef.h> > > > > Laszlo, > > > > Are you sure /usr//include is the right include directory for cross- > > compiling? I must confess, I'm not familiar with cross-compiling, but > > this looks fishy. > > > > Most certainly not, but other softwares get it right. I will assume that it > has something to do with how the Makefile is generated for stunnel. Got a > clue in that area? I would try to remove -I/usr//include (and -pedantic) from the compiler flags, but again, I'm no expert in autoconf and cross-compiling. Ludolf -- Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

3 3

REMOVE
by Bruce Edwards 22 Aug '13

22 Aug '13

Please remove me from your list server R. Bruce Edwards Communications Manager 1018 Pretlow St Franklin, VA 23851 bedwards(a)franklinpolice.org Office: 757-562-8696 Cell: 757-621-5295

1 0

Build failure for ARM32 with Yocto
by Laszlo Papp 22 Aug '13

22 Aug '13

Hi, if I build stunnel manually on my desktop machine (Archlinux), it works fine. However, when I am trying to use a Yocto/OE recipe for building it for my arm32 target, I am facing the issue below. Anyone any hint? Cheers, L. | /usr//include/linux/sysctl.h:836:20: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:849:12: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:892:31: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:897:32: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:912:26: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:917:32: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:928:20: warning: comma at end of enumerator list [-pedantic] | In file included from /usr//include/linux/netfilter_ipv4.h:8:0, | from common.h:383, | from network.c:38: | /usr//include/linux/netfilter.h:58:18: warning: comma at end of enumerator list [-pedantic] | In file included from common.h:383:0, | from network.c:38: | /usr//include/linux/netfilter_ipv4.h:68:26: warning: comma at end of enumerator list [-pedantic] | make[2]: *** [stunnel-str.o] Error 1 | make[2]: *** Waiting for unfinished jobs.... | make[2]: *** [stunnel-network.o] Error 1 | make[2]: *** [stunnel-resolver.o] Error 1 | make[2]: *** [stunnel-protocol.o] Error 1 | make[2]: *** [stunnel-log.o] Error 1 | make[2]: *** [stunnel-file.o] Error 1 | make[2]: *** [stunnel-options.o] Error 1 | make[2]: *** [stunnel-client.o] Error 1 | make[2]: Leaving directory `/home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/work/armv5te-linux-gnueabi/stunnel/4.56-r0/stunnel-4.56/src' | make[1]: *** [all] Error 2 | make[1]: Leaving directory `/home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/work/armv5te-linux-gnueabi/stunnel/4.56-r0/stunnel-4.56/src' | make: *** [all-recursive] Error 1 | ERROR: oe_runmake failed | ERROR: Function failed: do_compile (see /home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/work/armv5te-linux-gnueabi/stunnel/4.56-r0/temp/log.do_compile.10590 for further information) ERROR: Task 6 (/home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/../meta-networking/recipes-support/stunnel/ stunnel_4.56.bb, do_compile) failed with exit code '1' NOTE: Tasks Summary: Attempted 561 tasks of which 559 didn't need to be rerun and 1 failed. No currently running tasks (561 of 568) Summary: 1 task failed: /home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/../meta-networking/recipes-support/stunnel/ stunnel_4.56.bb, do_compile Summary: There was 1 ERROR message shown, returning a non-zero exit code.

2 3

Problem Selecting Only Ecliptic Curve Ciphers
by Carter Browne 07 Aug '13

07 Aug '13

I'm using stunnel 4.56 on Windows 7. When I use the following cipher list: ciphers = ECDHE-ECDSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-ECDSA-AES128-SHA to establish a connection, I get a "no shared cipher" response. The following set of ciphers does work: ciphers = ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA Other relevant settings: options = NO_SSLv2 sslVersion = all fips = no verify = 2 If I take out the first ECDHE-RSA-ASE256-SHA cipher from the list, the ECDHE-RSA-AES128-SHA cipher is selected. What am I doing wrong? Thanks. -- Carter Browne cbrowne(a)cbcs-usa.com

2 1

Unable to make SSL connexion work
by OLIVER Patrice 07 Aug '13

07 Aug '13

Hi, Since our company had to migrate to Orange Office365 platform, we cannot send simple SMTP message using smtp.office365.com We have to use SMTP over TLS. While I have to use some applications which cannot use SMTP, I installed and setup STunnel. When I try to send a simple mail like this : telnet myserver 25 ehlo ch-lepuy.fr mail from: toto(a)ch-lepuy.fr I cannot continue with rcpt to syntax and I have the following message : rcpt to:530 5.7.1 Client was not authenticated In the STunnel log file, I can see that : 2013.08.06 19:20:49 LOG7[1352:2832]: SSL state (connect): before/connect initialization 2013.08.06 19:20:49 LOG7[1352:2832]: SSL state (connect): SSLv3 write client hello A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server hello A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server certificate A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server key exchange A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server certificate request A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server done A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write client certificate A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write client key exchange A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write certificate verify A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write change cipher spec A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write finished A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 flush data 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read finished A 2013.08.06 19:20:50 LOG7[1352:2832]: 1 items in the session cache 2013.08.06 19:20:50 LOG7[1352:2832]: 1 client connects (SSL_connect()) 2013.08.06 19:20:50 LOG7[1352:2832]: 1 client connects that finished 2013.08.06 19:20:50 LOG7[1352:2832]: 0 client renegotiations requested 2013.08.06 19:20:50 LOG7[1352:2832]: 0 server connects (SSL_accept()) 2013.08.06 19:20:50 LOG7[1352:2832]: 0 server connects that finished 2013.08.06 19:20:50 LOG7[1352:2832]: 0 server renegotiations requested 2013.08.06 19:20:50 LOG7[1352:2832]: 0 session cache hits 2013.08.06 19:20:50 LOG7[1352:2832]: 0 external session cache hits 2013.08.06 19:20:50 LOG7[1352:2832]: 0 session cache misses 2013.08.06 19:20:50 LOG7[1352:2832]: 0 session cache timeouts 2013.08.06 19:20:50 LOG7[1352:2832]: Peer certificate was cached (6184 bytes) 2013.08.06 19:20:50 LOG6[1352:2832]: SSL connected: new session negotiated 2013.08.06 19:20:50 LOG6[1352:2832]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES256-SHA (256-bit encryption) 2013.08.06 19:20:50 LOG6[1352:2832]: Compression: null, expansion: null 2013.08.06 19:21:13 LOG3[1352:2832]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2013.08.06 19:21:13 LOG5[1352:2832]: Connection reset: 65 byte(s) sent to SSL, 231 byte(s) sent to socket 2013.08.06 19:21:13 LOG7[1352:2832]: Remote socket (FD=316) closed 2013.08.06 19:21:13 LOG7[1352:2832]: Local socket (FD=244) closed 2013.08.06 19:21:13 LOG7[1352:2832]: Service [SMTP Outgoing] finished (0 left) Here is my STunnel setup : client = yes output = stunnel-log.txt debug = 7 taskbar = yes ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [SMTP Outgoing] protocol = smtp accept = 25 connect = smtp.office365.com:587 Does anyone have an idea ? Regards? Patrice Oliver | Centre Hospitalier Emile Roux Responsable Informatique T. 04 71 04 38 30 12 Bd Andr? Chantemesse - 43012 LE PUY EN VELAY Cedex http://www.ch-lepuy.fr

3 3

Disable SSL session ticket
by dansmith 06 Aug '13

06 Aug '13

Hi, when connecting a stunnel client to a stunnel server, is it possible to disable the use of SSL session tickets? I need to be able to decrypt the stunnel traffic in wireshark. Unfortunately, wireshark still doesn't support SSL session tickets.

2 1

transparent = source, not working
by Ruben Cardenal 04 Aug '13

04 Aug '13

Hi, I'm trying to setup yet another service of this kind. I've seen this has been largely discussed several times on this list (but without valid solutions), and I'm writting this email as some kind of last resort after hours of testing and debugging. Pretty simple configuration: # cat /etc/stunnel/stunnel.conf cert = /etc/ssl/certs/stunnel4/my-cert.crt key = /etc/ssl/certs/stunnel4/my-cert.key sslVersion = SSLv3 foreground = yes pid = /tmp/stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log [service] accept = 195.78.X.X:6697 connect = 195.78.X.X:1357 transparent = source Accept and connect IP's are the same. # /usr/local/bin/stunnel -version stunnel 4.56 on i686-pc-linux-gnu platform Compiled/running with OpenSSL 0.9.8o 01 Jun 2010 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP Global options: debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # /usr/local/bin/stunnel -sockets stunnel 4.56 on i686-pc-linux-gnu platform Compiled/running with OpenSSL 0.9.8o 01 Jun 2010 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP Socket option defaults: Option Name | Accept | Local | Remote |OS default ----------------+----------+----------+----------+---------- SO_DEBUG | -- | -- | -- | no SO_DONTROUTE | -- | -- | -- | no SO_KEEPALIVE | -- | -- | -- | no SO_LINGER | -- | -- | -- | 0:0 SO_OOBINLINE | -- | -- | -- | no SO_RCVBUF | -- | -- | -- | 87380 SO_SNDBUF | -- | -- | -- | 65536 SO_RCVLOWAT | -- | -- | -- | 1 SO_SNDLOWAT | -- | -- | -- | 1 SO_RCVTIMEO | -- | -- | -- | 0:0 SO_SNDTIMEO | -- | -- | -- | 0:0 SO_REUSEADDR | yes| -- | -- | no SO_BINDTODEVICE | -- | -- | -- |write-only TCP_KEEPCNT | -- | -- | -- | 9 TCP_KEEPIDLE | -- | -- | -- | 7200 TCP_KEEPINTVL | -- | -- | -- | 75 IP_TOS | -- | -- | -- | 0 IP_TTL | -- | -- | -- | 64 TCP_NODELAY | -- | yes| yes| no IP_FREEBIND | -- | -- | -- | no And the timeout, the same I've seen suffering to other people: 2013.08.03 19:52:12 LOG7[18496:3074533056]: Service [service] accepted (FD=3) from MY_HOME_ADDRESS:34836 2013.08.03 19:52:12 LOG7[18496:3074530160]: Service [service] started 2013.08.03 19:52:12 LOG5[18496:3074530160]: Service [service] accepted connection from MY_HOME_ADDRESS:34836 (blah blah ssl stuff) 2013.08.03 19:52:12 LOG6[18496:3074530160]: Negotiated TLSv1/SSLv3 ciphersuite: DHE-RSA-AES256-SHA (256-bit encryption) 2013.08.03 19:52:12 LOG6[18496:3074530160]: Compression: null, expansion: null 2013.08.03 19:52:12 LOG6[18496:3074530160]: IP_TRANSPARENT socket option set 2013.08.03 19:52:12 LOG6[18496:3074530160]: local_bind succeeded on the original port 2013.08.03 19:52:12 LOG6[18496:3074530160]: connect_blocking: connecting 195.78.X.X:1357 2013.08.03 19:52:12 LOG7[18496:3074530160]: connect_blocking: s_poll_wait 195.78.X.X:1357: waiting 60 seconds 2013.08.03 19:52:21 LOG3[18496:3074530160]: connect_blocking: connect 195.78.X.X:1357: Connection timed out (110) 2013.08.03 19:52:21 LOG5[18496:3074530160]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket iptables stuff and that, is in place: # cat /proc/sys/net/ipv4/conf/all/rp_filter 0 # cat /proc/sys/net/ipv4/ip_forward 1 And did the iptables part: iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 Debugging the whole thing, it can be seen that stunnel tries to connect: [pid 16823] connect(9, {sa_family=AF_INET, sin_port=htons(1357), sin_addr=inet_addr("195.78.X.X")}, 16) = -1 EINPROGRESS (Operation now in progress) BUT the service running in 1357 does this: # tcpdump -i eth1 -n port 1357 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes 19:52:52.586773 IP 195.78.X.X.1357 > MY_HOME_ADDRESS.34853: Flags [S.], seq 2655966098, ack 546202865, win 5840, options [mss 1460,nop,nop,sackOK], length 0 And, according to that, it looks obvious to me that this setup will never work, since that ACK packet goes to my home box, and not to the local connection. So either I'm doing something wrong (I hope I am!!) or this thing definitely doesn't work... Any help/ideas/whatever, please? Thanks, Rubén.

2 5

Library for iOS
by ios dev 29 Jul '13

29 Jul '13

Hi. I have to build static library for using in iOS application. Did anybody already built it? How can I do it? Thanks.

1 0

Reverse DNS lookup in stunnel log possible?
by mkanet＠yahoo.com 28 Jul '13

28 Jul '13

I currently have stunnel strip SSL from incoming https connections; which then passes the connections to a proxy before ultimately reaching my web server. So, the only easy way to see where incoming connections are coming from are in the stunnel log. Below, is a small example of what my stunnel log looks like (no, those arent the real IPs ). The information below would be much more useful to me if it included the DNS names in addition to their numeric IP. I currently have the latest Windows version of stunnel installed. It would be great to know how to get it to resolve DNS names as well in the log file; preferably without impeding general stunnel performance. I tried several debug levels; but none them did reverse DNS lookup. Hopefully someone know how to do this on a Windows stunnel setup. 2013.07.23 10:16:00 LOG5[10152:15136]: Service [stunnel-sslh] connected remote server from 24.12.152.129:58773 2013.07.23 10:16:00 LOG3[10152:15136]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2013.07.23 10:16:00 LOG5[10152:15136]: Connection reset: 272 byte(s) sent to SSL, 96 byte(s) sent to socket 2013.07.23 10:17:53 LOG5[10152:4000]: Service [stunnel-sslh] accepted connection from 71.194.51.232:5535 2013.07.23 10:17:53 LOG5[10152:4000]: connect_blocking: connected 24.12.152.129:7777 2013.07.23 10:17:53 LOG5[10152:4000]: Service [stunnel-sslh] connected remote server from 24.12.152.129:58799 2013.07.23 10:17:53 LOG5[10152:13212]: Service [stunnel-sslh] accepted connection from 71.194.51.232:5508 2013.07.23 10:17:53 LOG5[10152:3348]: Service [stunnel-sslh] accepted connection from 71.194.51.232:5509 2013.07.23 10:17:53 LOG5[10152:2884]: Service [stunnel-sslh] accepted connection from 71.194.51.232:5519

4 9

Re: [stunnel-users] Server down
by Ludolf Holzheid 24 Jul '13

24 Jul '13

On Wed, 2013-07-24 13:22:26 -0400, Walter Hankins wrote: > Hi Ludoff, > > I am new to stunnel. I trying to configure. > > Stunnel.conf: > socket = l: TCP_NODELAY = 1 > socket = r: TCP_NODELAY = 1 > > debug = 7 > output = stunnel.log Hi Walter, Always reply to the list, so others can comment. Your log says `Cannot open log file: stunnel.log´. I don't how you invoke stunnel, so I don't know if the directory it's working in is writable, but you may try to specify an output file in a writable directory with an absolute path, e.g. output=C:/stunnel.log if C:\ is writable on your box. HTH, Ludolf -- Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Server down
by Walter Hankins 24 Jul '13

24 Jul '13

Server is down Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from C:/.rnd Wrote 0 new random bytes to C:/.rnd PRNG seeded successfully Initializing service [Ssmtp] Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded SSL options set: 0x01000004 Configuration successful Service [Ssmtp] (FD=672) bound to 127.0.0.1:25 Cannot open log file: stunnel.log Closing service [Ssmtp] Service [Ssmtp] closed (FD=672) Sessions cached before flush: 0 Sessions cached after flush: 0 Service [Ssmtp] closed Server is down

