stunnel-users

3306 discussions

Log rotation for Windows
by John Smith 31 Mar '15

31 Mar '15

Hi I came across this thread, I know it's old... http://mailing.unix.stunnel-users.narkive.com/QOEx4XQz/stunnel-users-log-ro… And it says that's it's on the todo list, though I don't see anything indicating this on the list. So is log rotation implemented for Windows and if so what is the config parameter? Thanks

2 5

Stunnel not receiving connections on ports 465 & 587
by James Brown 31 Mar '15

31 Mar '15

I am running Stunnel 5.14 on my Mac mail server (OS X 10.7.5), but trying to send emails using ports 465 & 587 does not work: Mail.app says: Mail was unable to connect to server “mail.bordo.com.au <http://mail.bordo.com.au/>” using SSL on port 587. Verify that this server supports SSL and that your account settings are correct. Log from Stunnel is: 2015.03.31 09:27:56 LOG7[ui]: Clients allowed=500 2015.03.31 09:27:56 LOG5[ui]: stunnel 5.14 on x86_64-apple-darwin11.4.2 platform 2015.03.31 09:27:56 LOG5[ui]: Compiled/running with OpenSSL 1.0.2a 19 Mar 2015 2015.03.31 09:27:56 LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2015.03.31 09:27:56 LOG7[ui]: errno: (*__error()) 2015.03.31 09:27:56 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2015.03.31 09:27:56 LOG5[ui]: UTF-8 byte order mark not detected 2015.03.31 09:27:56 LOG5[ui]: FIPS mode disabled 2015.03.31 09:27:56 LOG7[ui]: Compression disabled 2015.03.31 09:27:56 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2015.03.31 09:27:56 LOG7[ui]: PRNG seeded successfully 2015.03.31 09:27:56 LOG6[ui]: Initializing service [ssmtp] 2015.03.31 09:27:56 LOG6[ui]: Loading certificate from file: /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG6[ui]: Loading key from file: /usr/local/etc/postfix/smtpd.key 2015.03.31 09:27:56 LOG7[ui]: Private key check succeeded 2015.03.31 09:27:56 LOG7[ui]: DH initialization 2015.03.31 09:27:56 LOG7[ui]: Using DH parameters from /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG7[ui]: DH initialized with 2048-bit key 2015.03.31 09:27:56 LOG7[ui]: ECDH initialization 2015.03.31 09:27:56 LOG7[ui]: ECDH initialized with curve prime256v1 2015.03.31 09:27:56 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.03.31 09:27:56 LOG6[ui]: Initializing service [ssmtp2] 2015.03.31 09:27:56 LOG6[ui]: Loading certificate from file: /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG6[ui]: Loading key from file: /usr/local/etc/postfix/smtpd.key 2015.03.31 09:27:56 LOG7[ui]: Private key check succeeded 2015.03.31 09:27:56 LOG7[ui]: DH initialization 2015.03.31 09:27:56 LOG7[ui]: Using DH parameters from /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG7[ui]: DH initialized with 2048-bit key 2015.03.31 09:27:56 LOG7[ui]: ECDH initialization 2015.03.31 09:27:56 LOG7[ui]: ECDH initialized with curve prime256v1 2015.03.31 09:27:56 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.03.31 09:27:56 LOG5[ui]: Configuration successful 2015.03.31 09:27:56 LOG7[ui]: Listening file descriptor created (FD=6) 2015.03.31 09:27:56 LOG7[ui]: Service [ssmtp] (FD=6) bound to 0.0.0.0:465 2015.03.31 09:27:56 LOG7[ui]: Listening file descriptor created (FD=7) 2015.03.31 09:27:56 LOG7[ui]: Service [ssmtp2] (FD=7) bound to 0.0.0.0:587 /usr/local/etc/stunnel/stunnel.conf has: [ssmtp] client = no accept = 465 connect = 127.0.0.1:25 [ssmtp2] client = no accept = 587 connect = 127.0.0.1:25 The mail server is running on the same machine. I can send emails using port 25 with no SSL. (I have to have the ‘Allow insecure authentication’ ticked). When I try to send using ports 587 or 465 there is nothing logged by stunnel (or anywhere else that I can see). Firewall is not blocking anything: sudo ipfw list 65535 allow ip from any to any Postfix is the SMTP server, Dovecot for IMAP. Any suggestions? Thanks, James.

