- stunnel-users - stunnel.org

(no subject)
by Guido 30 Dec '18

30 Dec '18

Gesendet von Mail für Windows 10

1 0

(no subject)
by Guido 30 Dec '18

30 Dec '18

Gesendet von Mail für Windows 10

1 0

sslv3 alert bad certificate
by marko 26 Dec '18

26 Dec '18

Hello all, I'm using xmas for something useful - i.e. to configure a new server. After an install of stunnel 5.50 and generating the .pem and .key files with: openssl req -new -x509 -nodes -out /usr/local/etc/stunnel/nw_stunnel.pem -keyout /usr/local/etc/stunnel/nw_stunnel.key -days 1825 using this settings in the stunnel.conf: cert = /usr/local/etc/stunnel/nw_stunnel.pem key = /usr/local/etc/stunnel/nw_stunnel.key options = -NO_SSLv3 sslVersion = all I got LOG5[0]: Service [imaps] accepted connection from 192.168.1.3:64233 Dec LOG3[0]: SSL_accept: 14094412: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Just wondering: this is a self issued CA-Cert. Does the bad certificate error refer to the unsafe ssl3-standard or is it a placeholder for the certificate being self-generated as well? I'm currentlty on [.] stunnel 5.50 on amd64-portbld-freebsd12.0 platform [.] Compiled/running with OpenSSL 1.1.1a-freebsd 20 Nov 2018 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI This configuration works with the same install procedure: [.] stunnel 5.49 on i386-portbld-freebsd11.2 platform [.] Compiled/running with OpenSSL 1.0.2o-freebsd 27 Mar 2018 [.] Threading:PTHREAD Sockets:POLL,IPv4 TLS:ENGINE,OCSP,PSK,SNI Any insights into this matter are highly welcome. Cheers, and merry youknowwhat, Marko

1 0

win32 support
by Vida Bence 20 Dec '18

20 Dec '18

Hi Everyone! Is there any option to use s-tunnel on win32? I can see only win64 download links on the front page. Sorry if this is a blatant question, I am a totally new user. Thank you for the replies! All the best Bence

3 2

stunnel log size
by Joe Phillips 13 Dec '18

13 Dec '18

My stunnel log continues to grow. Will it truncate automatically? How do I restrict its size?

2 1

How to configure STunnel to use cert. from certificate store
by Chicoine, Jonathan 12 Dec '18

12 Dec '18

How in the word you specify the certificate to use from the windows certificate store (for example, on Windows 10 or Windows Server 2012)? The documentation obviously says to use the "cert" config option to specify a file (and the "key" config option for the private key) ... but to use a cert from the windows certificate store, shouldn't it be the certs "common name" field or thumbprint ... or something. Am new to this whole thing and have been googling for the answer for days. Any help would be greatly appreciated. -jonathan

2 1

stunnel 5.50 on Solaris 10
by Udo Erdelhoff 12 Dec '18

12 Dec '18

Hi, quick heads-up to anybody building/using stunnel 5.50 on Solaris 10 and wondering where the "Invalid configuration file name" errors are coming from: The problem is the call to realpath in line 334 of options.c, it uses NULL as second argument as a request to have the realpath function allocate the memory buffer for the sanitized string. This variant of realpath is not supported on Solaris 10, and leads to EINVAL (error code 22). Quickest fix is to run configure and then manually change src/config.h to have /* #undef HAVE_REALPATH */ instead of #define HAVE_REALPATH 1 -- "Treason is a charge invented by winners as an excuse for hanging the losers." - Benjamin Franklin, ca. 1776

1 0

Support for multiple root CAs
by Tom Bentley 07 Dec '18

07 Dec '18

Hi, I'm using stunnel to secure communication between nodes in a cluster, using a self-signed CA to sign the server certs and the `verify = 2` config parameter. This works great. What I want to be able to do is replace the CA key and certificate without breaking the cluster. How I thought this should work would be: 1. Configure the stunnels to trust both the old and new CA certificates while the nodes continued to use server certificates signed by the old CA key. 2. Switch to using using server certifcates signed by the new CA key. 3. Finally remove trust in the old CA certificate. I'd tried this by putting both CA certificates in a single file and using `CAfile` config parameter, and also by using the `CApath` config parameter with both root CA certificates in the configured directory, but I've not been able to get this to work while keeping `verify = 2`. It does work if I temporary use `verify = 0`, but obviously that means I've not got TLS authentication duration the duration of the process. Can anyone confirm whether stunnel supports this use case, and if so suggest where I might be going wrong? Many thanks, Tom

1 0

Re: [stunnel-users] older browsers, stunnel and privoxy (kovacs janos) - stunnel-users Digest, Vol 173, Issue 7
by Thomas GMX 07 Dec '18

07 Dec '18

Hi Janos, mail (SMTP / POP / IMAP) are other protocols as HTTPS. I was not able to connect via sTunnel to a server via HTTPS - and this was the reason to create and use my HTTPSProxy. HTTPSProxy is based on this code (local front- and rear proxy are connected directly without Proxomitron): https://prxbx.com/forums/showthread.php?tid=2172 https://prxbx.com/forums/showthread.php?tid=2191&pid=19252#pid19252 You can build your own release with python if you do not trust the versions offered by me or HeinoGanda on MSFN. Regards Thomas S. -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Friday, December 07, 2018 12:00 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 173, Issue 7 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: older browsers, stunnel and privoxy (kovacs janos) ---------------------------------------------------------------------- Message: 1 Date: Fri, 7 Dec 2018 01:30:21 +0100 From: kovacs janos <kovacsjanosfasz(a)gmail.com> To: Flo Rance <trourance(a)gmail.com> Cc: zizazit(a)protonmail.com, stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAOchpkp+5YDig_XpWPFVdP9zQ-L2UN10p8Wzsm9ggv2iuWpU8Q(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" now im really not sure, since the wikipedia page on stunnel also describes the program doing exactly what i need in the Example scenario section: https://en.wikipedia.org/wiki/Stunnel#Example_scenario "Network traffic from the client initially passes over SSL to the stunnel application, which transparently encrypts/decrypts traffic and forwards unsecured traffic to port 25 locally. The mail server sees a non-SSL mail client. " only difference is, i need it to forward "unsecured traffic" to my browser client, not a server. are you all sure its really not possible? On 12/5/18, kovacs janos <kovacsjanosfasz(a)gmail.com> wrote: > thank you for suggestions, but can someone tell me in what cases > stunnel can be used? > i can connect to http websites through it, but https doesnt work, even > if it would otherwise do. > i try to connect to 'https://via.hypothes.is/' like this, which i can > access in browser without any proxy: > [Tunnel_in] > client = yes > accept = 127.0.0.1:443 > connect = via.hypothes.is:443 > > i get these logs: > LOG5[1]: Service [Tunnel_in] accepted connection from 127.0.0.1:1788 > LOG5[1]: s_connect: connected 104.20.214.15:443 > LOG5[1]: Service [Tunnel_in] connected remote server from 192.168.0.3:1789 > LOG5[1]: Connection closed: 197 byte(s) sent to TLS, 332 byte(s) sent to > socket > > and the browser just shows a 'server not found' error. > with http sites its the same logs except the IP and bytes, and it > loads in the browser. > > On 12/5/18, Flo Rance <trourance(a)gmail.com> wrote: >> I would recommend to use squid which is able to do SSL bump. >> >> https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit >> >> Therefore, you'll be able to connect with TLS1.0 to squid and the proxy >> will establish a TLSv1.2 to the final destination. >> >> Regards, >> Flo >> >> On Tue, Dec 4, 2018 at 9:38 PM kovacs janos <kovacsjanosfasz(a)gmail.com> >> wrote: >> >>> well, what i meant is forwarding to the current address the browser >>> connects to, so basically browsing through stunnel. >>> >>> is it really that complicated to achieve that? if i configure stunnel >>> as a client, and make the browser send traffic to the accept address, >>> shouldnt stunnel encrypt the traffic with TLS and send forward to the >>> connect address? if thats true, shouldnt it also decrypt returning >>> traffic and send back to the browser? >>> when i configured stunnel as both client and server on the same >>> computer, it worked, but the browser still gave >>> 'ssl_error_no_cypher_overlap' errors. probably because the server side >>> decrypted it again before it reached the website's server? >>> >>> i dont necessarily need it to strip encryption, just use anything >>> below TLS 1.1. for example on 'https://via.hypothes.is/' i can visit >>> sites that would otherwise give cypher error, and they stay as https >>> >>> On 12/4/18, Zizhong Zhang <zizazit(a)protonmail.com> wrote: >>> > Hello, >>> > >>> >> im trying to make older browsers be able to display TLS 1.1 and TLS >>> >> 1.2 >>> >> sites. >>> >> i heard stunnel cant be configured to always forward to the current >>> >> site address dynamically, thats why i would use privoxy. >>> > >>> > If by "forward to the current site address dynamically" you meant >>> "forward >>> > to the current address of one specific domain" then stunnel can >>> > achieve >>> that >>> > by adding "delay = yes". >>> > >>> > However, if I understood correctly, you wanted to let stunnel strip >>> > or remove SSL for whatever sites you visit. Then no, I don't think you >>> can >>> > achieve that with privoxy and stunnel. If that's what you want, I >>> > would >>> > suggest you use nginx to remove SSL. The following example >>> > configuration >>> > will let nginx "upgrade" your HTTP request to HTTPS. >>> > >>> > events {} http { server { >>> > resolver 9.9.9.9; >>> > listen 80; >>> > location / { >>> > proxy_pass https://$host$request_uri; >>> > proxy_set_header Host $http_host; >>> > } >>> > }} >>> > >>> > You can then point any domain to the nginx server (for example, via >>> > the >>> > hosts file) and visit the site via HTTP. This will make HTTPS-oly >>> > servers >>> > happy. >>> > >>> > That won't strip third-party HTTPS:// URL resources like NewIPNow >>> > does, >>> but >>> > you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. >>> Also >>> > there are "security features" like "Content-Security-Policy" that >>> > prevent >>> > modern browsers from visiting your SSL-stripped sites, but I believe >>> > your >>> > out-dated browser will happily ignore those. >>> > >>> > --Zizhong >>> > >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >> > ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 173, Issue 7 *********************************************

1 0

Re: [stunnel-users] older browsers with modern HTTPS - stunnel-users Digest, Vol 173, Issue 4
by Thomas GMX 05 Dec '18

05 Dec '18

Hi Janos, you can use a local proxy to "translate" HTTPS TLS1.0 to TLS1.2 Look here: https://msfn.org/board/topic/176344-problems-accessing-certain-sites-https-… HTTPSProxy (and tools) manage the whole traffic locally (in- and outgoing HTTPS), but needs manually configuration as described in the help files. If you have questions please ask in this forum. Regards Thomas S. -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 05, 2018 10:12 AM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 173, Issue 4 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: older browsers, stunnel and privoxy (kovacs janos) 2. Re: older browsers, stunnel and privoxy (Zizhong Zhang) 3. Re: older browsers, stunnel and privoxy (kovacs janos) 4. Re: older browsers, stunnel and privoxy (Flo Rance) ---------------------------------------------------------------------- Message: 1 Date: Tue, 4 Dec 2018 19:27:15 +0100 From: kovacs janos <kovacsjanosfasz(a)gmail.com> To: Flo Rance <trourance(a)gmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAOchpkrOTmoAgCpv4fK19NhZeP-5-JgjX3EASFcfQbMVydR2yA(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" well yes, im pretty sure the same encryption is needed in requests and the returned page, otherwise it would probably get a no cypher overlap error. so i basically need stunnel to encrypt outgoing requests, and decrypt the returned things and only on the browser side of connection. there's a good reason why they are deprecated, but it would be better to add this functionality this way if possible, rather than change whole programs, especially when its the purpose of stunnel, according to the description On 12/4/18, Flo Rance <trourance(a)gmail.com> wrote: > This is not what I've understood from your first description. You would > like to bridge TLSv1 to TLSv1.1 or TLSv1.2 before sending requests to a web > proxy. > > This is why I don't think stunnel is intended for that. > > That said, if SSLV3 and TLSv1 have been deprecated, there's a good reason > and you should seriously think to update your tools. > > Regards, > Flo > > On Tue, Dec 4, 2018 at 3:18 PM kovacs janos <kovacsjanosfasz(a)gmail.com> > wrote: > >> well, it says this on the first line of the website: >> "Stunnel is a proxy designed to add TLS encryption functionality to >> existing clients and servers without any changes in the programs' >> code." >> >> i just want to add TLS functionality to client browsers which dont >> have it. i only need stunnel to decrypt TLS traffic going back to the >> browser. >> >> On 12/4/18, Flo Rance <trourance(a)gmail.com> wrote: >> > Sorry I didn't read it correctly. I don't think this is something >> > stunnel >> > can handle. >> > >> > Regards, >> > Flo >> > >> > On Mon, Dec 3, 2018 at 9:31 PM kovacs janos <kovacsjanosfasz(a)gmail.com> >> > wrote: >> > >> >> thank you for the reply, >> >> its the address and port where privoxy listens for requests. >> >> from the config file: >> >> "# 4.1. listen-address >> >> # ==================== >> >> # >> >> # Specifies: >> >> # >> >> # The IP address and TCP port on which Privoxy will listen for >> >> # client requests." >> >> and under it: >> >> >> >> listen-address 127.0.0.1:8118 >> >> >> >> On 12/3/18, Flo Rance <trourance(a)gmail.com> wrote: >> >> > Hi, >> >> > >> >> > It's not clear in your description what is running on 8118 local >> >> > port. >> >> > >> >> > Regards, >> >> > Flo >> >> > >> >> > On Mon, Dec 3, 2018 at 2:40 PM kovacs janos < >> kovacsjanosfasz(a)gmail.com> >> >> > wrote: >> >> > >> >> >> sorry to bother, >> >> >> im trying to make older browsers be able to display TLS 1.1 and TLS >> >> >> 1.2 >> >> >> sites. >> >> >> i heard stunnel cant be configured to always forward to the current >> >> >> site address dynamically, thats why i would use privoxy. >> >> >> the browser is configured to send to: >> >> >> 127.0.0.1 443 >> >> >> >> >> >> stunnel config has this at the end: >> >> >> [Tunnel_in] >> >> >> client = yes >> >> >> accept = 127.0.0.1:443 >> >> >> connect = 127.0.0.1:8118 >> >> >> verifyChain = yes >> >> >> CAfile = ca-certs.pem >> >> >> checkHost = localhost >> >> >> >> >> >> 127.0.0.1:8118 is the privoxy address. >> >> >> this is what stunnel writes: >> >> >> LOG5[main]: Configuration successful >> >> >> LOG5[0]: Service [Tunnel_in] accepted connection from >> >> >> 127.0.0.1:3261 >> >> >> LOG5[0]: s_connect: connected 127.0.0.1:8118 >> >> >> LOG5[0]: Service [Tunnel_in] connected remote server from >> >> 127.0.0.1:3262 >> >> >> >> >> >> and the browser infinitely loads, and never loads anything or >> >> >> leaves >> >> >> the >> >> >> page. >> >> >> if i remove the last 3 lines, its the same just with this line >> >> >> added: >> >> >> LOG4[main]: Service [Tunnel_in] needs authentication to prevent >> >> >> MITM >> >> >> attacks >> >> >> >> >> >> but it doesnt give an error or anything. >> >> >> >> >> >> with a configuration like: >> >> >> [Tunnel_out] >> >> >> client = no >> >> >> accept = 127.0.0.1:443 >> >> >> connect = 127.0.0.1:8118 >> >> >> cert = stunnel.pem >> >> >> >> >> >> this is what it gives: >> >> >> LOG5[3]: Service [Tunnel_out] accepted connection from >> 127.0.0.1:3294 >> >> >> LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL >> >> >> routines:SSL23_GET_CLIENT_HELLO:https proxy request >> >> >> LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to >> >> >> socket >> >> >> >> >> >> and browser gives a server not found error immediately. im not even >> >> >> sure if i should use client or server configuration in a case like >> >> >> this, but none of them works anyway. all i would need is for my >> >> >> browser to get the pages decrypted, or at least in less than >> >> >> TLS1.1. >> >> >> like how on newipnow.com i can access sites with any encryption, >> since >> >> >> they are sent to the browser without encryption. the browser just >> >> >> gives an "unencrypted tunnel" warning, which is how i found >> >> >> stunnel, >> >> >> and which is exactly what i need, just locally. >> >> >> _______________________________________________ >> >> >> stunnel-users mailing list >> >> >> stunnel-users(a)stunnel.org >> >> >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> >> >> >> > >> >> >> > >> > ------------------------------ Message: 2 Date: Tue, 04 Dec 2018 19:16:53 +0000 From: Zizhong Zhang <zizazit(a)protonmail.com> To: kovacs janos <kovacsjanosfasz(a)gmail.com> Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <mSx8WOjppmpWbvW5ETuPUXO048xh4PcPTtZPpOpzkrecueeSUtjQQx13FhtLO24lkyNXRPe_lNpMV8ko6RMEvowOx7mg6rl_1hwj43QAxWw=(a)protonmail.com> Content-Type: text/plain; charset=UTF-8 Hello, > im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. > i heard stunnel cant be configured to always forward to the current > site address dynamically, thats why i would use privoxy. If by "forward to the current site address dynamically" you meant "forward to the current address of one specific domain" then stunnel can achieve that by adding "delay = yes". However, if I understood correctly, you wanted to let stunnel strip or remove SSL for whatever sites you visit. Then no, I don't think you can achieve that with privoxy and stunnel. If that's what you want, I would suggest you use nginx to remove SSL. The following example configuration will let nginx "upgrade" your HTTP request to HTTPS. events {} http { server { resolver 9.9.9.9; listen 80; location / { proxy_pass https://$host$request_uri; proxy_set_header Host $http_host; } }} You can then point any domain to the nginx server (for example, via the hosts file) and visit the site via HTTP. This will make HTTPS-oly servers happy. That won't strip third-party HTTPS:// URL resources like NewIPNow does, but you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. Also there are "security features" like "Content-Security-Policy" that prevent modern browsers from visiting your SSL-stripped sites, but I believe your out-dated browser will happily ignore those. --Zizhong ------------------------------ Message: 3 Date: Tue, 4 Dec 2018 21:37:53 +0100 From: kovacs janos <kovacsjanosfasz(a)gmail.com> To: Zizhong Zhang <zizazit(a)protonmail.com> Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAOchpkq7vG8vHBCrbVn6d4Eh7M2rd6jEob_huhoG=ZefJnpHLw(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" well, what i meant is forwarding to the current address the browser connects to, so basically browsing through stunnel. is it really that complicated to achieve that? if i configure stunnel as a client, and make the browser send traffic to the accept address, shouldnt stunnel encrypt the traffic with TLS and send forward to the connect address? if thats true, shouldnt it also decrypt returning traffic and send back to the browser? when i configured stunnel as both client and server on the same computer, it worked, but the browser still gave 'ssl_error_no_cypher_overlap' errors. probably because the server side decrypted it again before it reached the website's server? i dont necessarily need it to strip encryption, just use anything below TLS 1.1. for example on 'https://via.hypothes.is/' i can visit sites that would otherwise give cypher error, and they stay as https On 12/4/18, Zizhong Zhang <zizazit(a)protonmail.com> wrote: > Hello, > >> im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 >> sites. >> i heard stunnel cant be configured to always forward to the current >> site address dynamically, thats why i would use privoxy. > > If by "forward to the current site address dynamically" you meant "forward > to the current address of one specific domain" then stunnel can achieve that > by adding "delay = yes". > > However, if I understood correctly, you wanted to let stunnel strip > or remove SSL for whatever sites you visit. Then no, I don't think you can > achieve that with privoxy and stunnel. If that's what you want, I would > suggest you use nginx to remove SSL. The following example configuration > will let nginx "upgrade" your HTTP request to HTTPS. > > events {} http { server { > resolver 9.9.9.9; > listen 80; > location / { > proxy_pass https://$host$request_uri; > proxy_set_header Host $http_host; > } > }} > > You can then point any domain to the nginx server (for example, via the > hosts file) and visit the site via HTTP. This will make HTTPS-oly servers > happy. > > That won't strip third-party HTTPS:// URL resources like NewIPNow does, but > you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. Also > there are "security features" like "Content-Security-Policy" that prevent > modern browsers from visiting your SSL-stripped sites, but I believe your > out-dated browser will happily ignore those. > > --Zizhong > ------------------------------ Message: 4 Date: Wed, 5 Dec 2018 10:12:06 +0100 From: Flo Rance <trourance(a)gmail.com> To: kovacsjanosfasz(a)gmail.com Cc: zizazit(a)protonmail.com, stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAHogYcV+ig2-2u8CWYbbqH_AnkiZNzqM9etx=jHj3N+nug-FpQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I would recommend to use squid which is able to do SSL bump. https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit Therefore, you'll be able to connect with TLS1.0 to squid and the proxy will establish a TLSv1.2 to the final destination. Regards, Flo On Tue, Dec 4, 2018 at 9:38 PM kovacs janos <kovacsjanosfasz(a)gmail.com> wrote: > well, what i meant is forwarding to the current address the browser > connects to, so basically browsing through stunnel. > > is it really that complicated to achieve that? if i configure stunnel > as a client, and make the browser send traffic to the accept address, > shouldnt stunnel encrypt the traffic with TLS and send forward to the > connect address? if thats true, shouldnt it also decrypt returning > traffic and send back to the browser? > when i configured stunnel as both client and server on the same > computer, it worked, but the browser still gave > 'ssl_error_no_cypher_overlap' errors. probably because the server side > decrypted it again before it reached the website's server? > > i dont necessarily need it to strip encryption, just use anything > below TLS 1.1. for example on 'https://via.hypothes.is/' i can visit > sites that would otherwise give cypher error, and they stay as https > > On 12/4/18, Zizhong Zhang <zizazit(a)protonmail.com> wrote: > > Hello, > > > >> im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 > >> sites. > >> i heard stunnel cant be configured to always forward to the current > >> site address dynamically, thats why i would use privoxy. > > > > If by "forward to the current site address dynamically" you meant > "forward > > to the current address of one specific domain" then stunnel can achieve > that > > by adding "delay = yes". > > > > However, if I understood correctly, you wanted to let stunnel strip > > or remove SSL for whatever sites you visit. Then no, I don't think you > can > > achieve that with privoxy and stunnel. If that's what you want, I would > > suggest you use nginx to remove SSL. The following example configuration > > will let nginx "upgrade" your HTTP request to HTTPS. > > > > events {} http { server { > > resolver 9.9.9.9; > > listen 80; > > location / { > > proxy_pass https://$host$request_uri; > > proxy_set_header Host $http_host; > > } > > }} > > > > You can then point any domain to the nginx server (for example, via the > > hosts file) and visit the site via HTTP. This will make HTTPS-oly servers > > happy. > > > > That won't strip third-party HTTPS:// URL resources like NewIPNow does, > but > > you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. > Also > > there are "security features" like "Content-Security-Policy" that prevent > > modern browsers from visiting your SSL-stripped sites, but I believe your > > out-dated browser will happily ignore those. > > > > --Zizhong > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

Web mail browsing over stunnel
by Osvald Brko 05 Dec '18

05 Dec '18

Hello, I would like to use stunnel for mail reading from www.hotmail.com . But there are plenty of redirections, to outlook.live.com, login.live.com, outlook.office365.com etc., moreover IP adresses of these servers are changing... Is there any configuration which allowed to use such web server over stunnel? Regards, Olda

1 0

stunnel 5.50 released
by Michal Trojnara 04 Dec '18

04 Dec '18

Dear Users, I have released version 5.50 of stunnel. Version 5.50, 2018.12.02, urgency: MEDIUM * New features - 32-bit Windows builds replaced with 64-bit builds. - OpenSSL DLLs updated to version 1.1.1. - Check whether "output" is not a relative file name. - Major code cleanup in the configuration file parser. - Added sslVersion, sslVersionMin and sslVersionMax for OpenSSL 1.1.0 and later. * Bugfixes - Fixed PSK session resumption with TLS 1.3. - Fixed a memory leak in WIN32 logging subsystem. - Allow for zero value (ignored) TLS options. - Partially refactored configuration file parsing and logging subsystems for clearer code and minor bugfixes. * Caveats - We removed FIPS support from our standard builds. FIPS will still be available with bespoke builds. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 951d92502908b852a297bd9308568f7c36598670b84286d3e05d4a3a550c0149 stunnel-5.50.tar.gz e855d58a05dca0943a5da8d030b5904630ee9cff47c3d747d326e151724f3bc8 stunnel-5.50-win64-installer.exe ad6c952cd26951c5a986efe8034b71af07c951e11d06e0b0ce73ef82594b1041 stunnel-5.50-android.zip Best regards, Mike

3 2

PSK mode does not work correctly with TLSv1.3
by Zizhong Zhang 21 Nov '18

21 Nov '18

Hello, In TLSv1.3, session resumption has been reworked to be the same way as PSK. The client attempts resumption by appending a ticket as PSK identity to the head of the list. With OpenSSL 1.1.1, the server side should use the new SSL_CTX_set_psk_find_session_callback() callback instead of SSL_CTX_set_psk_server_callback() which is used by stunnel now. Because stunnel only verifies against the first PSK identity, stunnel will fail for every other connections it makes. This impacts the default configuration when running with OpenSSL 1.1.1 because TLSv1.3 is enabled by default. It may be confusing because only half of the connections will fail as the client will try to resume the last successful session for every second connections. I purpose that stunnel should switch to SSL_CTX_set_psk_find_session_callback() for OpenSSL 1.1.1, and that it preferably should default to a maximum version of TLSv1.2 because it might be compiled with OpenSSL 1.0.x but runs with OpenSSL 1.1.1 which will enable TLSv1.3 automatically. With regards, --Zizhong

1 0

Installing stunnel as a Windows service with another service name?
by Al Birchall 16 Nov '18

16 Nov '18

Hi, Is it possible to install stunnel as a Windows service with another name? I want to have multiple instances of stunnel running on the same Windows 2008 server, if possible. Many thanks. Al

2 1

Server is down
by Paul Muller 12 Nov '18

12 Nov '18

I've installed Stunnel before with no issues. But now I'm getting the following: ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [SMTP Outgoing] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [SMTP Outgoing] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [SMTP Outgoing] [ ] Listening file descriptor created (FD=1388) [ ] Setting accept socket options (FD=1388) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [SMTP Outgoing] to 0.0.0.0:25: Address already in use (WSAEADDRINUSE) (10048) [!] Binding service [SMTP Outgoing] failed [ ] Deallocating section defaults [ ] Unbinding service [SMTP Outgoing] [ ] Service [SMTP Outgoing] closed [ ] Deallocating section [SMTP Outgoing] [!] Server is down Please let me know what I'm doing wrong here. Thank you, [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

1 0

Issue with Office365 certificates
by milanimarco82＠libero.it 09 Nov '18

09 Nov '18

Hello, I'm encountering an issue while using sTunnel with an Office365 account. sTunnel worked properly for a few months, while it gived an error with certificates since yesterday, whilst didn't change anything in the configuration. This is our configuration: [pop3s] client = yes accept = 127.0.0.1:2001 connect = outlook.office365.com:995 CAfile = C:\Program Files (x86)\stunnel\config\ca-certs.pem checkHost = outlook.office365.com verifyChain = yes OCSPaia = yes This is what we get in the log: 2018.11.09 11:34:09 LOG7[main]: Found 1 ready file descriptor(s) 2018.11.09 11:34:09 LOG7[main]: FD=432 ifds=r-x ofds=--- 2018.11.09 11:34:09 LOG7[main]: Service [pop3s] accepted (FD=672) from 127.0.0.1:49619 2018.11.09 11:34:09 LOG7[main]: Creating a new thread 2018.11.09 11:34:09 LOG7[main]: New thread created 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] started 2018.11.09 11:34:09 LOG7[30]: Setting local socket options (FD=672) 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on local socket 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] accepted connection from 127.0.0.1:49619 2018.11.09 11:34:09 LOG6[30]: failover: priority, starting at entry #0 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 40.101.9.178:995 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 40.101.9.178:995: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 40.101.9.178:995 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] connected remote server from 172.31.20.23:49620 2018.11.09 11:34:09 LOG7[30]: Setting remote socket options (FD=668) 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on remote socket 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) initialized 2018.11.09 11:34:09 LOG6[30]: SNI: sending servername: outlook.office365.com 2018.11.09 11:34:09 LOG6[30]: Peer certificate required 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): before/connect initialization 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv2/v3 write client hello A 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv3 read server hello A 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=2: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG7[30]: OCSP: Ignoring root certificate 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=2: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocsp.digicert.com" 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocsp.digicert.com:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received 2018.11.09 11:34:09 LOG6[30]: OCSP: Status: good 2018.11.09 11:34:09 LOG6[30]: OCSP: This update: Nov 9 00:00:00 2018 GMT 2018.11.09 11:34:09 LOG6[30]: OCSP: Next update: Nov 16 00:00:00 2018 GMT 2018.11.09 11:34:09 LOG5[30]: OCSP: Certificate accepted 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG6[30]: CERT: Host name "outlook.office365.com" matched with "*.office365.com" 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocspx.digicert.com" 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocspx.digicert.com:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received 2018.11.09 11:34:09 LOG3[30]: OCSP: Responder error: 6: unauthorized 2018.11.09 11:34:09 LOG4[30]: Rejected by OCSP at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com 2018.11.09 11:34:09 LOG7[30]: TLS alert (write): fatal: handshake failure 2018.11.09 11:34:09 LOG3[30]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed 2018.11.09 11:34:09 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.11.09 11:34:09 LOG7[30]: Deallocating application specific data for session connect address 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) closed 2018.11.09 11:34:09 LOG7[30]: Local descriptor (FD=672) closed 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] finished (0 left) Can you please help me? Thanks in advance!

2 3

Please need urgent help
by Alix Janeth Jerez 09 Nov '18

09 Nov '18

Hi, I have installed the last stunnel version 5.4.9, i get this fatal error [cid:60207984-5796-4d47-986e-21551ff82966] The stunnel.conf is configured so: debug = 7 output = stunnel.log # GLOBAL OPTIONS client = yes taskbar=yes [SMTP Outgoing] protocol = smtp accept = 172.31.41.84:117 connect = smtp.outlook.com:587 checkHost = smtp.outlook.com verifyChain = yes CAfile = ca-certs.pem OCSPaia = yes cert = stunnel.pem I tried to enable this option ; Enable support for the insecure SSLv3 protocol options = -NO_SSLv3 But stunnel does't work. Thank you in advance for your help. Best regards,

2 3

Re: [stunnel-users] Multiple Instance of sTunnel on same machine
by Shah, Marmik 31 Oct '18

31 Oct '18

I would be connecting to different Vendors using sTunnel from my machine. I want to run multiple instance of sTunnel as hosted service on Window Server. How can I achieve that ? I can do that through Terminal but I want to install stunnel service per vendor (in Service Control Manager) so that I can manage them independently and stop or start based on Vendor's requirement. I can do this through Command Prompt. Thanks Marmik ............................................................................ For further important information about AllianceBernstein please click here http://www.alliancebernstein.com/disclaimer/email/disclaimer.html

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 171, Issue 16
by Johann Hörmann 25 Oct '18

25 Oct '18

Am 25.10.18 um 12:00 schrieb stunnel-users-request(a)stunnel.org: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian > jessie (Johann Hörmann) > 2. Re: stunnel 5.06 not yet linked against OpenSSL 1.0.1t on > debian jessie (Eric Eberhard) > 3. stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian > jessie (Jakob Hirsch) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 24 Oct 2018 17:29:18 +0200 > From: Johann Hörmann <support(a)hans-hoermann.de> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL > 1.0.1t on debian jessie > Message-ID: <f9fb3d42-c0f2-dffd-e0b1-249d8e068081(a)hans-hoermann.de> > Content-Type: text/plain; charset=utf-8 > > Hi, > > that's the log on a debian jessie, starting stunnel: > > 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform > 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 > 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 > 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel > > All debian packages are upgraded: > $ sudo apt-get update > ... > $ sudo apt-get upgrade > 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. > $ > > $ dpkg -l|egrep 'openssl|stunnel' > ... > ii openssl 1.0.1t-1+deb8u9 > ... > ii stunnel4 3:5.06-2+deb8u1 > $ > > Guess the log tells the current stunnel-package is not linked against > openssl 1.0.1t lib yet. > > No pinning is active: > $ ls -l /etc/apt/preferences > -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences > $ > > Is that - stunnel not being linked against the current openssl-lib - a > serious problem? > Will there soon be a stunnel-package being linked against openssl 1.0.1t? > > > Thanks in Advance > -- > Hans > > > ------------------------------ > > Message: 2 > Date: Wed, 24 Oct 2018 15:02:08 -0700 > From: "Eric Eberhard" <flash(a)vicsmba.com> > To: 'Johann Hörmann' <support(a)hans-hoermann.de>, > <stunnel-users(a)stunnel.org> > Subject: Re: [stunnel-users] stunnel 5.06 not yet linked against > OpenSSL 1.0.1t on debian jessie > Message-ID: <03bb01d46be5$40d264c0$c2772e40$(a)vicsmba.com> > Content-Type: text/plain; charset="utf-8" > > Static linking is much easier, especially when put in a non-standard place, such as /usr/local/customer-name/lib -- this means if somebody does an update of say openssl alone you won't have this problem. You can also do it non-static as long as it is in a non-standard place and be pretty safe. > > My versions have stunnel 5.44 and openssl 1.0.2 -- works fine. It is static and keeps on ticking. > > Eric > > -----Original Message----- > From: stunnel-users [mailto:[email protected]] On Behalf Of Johann Hörmann > Sent: Wednesday, October 24, 2018 8:29 AM > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie > > Hi, > > that's the log on a debian jessie, starting stunnel: > > 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform > 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 > 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 > 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel > > All debian packages are upgraded: > $ sudo apt-get update > ... > $ sudo apt-get upgrade > 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. > $ > > $ dpkg -l|egrep 'openssl|stunnel' > ... > ii openssl 1.0.1t-1+deb8u9 > ... > ii stunnel4 3:5.06-2+deb8u1 > $ > > Guess the log tells the current stunnel-package is not linked against openssl 1.0.1t lib yet. > > No pinning is active: > $ ls -l /etc/apt/preferences > -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences $ > > Is that - stunnel not being linked against the current openssl-lib - a serious problem? > Will there soon be a stunnel-package being linked against openssl 1.0.1t? > > > Thanks in Advance > -- > Hans > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > > ------------------------------ > > Message: 3 > Date: Thu, 25 Oct 2018 10:58:48 +0200 > From: Jakob Hirsch <jh(a)plonk.de> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL > 1.0.1t on debian jessie > Message-ID: <a518f51f-180d-b1a3-96e1-c3f976dd1e42(a)Message-ID.plonk.de> > Content-Type: text/plain; charset=utf-8 > > Hi, > > On 2018-10-24 17:29, Johann Hörmann wrote: >> Is that - stunnel not being linked against the current openssl-lib - a >> serious problem? > > It is usually not necessary to rebuild all packages using a specific lib > just because it got updated. > >> Will there soon be a stunnel-package being linked against openssl 1.0.1t? > > The debian people are doing that, so that would be something to ask > them, specifically the package maintainers (see > https://packages.debian.org/jessie/stunnel4) But since jessie support > ended last June and LTS won't rebuild , I would not hold my breath. > > Why do you care about this in the first place? You are using a stunnel > version that is 4 years old and got last patched more than 3 years ago. > If it's of any importance to you, you should really upgrade to stretch > (optionally with bpo) or at least use jessie-backports. > > > Regards > Jakob > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > ------------------------------ > > End of stunnel-users Digest, Vol 171, Issue 16 > ********************************************** > Thanks a lot for your valuable advices, Eric and Jakob! Being just a dumb user, i supposed the distribution should stay 'in harmony': Ok now i know for oldstable this can be solved by backports or compiling stunnel with a static openssl-lib. Upgrading to stretch is not yet a choice because i am using stunnel with 'verify=3' which results in checking the self-signed client-certs at the server: Can't tell why but my cacert file was generated with a CAFile value of FALSE, which worked until jessie but at stretch the request results in a reject by the openssl-lib because of the FALSE-value. So first i have to renew and deploy all my customers certs - about 80 - with a stretch-conform cacert performing with CAFile=true. Hans -- https://hoermann-solutions.com