2 1

Re: [stunnel-users] stunnel and keepalive
by David H. Durgee 23 Jul '13

23 Jul '13

> `stunnel -sockets´ should show the available socket options and their > default values. > > For the box I'm writing this mail from, the default for TCP_KEEPIDLE > is 7200 and for TCP_KEEPINTVL 75 (both in seconds). You'll have to be > quite patient if you want to watch keepalive packets in wireshark > without tweaking the defaults ... > > HTH, > > Ludolf You hit the nail on the head. I set the parameters to something more reasonable and I now see the keepalive packets. Thank you for your speedy response. Dave

1 0

keepalive and stunnel
by David H. Durgee 23 Jul '13

23 Jul '13

I am attempting to use stunnel to provide secure telnet access to a server on my system. As it is possible that a user may be idle for long period I have attempted to enable keepalive with stunnel. My stunnel conf files contain: socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 on both the server and client side. But wireshark shows no keepalive packets being exchanged. I am using socat to provide a service on the LAN and connections using socat do show keepalive packets. But to get this working with socat I had to use the following: socat -d -d -L/var/lock/Port$PORT - TCP:127.0.0.1:$PORT,keepalive,keepcnt=10,keepidle=3,keepintvl=1 I had originally tried it with only the keepalive option, but it took adding the other three options for it to work. Perhaps this is particular to my linux mint 13 maya x64 system and keepalive works by itself on windows? Are the other three options supported in stunnel? Dave

2 1

What do I need to provide an SSL service and verify individual clients?
by John Long 22 Jul '13

22 Jul '13

Hi, I want to set up a service using stunnel as a server. I want only specific clients to be able to connect. Each client will have an SSL-enabled client app. I understand the part about needing to create a self-signed cert for the stunnel server. I don't understand what Stunnel will require from each client. Do I have to create CSRs for each client and sign them with my self-signed cert, or will the keys from additional standalone self-signed certs for each client be good enough on the client side as long as I have a cert that for each key in the certificate path of the server? Is it correct that verify=3 will make sure only clients that have keys matching the certs in the server cert path can connect? If a client with a key that I have no cert for tries to connect, what should happen? Will it time out or will there be an error that the key isn't valid? Thanks, /jl

1 0

Stunnel log file limit
by mehmet ozisik 18 Jul '13

18 Jul '13

Hi, I would like to ask some questions regarding stunnel logging which I could not find answer with googling. 1) what is the limit of stunnel log file (can we define this)? 2) If there is a limit, when the limit is reached does it remove the filled file and starts with the same name an empty log file? Regards Mehmet

3 5

Feature requests
by Death Master 17 Jul '13

17 Jul '13

Can you implement some features? 1) Load balancing leastconn (like leastconn in haproxy) 2) UDT transport between stunnel instances(with several congestion controls which are already implemented for UDT) 3) SCTP transport between stunnel instances (if can be done in userspace) P.S. I'm using 400mbit WAN with 55-90ms latency+0-10%packet loss and on one end I can't control TCP settings at all (remote end is on OpenVZ VPS).

2 1

Line 51: "[pop3s]": Failed to initialize SSL
by Laura Fried 15 Jul '13

15 Jul '13

Beginning with Stunnel version 4.55 and continuing with 4.56 I can configure, make and make install without issue. But as soon as I try to start stunnel with the following command: /usr/local/bin/stunnel /usr/local/etc/stunnel/stunnel.conf I get the folllowing error message: Clients allowed=500 stunnel 4.56 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1 14 Mar 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported Line 51: "[pop3s]": Failed to initialize SSL str_stats: 9 block(s), 163 data byte(s), 522 control byte(s) Any insight into this issue would be greatly appreciated. -- Laura J. Fried

3 5

is verify level 4 working?
by dansmith 11 Jul '13

11 Jul '13

I would expect that level 4 only compares locally installed certificates, however I get the same behaviour as with level 3, stunnel expects a CA cert. Here'e the relevant log when on level 4 Jul 6 23:46:31 mmm stunnel: LOG7[7870:140491349628672]: Starting certificate verification: depth=0, /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: CERT: Verification error: unable to get local issuer certificate Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: Certificate check failed: depth=0, /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd Jul 6 23:46:31 mmm stunnel: LOG7[7872:140080853112576]: SSL alert (read): fatal: unknown CA What am I missing in understanding verify's level 4 ?

3 6

Creating a Centralized Secure Log Server with syslog-ng and Stunnel
by Szajt, Pablo 10 Jul '13

10 Jul '13

Hi guys, I have the task to install a secure syslog server using syslog-ng and stunnel. The Syslog server is a Solaris 10 and Syslog clients are HP-UX 11.31. I've spent already so many hours and I cannot make it run properly. I know syslog-ng works well without stunnel. I'm pretty sure someone is already using it. I'd like to have step by step installation process. I have no issue if I have to start from scratch. Thanks for your help, Pablo Pablo Szajt

2 1

Stunnel 4.56 and FIPS
by Ondrej Hrebicek 09 Jul '13

09 Jul '13

Hello stunnel users, I'm trying to compile stunnel 4.56 with FIPS support on Ubuntu 12.04. Always end up with the infamous "fingerprint does not match" error. I can't figure out what I'm doing wrong. 1. Download openssl-fips-2.0.2.tar.gz, unpack, ./config, make, and sudo make install (as specified in http://www.openssl.org/docs/fips/UserGuide-2.0.pdf) 2. Download openssl-1.0.1e.tar.gz, unpack, ./config fips --with-fipslibdir=/usr/local/ssl/fips-2.0/lib/ --with-fipsdir=/usr/local/ssl/fips-2.0/, make depend, make, and sudo make install 3. At this point, openssl is working in FIPS mode: > OPENSSL_FIPS=1 /usr/local/ssl/bin/openssl version OpenSSL 1.0.1e-fips 11 Feb 2013 > OPENSSL_FIPS=1 /usr/local/ssl/bin/openssl sha1 c_rehash SHA1(c_rehash)= 5af9e1479950bbbd9d3304c181b3f802c54f64fd > OPENSSL_FIPS=1 /usr/local/ssl/bin/openssl md5 c_rehash Error setting digest md5 139806582736544:error:060A80A3:digital envelope routines:FIPS_DIGESTINIT:disabled for fips:fips_md.c:180: 4. Download stunnel-4.56.tar.gz, unpack, ./configure --enable-fips --with-ssl=/usr/local/ssl, make, and sudo make install 5. While configuring and building stunnel completes as expected, the following does appear in ./configure's output: checking whether to enable FIPS mode support... yes configure: **************************************** SSL checking for SSL directory... /usr/local/ssl checking /usr/local/ssl/include/openssl/engine.h usability... yes checking /usr/local/ssl/include/openssl/engine.h presence... yes checking for /usr/local/ssl/include/openssl/engine.h... yes checking /usr/local/ssl/include/openssl/ocsp.h usability... yes checking /usr/local/ssl/include/openssl/ocsp.h presence... yes checking for /usr/local/ssl/include/openssl/ocsp.h... yes checking /usr/local/ssl/include/openssl/fips.h usability... no checking /usr/local/ssl/include/openssl/fips.h presence... no checking for /usr/local/ssl/include/openssl/fips.h... no configure: WARNING: OpenSSL fips header not found This is not entirely unexpected as fips.h only exists in /usr/local/ssl/fips-2.0/include/openssl. 6. Running stunnel however fails: > /usr/local/bin/stunnel Clients allowed=500 stunnel 4.56 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06B06F: error:2D06B06F:FIPS routines:FIPS_check_incore_fingerprint:fingerprint does not match Line 61: "[pop3s]": Failed to initialize SSL str_stats: 5 block(s), 120 data byte(s), 290 control byte(s) I can't figure out what's causing this, hoping someone on the list may have a couple suggestions. Thanks in advance!

2 2

Re: [stunnel-users] is verify level 4 working?
by Thomas Eifert 08 Jul '13

08 Jul '13

dansmith, I'd be the last to argue with you. Purely as an experiment, I tried changing the verify level from 4 to 3, but it didn't fly. I most likely missed the entirety of the signing chain, as I only added the certificate of the *issuing* CA. Regards, Thomas On 7/8/2013 7:01 PM, dansmith wrote: > Thomas, the recent exception you are describing - needing a CA > sertificate and server certificate is what verify=3 does. > So, I guess there is some regression in the code. > When I look at stunnel's verify.c code, there is only one reference to > level 4 in line 225. It seems like verify=4 functionality is missing > from the code. > > On 07/08/2013 11:44 PM, Thomas Eifert wrote: >> dansmith, >> >> It's my understanding that verify = 4 should, theoretically, look only >> for the server certificate, and this is the way I've been using it >> with great success over the past year or so. Recently, however, I ran >> into an exception to that behavior. >> >> In my case, I only had to download and install one certificate; that >> of the signing CA. I simply pasted it directly below the server >> certificate in the associated .pem file. The CA certificate wasn't >> originally in .pem format, so I converted it beforehand. OpenSSL has >> conversion capability, and there are also online certificate tools >> available. Your mileage may vary. >> >> Good luck. >> >> Thomas >> >> >> On 7/8/2013 3:01 PM, dansmith wrote: >> >>> Could you kindly break it down for me. Are you saying that I need to >>> have two CAs A & B. A signs the certificate of B and B signs the >>> certificate of my server? >>> Do I understand correctly that verify=4 is supposed to simply ignore >> any >>> CAs and only look at the actual certificate, comparing it to the >>> certificate in CAfile ? >>> >>> >>> On 07/08/2013 06:32 PM, Thomas Eifert wrote: >>>> You're not missing anything. I've experienced a similar issue. While >>>> verify = 4 generally works well in most cases and will ignore the CA >>>> chain, I've encountered a few isolated incidences in which I've had to >>>> append or "chain" the server certificate with the certificate of the >>>> CA. Give it a shot and see if it resolves your issue. >>>> >>>> Thomas >>>> >>>> On 7/8/2013 3:02 AM, dansmith wrote: >>>>> I would expect that level 4 only compares locally installed >>>>> certificates, however I get the same behaviour as with level 3, >> stunnel >>>>> expects a CA cert. >>>>> Here'e the relevant log when on level 4 >>>>> >>>>> Jul 6 23:46:31 mmm stunnel: LOG7[7870:140491349628672]: Starting >>>>> certificate verification: depth=0, >>>>> /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd >>>>> Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: CERT: >>>>> Verification error: unable to get local issuer certificate >>>>> Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: Certificate >>>>> check failed: depth=0, >> /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd >>>>> Jul 6 23:46:31 mmm stunnel: LOG7[7872:140080853112576]: SSL alert >>>>> (read): fatal: unknown CA >>>>> >>>>> What am I missing in understanding verify's level 4 ? >>>>> >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> stunnel-users mailing list >>>>> stunnel-users(a)stunnel.org >>>>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>>>> >>>> >>> >>> >> > > -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

is verify level 4 working?
by Thomas Eifert 08 Jul '13

08 Jul '13

dansmith, It's my understanding that verify = 4 should, theoretically, look only for the server certificate, and this is the way I've been using it with great success over the past year or so. Recently, however, I ran into an exception to that behavior. In my case, I only had to download and install one certificate; that of the signing CA. I simply pasted it directly below the server certificate in the associated .pem file. The CA certificate wasn't originally in .pem format, so I converted it beforehand. OpenSSL has conversion capability, and there are also online certificate tools available. Your mileage may vary. Good luck. Thomas On 7/8/2013 3:01 PM, dansmith wrote: > Could you kindly break it down for me. Are you saying that I need to > have two CAs A & B. A signs the certificate of B and B signs the > certificate of my server? > Do I understand correctly that verify=4 is supposed to simply ignore any > CAs and only look at the actual certificate, comparing it to the > certificate in CAfile ? > > > On 07/08/2013 06:32 PM, Thomas Eifert wrote: >> You're not missing anything. I've experienced a similar issue. While >> verify = 4 generally works well in most cases and will ignore the CA >> chain, I've encountered a few isolated incidences in which I've had to >> append or "chain" the server certificate with the certificate of the >> CA. Give it a shot and see if it resolves your issue. >> >> Thomas >> >> On 7/8/2013 3:02 AM, dansmith wrote: >>> I would expect that level 4 only compares locally installed >>> certificates, however I get the same behaviour as with level 3, stunnel >>> expects a CA cert. >>> Here'e the relevant log when on level 4 >>> >>> Jul 6 23:46:31 mmm stunnel: LOG7[7870:140491349628672]: Starting >>> certificate verification: depth=0, >>> /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd >>> Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: CERT: >>> Verification error: unable to get local issuer certificate >>> Jul 6 23:46:31 mmm stunnel: LOG4[7870:140491349628672]: Certificate >>> check failed: depth=0, /C=qq/ST=qq/O=qqq/OU=rer/CN=redf/emailAddress=rfd >>> Jul 6 23:46:31 mmm stunnel: LOG7[7872:140080853112576]: SSL alert >>> (read): fatal: unknown CA >>> >>> What am I missing in understanding verify's level 4 ? >>> >>> >>> >>> >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >> > > -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately. -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

Re: [stunnel-users] accept : too many open files error(24)
by Senthil Naidu 01 Jul '13

01 Jul '13

Hi, We are using 64 bit version of centos, and the ram of this system is 1gb so should we increase this limit to 100000 in the limits.conf Regards senthil On Sun, Jun 30, 2013 at 12:31 AM, Michael Curran <mike_curran(a)hotmail.com>wrote: > Are you running 32-kernel for centos? > > 32-bit limits in the 4500 range for open connections due to the memory > constraints > > We usually set our open file limits to 100I specifically for Stunnel user > > *Sent from my Verizon Wireless 4G LTE DROID* > > > Senthil Naidu <senthil.naidu(a)gmail.com> wrote: > > Hi > > > > We are using stunnel 4.32 on centos and our ulimits in limits.conf are as > follows > > > > * soft nofile 16384 > > * hard nofile 65536 > > > > We keep getting the error “too many open files(24)” and stunnel does not > accept new connection till we restart the same > > > > Is this ulimit proper or we need to increase the same , we are look for > 3000 to 5000 connections > > > > Regards > > Senthil >

2 2

accept : too many open files error(24)
by Senthil Naidu 29 Jun '13

29 Jun '13

Hi We are using stunnel 4.32 on centos and our ulimits in limits.conf are as follows * soft nofile 16384 * hard nofile 65536 We keep getting the error “too many open files(24)” and stunnel does not accept new connection till we restart the same Is this ulimit proper or we need to increase the same , we are look for 3000 to 5000 connections Regards Senthil

1 0

Re: [stunnel-users] Sending Email Without Authentication with gmail
by Stephen Gates 28 Jun '13

28 Jun '13

I downloaded the old argosoft freeware and it works! Praise God! Thanks to all for your time, help and suggestions!! Much appreciated. Stephen Gates Harold K. Scholz Company 7800 Serum Avenue Ralston, NE 68127 402-339-7600

2 1

Re: [stunnel-users] Sending Email from PLC Without Authentication with gmail - static ip/argosoft/php script
by Stephen Gates 28 Jun '13

28 Jun '13

> The only limitation I can recall on this freeware version is in the file size (5MB) and in the retries between relay errors. > > But you have to be aware when using a mail server that, thanks to Spamhaus, you need a static IP or almost all SMTPs out there will block your server to accept mail from (including Gmail)." > The router that my network is connected to has a static IP as far as I can tell and so does the PC and PLC on the LAN. How can I determine for sure if I have a static IP? I will try the Argosoft link. > Question? What does this device have available for resources. I use a php script that checks server status emails via gmail when there are changes in status, and it handles the connection directly to gmail. > I'm not sure. I don't know what php script is. I am about to try emailrelay from sourceforge.net. Anybody have experience with that? http://emailrelay.sourceforge.net/ Thanks, Stephen Gates Harold K. Scholz Company 7800 Serum Avenue Ralston, NE 68127 402-339-7600