2 2

5.xx Windows binaries - FIPS compliant?
by Rob Lockhart 30 Mar '15

30 Mar '15

I apologize if this was asked in the past. I couldn't find any references to my question in the lists except this (related but not answering the question): http://www.stunnel.org/pipermail/stunnel-users/2014-July/004673.html http://www.stunnel.org/pipermail/stunnel-users/2012-November/003963.html I understand how to compile Stunnel from source, and the FIPS canister for OpenSSL, then build OpenSSL with this FIPS canister, then build Stunnel using that OpenSSL. My question is for the Windows version with filename "stunnel-5.13-installer.exe". That compiled version doesn't seem to be built with FIPS canister, as the log shows: "Compiled/running with OpenSSL 1.0.2a 19 Mar 2015" without a "-fips" appendage after the OpenSSL version. In other words, if it was built as FIPS-compliant, it would show: "Compiled/running with OpenSSL 1.0.2a-fips 19 Mar 2015" It may support the FIPS options (in the config file) but it's not FIPS-compliant. I also assume that this doesn't preclude the FIPS options in the config file from working. Specifically, FIPS-compliant does NOT imply that FIPS mode cannot be enabled. Am I understanding this correctly? Thanks, -Rob

2 2

Libressl with stunnel
by jungle Boogie 29 Mar '15

29 Mar '15

Hello All, It appears that stunnel still requires openssl and cannot use libressl. Have the developers considered this patch: https://github.com/sabotage-linux/sabotage/commit/9b47cbbf3ce903dee042c45c8… This is from stunnel 5.02 days but are there any issues with applying this with 5.14? -- ------- inum: 883510009027723 sip: jungleboogie(a)sip2sip.info xmpp: jungle-boogie(a)jit.si

2 2

stunnel 5.14 release
by Michal Trojnara 25 Mar '15

25 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.14 of stunnel. The ChangeLog entry: Version 5.14, 2015.03.25, urgency: HIGH: * Security bugfixes - The "redirect" option now also redirects clients on SSL session reuse. In stunnel versions 5.00 to 5.12 reused sessions were never redirected regardless of their certificate verification result. This vulnerability was reported by Johan Olofsson. * New features - Windows service is automatically restarted after upgrade. * Bugfixes - Fixed a memory allocation error during Unix daemon shutdown. - Fixed handling multiple connect/redirect destinations. - OpenSSL FIPS builds are now correctly reported on startup. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 2197b4fc1db82eba69c8baf1fac30f0767af26e9f8c7e9e1d5a4a8fbb264695a stunnel-5.14.tar.gz 29364b3f07a84245fe1b0f8373d96c9924650a8058e602670a67a2da07a801bd stunnel-5.14-installer.exe e3b48534bb4a5f8237e4ed1aa4990ed8485bdf97f6e0b8da2507dbd9b5cad34c stunnel-5.14-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVEs/mAAoJEC78f/DUFuAUNq4P/A7Ap1NkzfhZQJWJMJthar1P hoVHIzuH7dGbRt4C5s0PgbC4S9UOz8wdcKbsNcPJRQf0PXP5oVARo2bx+3dV9uAC /6GRL+a5Rj8HU5vG4UX/9D5D0pvwcyFkk7sIxUhyeKSHcEH354Vgw0AlJM6GiWKG nwE5RJ3JTdxi8A4e10p3ZKnPg4Y0eWmpkm1qkqH9RWKj9+BbLaPt7ZvRBNYNicq3 3BtVaJ5KLGvWaQRww+llhvPnR2K+h7PnJiaIKm/cIHzbP8VLjoVWy/Dk5EOku6Zg iCfz8uFzezz+9NwwjjEl2KfGUNdBaZf02R2LqN57pTZyBPZNVH9G7IE1/BGJh7Ai f440LTC29OB7qnJThDRdU16x/Iz+NTcc1QFK4x7eTD+nTouUuyZh9Md0x4DD9jwk CL3dHZ6abUO9j7V04Sb8+wfWzP/pZdilWLyY1jj8L41EPXyb0DE3ZsrHyN7lJ2Fx OihfevJhB9bzCzXiLg0oW61YRUm5prRTxMaeTAC53fITlvx0yf9pHFNy0OtoTNr+ t0Skf/LMaZnvU0rE0UBSjqQbpKNaRff5zsGrI/NLgk98X/NTdakgrgsS0jjaQgYm 7mgH4mKoI9qL2YUMw7d9eGg8j8I9qewhaQYjVz4kGoq9YOCVhh69XormcGMAXXjY gf3RNVLzQH4N19TYz5a8 =lrVy -----END PGP SIGNATURE-----