1 0

stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie
by Johann Hörmann 25 Oct '18

25 Oct '18

Hi, that's the log on a debian jessie, starting stunnel: 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel All debian packages are upgraded: $ sudo apt-get update ... $ sudo apt-get upgrade 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. $ $ dpkg -l|egrep 'openssl|stunnel' ... ii openssl 1.0.1t-1+deb8u9 ... ii stunnel4 3:5.06-2+deb8u1 $ Guess the log tells the current stunnel-package is not linked against openssl 1.0.1t lib yet. No pinning is active: $ ls -l /etc/apt/preferences -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences $ Is that - stunnel not being linked against the current openssl-lib - a serious problem? Will there soon be a stunnel-package being linked against openssl 1.0.1t? Thanks in Advance -- Hans

2 1

Re: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie
by Eric Eberhard 24 Oct '18

24 Oct '18

Static linking is much easier, especially when put in a non-standard place, such as /usr/local/customer-name/lib -- this means if somebody does an update of say openssl alone you won't have this problem. You can also do it non-static as long as it is in a non-standard place and be pretty safe. My versions have stunnel 5.44 and openssl 1.0.2 -- works fine. It is static and keeps on ticking. Eric -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Johann Hörmann Sent: Wednesday, October 24, 2018 8:29 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie Hi, that's the log on a debian jessie, starting stunnel: 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel All debian packages are upgraded: $ sudo apt-get update ... $ sudo apt-get upgrade 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. $ $ dpkg -l|egrep 'openssl|stunnel' ... ii openssl 1.0.1t-1+deb8u9 ... ii stunnel4 3:5.06-2+deb8u1 $ Guess the log tells the current stunnel-package is not linked against openssl 1.0.1t lib yet. No pinning is active: $ ls -l /etc/apt/preferences -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences $ Is that - stunnel not being linked against the current openssl-lib - a serious problem? Will there soon be a stunnel-package being linked against openssl 1.0.1t? Thanks in Advance -- Hans _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] stunnel logging of OpenSSL error source file and line number?
by Eric Eberhard 19 Oct '18

19 Oct '18

Good idea and about as much fun as watching grass grow :) E From: stunnel-users [mailto:[email protected]] On Behalf Of Tom Hood Sent: Friday, October 19, 2018 7:09 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel logging of OpenSSL error source file and line number? Hi, Was it by design that stunnel's logging of OpenSSL errors does not include the OpenSSL source file and line number? If not, please consider switching from ERR_get_error to ERR_get_error_line <https://www.openssl.org/docs/man1.0.2/crypto/ERR_get_error_line.html> . Thanks, -- Tom

1 0

stunnel logging of OpenSSL error source file and line number?
by Tom Hood 19 Oct '18

19 Oct '18

Hi, Was it by design that stunnel's logging of OpenSSL errors does not include the OpenSSL source file and line number? If not, please consider switching from ERR_get_error to ERR_get_error_line <https://www.openssl.org/docs/man1.0.2/crypto/ERR_get_error_line.html>. Thanks, -- Tom

1 0

Re: [stunnel-users] CPU 100%
by Eric Eberhard 19 Oct '18

19 Oct '18

Somewhere there is a physical network card - checking the firewall/router for traffic is a good idea no matter what it is running on. VMs have lots of clever software to isolate each instance (including resources) and you may be being streamed at a rate the VM as whole can handle, and your isolated VM cannot. And setting the debug level up is still a good idea. And forcing core files and using a debugger is still a good idea. And trying inetd mode is still a good idea. You need to narrow your focus and each of these suggestions will tell you something that narrows the problem. Eric From: Murrey, Brian J. [mailto:[email protected]] Sent: Thursday, October 18, 2018 7:14 AM To: Eric Eberhard <flash(a)vicsmba.com>; stunnel-users(a)stunnel.org Subject: RE: [stunnel-users] CPU 100% Thank you Eric, this server is a VM running under vSphere 6.5 and has no physical network card. From: Eric Eberhard <flash(a)vicsmba.com <mailto:[email protected]> > Sent: Wednesday, October 17, 2018 7:56 PM To: Murrey, Brian J. <Brian.Murrey(a)trimedx.com <mailto:[email protected]> >; stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: RE: [stunnel-users] CPU 100% Long ago I had a server with a bad network card. Every once in a while it would spew uncontrollable bytes onto the network. If you open a stunnel connection and it does that this could very well be the problem. If it cheap, try changing the network card. If not, you should be able to look in your firewall/router and it will tell you who is sending what bytes to whomever. See if that machine is indeed streaming the bytes in massive quantities. If not, I would suspect your stunnel is getting stuck in it's own loop. There are a million reasons this can happen (well a few less than a million) - such as maybe a bad library in the FreeBSD or a bad choice in the Makefile - such as doing threads or something in a way your O/S does not like (I use threads=fork or whatever it is, instead of actual threading). You might tinker with some of the options that make the stunnel build and try different ones. Especially if stunnel was compiled on a different version of the O/S - could be differences in bytes in things and who knows what. That is all I can suggest beyond setting the debug level to 7 (I think is highest) and then watching the log file. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 10:57 AM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment. _____ CAUTION: This email originated from outside of the organization. Do not open links or attachments you were not expecting, even from known senders, and use caution when responding. Please contact the Service Desk if in doubt regarding the legitimacy of this email. _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 1

Re: [stunnel-users] Windows stunnel Command Line Configuration File Location
by Eric Eberhard 18 Oct '18

18 Oct '18

If it reading from .\config . then I would try putting the path in quotes. If it fails to read the one in \temp but is not reading anything, I would check permissions on the directory and file (easy test is set "everyone" to full permissions, at least as a test). You have to do the entire directory tree (in the case of c:\temp it is just that directory) and the file. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Steve Jones Sent: Wednesday, October 17, 2018 1:59 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Windows stunnel Command Line Configuration File Location I would like to be able to run stunnel interactively on Windows, but specify a different location for the configuration file. When I looked at the help output, it stated that you could pass a parameter for "[<filename>]". I assumed I could put a path on there, but it does not appear to work. For example, I tried running "stunnel.exe C:\temp\stunnel.conf", but it would not find the configuration file even though it is there. Is there a way to do what I am trying to do or does the config file have to be in a folder "..\config"? Thanks.

2 1

Re: [stunnel-users] CPU 100%
by Eric Eberhard 18 Oct '18

18 Oct '18

One other suggestion - run it in inetd mode. This is MUCH simpler, stunnel will not have to do as much forking and managing and so forth. The O/S will do all that. I know - it is a little less efficient. However, I have found on modern Centos and AIX computers that even with very high volumes it makes no measurable difference. If nothing else, it is another debugging technique. Especially if the runaway process is the parent process . because that does not exist under inetd mode. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 11:09 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] CPU 100% We have one service, connecting stunnel to another application. Relevant configuration: [vpn] client = no accept = 172.17.102.122:443 exec = /usr/sbin/ppp execargs = ppp -direct vpn pty = yes Brian From: Vincent Deschenes <vdeschenes(a)stelvio.com <mailto:[email protected]> > Sent: Wednesday, October 17, 2018 2:05 PM To: Murrey, Brian J. <Brian.Murrey(a)trimedx.com <mailto:[email protected]> >; stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: RE: [stunnel-users] CPU 100% Just a silly idea, but is it possible you have a re-entrant configuration for one service, one that connect back to itself creating a loop? Vincent Deschenes Ing. PMP From: stunnel-users <stunnel-users-bounces(a)stunnel.org <mailto:[email protected]> > On Behalf Of Murrey, Brian J. Sent: Wednesday, 17 October 2018 1:57 PM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment. _____ CAUTION: This email originated from outside of the organization. Do not open links or attachments you were not expecting, even from known senders, and use caution when responding. Please contact the Service Desk if in doubt regarding the legitimacy of this email. _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

1 0

Re: [stunnel-users] CPU 100%
by Eric Eberhard 18 Oct '18

18 Oct '18

Also a good idea. That would be found in the log ASAP certainly with a high debug level. Might fill the filesystem for the log if that is so :) Does FreeBSD support kill -9 (or is it 11?) that forces a core dump? If so, when you kill it and leave a core file, you can use the debugger on that core file and see what it is doing. Look at the stack trace. You may need several to catch the problem. If it is simply in a read() type state then the other machine is streaming you. If it is loop around you should see it in a different place in each core file (the odds of hitting the same line of code when kill it every time are not good). I do not know what debuggers you have (gdb?) but that is another trick. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Vincent Deschenes Sent: Wednesday, October 17, 2018 11:05 AM To: Murrey, Brian J. <Brian.Murrey(a)trimedx.com>; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] CPU 100% Just a silly idea, but is it possible you have a re-entrant configuration for one service, one that connect back to itself creating a loop? Vincent Deschenes Ing. PMP From: stunnel-users <stunnel-users-bounces(a)stunnel.org <mailto:[email protected]> > On Behalf Of Murrey, Brian J. Sent: Wednesday, 17 October 2018 1:57 PM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

1 0

Windows stunnel Command Line Configuration File Location
by Steve Jones 17 Oct '18

17 Oct '18

I would like to be able to run stunnel interactively on Windows, but specify a different location for the configuration file. When I looked at the help output, it stated that you could pass a parameter for "[<filename>]". I assumed I could put a path on there, but it does not appear to work. For example, I tried running "stunnel.exe C:\temp\stunnel.conf", but it would not find the configuration file even though it is there. Is there a way to do what I am trying to do or does the config file have to be in a folder "..\config"? Thanks.

1 0

CPU 100%
by Murrey, Brian J. 17 Oct '18

17 Oct '18

We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure ________________________________ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 2

stunnel 5.49 on Win32 (invalid configuration file)
by Hardik Mehta 10 Oct '18

10 Oct '18

Hi, can you please help, I was able to send a mail using blat, stunnel and gmail and then i tried adding Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name: Stunnel Type: REG_SZ Value: "c:\Program Files (x86)\stunnel\bin\stunnel.exe" to run on windows startup, but as soon as i restarted the system gave me following message stunnel 5.49 on Win32 (invalid configuration file) Stunnel server is down due to an error. you need to exit and correct the problem. click of to see the error lg window this is the log that i'm getting on stunnel [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [SMTP Gmail] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [SMTP Gmail] needs authentication to prevent MITM attacks [ ] Initializing service [POP3 Gmail] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [POP3 Gmail] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [SMTP Gmail] [ ] Listening file descriptor created (FD=1800) [ ] Setting accept socket options (FD=1800) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [SMTP Gmail] (FD=1800) bound to ::1:1099 [ ] Listening file descriptor created (FD=1516) [ ] Setting accept socket options (FD=1516) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [SMTP Gmail] to 127.0.0.1:1099: Address already in use (WSAEADDRINUSE) (10048) [ ] Binding service [POP3 Gmail] [ ] Listening file descriptor created (FD=1516) [ ] Setting accept socket options (FD=1516) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [POP3 Gmail] to 127.0.0.1:1109: Address already in use (WSAEADDRINUSE) (10048) [!] Binding service [POP3 Gmail] failed [ ] Deallocating section defaults [ ] Unbinding service [SMTP Gmail] [ ] Service [SMTP Gmail] closed (FD=1800) [ ] Service [SMTP Gmail] closed [ ] Deallocating section [SMTP Gmail] [ ] Unbinding service [POP3 Gmail] [ ] Service [POP3 Gmail] closed [ ] Deallocating section [POP3 Gmail] [!] Server is down I also tried changing 1099 to some other random ports but nothing works tried stopping gui, service & service uninstall, then service reinstall, service start & open gui, but the same log appears an early help will be highly appreciated. -- Regards Quick Support <https://get.teamviewer.com/66sdg3u>, Buy Tally Online <http://experts.tallysolutions.com/tallyweb/modules/sd/docmgmt/COnlineOrderE…> , Buy Addons Online <http://www.tallysolutions.com/tallyweb/modules/sd/docmgmt/CMktPlaceHomepage…> , Tally Solutions Website <http://www.tallysolutions.com>, Hardik Printers Youtube Channel <https://www.youtube.com/user/hardikcomp>, Twitter Handle <https://twitter.com/hardikcomp>, Quora Answers <https://www.quora.com/profile/Hardik-N-Mehta-Vadalia> Legal Disclaimer The information contained in this electronic communication is intended solely for the individual(s) or entity to which it is addressed. It may contain proprietary, confidential and/or legally privileged information. Any review, retransmission, dissemination, printing, copying or other use of, or taking any action in reliance on the contents of this information by person(s) or entities other than the intended recipient is strictly prohibited and may be unlawful. If you are not the addressee, or person responsible for delivering it to the addressee, you should not copy or deliver this to anyone else. If you receive this message by mistake, please notify us by responding to this email or telephone and immediately and permanently delete all copies of this message and any attachments from your system(s). We appreciate your assistance in preserving the confidentiality of our correspondence. Any information in this message that does not relate to the official business of the organization shall be understood as neither given nor endorsed by it. The contents of this message do not necessarily represent the views or policies of the Hardik Printers. Computer viruses can be transmitted via email. Hardik Printers attempts to sweep e-mails and attachments for viruses, it does not guarantee that either are virus free. The recipient should check this email and any attachments for the presence of viruses. Hardik Printers shall neither be liable for security of any information transmitted electronically nor be liable or responsible for the proper, timely and complete transmission thereof.

2 1

Re: [stunnel-users] build static stunnel with openssl
by Peter Pentchev 08 Oct '18

08 Oct '18

On Mon, Oct 08, 2018 at 03:09:07PM +0800, White Little wrote: > Thanks, Eric > > But I did not put it on /usr/local/opensl or /usr/local/stunnel > > > Below is my configuration log > > > [root@Stunnel-Fedora stunnel-5.49]# ./configure --enable-static > --with-ssl=/root/stunnel/openssl-1.1.0i [snip] > configure: **************************************** TLS [snip] > checking for TLS directory... /root/stunnel/openssl-1.1.0i [snip] > > I tested on ubuntu14.04, 16.04 64bit and fedora 32bit, all of them are > them are not include opennssl. What exactly makes you think that this does not include OpenSSL support? The configure script seemed to find the include/openssl/ directory in the directory that you specified; does the build fail somehow later? If it does, show us the logs from the failed build. Or does the compiled executable does not say "Compiled with OpenSSL 1.1.0i"? If it does not, show us the full build log (maybe use a pastebin-like service somewhere, e.g. paste.debian.net) BTW a question: is /root/stunnel/openssl-1.1.0i the place you extracted and compiled OpenSSL, or the place you installed it after building it? If you just built it there, you also need to install it somewhere and point the stunnel configure script at the directory where it is installed, not at the build tree. This might mean that you may need to rebuild it again after specifying a --prefix or something like that (I do not remember exactly how the OpenSSL build works). G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Re: [stunnel-users] build static stunnel with openssl
by Eric Eberhard 06 Oct '18

06 Oct '18

Make openssl and stunnel static. That is what I do and I consider it MUCH smarter than dynamic. I got tired of getting support calls because stunnel stopped working because the user installed a new openssl. Static will always work. Another piece of advice – do NOT put it on /usr/local/opensl or /usr/local/stunnel (or whatever the defaults are). Before building make your OWN directories. Our short name for our product is “met” so we use /usr/local/met/obj and /usr/local/met/bin for the object and binary files, respectively. This ensures nobody will install over you. This is also a real security issue mostly ignored. Most people have heard of SQL injection (where SQL is modified to do what the developer never intended). However, DLL injection (e.g. dynamic library injection) is a real problem. I could easily install an openssl DLL that does exactly what it should do … and sends the same data in clear text (or with my own encryption) to my machine. A thief could simply install one dynamic library and then OWN your data. E From: stunnel-users [mailto:[email protected]] On Behalf Of White Little Sent: Sunday, September 30, 2018 11:33 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] build static stunnel with openssl Hi All I try to build a static (portable) stunnel that contain opensll. I know there are some similar questions long ago, but I still fail on how to build it. I try to link the stunnel to latest openssl, so I download the openssl-1.0.2p and make it. And then I type ./configure --enable-static --with-ssl= openssl-1.0.2p_dir And typing make, I found there is a stunnel binary under /src folder, but it still not include the openssl. Do I miss something that I did not notice? Thanks

1 0

server mode support for both ECC and RSA server certificates
by Tom Hood 02 Oct '18

02 Oct '18

Hi, Can one stunnel service in server mode be configured with both ECDSA and RSA server certs? The stunnel man page Certificates section suggests only one can be specified along with its CA chain. Use case is some legacy clients don't support ECDSA, but it would be nice to support ECDSA when a client does support it. It appears that HAProxy supports this <https://www.haproxy.com/blog/serving-ecc-and-rsa-certificates-on-same-ip-wi…>,but I'm hoping there is an equivalent way to do this with stunnel. I'm currently testing with stunnel 5.49 with OpenSSL 1.0.2p on Solaris 11.3, but can rebuild with any version of openssl if that helps. Thanks, -- Tom

1 0

build static stunnel with openssl
by White Little 01 Oct '18

01 Oct '18

Hi All I try to build a static (portable) stunnel that contain opensll. I know there are some similar questions long ago, but I still fail on how to build it. I try to link the stunnel to latest openssl, so I download the openssl-1.0.2p and make it. And then I type *./configure --enable-static --with-ssl= openssl-1.0.2p_dir* And typing make, I found there is a stunnel binary under /src folder, but it still not include the openssl. Do I miss something that I did not notice? Thanks

1 0

Re: [stunnel-users] stunnel log rolling
by Eric Eberhard 17 Sep '18

17 Sep '18

Most O/S will either prevent renaming a file that is in use (or deleting it). Some will – but they will actually continue to write to the old file (and if that file was deleted then it writes to a file you can nexer see). Since I generally use AIX it is the second feature I see. We have systems with over 500 connections via stunnel – it never rests, and rolling the log file is not easy. I can easily provide a code fix for stunnel that we use in out software. It allows daily logs, sized logs, etc. And it rolls properly. The downside is we open the log, write to it, and close it – each time – which is not efficient. Given modern computers I have come to not care. So the open routine either opens (append) a daily file or it looks up the file and gets the size and decides to move it (or not). The second is not perfect … if three other processes have it open at the moment they will finish writing to that log. Who cares? As long as the logging is always opening and closing the “bleed over” is minimized. If people want me to do this, I will – if they can tell me the log routines it would speed me some, preventing from having to search for them. We like and prefer the daily logs – it is clean as you get one per day. As long as one day is never too huge it is great and we have daemons that remove logs over xx number of days (although I could add a simple parameter for that as well and simply kill those files). This is an annoying problem – especially for multi-O/S software – but one I am good at. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Daniel Trickett Sent: Wednesday, September 12, 2018 11:16 AM To: Tom Hood <tom.w.hood(a)gmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel log rolling Hi Tom, Is what you refer to? I think the open and re-open only happen when the service is stopped and restarted. It hasn’t rolled over like Apache in my short experience. log = append | overwrite log file handling This option allows you to choose whether the log file (specified with the output option) is appended or overwritten when opened or re-opened. default: append Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence – MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email <mailto:[email protected]> daniel.trickett(a)emdmillipore.com From: Tom Hood <tom.w.hood(a)gmail.com <mailto:[email protected]> > Sent: Wednesday, September 12, 2018 1:10 PM To: Daniel Trickett <daniel.trickett(a)emdmillipore.com <mailto:[email protected]> > Cc: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: Re: [stunnel-users] stunnel log rolling Hi Daniel, The trick is how to roll the logs without an interruption of service (i.e. without a stunnel restart). I believe stunnel claims to support this, but I think the feature might be broken in 5.49 Thanks, -- Tom On Wed, Sep 12, 2018 at 5:43 AM Daniel Trickett <daniel.trickett(a)emdmillipore.com <mailto:[email protected]> > wrote: Tom, Kill the stunnel process. Then mv the log. This will allow stunnel to right to a new log file. Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence – MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email <mailto:[email protected]> daniel.trickett(a)emdmillipore.com From: stunnel-users <stunnel-users-bounces(a)stunnel.org <mailto:[email protected]> > On Behalf Of Tom Hood Sent: Tuesday, September 11, 2018 5:02 PM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] stunnel log rolling Hi, I'm new to stunnel and it isn't clear to me how the log rolling feature works. I built stunnel 5.49 with gcc 4.2.0 on Solaris 10. I'm running it on Solaris 11.3 SPARC. Using openssl 1.0.2p The config file has disabled syslog and is logging to stunnel.log. Command line is: stunnel stunnel.conf where stunnel.conf contains the following: syslog = no output = stunnel.log debug = 7 [service-exterior] client = no options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = -NO_TLSv1.2 cert = /path/to/stunnel.pem curve = zzz accept = testhost:32100 connect = 127.0.0.1:32200 <http://127.0.0.1:32200> [service-interior] client = yes options = NO_SSLv2 options = NO_SSLv3 accept = 127.0.0.1:32200 <http://127.0.0.1:32200> connect = 127.0.0.1:32100 <http://127.0.0.1:32100> sslVersion = TLSv1 ciphers = zzz TIMEOUTconnect = 60 The log rollowing steps I tried that don't work are: mv stunnel.log stunnel.log.1 kill -USR1 <stunnelpid> The log message "LOG7[main]: Processing SIGNAL_REOPEN_LOG" shows up in stunnel.log.1. However, new client connections to host:32100 do not trigger creation of a new stunnel.log file. In fact, logging stops to stunnel.log.1 as soon as the USR1 is processed. The new client connections work as before, but there isn't any logging. I restarted stunnel and tried the test again with these steps: mv stunnel.log stunnel.log.1 touch stunnel.log kill -USR1 <stunnelpid> That also doesn't work. Please let me know the correct sequence of steps to roll the stunnel.log Thank you, -- Tom This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer. This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

2 1

stunnel log rolling
by Tom Hood 12 Sep '18

12 Sep '18

Hi, I'm new to stunnel and it isn't clear to me how the log rolling feature works. I built stunnel 5.49 with gcc 4.2.0 on Solaris 10. I'm running it on Solaris 11.3 SPARC. Using openssl 1.0.2p The config file has disabled syslog and is logging to stunnel.log. Command line is: stunnel stunnel.conf where stunnel.conf contains the following: syslog = no output = stunnel.log debug = 7 [service-exterior] client = no options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = -NO_TLSv1.2 cert = /path/to/stunnel.pem curve = zzz accept = testhost:32100 connect = 127.0.0.1:32200 [service-interior] client = yes options = NO_SSLv2 options = NO_SSLv3 accept = 127.0.0.1:32200 connect = 127.0.0.1:32100 sslVersion = TLSv1 ciphers = zzz TIMEOUTconnect = 60 The log rollowing steps I tried that don't work are: mv stunnel.log stunnel.log.1 kill -USR1 <stunnelpid> The log message "LOG7[main]: Processing SIGNAL_REOPEN_LOG" shows up in stunnel.log.1. However, new client connections to host:32100 do not trigger creation of a new stunnel.log file. In fact, logging stops to stunnel.log.1 as soon as the USR1 is processed. The new client connections work as before, but there isn't any logging. I restarted stunnel and tried the test again with these steps: mv stunnel.log stunnel.log.1 touch stunnel.log kill -USR1 <stunnelpid> That also doesn't work. Please let me know the correct sequence of steps to roll the stunnel.log Thank you, -- Tom

2 4

stunnel 5.49 released
by Michal Trojnara 03 Sep '18

03 Sep '18

Dear Users, I have released version 5.49 of stunnel. Version 5.49, 2018.09.03, urgency: MEDIUM * New features - Performance optimizations. - Logging of negotiated or resumed TLS session IDs (thx to ANSSI - National Cybersecurity Agency of France). - Merged Debian 10-enabled.patch and 11-killproc.patch (thx to Peter Pentchev). - OpenSSL DLLs updated to version 1.0.2p. - PKCS#11 engine DLL updated to version 0.4.9. * Bugfixes - Fixed a crash in the session persistence implementation. - Fixed syslog identifier after configuration file reload. - Fixed non-interactive "make check" invocations. - Fixed reloading syslog configuration. - stunnel.pem created with SHA-256 instead of SHA-1. - SHA-256 "make check" certificates. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 3d6641213a82175c19f23fde1c3d1c841738385289eb7ca1554f4a58b96d955e stunnel-5.49.tar.gz 459bbb212baf0b9821c80e0664c830246ef6e97c7329fb08160e87ff11ae9692 stunnel-5.49-win32-installer.exe 72416c6664106ad815a8da67a525c6593247fc06cbca3b8918ffc87ae92595e8 stunnel-5.49-android.zip Best regards, Mike

1 0

Adding custom HTTP headers to a proxy'ed HTTP request when stunnel is used as an endpoint for a HTTP proxy
by Tony Cheneau 02 Sep '18

02 Sep '18

Good evening folks, Michal was kind enough to review and rewrite/integrate one of my patches for logging session IDs [1] and post the remaining ones on the website [2]! So, I feel I should also contribute to this list a little program I wrote. It is meant to be used with the exec= directive. It is mostly useful when stunnel is used to secure a connexion between a client and a HTTP proxy. A stunnel instance can run locally on the client while a stunnel server runs on the HTTP proxy: HTTP client (proxy'ed) <- > stunnel client <--> stunnel server <-> HTTP proxy Here, the "exec=" program will run on the stunnel server and add some extra headers to each HTTP request. One of this headers is the client's Distinguished Name (from its X.509 certificate). The HTTP proxy (squid for example) can then make some decision based on this HTTP header (authorisation, etc.). It relies heavily on PicoHTTPParser. Regards, Tony Cheneau [1]: to appear in version 5.49, see https://www.stunnel.org/sdf_ChangeLog.html [2]: patches 0002 and 0003 on https://www.stunnel.org/patches.html

1 0

OpenSSL 1.1.1 secure level and also an old problem rearing up
by Peter Pentchev 26 Aug '18

26 Aug '18

Hi, Sorry to be the bearer of a "those OS vendors did something again and now we have to catch up with them... again..." type of news, but, well, the maintainers of the Debian package of OpenSSL upgraded it to a prerelease 1.1.1 version and, in the process, changed the default cipher selection in the openssl.cnf file to 'SECLEVEL=2'. Unfortunately, this means that the server certificate used in the stunnel test suite is not considered strong enough, so the test suite is failing. More details may be found in the description of the Debian bug https://bugs.debian.org/906981 and the error message itself is at https://ci.debian.net/data/autopkgtest/testing/amd64/s/stunnel4/865956/log.… (look for all the lines containing "SSL_CTX_use_certificate:ca md too weak") So my first reaction was to stop running the stunnel test suite and only leave my functional test script; however, I then had another idea and tried to get the stunnel test suite to explicitly specify SECLEVEL=1 using the attached patch. This actually helped a bit - it made most of the tests pass - but then I hit a problem with e.g. 037_failover_prio1: if there is a "ciphers" option in the config file, stunnel eventually dies with an error that I seem to remember having seen before; take a look at this gdb backtrace from stunnel 5.48: (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007f0a349882f1 in __GI_abort () at abort.c:79 #2 0x000055b1aa3ad645 in fatal_debug (txt=0x55b1aa3c503c "Bad magic", file=0x55b1aa3ca6dd "ssl.c", line=118) at log.c:379 #3 0x000055b1aa3ae066 in get_alloc_list_ptr (ptr=0x7f0a24014520, file=0x55b1aa3ca6dd "ssl.c", line=118) at str.c:429 #4 0x000055b1aa3ae229 in str_detach_debug (ptr=ptr@entry=0x7f0a24014520, file=file@entry=0x55b1aa3ca6dd "ssl.c", line=line@entry=118) at str.c:378 #5 0x000055b1aa3ae884 in str_detach_debug (line=118, file=0x55b1aa3ca6dd "ssl.c", ptr=0x7f0a24014520) at str.c:413 #6 str_free_debug (ptr=0x7f0a24014520, file=0x55b1aa3ca6dd "ssl.c", line=118) at str.c:413 #7 0x00007f0a34f7661a in CRYPTO_free_ex_data () from /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 #8 0x00007f0a35112a98 in SSL_SESSION_free () from /usr/lib/x86_64-linux-gnu/libssl.so.1.1 #9 0x00007f0a34f7a1bc in OPENSSL_LH_doall_arg () from /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 #10 0x00007f0a35114177 in SSL_CTX_flush_sessions () from /usr/lib/x86_64-linux-gnu/libssl.so.1.1 #11 0x000055b1aa3c3701 in unbind_ports () at stunnel.c:439 #12 0x000055b1aa3c3799 in main_cleanup () at stunnel.c:224 #13 0x000055b1aa3ad720 in main (argc=<optimized out>, argv=<optimized out>) at ui_unix.c:79 (gdb) (the line numbers may be a bit off from the stock stunnel source, since I also added a setrlimit(RLIMIT_CORE, infinity) patch) So, yeah, what would be the best way forward here? I guess I might create a new certificate specifically for the Debian package's test suite, but I think the double-free problem may also need to be fixed. Let me know if you need any more information about reproducing it or any more data in case it doesn't happen on your end. Thanks for everything you're doing for stunnel, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

2 2

Log to syslog without process name, after reloading the configuration (sighup)
by Reschke, Sven (VWIF G-TS/P) 22 Aug '18

22 Aug '18

Hi, I've upgraded my stunnel from version 5.44 to 5.45. After reloading the configuration of stunnel (via pkill -sighup stunnel) several times, I've stumbled about missing syslogs. Only the loading of the configuration file was still visible. Then I've noticed, that greping the syslog for stunnel was my mistake. Stunnel doesn't log its process name after reloading the configuration file the second time (see logs below) Can someone verify, or is it just me, or some configuration I'm missing? BTW: I've reproduced the "problem" also for the version 5.48 as you can see from the logs. With version 5.44 stunnel always logged its process name to syslog. Syslog output for greping after "stunnel": Aug 17 13:41:14 <user> stunnel: LOG5[ui]: stunnel 5.48 on armv7l-unknown-linux-gnueabihf platform Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Compiled/running with OpenSSL 1.0.2p 14 Aug 2018 Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Reading configuration from file /home/pi/stunnel.conf Aug 17 13:41:14 <user> stunnel: LOG5[ui]: UTF-8 byte order mark not detected Aug 17 13:41:14 <user> stunnel: LOG5[ui]: FIPS mode disabled Aug 17 13:41:14 <user> stunnel: LOG4[ui]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:14 <user> stunnel: LOG4[ui]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Configuration successful ---------------- Reloading the configuration the first time ----------------------- Aug 17 13:41:21 <user> stunnel: LOG5[main]: Reading configuration from file /home/pi/stunnel.conf Aug 17 13:41:21 <user> stunnel: LOG5[main]: UTF-8 byte order mark not detected Aug 17 13:41:21 <user> stunnel: LOG5[main]: FIPS mode disabled Aug 17 13:41:21 <user> stunnel: LOG4[main]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:21 <user> stunnel: LOG4[main]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:21 <user> stunnel: LOG5[main]: Configuration successful ---------------- Reloading the configuration a second time ------------------------ Aug 17 13:41:26 <user> : LOG5[main]: Reading configuration from file /home/pi/stunnel.conf My configuration file: [PSK client] client = yes accept = <listen address> connect = <remote address> PSKsecrets = /home/pi/psk.txt [PSK server] accept = <listen address> connect = <remote address> PSKsecrets = /home/pi/psk.txt Sven Reschke Embedded System SW Developer G-TS/P Volkswagen Infotainment GmbH Universitätsstr. 140 44799 Bochum Mobile +49 1525-887 2762 sven.reschke(a)volkswagen-infotainment.com<mailto:[email protected]> http://www.volkswagen-infotainment.com<http://www.volkswagen-infotainment.com/> Sitz der Gesellschaft: Wolfsburg Amtsgericht Braunschweig: HRB 204780 Geschäftsführung: Bernhard Krauße (Sprecher), Tobias Nadjib

2 2

OFFICE 365
by Mark Brezinski 15 Aug '18

15 Aug '18

Hello, Anyone have any luck connecting stunnel to office 365 I keep getting a socket 10061 error Mark Brezinski IT / EDI Manager [cid:[email protected]]Healthcare, Inc. Proud Winner of the US National Minority Manufacturer of the Year Award 2012, MBDA, US Dept of Commerce Proud Winner of the Supplier of the Year Award 2012, Chicago Minority Supplier Development Council (Class IV >$50MM) Manufacturer of Medical Devices & Disposable Kits 5535 N. Wolcott Avenue Chicago, IL 60640 Tel : (773) 878-1100 ext.277 Fax: (773) 878-9100 mark.brezinski(a)lslhealthcare.com<mailto:[email protected]> www.LSLHealthcare.com<http://www.lslhealthcare.com/> Notice: If you are not the intended recipient, please note that any dissemination, disclosure, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately by telephone or by return e-mail and delete it from their computer. This communication may contain information that is privileged, confidential or exempt from disclosure. P LSL Healthcare, Inc.is dedicated to preserving our environment. Please join us and consider not printing this e-mail unless necessary.