1 0

Re: [stunnel-users] Sending Email from PLC Without Authentication with gmail
by Stephen Gates 27 Jun '13

27 Jun '13

"The issue with your situation is not stunnel but the fact that your SMTP client does not have the capability to provide authentication. As you mentioned, Gmail will require authentication information from the client. If that information is not provided by the SMTP client application, then the SMTP transaction will fail. ? I would suggest you consider setting up some kind of SMTP Relay. Which will serve as a proxy between your PLC and Google SMTP servers. ? You can also take a look at this document and if possible implement the last approach? http://support.google.com/a/bin/answer.py?hl=en <http://support.google.com/a/bin/answer.py?hl=en&answer=176600> &answer=176600" Thanks for your help Leandro. Do you have a suggestion for a SMTP Relay?? I have tried Free SMTP Server which was the only thing that has worked so far and worked almost perfectly except that it can only send out 10 emails a day. And I need more capacity for sending than that. I also have used trial versions of ArgoSoft, 1st Mail Server and QK SMTP Server but couldn't get those to work. I have tried the Google suggestion for using asmpx.l.google.com but I need to send to vtext.com addresses which are outside of the google domain. I tried adding the vtext.com addresses to googlegroups.com and sending emails using the asmpx.l.google.com server but vtext did not receive the emails for googlegroups.com. So I'm desperate to find some sort of solution. Thanks, Stephen Gates Harold K. Scholz Company 7800 Serum Avenue Ralston, NE 68127 402-339-7600

3 2

Stunnel | connection reset by peer
by Prem Vikash Upadhyay 27 Jun '13

27 Jun '13

Hi, Is there any configuration that can be used, to change the 'connection reset by peer' to 'connection refused'?. In our setup we are using day cq dispatcher with sticky session enabled, but dispatcher is invalidating sticky session only when it receiving error as 'connection refused', while stunnel is always sending error as 'connection reset by peer', whenever the connect server is down/crashed. Thanks Prem

2 1

Sending Email from PLC Without Authentication with gmail
by Stephen Gates 27 Jun '13

27 Jun '13

A customer needs to send emails from a Programmable Logic Controller (PLC) which cannot provide authentication. The customer's email server is gmail which obviously requires authentication. The PLC IP is 192.168.1.2 and the PC IP on which stunnel is installed is 192.168.1.31 My config is: cert = stunnel.pem [smtps] client = yes accept = 25 connect = smtp.gmail.com:465 The PLC is set up to send emails to the IP of the PC 192.168.1.31 When I try to send emails I get the following in the stunnel log: 2013.06.26 14:26:30 LOG5[12384:13048]: Service [smtps] accepted connection from 192.168.1.2:2938 2013.06.26 14:26:30 LOG5[12384:13048]: connect_blocking: connected 74.125.130.108:465 2013.06.26 14:26:30 LOG5[12384:13048]: Service [smtps] connected remote server from 192.168.1.31:53599 Any help would be greatly appreciated! Stephen Gates Harold K. Scholz Company 7800 Serum Avenue Ralston, NE 68127 402-339-7600

2 1

Re: [stunnel-users] Sending Email from PLC Without Authentication - With debug = 7 log
by Stephen Gates 26 Jun '13