1 0

Multiple versions of TLS in config?
by Rob Lockhart 25 Mar '15

25 Mar '15

Unless I'm mistaken, stunnel version 5 currently supports the options shown below for sslVersion: all => TLS v1.0, TLS v1.1, TLS v1.2, SSLv2, SSLv3 TLSv1 => TLS v1.0 only (not TLS v1.1, TLSv1.2, SSLv2 or SSLv3) TLSv1.1 => TLS v1.1 only TLSv1.2 => TLS v1.2 only In order to support TLS v1.0, TLS v1.1 and TLS v1.2 but disable SSLv2 and SSLv3, you should have in the config file: sslVersion = all options = NO_SSLv2 options = NO_SSLv3 (those last two lines may be default in the new Stunnel). However, what if I want to just have TLSv1.1 and TLSv1.2 but NOT TLSv1.0? I last tried this with Stunnel v5.10 but nothing in the changelogs tells me that this behavior has been changed to choose a list of protocols; only one parameter is accepted. Is there a way to allow TLSv1.1 and TLSv1.2 but disallow TLSv1.0? Thanks, -Rob

2 1

Stunnel urgency: HIGH versus LOW
by Rob Lockhart 24 Mar '15

24 Mar '15

Hello, I just noticed a urgency discrepancy for Stunnel 5.12 on the website (both of these links are under the Downloads section): https://www.stunnel.org/versions.html - shows 5.12 urgency as HIGH https://www.stunnel.org/sdf_ChangeLog.html - shows 5.12 urgency as LOW I don't know if it makes a difference with 5.13 available (assuming urgency = LOW) but I think 5.12 should have urgency=HIGH. Thanks, -Rob

1 0

Definition of accept/local/remote sockets
by David Wittman 21 Mar '15

21 Mar '15

Is there a clear definition of what stunnel defines as the accept, local, and remote sockets below? > socket = a|l|r:OPTION=VALUE[:VALUE] > Set an option on accept/local/remote socket From: http://www.stunnel.org/static/stunnel.html It seems to me that the accept and local socket would be the same thing. Thanks, Dave