1 0

x64 Installers and Upgrade HowTo
by Cynthia Davis 07 Aug '18

07 Aug '18

Two questions for the mailing list: 1. Are win64 installers available for stunnel? I only see win32 installers on the downloads page. 2. Are there formal (or informal) instructions for upgrading an existing stunnel installation? Thanks in advance, CJD

1 0

zlib1.dll not installed
by Gonzalo Costantini 01 Aug '18

01 Aug '18

Hi, The installer stunnel-5.48-win32-installer.exe do not copy zlib1.dll in any directory; this problem begins with the installer stunnel-5.44-win32-installer. Thaks. -- Luis Gonzalo Costantini Rickel Clave GPG (GPG Key): Fingerprint: 081069E0C552DFBDF53A0D2046ECD11A960D250F Key-ID.: 0x960D250F

1 0

Re: [stunnel-users] Is there a way to specify certificate content in stunnel config
by Eric S Eberhard 24 Jul '18

24 Jul '18

Use stunnel in inetd mode. Execute a script (or better C program). Copy the certificates for making the stunnel connection to a directory that is OK … then delete them immediately after stunnel starts. Hack – but might be OK for what you are doing. I am not sure why anyone would think it more secure to put the keys into the stunnel command than to just use them from a file … but I likely do not know enough about your application to make a judgement. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 From: stunnel-users [mailto:[email protected]] On Behalf Of Hari Sent: Thursday, July 19, 2018 4:42 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Is there a way to specify certificate content in stunnel config Hi, I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them. Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged. Thanks Hari <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> Virus-free. <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> www.avg.com

3 2

Grok log parsing
by Manuele Trimarchi 24 Jul '18

24 Jul '18

I would ask if someone use Grok log parsing for stunnel and, if yes, what kind of filter statement are you using? At the moment I've just created 2 parser: STUNNEL_AcceptedConnectionParser %{date("yyyy.MM.dd HH:mm:ss"):date} LOG%{integer:loglevel}\[%{integer:session_id}\]\: Service \[%{word:csb_name}\-%{word:csb_port}\] accepted connection from %{ipv4:caller_ip}\:%{port:caller_port} and STUNNEL_ConnectionClosedParser %{date("yyyy.MM.dd HH:mm:ss"):date} LOG%{integer:loglevel}\[%{integer:session_id}\]\: Connection closed\: %{integer:byte_tx} byte$s$ sent to SSL\, %{integer:byte_rx} byte$s$ sent to socket I'm new with Grok and all the things related to log match-and-parse, so I think that there will be a much better solution than mine, anyway Google this time doesn't help unfortunately. Thank you so much to all those who will help me with this stuff! Manuele

1 1

Cross Compiling Stunnel-5.48 Using BoringSSL
by Jaymin D 24 Jul '18

24 Jul '18

Hi All, I want to cross compile the Stunnel-5.48 for my Android AOSP (arch64) platform using BoringSSL's 'libssl.so' and 'libcrypto.so' libraries. I have successfully cross compiled the BoringSSL in my AOSP and both .so file was generated for arch64 platform. Am using BoringSSL which was delivered with Android AOSP (Android 7). Am cross compiling using "build-android.sh" script. But, while cross compiling the Stunnel-5.48 facing error as below: ------------------------------------------------------------------------------------------------ VERSION=5.48 > DST=stunnel-$VERSION-android > # to build OpenSSL: > # ./Configure threads no-shared no-dso > --cross-compile-prefix=arm-linux-androideabi- > --prefix=/opt/androideabi/sysroot linux-armv4 > # make install > LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE" > export LDFLAGS > test -f Makefile && make distclean > mkdir -p bin/android > cd bin/android > ../../configure --with-pic --enable-shared --with-sysroot > --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib > configure: **************************************** initialization > checking for a BSD-compatible install... /usr/bin/install -c > checking whether build environment is sane... yes > checking for aarch64-linux-android-strip... no > checking for strip... strip > checking for a thread-safe mkdir -p... /bin/mkdir -p > checking for gawk... gawk > checking whether make sets $(MAKE)... yes > checking whether make supports nested variables... yes > checking build system type... x86_64-pc-linux-gnu > checking host system type... aarch64-unknown-linux-android > checking for aarch64-linux-android-gcc... no > checking for gcc... gcc > checking whether the C compiler works... yes > checking for C compiler default output file name... a.out > checking for suffix of executables... > checking whether we are cross compiling... no > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ISO C89... none needed > checking whether gcc understands -c and -o together... yes > checking for style of include used by make... GNU > checking dependency style of gcc... gcc3 > checking whether make sets $(MAKE)... (cached) yes > checking whether make supports nested variables... (cached) yes > configure: **************************************** thread model > checking for a sed that does not truncate output... /bin/sed > checking how to run the C preprocessor... gcc -E > checking for grep that handles long lines and -e... /bin/grep > checking for egrep... /bin/grep -E > checking whether gcc is Clang... no > checking whether pthreads work with -pthread... yes > checking for joinable pthread attribute... PTHREAD_CREATE_JOINABLE > checking whether more special flags are required for pthreads... no > checking for PTHREAD_PRIO_INHERIT... yes > configure: PTHREAD thread model detected > configure: **************************************** compiler/linker flags > checking whether C compiler accepts -Wall... yes > checking whether C compiler accepts -Wextra... yes > checking whether C compiler accepts -Wpedantic... yes > checking whether C compiler accepts -Wformat=2... yes > checking whether C compiler accepts -Wconversion... yes > checking whether C compiler accepts -Wno-long-long... yes > checking whether C compiler accepts -Wno-deprecated-declarations... yes > checking whether C compiler accepts -fPIE... yes > checking whether C compiler accepts -fstack-protector... yes > checking whether the linker accepts -fPIE... yes > checking whether the linker accepts -pie... yes > checking whether the linker accepts -Wl,-z,relro... yes > checking whether the linker accepts -Wl,-z,now... yes > checking whether the linker accepts -Wl,-z,noexecstack... yes > checking whether C compiler accepts -D_FORTIFY_SOURCE=2... yes > configure: **************************************** libtool > checking how to print strings... printf > checking for a sed that does not truncate output... (cached) /bin/sed > checking for fgrep... /bin/grep -F > checking for ld used by gcc... /usr/bin/ld > checking if the linker (/usr/bin/ld) is GNU ld... yes > checking for BSD- or MS-compatible name lister (nm)... no > checking for aarch64-linux-android-dumpbin... no > checking for aarch64-linux-android-link... no > checking for dumpbin... no > checking for link... link -dump > checking the name lister (nm) interface... BSD nm > checking whether ln -s works... yes > checking the maximum length of command line arguments... 1572864 > checking how to convert x86_64-pc-linux-gnu file names to > aarch64-unknown-linux-android format... func_convert_file_noop > checking how to convert x86_64-pc-linux-gnu file names to toolchain > format... func_convert_file_noop > checking for /usr/bin/ld option to reload object files... -r > checking for aarch64-linux-android-objdump... no > checking for objdump... objdump > checking how to recognize dependent libraries... pass_all > checking for aarch64-linux-android-dlltool... no > checking for dlltool... no > checking how to associate runtime and link libraries... printf %s\n > checking for aarch64-linux-android-ar... no > checking for ar... ar > checking for archiver @FILE support... @ > checking for aarch64-linux-android-strip... strip > checking for aarch64-linux-android-ranlib... no > checking for ranlib... ranlib > checking command to parse nm output from gcc object... ok > checking for sysroot... / > checking for a working dd... /bin/dd > checking how to truncate binary pipes... /bin/dd bs=4096 count=1 > checking for aarch64-linux-android-mt... no > checking for mt... mt > checking if mt is a manifest tool... no > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking for dlfcn.h... yes > checking for objdir... .libs > checking if gcc supports -fno-rtti -fno-exceptions... no > checking for gcc option to produce PIC... -fPIC -DPIC > checking if gcc PIC flag -fPIC -DPIC works... yes > checking if gcc static flag -static works... no > checking if gcc supports -c -o file.o... yes > checking if gcc supports -c -o file.o... (cached) yes > checking whether the gcc linker (/usr/bin/ld) supports shared libraries... > yes > checking whether -lc should be explicitly linked in... no > checking dynamic linker characteristics... Android linker > checking how to hardcode library paths into programs... immediate > checking whether stripping libraries is possible... yes > checking if libtool supports shared libraries... yes > checking whether to build shared libraries... yes > checking whether to build static libraries... no > configure: **************************************** types > checking for int8_t... yes > checking for int16_t... yes > checking for int32_t... yes > checking for int64_t... yes > checking for uint8_t... yes > checking for uint16_t... yes > checking for uint32_t... yes > checking for uint64_t... yes > checking for size_t... yes > checking for ssize_t... yes > checking for uid_t in sys/types.h... yes > checking for socklen_t... yes > checking for struct sockaddr_un... yes > checking for struct addrinfo... yes > configure: **************************************** PTY device files > checking for "/dev/ptmx"... yes > checking for "/dev/ptc"... no > configure: **************************************** entropy sources > checking for "/dev/urandom"... yes > configure: **************************************** default group > checking for default group... nogroup > checking for special C compiler options needed for large files... no > checking for _FILE_OFFSET_BITS value needed for large files... no > configure: **************************************** header files > checking for stdint.h... (cached) yes > checking for inttypes.h... (cached) yes > checking malloc.h usability... yes > checking malloc.h presence... yes > checking for malloc.h... yes > checking ucontext.h usability... yes > checking ucontext.h presence... yes > checking for ucontext.h... yes > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes > checking poll.h usability... yes > checking poll.h presence... yes > checking for poll.h... yes > checking tcpd.h usability... no > checking tcpd.h presence... no > checking for tcpd.h... no > checking stropts.h usability... yes > checking stropts.h presence... yes > checking for stropts.h... yes > checking grp.h usability... yes > checking grp.h presence... yes > checking for grp.h... yes > checking for unistd.h... (cached) yes > checking util.h usability... no > checking util.h presence... no > checking for util.h... no > checking libutil.h usability... no > checking libutil.h presence... no > checking for libutil.h... no > checking pty.h usability... yes > checking pty.h presence... yes > checking for pty.h... yes > checking limits.h usability... yes > checking limits.h presence... yes > checking for limits.h... yes > checking for sys/types.h... (cached) yes > checking sys/select.h usability... yes > checking sys/select.h presence... yes > checking for sys/select.h... yes > checking sys/poll.h usability... yes > checking sys/poll.h presence... yes > checking for sys/poll.h... yes > checking sys/socket.h usability... yes > checking sys/socket.h presence... yes > checking for sys/socket.h... yes > checking sys/un.h usability... yes > checking sys/un.h presence... yes > checking for sys/un.h... yes > checking sys/ioctl.h usability... yes > checking sys/ioctl.h presence... yes > checking for sys/ioctl.h... yes > checking sys/filio.h usability... no > checking sys/filio.h presence... no > checking for sys/filio.h... no > checking sys/resource.h usability... yes > checking sys/resource.h presence... yes > checking for sys/resource.h... yes > checking sys/uio.h usability... yes > checking sys/uio.h presence... yes > checking for sys/uio.h... yes > checking sys/syscall.h usability... yes > checking sys/syscall.h presence... yes > checking for sys/syscall.h... yes > checking linux/sched.h usability... yes > checking linux/sched.h presence... yes > checking for linux/sched.h... yes > checking for struct msghdr.msg_control... yes > checking for linux/netfilter_ipv4.h... yes > configure: **************************************** libraries > checking for library containing gethostbyname... none required > checking for library containing yp_get_default_domain... -lnsl > checking for library containing socket... none required > checking for library containing openpty... -lutil > checking for library containing dlopen... -ldl > checking for library containing shl_load... no > configure: **************************************** library functions > checking for snprintf... yes > checking for vsnprintf... yes > checking for openpty... yes > checking for _getpty... no > checking for daemon... yes > checking for waitpid... yes > checking for wait4... yes > checking for setsid... yes > checking for setgroups... yes > checking for chroot... yes > checking for realpath... yes > checking for sysconf... yes > checking for getrlimit... yes > checking for pthread_sigmask... yes > checking for localtime_r... yes > checking for getcontext... yes > checking for __makecontext_v2... no > checking for poll... yes > checking for gethostbyname2... yes > checking for endhostent... yes > checking for getnameinfo... yes > checking for getaddrinfo... yes > checking for broken poll() implementation... no > checking for pipe2... yes > checking for accept4... yes > configure: **************************************** optional features > checking whether to enable IPv6 support... yes (default) > checking whether to enable FIPS support... autodetecting > checking whether to enable systemd socket activation support... > autodetecting > checking for library containing sd_listen_fds... no > configure: systemd library not found > checking whether to enable TCP wrappers support... autodetecting > checking for hosts_access in -lwrap... no > configure: libwrap library not found > configure: **************************************** TLS > checking for compiler sysroot... / > checking for TLS directory... /home/jaymin/Desktop/boringssl_lib > checking for FIPS_mode_set... yes > configure: FIPS support enabled > configure: **************************************** write the results > checking that generated files are newer than configure... done > configure: creating ./config.status > config.status: creating Makefile > config.status: creating src/Makefile > config.status: creating doc/Makefile > config.status: creating tools/Makefile > config.status: creating tests/Makefile > config.status: creating src/config.h > config.status: src/config.h is unchanged > config.status: executing depfiles commands > config.status: executing libtool commands > configure: **************************************** success > make clean > Making clean in src > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > rm -f stunnel > test -z "stunnel3" || rm -f stunnel3 > rm -rf .libs _libs > rm -rf ../obj ../bin > test -z "libstunnel.la" || rm -f libstunnel.la > rm -f ./so_locations > rm -f *.o > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Making clean in doc > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc' > test -z "stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html" || rm -f > stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc' > Making clean in tools > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools' > test -z "stunnel.conf-sample stunnel.init stunnel.service" || rm -f > stunnel.conf-sample stunnel.init stunnel.service > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools' > Making clean in tests > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests' > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests' > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android' > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android' > make > Making all in src > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > make all-am > make[2]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > CC env.lo > CCLD libstunnel.la > CC stunnel-tls.o > CC stunnel-str.o > CC stunnel-file.o > CC stunnel-client.o > CC stunnel-log.o > CC stunnel-options.o > CC stunnel-protocol.o > CC stunnel-network.o > CC stunnel-resolver.o > CC stunnel-ssl.o > CC stunnel-ctx.o > CC stunnel-verify.o > CC stunnel-sthreads.o > CC stunnel-fd.o > CC stunnel-dhparam.o > CC stunnel-cron.o > CC stunnel-stunnel.o > CC stunnel-pty.o > CC stunnel-libwrap.o > CC stunnel-ui_unix.o > CCLD stunnel > /usr/bin/ld: skipping incompatible > /home/jaymin/Desktop/boringssl_lib/libssl.so when searching for -lssl > /usr/bin/ld: skipping incompatible > /home/jaymin/Desktop/boringssl_lib/libcrypto.so when searching for -lcrypto > stunnel-str.o: In function `str_leak_debug': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:459: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:470: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:501: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:509: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `session_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:568: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:581: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `ssl_start': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:501: > undefined reference to `OpenSSL_version_num' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:519: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:511: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:502: > undefined reference to `OpenSSL_version_num' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:503: > undefined reference to `OpenSSL_version_num' > stunnel-client.o: In function `print_cipher': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:595: > undefined reference to `SSL_session_reused' > stunnel-client.o: In function `idx_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1446: > undefined reference to `SSL_session_reused' > stunnel-client.o: In function `idx_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1432: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1436: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `idx_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1447: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1453: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1469: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `client_run': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:224: > undefined reference to `CRYPTO_atomic_add' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:323: > undefined reference to `CRYPTO_atomic_add' > stunnel-log.o: In function `log_close': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:109: > undefined reference to `CRYPTO_THREAD_write_lock' > stunnel-log.o: In function `s_log': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:165: > undefined reference to `CRYPTO_THREAD_read_lock' > stunnel-log.o: In function `log_queue': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:194: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:201: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `s_log': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:170: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_flush': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:205: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:211: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:219: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_close': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:115: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_flush': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:220: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-options.o: In function `engine_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:4219: > undefined reference to `OPENSSL_init_crypto' > stunnel-options.o: In function `service_up_ref': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614: > undefined reference to `CRYPTO_atomic_add' > stunnel-options.o: In function `parse_global_option': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:681: > undefined reference to `OpenSSL_version_num' > stunnel-options.o: In function `tls_methods_set': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3514: > undefined reference to `TLS_client_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3515: > undefined reference to `TLS_server_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3506: > undefined reference to `TLS_client_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3507: > undefined reference to `TLS_server_method' > stunnel-options.o: In function `service_up_ref': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614: > undefined reference to `CRYPTO_atomic_add' > stunnel-options.o: In function `service_free': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:624: > undefined reference to `CRYPTO_atomic_add' > stunnel-ssl.o: In function `ssl_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:56: > undefined reference to `OPENSSL_init_ssl' > stunnel-ssl.o: In function `sk_SSL_COMP_pop': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_pop' > stunnel-ssl.o: In function `sk_SSL_COMP_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > stunnel-ssl.o: In function `sk_SSL_COMP_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_value' > stunnel-ssl.o: In function `compression_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:217: > undefined reference to `SSL_COMP_get0_name' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:221: > undefined reference to `SSL_COMP_get_id' > stunnel-ssl.o: In function `ssl_configure': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:127: > undefined reference to `OPENSSL_init_crypto' > stunnel-ssl.o: In function `compression_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:201: > undefined reference to `COMP_get_type' > stunnel-ctx.o: In function `info_callback': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:1231: > undefined reference to `SSL_get_state' > stunnel-ctx.o: In function `session_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:981: > undefined reference to `SSL_SESSION_up_ref' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:986: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-ctx.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-ctx.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-ctx.o: In function `session_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-ctx.o: In function `context_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:154: > undefined reference to `SSL_CTX_set_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:157: > undefined reference to `SSL_CTX_clear_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:161: > undefined reference to `SSL_CTX_set_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:164: > undefined reference to `SSL_CTX_clear_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:170: > undefined reference to `SSL_CTX_get_options' > stunnel-ctx.o: In function `dh_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:328: > undefined reference to `SSL_CTX_get_ciphers' > stunnel-ctx.o: In function `sk_SSL_CIPHER_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined > reference to `OPENSSL_sk_num' > stunnel-ctx.o: In function `sk_SSL_CIPHER_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined > reference to `OPENSSL_sk_value' > stunnel-ctx.o: In function `dh_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:356: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:358: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-verify.o: In function `ocsp_request': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:539: > undefined reference to `X509_STORE_CTX_get0_chain' > stunnel-verify.o: In function `get_current_issuer': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:701: > undefined reference to `X509_STORE_CTX_get0_chain' > stunnel-verify.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_OPENSSL_STRING_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151: > undefined reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_OPENSSL_STRING_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151: > undefined reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `cert_check_local': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:353: > undefined reference to `X509_STORE_CTX_get1_certs' > stunnel-verify.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_X509_pop_free': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_pop_free' > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_pop_free' > stunnel-verify.o: In function `sk_X509_NAME_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_NAME_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined > reference to `OPENSSL_sk_value' > stunnel-sthreads.o: In function `locking_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358: > undefined reference to `CRYPTO_THREAD_lock_new' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358: > undefined reference to `CRYPTO_THREAD_lock_new' > stunnel-dhparam.o: In function `get_dh2048': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/dhparam.c:49: > undefined reference to `DH_set0_pqg' > stunnel-cron.o: In function `cron_dh_param': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:193: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:196: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-stunnel.o: In function `stunnel_info': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:887: > undefined reference to `OpenSSL_version' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:889: > undefined reference to `OpenSSL_version' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:890: > undefined reference to `OpenSSL_version_num' > collect2: error: ld returned 1 exit status > Makefile:538: recipe for target 'stunnel' failed > make[2]: *** [stunnel] Error 1 > make[2]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Makefile:401: recipe for target 'all' failed > make[1]: *** [all] Error 2 > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Makefile:447: recipe for target 'all-recursive' failed > make: *** [all-recursive] Error 1 ------------------------------------------------------------------------------------------------ As I want to use SSL, did modification as below: --------------------------------------------------------------------------------------------- #!/bin/sh > set -ev > VERSION=5.48 > DST=stunnel-$VERSION-android > # to build OpenSSL: > # ./Configure threads no-shared no-dso > --cross-compile-prefix=arm-linux-androideabi- > --prefix=/opt/androideabi/sysroot linux-armv4 > # make install > LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE" > export LDFLAGS > test -f Makefile && make distclean > mkdir -p bin/android > cd bin/android > ../../configure --with-pic --enable-shared --with-sysroot > --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib > make clean > make > cd ../.. > mkdir $DST > cp bin/android/src/stunnel $DST > # arm-linux-androideabi-strip $DST/stunnel $DST/openssl > # cp /opt/androideabi/sysroot/bin/openssl $DST > # arm-linux-androideabi-strip $DST/openssl > zip -r $DST.zip $DST > rm -rf $DST > # sha256sum $DST.zip > # mv $DST.zip ../dist/ --------------------------------------------------------------------------------------------- How can I cross compile the Stunnel-5.48 using this BoringSSL? Are my BoringSSL's .so files incompatible? Any suggestions. Regards, Jaymin

1 0

"Reverse" tunneling with stunnel.
by C. Petro 20 Jul '18

20 Jul '18

I have a client who is setting up a logging infrastructure involving a couple of DMZs forwarding logs into central logging points. They have to pass compliance audits (SOX, PCI at least) and have some rather specific desires in regards to how they want the log traffic to move, and which servers *initiate* the connections. Which is to say they want the internal servers to set up tunnels to the DMZ servers and then the forwarders use that tunnel to deliver logs back. Lemme see if I can ascii art this: central1----------------------------------dmz1 \____________________ / _____________________\ _/ / \ central2----------------------------------dmz2 Something like that. Central1=10.10.1.2 Central2=10.9.1.2 DMZ1=172.18.0.5 DMZ2=172.20.0.5 Firewalls are in effect. I have gotten it set up so that I can initiate a connection FROM Central1 to DMZ2. [Tunnel_to_DMZ2] client = yes accept = 3002 connect = 172.20.0.5:5000 And [Tunnel_from_Central1] accept = 5000 connect = 3000 Like I said, I can open a tunnel from Central1 to DMZ2, but can't get traffic to pass backwards--I get a message in the log saying the session is closed. Is it possible to set stunnel up in a "reverse tunnel" mode--one where the connect is initiated from one end, but the other does most of the message passing? What I am missing? Thanks, Petro.

2 2

TLS alert (read): fatal: bad record mac (windows)
by Per Gunnarsson 19 Jul '18

19 Jul '18

I found it after looking once more in the log file. PSK client configured for identity "ï»¿user2" (the identity in the secrets.txt is user2:secretkey, somehow those three weird characters are added on windows) I got around it by copying the secrets.txt file to the server so that the secrets.txt on the server also begins with "ï»¿user2" but I suspect it's a bug. Regards, Per Gunnarsson

1 0

Is there a way to specify certificate content in stunnel config
by Hari 19 Jul '18

19 Jul '18

Hi, I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them. Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged. ThanksHari | | Virus-free. www.avg.com |

1 0

TLS alert (read): fatal: bad record mac (windows)
by Per Gunnarsson 19 Jul '18

19 Jul '18

Hello! I am trying to set up stunnel from a windows box to a VPS. I have working tunnels from a FreeBSD box to the VPS. On the VPS, the config looks like: [socks_server] protocol = socks PSKsecrets = /my/secret/location/secrets.txt accept = xxx.xxx.xxx.xxx:xxxx [ssh] PSKsecrets = /my/secret/location/hecrets.txt accept = xxx.xxx.xxx.xxx:xxxx connect = 127.0.0.1:22 On the windows box, the config looks like this: [socks_client2] debug = 7 client = yes PSKsecrets = c:\my\secret\location\secrets.txt accept = 127.0.0.1:1080 connect = xxx.xxx.xxx.xxx:xxxx The log on Windows looks like this: 2018.07.19 13:13:09 LOG5[main]: stunnel 5.48 on x86-pc-msvc-1500 platform 2018.07.19 13:13:09 LOG5[main]: Compiled/running with OpenSSL 1.0.2o-fips 27 Mar 2018 2018.07.19 13:13:09 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.07.19 13:13:09 LOG5[main]: Reading configuration from file stunnel.conf 2018.07.19 13:13:09 LOG5[main]: UTF-8 byte order mark detected 2018.07.19 13:13:09 LOG5[main]: FIPS mode disabled 2018.07.19 13:13:09 LOG5[main]: Configuration successful 2018.07.19 13:13:11 LOG7[0]: Service [socks_client2] started 2018.07.19 13:13:11 LOG7[0]: Setting local socket options (FD=460) 2018.07.19 13:13:11 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.19 13:13:11 LOG5[0]: Service [socks_client2] accepted connection from 127.0.0.1:56598 2018.07.19 13:13:11 LOG6[0]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:11 LOG7[0]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:13:11 LOG5[0]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:11 LOG5[0]: Service [socks_client2] connected remote server from 192.168.1.65:56599 2018.07.19 13:13:11 LOG7[0]: Setting remote socket options (FD=508) 2018.07.19 13:13:11 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.19 13:13:11 LOG7[0]: Remote descriptor (FD=508) initialized 2018.07.19 13:13:11 LOG6[0]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:13:11 LOG6[0]: Peer certificate not required 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): before/connect initialization 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:13:11 LOG6[0]: Client certificate not requested 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:13:11 LOG6[0]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 flush data 2018.07.19 13:13:11 LOG3[0]: SSL_connect: Peer suddenly disconnected 2018.07.19 13:13:11 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:13:11 LOG7[0]: Deallocating application specific data for session connect address 2018.07.19 13:13:11 LOG7[0]: Remote descriptor (FD=508) closed 2018.07.19 13:13:11 LOG7[0]: Local descriptor (FD=460) closed 2018.07.19 13:13:11 LOG7[0]: Service [socks_client2] finished (0 left) 2018.07.19 13:13:34 LOG7[1]: Service [socks_client2] started 2018.07.19 13:13:34 LOG7[1]: Setting local socket options (FD=528) 2018.07.19 13:13:34 LOG7[1]: Option TCP_NODELAY set on local socket 2018.07.19 13:13:34 LOG5[1]: Service [socks_client2] accepted connection from 127.0.0.1:56601 2018.07.19 13:13:34 LOG6[1]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:34 LOG7[1]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:13:34 LOG5[1]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:34 LOG5[1]: Service [socks_client2] connected remote server from 192.168.1.65:56602 2018.07.19 13:13:34 LOG7[1]: Setting remote socket options (FD=536) 2018.07.19 13:13:34 LOG7[1]: Option TCP_NODELAY set on remote socket 2018.07.19 13:13:34 LOG7[1]: Remote descriptor (FD=536) initialized 2018.07.19 13:13:34 LOG6[1]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:13:34 LOG6[1]: Peer certificate not required 2018.07.19 13:13:34 LOG7[1]: TLS state (connect): before/connect initialization 2018.07.19 13:13:34 LOG7[1]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:13:35 LOG6[1]: Client certificate not requested 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:13:35 LOG6[1]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 flush data 2018.07.19 13:13:35 LOG7[1]: TLS alert (read): fatal: bad record mac 2018.07.19 13:13:35 LOG3[1]: SSL_connect: 140943FC: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac 2018.07.19 13:13:35 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:13:35 LOG7[1]: Deallocating application specific data for session connect address 2018.07.19 13:13:35 LOG7[1]: Remote descriptor (FD=536) closed 2018.07.19 13:13:35 LOG7[1]: Local descriptor (FD=528) closed 2018.07.19 13:13:35 LOG7[1]: Service [socks_client2] finished (0 left) 2018.07.19 13:14:06 LOG7[2]: Service [socks_client2] started 2018.07.19 13:14:06 LOG7[2]: Setting local socket options (FD=1880) 2018.07.19 13:14:06 LOG7[2]: Option TCP_NODELAY set on local socket 2018.07.19 13:14:06 LOG5[2]: Service [socks_client2] accepted connection from 127.0.0.1:56604 2018.07.19 13:14:06 LOG6[2]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:14:06 LOG7[2]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:14:06 LOG5[2]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:14:06 LOG5[2]: Service [socks_client2] connected remote server from 192.168.1.65:56605 2018.07.19 13:14:06 LOG7[2]: Setting remote socket options (FD=2044) 2018.07.19 13:14:06 LOG7[2]: Option TCP_NODELAY set on remote socket 2018.07.19 13:14:06 LOG7[2]: Remote descriptor (FD=2044) initialized 2018.07.19 13:14:06 LOG6[2]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:14:06 LOG6[2]: Peer certificate not required 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): before/connect initialization 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:14:06 LOG6[2]: Client certificate not requested 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:14:06 LOG6[2]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 flush data 2018.07.19 13:14:06 LOG7[2]: TLS alert (read): fatal: bad record mac 2018.07.19 13:14:06 LOG3[2]: SSL_connect: 140943FC: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac 2018.07.19 13:14:06 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:14:06 LOG7[2]: Deallocating application specific data for session connect address 2018.07.19 13:14:06 LOG7[2]: Remote descriptor (FD=2044) closed 2018.07.19 13:14:06 LOG7[2]: Local descriptor (FD=1880) closed 2018.07.19 13:14:06 LOG7[2]: Service [socks_client2] finished (0 left)

1 0

Loss of ability to use Stunnel-Blat, and a solution
by Roger Bohl 10 Jul '18

10 Jul '18

Early in 2018, around the time when I upgraded my system to Windows 10, the Stunnel and Blat files that had worked fine with my Vista PC would not work with the new PC. However, the "bug" turned out to be unrelated to the change in operating systems, but rather an "upgrade" to Gmail: Coincidentally, about that time, Gmail evidently decided to stop accepting e-mails from apps deemed "a less secure app", including Stunnel-Blat, with Blat then displaying messages: *** Warning *** The SMTP server did not accept Auth PLAIN value. *** Warning *** Are your login userid and password correct? *** Warning *** The SMTP server did not accept Auth LOGIN PASSWD value. Only a failure message sent to my "backup e-mail address" led me to explore this as a possible cause for what I had thought was, but turned out not to be, a Stunnel-Blat problem. Gmail has an option to suppress this heightened security feature, and when I activated this option, my Stunnel-Blat tools immediately began to function as intended. While I was at first able to enable Gmail to "Allow access from "less secure accounts," I have been unable to get through Gmail options consistently to turn this on and off and share this info with others. (I would welcome instructions that work consistently.) I would also welcome guidance on how to include Stunnel-Blat as a specific alllowed app, without having to enable Gmail to enable *all* "less secure apps" Roger Bohl

3 3

Re: [stunnel-users] Intermittent error in 042_inetd
by Eric S Eberhard 10 Jul '18

10 Jul '18

The 50% could be because the server side is not fully updated - we have this problem a lot with very large companies that should know better (and in reality should overlap instead of changing over - meaning allow SSLv3 for 3 months or something while also accepting TLSv2. A very good way to test is to get a telnet program. Then "telnent localhost port#" - the port # being the port number stunnel is running on. This will remove all variables except stunnel and allow you to see the output. It could be you are connecting fine and failing some other authentication like a login - which you can see often with telnet. And set your firewall to not allow telnet on port 23. Also, we have found stunnel MUCH more reliable under inetd (if you are on Unix of course) than as a stand-alone server. A little performance loss that is unnoticeable to us - big customers exchange 2-4 million XML documents a day (using stunnel) so inetd is definitely not the most efficient way, but the machines are so darn fast it seems not to matter. The certificates have become more painful but I have never had to use an official signed one. I make my own with openssl. However, there are intermediate ones that are needed from whomever you connect to if they have a signed certificate - say from Verisign - you may need your certificate and Verisigns, etc - in a chain. I use "cacert" to set to a large file of .pem certificates - which I simply download from the Web (available all over, some work, some don't. When you get one that works . then use it. You can modify them by adding anything not found in the file. Supposedly the cacert file I have now is good till 2020 for the big names. You can also use openssl to get the certificate from the server - just ask and you shall receive. It should have the entire chain. I used to have on massive cacert for everyone and it was getting out of hand. As tacky as it is, I just make a cacert.pem file for every connection (e.g. Walmart, Fedex, Target, whatever). This allows working connections to keep working while you fiddle with a tricky one. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 From: stunnel-users [mailto:[email protected]] On Behalf Of Ian Bamforth Sent: Wednesday, July 04, 2018 9:00 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Intermittent error in 042_inetd Afternoon, Until recently we'd disabled `make test` because of certificate problems - we've re-enabled it (using `make check`) but are getting intermittent failures (around 50% of CI runs). Below is the output from the logs - I can't see what's gone wrong, can anyone shed any light? 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02004004 (+0x00004000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: Private key check succeeded 2018.07.04 09:59:36 LOG7[ui]: ECDH initialization 2018.07.04 09:59:36 LOG7[ui]: ECDH initialized with curve prime256v1 2018.07.04 09:59:36 LOG7[ui]: Binding service [server] 2018.07.04 09:59:36 LOG7[ui]: Listening file descriptor created (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Setting accept socket options (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.07.04 09:59:36 LOG7[main]: Created pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[cron]: Cron thread initialized 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: Service [server] accepted (FD=3) from 127.0.0.1:58890 2018.07.04 09:59:36 LOG7[0]: Service [server] started 2018.07.04 09:59:36 LOG7[0]: Setting local socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: SNI: no virtual services defined 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 server renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: 1 internal session cache item(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache fill-up(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache miss(es) 2018.07.04 09:59:36 LOG7[0]: 0 external session cache hit(s) 2018.07.04 09:59:36 LOG7[0]: 0 expired session(s) retrieved 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=10) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) initialized 2018.07.04 09:59:36 LOG7[0]: TLS alert (read): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Sent socket write shutdown 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) closed 2018.07.04 09:59:36 LOG7[0]: Local descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [server] finished (0 left) 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGCHLD 2018.07.04 09:59:36 LOG7[main]: Retrieving pid statuses with waitpid() 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02000004 (+0x00000000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: No certificate or private key specified 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] started 2018.07.04 09:59:36 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:4433: waiting 10 seconds 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) initialized 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server done 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: Peer certificate was cached (1241 bytes) 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 client renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Sending close_notify alert 2018.07.04 09:59:36 LOG7[0]: TLS alert (write): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] finished (0 left) 2018.07.04 09:59:36 LOG7[0]: Deallocating section defaults 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGNAL_TERMINATE 2018.07.04 09:59:36 LOG7[main]: Leak detection table utilization: 86/997, 8.63% 2018.07.04 09:59:36 LOG7[main]: Removed pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[main]: Deallocating section defaults Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division T: <tel:00441133443970> +44 (0)113 344 3970 M: <tel:00447852404240> +44 (0)7852 404240 E: <mailto:[email protected]> Ian.Bamforth(a)tracsis.com W: <https://www.tracsis.com> www.tracsis.com <http://www.tracsisops.com> www.tracsisops.com Follow Us <https://www.linkedin.com/company/972873?trk=tyah&trkInfo=idx:1-1-1,tarId:14 20795682492,tas:tracsis> <https://www.twitter.com/tracsis> Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF <https://static.tracsis.com/email/award4.png> Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error.