26 Jun '13

Just wanted to send this again with a clarified subject. Still getting the connect_blocking error. Any more ideas? Thanks for replying, Brian. From: Stephen Gates [mailto:[email protected]] Sent: Wednesday, June 26, 2013 3:09 PM To: 'stunnel-users(a)stunnel.org' Subject: RE: Sending Email from PLC Without Authentication with gmail I added the following as Brian suggested. debug = 7 I tried doing output = stunnel.log but that cause an error when I reloded the config file. Here's the log after adding the above and trying to send another email. 2013.06.26 15:03:37 LOG7[10620:10992]: Service [smtps] (FD=416) bound to 0.0.0.0:25 2013.06.26 15:03:58 LOG7[10620:10992]: Service [smtps] accepted (FD=296) from 192.168.1.2:2946 2013.06.26 15:03:58 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:03:58 LOG7[10620:10992]: New thread created 2013.06.26 15:03:58 LOG7[10620:10360]: Service [smtps] started 2013.06.26 15:03:58 LOG5[10620:10360]: Service [smtps] accepted connection from 192.168.1.2:2946 2013.06.26 15:03:58 LOG6[10620:10360]: connect_blocking: connecting 74.125.130.108:465 2013.06.26 15:03:58 LOG7[10620:10360]: connect_blocking: s_poll_wait 74.125.130.108:465: waiting 10 seconds 2013.06.26 15:03:58 LOG5[10620:10360]: connect_blocking: connected 74.125.130.108:465 2013.06.26 15:03:58 LOG5[10620:10360]: Service [smtps] connected remote server from 192.168.1.31:53640 2013.06.26 15:03:58 LOG7[10620:10360]: Remote socket (FD=368) initialized 2013.06.26 15:03:58 LOG7[10620:10360]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): before/connect initialization 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 read server certificate A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 read server done A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 write client key exchange A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 flush data 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 read server session ticket A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:03:58 LOG7[10620:10360]: 1 items in the session cache 2013.06.26 15:03:58 LOG7[10620:10360]: 1 client connects (SSL_connect()) 2013.06.26 15:03:58 LOG7[10620:10360]: 1 client connects that finished 2013.06.26 15:03:58 LOG7[10620:10360]: 0 client renegotiations requested 2013.06.26 15:03:58 LOG7[10620:10360]: 0 server connects (SSL_accept()) 2013.06.26 15:03:58 LOG7[10620:10360]: 0 server connects that finished 2013.06.26 15:03:58 LOG7[10620:10360]: 0 server renegotiations requested 2013.06.26 15:03:58 LOG7[10620:10360]: 0 session cache hits 2013.06.26 15:03:58 LOG7[10620:10360]: 0 external session cache hits 2013.06.26 15:03:58 LOG7[10620:10360]: 0 session cache misses 2013.06.26 15:03:58 LOG7[10620:10360]: 0 session cache timeouts 2013.06.26 15:03:58 LOG7[10620:10360]: Peer certificate was cached (2266 bytes) 2013.06.26 15:03:58 LOG6[10620:10360]: SSL connected: new session negotiated 2013.06.26 15:03:58 LOG6[10620:10360]: Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) 2013.06.26 15:03:58 LOG6[10620:10360]: Compression: null, expansion: null 2013.06.26 15:03:59 LOG6[10620:10360]: SSL socket closed (SSL_read) 2013.06.26 15:03:59 LOG7[10620:10360]: Sent socket write shutdown 2013.06.26 15:03:59 LOG5[10620:10360]: Connection closed: 65 byte(s) sent to SSL, 293 byte(s) sent to socket 2013.06.26 15:03:59 LOG7[10620:10360]: Remote socket (FD=368) closed 2013.06.26 15:03:59 LOG7[10620:10360]: Local socket (FD=296) closed 2013.06.26 15:03:59 LOG7[10620:10360]: Service [smtps] finished (0 left) 2013.06.26 15:03:59 LOG7[10620:10992]: Service [smtps] accepted (FD=364) from 192.168.1.2:2947 2013.06.26 15:03:59 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:03:59 LOG7[10620:10992]: New thread created 2013.06.26 15:03:59 LOG7[10620:7792]: Service [smtps] started 2013.06.26 15:03:59 LOG5[10620:7792]: Service [smtps] accepted connection from 192.168.1.2:2947 2013.06.26 15:03:59 LOG6[10620:7792]: connect_blocking: connecting 74.125.130.109:465 2013.06.26 15:03:59 LOG7[10620:7792]: connect_blocking: s_poll_wait 74.125.130.109:465: waiting 10 seconds 2013.06.26 15:03:59 LOG5[10620:7792]: connect_blocking: connected 74.125.130.109:465 2013.06.26 15:03:59 LOG5[10620:7792]: Service [smtps] connected remote server from 192.168.1.31:53641 2013.06.26 15:03:59 LOG7[10620:7792]: Remote socket (FD=368) initialized 2013.06.26 15:03:59 LOG7[10620:7792]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): before/connect initialization 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): SSLv3 flush data 2013.06.26 15:03:59 LOG7[10620:7792]: 1 items in the session cache 2013.06.26 15:03:59 LOG7[10620:7792]: 2 client connects (SSL_connect()) 2013.06.26 15:03:59 LOG7[10620:7792]: 2 client connects that finished 2013.06.26 15:03:59 LOG7[10620:7792]: 0 client renegotiations requested 2013.06.26 15:03:59 LOG7[10620:7792]: 0 server connects (SSL_accept()) 2013.06.26 15:03:59 LOG7[10620:7792]: 0 server connects that finished 2013.06.26 15:03:59 LOG7[10620:7792]: 0 server renegotiations requested 2013.06.26 15:03:59 LOG7[10620:7792]: 1 session cache hits 2013.06.26 15:03:59 LOG7[10620:7792]: 0 external session cache hits 2013.06.26 15:03:59 LOG7[10620:7792]: 0 session cache misses 2013.06.26 15:03:59 LOG7[10620:7792]: 0 session cache timeouts 2013.06.26 15:03:59 LOG6[10620:7792]: SSL connected: previous session reused 2013.06.26 15:04:00 LOG6[10620:7792]: SSL socket closed (SSL_read) 2013.06.26 15:04:00 LOG7[10620:7792]: Sent socket write shutdown 2013.06.26 15:04:00 LOG5[10620:7792]: Connection closed: 65 byte(s) sent to SSL, 287 byte(s) sent to socket 2013.06.26 15:04:00 LOG7[10620:7792]: Remote socket (FD=368) closed 2013.06.26 15:04:00 LOG7[10620:7792]: Local socket (FD=364) closed 2013.06.26 15:04:00 LOG7[10620:7792]: Service [smtps] finished (0 left) 2013.06.26 15:04:00 LOG7[10620:10992]: Service [smtps] accepted (FD=372) from 192.168.1.2:2948 2013.06.26 15:04:00 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:04:00 LOG7[10620:10992]: New thread created 2013.06.26 15:04:00 LOG7[10620:12944]: Service [smtps] started 2013.06.26 15:04:00 LOG5[10620:12944]: Service [smtps] accepted connection from 192.168.1.2:2948 2013.06.26 15:04:00 LOG6[10620:12944]: connect_blocking: connecting 74.125.130.108:465 2013.06.26 15:04:00 LOG7[10620:12944]: connect_blocking: s_poll_wait 74.125.130.108:465: waiting 10 seconds 2013.06.26 15:04:00 LOG5[10620:12944]: connect_blocking: connected 74.125.130.108:465 2013.06.26 15:04:00 LOG5[10620:12944]: Service [smtps] connected remote server from 192.168.1.31:53642 2013.06.26 15:04:00 LOG7[10620:12944]: Remote socket (FD=368) initialized 2013.06.26 15:04:00 LOG7[10620:12944]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): before/connect initialization 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): SSLv3 flush data 2013.06.26 15:04:00 LOG7[10620:12944]: 1 items in the session cache 2013.06.26 15:04:00 LOG7[10620:12944]: 3 client connects (SSL_connect()) 2013.06.26 15:04:00 LOG7[10620:12944]: 3 client connects that finished 2013.06.26 15:04:00 LOG7[10620:12944]: 0 client renegotiations requested 2013.06.26 15:04:00 LOG7[10620:12944]: 0 server connects (SSL_accept()) 2013.06.26 15:04:00 LOG7[10620:12944]: 0 server connects that finished 2013.06.26 15:04:00 LOG7[10620:12944]: 0 server renegotiations requested 2013.06.26 15:04:00 LOG7[10620:12944]: 2 session cache hits 2013.06.26 15:04:00 LOG7[10620:12944]: 0 external session cache hits 2013.06.26 15:04:00 LOG7[10620:12944]: 0 session cache misses 2013.06.26 15:04:00 LOG7[10620:12944]: 0 session cache timeouts 2013.06.26 15:04:00 LOG6[10620:12944]: SSL connected: previous session reused 2013.06.26 15:04:01 LOG6[10620:12944]: SSL socket closed (SSL_read) 2013.06.26 15:04:01 LOG7[10620:12944]: Sent socket write shutdown 2013.06.26 15:04:01 LOG5[10620:12944]: Connection closed: 65 byte(s) sent to SSL, 290 byte(s) sent to socket 2013.06.26 15:04:01 LOG7[10620:12944]: Remote socket (FD=368) closed 2013.06.26 15:04:01 LOG7[10620:12944]: Local socket (FD=372) closed 2013.06.26 15:04:01 LOG7[10620:12944]: Service [smtps] finished (0 left) 2013.06.26 15:04:01 LOG7[10620:10992]: Service [smtps] accepted (FD=288) from 192.168.1.2:2949 2013.06.26 15:04:01 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:04:01 LOG7[10620:10992]: New thread created 2013.06.26 15:04:01 LOG7[10620:12900]: Service [smtps] started 2013.06.26 15:04:01 LOG5[10620:12900]: Service [smtps] accepted connection from 192.168.1.2:2949 2013.06.26 15:04:01 LOG6[10620:12900]: connect_blocking: connecting 74.125.130.109:465 2013.06.26 15:04:01 LOG7[10620:12900]: connect_blocking: s_poll_wait 74.125.130.109:465: waiting 10 seconds 2013.06.26 15:04:01 LOG5[10620:12900]: connect_blocking: connected 74.125.130.109:465 2013.06.26 15:04:01 LOG5[10620:12900]: Service [smtps] connected remote server from 192.168.1.31:53643 2013.06.26 15:04:01 LOG7[10620:12900]: Remote socket (FD=368) initialized 2013.06.26 15:04:01 LOG7[10620:12900]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): before/connect initialization 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): SSLv3 flush data 2013.06.26 15:04:01 LOG7[10620:12900]: 1 items in the session cache 2013.06.26 15:04:01 LOG7[10620:12900]: 4 client connects (SSL_connect()) 2013.06.26 15:04:01 LOG7[10620:12900]: 4 client connects that finished 2013.06.26 15:04:01 LOG7[10620:12900]: 0 client renegotiations requested 2013.06.26 15:04:01 LOG7[10620:12900]: 0 server connects (SSL_accept()) 2013.06.26 15:04:01 LOG7[10620:12900]: 0 server connects that finished 2013.06.26 15:04:01 LOG7[10620:12900]: 0 server renegotiations requested 2013.06.26 15:04:01 LOG7[10620:12900]: 3 session cache hits 2013.06.26 15:04:01 LOG7[10620:12900]: 0 external session cache hits 2013.06.26 15:04:01 LOG7[10620:12900]: 0 session cache misses 2013.06.26 15:04:01 LOG7[10620:12900]: 0 session cache timeouts 2013.06.26 15:04:01 LOG6[10620:12900]: SSL connected: previous session reused 2013.06.26 15:04:02 LOG6[10620:12900]: SSL socket closed (SSL_read) 2013.06.26 15:04:02 LOG7[10620:12900]: Sent socket write shutdown 2013.06.26 15:04:02 LOG5[10620:12900]: Connection closed: 65 byte(s) sent to SSL, 293 byte(s) sent to socket 2013.06.26 15:04:02 LOG7[10620:12900]: Remote socket (FD=368) closed 2013.06.26 15:04:02 LOG7[10620:12900]: Local socket (FD=288) closed 2013.06.26 15:04:02 LOG7[10620:12900]: Service [smtps] finished (0 left) 2013.06.26 15:04:02 LOG7[10620:10992]: Service [smtps] accepted (FD=292) from 192.168.1.2:2950 2013.06.26 15:04:02 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:04:02 LOG7[10620:10992]: New thread created 2013.06.26 15:04:02 LOG7[10620:11560]: Service [smtps] started 2013.06.26 15:04:02 LOG5[10620:11560]: Service [smtps] accepted connection from 192.168.1.2:2950 2013.06.26 15:04:02 LOG6[10620:11560]: connect_blocking: connecting 74.125.130.108:465 2013.06.26 15:04:02 LOG7[10620:11560]: connect_blocking: s_poll_wait 74.125.130.108:465: waiting 10 seconds 2013.06.26 15:04:02 LOG5[10620:11560]: connect_blocking: connected 74.125.130.108:465 2013.06.26 15:04:02 LOG5[10620:11560]: Service [smtps] connected remote server from 192.168.1.31:53644 2013.06.26 15:04:02 LOG7[10620:11560]: Remote socket (FD=368) initialized 2013.06.26 15:04:02 LOG7[10620:11560]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): before/connect initialization 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): SSLv3 flush data 2013.06.26 15:04:02 LOG7[10620:11560]: 1 items in the session cache 2013.06.26 15:04:02 LOG7[10620:11560]: 5 client connects (SSL_connect()) 2013.06.26 15:04:02 LOG7[10620:11560]: 5 client connects that finished 2013.06.26 15:04:02 LOG7[10620:11560]: 0 client renegotiations requested 2013.06.26 15:04:02 LOG7[10620:11560]: 0 server connects (SSL_accept()) 2013.06.26 15:04:02 LOG7[10620:11560]: 0 server connects that finished 2013.06.26 15:04:02 LOG7[10620:11560]: 0 server renegotiations requested 2013.06.26 15:04:02 LOG7[10620:11560]: 4 session cache hits 2013.06.26 15:04:02 LOG7[10620:11560]: 0 external session cache hits 2013.06.26 15:04:02 LOG7[10620:11560]: 0 session cache misses 2013.06.26 15:04:02 LOG7[10620:11560]: 0 session cache timeouts 2013.06.26 15:04:02 LOG6[10620:11560]: SSL connected: previous session reused 2013.06.26 15:04:03 LOG6[10620:11560]: SSL socket closed (SSL_read) 2013.06.26 15:04:03 LOG7[10620:11560]: Sent socket write shutdown 2013.06.26 15:04:03 LOG5[10620:11560]: Connection closed: 65 byte(s) sent to SSL, 296 byte(s) sent to socket 2013.06.26 15:04:03 LOG7[10620:11560]: Remote socket (FD=368) closed 2013.06.26 15:04:03 LOG7[10620:11560]: Local socket (FD=292) closed 2013.06.26 15:04:03 LOG7[10620:11560]: Service [smtps] finished (0 left) 2013.06.26 15:04:03 LOG7[10620:10992]: Service [smtps] accepted (FD=296) from 192.168.1.2:2951 2013.06.26 15:04:03 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:04:03 LOG7[10620:10992]: New thread created 2013.06.26 15:04:03 LOG7[10620:10092]: Service [smtps] started 2013.06.26 15:04:03 LOG5[10620:10092]: Service [smtps] accepted connection from 192.168.1.2:2951 2013.06.26 15:04:03 LOG6[10620:10092]: connect_blocking: connecting 74.125.130.109:465 2013.06.26 15:04:03 LOG7[10620:10092]: connect_blocking: s_poll_wait 74.125.130.109:465: waiting 10 seconds 2013.06.26 15:04:03 LOG5[10620:10092]: connect_blocking: connected 74.125.130.109:465 2013.06.26 15:04:03 LOG5[10620:10092]: Service [smtps] connected remote server from 192.168.1.31:53645 2013.06.26 15:04:03 LOG7[10620:10092]: Remote socket (FD=368) initialized 2013.06.26 15:04:03 LOG7[10620:10092]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): before/connect initialization 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): SSLv3 flush data 2013.06.26 15:04:03 LOG7[10620:10092]: 1 items in the session cache 2013.06.26 15:04:03 LOG7[10620:10092]: 6 client connects (SSL_connect()) 2013.06.26 15:04:03 LOG7[10620:10092]: 6 client connects that finished 2013.06.26 15:04:03 LOG7[10620:10092]: 0 client renegotiations requested 2013.06.26 15:04:03 LOG7[10620:10092]: 0 server connects (SSL_accept()) 2013.06.26 15:04:03 LOG7[10620:10092]: 0 server connects that finished 2013.06.26 15:04:03 LOG7[10620:10092]: 0 server renegotiations requested 2013.06.26 15:04:03 LOG7[10620:10092]: 5 session cache hits 2013.06.26 15:04:03 LOG7[10620:10092]: 0 external session cache hits 2013.06.26 15:04:03 LOG7[10620:10092]: 0 session cache misses 2013.06.26 15:04:03 LOG7[10620:10092]: 0 session cache timeouts 2013.06.26 15:04:03 LOG6[10620:10092]: SSL connected: previous session reused 2013.06.26 15:04:04 LOG6[10620:10092]: SSL socket closed (SSL_read) 2013.06.26 15:04:04 LOG7[10620:10092]: Sent socket write shutdown 2013.06.26 15:04:04 LOG5[10620:10092]: Connection closed: 65 byte(s) sent to SSL, 290 byte(s) sent to socket 2013.06.26 15:04:04 LOG7[10620:10092]: Remote socket (FD=368) closed 2013.06.26 15:04:04 LOG7[10620:10092]: Local socket (FD=296) closed 2013.06.26 15:04:04 LOG7[10620:10092]: Service [smtps] finished (0 left) 2013.06.26 15:04:04 LOG7[10620:10992]: Service [smtps] accepted (FD=364) from 192.168.1.2:2952 2013.06.26 15:04:04 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:04:04 LOG7[10620:10992]: New thread created 2013.06.26 15:04:04 LOG7[10620:1404]: Service [smtps] started 2013.06.26 15:04:04 LOG5[10620:1404]: Service [smtps] accepted connection from 192.168.1.2:2952 2013.06.26 15:04:04 LOG6[10620:1404]: connect_blocking: connecting 74.125.130.108:465 2013.06.26 15:04:04 LOG7[10620:1404]: connect_blocking: s_poll_wait 74.125.130.108:465: waiting 10 seconds 2013.06.26 15:04:04 LOG5[10620:1404]: connect_blocking: connected 74.125.130.108:465 2013.06.26 15:04:04 LOG5[10620:1404]: Service [smtps] connected remote server from 192.168.1.31:53646 2013.06.26 15:04:04 LOG7[10620:1404]: Remote socket (FD=368) initialized 2013.06.26 15:04:04 LOG7[10620:1404]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:04:04 LOG7[10620:1404]: SSL state (connect): before/connect initialization 2013.06.26 15:04:04 LOG7[10620:1404]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:04:05 LOG7[10620:1404]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:04:05 LOG7[10620:1404]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:04:05 LOG7[10620:1404]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:04:05 LOG7[10620:1404]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:04:05 LOG7[10620:1404]: SSL state (connect): SSLv3 flush data 2013.06.26 15:04:05 LOG7[10620:1404]: 1 items in the session cache 2013.06.26 15:04:05 LOG7[10620:1404]: 7 client connects (SSL_connect()) 2013.06.26 15:04:05 LOG7[10620:1404]: 7 client connects that finished 2013.06.26 15:04:05 LOG7[10620:1404]: 0 client renegotiations requested 2013.06.26 15:04:05 LOG7[10620:1404]: 0 server connects (SSL_accept()) 2013.06.26 15:04:05 LOG7[10620:1404]: 0 server connects that finished 2013.06.26 15:04:05 LOG7[10620:1404]: 0 server renegotiations requested 2013.06.26 15:04:05 LOG7[10620:1404]: 6 session cache hits 2013.06.26 15:04:05 LOG7[10620:1404]: 0 external session cache hits 2013.06.26 15:04:05 LOG7[10620:1404]: 0 session cache misses 2013.06.26 15:04:05 LOG7[10620:1404]: 0 session cache timeouts 2013.06.26 15:04:05 LOG6[10620:1404]: SSL connected: previous session reused 2013.06.26 15:04:05 LOG6[10620:1404]: SSL socket closed (SSL_read) 2013.06.26 15:04:05 LOG7[10620:1404]: Sent socket write shutdown 2013.06.26 15:04:05 LOG5[10620:1404]: Connection closed: 65 byte(s) sent to SSL, 290 byte(s) sent to socket 2013.06.26 15:04:05 LOG7[10620:1404]: Remote socket (FD=368) closed 2013.06.26 15:04:05 LOG7[10620:1404]: Local socket (FD=364) closed 2013.06.26 15:04:05 LOG7[10620:1404]: Service [smtps] finished (0 left) 2013.06.26 15:04:05 LOG7[10620:10992]: Service [smtps] accepted (FD=372) from 192.168.1.2:2953 2013.06.26 15:04:05 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:04:05 LOG7[10620:10992]: New thread created 2013.06.26 15:04:05 LOG7[10620:11904]: Service [smtps] started 2013.06.26 15:04:05 LOG5[10620:11904]: Service [smtps] accepted connection from 192.168.1.2:2953 2013.06.26 15:04:05 LOG6[10620:11904]: connect_blocking: connecting 74.125.130.109:465 2013.06.26 15:04:05 LOG7[10620:11904]: connect_blocking: s_poll_wait 74.125.130.109:465: waiting 10 seconds 2013.06.26 15:04:06 LOG5[10620:11904]: connect_blocking: connected 74.125.130.109:465 2013.06.26 15:04:06 LOG5[10620:11904]: Service [smtps] connected remote server from 192.168.1.31:53647 2013.06.26 15:04:06 LOG7[10620:11904]: Remote socket (FD=368) initialized 2013.06.26 15:04:06 LOG7[10620:11904]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): before/connect initialization 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): SSLv3 flush data 2013.06.26 15:04:06 LOG7[10620:11904]: 1 items in the session cache 2013.06.26 15:04:06 LOG7[10620:11904]: 8 client connects (SSL_connect()) 2013.06.26 15:04:06 LOG7[10620:11904]: 8 client connects that finished 2013.06.26 15:04:06 LOG7[10620:11904]: 0 client renegotiations requested 2013.06.26 15:04:06 LOG7[10620:11904]: 0 server connects (SSL_accept()) 2013.06.26 15:04:06 LOG7[10620:11904]: 0 server connects that finished 2013.06.26 15:04:06 LOG7[10620:11904]: 0 server renegotiations requested 2013.06.26 15:04:06 LOG7[10620:11904]: 7 session cache hits 2013.06.26 15:04:06 LOG7[10620:11904]: 0 external session cache hits 2013.06.26 15:04:06 LOG7[10620:11904]: 0 session cache misses 2013.06.26 15:04:06 LOG7[10620:11904]: 0 session cache timeouts 2013.06.26 15:04:06 LOG6[10620:11904]: SSL connected: previous session reused 2013.06.26 15:04:06 LOG6[10620:11904]: SSL socket closed (SSL_read) 2013.06.26 15:04:06 LOG7[10620:11904]: Sent socket write shutdown 2013.06.26 15:04:06 LOG5[10620:11904]: Connection closed: 65 byte(s) sent to SSL, 290 byte(s) sent to socket 2013.06.26 15:04:06 LOG7[10620:11904]: Remote socket (FD=368) closed 2013.06.26 15:04:06 LOG7[10620:11904]: Local socket (FD=372) closed 2013.06.26 15:04:06 LOG7[10620:11904]: Service [smtps] finished (0 left) From: Stephen Gates [mailto:[email protected]] Sent: Wednesday, June 26, 2013 2:25 PM To: 'stunnel-users(a)stunnel.org' Subject: Sending Email from PLC Without Authentication with gmail A customer needs to send emails from a Programmable Logic Controller (PLC) which cannot provide authentication. The customer's email server is gmail which obviously requires authentication. The PLC IP is 192.168.1.2 and the PC IP on which stunnel is installed is 192.168.1.31 My config is: cert = stunnel.pem [smtps] client = yes accept = 25 connect = smtp.gmail.com:465 The PLC is set up to send emails to the IP of the PC 192.168.1.31 When I try to send emails I get the following in the stunnel log: 2013.06.26 14:26:30 LOG5[12384:13048]: Service [smtps] accepted connection from 192.168.1.2:2938 2013.06.26 14:26:30 LOG5[12384:13048]: connect_blocking: connected 74.125.130.108:465 2013.06.26 14:26:30 LOG5[12384:13048]: Service [smtps] connected remote server from 192.168.1.31:53599 Any help would be greatly appreciated! Stephen Gates Harold K. Scholz Company 7800 Serum Avenue Ralston, NE 68127 402-339-7600

1 0

Re: [stunnel-users] Sending Email from PLC Without Authentication with gmail
by Stephen Gates 26 Jun '13