3 3

Receive from secure servers
by Info ITsatWork 21 Mar '15

21 Mar '15

Hello, A company which we work with wants to send secure (TLS) mails to our server. I think stunnel can do the trick for me, as our own server (Scalix) doesn't support TLS for itself. Now I set up stunnel and it looks like its working, except it's not receiving secured mails. I can still receive normal mails, so somehow it is not working. I used the sample config and filled in the things I thought I needed. My config: ; Sample stunnel configuration file for Unix by Michal Trojnara 2002-2015 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; A copy of some devices and system files is needed within the chroot jail ; Chroot conflicts with configuration file reload and many other features ; Remember also to update the logrotate configuration. ;chroot = /usr/local/var/lib/stunnel/ ; Chroot jail can be escaped if setuid option is not used ;setuid = nobody ;setgid = nogroup ; PID file is created inside the chroot jail (if enabled) ;pid = /usr/local/var/run/stunnel.pid ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** client = no ; Certificate/key is needed in server mode and optional in client mode cert = /usr/local/etc/stunnel/stunnel.pem ;key = /usr/local/etc/stunnel/mail.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /usr/local/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively CRLfile can be used ;CRLfile = /usr/local/etc/stunnel/crls.pem ;sslVersion = all ; Enable support for the insecure SSLv2 protocol ;options = NO_SSLv2 ; Enable support for the insecure SSLv3 protocol ;options = NO_SSLv3 ; Workaround for Eudora bug ; options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Service definitions (remove all services for inetd mode) * ; ************************************************************************** ; Example SSL server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 192.168.1.102:25 connect = 192.168.1.102:26 protocol = smtp ; Example SSL client mode services ;[gmail-pop3] ;client = yes ;accept = 127.0.0.1:110 ;connect = pop.gmail.com:995 ;[gmail-imap] ;client = yes ;accept = 127.0.0.1:143 ;connect = imap.gmail.com:993 ;[gmail-smtp] ;client = yes ;accept = 127.0.0.1:25 ;connect = smtp.gmail.com:465 ; Example SSL front-end to a web server ;[https] ;accept = 443 ;connect = 80 ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL ; Microsoft implementations do not use SSL close-notify alert and thus ; they are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; vim:ft=dosini This is what I see in the logfiles for the mails I don't receive: 2015.03.21 14:56:46 LOG7[main]: Service [ssmtp] accepted (FD=12) from 207.46.163.207:8478 2015.03.21 14:56:46 LOG7[2]: <- EHLO na01-by2-obe.outbound.protection.outlook.com 2015.03.21 14:56:46 LOG7[2]: -> 250-mailserver.mydomain.nl 2015.03.21 14:56:46 LOG7[2]: -> 250 STARTTLS 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 read client key exchange A 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 read finished A 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 write change cipher spec A 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 write finished A 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 flush data 2015.03.21 14:56:46 LOG7[1]: 1 items in the session cache 2015.03.21 14:56:46 LOG7[1]: 0 client connects (SSL_connect()) 2015.03.21 14:56:46 LOG7[1]: 0 client connects that finished 2015.03.21 14:56:46 LOG7[1]: 0 client renegotiations requested 2015.03.21 14:56:46 LOG7[1]: 1 server connects (SSL_accept()) 2015.03.21 14:56:46 LOG7[1]: 1 server connects that finished 2015.03.21 14:56:46 LOG7[1]: 0 server renegotiations requested 2015.03.21 14:56:46 LOG7[1]: 0 session cache hits 2015.03.21 14:56:46 LOG7[1]: 0 external session cache hits 2015.03.21 14:56:46 LOG7[1]: 0 session cache misses 2015.03.21 14:56:46 LOG7[1]: 0 session cache timeouts 2015.03.21 14:56:46 LOG6[1]: No peer certificate received 2015.03.21 14:56:46 LOG6[1]: SSL accepted: new session negotiated 2015.03.21 14:56:46 LOG6[1]: Negotiated TLSv1 ciphersuite AES256-SHA (256-bit encryption) 2015.03.21 14:56:46 LOG7[1]: Compression: null, expansion: null 2015.03.21 14:56:46 LOG7[3]: Service [ssmtp] started 2015.03.21 14:56:46 LOG5[3]: Service [ssmtp] accepted connection from 207.46.163.207:8478 2015.03.21 14:56:46 LOG6[3]: s_connect: connecting 192.168.1.102:26 2015.03.21 14:56:46 LOG7[3]: s_connect: s_poll_wait 192.168.1.102:26: waiting 10 seconds 2015.03.21 14:56:46 LOG5[3]: s_connect: connected 192.168.1.102:26 2015.03.21 14:56:46 LOG5[3]: Service [ssmtp] connected remote server from 192.168.1.102:22148 2015.03.21 14:56:46 LOG7[3]: Remote socket (FD=13) initialized 2015.03.21 14:56:46 LOG6[1]: Read socket closed (readsocket) 2015.03.21 14:56:46 LOG7[1]: Sending close_notify alert 2015.03.21 14:56:46 LOG7[1]: SSL alert (write): warning: close notify 2015.03.21 14:56:46 LOG6[1]: SSL_shutdown successfully sent close_notify alert 2015.03.21 14:56:46 LOG7[2]: <- STARTTLS 2015.03.21 14:56:46 LOG7[2]: -> 220 Go ahead 2015.03.21 14:56:46 LOG7[2]: SSL state (accept): before/accept initialization 2015.03.21 14:56:46 LOG7[3]: RFC 2487 detected 2015.03.21 14:56:46 LOG7[3]: <- 220 mailserver.rsconsultancy.nl ESMTP Scalix SMTP Relay 11.4.6.13676; Sat, 21 Mar 2015 14:56:46 +0100 (CET) 2015.03.21 14:56:46 LOG7[3]: -> 220 mailserver.rsconsultancy.nl stunnel for ESMTP Scalix SMTP Relay 11.4.6.13676; Sat, 21 Mar 2015 14:56:46 2015.03.21 14:56:46 LOG6[1]: SSL socket closed (SSL_read) 2015.03.21 14:56:46 LOG7[1]: Sent socket write shutdown 2015.03.21 14:56:46 LOG5[1]: Connection closed: 52 byte(s) sent to SSL, 6 byte(s) sent to socket 2015.03.21 14:56:46 LOG7[1]: Remote socket (FD=9) closed 2015.03.21 14:56:46 LOG7[1]: Local socket (FD=3) closed 2015.03.21 14:56:46 LOG7[1]: Service [ssmtp] finished (2 left) Could anyone please tell me what I'm doing wrong? Jeroen