2 1

Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue?
by Eric S Eberhard 09 Jul '18

09 Jul '18

Exactly. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Peter Pentchev Sent: Thursday, July 05, 2018 5:47 AM To: Spies, Will <Will_Spies(a)comcast.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue? On Thu, Jul 05, 2018 at 11:41:18AM +0000, Spies, Will wrote: > Thanks for the quick response. The client is an Echo Show device and > there is no log. It is an RTSP connection and my backend (behind > Stunnel) is Live555ProxyServer. I read somewhere there is some bug > related to MSIE that closed the connection like this and the fix is to > use TIMEOUTclose=0 which I did but this did not help. This is the > earlier (startup) portion of my log: Hi, Unfortunately, without more information about what the client doesn't like about the established connection, I don't think there is anything more I can help you with :( You *might* try playing with stunnel's cipher settings (OpenSSL options), on the off chance that the client is somewhat confused and offers for negotiation a cipher or something that it later realizes it cannot support... but that would be really weird. G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue?
by Eric S Eberhard 09 Jul '18

09 Jul '18

I should also point out that the cipher suite is related to openssl version stunnel is compiled with. Again, we had customers that connected with TLSv1.3 and then could not negotiate a cipher suite ... leading to lost connection. Make sure you update openssl first -- then compile stunnel. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Javier Sent: Monday, July 09, 2018 9:55 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue? On Mon, 9 Jul 2018 12:26:08 +0000 Daniel Trickett <daniel.trickett(a)emdmillipore.com> wrote: > > Will, > > I was told to ignore the SSLv3 stuff in the log. I have options set to > allow only TLS1.2 and still see SSLv3 references in the log. > > Best regards, > > Dan Hi, in fact, the version can be disclosed from following lines in the log, where is told the cipher used, but not where you usually look: LOG6[1]: TLSv(1-1.1-1.2-1.3-whatever) ciphersuite: (whatever) Regards. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel connection issue?
by Spies, Will 09 Jul '18

09 Jul '18

I've been trying to get Stunnel to work for some time now. I have avoided using the mail list - but I see no recourse now. I think I've tried just about every setting I could find. I appear to be getting a connection issue - but as you will see the log just doesn't indicate clearly what is going on. The behavior is my client is failing to get a connection through Stunnel to my backend. The log appears to be closing a socket (but can't tell which one frontend or backend). Nothing wrong happens up until a client connects - 443 binds fine and later a connection to my backend 554 appears to connect find. If someone/anyone can help direct me to how to trouble shoot this better I would greatly appreciate it. As you will see in the log - the client attempts twice to get through. An excerpt of my log and the conf is below. /etc/stunnel.conf: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel.log debug=7 [rtsp] cert = /etc/stunnel/stunnel.pem accept=192.168.112.16:443 connect=192.168.112.16:554 TIMEOUTclose = 0 TIMEOUTbusy = 5 TIMEOUTidle = 30 delay = yes sslVersion = TLSv1.2 /var/log/stunnel.log: 2018.07.05 05:31:01 LOG7[main]: Service [rtsp] accepted (FD=3) from 192.168.112.197:43869 2018.07.05 05:31:01 LOG7[5]: Service [rtsp] started 2018.07.05 05:31:01 LOG7[5]: Setting local socket options (FD=3) 2018.07.05 05:31:01 LOG7[5]: Option TCP_NODELAY set on local socket 2018.07.05 05:31:01 LOG5[5]: Service [rtsp] accepted connection from 192.168.112.197:43869 2018.07.05 05:31:01 LOG6[5]: Peer certificate not required 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): before SSL initialization 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): before SSL initialization 2018.07.05 05:31:01 LOG7[5]: SNI: no virtual services defined 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read client hello 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write server hello 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write certificate 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read finished 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write finished 2018.07.05 05:31:01 LOG7[5]: New session callback 2018.07.05 05:31:01 LOG6[5]: No peer certificate received 2018.07.05 05:31:01 LOG7[5]: 6 server accept(s) requested 2018.07.05 05:31:01 LOG7[5]: 3 server accept(s) succeeded 2018.07.05 05:31:01 LOG7[5]: 0 server renegotiation(s) requested 2018.07.05 05:31:01 LOG7[5]: 0 session reuse(s) 2018.07.05 05:31:01 LOG7[5]: 3 internal session cache item(s) 2018.07.05 05:31:01 LOG7[5]: 0 internal session cache fill-up(s) 2018.07.05 05:31:01 LOG7[5]: 0 internal session cache miss(es) 2018.07.05 05:31:01 LOG7[5]: 0 external session cache hit(s) 2018.07.05 05:31:01 LOG7[5]: 0 expired session(s) retrieved 2018.07.05 05:31:01 LOG6[5]: TLS accepted: new session negotiated 2018.07.05 05:31:01 LOG6[5]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.07.05 05:31:01 LOG7[5]: Compression: null, expansion: null 2018.07.05 05:31:01 LOG6[5]: s_connect: connecting 192.168.112.16:554 2018.07.05 05:31:01 LOG7[5]: s_connect: s_poll_wait 192.168.112.16:554: waiting 10 seconds 2018.07.05 05:31:01 LOG5[5]: s_connect: connected 192.168.112.16:554 2018.07.05 05:31:01 LOG6[5]: persistence: 192.168.112.16:554 cached 2018.07.05 05:31:01 LOG5[5]: Service [rtsp] connected remote server from 192.168.112.16:58594 2018.07.05 05:31:01 LOG7[5]: Setting remote socket options (FD=9) 2018.07.05 05:31:01 LOG7[5]: Option TCP_NODELAY set on remote socket 2018.07.05 05:31:01 LOG7[5]: Remote descriptor (FD=9) initialized 2018.07.05 05:31:02 LOG6[5]: TLS socket closed (SSL_read) 2018.07.05 05:31:02 LOG7[5]: Sent socket write shutdown 2018.07.05 05:31:02 LOG5[5]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.05 05:31:02 LOG7[5]: Remote descriptor (FD=9) closed 2018.07.05 05:31:02 LOG7[5]: Local descriptor (FD=3) closed 2018.07.05 05:31:02 LOG7[5]: Service [rtsp] finished (0 left) 2018.07.05 05:31:02 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.05 05:31:02 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.05 05:31:02 LOG7[main]: FD=7 events=0x2001 revents=0x1 2018.07.05 05:31:02 LOG7[main]: Service [rtsp] accepted (FD=3) from 192.168.112.197:43870 2018.07.05 05:31:02 LOG7[6]: Service [rtsp] started 2018.07.05 05:31:02 LOG7[6]: Setting local socket options (FD=3) 2018.07.05 05:31:02 LOG7[6]: Option TCP_NODELAY set on local socket 2018.07.05 05:31:02 LOG5[6]: Service [rtsp] accepted connection from 192.168.112.197:43870 2018.07.05 05:31:02 LOG6[6]: Peer certificate not required 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): before SSL initialization 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): before SSL initialization 2018.07.05 05:31:02 LOG7[6]: SNI: no virtual services defined 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read client hello 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write server hello 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write certificate 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read finished 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write finished 2018.07.05 05:31:02 LOG7[6]: New session callback 2018.07.05 05:31:02 LOG6[6]: No peer certificate received 2018.07.05 05:31:02 LOG7[6]: 7 server accept(s) requested 2018.07.05 05:31:02 LOG7[6]: 4 server accept(s) succeeded 2018.07.05 05:31:02 LOG7[6]: 0 server renegotiation(s) requested 2018.07.05 05:31:02 LOG7[6]: 0 session reuse(s) 2018.07.05 05:31:02 LOG7[6]: 4 internal session cache item(s) 2018.07.05 05:31:02 LOG7[6]: 0 internal session cache fill-up(s) 2018.07.05 05:31:02 LOG7[6]: 0 internal session cache miss(es) 2018.07.05 05:31:02 LOG7[6]: 0 external session cache hit(s) 2018.07.05 05:31:02 LOG7[6]: 0 expired session(s) retrieved 2018.07.05 05:31:02 LOG6[6]: TLS accepted: new session negotiated 2018.07.05 05:31:02 LOG6[6]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.07.05 05:31:02 LOG7[6]: Compression: null, expansion: null 2018.07.05 05:31:02 LOG6[6]: s_connect: connecting 192.168.112.16:554 2018.07.05 05:31:02 LOG7[6]: s_connect: s_poll_wait 192.168.112.16:554: waiting 10 seconds 2018.07.05 05:31:02 LOG5[6]: s_connect: connected 192.168.112.16:554 2018.07.05 05:31:02 LOG6[6]: persistence: 192.168.112.16:554 cached 2018.07.05 05:31:02 LOG5[6]: Service [rtsp] connected remote server from 192.168.112.16:58596 2018.07.05 05:31:02 LOG7[6]: Setting remote socket options (FD=9) 2018.07.05 05:31:02 LOG7[6]: Option TCP_NODELAY set on remote socket 2018.07.05 05:31:02 LOG7[6]: Remote descriptor (FD=9) initialized 2018.07.05 05:31:02 LOG6[6]: TLS socket closed (SSL_read) 2018.07.05 05:31:02 LOG7[6]: Sent socket write shutdown 2018.07.05 05:31:02 LOG5[6]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.05 05:31:02 LOG7[6]: Remote descriptor (FD=9) closed 2018.07.05 05:31:02 LOG7[6]: Local descriptor (FD=3) closed 2018.07.05 05:31:02 LOG7[6]: Service [rtsp] finished (0 left) 2018.07.05 05:31:05 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.05 05:31:05 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.05 05:31:05 LOG7[main]: FD=7 events=0x2001 revents=0x1

6 12

Fwd: stunnel-users Digest, Vol 168, Issue 2
by Avinash Kumar 05 Jul '18

05 Jul '18

Regards, Avinash Kumar ---------- Forwarded message ---------- From: Avinash Kumar <avinash14331(a)gmail.com> Date: Wed, Jul 4, 2018 at 11:59 AM Subject: Re: [stunnel-users] stunnel-users Digest, Vol 168, Issue 2 To: "Jose Alf." <josealf(a)rocketmail.com> Hi, I commented sslVersion but still getting the same issue. Please find below my configuration details for both client and server: Server conf: Client Conf: Regards, Avinash Kumar On Tue, Jul 3, 2018 at 6:26 PM, Jose Alf. <josealf(a)rocketmail.com> wrote: > Kumar, > > Probably you are trying to connect to a server that dos not allow TLs > v1.0m a protocol that has been deprecated. Please Comment out the > sslVersion line and try again. > > regards, > > Jose > > > > On Tuesday, July 3, 2018, 6:37:53 AM GMT-5, Avinash Kumar < > avinash14331(a)gmail.com> wrote: > > > Hi, > > As requested, Posting my configuration. > [https-App-setup] client = yes accept = 9898 connect = > <<source-ipaddress>>:9898 cert = <<stunnel-installationdirectory>>\config\App\morpheus.pem > key = <<stunnel-installationdirectory>>\config\App\morpheus.key CAfile = > <<stunnel-installationdirectory>>\config\App\root-ca.pem sslVersion = > TLSv1 options = NO_SSLv3 > > > Regards, > Avinash Kumar > > On Tue, Jul 3, 2018 at 3:30 PM, <stunnel-users-request(a)stunnel.org> wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi- bin/mailman/listinfo/stunnel- users > <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users> > or, via email, send a message with subject or body 'help' to > stunnel-users-request@stunnel. org > <stunnel-users-request(a)stunnel.org> > > You can reach the person managing the list at > stunnel-users-owner@stunnel. org <stunnel-users-owner(a)stunnel.org> > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: Stunnel Issue (Flo Rance) > > > ------------------------------ ------------------------------ ---------- > > Message: 1 > Date: Tue, 3 Jul 2018 11:18:03 +0200 > From: Flo Rance <trourance(a)gmail.com> > To: Avinash Kumar <avinash14331(a)gmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Stunnel Issue > Message-ID: > <CAHogYcUn6BzfBr75X- DuteetppESv2KOjGJmGO7mc=SuHVaE > Xw(a)mail.gmail.com <SuHVaEXw(a)mail.gmail.com>> > Content-Type: text/plain; charset="utf-8" > > Please post your configuration. Without that, it's not obvious. > > Regards, > Flo > > On Tue, Jul 3, 2018 at 10:42 AM, Avinash Kumar <avinash14331(a)gmail.com> > wrote: > > > Attaching the screenshot > > > > Regards, > > Avinash Kumar > > > > On Tue, Jul 3, 2018 at 2:11 PM, Avinash Kumar <avinash14331(a)gmail.com> > > wrote: > > > >> Hi, > >> > >> I am getting below error while connecting through stunnel: > >> > >> > >> > >> Regards, > >> Avinash Kumar > >> > > > > > > ______________________________ _________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi- bin/mailman/listinfo/stunnel- users > <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users> > > > > >

3 3

Intermittent error in 042_inetd
by Ian Bamforth 04 Jul '18

04 Jul '18

Afternoon, Until recently we'd disabled `make test` because of certificate problems - we've re-enabled it (using `make check`) but are getting intermittent failures (around 50% of CI runs). Below is the output from the logs - I can't see what's gone wrong, can anyone shed any light? 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02004004 (+0x00004000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: Private key check succeeded 2018.07.04 09:59:36 LOG7[ui]: ECDH initialization 2018.07.04 09:59:36 LOG7[ui]: ECDH initialized with curve prime256v1 2018.07.04 09:59:36 LOG7[ui]: Binding service [server] 2018.07.04 09:59:36 LOG7[ui]: Listening file descriptor created (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Setting accept socket options (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.07.04 09:59:36 LOG7[main]: Created pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[cron]: Cron thread initialized 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: Service [server] accepted (FD=3) from 127.0.0.1:58890 2018.07.04 09:59:36 LOG7[0]: Service [server] started 2018.07.04 09:59:36 LOG7[0]: Setting local socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: SNI: no virtual services defined 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 server renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: 1 internal session cache item(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache fill-up(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache miss(es) 2018.07.04 09:59:36 LOG7[0]: 0 external session cache hit(s) 2018.07.04 09:59:36 LOG7[0]: 0 expired session(s) retrieved 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=10) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) initialized 2018.07.04 09:59:36 LOG7[0]: TLS alert (read): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Sent socket write shutdown 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) closed 2018.07.04 09:59:36 LOG7[0]: Local descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [server] finished (0 left) 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGCHLD 2018.07.04 09:59:36 LOG7[main]: Retrieving pid statuses with waitpid() 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02000004 (+0x00000000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: No certificate or private key specified 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] started 2018.07.04 09:59:36 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:4433: waiting 10 seconds 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) initialized 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server done 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: Peer certificate was cached (1241 bytes) 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 client renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Sending close_notify alert 2018.07.04 09:59:36 LOG7[0]: TLS alert (write): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] finished (0 left) 2018.07.04 09:59:36 LOG7[0]: Deallocating section defaults 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGNAL_TERMINATE 2018.07.04 09:59:36 LOG7[main]: Leak detection table utilization: 86/997, 8.63% 2018.07.04 09:59:36 LOG7[main]: Removed pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[main]: Deallocating section defaults Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division T: +44 (0)113 344 3970<tel:00441133443970> M: +44 (0)7852 404240<tel:00447852404240> E: Ian.Bamforth(a)tracsis.com<mailto:[email protected]> W: www.tracsis.com<https://www.tracsis.com> www.tracsisops.com<http://www.tracsisops.com> Follow Us [https://static.tracsis.com/email/lin2.png]<https://www.linkedin.com/company/972873?trk=tyah&trkInfo=idx:1-1-1,tarId:14…> [https://static.tracsis.com/email/twi2.png] <https://www.twitter.com/tracsis> Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF [https://static.tracsis.com/email/award4.png] Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error.

1 0

stunnel on Windows - using CAPI - tls v1.2?==?utf-8?q? ?
by Brian Ipsen 04 Jul '18

04 Jul '18

Hi Does anyone know whether there is a fix pending for being able to use the Windows built-in certificate store (by CAPI) for client authentication - and using TLS v1.2 ? Currently I need to force the stunnel client to use TLS v1.1, as there seem to be a limitation somewhere if using TLS v1.2... Regards Brian

1 0

tls linger
by Daniel Trickett 03 Jul '18

03 Jul '18

Hi, We are using stunnel to allow us to punchout to suppliers using TLS 1.2 protocol. We are seeing the following with this particular supplier. 2018.07.02 08:49:05 LOG6[4]: TLS connected: previous session reused 2018.07.02 08:49:05 LOG6[4]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-SHA384 (256-bit encryption) 2018.07.02 08:49:05 LOG7[4]: Compression: null, expansion: null 2018.07.02 08:49:15 LOG3[4]: SSL_read: Connection reset by peer (131) 2018.07.02 08:49:15 LOG5[4]: Connection reset: 1720 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.02 08:49:15 LOG7[4]: linger (remote): Invalid argument (22) 2018.07.02 08:49:15 LOG7[4]: Remote descriptor (FD=13) closed 2018.07.02 08:49:15 LOG7[4]: Local descriptor (FD=3) closed 2018.07.02 08:49:15 LOG7[4]: Service [dell-https] finished (0 left) We have set socket = l:SO_LINGER=1:60, but still occasionally have an issue. Is there anything else that we may need to set? Since the below is default, would not expect to set it.. socket = a:SO_REUSEADDR=no disable address reuse (enabled by default) Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 168, Issue 2
by Avinash Kumar 03 Jul '18

03 Jul '18

Hi, As requested, Posting my configuration. [https-App-setup] client = yes accept = 9898 connect = <<source-ipaddress>>:9898 cert = <<stunnel-installationdirectory>>\config\App\morpheus.pem key = <<stunnel-installationdirectory>>\config\App\morpheus.key CAfile = <<stunnel-installationdirectory>>\config\App\root-ca.pem sslVersion = TLSv1 options = NO_SSLv3 Regards, Avinash Kumar On Tue, Jul 3, 2018 at 3:30 PM, <stunnel-users-request(a)stunnel.org> wrote: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: Stunnel Issue (Flo Rance) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 3 Jul 2018 11:18:03 +0200 > From: Flo Rance <trourance(a)gmail.com> > To: Avinash Kumar <avinash14331(a)gmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Stunnel Issue > Message-ID: > <CAHogYcUn6BzfBr75X-DuteetppESv2KOjGJmGO7mc=SuHVaE > Xw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Please post your configuration. Without that, it's not obvious. > > Regards, > Flo > > On Tue, Jul 3, 2018 at 10:42 AM, Avinash Kumar <avinash14331(a)gmail.com> > wrote: > > > Attaching the screenshot > > > > Regards, > > Avinash Kumar > > > > On Tue, Jul 3, 2018 at 2:11 PM, Avinash Kumar <avinash14331(a)gmail.com> > > wrote: > > > >> Hi, > >> > >> I am getting below error while connecting through stunnel: > >> > >> > >> > >> Regards, > >> Avinash Kumar > >> > > > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > >

2 1

Stunnel Issue
by Avinash Kumar 03 Jul '18

03 Jul '18

Hi, I am getting below error while connecting through stunnel: Regards, Avinash Kumar

2 2

stunnel 5.48 released
by Michal Trojnara 02 Jul '18

02 Jul '18

Dear Users, I have released version 5.48 of stunnel. Version 5.48, 2018.07.02, urgency: HIGH * Security bugfixes - Fixed requesting client certificate when specified as a global option. * New features - Certificate subject checks modified to accept certificates if at least one of the specified checks matches. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 1011d5a302ce6a227882d094282993a3187250f42f8a801dcc1620da63b2b8df stunnel-5.48.tar.gz eb160fdf28061eb509e09824ab9cd26f4f0ca9be3b90008bba32274d5136c7eb stunnel-5.48-win32-installer.exe 667ee8c8d5440117285eb5a5ddf0d305a6dd1dbb93dcf5b7bac62f84ddba7466 stunnel-5.48-android.zip Best regards, Mike

1 0

tls question
by Daniel Trickett 02 Jul '18

02 Jul '18

Hi, If I use stunnel 5.44, how do I know that the protocol being used is TLS1.2? Is it the default? Working with supplier sites which still accept 1.0/1.1, but want to make sure that I am using 1.2, as they will be disabling the older protocols. Thanks and Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

4 3

Potentially dangerous change of behavior in handling "global option" in stunnel after version 5.45
by Tony Cheneau 29 Jun '18

29 Jun '18

Hello everyone, I was updating my version of stunnel and playing my regression suite and I was surprised to see some tests fail. We usually apply "verify = 2" as global option at the beginning of the configuration file on our stunnel "server" so as to enforce the client certificate verification. So I was a little bit surprise to see I could establish a TLS connection with my test server without providing a client certificate. The "verify = 2" as a "global option" is parsed at some point, because I can trigger an error message if I place a bogus value ("verify = 8"). Yet, it seems to be ignored when accepting connections. If I move the "verify = 2" from the "global option" to a service-level option for a specific service/tunnel, it works as expected (and documented): it rejects my certificate-less client. After a little bit of investigation, I was able to narrow down the change of behavior in version 5.45 (meaning that 5.44 still follow the old behavior). All the newer version follow this new behavior. I haven't seen any public CVS/SVN/git for stunnel, so I was not able to narrow it down further and I could not identify the exact change in the code that modified the behavior. While I understand that this option is documented in the manpage as a service-level option, in practice, "verify" could be used as a global option for years (my oldest documented usage at my company dates back from stunnel 4.54). (I know this option is going to be replaced by verifyChain/requireCert, the observed behavior reported in this email also applies on these options: they can't be applied program wide as a "global option") Am I missing something obvious here ? I haven't seen the change documented in the changelog, so it looks like a regression to me. Thank you in advance (and thank you for the great piece of software, obviously!). Regards, Tony Cheneau

1 0

Re: [stunnel-users] stunnel 5.47 released
by Eric S Eberhard 28 Jun '18

28 Jun '18

Query -- how does this relate to TLSv1.3 and the alpha version (which is not going to work with the final version -- and does not exist I think) -- and what version of openssl do you recommend? Thanks, Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Friday, June 22, 2018 11:10 PM To: stunnel-users(a)stunnel.org; stunnel-announce(a)stunnel.org; openssl-users(a)openssl.org Subject: [stunnel-users] stunnel 5.47 released Dear Users, I have released version 5.47 of stunnel. Version 5.47, 2018.06.23, urgency: HIGH * New features - Fast add_lock_callback for OpenSSL < 1.1.0. This largely improves performance on heavy load. - Automatic detection of Homebrew OpenSSL. - Clarified port binding error logs. - Various "make test" improvements. * Bugfixes - Fixed a crash on switching to SNI slave sections. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c4e675db996eb92beef885f72a3ed8af3c7603fea6b99d2873198dd6c0021d0b stunnel-5.47.tar.gz 985e1d65a3f4a7599cc78630960e1b2c97981f91ce6bc41f2eefcd371b4067a3 stunnel-5.47-win32-installer.exe 309cfb79329448f0c134aece0d10d0737e3728b25c288e9a76650837cd6f839c stunnel-5.47-android.zip Best regards, Mike

1 0

question regarding TLS connection.
by Daniel Trickett 26 Jun '18

26 Jun '18

Hi We are using stunnel 5.44. We are having an issue connecting with a customer who is not supporting TLS 1.1, only 1.2 and 1.3. When I look in the log, I see the following. Why do I see the SSLv3 note in the line? The below leads me to believe that we connect to the customer, but they say that we are not. 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read server certificate A 2018.06.25 11:37:24 LOG6[7]: Client certificate not requested 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read server done A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write client key exchange A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write change cipher spec A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write finished A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 flush data 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read finished A 2018.06.25 11:37:24 LOG7[7]: 1 client connect(s) requested 2018.06.25 11:37:24 LOG7[7]: 1 client connect(s) succeeded 2018.06.25 11:37:24 LOG7[7]: 0 client renegotiation(s) requested 2018.06.25 11:37:24 LOG7[7]: 0 session reuse(s) 2018.06.25 11:37:24 LOG6[7]: TLS connected: new session negotiated Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence - 7/2/2018 - 7/6/2018 MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email daniel.trickett(a)emdmillipore.com<mailto:[email protected]> This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

2 1

stunnel 5.47 released
by Michal Trojnara 23 Jun '18

23 Jun '18

Dear Users, I have released version 5.47 of stunnel. Version 5.47, 2018.06.23, urgency: HIGH * New features - Fast add_lock_callback for OpenSSL < 1.1.0. This largely improves performance on heavy load. - Automatic detection of Homebrew OpenSSL. - Clarified port binding error logs. - Various "make test" improvements. * Bugfixes - Fixed a crash on switching to SNI slave sections. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c4e675db996eb92beef885f72a3ed8af3c7603fea6b99d2873198dd6c0021d0b stunnel-5.47.tar.gz 985e1d65a3f4a7599cc78630960e1b2c97981f91ce6bc41f2eefcd371b4067a3 stunnel-5.47-win32-installer.exe 309cfb79329448f0c134aece0d10d0737e3728b25c288e9a76650837cd6f839c stunnel-5.47-android.zip Best regards, Mike

2 1

Stunnel 5.45 and 5.46 crashes upon reconnect HTTPS
by Javier 22 Jun '18

22 Jun '18

Hi, isn't annoying when you are using an old version, 5.44, and all goes fine, you notice you are outdated and then comes the problems after update? :-P The thing is that yesterday I needed the HTTPS server so I run Stunnel 5.44 for my non-SSL app and all was fine. I updated to 5.46 just because I forgot the last time and didn't even run again because I didn't need it. Today I used it and... I had a crash. I tested 5.45 to trace versions back, and it crashes as well. Back to 5.44 and no crash. The crash happens when there is a reload/reconnect/multiconnect (example, 2 connections html+images) by the browser when connects to an HTTPS server. It only happens when using a SNI service. I've been able to trace back the log on those versions and when fails in 5.45 and 5.46 is at the time when it needs to switch to the SNI service. (log from 5.44) SNI: requested servername: xxx SNI: matched pattern: xxx SNI: switched to service [xxx] <<<<----- BEFORE SWITCH, IT CRASHES on 5.45 and 5.46 Imagine you load https://xxx/. The first time is fine, the second, crashes stunnel. Not happening with 5.44. I haven't seen any change to SNI in manual so... :-? These are the configs for the used virtual servers. Nothing has been changed, anyway: [SSL] client = no accept = y.y.y.1:4747 connect = y.y.y.2:443 [SSL-xxx-SNI] client = no sni = SSL:xxx connect = y.y.y.2:443 cert = pem key = pem Don't mind the port numbers. They aren't in conflict. Running on Windows 2000. Regards.

3 4

Reg : Stunnel + RSYNC Usage with TLSv1.2
by Sakthivel Ganesamoorthy 20 Jun '18

20 Jun '18

Hi, I have configured a server and client for Stunnel + Rsync usage over TLSv1.2. It is working fine, but I wanted to verify the "Cipher Key" exchange mechanism between "Server & Client" via "Wireshark". When I captured the logs via "Wireshark", it shows everything as TCP messages and I don't see any "Client Hello message (or) Cipher Key exchange message (or) any of the TLSv1.2" handshake messages. Please let me know whether I'm missing something here. Thanks, Sakthi

1 0

stunnel used as jump host for SFTP
by Schultz, Cecilia 20 Jun '18

20 Jun '18

Hello, I am trying to test stunnel to see if it can provide the functionality we need. We are a Windows shop. What we need is for multiple client machines (I call these C1, C2, C3) to connect to our server (S). Server S will connect to a remote SFTP server (port 22). I call the remote SFTP server "R". C1, C2, C3 and S are all inside our firewall. Currently S can connect and send files to R using SFTP (port 22). The problem is that R does not accept a range of IP addresses, and has a limit on the number of IP addresses they can accept. So, what I need is for C1, C2, C3 to be able to connect to server R using S as a jump host. >From R's perspective, it should be like the connection is coming from S. Question 1: can stunnel be used to accomplish this? Question 2: I have installed stunnel in a test server ("stunnel -install" actually from the bin folder), and configured the conf like this: [sftp] accept=127.0.0.1:22 connect=some.remote.server.com:22 I tried to use Winscp SFTP client to test a connection, but it times out. I then checked S, and I don't see anything listening on port 22. I did "netstat -a" and I don't see anything listening on port 22. Was something wrong in the "stunnel -install" command? Shouldn't it be listening on port 22? Also, I uncommented the entry for log, but I don't see any log file in the stunnel folder/subfolders ; Debugging stuff (may be useful for troubleshooting) debug = info output = stunnel.log Thanks for your help, Cecilia

3 3

Re: [stunnel-users] stunnel used as jump host for SFTP
by Schultz, Cecilia 20 Jun '18

20 Jun '18

Thank you so much for the info! I will try this out. From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Harris, Douglas (SSC/SPC) Sent: Wednesday, June 20, 2018 5:08 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel used as jump host for SFTP You can accomplish this in Windows. Just add a port forwarding rule to S: netsh interface portproxy add v4tov4 listenport=22 listenaddress=[IP of S] connectport=22 connectaddress=[IP of R] -Doug

1 0

stunnel PSK support via custome openssl engine
by Tarakeshwar Rao 14 Jun '18

14 Jun '18

Dear Stunnel-users, >From Stunnel man pages, I could see that we could read PSK secret from plain text file with following option: PSKsecrets = psk.txt Could it possible to use custom openssl engine to read PSK file from HSM. I know that this works for reading TLS keys. I am not sure how I could do it for PSK. Thanks for your support, Regards, Tarak

1 0

is it possible to make stunnel works for dbmail timsieved?
by cktmwe＠gmail.com 12 Jun '18

12 Jun '18

hello everyone, I'm currently try to stunnel sieve traffic to local dbmail timsieved, unfortunately I couldn't get it to work, my first question, does stunnel support sieve manage protocol? secondly if it does, how can I config the service? what I've done so far. timsieved started on 127.0.0.1:2000, connect and manage all works, I saw connection in dbmail log, then define sieve service block in stunnel.conf, restart stunnel, but if I connect our.public.ip:4190, timsieved becames no connection at all, dbmail log kept silent. traffic from port 4190 is already accepted in iptables. config that I used. > [sieve] > accept = our.public.ip:4190 > connect = 127.0.0.1:2000 > software version: stunnel-5.43 dbmail-3.2.3 Thanks.

2 1

Slow DNS lookups when DNS does not respond
by Guillermo Rodriguez Garcia 08 Jun '18

08 Jun '18

Hi all, I have stunnel setup on a Linux box and I am experiencing very slow DNS lookup times when DNS does not respond. On this same system, anything that results in a DNS lookup (e.g. ping, ...) takes about 20 seconds before it times out and fails. However with stunnel (and a single service configured) the lookup takes more than 1 minute (approx 80 seconds). Is there any way to configure this? Thank you, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

1 0

Windows 2016 Server: [!] bind: Address already in use (WSAEADDRINUSE) (10048)
by Martin Schweizer 06 Jun '18

06 Jun '18

Hello List My problem: If I run stunnel I regular get the below error: [.] stunnel 5.46 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2o-fips 27 Mar 2018 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [smtps] [ ] GUI message loop initialized [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [smtps] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [smtps] [ ] Listening file descriptor created (FD=676) [ ] Setting accept socket options (FD=676) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket >>> [!] bind: Address already in use (WSAEADDRINUSE) (10048) <<<< [!] Error binding service [smtps] to 192.168.10.62:11465 [!] Could not bind any accepting port [ ] Deallocating section defaults [ ] Unbinding service [smtps] [ ] Service [smtps] closed [ ] Deallocating section [smtps] I had the same problem with the previous versions aswell. To temporary resolv the problem I have to change the listen port to another number. Reread the config file and let the stunnel GUI open. Then all is working until I close the GUI (not each time but most of). My system: - Windows 2016 Server - stunnel-5.46 - stunnel installed as service and GUI My config file (relevant part): taskbar = yes client=yes [smtps] ;delay = yes accept = 192.168.10.62:11466 connect = server.domain.ch:465 cert = stunnel.pem local = 192.168.10.53 (this is dedicated address) I found a similar threat in the archives (but on Linux): https://www.stunnel.org/pipermail/stunnel-users/2018-February/005935.html Here is Microsoft's describtion about WSAEADDRINUSE) (10048): https://msdn.microsoft.com/en-us/library/windows/desktop/ms740668(v=vs.85).… All helps are welcome. Kind regards, -- Martin Schweizer PC-Service M. Schweizer GmbH; Bannholzstrasse 6; Postfach 132; CH-8608 Bubikon; Tel. +41 55 243 30 00; Fax: +41 55 243 33 22

1 0

port-only accept value binds to 127.0.0.1, instead of the wildcard address
by Poor Yorick 30 May '18

30 May '18

The stunnel 6.45 documentation for "accept" states, "If no host specified, defaults to all IPv4 addresses for the local host." In this case, stunnel actually binds to 127.0.0.1. Indeed, inspection of the relevant code paths reveals that addr_list->passive is never set to 1 in this case. To get stunnel to bind to all addresses, 0.0.0.0 must be explicitly specified. Furthermore, inspection of the code path for the "local" option reveals that addr_list->passive is set to 1 in this case, which seems to be backwards: The documentation for getaddrinfo states that AI_PASSIVE is ignored in this case. The logic for these two cases seems to be reversed. -- Yorick

1 0

stunnel 5.46 released
by Michal Trojnara 28 May '18

28 May '18

Dear Users, I have released version 5.46 of stunnel. Version 5.46, 2018.05.28, urgency: MEDIUM * New features - The default cipher list was updated to a safer value: "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK". * Bugfixes - Default accept address restored to INADDR_ANY. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 76aab48c28743d78e4b2f6b2dfe49994b6ca74126046c179444f699fae7a84c7 stunnel-5.46.tar.gz 721cc4d7c385743df767a32a53c11477def2440ae20ad4538d8e685f7b7d6538 stunnel-5.46-win32-installer.exe d08a3b3598868064db08d6f0e3a97e3c49dedbf6c8d7f348a613b832eca16dd6 stunnel-5.46-android.zip Best regards, Mike

1 0

Stunnel stopps in Windows Failover Cluster
by Tobias Gillstöm 28 May '18

28 May '18

Hi, I'm having problems with Stunnel in a Windows Failover Cluster. When a failover happens and the stunnel service changes node that it's running on, the service changes node just fine but the stunnel service dosen't appear to be doing anything? If anyone has some prior knowledge about Stunnel in a Windows Failover Cluster i would appreciate the help :)

1 0

stunnel and CAPI on Windows
by Brian Ipsen 23 May '18

23 May '18

Hi I am trying to use the Microsoft certificate store/API for client validation of Windows hosts towards an F5. Everything works, when we use file-based certificates - but for security purposes I would prefer to use the windows certificate store, and set the private key on the client as non-exportable... I have enabled the engineId = capi in the global section of stunnel.conf - and for the required client/service I have: [F5CertAdmin] client=yes accept = 127.0.0.1:1679 connect = w.x.y.z:443 delay = yes sni = ssl79admpki.xxxx.com CApath = C:\Program Files (x86)\stunnel\config\certs CAFile = C:\Program Files (x86)\stunnel\config\certs\GlobalSign-Cert-Chain.pem verify = 2 engineId = capi key = BaaSClientCertificateCP cert = BaaSClientCertificateCP I have a certificate in the local computer certificate store with the supplied name - but stunnel is not able to locate it... Is it because it will look under the user account? If yes, will it look under the local machine when running as local system ? The output from stunnel says: [ ] Initializing service [F5CertAdmin] [ ] Ciphers: HIGH:!DH:!aNULL:!SSLv2 [ ] TLS options: 0x03000004 (+0x03000000, -0x00000000) [ ] Client certificate engine (capi) enabled [ ] Loading certificate from engine ID: BaaSClientCertificateCP [!] ENGINE_ctrl_cmd: Peer suddenly disconnected [ ] Initializing private key on engine ID: BaaSClientCertificateCP [!] ENGINE_load_private_key: 26096080: error:26096080:engine routines:ENGINE_load_private_key:failed loading private key [ ] Loading certificate from file: BaaSClientCertificateCP [!] error queue: 140DC002: error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib [!] error queue: 20074002: error:20074002:BIO routines:FILE_CTRL:system lib [!] SSL_CTX_use_certificate_chain_file: 2001002: error:02001002:system library:fopen:No such file or directory [!] Service [F5CertAdmin]: Failed to initialize TLS context @am6pr03mb3813.eurprd03.prod.outlook.com>Any advice appreciated... Thanks Brian

1 0

stunnel 5.45 released
by Michal Trojnara 21 May '18

21 May '18

Dear Users, I have released version 5.45 of stunnel. Version 5.45, 2018.05.21, urgency: MEDIUM * New feature sponsored by https://loadbalancer.org/ - Implemented delayed deallocation of service sections after configuration file reload. * Other new features - OpenSSL DLLs updated to version 1.0.2o. - Deprecated the sslVersion option. - The "socket" option is now also available in service sections. - Implemented try-restart in the SysV init script (thx to Peter Pentchev). - TLS 1.3 compliant session handling for OpenSSL 1.1.1. - Default "failover" value changed from "rr" to "prio". - New "make check" tests. * Bugfixes - A service no longer refuses to start if binding fails for some (but not all) addresses:ports. - Fixed compression handling with OpenSSL 1.1.0 and later. - _beginthread() replaced with safer _beginthreadex(). - Fixed exception handling in libwrap. - Fixed exec+connect services. - Fixed automatic resolver delaying. - Fixed a Gentoo cross-compilation bug (thx to Joe Harvell). - A number of "make check" framework fixes. - Fixed false postive memory leak logs. - Build fixes for OpenSSL versions down to 0.9.7. - Fixed (again) round-robin failover in the FORK threading model. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 548244839b8a4bf4dffea46c97893b203d1b9eed118c3dd6a9ac4d8d02592ee3 stunnel-5.45.tar.gz fc13a224c7ec1290035efe8317c53d62a0980a5ab2efe8930b06aae269fbe873 stunnel-5.45-win32-installer.exe 29025eaed007c62856f16c7a8a22f9713eee9762ed95009f6f91f729c35c0bc0 stunnel-5.45-android.zip Best regards, Mike

1 0

configuring Stunnel
by support 20 May '18

20 May '18

The config as described hereby did work properly a few times giving a secured connection. All of a sudden this is no longer working? Any suggestions? Namens IMS evba Paul Waegemans +32475341310 <mailto:[email protected]> support(a)imseuro.be <http://eu.ntrsupport.com/inquiero/web/digisign/digisign.asp?login=I23EBF509 C6B51A9E700D43&lang=nl>

1 0

UTF8 BOM in PSKsecrets file
by Jakob Hirsch 17 May '18

17 May '18

Hi! I just found out (after a while of troubleshooting) that stunnel does not handle UTF-8 BOM in the PSKsecrets file, i.e. the BOM is considered part of the identity (tested with 5.44, 5.45b4 and 5.45b6 on Windows 10 1709). It was a little tricky to figure this out, as the BOM is apparently filtered out in the logs, e.g. the server just says 'No key found for PSK identity "client1"'. Ok, nobody says that this is supported or that you should do it, it just happens automatically when you click "Edit Configuration" in the Windows GUI and click "Save as" (out of convenience, because you will already be in the config directory then), because the sample config has a BOM and Notepad will also insert a BOM in the new file. I don't know how much work it would be to handle the BOM correctly or at least print a warning (didn't look at the code, sorry), a warning in the manual would probably sufficient, as it could be that I'm the first one to stumble over this (at least I didn't find anything about it on the net). Regards (and thanks for this nice piece of software) Jakob

1 0

Windows Server 2012 R2
by Daniel McArdell 17 May '18

17 May '18

Hello, I have joined the mail group in the hope that someone can help with problems I am having running on our Server machine. I downloaded "stunnel-5.45b6-win64-installer" and installed it on our Server. When I run the executable I get: 2018.05.17 12:48:33 LOG5[main]: stunnel 5.45 on x64-pc-msvc-1913 platform 2018.05.17 12:48:33 LOG5[main]: Compiled/running with OpenSSL 1.1.0g 2 Nov 2017 2018.05.17 12:48:33 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2018.05.17 12:48:33 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.17 12:48:33 LOG5[main]: UTF-8 byte order mark detected 2018.05.17 12:48:33 LOG5[main]: Configuration successful The shortcut [cid:[email protected]] I was expecting to get a GUI interface but that does not happen. Can someone tell me what is going wrong. I feel as though I have missed something obvious. Daniel McArdell | Senior Analyst Programmer | Products & Technology | BNZ<http://www.bnz.co.nz/> L6 Custom House, 17 Whitmore St, Wellington 6011 DDI +64 4 4746679 (extn 76679) | F +64 4 4746023 | M +64 29 2220451 | E Daniel_McArdell(a)bnz.co.nz<mailto:[email protected]?Subject=> CAUTION - This message may contain privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that any use, dissemination, distribution or reproduction of this message is prohibited. This email was sent by the Bank of New Zealand. You can contact us on 0800 ASK BNZ (0800 275 269). Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of Bank of New Zealand.