26 Jun '13

I added the following as Bruce suggested. debug = 7 I tried doing output = stunnel.log but that cause an error when I reloded the config file. Here's the log after adding the above and trying to send another email. 2013.06.26 15:03:37 LOG7[10620:10992]: Service [smtps] (FD=416) bound to 0.0.0.0:25 2013.06.26 15:03:58 LOG7[10620:10992]: Service [smtps] accepted (FD=296) from 192.168.1.2:2946 2013.06.26 15:03:58 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:03:58 LOG7[10620:10992]: New thread created 2013.06.26 15:03:58 LOG7[10620:10360]: Service [smtps] started 2013.06.26 15:03:58 LOG5[10620:10360]: Service [smtps] accepted connection from 192.168.1.2:2946 2013.06.26 15:03:58 LOG6[10620:10360]: connect_blocking: connecting 74.125.130.108:465 2013.06.26 15:03:58 LOG7[10620:10360]: connect_blocking: s_poll_wait 74.125.130.108:465: waiting 10 seconds 2013.06.26 15:03:58 LOG5[10620:10360]: connect_blocking: connected 74.125.130.108:465 2013.06.26 15:03:58 LOG5[10620:10360]: Service [smtps] connected remote server from 192.168.1.31:53640 2013.06.26 15:03:58 LOG7[10620:10360]: Remote socket (FD=368) initialized 2013.06.26 15:03:58 LOG7[10620:10360]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): before/connect initialization 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 read server certificate A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 read server done A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 write client key exchange A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 flush data 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 read server session ticket A 2013.06.26 15:03:58 LOG7[10620:10360]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:03:58 LOG7[10620:10360]: 1 items in the session cache 2013.06.26 15:03:58 LOG7[10620:10360]: 1 client connects (SSL_connect()) 2013.06.26 15:03:58 LOG7[10620:10360]: 1 client connects that finished 2013.06.26 15:03:58 LOG7[10620:10360]: 0 client renegotiations requested 2013.06.26 15:03:58 LOG7[10620:10360]: 0 server connects (SSL_accept()) 2013.06.26 15:03:58 LOG7[10620:10360]: 0 server connects that finished 2013.06.26 15:03:58 LOG7[10620:10360]: 0 server renegotiations requested 2013.06.26 15:03:58 LOG7[10620:10360]: 0 session cache hits 2013.06.26 15:03:58 LOG7[10620:10360]: 0 external session cache hits 2013.06.26 15:03:58 LOG7[10620:10360]: 0 session cache misses 2013.06.26 15:03:58 LOG7[10620:10360]: 0 session cache timeouts 2013.06.26 15:03:58 LOG7[10620:10360]: Peer certificate was cached (2266 bytes) 2013.06.26 15:03:58 LOG6[10620:10360]: SSL connected: new session negotiated 2013.06.26 15:03:58 LOG6[10620:10360]: Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) 2013.06.26 15:03:58 LOG6[10620:10360]: Compression: null, expansion: null 2013.06.26 15:03:59 LOG6[10620:10360]: SSL socket closed (SSL_read) 2013.06.26 15:03:59 LOG7[10620:10360]: Sent socket write shutdown 2013.06.26 15:03:59 LOG5[10620:10360]: Connection closed: 65 byte(s) sent to SSL, 293 byte(s) sent to socket 2013.06.26 15:03:59 LOG7[10620:10360]: Remote socket (FD=368) closed 2013.06.26 15:03:59 LOG7[10620:10360]: Local socket (FD=296) closed 2013.06.26 15:03:59 LOG7[10620:10360]: Service [smtps] finished (0 left) 2013.06.26 15:03:59 LOG7[10620:10992]: Service [smtps] accepted (FD=364) from 192.168.1.2:2947 2013.06.26 15:03:59 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:03:59 LOG7[10620:10992]: New thread created 2013.06.26 15:03:59 LOG7[10620:7792]: Service [smtps] started 2013.06.26 15:03:59 LOG5[10620:7792]: Service [smtps] accepted connection from 192.168.1.2:2947 2013.06.26 15:03:59 LOG6[10620:7792]: connect_blocking: connecting 74.125.130.109:465 2013.06.26 15:03:59 LOG7[10620:7792]: connect_blocking: s_poll_wait 74.125.130.109:465: waiting 10 seconds 2013.06.26 15:03:59 LOG5[10620:7792]: connect_blocking: connected 74.125.130.109:465 2013.06.26 15:03:59 LOG5[10620:7792]: Service [smtps] connected remote server from 192.168.1.31:53641 2013.06.26 15:03:59 LOG7[10620:7792]: Remote socket (FD=368) initialized 2013.06.26 15:03:59 LOG7[10620:7792]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): before/connect initialization 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:03:59 LOG7[10620:7792]: SSL state (connect): SSLv3 flush data 2013.06.26 15:03:59 LOG7[10620:7792]: 1 items in the session cache 2013.06.26 15:03:59 LOG7[10620:7792]: 2 client connects (SSL_connect()) 2013.06.26 15:03:59 LOG7[10620:7792]: 2 client connects that finished 2013.06.26 15:03:59 LOG7[10620:7792]: 0 client renegotiations requested 2013.06.26 15:03:59 LOG7[10620:7792]: 0 server connects (SSL_accept()) 2013.06.26 15:03:59 LOG7[10620:7792]: 0 server connects that finished 2013.06.26 15:03:59 LOG7[10620:7792]: 0 server renegotiations requested 2013.06.26 15:03:59 LOG7[10620:7792]: 1 session cache hits 2013.06.26 15:03:59 LOG7[10620:7792]: 0 external session cache hits 2013.06.26 15:03:59 LOG7[10620:7792]: 0 session cache misses 2013.06.26 15:03:59 LOG7[10620:7792]: 0 session cache timeouts 2013.06.26 15:03:59 LOG6[10620:7792]: SSL connected: previous session reused 2013.06.26 15:04:00 LOG6[10620:7792]: SSL socket closed (SSL_read) 2013.06.26 15:04:00 LOG7[10620:7792]: Sent socket write shutdown 2013.06.26 15:04:00 LOG5[10620:7792]: Connection closed: 65 byte(s) sent to SSL, 287 byte(s) sent to socket 2013.06.26 15:04:00 LOG7[10620:7792]: Remote socket (FD=368) closed 2013.06.26 15:04:00 LOG7[10620:7792]: Local socket (FD=364) closed 2013.06.26 15:04:00 LOG7[10620:7792]: Service [smtps] finished (0 left) 2013.06.26 15:04:00 LOG7[10620:10992]: Service [smtps] accepted (FD=372) from 192.168.1.2:2948 2013.06.26 15:04:00 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:04:00 LOG7[10620:10992]: New thread created 2013.06.26 15:04:00 LOG7[10620:12944]: Service [smtps] started 2013.06.26 15:04:00 LOG5[10620:12944]: Service [smtps] accepted connection from 192.168.1.2:2948 2013.06.26 15:04:00 LOG6[10620:12944]: connect_blocking: connecting 74.125.130.108:465 2013.06.26 15:04:00 LOG7[10620:12944]: connect_blocking: s_poll_wait 74.125.130.108:465: waiting 10 seconds 2013.06.26 15:04:00 LOG5[10620:12944]: connect_blocking: connected 74.125.130.108:465 2013.06.26 15:04:00 LOG5[10620:12944]: Service [smtps] connected remote server from 192.168.1.31:53642 2013.06.26 15:04:00 LOG7[10620:12944]: Remote socket (FD=368) initialized 2013.06.26 15:04:00 LOG7[10620:12944]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): before/connect initialization 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:04:00 LOG7[10620:12944]: SSL state (connect): SSLv3 flush data 2013.06.26 15:04:00 LOG7[10620:12944]: 1 items in the session cache 2013.06.26 15:04:00 LOG7[10620:12944]: 3 client connects (SSL_connect()) 2013.06.26 15:04:00 LOG7[10620:12944]: 3 client connects that finished 2013.06.26 15:04:00 LOG7[10620:12944]: 0 client renegotiations requested 2013.06.26 15:04:00 LOG7[10620:12944]: 0 server connects (SSL_accept()) 2013.06.26 15:04:00 LOG7[10620:12944]: 0 server connects that finished 2013.06.26 15:04:00 LOG7[10620:12944]: 0 server renegotiations requested 2013.06.26 15:04:00 LOG7[10620:12944]: 2 session cache hits 2013.06.26 15:04:00 LOG7[10620:12944]: 0 external session cache hits 2013.06.26 15:04:00 LOG7[10620:12944]: 0 session cache misses 2013.06.26 15:04:00 LOG7[10620:12944]: 0 session cache timeouts 2013.06.26 15:04:00 LOG6[10620:12944]: SSL connected: previous session reused 2013.06.26 15:04:01 LOG6[10620:12944]: SSL socket closed (SSL_read) 2013.06.26 15:04:01 LOG7[10620:12944]: Sent socket write shutdown 2013.06.26 15:04:01 LOG5[10620:12944]: Connection closed: 65 byte(s) sent to SSL, 290 byte(s) sent to socket 2013.06.26 15:04:01 LOG7[10620:12944]: Remote socket (FD=368) closed 2013.06.26 15:04:01 LOG7[10620:12944]: Local socket (FD=372) closed 2013.06.26 15:04:01 LOG7[10620:12944]: Service [smtps] finished (0 left) 2013.06.26 15:04:01 LOG7[10620:10992]: Service [smtps] accepted (FD=288) from 192.168.1.2:2949 2013.06.26 15:04:01 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:04:01 LOG7[10620:10992]: New thread created 2013.06.26 15:04:01 LOG7[10620:12900]: Service [smtps] started 2013.06.26 15:04:01 LOG5[10620:12900]: Service [smtps] accepted connection from 192.168.1.2:2949 2013.06.26 15:04:01 LOG6[10620:12900]: connect_blocking: connecting 74.125.130.109:465 2013.06.26 15:04:01 LOG7[10620:12900]: connect_blocking: s_poll_wait 74.125.130.109:465: waiting 10 seconds 2013.06.26 15:04:01 LOG5[10620:12900]: connect_blocking: connected 74.125.130.109:465 2013.06.26 15:04:01 LOG5[10620:12900]: Service [smtps] connected remote server from 192.168.1.31:53643 2013.06.26 15:04:01 LOG7[10620:12900]: Remote socket (FD=368) initialized 2013.06.26 15:04:01 LOG7[10620:12900]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): before/connect initialization 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:04:01 LOG7[10620:12900]: SSL state (connect): SSLv3 flush data 2013.06.26 15:04:01 LOG7[10620:12900]: 1 items in the session cache 2013.06.26 15:04:01 LOG7[10620:12900]: 4 client connects (SSL_connect()) 2013.06.26 15:04:01 LOG7[10620:12900]: 4 client connects that finished 2013.06.26 15:04:01 LOG7[10620:12900]: 0 client renegotiations requested 2013.06.26 15:04:01 LOG7[10620:12900]: 0 server connects (SSL_accept()) 2013.06.26 15:04:01 LOG7[10620:12900]: 0 server connects that finished 2013.06.26 15:04:01 LOG7[10620:12900]: 0 server renegotiations requested 2013.06.26 15:04:01 LOG7[10620:12900]: 3 session cache hits 2013.06.26 15:04:01 LOG7[10620:12900]: 0 external session cache hits 2013.06.26 15:04:01 LOG7[10620:12900]: 0 session cache misses 2013.06.26 15:04:01 LOG7[10620:12900]: 0 session cache timeouts 2013.06.26 15:04:01 LOG6[10620:12900]: SSL connected: previous session reused 2013.06.26 15:04:02 LOG6[10620:12900]: SSL socket closed (SSL_read) 2013.06.26 15:04:02 LOG7[10620:12900]: Sent socket write shutdown 2013.06.26 15:04:02 LOG5[10620:12900]: Connection closed: 65 byte(s) sent to SSL, 293 byte(s) sent to socket 2013.06.26 15:04:02 LOG7[10620:12900]: Remote socket (FD=368) closed 2013.06.26 15:04:02 LOG7[10620:12900]: Local socket (FD=288) closed 2013.06.26 15:04:02 LOG7[10620:12900]: Service [smtps] finished (0 left) 2013.06.26 15:04:02 LOG7[10620:10992]: Service [smtps] accepted (FD=292) from 192.168.1.2:2950 2013.06.26 15:04:02 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:04:02 LOG7[10620:10992]: New thread created 2013.06.26 15:04:02 LOG7[10620:11560]: Service [smtps] started 2013.06.26 15:04:02 LOG5[10620:11560]: Service [smtps] accepted connection from 192.168.1.2:2950 2013.06.26 15:04:02 LOG6[10620:11560]: connect_blocking: connecting 74.125.130.108:465 2013.06.26 15:04:02 LOG7[10620:11560]: connect_blocking: s_poll_wait 74.125.130.108:465: waiting 10 seconds 2013.06.26 15:04:02 LOG5[10620:11560]: connect_blocking: connected 74.125.130.108:465 2013.06.26 15:04:02 LOG5[10620:11560]: Service [smtps] connected remote server from 192.168.1.31:53644 2013.06.26 15:04:02 LOG7[10620:11560]: Remote socket (FD=368) initialized 2013.06.26 15:04:02 LOG7[10620:11560]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): before/connect initialization 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:04:02 LOG7[10620:11560]: SSL state (connect): SSLv3 flush data 2013.06.26 15:04:02 LOG7[10620:11560]: 1 items in the session cache 2013.06.26 15:04:02 LOG7[10620:11560]: 5 client connects (SSL_connect()) 2013.06.26 15:04:02 LOG7[10620:11560]: 5 client connects that finished 2013.06.26 15:04:02 LOG7[10620:11560]: 0 client renegotiations requested 2013.06.26 15:04:02 LOG7[10620:11560]: 0 server connects (SSL_accept()) 2013.06.26 15:04:02 LOG7[10620:11560]: 0 server connects that finished 2013.06.26 15:04:02 LOG7[10620:11560]: 0 server renegotiations requested 2013.06.26 15:04:02 LOG7[10620:11560]: 4 session cache hits 2013.06.26 15:04:02 LOG7[10620:11560]: 0 external session cache hits 2013.06.26 15:04:02 LOG7[10620:11560]: 0 session cache misses 2013.06.26 15:04:02 LOG7[10620:11560]: 0 session cache timeouts 2013.06.26 15:04:02 LOG6[10620:11560]: SSL connected: previous session reused 2013.06.26 15:04:03 LOG6[10620:11560]: SSL socket closed (SSL_read) 2013.06.26 15:04:03 LOG7[10620:11560]: Sent socket write shutdown 2013.06.26 15:04:03 LOG5[10620:11560]: Connection closed: 65 byte(s) sent to SSL, 296 byte(s) sent to socket 2013.06.26 15:04:03 LOG7[10620:11560]: Remote socket (FD=368) closed 2013.06.26 15:04:03 LOG7[10620:11560]: Local socket (FD=292) closed 2013.06.26 15:04:03 LOG7[10620:11560]: Service [smtps] finished (0 left) 2013.06.26 15:04:03 LOG7[10620:10992]: Service [smtps] accepted (FD=296) from 192.168.1.2:2951 2013.06.26 15:04:03 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:04:03 LOG7[10620:10992]: New thread created 2013.06.26 15:04:03 LOG7[10620:10092]: Service [smtps] started 2013.06.26 15:04:03 LOG5[10620:10092]: Service [smtps] accepted connection from 192.168.1.2:2951 2013.06.26 15:04:03 LOG6[10620:10092]: connect_blocking: connecting 74.125.130.109:465 2013.06.26 15:04:03 LOG7[10620:10092]: connect_blocking: s_poll_wait 74.125.130.109:465: waiting 10 seconds 2013.06.26 15:04:03 LOG5[10620:10092]: connect_blocking: connected 74.125.130.109:465 2013.06.26 15:04:03 LOG5[10620:10092]: Service [smtps] connected remote server from 192.168.1.31:53645 2013.06.26 15:04:03 LOG7[10620:10092]: Remote socket (FD=368) initialized 2013.06.26 15:04:03 LOG7[10620:10092]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): before/connect initialization 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:04:03 LOG7[10620:10092]: SSL state (connect): SSLv3 flush data 2013.06.26 15:04:03 LOG7[10620:10092]: 1 items in the session cache 2013.06.26 15:04:03 LOG7[10620:10092]: 6 client connects (SSL_connect()) 2013.06.26 15:04:03 LOG7[10620:10092]: 6 client connects that finished 2013.06.26 15:04:03 LOG7[10620:10092]: 0 client renegotiations requested 2013.06.26 15:04:03 LOG7[10620:10092]: 0 server connects (SSL_accept()) 2013.06.26 15:04:03 LOG7[10620:10092]: 0 server connects that finished 2013.06.26 15:04:03 LOG7[10620:10092]: 0 server renegotiations requested 2013.06.26 15:04:03 LOG7[10620:10092]: 5 session cache hits 2013.06.26 15:04:03 LOG7[10620:10092]: 0 external session cache hits 2013.06.26 15:04:03 LOG7[10620:10092]: 0 session cache misses 2013.06.26 15:04:03 LOG7[10620:10092]: 0 session cache timeouts 2013.06.26 15:04:03 LOG6[10620:10092]: SSL connected: previous session reused 2013.06.26 15:04:04 LOG6[10620:10092]: SSL socket closed (SSL_read) 2013.06.26 15:04:04 LOG7[10620:10092]: Sent socket write shutdown 2013.06.26 15:04:04 LOG5[10620:10092]: Connection closed: 65 byte(s) sent to SSL, 290 byte(s) sent to socket 2013.06.26 15:04:04 LOG7[10620:10092]: Remote socket (FD=368) closed 2013.06.26 15:04:04 LOG7[10620:10092]: Local socket (FD=296) closed 2013.06.26 15:04:04 LOG7[10620:10092]: Service [smtps] finished (0 left) 2013.06.26 15:04:04 LOG7[10620:10992]: Service [smtps] accepted (FD=364) from 192.168.1.2:2952 2013.06.26 15:04:04 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:04:04 LOG7[10620:10992]: New thread created 2013.06.26 15:04:04 LOG7[10620:1404]: Service [smtps] started 2013.06.26 15:04:04 LOG5[10620:1404]: Service [smtps] accepted connection from 192.168.1.2:2952 2013.06.26 15:04:04 LOG6[10620:1404]: connect_blocking: connecting 74.125.130.108:465 2013.06.26 15:04:04 LOG7[10620:1404]: connect_blocking: s_poll_wait 74.125.130.108:465: waiting 10 seconds 2013.06.26 15:04:04 LOG5[10620:1404]: connect_blocking: connected 74.125.130.108:465 2013.06.26 15:04:04 LOG5[10620:1404]: Service [smtps] connected remote server from 192.168.1.31:53646 2013.06.26 15:04:04 LOG7[10620:1404]: Remote socket (FD=368) initialized 2013.06.26 15:04:04 LOG7[10620:1404]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:04:04 LOG7[10620:1404]: SSL state (connect): before/connect initialization 2013.06.26 15:04:04 LOG7[10620:1404]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:04:05 LOG7[10620:1404]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:04:05 LOG7[10620:1404]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:04:05 LOG7[10620:1404]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:04:05 LOG7[10620:1404]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:04:05 LOG7[10620:1404]: SSL state (connect): SSLv3 flush data 2013.06.26 15:04:05 LOG7[10620:1404]: 1 items in the session cache 2013.06.26 15:04:05 LOG7[10620:1404]: 7 client connects (SSL_connect()) 2013.06.26 15:04:05 LOG7[10620:1404]: 7 client connects that finished 2013.06.26 15:04:05 LOG7[10620:1404]: 0 client renegotiations requested 2013.06.26 15:04:05 LOG7[10620:1404]: 0 server connects (SSL_accept()) 2013.06.26 15:04:05 LOG7[10620:1404]: 0 server connects that finished 2013.06.26 15:04:05 LOG7[10620:1404]: 0 server renegotiations requested 2013.06.26 15:04:05 LOG7[10620:1404]: 6 session cache hits 2013.06.26 15:04:05 LOG7[10620:1404]: 0 external session cache hits 2013.06.26 15:04:05 LOG7[10620:1404]: 0 session cache misses 2013.06.26 15:04:05 LOG7[10620:1404]: 0 session cache timeouts 2013.06.26 15:04:05 LOG6[10620:1404]: SSL connected: previous session reused 2013.06.26 15:04:05 LOG6[10620:1404]: SSL socket closed (SSL_read) 2013.06.26 15:04:05 LOG7[10620:1404]: Sent socket write shutdown 2013.06.26 15:04:05 LOG5[10620:1404]: Connection closed: 65 byte(s) sent to SSL, 290 byte(s) sent to socket 2013.06.26 15:04:05 LOG7[10620:1404]: Remote socket (FD=368) closed 2013.06.26 15:04:05 LOG7[10620:1404]: Local socket (FD=364) closed 2013.06.26 15:04:05 LOG7[10620:1404]: Service [smtps] finished (0 left) 2013.06.26 15:04:05 LOG7[10620:10992]: Service [smtps] accepted (FD=372) from 192.168.1.2:2953 2013.06.26 15:04:05 LOG7[10620:10992]: Creating a new thread 2013.06.26 15:04:05 LOG7[10620:10992]: New thread created 2013.06.26 15:04:05 LOG7[10620:11904]: Service [smtps] started 2013.06.26 15:04:05 LOG5[10620:11904]: Service [smtps] accepted connection from 192.168.1.2:2953 2013.06.26 15:04:05 LOG6[10620:11904]: connect_blocking: connecting 74.125.130.109:465 2013.06.26 15:04:05 LOG7[10620:11904]: connect_blocking: s_poll_wait 74.125.130.109:465: waiting 10 seconds 2013.06.26 15:04:06 LOG5[10620:11904]: connect_blocking: connected 74.125.130.109:465 2013.06.26 15:04:06 LOG5[10620:11904]: Service [smtps] connected remote server from 192.168.1.31:53647 2013.06.26 15:04:06 LOG7[10620:11904]: Remote socket (FD=368) initialized 2013.06.26 15:04:06 LOG7[10620:11904]: SNI: sending servername: smtp.gmail.com 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): before/connect initialization 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): SSLv3 write client hello A 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): SSLv3 read server hello A 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): SSLv3 read finished A 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): SSLv3 write finished A 2013.06.26 15:04:06 LOG7[10620:11904]: SSL state (connect): SSLv3 flush data 2013.06.26 15:04:06 LOG7[10620:11904]: 1 items in the session cache 2013.06.26 15:04:06 LOG7[10620:11904]: 8 client connects (SSL_connect()) 2013.06.26 15:04:06 LOG7[10620:11904]: 8 client connects that finished 2013.06.26 15:04:06 LOG7[10620:11904]: 0 client renegotiations requested 2013.06.26 15:04:06 LOG7[10620:11904]: 0 server connects (SSL_accept()) 2013.06.26 15:04:06 LOG7[10620:11904]: 0 server connects that finished 2013.06.26 15:04:06 LOG7[10620:11904]: 0 server renegotiations requested 2013.06.26 15:04:06 LOG7[10620:11904]: 7 session cache hits 2013.06.26 15:04:06 LOG7[10620:11904]: 0 external session cache hits 2013.06.26 15:04:06 LOG7[10620:11904]: 0 session cache misses 2013.06.26 15:04:06 LOG7[10620:11904]: 0 session cache timeouts 2013.06.26 15:04:06 LOG6[10620:11904]: SSL connected: previous session reused 2013.06.26 15:04:06 LOG6[10620:11904]: SSL socket closed (SSL_read) 2013.06.26 15:04:06 LOG7[10620:11904]: Sent socket write shutdown 2013.06.26 15:04:06 LOG5[10620:11904]: Connection closed: 65 byte(s) sent to SSL, 290 byte(s) sent to socket 2013.06.26 15:04:06 LOG7[10620:11904]: Remote socket (FD=368) closed 2013.06.26 15:04:06 LOG7[10620:11904]: Local socket (FD=372) closed 2013.06.26 15:04:06 LOG7[10620:11904]: Service [smtps] finished (0 left) From: Stephen Gates [mailto:[email protected]] Sent: Wednesday, June 26, 2013 2:25 PM To: 'stunnel-users(a)stunnel.org' Subject: Sending Email from PLC Without Authentication with gmail A customer needs to send emails from a Programmable Logic Controller (PLC) which cannot provide authentication. The customer's email server is gmail which obviously requires authentication. The PLC IP is 192.168.1.2 and the PC IP on which stunnel is installed is 192.168.1.31 My config is: cert = stunnel.pem [smtps] client = yes accept = 25 connect = smtp.gmail.com:465 The PLC is set up to send emails to the IP of the PC 192.168.1.31 When I try to send emails I get the following in the stunnel log: 2013.06.26 14:26:30 LOG5[12384:13048]: Service [smtps] accepted connection from 192.168.1.2:2938 2013.06.26 14:26:30 LOG5[12384:13048]: connect_blocking: connected 74.125.130.108:465 2013.06.26 14:26:30 LOG5[12384:13048]: Service [smtps] connected remote server from 192.168.1.31:53599 Any help would be greatly appreciated! Stephen Gates Harold K. Scholz Company 7800 Serum Avenue Ralston, NE 68127 402-339-7600