2 1

stunnel 5.13 released
by Michal Trojnara 20 Mar '15

20 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.13 of stunnel. The ChangeLog entry: Version 5.13, 2015.03.20, urgency: MEDIUM: * New features - The "service" option was modified to also control the syslog service name. * Bugfixes - Fixed Windows service crash. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 71b4efb3814ec298124ec78386d756ee2cba9c999e7f9571bb8abcef317f04b5 stunnel-5.13.tar.gz bc5e8dc34ef32d92fb088afd18bae504ae4619b860f2a3ebb5e0af5e6b3531cd stunnel-5.13-installer.exe 1740861d1ff0e6f0146d181e832a4634ed4a13fdf52b50e12bb63c41d550579e stunnel-5.13-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVC/XkAAoJEC78f/DUFuAUtvwP/jUHwfoKRfT9eF5q8KV/gINx DxIs6bEf84hjw43n+tHCuPEJgXp8p9UYKR2MF5wHrYv7Wv0MqvRGZZvImY9qIwU/ ev3ZXpZTCo3hOn+kNeeQczuBfLfdNx/O11J0BxkSAJFz9mTeM4mxWoPqx/PP/Q54 mih/Jg17VobRPJXJRZlX8pabevO3wPteGT2t8Vd+JB3jTZzVgZBZXI+S9tr9evuD G2vHVz2f7aLRIw9wXIcM5k4HgNM4F8Oe0t9Y/RPkugvLJq7UZ5tskhNIa5+So3qG O/sYQSGfL77KI82N/k89tMj2ksGK9oNvKLCI1rpCKJOIIv58m3zyMlaXWWTJkETP vxxeSzwCvGkoL2Jzwomi2a1ev1Tqjwia2zjzFexPgHZCTxVLa4rGRJDBZcwWDtAl So7g7JjKI9QASP38ZT0G/0X8LQjtrMiKrfcU7eDhgRLfiQbyaV5h1g5GNJv4uAac 0qA8ho0VwOLXHT4Ny1V2d/wDuWTrcUl8f2wqlRnUGcEfoHH9ejkoLw0FcQ7RFm51 B9QCE/ntTKXknMWys9A/NSEmQ02KYGlVnTq++gjfvR927Wkr1dFCW3xj3fx8K+JW uWRLf61VjT72s2Qsx6HxyoYw3Yh9ehJo5Xm48iFAkvSnnk/7rQu8c1lazDtuRgRr YYViDon00Bx1ktaxlJPN =Q4iO -----END PGP SIGNATURE-----

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users