1 0

stunnel with client-auth via proxy-server
by jack.reacher＠gmx.de 16 May '18

16 May '18

2 1

Stunnel running as service on Windows Server 2008 R2 but Stunnel All Users shortcut on the desktop reports that it server is down?
by Alex Birchall 16 May '18

16 May '18

Hello, I have Stunnel running as a service on a Windows Server 2008 R2. But the shortcut on the desktop "Stunnel All Users", when launched, informs me that the server is down due to an "invalid configuration file". In the config file, if Stunnel is being run as a service, should it be "client = no" or "server = yes"? Many thanks. Best regards, Alex

2 2

SMTP Authentication failed
by Ian Coetzee 15 May '18

15 May '18

Hi List, I have just joined the stunnel community. I am in the process of migrating our mailserver's public facing ports to stunnel for PCI compliance reasons. So far i have managed to get working: - imap (143/tcp) with starttls - imaps (993/tcp) - pop3 (110/tcp) with starttls - pop3s (995/tcp) My trouble is with smtp(25/tcp,587/tcp) with starttls. I have now tried a couple different mail clients and everyone of them tells me that the server does not support the authentication protocols. I have installed stunnel 5.44. Tee relevant parts in my config: [mail2-imap] protocol = imap accept = 143 connect = <mail-fqdn>:143 [mail2-imaps] accept = 993 connect = <mail-fqdn>:143 [mail2-pop3] protocol = pop3 accept = 110 connect = <mail-fqdn>:110 [mail2-pop3s] accept = 995 connect = <mail-fqdn>:110 [mail2-smtp] protocol = smtp accept = 25 connect = <mail-fqdn>:25 [mail2-smtps] accept = 465 connect = <mail-fqdn>:465 [mail2-smtps-submission] debug = 7 protocol = smtp accept = 587 connect = <mail-fqdn>:587 In the logfile I have the following entries upon connecting 2018.04.30 09:20:50 LOG7[5]: Service [mail2-smtps-submission] started 2018.04.30 09:20:50 LOG7[5]: Option TCP_NODELAY set on local socket 2018.04.30 09:20:50 LOG5[5]: Service [mail2-smtps-submission] accepted connection from 41.13.8.49:56890 2018.04.30 09:20:50 LOG6[5]: s_connect: connecting 10.10.11.2:587 2018.04.30 09:20:50 LOG7[5]: s_connect: s_poll_wait 10.10.11.2:587: waiting 10 seconds 2018.04.30 09:20:50 LOG5[5]: s_connect: connected 10.10.11.2:587 2018.04.30 09:20:50 LOG5[5]: Service [mail2-smtps-submission] connected remote server from 10.10.11.11:42466 2018.04.30 09:20:50 LOG7[5]: Option TCP_NODELAY set on remote socket 2018.04.30 09:20:50 LOG7[5]: Remote descriptor (FD=23) initialized 2018.04.30 09:20:50 LOG7[5]: RFC 2487 detected 2018.04.30 09:20:50 LOG7[5]: <- 220 <mail-fqdn> ESMTP Postfix 2018.04.30 09:20:50 LOG7[5]: -> 220 <mail-fqdn> stunnel for ESMTP Postfix 2018.04.30 09:20:51 LOG7[5]: <- EHLO [100.125.153.220] 2018.04.30 09:20:51 LOG7[5]: -> 250-<mail-fqdn> 2018.04.30 09:20:51 LOG7[5]: -> 250 STARTTLS 2018.04.30 09:20:51 LOG7[5]: <- STARTTLS 2018.04.30 09:20:51 LOG7[5]: -> 220 Go ahead 2018.04.30 09:20:51 LOG6[5]: Peer certificate not required 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): before/accept initialization 2018.04.30 09:20:51 LOG7[5]: SNI: no virtual services defined 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 read client hello A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write server hello A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write certificate A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write key exchange A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write server done A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 flush data 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 read client certificate A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read client key exchange A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read certificate verify A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read finished A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 write change cipher spec A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 write finished A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 flush data 2018.04.30 09:20:52 LOG7[5]: New session callback 2018.04.30 09:20:52 LOG7[5]: 2 server accept(s) requested 2018.04.30 09:20:52 LOG7[5]: 2 server accept(s) succeeded 2018.04.30 09:20:52 LOG7[5]: 0 server renegotiation(s) requested 2018.04.30 09:20:52 LOG7[5]: 0 session reuse(s) 2018.04.30 09:20:52 LOG7[5]: 2 internal session cache item(s) 2018.04.30 09:20:52 LOG7[5]: 0 internal session cache fill-up(s) 2018.04.30 09:20:52 LOG7[5]: 0 internal session cache miss(es) 2018.04.30 09:20:52 LOG7[5]: 0 external session cache hit(s) 2018.04.30 09:20:52 LOG7[5]: 0 expired session(s) retrieved 2018.04.30 09:20:52 LOG6[5]: TLS accepted: new session negotiated 2018.04.30 09:20:52 LOG6[5]: No peer certificate received 2018.04.30 09:20:52 LOG6[5]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2018.04.30 09:20:52 LOG7[5]: Compression: null, expansion: null 2018.04.30 09:20:52 LOG6[5]: Read socket closed (read hangup) 2018.04.30 09:20:52 LOG7[5]: Sending close_notify alert 2018.04.30 09:20:52 LOG7[5]: TLS alert (write): warning: close notify 2018.04.30 09:20:52 LOG6[5]: SSL_shutdown successfully sent close_notify alert 2018.04.30 09:20:52 LOG6[5]: TLS fd: Connection reset by peer (104) 2018.04.30 09:20:52 LOG6[5]: TLS socket closed (SSL_read) 2018.04.30 09:20:52 LOG7[5]: Sent socket write shutdown 2018.04.30 09:20:52 LOG5[5]: Connection closed: 156 byte(s) sent to TLS, 30 byte(s) sent to socket 2018.04.30 09:20:52 LOG7[5]: Remote descriptor (FD=23) closed 2018.04.30 09:20:52 LOG7[5]: Local descriptor (FD=22) closed 2018.04.30 09:20:52 LOG7[5]: Service [mail2-smtps-submission] finished (4 left) This is the error I am getting from K9-Mail The google mail app just tells me: Alpine (linux commandline smtp client) Any advise from the gurus? Kind regards Ian

1 1

Error with negotiation OK
by Alix Janeth Jerez 15 May '18

15 May '18

Hi I am using lastest stunnel version. When i try to send an email, i get: "error permanente de SMTP: 503 Bad sequence of commands". This is the trace generated when I try to send an email. 2018.05.14 12:59:08 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.14 12:59:08 LOG5[main]: UTF-8 byte order mark not detected 2018.05.14 12:59:08 LOG5[main]: FIPS mode disabled 2018.05.14 12:59:08 LOG5[main]: Configuration successful 2018.05.14 12:59:08 LOG7[main]: Binding service [pseudo-ssmtp] 2018.05.14 12:59:08 LOG7[main]: Listening file descriptor created (FD=568) 2018.05.14 12:59:08 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.05.14 12:59:08 LOG7[main]: Service [pseudo-ssmtp] (FD=568) bound to 172.31.41.84:116 2018.05.14 12:59:08 LOG7[main]: Signal pipe is empty 2018.05.14 12:59:22 LOG7[main]: Found 1 ready file descriptor(s) 2018.05.14 12:59:22 LOG7[main]: FD=324 ifds=r-x ofds=r-- 2018.05.14 12:59:22 LOG7[main]: Dispatching signals from the signal pipe 2018.05.14 12:59:22 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2018.05.14 12:59:22 LOG7[main]: Running on Windows 6.1 2018.05.14 12:59:22 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.14 12:59:22 LOG5[main]: UTF-8 byte order mark not detected 2018.05.14 12:59:22 LOG5[main]: FIPS mode disabled 2018.05.14 12:59:22 LOG7[main]: Compression disabled 2018.05.14 12:59:22 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2018.05.14 12:59:22 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2018.05.14 12:59:22 LOG7[main]: PRNG seeded successfully 2018.05.14 12:59:22 LOG6[main]: Initializing service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.05.14 12:59:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, 0x00000000) 2018.05.14 12:59:22 LOG6[main]: Loading certificate from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Certificate loaded from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Loading private key from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Private key loaded from file: stunnel.pem 2018.05.14 12:59:22 LOG7[main]: Private key check succeeded 2018.05.14 12:59:22 LOG5[main]: Configuration successful 2018.05.14 12:59:22 LOG7[main]: Unbinding service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] closed (FD=568) 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] closed 2018.05.14 12:59:22 LOG7[main]: Binding service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Listening file descriptor created (FD=568) 2018.05.14 12:59:22 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] (FD=568) bound to 172.31.41.84:116 2018.05.14 12:59:22 LOG7[main]: Signal pipe is empty 2018.05.14 12:59:34 LOG7[main]: Found 1 ready file descriptor(s) 2018.05.14 12:59:34 LOG7[main]: FD=324 ifds=r-x ofds=--- 2018.05.14 12:59:34 LOG7[main]: Service [pseudo-ssmtp] accepted (FD=584) from 172.31.41.84:53557 2018.05.14 12:59:34 LOG7[main]: Creating a new thread 2018.05.14 12:59:34 LOG7[main]: New thread created 2018.05.14 12:59:34 LOG7[37]: Service [pseudo-ssmtp] started 2018.05.14 12:59:34 LOG7[37]: Option TCP_NODELAY set on local socket 2018.05.14 12:59:34 LOG5[37]: Service [pseudo-ssmtp] accepted connection from 172.31.41.84:53557 2018.05.14 12:59:34 LOG6[37]: failover: round-robin, starting at entry #1 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 212.227.15.158:465 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 212.227.15.158:465: waiting 10 seconds 2018.05.14 12:59:34 LOG5[37]: s_connect: connected 212.227.15.158:465 2018.05.14 12:59:34 LOG5[37]: Service [pseudo-ssmtp] connected remote server from 172.31.41.84:53558 2018.05.14 12:59:34 LOG7[37]: Option TCP_NODELAY set on remote socket 2018.05.14 12:59:34 LOG7[37]: Remote descriptor (FD=552) initialized 2018.05.14 12:59:34 LOG6[37]: SNI: sending servername: smtp.1and1.es 2018.05.14 12:59:34 LOG6[37]: Peer certificate required 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): before/connect initialization 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): SSLv2/v3 write client hello A 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): SSLv3 read server hello A 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=2: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG7[37]: OCSP: Ignoring root certificate 2018.05.14 12:59:34 LOG6[37]: Certificate accepted at depth=2: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=1: C=US, O="thawte, Inc.", CN=thawte SSL CA - G2 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG5[37]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 23.5.251.27:80: waiting 10 seconds 2018.05.14 12:59:34 LOG5[37]: s_connect: connected 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: OCSP: Connected t2.symcb.com:80 2018.05.14 12:59:34 LOG7[37]: OCSP: Response received 2018.05.14 12:59:34 LOG6[37]: OCSP: Status: good 2018.05.14 12:59:34 LOG6[37]: OCSP: This update: May 13 18:15:02 2018 GMT 2018.05.14 12:59:34 LOG6[37]: OCSP: Next update: May 20 18:15:02 2018 GMT 2018.05.14 12:59:34 LOG5[37]: OCSP: Certificate accepted 2018.05.14 12:59:34 LOG6[37]: Certificate accepted at depth=1: C=US, O="thawte, Inc.", CN=thawte SSL CA - G2 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=0: C=DE, ST=Rheinland-Pfalz, L=Montabaur, O=1&1 Internet SE, CN=smtp.1and1.es 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG6[37]: CERT: Host name "smtp.1and1.es" matched with "smtp.1and1.es" 2018.05.14 12:59:34 LOG5[37]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 23.5.251.27:80: waiting 10 seconds 2018.05.14 12:59:35 LOG5[37]: s_connect: connected 23.5.251.27:80 2018.05.14 12:59:35 LOG7[37]: OCSP: Connected tj.symcd.com:80 2018.05.14 12:59:35 LOG7[37]: OCSP: Response received 2018.05.14 12:59:35 LOG6[37]: OCSP: Status: good 2018.05.14 12:59:35 LOG6[37]: OCSP: This update: May 14 01:38:59 2018 GMT 2018.05.14 12:59:35 LOG6[37]: OCSP: Next update: May 21 01:38:59 2018 GMT 2018.05.14 12:59:35 LOG5[37]: OCSP: Certificate accepted 2018.05.14 12:59:35 LOG5[37]: Certificate accepted at depth=0: C=DE, ST=Rheinland-Pfalz, L=Montabaur, O=1&1 Internet SE, CN=smtp.1and1.es 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server certificate A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server key exchange A 2018.05.14 12:59:35 LOG6[37]: Client certificate not requested 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server done A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write client key exchange A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write change cipher spec A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write finished A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 flush data 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read finished A 2018.05.14 12:59:35 LOG7[37]: 1 client connect(s) requested 2018.05.14 12:59:35 LOG7[37]: 1 client connect(s) succeeded 2018.05.14 12:59:35 LOG7[37]: 0 client renegotiation(s) requested 2018.05.14 12:59:35 LOG7[37]: 0 session reuse(s) 2018.05.14 12:59:35 LOG6[37]: TLS connected: new session negotiated 2018.05.14 12:59:35 LOG7[37]: Peer certificate was cached (5543 bytes) 2018.05.14 12:59:35 LOG6[37]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.14 12:59:35 LOG7[37]: Compression: null, expansion: null 2018.05.14 12:59:53 LOG3[36]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2018.05.14 12:59:53 LOG5[36]: Connection closed: 15 byte(s) sent to TLS, 166 byte(s) sent to socket I can't find the error. Thanks in advance for your help. Best regards, Alix

2 5

stunnel-5.44 fails cross compile due to wrong include path in Gentoo....fix available
by Joe Harvell 14 May '18

14 May '18

The src/Makefile.am hardcodes -I/usr/kerberos/include. When cross compiling it should be including -I$(SYSROOT)//usr/kerberos/include. I patched configure.ac and Makefile.am, taking advantage of the existing --with-sysroot configure option. The Gentoo bug report: https://bugs.gentoo.org/654374 The patch to configure.ac and Makefile.am: https://654374.bugs.gentoo.org/attachment.cgi?id=528968 I was unable to find a bug reporting system for stunnel. So I guess this is it. Please source this fix. --- Joe Harvell

1 1

help with tls config in stunnel
by Daniel Trickett 10 May '18

10 May '18

Hi, We are running stunnel 5.44 on Solaris. Our b2b legacy system is using TLS 1.0. We have a supplier who recently switched to TLS 1.2 and we can no longer connect to the site from our b2b. How can I configure stunnel to connect to the supplier site using TLS 1.2? TIA. Dan T This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

How to tell if commuications are encrypted?
by Alex Birchall 10 May '18

10 May '18

Hello, I have Stunnel installed on Windows Server 2008 R2, running as a service. I have it installed as a client on a Windows POS 2009 device. This setup is working, in that the client is operating correctly and using Stunnel. But how can I tell if communications between the Stunnel client and the Stunnel server are being encrypted, rather than Stunnel just doing port forwarding? I did read the client needs to have access to the server's certificate, but at the moment it does not. Alex

2 1

Stunnel to Outlook
by DPS Support 09 May '18

09 May '18

I am trying to get a device on my network to send pop email notifications to my outlook account but can't seem to get it to work. I have enabled the outlook account to accept pop and enabled the client to send them. I'm not sure if I'm missing something or what, any help would be greatly appreciated. Here is my config: debug = info output = stunnel.log [outlook-pop3] client = yes accept = 110 connect = pop-mail.outlook.com:995 [outlook-imap] client = yes accept = 143 connect = imap-mail.outlook.com:993 [outlook-smtp] protocol = smtp client = yes accept = 25 connect = smtp-mail.outlook.com:587 Here is the log as well: 2018.05.08 15:15:03 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.05.08 15:15:03 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.05.08 15:15:03 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.05.08 15:15:03 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.08 15:15:03 LOG5[main]: UTF-8 byte order mark detected 2018.05.08 15:15:03 LOG5[main]: FIPS mode disabled 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-pop3] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-pop3] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-imap] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-imap] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-smtp] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-smtp] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG5[main]: Configuration successful 2018.05.08 15:15:03 LOG5[main]: Logging to C:\Users\dps_engineer\AppData\Local\stunnel.log 2018.05.08 15:15:53 LOG5[0]: Service [outlook-pop3] accepted connection from 126.10.230.254:52629 2018.05.08 15:15:53 LOG6[0]: failover: round-robin, starting at entry #1 2018.05.08 15:15:53 LOG6[0]: s_connect: connecting 40.97.135.130:995 2018.05.08 15:15:53 LOG5[0]: s_connect: connected 40.97.135.130:995 2018.05.08 15:15:53 LOG5[0]: Service [outlook-pop3] connected remote server from 126.10.218.222:60145 2018.05.08 15:15:53 LOG6[0]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:15:53 LOG6[0]: Peer certificate not required 2018.05.08 15:15:54 LOG6[0]: Certificate verification disabled 2018.05.08 15:15:54 LOG6[0]: Certificate verification disabled 2018.05.08 15:15:54 LOG6[0]: Client certificate not requested 2018.05.08 15:15:54 LOG6[0]: TLS connected: new session negotiated 2018.05.08 15:15:54 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:15:55 LOG6[0]: Read socket closed (readsocket) 2018.05.08 15:15:55 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2018.05.08 15:15:55 LOG6[0]: TLS socket closed (SSL_read) 2018.05.08 15:15:55 LOG5[0]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:15:55 LOG5[1]: Service [outlook-smtp] accepted connection from 126.10.230.254:52639 2018.05.08 15:15:55 LOG6[1]: failover: round-robin, starting at entry #2 2018.05.08 15:15:55 LOG6[1]: s_connect: connecting 40.97.162.162:587 2018.05.08 15:15:55 LOG5[1]: s_connect: connected 40.97.162.162:587 2018.05.08 15:15:55 LOG5[1]: Service [outlook-smtp] connected remote server from 126.10.218.222:60147 2018.05.08 15:15:55 LOG6[1]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:15:55 LOG6[1]: Peer certificate not required 2018.05.08 15:15:55 LOG6[1]: Certificate verification disabled 2018.05.08 15:15:55 LOG6[1]: Certificate verification disabled 2018.05.08 15:15:55 LOG6[1]: Empty client CA list 2018.05.08 15:15:55 LOG6[1]: TLS connected: new session negotiated 2018.05.08 15:15:55 LOG6[1]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:00 LOG6[1]: TLS socket closed (SSL_read) 2018.05.08 15:16:00 LOG5[1]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket 2018.05.08 15:16:00 LOG5[2]: Service [outlook-pop3] accepted connection from 126.10.230.254:52644 2018.05.08 15:16:00 LOG6[2]: failover: round-robin, starting at entry #2 2018.05.08 15:16:00 LOG6[2]: s_connect: connecting 40.97.161.50:995 2018.05.08 15:16:00 LOG5[2]: s_connect: connected 40.97.161.50:995 2018.05.08 15:16:00 LOG5[2]: Service [outlook-pop3] connected remote server from 126.10.218.222:60149 2018.05.08 15:16:00 LOG6[2]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:16:00 LOG6[2]: Peer certificate not required 2018.05.08 15:16:00 LOG6[2]: Certificate verification disabled 2018.05.08 15:16:00 LOG6[2]: Certificate verification disabled 2018.05.08 15:16:00 LOG6[2]: Client certificate not requested 2018.05.08 15:16:00 LOG6[2]: TLS connected: new session negotiated 2018.05.08 15:16:00 LOG6[2]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:01 LOG6[2]: TLS socket closed (SSL_read) 2018.05.08 15:16:01 LOG5[2]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:16:01 LOG5[3]: Service [outlook-smtp] accepted connection from 126.10.230.254:52647 2018.05.08 15:16:01 LOG6[3]: failover: round-robin, starting at entry #3 2018.05.08 15:16:01 LOG6[3]: s_connect: connecting 40.97.162.146:587 2018.05.08 15:16:01 LOG5[3]: s_connect: connected 40.97.162.146:587 2018.05.08 15:16:01 LOG5[3]: Service [outlook-smtp] connected remote server from 126.10.218.222:60150 2018.05.08 15:16:01 LOG6[3]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:16:01 LOG6[3]: Peer certificate not required 2018.05.08 15:16:01 LOG6[3]: Certificate verification disabled 2018.05.08 15:16:01 LOG6[3]: Certificate verification disabled 2018.05.08 15:16:01 LOG6[3]: Empty client CA list 2018.05.08 15:16:01 LOG6[3]: TLS connected: new session negotiated 2018.05.08 15:16:01 LOG6[3]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:03 LOG6[cron]: Executing cron jobs 2018.05.08 15:16:03 LOG6[cron]: Cron jobs completed in 0 seconds 2018.05.08 15:16:06 LOG6[3]: TLS socket closed (SSL_read) 2018.05.08 15:16:06 LOG5[3]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket 2018.05.08 15:16:06 LOG5[4]: Service [outlook-pop3] accepted connection from 126.10.230.254:52653 2018.05.08 15:16:06 LOG6[4]: failover: round-robin, starting at entry #3 2018.05.08 15:16:06 LOG6[4]: s_connect: connecting 40.97.134.18:995 2018.05.08 15:16:06 LOG5[4]: s_connect: connected 40.97.134.18:995 2018.05.08 15:16:06 LOG5[4]: Service [outlook-pop3] connected remote server from 126.10.218.222:60153 2018.05.08 15:16:06 LOG6[4]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:16:06 LOG6[4]: Peer certificate not required 2018.05.08 15:16:06 LOG6[4]: Certificate verification disabled 2018.05.08 15:16:06 LOG6[4]: Certificate verification disabled 2018.05.08 15:16:06 LOG6[4]: Client certificate not requested 2018.05.08 15:16:06 LOG6[4]: TLS connected: new session negotiated 2018.05.08 15:16:06 LOG6[4]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:07 LOG6[4]: Read socket closed (readsocket) 2018.05.08 15:16:07 LOG6[4]: SSL_shutdown successfully sent close_notify alert 2018.05.08 15:16:07 LOG6[4]: TLS socket closed (SSL_read) 2018.05.08 15:16:07 LOG5[4]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:16:07 LOG5[5]: Service [outlook-smtp] accepted connection from 126.10.230.254:52656 2018.05.08 15:16:07 LOG6[5]: failover: round-robin, starting at entry #4 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:101::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:101::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:108::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:108::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:cc::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:cc::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:8f::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:8f::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 40.97.161.50:587 2018.05.08 15:16:08 LOG5[5]: s_connect: connected 40.97.161.50:587 2018.05.08 15:16:08 LOG5[5]: Service [outlook-smtp] connected remote server from 126.10.218.222:60158 2018.05.08 15:16:08 LOG6[5]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:16:08 LOG6[5]: Peer certificate not required 2018.05.08 15:16:08 LOG6[5]: Certificate verification disabled 2018.05.08 15:16:08 LOG6[5]: Certificate verification disabled 2018.05.08 15:16:08 LOG6[5]: Empty client CA list 2018.05.08 15:16:08 LOG6[5]: TLS connected: new session negotiated 2018.05.08 15:16:08 LOG6[5]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:13 LOG6[5]: TLS socket closed (SSL_read) 2018.05.08 15:16:13 LOG5[5]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket Sent from Outlook<http://aka.ms/weboutlook>

2 1

Stunnel Time out Error
by Sedick Cloete 07 May '18

07 May '18

HI All, We recently moved our email server from an in-house server to Office 365. We are now in the process of replacing all our XP boxes with Windows 10. One of the boxes are running the email service which collects emails from Office 365, that we have just recently upgraded. This process works on the XP but times out on windows 10. Attached, is the time out the log file. Below is the code I am using: Basic program code * variables ChannelNo = 0 Pop3Server = 'outlook.office365.com' Pop3User = UserName Pop3Pass = Password Pop3Port = '995' ProxYServer = '127.0.0.1' ProxyPort = '110' ProxyDir = 'C:\see4OI\SSL\' ProxyExe = 'stunnel.exe' ProxyCert = 'stunnel.pem' * retreives mail in MIME format Gosub GET_EMAILS return Mail_Rec * ---------------------------------------------------------------------------- ------------- GET_EMAILS: * close previous session If it wasnt closed properly Code = seeClose(ChannelNo) Code = seeRelease() * attach key code Code = seeAttach(1, KeyCode) if Code < 0 then RetFlag = 1 return end * start stunnel Code = seeSetProxySSL(0, 1, ProxyDir, ProxyCert, ProxyExe) If Code < 0 Then RETURN end * connect to email server Code = seePop3ConnectSSL(ChannelNo, ProxyPort, Pop3Port, Pop3Server, Pop3User, Pop3Pass, ProxyServer) If Code < 0 Then RETURN End Your assistance in this regard will be highly appreciated. Thank you. Kind Regards, Logicore SEDICK CLOETE IT Business Consultant Cell: 083 228 7058 Fax: 086 515 9695 email: sedick(a)logicore.co.za If you are not the intended recipient of this communication, please notify the sender immediately. The information and/or attachment contained in this email is confidential and may contain proprietary and/or personal information. It is meant solely for the intended recipient. Access to this email by anyone else is unauthorised. If you are not the intended recipient, any processing of the email or the information contained therein (including disclosure, copying, distribution, storage) or any action taken or omitted in reliance on this, is prohibited and may be unlawful.

2 1

How to configure stunnel client on Mac
by Mark Foley 04 May '18

04 May '18

I've successfully set up stunnel for Windows and Linux clients. Now to set up for Mac. I've gone to the website http://macappstore.org/stunnel/ and followed the instructions there which are: 1. Press Command+Space and type Terminal and press enter/return key. 2. Run in Terminal app: ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" < /dev/null 2> /dev/null and press enter/return key. 3. Run: brew install stunnel And then it says, "Done! You can now use stunnel." Well, not exactly. Where do I put my stunnel.conf and certificate.pem? How do I make stunnel run automatically at boot time? The web instructions aren't very complete. Need additional assistance. THX --Mark

1 1

Stunnel in Windows Failover cluster
by Tobias Gillstöm 27 Apr '18

27 Apr '18

Hi, I'm currently using stunnel in a windows fail over cluster: My problem is that when a fail over occurs stunnel switches too the other node and says that stunnel is running and everything is fine. But when I check the logs for stunnel and the program that uses stunnel, it does not appear to be running or sending any data. In the screenshot you can see my stunnel configuration, in the startup parameters section it says "-service -install" my question is if it shouldn't say "-service -start" instead, has anyone else encountered this problem? And if this is the problem why does the stunnel service install with these parameters?

1 0

Ubuntu 16.04.4 LTS SSLv3 and SSlv2 running stunnel 5.44
by Joe Phillips 25 Apr '18

25 Apr '18

I am running stunnel 5.44 on Ubuntu 16.04.4 LTS with all updates. I cannot get devices to connect using sslv2 or 3. My conf file Options line as seen below : ;Enable support for inecure SSLv3 protocol Options = -NO_SSLv3 Options = -NO_SSLv2 I continuously get error 1408A10B SSL routines: ssl3_get_client_hello:wrong version number Do I not have SSL3 and 2 correctly defined in my conf file? I realize 2 and 3 are no longer secure, but I need to support them while I transition to TLS 1.2 thanks [cid:[email protected]]

2 1

stunnel as a Windows Service
by Paul Muller 20 Apr '18

20 Apr '18

Does anyone have any documentation on how to setup stunnel as a Windows Service? I currently have it installed on a Windows Server 2012 R2 Standard. I noticed that stunnel stops running as soon as I log off of my RDP session on the server. [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

2 1

Rapid subsequent DNS resolution fails within stunnel
by Vincent Deschenes 20 Apr '18

20 Apr '18

Hi, We have had this weird problem for a long time where sometime DNS resolution will fail with this error: Error resolving 'domain name printed here': Neither nodename nor servname known (EAI_NONAME) Today I found out that this will happen when stunnel get 2 calls for the same outgoing endpoint very fast one after the other. One call will work no problem. But if you do 2 one after the other then the second one and all other subsequent will fail. Wait a bit and try again, the first one will pass and then others will fail. DNS resolution on the server (linux) itself work without problem, nslookup in loops no problem. But with stunnel we always have the problem. The only working solution is to add a record to the server host file. Any idea ? Could this be a bug in stunnel ? Thanks, Vincent

1 1

Authentication
by Paul Muller 20 Apr '18

20 Apr '18

When I first setup stunnel, I changed my software to reflect the [gmail-smtp] entries in my configuration file. When I tried to send an email from my application I received the following message: "No Email sent, Error 535-5.7.8 Username and Password not accepted." Then I remarked out the authentication credentials in my software. When I tried to send an email I received the following message: "No Email sent, Error-5.5.1 Authentication Required." My question is, can place my authentication credentials in the "stunnel.conf" file? And if so, where? Thanks, [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

2 2

/etc/hosts setting
by White Little 17 Apr '18

17 Apr '18

Hi All I found a interesting issue with /etc/hosts setting in different Linux system. My stunnel.conf setting like below [HOST] cert = client.crt key = client.key CAfile = server.crt client = yes accept = 10.160.160.88:57853 connect = 10.136.160.21:3520 I would like to connect server 10.136.160.21:3520 via stunnel 10.160.160.88:57853 Part A If my hostname and /etc/hosts setting in different System as followings all will works well 1. CentOS 7 32bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 2. Redhat 7 64bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 3. Ubuntu15.10 64bit $hostname virtual-machine $ cat /etc/hosts 127.0.0.1 localhost 10.136.160.88 virtual-machine Part B. If the "127.0.0.1" include the hostname in /etc/hosts, both CentOS and Fedora will fail, but Ubuntu still work 1. CentOS 7 32bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost* localhost.localdomain* localhost4 localhost4.localdomain4 10.136.160.253 localhost.localdomain 2. Redhat 7 64bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost *localhost.localdomain* localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 3. Ubuntu15.10 64bit $hostname virtual-machine $ cat /etc/hosts 127.0.0.1 localhost *virtual-machine* 10.136.160.88 virtual-machine I think it maybe not a stunnel issue, but I'd like to know why it has different behavior Thanks Jay

2 2

make_test failing
by Ian Bamforth 16 Apr '18

16 Apr '18

Morning, Our CI has been failing since Friday with the same errors seen at https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/stunnel4…. make_test fails on 012_verify_chain and 013_CRL_file. Anyone else seeing the same thing? We run Ubuntu 14.04, stunnel v5.44, automatically applying apt security patches to the OS. My initial assumption is that some dependency of stunnel has been updated, but I've not had chance to find out. We have been using the same version of stunnel since the day it was released without any other problems. Ian

2 2

Invalid certificate in tests, prevents make_test from running
by Ian Bamforth 16 Apr '18

16 Apr '18

Morning, I posted earlier about `make_test` failing, apologies for not replying to that thread but I didn't receive the email myself. I've tracked this down to `tests/certs/CACert.pem` containing an expired certificate - see below output: openssl x509 -in tests/certs/CACert.pem -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha1WithRSAEncryption Issuer: C=pl, O=CA_cert, OU=CA_cert, CN=CA_cert/emailAddress=CA_cert(a)example.com Validity Not Before: Apr 26 18:41:00 2017 GMT Not After : Apr 13 15:45:00 2018 GMT Subject: C=pl, O=CA_cert, OU=CA_cert, CN=CA_cert/emailAddress=CA_cert(a)example.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:af:cc:61:f5:73:2b:49:3c:62:c0:b0:d6:1b:0f: 5e:32:d1:49:48:01:b2:35:36:a8:04:a3:e0:7e:e4: 1d:f9:cb:fe:11:0a:c3:2e:b1:3e:87:4c:b0:72:d7: 73:04:ba:28:c7:2b:b4:67:13:0e:5d:05:7f:67:bd: ba:7f:c5:89:b0:48:d6:21:4b:e8:3a:70:ac:dc:e4: f5:43:c3:c9:57:7f:73:f1:3b:b0:e5:a5:90:44:9f: 6e:c3:2a:f5:ab:e6:15:f3:de:cd:44:23:5e:4f:c2: eb:44:59:6c:f5:76:46:b0:7c:fc:59:df:20:97:0c: 0f:43:ae:df:47:f6:d2:78:fd:c6:be:11:cf:26:a1: 8d:87:74:2f:c9:b5:1b:2b:9d:a4:95:44:0c:54:de: 0c:12:d4:8d:14:57:31:a7:a8:70:11:68:6e:20:3d: 76:c9:c8:45:50:d5:4e:2f:f1:6e:78:25:23:05:45: 6e:7d:11:2a:b3:e8:88:6e:68:29:2c:a2:c2:3d:cf: 41:50:b5:e1:51:8f:8e:f4:36:0f:f5:a8:63:5e:29: 1d:b4:fe:71:43:d0:2a:be:2a:2c:b1:62:c6:b9:bc: 4d:95:80:4e:60:ec:e9:79:92:19:31:9c:b2:00:74: 3b:a1:80:57:b4:22:45:c8:d3:1a:a7:4f:f6:00:12: 35:b7 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha1WithRSAEncryption 97:03:b2:c1:a2:44:8a:2a:9c:1d:3c:cb:61:a6:f9:bc:7f:4f: 21:fc:69:d8:f3:31:7b:4b:e5:2b:34:42:19:03:1a:40:af:fa: 7e:18:93:99:a8:78:cb:32:15:23:75:6e:49:6d:ac:ee:ca:5e: d6:d2:69:5a:b5:4a:13:cd:7c:77:e4:f2:6d:a0:2d:63:2f:62: b5:be:24:ee:12:d7:22:3e:dd:d2:56:07:81:ca:c4:cf:4c:2c: 36:64:32:52:b1:76:76:5f:c7:45:86:b9:34:1a:c7:37:0c:38: ce:8b:20:8b:70:a1:33:a0:e1:3d:ed:9a:26:c0:04:e7:35:c5: 41:ab:bd:f9:cc:10:8d:12:3f:7a:ee:b3:a3:98:35:09:b2:e5: 5f:aa:22:16:7e:18:df:61:ac:3d:30:48:f7:77:41:5c:25:bd: 6f:dc:53:d0:f3:d7:cc:33:f6:77:36:99:0b:e4:8f:3e:83:e4: ca:3a:58:6f:73:55:83:6e:a7:01:b2:21:bf:09:54:28:e3:e0: a5:4f:bd:d7:66:a2:f8:c2:81:6f:0d:aa:ba:6f:7d:a9:cf:6f: 06:a8:a2:b1:5b:3b:f9:7b:89:bf:f5:c4:ed:f0:5e:cf:64:87: 39:84:90:6c:c9:e0:5d:b4:54:ae:a7:6c:e7:b4:2a:29:fe:ab: 62:4f:91:d0 As a (horrible) workaround I've had to skip "make_test" in my CI - if there are any better ideas please let me know! Ian