1 0

Re: [stunnel-users] "Broken pipe" issue
by Ron McWilliams 21 Jun '13

21 Jun '13

I have the same issue with the broken pipe on my stunnel. Here is the revealing log clip. appsadmin@MIRTHTEST:/etc/stunnel.d$ sudo tail -f /var/log/stunnel_mirth.log 2013.06.21 17:28:03 LOG7[30980:3077569344]: Service hl7_client prod finished (1 left) 2013.06.21 17:28:03 LOG7[30980:3077569344]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) 2013.06.21 17:28:14 LOG6[30980:3073227584]: SSL connected: previous session reused 2013.06.21 17:28:14 LOG7[30980:3073227584]: Socket closed on read 2013.06.21 17:28:14 LOG7[30980:3073227584]: Sending SSL write shutdown 2013.06.21 17:28:14 LOG6[30980:3073227584]: SSL_shutdown successfully sent close_notify 2013.06.21 17:28:24 LOG5[30980:3073227584]: Error detected on socket (read) file descriptor: Broken pipe (32) 2013.06.21 17:28:24 LOG5[30980:3073227584]: Connection reset: 661 bytes sent to SSL, 124 bytes sent to socket 2013.06.21 17:28:24 LOG7[30980:3073227584]: Service hl7_client prod finished (0 left) 2013.06.21 17:28:24 LOG7[30980:3073227584]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) Was there a simple edit to the conf file and if so, could you send the sample settings. Thank you, rmcwilli

1 0

Re: [stunnel-users] Broken pipes and TCP resets on parallel requests over stunnel
by Ron McWilliams 21 Jun '13

21 Jun '13

I have essentially the same issue. We were successfully sending messages and receiving ACK prior to this glitch. I am on Ubuntu 12.04 LTS using stunnel 4.50. appsadmin@MIRTHTEST:/etc/stunnel.d$ sudo tail -f /var/log/stunnel_mirth.log 2013.06.21 17:28:03 LOG7[30980:3077569344]: Service hl7_client prod finished (1 left) 2013.06.21 17:28:03 LOG7[30980:3077569344]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) 2013.06.21 17:28:14 LOG6[30980:3073227584]: SSL connected: previous session reused 2013.06.21 17:28:14 LOG7[30980:3073227584]: Socket closed on read 2013.06.21 17:28:14 LOG7[30980:3073227584]: Sending SSL write shutdown 2013.06.21 17:28:14 LOG6[30980:3073227584]: SSL_shutdown successfully sent close_notify 2013.06.21 17:28:24 LOG5[30980:3073227584]: Error detected on socket (read) file descriptor: Broken pipe (32) 2013.06.21 17:28:24 LOG5[30980:3073227584]: Connection reset: 661 bytes sent to SSL, 124 bytes sent to socket 2013.06.21 17:28:24 LOG7[30980:3073227584]: Service hl7_client prod finished (0 left) 2013.06.21 17:28:24 LOG7[30980:3073227584]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) rmcwilli

1 0

certificate verify failed
by Roman Tuchyna 19 Jun '13

19 Jun '13

Hi All, I'm trying to create SSl tunnel between my server (Win 2008 R2, 4.56 version of stunnel) and remote application server - I have merged both root and sub certificate into 1 file and it looks like it can verify them and accept them as well, but then it tries to verify it at depth=0 and says certificate not found in local repository. Am I missing anything here ? (I modified messages to not disclose details of certificates in the debug below). Thank you! BR, Roman 2013.06.18 11:22:34 LOG7[272:2156]: Service [SZX] started 2013.06.18 11:22:34 LOG5[272:2156]: Service [SZX] accepted connection from 127.0.0.1:49397 2013.06.18 11:22:34 LOG6[272:2156]: connect_blocking: connecting 10.254.0.21:443 2013.06.18 11:22:34 LOG7[272:2156]: connect_blocking: s_poll_wait 10.254.0.21:443: waiting 10 seconds 2013.06.18 11:22:34 LOG5[272:2156]: connect_blocking: connected 10.254.0.21:443 2013.06.18 11:22:34 LOG5[272:2156]: Service [SZX] connected remote server from 192.168.20.23:49398 2013.06.18 11:22:34 LOG7[272:2156]: Remote socket (FD=396) initialized 2013.06.18 11:22:34 LOG7[272:2156]: SNI: sending servername: 10.254.0.21 2013.06.18 11:22:34 LOG7[272:2156]: SSL state (connect): before/connect initialization 2013.06.18 11:22:34 LOG7[272:2156]: SSL state (connect): SSLv3 write client hello A 2013.06.18 11:22:34 LOG7[272:2156]: SSL state (connect): SSLv3 read server hello A 2013.06.18 11:22:34 LOG7[272:2156]: Starting certificate verification: depth=2, /CN=xxx RootCA 2013.06.18 11:22:34 LOG5[272:2156]: Certificate accepted: depth=2, /CN=xxx RootCA 2013.06.18 11:22:34 LOG7[272:2156]: Starting certificate verification: depth=1, /CN=xxx 2013.06.18 11:22:34 LOG5[272:2156]: Certificate accepted: depth=1, /CN=xxx SubCA1 2013.06.18 11:22:34 LOG7[272:2156]: Starting certificate verification: depth=0, /C=zzz 2013.06.18 11:22:34 LOG4[272:2156]: CERT: Certificate not found in local repository 2013.06.18 11:22:34 LOG4[272:2156]: Certificate check failed: depth=0, /C=zzz 2013.06.18 11:22:34 LOG7[272:2156]: SSL alert (write): fatal: certificate unknown 2013.06.18 11:22:34 LOG3[272:2156]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2013.06.18 11:22:34 LOG5[272:2156]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.06.18 11:22:34 LOG7[272:2156]: Remote socket (FD=396) closed 2013.06.18 11:22:34 LOG7[272:2156]: Local socket (FD=376) closed 2013.06.18 11:22:34 LOG7[272:2156]: Service [SZX] finished (0 left)

3 2

stunnel RHEL 6.3 and HTTPS header fields
by xxxxxxxxxxxxxxxxx 16 Jun '13

16 Jun '13

I'm an Stunnel newbie so forgive me if this question has been asked previously. I am using stunnel to accept a connection from http://127.0.0.1:someport/url/to/wsdland connect to hostname.somewhere.abc:443 Everything is working fine with the exception of a certain endpoint that responds with an HTTP status code of 403 "forbidden". What I have determined is that the server is rejecting the request due to the HTTP "Host:" field value, it's set to 127.0.0.1. Is there anyway to pass the value of the config file "connect" property instead (in my case "hostname.somewhere")?I have tried various config settings without success. Config entry: [testnesiis]client = yesaccept = 127.0.0.1:1445connect = testnesiis:443;protocolHost = testnesiis:443protocol = proxy;sni = testnesiis;transparent = both Thanks and Kudos to the authors of stunnel !

2 1

Certificate failure to verify with verify = 4 option
by Thomas Eifert 16 Jun '13

16 Jun '13

Greetings; Stunnel 4.56 running under Win 7 SP1 x86. Recently, the owners of a server I regularly connect to updated their server certificate; the former had expired at the end of May. As soon as that event occurred, I deleted the old certificate, then used the "save peer certificate" function of Stunnel to get the updated one. However, the new certificate fails to verify, even with the verify = 4 option in Stunnel. The error message is similar to what I used to get when doing a verify = 3 with some certificates. The general error output of Stunnel is: CERT: Verification error: unable to get local issuer certificate 2013.06.09 16:37:46 LOG4[608:2336]: Certificate check failed: depth=0 When I open the new certificate with: openssl x509 -text -in certname.pem and view the certificate details, I'm not seeing anything obvious. The certificate is within a valid date range, and contains the same basic elements as other certs I've viewed. The certificate appears to have been issued by Startcom LLC. If I comment out the verify statement, I'm able to successfully negotiate an SSL connection with the server. I realize that this may be more of an openssl issue than an issue with Stunnel. Nevertheless, I thought I'd start here and throw it out to the floor for comments. Anyone have any ideas or have run into this issue? Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 2

tuning/multiple stunnel instance
by William Kwan 13 Jun '13

13 Jun '13

Dear all, I would like to find out if there's anyway to tune stunnel or what's the best practice you would recommend. I have a bit more than 100 sessions defined in stunnel.conf. It appears that clients started to see latency increase. Would you say 1. Split the conf file to multiple conf files and start multiple stunnel with each conf file? 2. Any way to tune stunnel to run muliple process with more threads? 3. Any other options? Thanks Will

2 1

stunnel doesn't create tunnel
by Roman Tuchyna 13 Jun '13

13 Jun '13

Hi All, I'm trying to create SSL tunnel between my server and remote application server and according to log file, stunnel fails to 0.0.0.0:43 Service [SZR] (FD=716) bound to 0.0.0.0:443 (although connect and accept are configured for this service). I'm using stunnel on Windows and apparently I'm doing something wrong - any hint or advice would be appreciated. I was searching for the reason, but couldn't find any pointer... Thank you! BR, Roman 2013.06.13 16:25:19 LOG7[2884:3032]: Dispatching signals from the signal pipe 2013.06.13 16:25:19 LOG7[2884:3032]: Processing SIGNAL_RELOAD_CONFIG 2013.06.13 16:25:19 LOG5[2884:3032]: Reading configuration from file stunnel.conf 2013.06.13 16:25:19 LOG5[2884:3032]: FIPS mode is enabled 2013.06.13 16:25:19 LOG7[2884:3032]: Compression not enabled 2013.06.13 16:25:19 LOG7[2884:3032]: Snagged 64 random bytes from C:/.rnd 2013.06.13 16:25:19 LOG7[2884:3032]: Wrote 1024 new random bytes to C:/.rnd 2013.06.13 16:25:19 LOG7[2884:3032]: PRNG seeded successfully 2013.06.13 16:25:19 LOG6[2884:3032]: Initializing service [SZR] 2013.06.13 16:25:19 LOG7[2884:3032]: Loaded verify certificates from SZR.pem 2013.06.13 16:25:19 LOG7[2884:3032]: Loaded SZR.pem revocation lookup file 2013.06.13 16:25:19 LOG7[2884:3032]: SSL options set: 0x01000004 2013.06.13 16:25:19 LOG5[2884:3032]: Configuration successful 2013.06.13 16:25:19 LOG7[2884:3032]: Closing service [SZR] 2013.06.13 16:25:19 LOG7[2884:3032]: Service [SZR] closed (FD=716) 2013.06.13 16:25:19 LOG7[2884:3032]: Sessions cached before flush: 0 2013.06.13 16:25:19 LOG7[2884:3032]: Sessions cached after flush: 0 2013.06.13 16:25:19 LOG7[2884:3032]: Service [SZR] closed 2013.06.13 16:25:19 LOG7[2884:3032]: Service [SZR] (FD=716) bound to 0.0.0.0:443 2013.06.13 16:25:19 LOG7[2884:3032]: Signal pipe is empty

1 0

Re: [stunnel-users] Getting Stunnel working with Verizon.net SMTP
by Gary Kuznitz 13 Jun '13

13 Jun '13

Hi Jochen, With your help I selected "Do not use CRAM-MD5 authentication even if it is advertised" It's now woking. Thank you very much for your help. Do you know if there is any way to remove the emails with the user name and password from the archives? Thanks, Gary On 12 Jun 2013 at 23:08, Jochen (Jochen Bern <Jochen.Bern(a)LINworks.de>) commented about Re: [stunnel-users] Getting Stunnel working with : > On 12.06.2013 21:28, Gary Kuznitz wrote: > > On your first post I didn't see the difference in port numbers. I have corrected that. > > I'm getting this log from my email client: > > --- Wed, 12 Jun 2013 12:22:46 --- > > Connect to 'localhost' port 10115, timeout 60. > > 12:22:46.960 [*] Connection established to 127.0.0.1 > > 12:22:47.226 >> 0120 220 vms173007pub.verizon.net -- Server ESMTP (Sun Java(tm) > > System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))\0D\0A > > First and foremost, this shows that your e-mail client can now talk to > the server, which means that stunnel's job (the SSL negotiation) gets > done successfully. > > > 12:22:47.288 >> 0042 250-AUTH DIGEST-MD5 PLAIN LOGIN CRAM-MD5\0D\0A > > 12:22:47.288 >> 0022 250-AUTH=LOGIN PLAIN\0D\0A > > This part of the server's reply to the EHLO command shows the auth > mechanisms the server supports; CRAM-MD5 is listed ... > > > 12:22:47.288 << 0015 AUTH CRAM-MD5\0D\0A > > ... and your client requests it. > > > 12:22:47.335 >> 0050 334 PDEzNTYyOTY5MjEuMTIxMTA1NTFAdm1zMTczMDA3Pg==\0D\0A > > The servers issues (a base64 encoded version of) > "<1356296921.12110551@vms173007>" as a "random" string challenge. > > > 12:22:47.335 << 0058 YXR1cHJlcyBkYTlmZTI3MWFjODNjYWUxOTVjNmZhZWQ5ZGE0NTUzYg==\0D\0A > > This is a base64 encoded version of "atupres > da9fe271ac83cae195c6faed9da4553b". "atupres" should be your username and > da9fe271ac83cae195c6faed9da4553b the HMAC-MD5 digest of the challenge > with your password as the key. > > I don't know a tool to compute HMAC-MD5 digests that is readily > available under Windows, I'm afraid. If you're desperate, try > http://www.freeformatter.com/hmac-generator.html > (note that they won't know a) on which server and b) with what username > you'll be using the password ...). > > > 12:22:47.397 >> 0066 500 5.7.0 Unknown AUTH error -1 (Internal authentication error).\0D\0A > > ... and there the server says it cannot verify that. > > > Do you have any idea why I am getting [that]? > > I can think of several *possible* reasons, but ultimately, the server > doesn't tell us what exactly is wrong. > > 1. It may be that the server is announcing CRAM-MD5 auth though it > actually does *not* support it. (The DIGEST-MD5 and CRAM-MD5 mechs > require that the server *knows* the (plaintext) password, while for > PLAIN and LOGIN, storing only a hash of the password is enough, and > foils attackers who manage to steal a copy of the password database.) > Enforcing use of a different mechanism can probably be done through > your e-mail client's settings, but I'm afraid that it's usually > rather cryptic how exactly to do that ... > If you want to have a *manual* try at another mech, here's a web > page explaining what to input for PLAIN and LOGIN: > http://www.gadgetwiz.com/protocols/smtp-auth-example.html > and here's an MS KB article with a base64 en-/decoder: > http://support.microsoft.com/kb/191239 > Problem is that the strings to be base64 encoded are supposed *not* > to have an end-of-line, and sometimes even to contain NUL bytes > ("\0") ... Verify that your method of choice properly reproduces the > examples in the howto page. :-C > 2. I'm a bit surprised that your username supposedly is "atupres", > rather than "atupres(a)your.dom.ain", "atupres%your.dom.ain" or > something to that effect ... ? > 3. The obvious one, a mistyped password ... > > Regards, > J. Bern > -- > *NEU* - NEC IT-Infrastruktur-Produkte im <http://www.linworks-shop.de/>: > Server--Storage--Virtualisierung--Management SW--Passion for Performance > Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> > Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt > PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 > Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 > Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

2 1

Re: [stunnel-users] Getting Stunnel working with Verizon.net SMTP
by Gary Kuznitz 12 Jun '13

12 Jun '13

Thank you very much for working with me on resolving this. On your first post I didn't see the difference in port numbers. I have corrected that. Thank you for catching it. It did get me closer to resolving the issue. I'm getting this log from my email client: --- Wed, 12 Jun 2013 12:22:46 --- Connect to 'localhost' port 10115, timeout 60. 12:22:46.960 [*] Connection established to 127.0.0.1 12:22:47.226 >> 0120 220 vms173007pub.verizon.net -- Server ESMTP (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))\0D\0A 12:22:47.226 << 0023 EHLO [192.168.168.11]\0D\0A 12:22:47.288 >> 0030 250-vms173007pub.verizon.net\0D\0A 12:22:47.288 >> 0014 250-8BITMIME\0D\0A 12:22:47.288 >> 0016 250-PIPELINING\0D\0A 12:22:47.288 >> 0014 250-CHUNKING\0D\0A 12:22:47.288 >> 0009 250-DSN\0D\0A 12:22:47.288 >> 0025 250-ENHANCEDSTATUSCODES\0D\0A 12:22:47.288 >> 0010 250-HELP\0D\0A 12:22:47.288 >> 0044 250-XLOOP AD6DF29B04183351BAD9935B9A483ABE\0D\0A 12:22:47.288 >> 0042 250-AUTH DIGEST-MD5 PLAIN LOGIN CRAM-MD5\0D\0A 12:22:47.288 >> 0022 250-AUTH=LOGIN PLAIN\0D\0A 12:22:47.288 >> 0010 250-ETRN\0D\0A 12:22:47.288 >> 0019 250-NO-SOLICITING\0D\0A 12:22:47.288 >> 0019 250 SIZE 20971520\0D\0A 12:22:47.288 << 0015 AUTH CRAM-MD5\0D\0A 12:22:47.335 >> 0050 334 PDEzNTYyOTY5MjEuMTIxMTA1NTFAdm1zMTczMDA3Pg==\0D\0A 12:22:47.335 << 0058 YXR1cHJlcyBkYTlmZTI3MWFjODNjYWUxOTVjNmZhZWQ5ZGE0NTUzYg==\0D\0A 12:22:47.397 >> 0066 500 5.7.0 Unknown AUTH error -1 (Internal authentication error).\0D\0A 12:22:50.845 << 0006 QUIT\0D\0A 12:22:50.892 >> 0034 221 2.3.0 Bye received. Goodbye.\0D\0A 12:22:50.892 --- Connection closed normally at Wed, 12 Jun 2013 12:22:50. ---\0A\0A I'm getting this in the Stunnel.log 2013.06.12 12:22:46 LOG7[660:2460]: New thread created 2013.06.12 12:22:46 LOG7[660:896]: Service [Verizon-smtp] started 2013.06.12 12:22:46 LOG5[660:896]: Service [Verizon-smtp] accepted connection from 127.0.0.1:52721 2013.06.12 12:22:46 LOG6[660:896]: connect_blocking: connecting 206.46.232.12:465 2013.06.12 12:22:46 LOG7[660:896]: connect_blocking: s_poll_wait 206.46.232.12:465: waiting 10 seconds 2013.06.12 12:22:46 LOG5[660:896]: connect_blocking: connected 206.46.232.12:465 2013.06.12 12:22:46 LOG5[660:896]: Service [Verizon-smtp] connected remote server from 192.168.168.11:52722 2013.06.12 12:22:46 LOG7[660:896]: Remote socket (FD=384) initialized 2013.06.12 12:22:46 LOG7[660:896]: SNI: sending servername: outgoing.verizon.net 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): before/connect initialization 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 write client hello A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 read server hello A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 read server certificate A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 read server key exchange A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 read server done A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 write client key exchange A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 write finished A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 flush data 2013.06.12 12:22:47 LOG7[660:896]: SSL state (connect): SSLv3 read finished A 2013.06.12 12:22:47 LOG7[660:896]: 2 items in the session cache 2013.06.12 12:22:47 LOG7[660:896]: 2 client connects (SSL_connect()) 2013.06.12 12:22:47 LOG7[660:896]: 2 client connects that finished 2013.06.12 12:22:47 LOG7[660:896]: 0 client renegotiations requested 2013.06.12 12:22:47 LOG7[660:896]: 0 server connects (SSL_accept()) 2013.06.12 12:22:47 LOG7[660:896]: 0 server connects that finished 2013.06.12 12:22:47 LOG7[660:896]: 0 server renegotiations requested 2013.06.12 12:22:47 LOG7[660:896]: 0 session cache hits 2013.06.12 12:22:47 LOG7[660:896]: 0 external session cache hits 2013.06.12 12:22:47 LOG7[660:896]: 0 session cache misses 2013.06.12 12:22:47 LOG7[660:896]: 0 session cache timeouts 2013.06.12 12:22:47 LOG6[660:896]: SSL connected: new session negotiated 2013.06.12 12:22:47 LOG6[660:896]: Negotiated TLSv1/SSLv3 ciphersuite: DHE-RSA-AES256-SHA (256-bit encryption) 2013.06.12 12:22:47 LOG6[660:896]: Compression: null, expansion: null 2013.06.12 12:22:50 LOG6[660:896]: Read socket closed (readsocket) 2013.06.12 12:22:50 LOG7[660:896]: Sending close_notify alert 2013.06.12 12:22:50 LOG7[660:896]: SSL alert (write): warning: close notify 2013.06.12 12:22:50 LOG6[660:896]: SSL_shutdown successfully sent close_notify alert 2013.06.12 12:22:50 LOG7[660:896]: SSL alert (read): warning: close notify 2013.06.12 12:22:50 LOG6[660:896]: SSL closed (SSL_read) 2013.06.12 12:22:50 LOG7[660:896]: Sent socket write shutdown 2013.06.12 12:22:50 LOG5[660:896]: Connection closed: 102 byte(s) sent to SSL, 544 byte(s) sent to socket 2013.06.12 12:22:50 LOG7[660:896]: Remote socket (FD=384) closed 2013.06.12 12:22:50 LOG7[660:896]: Local socket (FD=216) closed 2013.06.12 12:22:50 LOG7[660:896]: Service [Verizon-smtp] finished (0 left) Do you have any idea why I am getting: 12:22:47.397 >> 0066 500 5.7.0 Unknown AUTH error -1 (Internal authentication error).\0D\0A Thank you, Gary On 12 Jun 2013 at 20:36, Jochen (Jochen Bern <Jochen.Bern(a)LINworks.de>) commented about Re: [stunnel-users] Getting Stunnel working with : > On 12.06.2013 19:48, Gary Kuznitz wrote: > > Thanks for showing me how to test SSL. I installed openssl and ran the test. This is > > what I received back. > > > > C:\Programs\OpenSSL-Win32\bin>openssl s_client -connect smtp.verizon.net:465 > [...] > > Verify return code: 19 (self signed certificate in certificate chain) > > --- > > At this point, the SSL layer of the connection has been set up (s_client > ignores the non-null verification result) and the actual payload > protocol can start to do its thing. The payload protocol is SMTP, so the > server throws you a hello line: > > > 220 vms173025pub.verizon.net -- Server ESMTP (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009)) > > and then waits for the client to send its requests. Since you apparently > didn't enter anything, the server obviously terminated the connection with: > > > 421 4.4.2 Timeout while waiting for command. > > An actual SMTP session with an *attempt* at transferring an e-mail would > look like, e.g.: > > > 220 vms173023pub.verizon.net -- Server ESMTP (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009)) > > HELO this.is.my.laptop > > 250 vms173023pub.verizon.net OK, [unknown] [213.157.4.156]. > > MAIL FROM:<Jochen.Bern(a)LINworks.de> > > 550 5.7.1 Authentication Required > > rSET > > 250 2.5.0 Ok. > > QUIT > > (The lines starting with a three-digit SMTP status code number are sent > by the server; the 5xx code signals a permanent error; the lines > starting with a four-letter SMTP command are sent by the client, i.e., I > typed them into the s_client; and I typed "rSET" instead of the normal > "RSET" because s_client takes every line starting with an *uppercase* > 'R' as a command to do an SSL renegotiation.) > > > It sounds like something is wrong on this end. Any ideas? > > What about the two *****DIFFERING***** port numbers I pointed out in > your posted data? > > >> On 12.06.2013 05:12, Gary Kuznitz wrote: > >>> [Verizon-smtp] > >>> client = yes > >>> accept = 11015 > >> ^##^^ > >> [...] > >>> --- Tue, 11 Jun 2013 16:38:55 --- > >>> Connect to 'localhost' port 10115, timeout 60. > >> ^##^^ > > I don't actually use stunnel (subscribed to the list when I had a need > that I later fulfilled with socat, but that's Unix/Linux only), so I > don't know whether stunnel has a problem with the self-signed cert ... > > Regards, > J. Bern > -- > *NEU* - NEC IT-Infrastruktur-Produkte im <http://www.linworks-shop.de/>: > Server--Storage--Virtualisierung--Management SW--Passion for Performance > Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> > Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt > PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 > Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 > Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