1 0

Possible memory leak with stunnel reload
by Mark Brookes 06 Apr '18

06 Apr '18

Hi all, we have noticed that when reloading (note reloading not restarting) stunnel it appears to be leaking between 12 and 32 bytes of memory (ish) per reload. There does not need to be any traffic passing through it at the time to view this problem. If its reloaded enough times the system will eventually run out of memory. Unless an stunnel restart if performed inbetween. We are running 5.41 tried with the latest 5.44 and have the same result. We are using openssl 1.0.2j-fips ive tried with 1.0.2n and 1.1.0e (to try and rule out openssl) We are reloading by running: kill -s HUP <pid> The stunnel configuration is - pid = /var/run/stunnel/stunnel.pid debug = 7 syslog = no output = /var/log/stunnel.log socket = a:IP_FREEBIND=yes fips = no sslVersion = all [VIP_Name] cert = /etc/loadbalancer.org/certs/server.pem ciphers = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES accept = 192.168.80.16:443 connect = 127.0.0.5:80 delay = yes options = NO_SSLv3 options = NO_TLSv1 options = DONT_INSERT_EMPTY_FRAGMENTS renegotiation = no local = 192.168.80.16 TIMEOUTclose = 0 The stunnel log file is as follows - 2018.04.03 11:09:59 LOG7[ui]: Clients allowed=62937 2018.04.03 11:09:59 LOG5[ui]: stunnel 5.44 on x86_64-pc-linux-gnu platform 2018.04.03 11:09:59 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j-fips 26 Sep 2016 2018.04.03 11:09:59 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.04.03 11:09:59 LOG7[ui]: errno: (*__errno_location ()) 2018.04.03 11:09:59 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2018.04.03 11:09:59 LOG5[ui]: UTF-8 byte order mark not detected 2018.04.03 11:09:59 LOG5[ui]: FIPS mode disabled 2018.04.03 11:09:59 LOG7[ui]: Compression disabled 2018.04.03 11:09:59 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2018.04.03 11:09:59 LOG7[ui]: PRNG seeded successfully 2018.04.03 11:09:59 LOG6[ui]: Initializing service [VIP_Name] 2018.04.03 11:09:59 LOG7[ui]: Ciphers: ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES 2018.04.03 11:09:59 LOG7[ui]: TLS options: 0x07004804 (+0x07004800, -0x00000000) 2018.04.03 11:09:59 LOG6[ui]: Loading certificate from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Certificate loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Loading private key from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Private key loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG7[ui]: Private key check succeeded 2018.04.03 11:09:59 LOG7[ui]: ECDH initialization 2018.04.03 11:09:59 LOG7[ui]: ECDH initialized with curve prime256v1 2018.04.03 11:09:59 LOG5[ui]: Configuration successful 2018.04.03 11:09:59 LOG7[ui]: Binding service [VIP_Name] 2018.04.03 11:09:59 LOG7[ui]: Listening file descriptor created (FD=6) 2018.04.03 11:09:59 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.04.03 11:09:59 LOG7[ui]: Option IP_FREEBIND set on accept socket 2018.04.03 11:09:59 LOG7[ui]: Service [VIP_Name] (FD=6) bound to 192.168.80.16:443 2018.04.03 11:09:59 LOG7[main]: Created pid file /var/run/stunnel/stunnel.pid 2018.04.03 11:09:59 LOG7[cron]: Cron thread initialized 2018.04.03 11:10:59 LOG6[cron]: Executing cron jobs 2018.04.03 11:10:59 LOG6[cron]: Cron jobs completed in 0 seconds 2018.04.03 11:10:59 LOG7[cron]: Waiting 86400 seconds 2018.04.03 11:11:08 LOG7[main]: Found 1 ready file descriptor(s) 2018.04.03 11:11:08 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.04.03 11:11:08 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.04.03 11:11:08 LOG7[main]: Dispatching signals from the signal pipe 2018.04.03 11:11:08 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2018.04.03 11:11:08 LOG5[main]: Reading configuration from file /etc/stunnel/stunnel.conf 2018.04.03 11:11:08 LOG5[main]: UTF-8 byte order mark not detected 2018.04.03 11:11:08 LOG5[main]: FIPS mode disabled 2018.04.03 11:11:08 LOG7[main]: Compression disabled 2018.04.03 11:11:08 LOG7[main]: Snagged 64 random bytes from /dev/urandom 2018.04.03 11:11:08 LOG7[main]: PRNG seeded successfully 2018.04.03 11:11:08 LOG6[main]: Initializing service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Ciphers: ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES 2018.04.03 11:11:08 LOG7[main]: TLS options: 0x07004804 (+0x07004800, -0x00000000) 2018.04.03 11:11:08 LOG6[main]: Loading certificate from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Certificate loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Loading private key from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Private key loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG7[main]: Private key check succeeded 2018.04.03 11:11:08 LOG7[main]: ECDH initialization 2018.04.03 11:11:08 LOG7[main]: ECDH initialized with curve prime256v1 2018.04.03 11:11:08 LOG5[main]: Configuration successful 2018.04.03 11:11:08 LOG7[main]: Unbinding service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] closed (FD=6) 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] closed 2018.04.03 11:11:08 LOG7[main]: Binding service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Listening file descriptor created (FD=6) 2018.04.03 11:11:08 LOG7[main]: Option SO_REUSEADDR set on accept socket 2018.04.03 11:11:08 LOG7[main]: Option IP_FREEBIND set on accept socket 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] (FD=6) bound to 192.168.80.16:443 2018.04.03 11:11:08 LOG7[main]: Signal pipe is empty Any help would be appreciated. Thanks -- Mark Brookes Loadbalancer.org Ltd. www.loadbalancer.org +44 (0)330 380 1064 mark(a)loadbalancer.org

2 2

Motion and Stunnel Query
by Vidya Govindan 04 Apr '18

04 Apr '18

Hi Everyone, I am trying to work on a video streaming project which uses the motion software to stream images from a usb camera. By default the streaming is done in a non-secure manner. So I installed Stunnel , generated a self signed certificate and I am not using it on top of the motion software to securely stream images. Now, I want to know exactly how Stunnel encrypts/decrypts image data that is generated by motion? I know that motion sends the data on port 8081 and Stunnel tunnels it to another port 8443. I can not understand where exactly the Openssl library functions are used to add the security feature in this scenario. Can anyone with a better understanding throw some light on the same? Thanks & Regards, Vidya

1 0

proxy with authentication
by Andreas Meier 03 Apr '18

03 Apr '18

3 3

First Time Troubles.
by me＠kilosierracharlie.me 22 Mar '18

22 Mar '18

Hello All, I'm trying to configure STunnel4 on Windows to connect to my VPS installed with STunnel, so I can use SSH through a DPI laden network. The configuration works if I try at home, or on a mobile data hotspot, but if I attempt within the DPI network, it does not work, and provides this console output: 2018.03.22 09:30:15 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.03.22 09:30:15 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.03.22 09:30:15 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.03.22 09:30:15 LOG5[main]: Reading configuration from file stunnel.conf 2018.03.22 09:30:15 LOG5[main]: UTF-8 byte order mark detected 2018.03.22 09:30:15 LOG5[main]: FIPS mode disabled 2018.03.22 09:30:15 LOG5[main]: Configuration successful 2018.03.22 09:30:24 LOG5[0]: Service [ssh] accepted connection from 127.0.0.1:65086 2018.03.22 09:30:24 LOG5[0]: s_connect: connected 130.185.251.28:443 2018.03.22 09:30:24 LOG5[0]: Service [ssh] connected remote server from 172.28.1.25:65087 2018.03.22 09:30:25 LOG4[0]: CERT: Certificate not found in local repository 2018.03.22 09:30:25 LOG4[0]: Rejected by CERT at depth=0: CN=130.185.251.28 2018.03.22 09:30:25 LOG3[0]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed 2018.03.22 09:30:25 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket This is the configuration I'm using: [ssh] client = yes accept = 443 connect = 130.185.251.28:443 CAfile = peer-ssh.pem verifyPeer = yes The odd thing, is that if I connect using my mobile data, and then switch over to filtered internet and try again, it works fine, and adds the following lines to the log: 2018.03.22 09:36:46 LOG5[1]: Service [ssh] accepted connection from 127.0.0.1:65237 2018.03.22 09:36:46 LOG5[1]: s_connect: connected 130.185.251.28:443 2018.03.22 09:36:46 LOG5[1]: Service [ssh] connected remote server from 192.168.43.115:65238 2018.03.22 09:36:46 LOG5[1]: Certificate accepted at depth=0: C=GB, ST=Lincolnshire, L=Horncastle, O=N/A, OU=N/A, CN=personal.kilosierracharlie.me, emailAddress=webmaster(a)kilosierracharlie.me Has anyone got any ideas regarding this issue? It's not mission critical, but it's quite annoyingly repetitive! Cheers, Kieran.

1 0

sTunnel client connecting to load balanced URL - stunnel 5.02 on x86-pc-msvc-1500 platform
by Tony 19 Mar '18

19 Mar '18

Hi all, I have a situation where I'm trying to use sTunnel as the client to connect to a service on a secure URL, but the hiccup is that the secure URL is load balanced. If a do an nslookup on the URL, the response comes back as it being an alias. Non-authoritative answer: Name: eu1571393051174.ssl.ondemand.com Address: 155.56.210.164 Aliases: l4884-iflmap.hcisbp.eu1.hana.ondemand.com Looking at the sTunnel log, it resolves to the IP of the server. But the IP itself does not host the service so I'm getting http:503 errors. 2018.03.16 14:44:44 LOG7[18796]: Service [ssl-OSRdev] (FD=564) bound to 0.0.0.0:8085 2018.03.16 14:44:55 LOG7[18796]: Service [ssl-OSRdev] accepted (FD=572) from 192.168.0.22:61093 2018.03.16 14:44:55 LOG7[18796]: Creating a new thread 2018.03.16 14:44:55 LOG7[18796]: New thread created 2018.03.16 14:44:55 LOG7[30864]: Service [ssl-OSRdev] started 2018.03.16 14:44:55 LOG5[30864]: Service [ssl-OSRdev] accepted connection from 192.168.0.22:61093 2018.03.16 14:44:55 LOG6[30864]: s_connect: connecting 155.56.210.164:443 2018.03.16 14:44:55 LOG7[30864]: s_connect: s_poll_wait 155.56.210.164:443: waiting 10 seconds 2018.03.16 14:44:56 LOG5[30864]: s_connect: connected 155.56.210.164:443 2018.03.16 14:44:56 LOG5[30864]: Service [ssl-OSRdev] connected remote server from 192.168.0.32:30269 2018.03.16 14:44:56 LOG7[30864]: Remote socket (FD=588) initialized 2018.03.16 14:44:56 LOG7[30864]: SNI: sending servername: l4884-iflmap.hcisbp.eu1.hana.ondemand.com 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): before/connect initialization 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv2/v3 write client hello A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server hello A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server certificate A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server key exchange A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server certificate request A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server done A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write client certificate A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write client key exchange A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write certificate verify A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write change cipher spec A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write finished A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 flush data 2018.03.16 14:44:57 LOG7[30864]: SSL state (connect): SSLv3 read finished A 2018.03.16 14:44:57 LOG7[30864]: 1 items in the session cache 2018.03.16 14:44:57 LOG7[30864]: 1 client connects (SSL_connect()) 2018.03.16 14:44:57 LOG7[30864]: 1 client connects that finished 2018.03.16 14:44:57 LOG7[30864]: 0 client renegotiations requested 2018.03.16 14:44:57 LOG7[30864]: 0 server connects (SSL_accept()) 2018.03.16 14:44:57 LOG7[30864]: 0 server connects that finished 2018.03.16 14:44:57 LOG7[30864]: 0 server renegotiations requested 2018.03.16 14:44:57 LOG7[30864]: 0 session cache hits 2018.03.16 14:44:57 LOG7[30864]: 0 external session cache hits 2018.03.16 14:44:57 LOG7[30864]: 0 session cache misses 2018.03.16 14:44:57 LOG7[30864]: 0 session cache timeouts 2018.03.16 14:44:57 LOG7[30864]: Peer certificate was cached (3826 bytes) 2018.03.16 14:44:57 LOG6[30864]: SSL connected: new session negotiated 2018.03.16 14:44:57 LOG6[30864]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2018.03.16 14:44:57 LOG6[30864]: Compression: null, expansion: null 2018.03.16 14:44:58 LOG6[30864]: SSL socket closed (SSL_read) 2018.03.16 14:44:58 LOG7[30864]: Sent socket write shutdown 2018.03.16 14:44:58 LOG5[30864]: Connection closed: 1730 byte(s) sent to SSL, 274 byte(s) sent to socket 2018.03.16 14:44:58 LOG7[30864]: Remote socket (FD=588) closed 2018.03.16 14:44:58 LOG7[30864]: Local socket (FD=572) closed 2018.03.16 14:44:58 LOG7[30864]: Service [ssl-OSRdev] finished (0 left) 2018.03.16 14:44:58 LOG7[30864]: str_stats: 3 block(s), 4294962489 data byte(s), 150 control byte(s) 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:413 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:412 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:411 I have tested the service using SoapUI and it works. Is it possible to have sTunnel follow the URL redirection? Regards, Tony

2 1

Re: [stunnel-users] basic usage question
by Mark Foley 19 Mar '18

19 Mar '18

Solved! I've fixed up the various ports and now I am able to connect. For the edification of other list readers I'll summarize. I have a local Linux host acting as firewall/router. It routes requests on port 1234 to port 3389 on a local Linux workstation which is running x11vnc server listening on its local port 5900. I want to connect to this VNC server from a remote vnc viewer. (Why does the router forward to port 3389? Because the workstaion can dual-boot Windows, so the forward works regardless of booted OS.) Remote vnc viewer, stunnel client stunnel.conf: verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [x11vnc] accept = 5900 connect = router.obfuscate.org:1234 Local workstation vnc server, stunnel server stunnel.conf: pid = /var/run/stunnel.pid debug = 7 [x11vnc] accept = 3389 key = /root/privatekey.pem cert = /root/certificate.pem connect = 127.0.0.1:5900 The certificate is self-signed and created on the stunnel/vnc server host using the following commands: openssl genrsa -out privatekey.pem 2048 openssl req -new -x509 -days 365 -key privatekey.pem -out certificate.pem The certificate.pem is copied to the stunnel client host. With x11vnc listening on 5900 on the local workstation and with 'stunnel stunnel.conf' running on both stunnel client (as the normal user) and server hosts, I use the remote vnc viewer, logged in as a normal user, with the connection 127.0.0.1:5900 I'm guessing I could configure my vnc viewers to connect to multiple clients with difference [service] sections, for example: verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [remoteHost1] accept = 5900 connect = router.obfuscate.org:1234 [remoteHost2] accept = 5901 connect = router.obfuscate.org:4321 I haven't tried that, but I will. I futher guess that I could have different CAfiles per server if I moved that directive to the respective service defintions (can someone confirm?), but I haven't tried that either. Thanks especially to Flo Rance for helping me work through this. Now, I have to figure out how to do this from a Windows client! --Mark

2 1

Creating CSR for GoDaddy
by John McClymont 15 Mar '18

15 Mar '18

Good Morning, As a novice user of stunnel. I use stunnel to make and encrypted video connection to home security system. I wish to create an SSL certificate request to obtain an SSL from GoDaddy I use the following command openssl req -new -newkey rsa:2048 -nodes -keyout c:\key\private_key.key -out c:\key\request.csr Is this correct? thanks in advance for suggestions

2 1

Re: [stunnel-users] basic usage question
by Mark Foley 15 Mar '18

15 Mar '18

Nitin - sorry, I didn't realize this was a response to my message and I sent a followup message before reading this one. I have your patch in a previous message. I'm not familiar with "patching". Can you give me quickie instructions on doing that, or refer me to a link that explains it? I assume I need to patch the source code, right? If so, I have stunnel version 5.35. Do I need to apply this patch to a more recent version? Are there any other sslVersions stunnel supports? Thanks --Mark -----Original Message----- On Tue, 13 Mar 2018 22:21:24 +0400 Nitin Mutkawoa <jmutkawoa(a)hackers.mu> wrote: > > hello > > Sorry, I was not clear enough in my previous mail. > The patch allows you to specify TLS 1.3 in the configuration file and do a > TLS 1.3 only. > > regards > > Nitin J Mutkawoa > > https://tunnelix.com > https://hackers.mu > > Twitter: @TheTunnelix > > On Tue, Mar 13, 2018 at 3:13 PM, Ma??gorzata Olszówka < > Malgorzata.Olszowka(a)stunnel.org> wrote: > > > I'm also working on TLS 1.3 compatibility with Stunnel. I will reach the > >> mailing list as soon as possible with a tested patch. > >> > > > > Hello Nitin, > > Could you specify what problem do you have with TLS 1.3. > > It works for me: > > > > 2018.03.13 11:39:06 LOG5[ui]: stunnel 5.44 on x86_64-unknown-linux-gnu > > platform > > 2018.03.13 11:39:06 LOG5[ui]: Compiled/running with OpenSSL > > 1.1.1-pre2-dev xx XXX xxxx > > ??? > > 2018.03.13 11:39:23 LOG6[0]: Negotiated TLSv1.3 ciphersuite > > TLS13-AES-256-GCM-SHA384 (256-bit encryption) > > > > > > Regards, > > Ma??gorzata > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > >

1 1

Re: [stunnel-users] basic usage question
by Mark Foley 14 Mar '18

14 Mar '18

Thanks to help from Nitin, I've made a tiny bit of progress with stunnel. I've created the certificates per Nitin's instructions at https://tunnelix.com/securing-mysql-traffic-with-stunnel-in-a-jail-environm… Certificates have permissions 0600. I want to use a VNC client on Linux to connect to a VNC Server also on Linux. In between these two computers I have a Linux router which routes all request to port 1914 to port 3389 on the VNC Server. stunnel on the server is run at the command line by root: 'stunnel /root/stunnel.conf'. Here is my VNC Server computer's stunnel.conf: foreground = yes pid = /var/run/stunnel.pid debug = 7 ; output = /root/stunnel.log output = /dev/stdout [x11vnc] accept = 3389 key = /root/privatekey.pem cert = /root/certificate.pem connect = 127.0.0.1:5900 stunnel on the client is run by a normal user, stunnel $HOME/.stunnel/stunnel.conf. Below is my client stunnel.conf: foreground = yes verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [x11vnc] accept = 5900 connect = mail.ohprs.org:1914 When I run stunnel on the client I get: 2018.03.13 13:21:17 LOG5[ui]: stunnel 5.35 on x86_64-slackware-linux-gnu platform 2018.03.13 13:21:17 LOG5[ui]: Compiled with OpenSSL 1.0.2h 3 May 2016 2018.03.13 13:21:17 LOG5[ui]: Running with OpenSSL 1.0.2n 7 Dec 2017 2018.03.13 13:21:17 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2018.03.13 13:21:17 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2018.03.13 13:21:17 LOG5[ui]: Reading configuration from file /home/mfoley/.stunnel/stunnel.conf 2018.03.13 13:21:17 LOG5[ui]: UTF-8 byte order mark not detected 2018.03.13 13:21:17 LOG5[ui]: FIPS mode disabled 2018.03.13 13:21:17 LOG4[ui]: Service [x11vnc] uses "verify = 2" without subject checks 2018.03.13 13:21:17 LOG4[ui]: Use "checkHost" or "checkIP" to restrict trusted certificates 2018.03.13 13:21:17 LOG5[ui]: Configuration successful On the client, I then run tigerVNCViewer connecting to 127.0.0.1::5900. I get the following messages on the client: 2018.03.13 13:22:03 LOG5[0]: Service [x11vnc] accepted connection from 127.0.0.1:35034 2018.03.13 13:22:03 LOG5[0]: s_connect: connected 98.102.63.107:1914 2018.03.13 13:22:03 LOG5[0]: Service [x11vnc] connected remote server from 192.168.0.17:40512 2018.03.13 13:22:03 LOG3[0]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2018.03.13 13:22:03 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Just guessing, but is it failing with the SSLVersion? Help appreciated. Thanks, Mark

1 1

[PATCH] TLS 1.3 Compatibility
by Nitin Mutkawoa 13 Mar '18

13 Mar '18

Hello, To add TLS 1.3 compatibility on Stunnel, the following patch was applied and tested. --- options.c.orig 2018-03-13 04:06:01.410477727 +0000 +++ options.c 2018-03-13 05:42:51.883782519 +0000 @@ -2675,6 +2675,18 @@ NOEXPORT char *parse_service_option(CMD #else /* defined(OPENSSL_NO_TLS1_2) */ return "TLSv1.2 not supported"; #endif /* !defined(OPENSSL_NO_TLS1_2) */ + } else if(!strcasecmp(arg, "TLSv1.3")) { +#ifndef OPENSSL_NO_TLS1_3 + section->client_method=(SSL_METHOD *)TLS_client_method(); + section->server_method=(SSL_METHOD *)TLS_server_method(); + section->ssl_options_set|= SSL_OP_NO_SSLv2; + section->ssl_options_set|= SSL_OP_NO_SSLv3; + section->ssl_options_set|= SSL_OP_NO_TLSv1; + section->ssl_options_set|= SSL_OP_NO_TLSv1_1; + section->ssl_options_set|= SSL_OP_NO_TLSv1_2; +#else /* defined(OPENSSL_NO_TLS1_3) */ + return "TLSv1.3 not supported"; +#endif #endif /* OPENSSL_API_COMPAT<0x10100000L */ } else return "Incorrect version of TLS protocol"; Please see this link for more info about the test for TLS 1.3 https://gist.github.com/jmutkawoa/c97f5d67ded592f6ad04389a3ade623e Regards Nitin J Mutkawoa https://tunnelix.com https://hackers.mu Twitter: @TheTunnelix

1 0

basic usage question
by Mark Foley 10 Mar '18

10 Mar '18

I'm trying to set up an ssl tunnel for VNC per the instructions at https://www.ibm.com/developerworks/library/l-sslvnc/index.html. I've not gotten very far into the steps. I tried: # stunnel -d 5905 -r 5900 -p /root/combined.pem [ ] Clients allowed=500 [.] stunnel 5.35 on x86_64-slackware-linux-gnu platform [.] Compiled with OpenSSL 1.0.2h 3 May 2016 [.] Running with OpenSSL 1.0.2n 7 Dec 2017 [.] Update OpenSSL shared libraries or rebuild stunnel [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [!] Invalid configuration file name "-d" [!] realpath: No such file or directory (2) [ ] Cron thread initialized I find nothing on the -d, -r or -p options in the manpage. This is my 1st posting to this list. I have very rudimentary skills with ssl, ssh, and certificates, mainly limited to getting certificates from a provider and installing for web and email; and creating public keys for ssh login using ssh-keygen. That's about it, so I'm pretty much a certified newbie. Help getting past the starting gate would be greatly appreciated. THX --Mark

1 0

[PATCH] Spectre v2 Vulnerability Mitigations
by Nitin Mutkawoa 07 Mar '18

07 Mar '18

Hello To prevent any leakage (Spectre v2) from a compromised VM on same physical host, this patch would mitigate the impact. --- configure.ac.orig 2018-03-04 01:46:55.877067173 +0400 +++ configure.ac 2018-03-04 01:49:26.422625147 +0400 @@ -101,6 +101,11 @@ if test "$GCC" = yes; then fi AX_APPEND_COMPILE_FLAGS([-D_FORTIFY_SOURCE=2]) +# Spectre v2 mitigations +AX_APPEND_COMPILE_FLAGS([-mfunction-return=thunk]) +AX_APPEND_COMPILE_FLAGS([-mindirect-branch=thunk]) + AC_MSG_NOTICE([**************************************** libtool]) LT_INIT([disable-static]) AC_SUBST([LIBTOOL_DEPS]) Kind regards, Nitin J Mutkawoa https://tunnelix.com https://hackers.mu

1 0

Re: [stunnel-users] Connect using TLS with public Web Server
by peter＠easthope.ca 06 Mar '18

06 Mar '18

From: Carlos Castro <carlos.castro.guerrero(a)gmail.com> Date: Fri, 2 Feb 2018 12:04:08 +0100 > I have older application and now I need connect with external server HTTPS > using TLS . My application doesn't support with TLS and I think use Stunnel > to connect with this Server HTTPS. Same requirement here. Have you tried this configuration? ; yourhost:/etc/stunnel4/stunnel.conf ... [https] client = yes accept = 443 transparent = destination Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca https://en.wikibooks.org/wiki/Medical_Suction_Machines https://en.wikibooks.org/wiki/Oberon

3 6

Stunnel in server mode with certificate from the Windows Certificate Store
by merlin＠mp3merlin.net 06 Mar '18

06 Mar '18

Hello, I'm trying to use stunnel in server mode with certificates from the Windows Certificate Store. I have a basic configuration which is working with a PEM certificate file and I'm trying to get it to use a cert via the CAPI engine. Here is my basic (working) config: debug = debug output = C:\stunnel\stunnel.log options = -NO_SSLv3 [https] accept = 443 connect = 80 cert = stunnel.pem Here is my config using the CAPI engine: debug = debug output = C:\stunnel\stunnel.log engine = capi engineCtrl = debug_level:2 engineCtrl = debug_file:c:\stunnel\capi.log engineCtrl = store_flags:1 engineCtrl = list_certs options = -NO_SSLv3 [https] accept = 443 connect = 80 engineId = capi However stunnel does not seem to find a certificate to use: [...] 2018.03.06 10:22:05 LOG7[main]: Enabling support for engine "capi" 2018.03.06 10:22:05 LOG7[main]: Executing engine control command debug_level:2 2018.03.06 10:22:05 LOG7[main]: Executing engine control command debug_file:c:\stunnel\capi.log 2018.03.06 10:22:05 LOG7[main]: Executing engine control command store_flags:1 2018.03.06 10:22:05 LOG7[main]: Executing engine control command list_certs 2018.03.06 10:22:05 LOG7[main]: Initializing engine #1 (capi) 2018.03.06 10:22:05 LOG6[main]: Engine #1 (capi) initialized [...] 2018.03.06 10:22:05 LOG6[main]: Initializing service [https] 2018.03.06 10:22:05 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.03.06 10:22:05 LOG7[main]: TLS options: 0x01004004 (+0x03004000, -0x02000000) 2018.03.06 10:22:05 LOG7[main]: No certificate or private key specified [...] And I have no certificates listed in the CAPI debug log: Setting debug level to 2 Setting debug file to c:\stunnel\capi.log Setting flags to 1 Listing certs for store MY Opening certificate store MY capi_cert_get_fname When I load the engine via OpenSSL, I can see that a certificate is present in the store: C:\stunnel\bin>openssl.exe engine -t dynamic -pre "SO_PATH:C:\stunnel\engines\capi.dll" -pre LOAD -post store_flags:1 -post store_name:MY -post list_certs WARNING: can't open config file: /devel/win32/openssl/openssl.cnf (dynamic) Dynamic engine loading support [Success]: SO_PATH:C:\stunnel\engines\capi.dll [Success]: LOAD Loaded: (capi) CryptoAPI ENGINE [ available ] [Success]: store_flags:1 Certificate 0 Friendly Name "test" Subject: CN = test Issuer: CN = test [Success]: list_certs This certificate (and the associated private key) has been generated via the IIS Manager console and I have imported it in the Local Computer Store (with the private key). Does anybody have any idea what I am missing to get this to work ? I can provide more logs and run more tests if necessary. I'm using Stunnel 5.44 on Windows 2008 R2. I tried with an older version (5.40) but same problem. Thanks. Kevin

1 0

Re: [stunnel-users] Re: Connect using TLS with public Web Server
by Carlos Castro 06 Mar '18

06 Mar '18

Hi All , it's mandatory for use stunnel wich the infrastructure has client stunnel and server stunnel ?? Or I can have client stunnel vs Web server HTTPS without stunnel server , only web server https . I newbie in stunnel , but i think is mandatory install stunnel in both sites , that's is correct? Regards On 05/03/18 20:23, Carlos Castro wrote: > > Thanks @Mike > > If possible use Squid + stunnel to solve the problem with host > header? The application is very very old . > > Thanks > > > On 05/03/18 20:06, Mike Spooner wrote: >> >> The problem is the "Host: ..." header that is being sent to the >> remote server. You need to configure 127.0.0.1:19021 as a proxy in >> your app (and curl) and then have the app (curl) fetch >> https://ctm.omego.net >> >> >> Not sure how to do that in curl, but search the curl manpage for any >> mentions of "proxy". >> >> -- Mike Spooner >> >> --------- Original Message --------- >> *From*: Carlos Castro >> *Date*: Mon Mar 05 12:28:15 GMT+00:00 2018 >> *Subject*: Re: [stunnel-users] Connect using TLS with public Web Server >> Hello >> >> Thanks @Peter >> >> >> Yes , my application not support TLS and I need the application connect >> using TLS , for this i using stunnel (i hope) >> >> When I make curl -v http://127.0.0.1:19021 : >> >> curl -v http://127.0.0.1:19201 >> * Rebuilt URL to: http://127.0.0.1:19201/ >> * Trying 127.0.0.1... >> * Connected to 127.0.0.1 (127.0.0.1) port 19201 (#0) >> > GET / HTTP/1.1 >> > Host: 127.0.0.1:19201 >> > User-Agent: curl/7.47.0 >> > Accept: */* >> > >> * HTTP 1.0, assume close after body >> < HTTP/1.0 400 Bad Request >> < Server: AkamaiGHost >> < Mime-Version: 1.0 >> < Content-Type: text/html >> < Content-Length: 208 >> < Expires: Mon, 05 Mar 2018 12:25:53 GMT >> < Date: Mon, 05 Mar 2018 12:25:53 GMT >> < Connection: close >> >> The web ctm.omgeo.net only works in mode HTTPS , . >> >> Thanks Peter >> >> >> On 05/03/18 13:22, Peter Pentchev wrote: >> > On Mon, Mar 05, 2018 at 12:32:41PM +0100, Carlos Castro wrote: >> >> Hello , >> >> >> >> Thanks @Peter >> >> >> >> I'm trying to configure to connect with my PC to this Public server >> >> https://ctm.omgeo.net using TLS1.2 but i don't can. >> >> >> >> I'm need setup stunnel for old application doesn't support TLS , >> and this >> >> application need connect with this public server to send data. >> >> >> >> >> >> I'm using the Peter config , but nothing . I try this config : >> >> >> >> [omgeo] >> >> client = yes >> >> accept = 127.0.0.1:19201 >> >> connect = ctm.omgeo.net:443 >> >> verify = 2 >> >> CApath = /etc/ssl/certs/ >> >> >> >> >> >> I'm using Curl to try connect , I'm recive this error >> >> >> >> /etc/ssl/certs# curl -v https://127.0.0.1:19201 >> > Maybe I'm reading this wrong, but if your client application does not >> > support TLS, then it won't speak HTTPS, it would speak plain HTTP. >> > That's what the configuration you're using does - it tells stunnel to >> > run in client mode, i.e. something will connect to stunnel using >> > an unencrypted connection and stunnel will connect to a TLS server >> > (in this case an HTTPS server). >> > >> > So what happens when you try almost the same query, but with the "http" >> > scheme instead of the "https" one? >> > >> > curl -v http://127.0.0.1:19201 >> > >> > G'luck, >> > Peter >> > >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

Client cert auth ?
by Brian Ipsen 27 Feb '18

27 Feb '18

Hi I am trying to see if I can get stunnel to authenticate using a client certificate towards a F5 setup - but I am having trouble getting it to work. Certificates are issued froma Microsoft PKI - where the F5 checks validity via an OCSP responder. In my stunnel config file, I have: [F5Cert] client=yes accept = 127.0.0.1:1598 connect = F5test.xxx.dk:443 delay = yes CAFile = GlobalSign-cert-Chain.pem Cert = BaaSClientCertificatePlain.pem key = BaaSClientCertificatePlain.key verify = 2 In the CAFile, I have the root CA and issuing certificate from GlobalSign - which have created the SSL certificate being used on the F5 (server side). Cert and Key points to the certificate and private key from my internal Microsoft based PKI.. But should the certificate chain from my internal PKI be listed somewhere as well ? Is this the way to do it - and is stunnel capable of handling client certificate validation ? Regards Brian

3 2

Question on reconnection after TCP RST
by Chawla, Vikas 27 Feb '18

27 Feb '18

Hi, We ran into an issue where stunnel after TCP RST from server, retries to re-establish connection after 5 seconds with exponential back off. Wanted to check if there is configuration parameter for us to modify the reconnection time to be a lower number. Thanks, Vikas

1 0

[PATCH] Address already in use (98) when binding to localhost
by Christian Kujau 06 Feb '18

06 Feb '18

Hi, I reported the following to the Fedora bugtracker[0], but only then realized that this happens with the upstream version too. In short: since stunnel 5.44 I am no longer able to have stunnel bind to localhost, when "localhost" is literally mentioned in the configuration file: $ cat stunnel.test [test] client = yes protocol = smtp accept = localhost:12345 connect = localhost:2025 $ stunnel-5.44 stunnel.test [...] [ ] Binding service [test] [ ] Listening file descriptor created (FD=6) [ ] Option SO_REUSEADDR set on accept socket [ ] Service [test] (FD=6) bound to 127.0.0.1:12345 [ ] Listening file descriptor created (FD=7) [ ] Option SO_REUSEADDR set on accept socket [!] bind: Address already in use (98) [!] Error binding service [test] to 127.0.0.1:12345 [ ] Unbinding service [test] [ ] Service [test] closed (FD=6) [ ] Service [test] closed When using "127.0.0.1" or "::1" instead of "localhost" in the configuration file, stunnel-5.44 works. However, then one can only connect to either the IPv4 _or_ the IPv6 address, depending on what's configured. With stunnel-5.43 and "accept=localhost:12345" both IPv4 and IPv6 was available. I suspect that this is related to the following change log entry for 5.44: > Default accept address restored to INADDR_ANY. I have attached a patch to revert that (?) change and also included a test script that fails on my system when the patch is not applied. I see "Version 5.45" already mention in the changelog on the website, but now download yet? Thanks, Christian. [0] https://bugzilla.redhat.com/show_bug.cgi?id=1542361 -- BOFH excuse #424: operation failed because: there is no message for this error (#1014)

1 0

Re: [stunnel-users] stunnel.log not generated in window server 2012 R2
by Zhang, Joanne 02 Feb '18

02 Feb '18

Hello. I installed a Stunnel-5.44-win32 on a Window Server 2012 R2 box. I am using it in client mode only as it is required by the Vendor. It works fine, I can connect to my Vendor's server via Stunnel . However, I don't see any stunnel.log generated when it is run as a service and I searched the entire directory on the server. I know the output path is working . As when I run Stunnel GUI Start, the log is created in the output folder specified in the conf file. Have anyone seen this problem before please? Here is my setting for stunnel.conf that relates to the debug log. debug = 7 output = C:\Program Files (x86)\stunnel\stunnel.log Thanks very much for your help ahead. Joanne _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

1 0

Connect using TLS with public Web Server
by Carlos Castro 02 Feb '18

02 Feb '18

Hi All, I have older application and now I need connect with external server HTTPS using TLS . My application doesn't support with TLS and I think use Stunnel to connect with this Server HTTPS. Wich is the mode I should choose to configurate this connection ? Proxy mode? or like examples created over gmail in default configuration File? The external server , is public server for all people ? should be necesary special certs ? or whit predeterminate certs inside windows (for use IE, chroome , firefox etc..etcc) is necesary ? Many thanks Regards

1 0

Re (2): Relationship to Netfilter.
by peter＠easthope.ca 26 Jan '18

26 Jan '18

From: Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> Date: Thu, 25 Jan 2018 18:23:58 +0100 > If it was in this diagram, it would be a 'local process' on the > application layer. So, two softwares, netfilter and stunnel, in a computer system. stunnel in the OSI application layer and netfilter in the protocol, network and link layers. That's a relationship. > Obviously nowhere. (Stunnel is not related to the Linux Netfilter.). Depends on your personal definition of a relationship. Thanks for explaining, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca https://en.wikibooks.org/wiki/Medical_Suction_Machines https://en.wikibooks.org/wiki/Oberon

1 0

Relationship to Netfilter.
by Peter Easthope 25 Jan '18

25 Jan '18

Where is stunnel in this diagram? https://en.wikipedia.org/wiki/Netfilter#/media/File:Netfilter-packet-flow.s… Thanks, ... Peter E. -- Telephone 1 360 639 0202 or +13606390202. Bcc: peter at easthope.ca http://easthope.ca/Shop.html

2 1

stunnel + mjpeg_streamer issue
by Akos Schneemaier 23 Jan '18

23 Jan '18

HI stunnel users, i hope somebody have an idea what is going wrong in my config: I am runnung debian on an arm box with kernel 4.4.89 and stunnel 5.44. I use mjpeg_streamer to stream webcam images. mjpeg streamer is attaches to port 8080 for http, but for external access connection goes through stunnel on port 2970. The problem is when i connect to mjpeg streamer to get a snapshot via stunnel i receive a broken image 8 time out of 10: https:/ipaddress:2970/?action=snapshot. When i do this via http:/ipaddress:8080/?action=snapshot everything works fine. it seems when image size is below ~11k then it works fine with stunnel, when the size goes above then the chance to receive a broken image increases with stunnel, normal image size is around 22k. Futuremore when i connect to the mjpeg stream of mjpeg stream then everything works fine even over stunnel https:/ipaddress:2970/?action=stream Here is the service config file: pid=/tmp/cam.pid ;foreground=yes ;debug=7 [cam0] cert = /etc/letsencrypt/live/..../fullchain.pem key = /etc/letsencrypt/live/..../privkey.pem sslVersion = all client = no accept = 2970 connect = 8080 [cam1] cert = /etc/letsencrypt/live/..../fullchain.pem key = /etc/letsencrypt/live/..../privkey.pem sslVersion = all client = no accept = 2971 connect = 8081 [cam2] cert = /etc/letsencrypt/live/..../fullchain.pem key = /etc/letsencrypt/live/..../privkey.pem sslVersion = all client = no accept = 2972 connect = 8082 Any ideas welcome! Thanks

1 0

Update on my stunnel problems
by Phil Smith III 21 Jan '18

21 Jan '18

As I'm sure all of you were thinking, the localhost vs. 127.0.0.1 shouldn't have made a difference, and probably didn't: that was across two different machines, as I'd had to switch horses mid-stream (always a bad idea, I realize). Mind you, both machines are the same hardware, same OS, etc. And the 127.0.0.1 version started working on the first machine after a while; I suspect I was seeing Cox's authentication server problems muddying the waters-it has that problem from time to time. BTW, I did check, and I have localhost entries for both IPv4 and IPv6 in my hosts file. This morning when I finally got access to my wife's machine, I installed stunnel with the same config that was working on machine#2 and changed Eudora to point to localhost. I could see Eudora happily connecting to stunnel, but then nothing happened. After the usual checking everything, I decided to try port 1110 instead of 110 for one of the POP accounts. That necessitated closing and reopening Eudora so I could hack the .ini file. After doing so, it worked. Then I changed the other accounts to localhost and they kept working. "Odd", sez I: "I haven't changed them to port 1110!" Still not sure how they were working, since localhost is definitely not serving port 110 that I know of. As my wife was getting antsy about getting her machine back, I didn't investigate further (wish I'd had time): I just changed the stunnel port back to 110, put the one account back to 110, restarted Eudora and refreshed the stunnel config.and all is now working fine. So something was stuck in an old setting, but that doesn't explain either why it was connecting to stunnel but not getting past it, or how it was going to localhost 110 and still working. In any case, it's functioning beautifully (in time for the Wednesday shutdown of non-encrypted POP), and I share this in case it helps someone else down the line! I don't care about SMTP, as I don't use Cox's SMTP anyway. Thanks again for all the helpful suggestions. There wasn't any single "Aha!" moment, but they all helped lead me to the happy place. .phsiii

1 0

Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Now that's interesting. Note that the failed nslookup looked v6-ish. I wonder if Cox is doing some v6 stuff that I don't know about! -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Vincent Deschenes Sent: Thursday, January 18, 2018 1:17 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 >From my experience, this relates to IPv4 vs IPv6. 127.0.0.1 is explicitly V4. While localhost can be V6. Vincent Deschenes -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca Sent: Thursday, 18 January 2018 1:08 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Huh. It does have it. But why didn’t 127.0.0.1 work, I wonder? From: stunnel-users [mailto:[email protected]] On Behalf Of Carter Browne Sent: Thursday, January 18, 2018 2:11 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 You should check your hosts file in \windows\system32\drivers\etc. Make sure it has an entry: 127.0.0.1 localhost The text claims it doesn't need it, but it doesn't hurt to have it, and I'm not sure I totally believe the text. Carter On 1/18/2018 1:55 PM, Phil Smith III wrote: Oh, the logging works--it just doesn't like it there in the file. I have it earlier and it's fine. -------------- C:\Users\phsiii>ls -ld \temp\stunnel-log.txt -rw-r--r-- 1 phsiii None 266835 Jan 18 08:52 \temp\stunnel-log.txt # That's Cygwin ls -- remember, this is Windows 7 C:\Users\phsiii>nslookup localhost Server: UnKnown Address: 2001:4860:4860::8888 *** UnKnown can't find localhost: No response from server # Windows nslookup (per "which nslookup") -------------- Odd. -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca <mailto:[email protected]> Sent: Thursday, January 18, 2018 1:13 PM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <mailto:[email protected]> <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P.