1 0

Getting Stunnel working with Verizon.net SMTP
by Gary Kuznitz 12 Jun '13

12 Jun '13

I can't seem to connect with email at Verizon.net SMTP. I can connect with POP3. The Stunnel.log shows: 2013.06.11 19:27:04 LOG5[3752:2524]: stunnel 4.56 on x86-pc-msvc-1500 platform 2013.06.11 19:27:04 LOG5[3752:2524]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 2013.06.11 19:27:04 LOG5[3752:2524]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2013.06.11 19:27:04 LOG5[3752:2524]: Reading configuration from file stunnel.conf 2013.06.11 19:27:04 LOG5[3752:2524]: FIPS mode is enabled 2013.06.11 19:27:04 LOG5[3752:2524]: Configuration successful I have IPv6 turned off in my network settings. The Stunnel.conf looks like this: output = stunnel.log cert = stunnel.pem options = NO_SSLv2 [Verizon-pop3] client = yes accept = 11014 connect = pop.verizon.net:995 delay = yes [Verizon-smtp] client = yes accept = 11015 connect = smtp.verizon.net:465 delay = yes I do not have SSL turned on in my email client. The log from my email client looks like this: --- Tue, 11 Jun 2013 16:38:55 --- Connect to 'localhost' port 10115, timeout 60. 16:38:56.897 15: Peer connect failure (the host has refused the connection). The Verizon account is FIOS. I am not connected directly to the Verizon ISP. I can't send email without SSL. Does anyone have any idea how I can get this working? Thanks, Gary Kuznitz

3 4

Certificate failure to verify with verify = 4 option
by Thomas Eifert 10 Jun '13

10 Jun '13

Correction: The cert issuer is Startcom Ltd, not Startcom LLC. -- Greetings; Stunnel 4.56 running under Win 7 SP1 x86. Recently, the owners of a server I regularly connect to updated their server certificate; the former had expired at the end of May. As soon as that event occurred, I deleted the old certificate, then used the "save peer certificate" function of Stunnel to get the updated one. However, the new certificate fails to verify, even with the verify = 4 option in Stunnel. The error message is similar to what I used to get when doing a verify = 3 with some certificates. The general error output of Stunnel is: CERT: Verification error: unable to get local issuer certificate 2013.06.09 16:37:46 LOG4[608:2336]: Certificate check failed: depth=0 When I open the new certificate with: openssl x509 -text -in certname.pem and view the certificate details, I'm not seeing anything obvious. The certificate is within a valid date range, and contains the same basic elements as other certs I've viewed. The certificate appears to have been issued by Startcom LLC. If I comment out the verify statement, I'm able to successfully negotiate an SSL connection with the server. I realize that this may be more of an openssl issue than an issue with Stunnel. Nevertheless, I thought I'd start here and throw it out to the floor for comments. Anyone have any ideas or have run into this issue? Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

3 3

weird stunnel problem
by Stephen Griffin 03 Jun '13

03 Jun '13

Hello A few days ago we ran into issue where the number of stunnel threads sky rocketed to over 3000 open stunnel threads. When this happen connections to our website slowed down considerably or failed to connect. It was resolved by flipping to our other proxy which accepted any new connections. It took about 5 minutes for the threads to die off on the other proxy. I was wondering if anyone has come across this problem? Here are some details of our stunnel version and config. Stunnel 4.44 with patch for x-forwarder [root@brm-proxy01 ~]# stunnel -version stunnel 4.44 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 Global options: debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 session = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none appriacated Our stunnel.conf. /etc/stunnel/stunnel.conf #sslVersion = TLSv1 pid = /var/run/stunnel.pid syslog = yes output = /var/log/stunnel.log debug = 3 [https] cert = /etc/stunnel/ssl/wildcard.blah.com.pem accept = 443 connect = 80 xforwardedfor = yes TIMEOUTbusy = 300 TIMEOUTclose = 0 TIMEOUTconnect = 10 TIMEOUTidle = 60 Is there anything we could add for performance tuning in stunnel? Any suggestions on what I could look for when this happens again would be appreciated. Our platform does between 2000 to 3000 rpm (request per minute) during peak hours. We constantly see a lot of these messages every hour but I am not sure what is happening as the connections seem to be working. SSL_accept: Peer suddenly disconnected There was a higher spike of them as per the normal rate during our incident described above. Thanks Stephen Griffin Sr. System Administrator www.achievers.com<http://www.achievers.com/> Confidentiality: The information contained in this e-mail and any attachments are confidential. If you are not the intended recipient, you may not copy or distribute this information. If you have received this communication in error, please notify the sender immediately and delete it from your system.

1 0

x-forwarded-for.patch for stunnel 4.55/4.56
by Shannon Carver 17 May '13

17 May '13

Hi all, Just wondering if anyone know's a an xforwardedfor patch available for the latest versions of stunnel? Thanks Shannon Carver

2 1

Strange Stunnel crash (no errors, issues, anything)
by Alfred Kernaghan 17 May '13

17 May '13

Hi, Long time lurker, new poster though! I've got two servers running Stunnel v2.54 (yet to upgrade as I've been waiting for an x-forwardfor patch to become available). I noticed recently that one Stunnel nodes had exited, requiring a restart. I'm not sure if it's a co-incidence, but I've only just changed the cert on both installs last night. This, of course, is very concerning as it's only just become a problem, but being the core SSL endpoint, it knocks our server offline until it's restarted. Now comes the interesting bit, I've run the SSL Labs SSL Health check at https://www.ssllabs.com/ssltest/ just to see if anything comes out of it, and noticed that without fail every time it runs (and the first server is online) it'll know Stunnel offline as it goes through it's tests: *"Testing TLS v1.0...." "Testing TLS v1.2...."* *-- SERVER OFFLINE --* This was noticed by a fluke, but appears to happen every time I restart and then rerun the test. I'm not getting any segfaults, or errors from stunnel, and it only affects the one (primary) server. Can anyone shed any light as to what might be causing it, how I can get any more info out of stunnel, or better yet, fix it completely? Thanks all Alfie

2 2

Error with stunnel 4.56 on Ubuntu 12
by Laura Fried 12 May '13

12 May '13

I am getting a success with doing the configure, make and make install. However when I go to start up stunnel I get the following error message: Clients allowed=500 stunnel 4.56 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1 14 Mar 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported Line 51: "[pop3s]": Failed to initialize SSL str_stats: 9 block(s), 163 data byte(s), 522 control byte(s) Any assistance would be greatly appreciated. -- Laura J. Fried

1 0

4.53 32-bit on Windows 2k8 R2 64bit
by Michael Curran 01 May '13

01 May '13

We are running stunnel and noticed an issue with what ended up being an issue creating a new thread due to running out of memory at 2gb - error (8) on create_client Are there any known issues with 4.53 around memory usage? We only terminate 2 ports against the installation 443 on 2 different interfaces / IP addresses and we ran into this issue with just under 5000 total connections We are not doing ECDH , but are using a 1024-bit param file

2 3

Problem with roundrobbin failover mode?
by Matt Wise 01 May '13

01 May '13

I've got dozens of clients connecting with Stunnel to a group of 5 servers. Each system has a config that looks like this: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > delay = yes > sslVersion = TLSv1 > client = yes > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > session = 86400 > debug = 5 > [zookeeper] > accept = 127.0.0.1:2182 > failover = rr > connect = prod-zookeeper:2182 > connect = prod-zookeeper-1:2182 > connect = prod-zookeeper-2:2182 > connect = prod-zookeeper-3:2182 > connect = prod-zookeeper-4:2182 > connect = prod-zookeeper-5:2182 Essentially the first host is a load balancer, and the next 5 are the actual zookeeper hosts so that we can bypass the ELB if its giving us fits. Now what we're seeing is that almost every connection ends up on prod-zookeeper-5. Over and over and over again, our hosts pick the same system each time. We're running Stunnel 4.52: > Clients allowed=8000 > stunnel 4.52 on i486-pc-linux-gnu platform > Compiled/running with OpenSSL 0.9.8k 25 Mar 2009 > Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 Any ideas what might be wrong here? Obviously we want the connections to be *roughly* random across the list of hosts... and if one of the hosts goes down, and the connection fails, we want the stunnel service to try again, and randomly pick a new host. It doesn't really seem to be doing that though. --Matt

3 8

help on Linux stunnel setup
by Valerio.FABRIZIO＠sungard.com 26 Apr '13

26 Apr '13

Hello all! I'm in charge of activating stunnel to connect a service to a remote service. Since I'm totally new on this product, I'd be grateful if someone could help me in configuring. This is where I stand: Stunnel version: stunnel 4.29 on x86_64-unknown-linux-gnu with OpenSSL 1.0.0-fips 29 Mar 2010 OS: Linux 2.6.32-220.23.1.el6.x86_64 #1 SMP Mon Jun 18 18:58:52 BST 2012 x86_64 x86_64 x86_64 GNU/Linux I'd need to have it started by non-root user, and I have loaded under a specific path (owned by the same user): Stunnel.conf: ; Sample stunnel configuration file ;cert = FXMS1.pem client = yes output = /export/home/bg_mtsbv/slev5fix/log pid = /export/home/bg_mtsbv/slev5fix/conf/stunnel.pid [ssl01] accept = 127.0.0.1:18889 connect = 193.203.229.143:443 Stunnel.pid (empty) xxx.pem (certificate has been provided by the owner of the target server) my first two questions: which is the correct command line to be launched? Is it correct to have all the files under the user's directory? Many thanks in advance for your help! Regards, Valerio

1 0

Inconsistent performance across stunnel and/or OpenSSL versions
by PPingPongBaker PPingPongBaker 23 Apr '13

23 Apr '13

Hi All, I am experimenting with stunnel inside a VM on Xenserver 6.02. So this may not be a "common" use case, nonetheless, I would like to point out the issue. It is a basic setup as follows with 3 VMs running "ab" for webclient, stunnel+haproxy combo as the https/http bridge and nginx as the webserver. client VM (ab) <-> stunnel + haproxy VM <-> webserver VM (nginx) Specs on the stunnel VM are 2GB RAM, single-core dedicated 2.5 GHz Xeon E5-2640 vCPU, running Debian Squeeze 2.6.32-5-amd64 (64 bit) kernel. All things unchanged such as stunnel/haproxy/nginx config and taking care of common gotchas such as file descriptor limit, TIMEOUTclose, disabling libwrap, etc. stunnel is built with pthreads. Also stunnel is configured to use a 2K RSA self-signed certificate, and the client is being forced to do TLS1. "ab" is invoked with "-c 4" so as to peg the stunnel VM CPU (any value beyond 4 doesn't seem to matter). nginx serves a tiny 32 byte static html file. With stunnel 4.29 and OpenSSL 0.9.8o, I get 300 requests per second as max throughput. With stunnel 4.56 and OpenSSL 1.0.1e, I get only 40 requests per second as max throughput. tcpdump tells me that the Server Hello sent to the client takes a longer time in the latter case. Tinkering with TCP_NODELAY doesn't change anything. Anyone else seeing this maybe even on physical hardware? Has anything changed in OpenSSL across those versions? Suggestions? Thanks.

4 10

Windows Failover Clustering Support
by Cynthia Haselton 22 Apr '13

22 Apr '13

All, A (hopefully) quick question: Is stunnel supported on Windows Failover Clusters...specifically as a clustered service or to encrypt connections to/from a clustered IP? Thanks in advance, CJH

2 4

Customizing encryption
by John 19 Apr '13

19 Apr '13

HI guys, I need to take off SSL and use another encryption, need some hints since i'm new to stunnel. Thanks in advance,John

1 0

limited number of ports
by Terren Suydam 09 Apr '13

09 Apr '13

Hi, There appears to be a limit to the number of services you can define. Services beyond the 64th service appear to get set up without any log warnings or errors, yet don't pass traffic. The code uses select() & FD_SET to accept() an incoming connection & in Windows (using Windows Server 2008) the default is 64 sockets for that so wondering if I can just recompile, setting FD_SETSIZE to something larger. I'll try it either way, just wanted to put it out there to see if anyone else has ever run into this. Thanks, Terren

4 10

Trying to Upgrade stunnel, but compile isn't working?
by Michael D. Setzer II 03 Apr '13

03 Apr '13

I have been using stunnel for a long time, but was just trying to compile the latest version from source, and it compiles, but doesn't work like the older version, so I must have some option wrong. With the current version on my Fedora 14 machine using the latest version it loads the stunnel ports and works, but the newer version does seem to load or give an error message. I've tested the stunnel from Fedora 16 and Fedora 17, and they work fine with the stunnel.conf to load the settings. Current version info from Fedora 14 system. stunnel 4.34 on x86_64-redhat-linux-gnu with OpenSSL 1.0.0e-fips 6 Sep 2011 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 curve = sect163r2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none The new build does this. stunnel 4.56 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0e-fips 6 Sep 2011 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Global options: debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Have also tried it with --disable-fips With the new version I have to provide the /etc/stunnel/stunnel.conf, but it doesn't load any of the options. Sure it is just a simple configure setting I am missing. Thanks. +----------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor Guam Community College Computer Center mailto:[email protected] mailto:[email protected] http://www.guam.net/home/mikes Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +----------------------------------------------------------+ http://setiathome.berkeley.edu (Original) Number of Seti Units Returned: 19,471 Processing time: 32 years, 290 days, 12 hours, 58 minutes (Total Hours: 287,489) BOINC@HOME CREDITS SETI 14305761.074364 | EINSTEIN 10610832.119852 ROSETTA 6726167.419674 | ABC 15903532.519753

2 2

Log Rotation on Windows
by Brian Wilkins 03 Apr '13

03 Apr '13

I know that log rotation on Windows is on the TO-DO list. Is there a way to rotate the log at startup using some other means or during use? I suppose I could start stunnel with a batch file and do the log rotation before starting. Is there any other way? Brian

1 0

32/64 bit interposition on Solaris
by Norm Jacobs 29 Mar '13

29 Mar '13

I was recently working with stunnel on Solaris and ran across the following code in client.c: putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); This appears to have been put in place to interpose a stunnel version of getpeername() on the downstream application. This works great when libstunnel.so has the same bittedness as the downstream application, but Solaris allows users to install and run both 32 and 64 bit applications on the same system. If the stunnel exectuable is a 32 bit application and the downstream application is a 64 bit application, the runtime linker falls over because of the mismatch with the interposed library. To avoid this problem, stunnel should use LD_PRELOAD_32 and LD_PRELOAD_64 on Solaris. I have put together a patch to client.c that sets both LD_PRELOAD_* environment variables to something that seems to make sense on Solaris, but have used a fairly hacky way of enabling it when I build. The client.c changes that I put together are: # On Solaris, fix stunnel so that the linker know where both the 32 and 64 bit # interposer libraries are. If you use LD_PRELOAD with the wrong bittedness # of interposer, the runtime linker hits a fatal error in trying to load # mismatched ELF objects. # diff -r -u stunnel-4.55.orig/src/client.c stunnel-4.55/src/client.c --- stunnel-4.55.orig/src/client.c 2013-02-28 00:17:58.000000000 -0800 +++ stunnel-4.55/src/client.c 2013-03-21 22:55:21.098479331 -0700 @@ -1096,9 +1096,14 @@ /* just don't set these variables if getnameinfo() fails */ putenv(str_printf("REMOTE_HOST=%s", host)); if(c->opt->option.transparent_src) { - putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); - /* for Tru64 _RLD_LIST is used instead */ +#ifdef MACH64 + putenv("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); + putenv("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so"); +#elif __osf /* for Tru64 _RLD_LIST is used instead */ putenv("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT"); +#else + putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); +#endif } } This adds more appropriate environment variables into the calling environment on Solaris. It still needs some work to integrate better with the build. Anyway, I thought that I would raise the issue and at least offer a direction to work from. I am happy to work with someone on a better resolution to this. -Norm

1 0