1 0

Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Oh, the logging works--it just doesn't like it there in the file. I have it earlier and it's fine. -------------- C:\Users\phsiii>ls -ld \temp\stunnel-log.txt -rw-r--r-- 1 phsiii None 266835 Jan 18 08:52 \temp\stunnel-log.txt # That's Cygwin ls -- remember, this is Windows 7 C:\Users\phsiii>nslookup localhost Server: UnKnown Address: 2001:4860:4860::8888 *** UnKnown can't find localhost: No response from server # Windows nslookup (per "which nslookup") -------------- Odd. -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 1:13 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

2 1

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Well, I'm stunned (pun intended): while the output= wasn't accepted (it said it wasn't valid there), changing 127.0.0.1 to localhost seems to have fixed it! -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 12:20 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > Here's my stunnel.conf, with blank lines and comments removed: > client = yes > output = C:\temp\stunnel-log.txt > taskbar = yes > debug = 7 > [POP3 Incoming] > protocol = pop3 > accept = 127.0.0.1:1110 > connect = pop.cox.net:995 > protocol = smtp > accept = 127.0.0.1:25 > connect = smtp.cox.net:465 Here it worked for POP3 immediately. Not needed for SMTP. https://en.wikibooks.org/wiki/Oberon/Oberon#Receiving_and_Sending_Email Before using 1110, check. netstat -tulpn | grep 1110 Correct id, passwd and port are in the MUA? Separate configurations for POP3 and SMTP. Troubleshoot one at a time. "protocol" shouldn't be necessary. Try this. [POP3] client = yes output = C:\temp\stunnel-log.txt accept = localhost:1110 connect = pop.cox.net:995 Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: Andrew Culver <aculver(a)uwo.ca> Date: Thu, 18 Jan 2018 11:39:20 -0500 > Some protocols use a protocol-specific command to begin TLS negotiation > (STARTTLS for SMTP and POP3), so stunnel needs to know how (and be told) to > use that command. Phil, General troubleshooting rule, always try for a most elementary, ordinary case before resorting to a special case. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

P.s. From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > protocol = pop3 The stunnel(8) manual has this. "protocol = PROTO application protocol to negotiate TLS This option enables initial, protocol-specific negotiation of the TLS encryption." Is there any need for protocol-specific negotiation? Why? Stunnel provides a tunnel and POP3 works inside. That's all. Try the configuration without the protocol option. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

2 1

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Right, I had done that: >Yes, I have protocol = pop3 and protocol = smtp; I’ve tried >commenting them out individually, no change that I can see. The doc really isn't clear about why you'd want/need these, by the way. But your earlier suggestion (localhost instead of 127.0.0.1) seems to have worked. Still a mystery. I'll be tinkering on machine2 tonight, and then will try on the wife's machine! -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 9:51 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7 P.s. From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > protocol = pop3 The stunnel(8) manual has this. "protocol = PROTO application protocol to negotiate TLS This option enables initial, protocol-specific negotiation of the TLS encryption." Is there any need for protocol-specific negotiation? Why? Stunnel provides a tunnel and POP3 works inside. That's all. Try the configuration without the protocol option. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > Here's my stunnel.conf, with blank lines and comments removed: > client = yes > output = C:\temp\stunnel-log.txt > taskbar = yes > debug = 7 > [POP3 Incoming] > protocol = pop3 > accept = 127.0.0.1:1110 > connect = pop.cox.net:995 > protocol = smtp > accept = 127.0.0.1:25 > connect = smtp.cox.net:465 Here it worked for POP3 immediately. Not needed for SMTP. https://en.wikibooks.org/wiki/Oberon/Oberon#Receiving_and_Sending_Email Before using 1110, check. netstat -tulpn | grep 1110 Correct id, passwd and port are in the MUA? Separate configurations for POP3 and SMTP. Troubleshoot one at a time. "protocol" shouldn't be necessary. Try this. [POP3] client = yes output = C:\temp\stunnel-log.txt accept = localhost:1110 connect = pop.cox.net:995 Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Cox has been warning us that as of next week, we need to use encrypted POP and SMTP. I have two reasons to use stunnel now: 1) I use the K9 Bayesian email proxy for spam filtering, and it doesn't do TLS 2) My wife still uses Eudora and doesn't want to switch, and while Eudora allegedly supports TLS, it's not trivial to make it work (and Cox certainly won't help) Thus stunnel looks like an ideal solution. But after tinkering for a few hours on two machines, I'm stumped. While I can type an SMTP or POP transaction in my sleep, I'm not so good at typing a TLS handshake, so I'm using Outlook 2013 as my test platform (and that's what I'll be using myself later anyway). I setup a new account, point to the right ports on 127.0.0.1, and the test times out, with: Log onto incoming mail server (POP3): The operation timed out waiting for a response from the receiving (POP) server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP). Send test e-mail message: The operation timed out waiting for a response from the sending (SMTP) server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP). Here's my stunnel.conf, with blank lines and comments removed: client = yes output = C:\temp\stunnel-log.txt taskbar = yes debug = 7 [POP3 Incoming] protocol = pop3 accept = 127.0.0.1:1110 connect = pop.cox.net:995 protocol = smtp accept = 127.0.0.1:25 connect = smtp.cox.net:465 Yes, that's port 1110, since K9 is using 110. Shouldn't matter, right? (As long as I point the client at 1110, obviously!) Yes, I have protocol = pop3 and protocol = smtp; I've tried commenting them out individually, no change that I can see. Yes, I'm running stunnel explicitly, not as a service-I found threads suggesting that it just doesn't work as a service on Windows 7 for some reason (and in fact beat my head against that wall for a while first). And here's the stunnel log: 2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1 2018.01.17 21:29:24 LOG7[main]: No limit detected for the number of clients 2018.01.17 21:29:24 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.01.17 21:29:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.01.17 21:29:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.01.17 21:29:24 LOG7[main]: errno: (*_errno()) 2018.01.17 21:29:24 LOG7[ui]: GUI message loop initialized 2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1 2018.01.17 21:29:24 LOG5[main]: Reading configuration from file stunnel.conf 2018.01.17 21:29:24 LOG5[main]: UTF-8 byte order mark not detected 2018.01.17 21:29:24 LOG5[main]: FIPS mode disabled 2018.01.17 21:29:24 LOG7[main]: Compression disabled 2018.01.17 21:29:24 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2018.01.17 21:29:24 LOG7[main]: Wrote 0 new random bytes to C:/.rnd 2018.01.17 21:29:24 LOG7[main]: PRNG seeded successfully 2018.01.17 21:29:24 LOG6[main]: Initializing service [POP3 Incoming] 2018.01.17 21:29:24 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.01.17 21:29:24 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2018.01.17 21:29:24 LOG7[main]: No certificate or private key specified 2018.01.17 21:29:24 LOG4[main]: Service [POP3 Incoming] needs authentication to prevent MITM attacks 2018.01.17 21:29:24 LOG5[main]: Configuration successful 2018.01.17 21:29:24 LOG7[main]: Binding service [POP3 Incoming] 2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=460) 2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=460) bound to 127.0.0.1:1110 2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=464) 2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=464) bound to 127.0.0.1:25 2018.01.17 21:29:24 LOG7[cron]: Cron thread initialized 2018.01.17 21:29:50 LOG7[main]: Found 1 ready file descriptor(s) 2018.01.17 21:29:50 LOG7[main]: FD=424 ifds=r-x ofds=--- 2018.01.17 21:29:50 LOG7[main]: FD=460 ifds=r-x ofds=r-- 2018.01.17 21:29:50 LOG7[main]: Service [POP3 Incoming] accepted (FD=488) from 127.0.0.1:54855 2018.01.17 21:29:50 LOG7[main]: Creating a new thread 2018.01.17 21:29:50 LOG7[main]: New thread created 2018.01.17 21:29:50 LOG7[0]: Service [POP3 Incoming] started 2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on local socket 2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] accepted connection from 127.0.0.1:54855 2018.01.17 21:29:50 LOG6[0]: failover: round-robin, starting at entry #1 2018.01.17 21:29:50 LOG6[0]: s_connect: connecting 68.6.19.8:465 2018.01.17 21:29:50 LOG7[0]: s_connect: s_poll_wait 68.6.19.8:465: waiting 10 seconds 2018.01.17 21:29:50 LOG5[0]: s_connect: connected 68.6.19.8:465 2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] connected remote server from 192.168.1.17:54856 2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.01.17 21:29:50 LOG7[0]: Remote descriptor (FD=508) initialized 2018.01.17 21:30:24 LOG6[cron]: Executing cron jobs 2018.01.17 21:30:24 LOG6[cron]: Cron jobs completed in 0 seconds 2018.01.17 21:30:24 LOG7[cron]: Waiting 86400 seconds 2018.01.17 21:31:05 LOG7[main]: Found 1 ready file descriptor(s) 2018.01.17 21:31:05 LOG7[main]: FD=424 ifds=r-x ofds=--- 2018.01.17 21:31:05 LOG7[main]: FD=460 ifds=r-x ofds=--- 2018.01.17 21:31:05 LOG7[main]: Service [POP3 Incoming] accepted (FD=528) from 127.0.0.1:54891 2018.01.17 21:31:05 LOG7[main]: Creating a new thread 2018.01.17 21:31:05 LOG7[main]: New thread created 2018.01.17 21:31:05 LOG7[1]: Service [POP3 Incoming] started 2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on local socket 2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] accepted connection from 127.0.0.1:54891 2018.01.17 21:31:05 LOG6[1]: failover: round-robin, starting at entry #0 2018.01.17 21:31:05 LOG6[1]: s_connect: connecting 146.20.147.245:995 2018.01.17 21:31:05 LOG7[1]: s_connect: s_poll_wait 146.20.147.245:995: waiting 10 seconds 2018.01.17 21:31:05 LOG5[1]: s_connect: connected 146.20.147.245:995 2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] connected remote server from 192.168.1.17:54892 2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on remote socket 2018.01.17 21:31:05 LOG7[1]: Remote descriptor (FD=336) initialized 2018.01.17 21:34:05 LOG3[1]: Unexpected socket close (s_read) 2018.01.17 21:34:05 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.01.17 21:34:05 LOG7[1]: Remote descriptor (FD=336) closed 2018.01.17 21:34:05 LOG7[1]: Local descriptor (FD=528) closed 2018.01.17 21:34:05 LOG7[1]: Service [POP3 Incoming] finished (1 left) 2018.01.17 21:34:05 LOG7[1]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2018.01.17 21:34:05 LOG7[1]: str_stats: 32 byte(s) at ..\src\network.c:680 2018.01.17 21:34:50 LOG6[0]: s_read: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2018.01.17 21:34:50 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.01.17 21:34:50 LOG7[0]: Remote descriptor (FD=508) closed 2018.01.17 21:34:50 LOG7[0]: Local descriptor (FD=488) closed 2018.01.17 21:34:50 LOG7[0]: Service [POP3 Incoming] finished (0 left) 2018.01.17 21:34:50 LOG7[0]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2018.01.17 21:34:50 LOG7[0]: str_stats: 32 byte(s) at ..\src\network.c:680 It looks like it connects, but then just sits there?! I see these: No certificate or private key specified Service [POP3 Incoming] needs authentication to prevent MITM attacks but that's during startup. Or are those significant? I feel like I'm one setting away from having this all work.! Thanks in advance for any suggestions. -- ...phsiii

1 0

TLS socket closed (SSL_write) with unsent byte(s)
by Cotswold Group - Stephen Murray 16 Jan '18

16 Jan '18

Hi All, We use stunnel to send emails from our scanners to our hosted mail provider (that now only accept TLS connections). This has been working well for a number of years, but just recently the scanners (all Lexmark) have sporadically been giving errors of 'connection failed'. If I check the stunnel logs, the failed send has an extra line in of TLS socket closed (SSL_write) with 418 unsent byte(s) Below are 2 examples, 59 was sent successfully, 60 was not. 2018.01.16 14:37:24 LOG5[59]: Service [fasthosts-smtp] accepted connection from 10.226.174.95:11473 2018.01.16 14:37:24 LOG5[59]: s_connect: connected 213.171.216.50:465 2018.01.16 14:37:24 LOG5[59]: Service [fasthosts-smtp] connected remote server from 10.226.150.9:52577 2018.01.16 14:37:24 LOG5[59]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.01.16 14:37:24 LOG5[59]: s_connect: connected 23.55.155.27:80 2018.01.16 14:37:24 LOG5[59]: OCSP: Certificate accepted 2018.01.16 14:37:24 LOG5[59]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.01.16 14:37:25 LOG5[59]: s_connect: connected 23.55.155.27:80 2018.01.16 14:37:25 LOG5[59]: OCSP: Certificate accepted 2018.01.16 14:37:25 LOG5[59]: Certificate accepted at depth=0: C=GB, ST=Gloucestershire, L=Gloucester, O=Fasthosts Internet Limited, OU=NOC, CN=smtp.livemail.co.uk 2018.01.16 14:37:29 LOG5[59]: Connection closed: 167106 byte(s) sent to TLS, 376 byte(s) sent to socket 2018.01.16 14:38:19 LOG5[60]: Service [fasthosts-smtp] accepted connection from 10.226.174.95:11483 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 213.171.216.50:465 2018.01.16 14:38:19 LOG5[60]: Service [fasthosts-smtp] connected remote server from 10.226.150.9:52620 2018.01.16 14:38:19 LOG5[60]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 23.55.155.27:80 2018.01.16 14:38:19 LOG5[60]: OCSP: Certificate accepted 2018.01.16 14:38:19 LOG5[60]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 23.55.155.27:80 2018.01.16 14:38:19 LOG5[60]: OCSP: Certificate accepted 2018.01.16 14:38:19 LOG5[60]: Certificate accepted at depth=0: C=GB, ST=Gloucestershire, L=Gloucester, O=Fasthosts Internet Limited, OU=NOC, CN=smtp.livemail.co.uk 2018.01.16 14:38:24 LOG3[60]: TLS socket closed (SSL_write) with 418 unsent byte(s) 2018.01.16 14:38:24 LOG5[60]: Connection reset: 964 byte(s) sent to TLS, 392 byte(s) sent to socket Has anyone come across this before? Our mail provider has send limits in place of 50 every 10 minutes, but I am confident we are not reaching those amounts. Any help appreciated. Regards, Stephen

1 0

Connecting a HTTP browser to a HTTPS server.
by peter＠easthope.ca 12 Jan '18

12 Jan '18

Hello, I'm interested to configure stunnel to allow my local non-TLS Web browser to receive pages from a remote server providing only HTTPS. This section of https://www.stunnel.org/static/stunnel.html appears relevant. transparent = none | source | destination | both (Unix only) enable transparent proxy support on selected platforms ... destination The original destination is used instead of the connect option. A service section for transparent destination may look like this: [transparent] client = yes accept = <stunnel_port> transparent = destination This configuration requires iptables setup to work, possibly in /etc/rc.local or equivalent file. ... For a connect target installed on a remote host: /sbin/iptables -I INPUT -i eth0 -p tcp --dport <stunnel_port> -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport <redirected_port> \ -i eth0 -j DNAT --to-destination <local_ip>:<stunnel_port> The transparent destination option is currently only supported on Linux. ==================================== Substitution of parameters for my context gives these configurations.. [transparent] client = yes accept = 127.0.0.1:954 transparent = destination /sbin/iptables -I INPUT -i eth0 -p tcp --dport 954 -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport 443 \ -i eth0 -j DNAT --to-destination 127.0.0.1:954 The non-TLS browser would address http://www.stunnel.org:954/ and receive the page from https://www.stunnel.org:443/. According to Wikipedia, 954 is not assigned. The browser would continue to receive the page http://www.website.org/ without involvement of stunnel or iptables. Plausible? Thanks, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Versions
by Editor 04 Jan '18

04 Jan '18

Hi: On the various repo sites for Redhat-CentOS-Oracle Linux, etc., they are only providing version 4.29 of stunnel. Is there anyway to push them an updated version? I normally use these repo providers: Oracle Linux repo EPEL 6 Repo rpmforce Repo In the end, I tried to compile the latest version on Linux but I get this somewhat cryptic message about a TLS installation directory. I never had this issue before but to be honest, I normally used Solaris (8-9-10) in the past. "Could not find your TLS library installation dir Use --with-ssl option to fix this problem" I tried pointing it at /usr/bin/openssl and also at /usr/lib64/openssl without any luck. Sorry for bothering the list if this has been answered in the past. Thanks. Kevin

2 1

Re: [stunnel-users] outgoing mail solution?
by Parker Brooks 02 Jan '18

02 Jan '18

Douglas, it worked! Thank you! I had not turned on gmail's allow less secure apps, so my first try netted this 2018.01.02 09:00:27 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.01.02 09:00:27 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.01.02 09:00:27 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.01.02 09:00:27 LOG5[main]: Reading configuration from file stunnel.conf 2018.01.02 09:00:27 LOG5[main]: UTF-8 byte order mark not detected 2018.01.02 09:00:27 LOG5[main]: FIPS mode disabled 2018.01.02 09:00:27 LOG5[main]: Configuration successful 2018.01.02 09:03:09 LOG5[0]: Service [gmail-smtp] accepted connection from 127.0.0.1:1046 2018.01.02 09:03:09 LOG5[0]: s_connect: connected 173.194.78.108:587 2018.01.02 09:03:09 LOG5[0]: Service [gmail-smtp] connected remote server from 192.168.1.103:1047 2018.01.02 09:03:09 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/gsr2" 2018.01.02 09:03:10 LOG5[0]: s_connect: connected 172.217.12.78:80 2018.01.02 09:03:10 LOG5[0]: OCSP: Certificate accepted 2018.01.02 09:03:10 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/GTSGIAG3" 2018.01.02 09:03:10 LOG5[0]: s_connect: connected 172.217.12.78:80 2018.01.02 09:03:10 LOG5[0]: OCSP: Certificate accepted 2018.01.02 09:03:10 LOG5[0]: Certificate accepted at depth=0: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com 2018.01.02 09:03:10 LOG3[0]: PLAIN Authentication Failed 2018.01.02 09:03:10 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket my monitoring s/w showed To = xxxxxx(a)gmail.com Connecting to mail server... 127.0.0.1 E-mail Failed. Error: 25058 / [10057] Socket is not connected 1/2/2018 9:03:10 AM there was a security alert from gmail with the instructions to enabling the less secure apps. turned it on and tried again... 2018.01.02 09:17:45 LOG5[1]: Service [gmail-smtp] accepted connection from 127.0.0.1:1050 2018.01.02 09:17:45 LOG5[1]: s_connect: connected 173.194.78.109:587 2018.01.02 09:17:45 LOG5[1]: Service [gmail-smtp] connected remote server from 192.168.1.103:1051 2018.01.02 09:17:47 LOG5[1]: Connection closed: 306 byte(s) sent to TLS, 508 byte(s) sent to socket again, thank you! On Tue, Jan 2, 2018 at 7:35 AM, Harris, Douglas (SSC/SPC) < douglas.harris(a)canada.ca> wrote: > Try this… > > > > [gmail-smtp] > > client = yes > > accept = 127.0.0.1:25 > > connect = smtp.gmail.com:587 <http://smtp.gmail.com:465> > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = smtp.gmail.com > > OCSPaia = yes > > protocol = smtp > > protocolUsername = [your gmail userid] > > protocolPassword = [your gmail password] > > > > > > > > > > *From:* stunnel-users [mailto:[email protected]] *On > Behalf Of *Parker Brooks > *Sent:* January 2, 2018 12:34 AM > *To:* stunnel-users(a)stunnel.org > *Subject:* [stunnel-users] outgoing mail solution? > > > > hello and happy new year! > > > > it seemed this question has been asked before in various ways, however > with the frequent version updates i'm still unclear if stunnel is meant as > a fix to my issue. > > > > i have a outdated home monitoring program running on a winxp box. when an > error occurs it sends an email. it's setup screen (besides the destination > email field) only have a) smtp server, b) undeliverable email address and > c) port # fields to configure. > > > > my workaround for several years (when port 25 became blocked or needed > authetication) has been to use LOApost but they've recently ceased. that > program, also running in the background, and if i understand correctly > acted as a local host. i configured the monitoring program's smtp for > 127.0.0.1 and LOApost did the rest > > > > other searches suggest cloud solutions like sendgrid and authsmtp. but > those sites need a login/ password with the outgoing message. perhaps this > is where i'm getting confused between the differences of SSL and smtp > authentication? > > > > i have gotten gsuite's restricted smtp server to work, but i hoped stunnel > would provide a better solution (ability to send besides gmail/ gsuite > addresses). > > > > below are my conf and log files of my attempt. again, i can't tell if i've > missed a step, or if this is not intended to work. > > > > PS: i've also tried to understand if this feature is on the todo list? > > tia, > > parker > > > > stunnel.conf > > > > [gmail-pop3] > > client = yes > > accept = 127.0.0.1:110 > > connect = pop.gmail.com:995 > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = pop.gmail.com > > OCSPaia = yes > > > > [gmail-imap] > > client = yes > > accept = 127.0.0.1:143 > > connect = imap.gmail.com:993 > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = imap.gmail.com > > OCSPaia = yes > > > > [gmail-smtp] > > client = yes > > accept = 127.0.0.1:25 > > connect = smtp.gmail.com:465 > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = smtp.gmail.com > > OCSPaia = yes > > > > log file > > > > 2017.12.31 16:22:45 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform > > 2017.12.31 16:22:45 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips > 2 Nov 2017 > > 2017.12.31 16:22:45 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 > TLS:ENGINE,FIPS,OCSP,PSK,SNI > > 2017.12.31 16:22:45 LOG5[main]: Reading configuration from file > stunnel.conf > > 2017.12.31 16:22:45 LOG5[main]: UTF-8 byte order mark not detected > > 2017.12.31 16:22:45 LOG5[main]: FIPS mode disabled > > 2017.12.31 16:22:45 LOG5[main]: Configuration successful > > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] accepted connection from > 127.0.0.1:1141 > > 2017.12.31 16:25:03 LOG5[0]: s_connect: connected 173.194.67.108:465 > > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] connected remote server > from 192.168.1.103:1142 > > 2017.12.31 16:25:03 LOG5[0]: OCSP: Connecting the AIA responder " > http://ocsp.pki.goog/gsr2" > > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > > 2017.12.31 16:25:04 LOG5[0]: OCSP: Connecting the AIA responder " > http://ocsp.pki.goog/GTSGIAG3" > > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > > 2017.12.31 16:25:04 LOG5[0]: Certificate accepted at depth=0: C=US, > ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com > > 2017.12.31 16:25:04 LOG5[0]: Connection closed: 55 byte(s) sent to TLS, > 514 byte(s) sent to socket > > > > > > and this is what shows up on my monitoring program log file... > > > > To = xxxxxx(a)gmail.com > > Connecting to mail server... 127.0.0.1 > > Sending message... > > E-mail Failed. Error: 20162 / 530 5.5.1 https://support.google.com/ > mail/?p=WantAuthError 51sm9558225oti.10 - gsmtp > > 12/31/2017 4:25:04 PM >

1 0

Re: [stunnel-users] outgoing mail solution?
by Josealf.rm 02 Jan '18

02 Jan '18

Cool! I was not aware that stunnel fully supported SMTP authentication. Thanks Parker! Saludos Jose Alfredo Diaz > On Jan 2, 2018, at 8:35 AM, Harris, Douglas (SSC/SPC) <douglas.harris(a)canada.ca> wrote: > > Try this… > > [gmail-smtp] > client = yes > accept = 127.0.0.1:25 > connect = smtp.gmail.com:587 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = smtp.gmail.com > OCSPaia = yes > protocol = smtp > protocolUsername = [your gmail userid] > protocolPassword = [your gmail password] > > > > > From: stunnel-users [mailto:[email protected]] On Behalf Of Parker Brooks > Sent: January 2, 2018 12:34 AM > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] outgoing mail solution? > > hello and happy new year! > > it seemed this question has been asked before in various ways, however with the frequent version updates i'm still unclear if stunnel is meant as a fix to my issue. > > i have a outdated home monitoring program running on a winxp box. when an error occurs it sends an email. it's setup screen (besides the destination email field) only have a) smtp server, b) undeliverable email address and c) port # fields to configure. > > my workaround for several years (when port 25 became blocked or needed authetication) has been to use LOApost but they've recently ceased. that program, also running in the background, and if i understand correctly acted as a local host. i configured the monitoring program's smtp for 127.0.0.1 and LOApost did the rest > > other searches suggest cloud solutions like sendgrid and authsmtp. but those sites need a login/ password with the outgoing message. perhaps this is where i'm getting confused between the differences of SSL and smtp authentication? > > i have gotten gsuite's restricted smtp server to work, but i hoped stunnel would provide a better solution (ability to send besides gmail/ gsuite addresses). > > below are my conf and log files of my attempt. again, i can't tell if i've missed a step, or if this is not intended to work. > > PS: i've also tried to understand if this feature is on the todo list? > tia, > parker > > stunnel.conf > > [gmail-pop3] > client = yes > accept = 127.0.0.1:110 > connect = pop.gmail.com:995 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = pop.gmail.com > OCSPaia = yes > > [gmail-imap] > client = yes > accept = 127.0.0.1:143 > connect = imap.gmail.com:993 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = imap.gmail.com > OCSPaia = yes > > [gmail-smtp] > client = yes > accept = 127.0.0.1:25 > connect = smtp.gmail.com:465 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = smtp.gmail.com > OCSPaia = yes > > log file > > 2017.12.31 16:22:45 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform > 2017.12.31 16:22:45 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 > 2017.12.31 16:22:45 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI > 2017.12.31 16:22:45 LOG5[main]: Reading configuration from file stunnel.conf > 2017.12.31 16:22:45 LOG5[main]: UTF-8 byte order mark not detected > 2017.12.31 16:22:45 LOG5[main]: FIPS mode disabled > 2017.12.31 16:22:45 LOG5[main]: Configuration successful > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] accepted connection from 127.0.0.1:1141 > 2017.12.31 16:25:03 LOG5[0]: s_connect: connected 173.194.67.108:465 > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] connected remote server from 192.168.1.103:1142 > 2017.12.31 16:25:03 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gsr2" > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > 2017.12.31 16:25:04 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/GTSGIAG3" > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > 2017.12.31 16:25:04 LOG5[0]: Certificate accepted at depth=0: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com > 2017.12.31 16:25:04 LOG5[0]: Connection closed: 55 byte(s) sent to TLS, 514 byte(s) sent to socket > > > and this is what shows up on my monitoring program log file... > > To = xxxxxx(a)gmail.com > Connecting to mail server... 127.0.0.1 > Sending message... > E-mail Failed. Error: 20162 / 530 5.5.1 https://support.google.com/mail/?p=WantAuthError 51sm9558225oti.10 - gsmtp > 12/31/2017 4:25:04 PM > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

outgoing mail solution?
by Parker Brooks 02 Jan '18

02 Jan '18

hello and happy new year! it seemed this question has been asked before in various ways, however with the frequent version updates i'm still unclear if stunnel is meant as a fix to my issue. i have a outdated home monitoring program running on a winxp box. when an error occurs it sends an email. it's setup screen (besides the destination email field) only have a) smtp server, b) undeliverable email address and c) port # fields to configure. my workaround for several years (when port 25 became blocked or needed authetication) has been to use LOApost but they've recently ceased. that program, also running in the background, and if i understand correctly acted as a local host. i configured the monitoring program's smtp for 127.0.0.1 and LOApost did the rest other searches suggest cloud solutions like sendgrid and authsmtp. but those sites need a login/ password with the outgoing message. perhaps this is where i'm getting confused between the differences of SSL and smtp authentication? i have gotten gsuite's restricted smtp server to work, but i hoped stunnel would provide a better solution (ability to send besides gmail/ gsuite addresses). below are my conf and log files of my attempt. again, i can't tell if i've missed a step, or if this is not intended to work. PS: i've also tried to understand if this feature is on the todo list? tia, parker stunnel.conf [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes log file 2017.12.31 16:22:45 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2017.12.31 16:22:45 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2017.12.31 16:22:45 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.12.31 16:22:45 LOG5[main]: Reading configuration from file stunnel.conf 2017.12.31 16:22:45 LOG5[main]: UTF-8 byte order mark not detected 2017.12.31 16:22:45 LOG5[main]: FIPS mode disabled 2017.12.31 16:22:45 LOG5[main]: Configuration successful 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] accepted connection from 127.0.0.1:1141 2017.12.31 16:25:03 LOG5[0]: s_connect: connected 173.194.67.108:465 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] connected remote server from 192.168.1.103:1142 2017.12.31 16:25:03 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/gsr2" 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted 2017.12.31 16:25:04 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/GTSGIAG3" 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted 2017.12.31 16:25:04 LOG5[0]: Certificate accepted at depth=0: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com 2017.12.31 16:25:04 LOG5[0]: Connection closed: 55 byte(s) sent to TLS, 514 byte(s) sent to socket and this is what shows up on my monitoring program log file... To = xxxxxx(a)gmail.com Connecting to mail server... 127.0.0.1 Sending message... E-mail Failed. Error: 20162 / 530 5.5.1 https://support.google.com/ mail/?p=WantAuthError 51sm9558225oti.10 - gsmtp 12/31/2017 4:25:04 PM

3 2

Updating stunnel 5.43 to 5.44 fails on Win7prof(32)
by tagtraeumer 15 Dec '17

15 Dec '17

Hello, removing compression = zlib did fix the starting issue for v5.44, update worked, thanks. Is 'deflate' affected too? Is compression recommended at this stage of mail processing? Thanks once more, regards! > Hello, > The compression is not recommended with TLS because of the CRIME or > BREACH attacks. > From stunnel v 5.44 in Windows the zlib compression is not supported. > So you should remove the option: > compression = zlib > > If you want to use this compression, please place the file zlib1.dll > (from the previous version) in the stunnel / bin directory. > > Best regards, > Malgorzata

1 0

Updating stunnel 5.43 to 5.44 fails on Win7prof(32)
by tagtraeumer 14 Dec '17

14 Dec '17

Hello, I did try updating stunnel 5.43 to 5.44 on a Win7prof (32bit) system, but it fails... Log before update (v5.43): 2017.12.14 20:46:39 LOG5[main]: stunnel 5.43 on x86-pc-msvc-1500 platform 2017.12.14 20:46:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2017.12.14 20:46:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.12.14 20:46:39 LOG5[main]: Reading configuration from file stunnel.conf 2017.12.14 20:46:39 LOG5[main]: UTF-8 byte order mark detected 2017.12.14 20:46:39 LOG6[main]: UI not supported by engine #1 (capi) 2017.12.14 20:46:39 LOG6[main]: Engine #1 (capi) initialized 2017.12.14 20:46:39 LOG5[main]: FIPS mode disabled 2017.12.14 20:46:39 LOG6[main]: Compression enabled: 2 method(s) 2017.12.14 20:46:39 LOG6[main]: Initializing service [HostEurope_SMTPs] 2017.12.14 20:46:39 LOG6[main]: Loading certificate from file: stunnel.pem 2017.12.14 20:46:39 LOG6[main]: Certificate loaded from file: stunnel.pem 2017.12.14 20:46:39 LOG6[main]: Loading private key from file: stunnel.pem 2017.12.14 20:46:39 LOG6[main]: Private key loaded from file: stunnel.pem 2017.12.14 20:46:39 LOG4[main]: Service [HostEurope_SMTPs] uses "verifyChain" without subject checks 2017.12.14 20:46:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2017.12.14 20:46:39 LOG5[main]: Configuration successful Log after 5.44 update: Pls refer to screenshot at: https://imgur.com/hCOKES7 "Invalid configuration file" errno: (*_errno()) stunnel.conf:65: ["name"]: Failed to initialize TLS How to solve this issue? Thx + regards!

1 0

Exception 40000015 STATUS_FATAL_APP_EXIT
by alexwaskilledfriendlyfire＠gmail.com 11 Dec '17

11 Dec '17

Hello Stunnel-users, Well, I have a problem with latest stunnel-5.44-win32 build. Both GUI and console versions won't to start throwing unhandled exception: tstunnel.exe: Problem signature: Problem Event Name: APPCRASH Application Name: tstunnel.exe Application Version: 0.0.0.0 Application Timestamp: 5a18f4f5 Fault Module Name: tstunnel.exe Fault Module Version: 0.0.0.0 Fault Module Timestamp: 5a18f4f5 Exception Code: 40000015 Exception Offset: 0000e43d OS Version: 6.1.7601.2.1.0.256.4 Locale ID: 1049 Additional Information 1: 57b4 Additional Information 2: 57b4bc5bbe66a065d3bc087357c09646 Additional Information 3: f6bb Additional Information 4: f6bb7b9b6fcf2c5cdb238bc389e9ede9 And GUI version stunnel.exe: --------------------------- Microsoft Visual C++ Runtime Library --------------------------- Runtime Error! Program: C:\Progs\Stunnel\bin\stunnel.exe This application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information. --------------------------- OK --------------------------- Problem signature: Problem Event Name: APPCRASH Application Name: stunnel.exe Application Version: 5.44.0.0 Application Timestamp: 5a18f4f3 Fault Module Name: stunnel.exe Fault Module Version: 5.44.0.0 Fault Module Timestamp: 5a18f4f3 Exception Code: 40000015 Exception Offset: 0000e43d OS Version: 6.1.7601.2.1.0.256.4 Locale ID: 1049 Additional Information 1: 2de9 Additional Information 2: 2de98e0ccee9cc0b77f8fe3f51196ec8 Additional Information 3: 42db Additional Information 4: 42db6f5f1de1e71ee661917dbb7cc0c8 Completely fresh isntallation (or deleting config folder) doesn't solve my problem. My OS is legal Windows 7 x64 with latest updates. There are screenshots just for case. https://i.imgur.com/N1kPI9J.jpg https://i.imgur.com/CqMXWtx.jpg Probably I missing some DLL or service running but it's not an option to turn everything ON (and copy every single DLL ever made to my PC) to determine which one is not running. Probably it's something else. I need help. Thanks. -- Best regards, Alexwaskilledfriendlyfire mailto:[email protected]

2 3

[patch] Fix build with LibreSSL
by Piotr Kubaj 06 Dec '17

06 Dec '17

Building against LibreSSL currently fails. Could you commit this patch? It builds fine on FreeBSD 11.1-RELEASE against LibreSSL 2.6.3. Since it doesn't change anything for OpenSSL, it should build against it too. -- ______________________________________ / A nickel ain't worth a dime anymore. \ | | \ -- Yogi Berra / -------------------------------------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || ||

1 0

possibility to delay connect to host
by Paavo Sild 04 Dec '17

04 Dec '17

Hello! I am a bit new to stunnel and while I tried to search the message archive I did not find any possible reference to the issue I try to solve. I am running a bit older version of stunnel as a simple reverse proxy. It accepts incoming TLS connection and opens clear TCP connection to a host specified by "connect" parameter in config. I wander - it is possible to delay the opening of TCP connection to a host until the actual data is received from client? I haven't found any reference to such a possibility in stunnel but thought that it worth to ask from community. The issue is that due to the nature of traffic there are instances then client negotiates the SSL connection but there is no actual data to be sent by the client. By opening the connection to host only when actual data is present would filter out unnecessary connections towards the application. Anybody had such an issue to solve? -- rgds, Paavo Sild --------------------- paavo.sild(a)estcard.ee ---------------------

1 0

routines:ssl3_read_bytes:sslv3 alert certificate unknown
by Ziad Badawi 04 Dec '17

04 Dec '17

Greetings, I am trying to capture clear text pcaps from client (browser) - server (java appserver) traffic. The java appserver is jboss using https. I'm running jboss and stunnel on the same machine. # stunnel.conf debug = 3 foreground = yes [jboss] client = yes cert= stunnel.pem # generated using makecert.sh accept = 1234 connect = 127.0.0.1:443 Version: stunnel 5.44 on x86_64-pc-linux-gnu platform Compiled/running with OpenSSL 1.0.2k-fips 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:!DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none When I try to test it usng firefox by browsing to https://localhost:1234, FF returns "Secure Connection Failed" and stunnel spits 2017.12.01 20:35:10 LOG3[0]: SSL_connect: 14094416: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown What am I missing / doing wrong? Regards Z

2 2

Stunnel 5.43 problem
by Carter Browne 15 Nov '17

15 Nov '17

When running stunnel 5.43 on Linux 4.14 (arm), accept = port only listens on 127.0.0.1:port. I don't know if other operating systems are affected. Carter

1 0

Re: [stunnel-users] TLS "translation" & 2-way auth
by Igor Gatis 15 Nov '17

15 Nov '17

It would be nice to know whether it is actually possible to achieve this with stunnel. If not, is there any other tool I could use or combine? On Nov 13, 2017 08:58, "Igor Gatis" <igorgatis(a)gmail.com> wrote: Yep, that's exactly what I'm seeking for help here. If we can abstract the 2-way bit for a second, I'd call this a "certificate transcription" TLS tunnel. On Thu, Nov 9, 2017 at 5:19 PM, Vincent Deschenes <vdeschenes(a)stelvio.com> wrote: > Ho, > > But that does not account for the A ->[TLS] ->B part. > > I believe that my sample will listen for unencrypted connection only. > > > > > > *From:* stunnel-users [mailto:[email protected]] *On > Behalf Of *Vincent Deschenes > *Sent:* Thursday, 9 November 2017 3:16 PM > *To:* Igor Gatis <igorgatis(a)gmail.com>; stunnel-users(a)stunnel.org > *Subject:* Re: [stunnel-users] TLS "translation" & 2-way auth > > > > You need to have a section in your config file which listen for requests > but also have the “client = yes” option with a cert and key like this: > > > > [http_a_to_c] > > client = yes > > accept = port_number_to_listen_on_server_b > > connect = server_c_address:443 > > cert = certificate.crt > > key = private.key > > > > > > cert and key are the certificate and private key server B uses to identify > itself on server C. > > You could also add more options to specify a trustore to specify which > cert coming from server C server B will trust, otherwise server B will > simply allow the connection. > > > > Good Luck > > > > > > *From:* stunnel-users [mailto:[email protected] > <stunnel-users-bounces(a)stunnel.org>] *On Behalf Of *Igor Gatis > *Sent:* Thursday, 9 November 2017 1:14 PM > *To:* stunnel-users(a)stunnel.org > *Subject:* [stunnel-users] TLS "translation" & 2-way auth > > > > Consider scenario below: > > > > Server A ==TLS==> Server B ==TLS+2WayAuth==> Server C > > > > Server A needs to connect to Server C through Server B which runs Stunnel. > Server C requires 2-way authentication. I have full control over Server A > and Server B and Server C belongs to a third-party. > > > > What does Stunnel config should look like? > > >

3 2

Re: [stunnel-users] Possible stunnel 5.43 bug ?
by Bezspam 15 Nov '17

15 Nov '17

Hello, The patch fixed the problem. Thank you very much! Best regards, Bez Spam Sent with [ProtonMail](https://protonmail.com) Secure Email. > -------- Original Message -------- > Subject: Re: [stunnel-users] Possible stunnel 5.43 bug ? > Local Time: November 15, 2017 7:15 AM > UTC Time: November 15, 2017 7:15 AM > From: Michal.Trojnara(a)stunnel.org > To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> > > On 11/14/2017 01:33 PM, Bezspam wrote: > >> Is this a bug or expected behaviour? >> Best regards, >> Bez Spam >> >> Dear Bez, >> >> I confirm this is a bug. A patch that fixes it is: >> ftp://ftp.stunnel.org/stunnel/accept.patch >> >> There will be a bugfix release of stunnel later this week. >> >> Best regards, >> Mike > > --------------------------------------------------------------- > > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Ubuntu 16.04 problem
by Carter Browne 14 Nov '17

14 Nov '17

I have a very confusing problem with stunnel on Ubuntu. I have a configuration file that I have used in both Windows and Arch Linux. In the Arch version, I use a single file with all the certificates for the partner systems, in the Windows version I use a capath directory. I have tried both here and I always get the response "tlsv1 alert unknown ca". The beginning of the stunnel.conf file is below. Any hints would be appreciated. Carter cert = /etc/stunnel/xxxxxxx.pem key = /etc/stunnel/xxxxxxx.pem fips = no # Enable client mode client = yes ; Some security enhancements for UNIX systems - comment them out on Win32 #chroot = /var/run/stunnel/ #setuid = stunnel #setgid = stunnel ; PID is created inside chroot jail pid = /etc/stunnel/stunnel.pid ; Some performance tunings # Debug and Foreground are for testing socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Uncomment for debugging stunnel problems debug = 5 output = /etc/stunnel/stunnel.log ##foreground = yes ; NO SSLv2 options = NO_SSLv3 sslVersion = all Ciphers = ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA # # Uncomment and modify the CAFile to point to your ca.txt file #CAFile = /etc/stunnel/all.pem CAPath = /etc/stunnel/capath #CAPath = @sysconfdir/ssl/certs # Uncomment and modify the verify to enable CA validation # verifyChain = no VerifyPeer = yes

1 0

Possible stunnel 5.43 bug ?
by Bezspam 14 Nov '17

14 Nov '17

Hello, I use stunnel on FreeBSD 11.1. I install it from ports. Yesterday I updated to stunnel 5.43. However it stopped working. I investigated the problem and found the issue- instead on all network interfaces, "accept" listens on 127.0.0.1 : sockstat -4 USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS stunnel stunnel 43945 7 tcp4 127.0.0.1:2222 *:* stunnel stunnel 43945 8 tcp4 127.0.0.1:3128 *:* stunnel stunnel 43945 9 tcp4 127.0.0.1:8080 *:* stunnel stunnel 43945 10 tcp4 127.0.0.1:1616 *:* A workaround is to modify "accept = 0.0.0.0:3128" explicitly to listen on 0.0.0.0. Is this a bug or expected behaviour? Best regards, Bez Spam

2 1

TLS "translation" & 2-way auth
by Igor Gatis 13 Nov '17

13 Nov '17

Consider scenario below: Server A ==TLS==> Server B ==TLS+2WayAuth==> Server C Server A needs to connect to Server C through Server B which runs Stunnel. Server C requires 2-way authentication. I have full control over Server A and Server B and Server C belongs to a third-party. What does Stunnel config should look like?

2 3

Email Solution Needed
by Jon Kinne 11 Nov '17

11 Nov '17

I am running Windows 7, 32-bit and I have an email problem I'm trying to solve. I will describe what I need to do and hopefully someone can tell me if stunnel will solve it or if not, where else I might find a solution. I need to send emails out of a database program called Sage Act. It requires that the outgoing SMTP server be on port 25, and be named "smtp.xxx..." My ISP (Charter) blocks port 25, and their SMTP server is called "mobile.charter.net" on port 587. I need to have a way to enter an address like "SMTP.charter.net" (Port 25) in ACT, and when I send that email, it actually goes to "mobile.charter.net" or perhaps my gmail SMTP server on port 587 (Charter) or whatever port the gmail SMTP server requires. I'll certainly appreciate any help anyone can offer me. Thanks, Jon

1 0

Running Stunnel GUI as a service
by Stunnel User999 11 Nov '17

11 Nov '17

Hi, I'm running stunnel 5.43 on Windows 2012 R2 server and trying to run stunnel GUI as a service. Whenever I close my user session, it shuts down the GUI service. Installing the Stunnel TLS Wrapper Windows service does not seem to start the GUI service. How to run GUI in the background as a service? Any information is highly appreciated. Thanks, SN

1 0

Tunnelblick over stunnel - connects but does not work
by Anton Kantsel 10 Nov '17

10 Nov '17

Hi! As OpenVPN seems to become banned in increasing number of countries, I had to look for a way to foil DPI. Wrapping OpenVPN traffic into stunnel SSL-secured connection seems promising but... On Windows machine it really works just fine. But on macOS it connects, but then no surfing or other Internet application works whatsoever. Looks like DNS problem but may be it's different... Moreover, in 40 secs or so Tunnelblick disconnects with message "2017-11-10 00:08:54 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting. 2017-11-10 00:09:30 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's IP address after connecting". Then it tries to connect again but never succeeds and cycles forever. Please find stunnel config and Tunnelblik full log below. Would appreciate any help! [STUNNEL] $ stunnel -version stunnel 5.23 on x86_64-apple-darwin14.5.0 platform Compiled with OpenSSL 0.9.8zd 8 Jan 2015 Running with OpenSSL 0.9.8zh 14 Jan 2016 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = HIGH:+3DES:+DH:!aNULL:!SSLv2 curve = prime256v1 debug = notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none stunnel.conf file: cert=stunnel.pem options=NO_SSLv2 [openvpn] client=yes accept=localhost:989 connect=X.X.X.X:990 [TUNNELBLICK] *Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4 (build 4900); prior version 3.7.3 (build 4880); Standard user git commit 0f68fae3cabe6b2ebdc9fbb3054232074c03bbfb Configuration client2_pc_stunnel "Sanitized" condensed configuration file for /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk: client dev tun proto tcp remote 127.0.0.1 989 resolv-retry infinite nobind persist-key persist-tun verb 3 remote-cert-tls server keepalive 10 120 tls-client key-direction 1 <ca> [Security-related line(s) omitted] </ca> <cert> [Security-related line(s) omitted] </cert> <key> [Security-related line(s) omitted] </key> <tls-auth> [Security-related line(s) omitted] </tls-auth> ================================================================================ XXX ================================================================================ There are no unusual files in client2_pc_stunnel.tblk ================================================================================ Configuration preferences: useDNS = 1 -notMonitoringConnection = 0 -resetPrimaryInterfaceAfterDisconnect = 1 -routeAllTrafficThroughVpn = 1 -runMtuTest = 0 -doNotFlushCache = 0 -useRouteUpInsteadOfUp = 1 -openvpnVersion = - -notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0 -keepConnected = 1 -lastConnectionSucceeded = 1 -prependDomainNameToSearchDomains = 1 ================================================================================ Wildcard preferences: -notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0 ================================================================================ Program preferences: skipWarningAboutNonAdminUpdatingTunnelblick = 1 skipWarningThatIPANotFetchedBeforeConnection = 1 skipWarningThatInternetIsNotReachable = 1 skipWarningAboutPlacingIconNearTheSpotlightIcon = 1 placeIconInStandardPositionInStatusBar = 0 launchAtNextLogin = 1 notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0 tunnelblickVersionHistory = ( "3.7.4 (build 4900)", "3.7.3 (build 4880)", "3.7.2a (build 4851)", "3.7.2 (build 4850)", "3.7.1b (build 4813)", "3.7.1a (build 4812)", "3.7.1 (build 4811)", "3.7.0 (build 4790)", "3.6.9 (build 4685)", "3.6.8 (build 4625)" ) statusDisplayNumber = 0 lastLaunchTime = 531944638.592689 showConnectedDurations = 1 lastLanguageAtLaunchWasRTL = 0 connectionWindowDisplayCriteria = showWhenConnecting maxLogDisplaySize = 102400 lastConnectedDisplayName = client2_pc_stunnel keyboardShortcutIndex = 1 updateCheckAutomatically = 1 NSWindow Frame SettingsSheetWindow = 367 167 829 524 0 0 1280 777 NSWindow Frame ConnectingWindow = 469 442 389 187 0 0 1280 777 NSWindow Frame SUStatusFrame = 624 664 400 129 0 0 1600 877 NSWindow Frame SUUpdateAlert = 516 363 620 392 0 0 1600 877 NSWindow Frame ListingWindow = 64 330 500 422 0 0 1280 777 detailsWindowFrameVersion = 4900 detailsWindowFrame = {{48, 0}, {1232, 777}} detailsWindowLeftFrame = {{0, 0}, {224, 659}} detailsWindowViewIndex = 0 detailsWindowConfigurationsTabIdentifier = log leftNavSelectedDisplayName = client2_pc_stunnel AdvancedWindowTabIdentifier = whileConnected haveDealtWithOldTunTapPreferences = 1 haveDealtWithOldLoginItem = 1 SUEnableAutomaticChecks = 1 SUFeedURL = https://www.tunnelblick.net/appcast-s.rss SUScheduledCheckInterval = 86400 SUSendProfileInfo = 1 SULastCheckTime = 2017-11-09 18:24:28 +0000 SULastProfileSubmissionDate = 2017-11-08 18:10:57 +0000 SUHasLaunchedBefore = 1 WebKitDefaultFontSize = 11 WebKitStandardFont = .AppleSystemUIFont askedUserIfOKToCheckThatIPAddressDidNotChangeAfterConnection = 1 haveDealtWithSparkle1dot5b6 = 1 tunnelblickdHash = 004cdba8e08abd144bc48409040bc80e29c12ee9741ed7d73754f51d2547f7ea tunnelblickdPlistHash = ce400d395d1801b003398461b5420021f4d591822783a04b79b2f43956d28620 updateSendProfileInfo = 1 ================================================================================ Tunnelblick Log: *Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4 (build 4900); prior version 3.7.3 (build 4880) 2017-11-10 00:08:03 *Tunnelblick: Attempting connection with client2_pc_stunnel; Set nameserver = 769; monitoring connection 2017-11-10 00:08:03 *Tunnelblick: openvpnstart start client2_pc_stunnel.tblk 1337 769 0 3 0 1099696 -ptADGNWradsgnw 2.4.4-libressl-2.5.5 2017-11-10 00:08:03 *Tunnelblick: openvpnstart log: OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line): /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.4-libressl-2.5.5/openvpn --daemon --log /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-Sclient2_pc_stunnel.tblk-SContents-SResources-Sconfig.ovpn.769_0_3_0_1099696.1337.openvpn.log --cd /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk/Contents/Resources --setenv IV_GUI_VER "net.tunnelblick.tunnelblick 4900 3.7.4 (build 4900)" --verb 3 --config /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk/Contents/Resources/config.ovpn --verb 3 --cd /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk/Contents/Resources --management 127.0.0.1 1337 --management-query-passwords --management-hold --redirect-gateway def1 --script-security 2 --route-up /Applications/Tunnelblick.app/Contents/Resources/ client.up.tunnelblick.sh -9 -d -f -m -p -r -w -ptADGNWradsgnw --down /Applications/Tunnelblick.app/Contents/Resources/ client.down.tunnelblick.sh -9 -d -f -m -p -r -w -ptADGNWradsgnw 2017-11-10 00:08:03 OpenVPN 2.4.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Nov 2 2017 2017-11-10 00:08:03 library versions: LibreSSL 2.5.5, LZO 2.10 2017-11-10 00:08:03 MANAGEMENT: TCP Socket listening on [AF_INET] 127.0.0.1:1337 2017-11-10 00:08:03 Need hold release from management interface, waiting... 2017-11-10 00:08:03 MANAGEMENT: Client connected from [AF_INET] 127.0.0.1:1337 2017-11-10 00:08:03 *Tunnelblick: openvpnstart starting OpenVPN 2017-11-10 00:08:04 *Tunnelblick: Established communication with OpenVPN 2017-11-10 00:08:04 MANAGEMENT: CMD 'pid' 2017-11-10 00:08:04 MANAGEMENT: CMD 'state on' 2017-11-10 00:08:04 MANAGEMENT: CMD 'state' 2017-11-10 00:08:04 MANAGEMENT: CMD 'bytecount 1' 2017-11-10 00:08:04 MANAGEMENT: CMD 'hold release' 2017-11-10 00:08:04 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2017-11-10 00:08:04 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication 2017-11-10 00:08:04 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication 2017-11-10 00:08:04 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:989 2017-11-10 00:08:04 Socket Buffers: R=[131072->131072] S=[131072->131072] 2017-11-10 00:08:04 Attempting to establish TCP connection with [AF_INET] 127.0.0.1:989 [nonblock] 2017-11-10 00:08:04 MANAGEMENT: >STATE:1510254484,TCP_CONNECT,,,,,, 2017-11-10 00:08:04 TCP connection established with [AF_INET]127.0.0.1:989 2017-11-10 00:08:04 TCP_CLIENT link local: (not bound) 2017-11-10 00:08:04 TCP_CLIENT link remote: [AF_INET]127.0.0.1:989 2017-11-10 00:08:04 MANAGEMENT: >STATE:1510254484,WAIT,,,,,, 2017-11-10 00:08:07 MANAGEMENT: >STATE:1510254487,AUTH,,,,,, 2017-11-10 00:08:07 TLS: Initial packet from [AF_INET]127.0.0.1:989, sid=db4e0f35 f615606b 2017-11-10 00:08:07 VERIFY OK: depth=1, C=UZ, ST=UZ, L=XXX, O=XXX, OU=VPNUnit, CN=XXX <http://talk.ingichkimetals.com>, name=EasyRSA, emailAddress=XXX 2017-11-10 00:08:07 VERIFY KU OK 2017-11-10 00:08:07 Validating certificate extended key usage 2017-11-10 00:08:07 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication 2017-11-10 00:08:07 VERIFY EKU OK 2017-11-10 00:08:07 VERIFY OK: depth=0, C=UZ, ST=UZ, L=XXX, O=IngMet, OU=VPNUnit, CN=server, name=EasyRSA, emailAddress=XXX 2017-11-10 00:08:08 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA 2017-11-10 00:08:08 [server] Peer Connection Initiated with [AF_INET] 127.0.0.1:989 2017-11-10 00:08:09 MANAGEMENT: >STATE:1510254489,GET_CONFIG,,,,,, 2017-11-10 00:08:09 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) 2017-11-10 00:08:10 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway local def1,route 10.0.26.0 255.255.255.0,dhcp-option DNS 10.0.26.1,route 10.0.26.1,topology net30,ping 10,ping-restart 120,ifconfig 10.0.26.10 10.0.26.9,peer-id 0,cipher AES-256-GCM' 2017-11-10 00:08:10 OPTIONS IMPORT: timers and/or timeouts modified 2017-11-10 00:08:10 OPTIONS IMPORT: --ifconfig/up options modified 2017-11-10 00:08:10 OPTIONS IMPORT: route options modified 2017-11-10 00:08:10 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified 2017-11-10 00:08:10 OPTIONS IMPORT: peer-id set 2017-11-10 00:08:10 OPTIONS IMPORT: adjusting link_mtu to 1626 2017-11-10 00:08:10 OPTIONS IMPORT: data channel crypto options modified 2017-11-10 00:08:10 Data Channel: using negotiated cipher 'AES-256-GCM' 2017-11-10 00:08:10 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2017-11-10 00:08:10 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2017-11-10 00:08:10 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16) 2017-11-10 00:08:10 Opened utun device utun1 2017-11-10 00:08:10 do_ifconfig, tt->did_ifconfig_ipv6_setup=0 2017-11-10 00:08:10 MANAGEMENT: >STATE:1510254490,ASSIGN_IP,,10.0.26.10,,,, 2017-11-10 00:08:10 /sbin/ifconfig utun1 delete ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address 2017-11-10 00:08:10 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure 2017-11-10 00:08:10 /sbin/ifconfig utun1 10.0.26.10 10.0.26.9 mtu 1500 netmask 255.255.255.255 up 2017-11-10 00:08:10 /sbin/route add -net 0.0.0.0 10.0.26.9 128.0.0.0 add net 0.0.0.0: gateway 10.0.26.9 2017-11-10 00:08:10 /sbin/route add -net 128.0.0.0 10.0.26.9 128.0.0.0 add net 128.0.0.0: gateway 10.0.26.9 2017-11-10 00:08:10 MANAGEMENT: >STATE:1510254490,ADD_ROUTES,,,,,, 2017-11-10 00:08:10 /sbin/route add -net 10.0.26.0 10.0.26.9 255.255.255.0 add net 10.0.26.0: gateway 10.0.26.9 2017-11-10 00:08:10 /sbin/route add -net 10.0.26.1 10.0.26.9 255.255.255.255 add net 10.0.26.1: gateway 10.0.26.9 ********************************************** Start of output from client.up.tunnelblick.sh Retrieved from OpenVPN: name server(s) [ 10.0.26.1 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ] Not aggregating ServerAddresses because running on OS X 10.6 or higher Prepending 'openvpn' to search domains '' because the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was selected Saved the DNS and SMB configurations so they can be restored Changed DNS ServerAddresses setting from '172.20.10.1' to '10.0.26.1' Changed DNS SearchDomains setting from '' to 'openvpn' Changed DNS DomainName setting from '' to 'openvpn' Did not change SMB NetBIOSName setting of '' Did not change SMB Workgroup setting of '' Did not change SMB WINSAddresses setting of '' DNS servers '10.0.26.1' will be used for DNS queries when the VPN is active NOTE: The DNS servers do not include any free public DNS servers known to Tunnelblick. This may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems. Flushed the DNS cache via dscacheutil /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil Notified mDNSResponder that the DNS cache was flushed Setting up to monitor system configuration with process-network-changes End of output from client.up.tunnelblick.sh ********************************************** 2017-11-10 00:08:13 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this 2017-11-10 00:08:13 Initialization Sequence Completed 2017-11-10 00:08:13 MANAGEMENT: >STATE:1510254493,CONNECTED,SUCCESS,10.0.26.10,127.0.0.1,989,127.0.0.1,50665 2017-11-10 00:08:14 *Tunnelblick: No 'connected.sh' script to execute 2017-11-10 00:08:54 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting. 2017-11-10 00:09:30 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's IP address after connecting. 2017-11-10 00:10:13 [server] Inactivity timeout (--ping-restart), restarting 2017-11-10 00:10:13 SIGUSR1[soft,ping-restart] received, process restarting 2017-11-10 00:10:13 MANAGEMENT: >STATE:1510254613,RECONNECTING,ping-restart,,,,, 2017-11-10 00:10:14 *Tunnelblick: No 'reconnecting.sh' script to execute 2017-11-10 00:10:14 MANAGEMENT: CMD 'hold release' 2017-11-10 00:10:14 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2017-11-10 00:10:14 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:989 2017-11-10 00:10:14 Socket Buffers: R=[131072->131072] S=[131072->131072] 2017-11-10 00:10:14 Attempting to establish TCP connection with [AF_INET] 127.0.0.1:989 [nonblock] 2017-11-10 00:10:14 MANAGEMENT: >STATE:1510254614,TCP_CONNECT,,,,,, 2017-11-10 00:10:15 TCP connection established with [AF_INET]127.0.0.1:989 2017-11-10 00:10:15 TCP_CLIENT link local: (not bound) 2017-11-10 00:10:15 TCP_CLIENT link remote: [AF_INET]127.0.0.1:989 2017-11-10 00:10:15 MANAGEMENT: >STATE:1510254615,WAIT,,,,,, 2017-11-10 00:10:24 Connection reset, restarting [-1] 2017-11-10 00:10:24 SIGUSR1[soft,connection-reset] received, process restarting 2017-11-10 00:10:24 MANAGEMENT: >STATE:1510254624,RECONNECTING,connection-reset,,,,, 2017-11-10 00:10:24 *Tunnelblick: No 'reconnecting.sh' script to execute 2017-11-10 00:10:24 MANAGEMENT: CMD 'hold release' 2017-11-10 00:10:24 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2017-11-10 00:10:24 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:989 2017-11-10 00:10:24 Socket Buffers: R=[131072->131072] S=[131072->131072] 2017-11-10 00:10:24 Attempting to establish TCP connection with [AF_INET] 127.0.0.1:989 [nonblock] 2017-11-10 00:10:24 MANAGEMENT: >STATE:1510254624,TCP_CONNECT,,,,,, 2017-11-10 00:10:25 TCP connection established with [AF_INET]127.0.0.1:989 2017-11-10 00:10:25 TCP_CLIENT link local: (not bound) 2017-11-10 00:10:25 TCP_CLIENT link remote: [AF_INET]127.0.0.1:989 2017-11-10 00:10:25 MANAGEMENT: >STATE:1510254625,WAIT,,,,,, 2017-11-10 00:10:32 *Tunnelblick: Disconnecting; notification window disconnect button pressed 2017-11-10 00:10:33 *Tunnelblick: No 'pre-disconnect.sh' script to execute 2017-11-10 00:10:33 *Tunnelblick: Disconnecting using 'kill' 2017-11-10 00:10:33 event_wait : Interrupted system call (code=4) 2017-11-10 00:10:33 /sbin/route delete -net 10.0.26.0 10.0.26.9 255.255.255.0 delete net 10.0.26.0: gateway 10.0.26.9 2017-11-10 00:10:33 /sbin/route delete -net 10.0.26.1 10.0.26.9 255.255.255.255 delete net 10.0.26.1: gateway 10.0.26.9 2017-11-10 00:10:33 /sbin/route delete -net 0.0.0.0 10.0.26.9 128.0.0.0 delete net 0.0.0.0: gateway 10.0.26.9 2017-11-10 00:10:33 /sbin/route delete -net 128.0.0.0 10.0.26.9 128.0.0.0 delete net 128.0.0.0: gateway 10.0.26.9 2017-11-10 00:10:33 Closing TUN/TAP interface 2017-11-10 00:10:33 /Applications/Tunnelblick.app/Contents/Resources/ client.down.tunnelblick.sh -9 -d -f -m -p -r -w -ptADGNWradsgnw utun1 1500 1623 10.0.26.10 10.0.26.9 init ********************************************** Start of output from client.down.tunnelblick.sh Cancelled monitoring of system configuration changes Restored the DNS and SMB configurations Flushed the DNS cache via dscacheutil /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil Notified mDNSResponder that the DNS cache was flushed Resetting primary interface 'en0' via networksetup -setairportpower en0 off/on... End of output from client.down.tunnelblick.sh ********************************************** 2017-11-10 00:10:36 SIGTERM[hard,] received, process exiting 2017-11-10 00:10:36 MANAGEMENT: >STATE:1510254636,EXITING,SIGTERM,,,,, 2017-11-10 00:10:36 *Tunnelblick: No 'post-disconnect.sh' script to execute 2017-11-10 00:10:36 *Tunnelblick: Expected disconnection occurred. ================================================================================ "Sanitized" full configuration file client dev tun proto tcp remote 127.0.0.1 989 resolv-retry infinite nobind persist-key persist-tun verb 3 remote-cert-tls server keepalive 10 120 tls-client key-direction 1 <ca> [Security-related line(s) omitted] </ca> <cert> [Security-related line(s) omitted] </cert> <key> [Security-related line(s) omitted] </key> <tls-auth> [Security-related line(s) omitted] </tls-auth> ================================================================================ ifconfig output: lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384 options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP> inet 127.0.0.1 netmask 0xff000000 inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 nd6 options=201<PERFORMNUD,DAD> gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280 stf0: flags=0<> mtu 1280 en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 ether 60:03:08:a6:ca:5a inet 172.20.10.2 netmask 0xfffffff0 broadcast 172.20.10.15 media: autoselect status: active en1: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500 options=60<TSO4,TSO6> ether 72:00:01:d9:43:00 media: autoselect <full-duplex> status: inactive en2: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500 options=60<TSO4,TSO6> ether 72:00:01:d9:43:01 media: autoselect <full-duplex> status: inactive p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304 ether 02:03:08:a6:ca:5a media: autoselect status: inactive awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484 ether c2:f1:c7:85:b6:9d inet6 fe80::c0f1:c7ff:fe85:b69d%awdl0 prefixlen 64 scopeid 0x8 nd6 options=201<PERFORMNUD,DAD> media: autoselect status: active bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 options=63<RXCSUM,TXCSUM,TSO4,TSO6> ether 72:00:01:d9:43:00 Configuration: id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0 maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200 root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0 ipfilter disabled flags 0x2 member: en1 flags=3<LEARNING,DISCOVER> ifmaxaddr 0 port 5 priority 0 path cost 0 member: en2 flags=3<LEARNING,DISCOVER> ifmaxaddr 0 port 6 priority 0 path cost 0 media: <unknown type> status: inactive utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000 inet6 fe80::6c50:d369:e570:bf02%utun0 prefixlen 64 scopeid 0xa nd6 options=201<PERFORMNUD,DAD> ================================================================================ Console Log: 2017-11-09 23:23:57 Tunnelblick[1595] Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4 (build 4900) 2017-11-09 23:23:57 Tunnelblick[1595] Warning: preferences contain unknown preference 'PMPrintingExpandedStateForPrint2' 2017-11-09 23:23:57 Tunnelblick[1595] Warning: preferences contain unknown preference 'userAgreementVersionAgreedTo' 2017-11-10 00:08:54 Tunnelblick[1595] currentIPInfo(Name): IP address info could not be fetched within 35.4 seconds; the error was 'Error Domain=NSURLErrorDomain Code=-1001 "The request timed out." UserInfo={NSUnderlyingError=0x60800024a200 {Error Domain=kCFErrorDomainCFNetwork Code=-1001 "The request timed out." UserInfo={NSErrorFailingURLStringKey=https://tunnelblick.net/ipinfo, NSErrorFailingURLKey=https://tunnelblick.net/ipinfo, _kCFStreamErrorCodeKey=-2102, _kCFStreamErrorDomainKey=4, NSLocalizedDescription=The request timed out.}}, NSErrorFailingURLStringKey= https://tunnelblick.net/ipinfo, NSErrorFailingURLKey= https://tunnelblick.net/ipinfo, _kCFStreamErrorDomainKey=4, _kCFStreamErrorCodeKey=-2102, NSLocalizedDescription=The request timed out.}'; the response was '(null)' 2017-11-10 00:09:30 Tunnelblick[1595] currentIPInfo(Address): IP address info could not be fetched within 35.5 seconds; the error was 'Error Domain=NSURLErrorDomain Code=-1001 "The request timed out." UserInfo={NSUnderlyingError=0x60000044cea0 {Error Domain=kCFErrorDomainCFNetwork Code=-1001 "The request timed out." UserInfo={NSErrorFailingURLStringKey=http://205.233.73.116/ipinfo, NSErrorFailingURLKey=http://205.233.73.116/ipinfo, _kCFStreamErrorCodeKey=-2102, _kCFStreamErrorDomainKey=4, NSLocalizedDescription=The request timed out.}}, NSErrorFailingURLStringKey= http://205.233.73.116/ipinfo, NSErrorFailingURLKey= http://205.233.73.116/ipinfo, _kCFStreamErrorDomainKey=4, _kCFStreamErrorCodeKey=-2102, NSLocalizedDescription=The request timed out.}'; the response was '(null)'

1 0

Re: [stunnel-users] Web browsing over stunnel
by Osvald Brko 08 Nov '17

08 Nov '17

> From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Tuesday, November 7, 2017 10:41 AM > To: Peter Pentchev > Cc: Osvald Brko; stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Web browsing over stunnel > Osvald, > Peter made a very clear explanation. Note that your connect statement should be something like: > connect=104.239.213.7:443 > And you should test using something like: > http://www.stunnel.net:8888/ O.K., I understand it. www.stunnel.org still refuse connection (see below), but I was able to open www.wikipedia.org: http://www.wikipedia.org:8888/ [https_test] client = yes accept = 127.0.0.1:8888 connect = 91.198.174.192:443 #127.0.0.1 localhost #127.0.0.1 www.stunnel.org 127.0.0.1 www.wikipedia.org But of course I am not able to use any web link, and I can see only default main page without any path. So stunnel is completely unusable for web browsing, I am right? O.B. ===== http://www.stunnel.org:8888/ [https_test] client = yes accept = 127.0.0.1:8888 connect = 207.192.69.165:443 #127.0.0.1 localhost 127.0.0.1 www.stunnel.org #127.0.0.1 www.wikipedia.org 2017.11.07 15:51:37 LOG7[main]: Service [https_test] (FD=260) bound to 127.0.0.1:8888 2017.11.07 15:51:37 LOG7[cron]: Cron thread initialized 2017.11.07 15:51:53 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.07 15:51:53 LOG7[main]: FD=232 ifds=r-x ofds=--- 2017.11.07 15:51:53 LOG7[main]: FD=248 ifds=r-x ofds=--- 2017.11.07 15:51:53 LOG7[main]: Service [https_test] accepted (FD=300) from 127.0.0.1:3197 2017.11.07 15:51:53 LOG7[main]: Creating a new thread 2017.11.07 15:51:53 LOG7[main]: New thread created 2017.11.07 15:51:53 LOG7[0]: Service [https_test] started 2017.11.07 15:51:53 LOG7[0]: Option TCP_NODELAY set on local socket 2017.11.07 15:51:53 LOG5[0]: Service [https_test] accepted connection from 127.0.0.1:3197 2017.11.07 15:51:53 LOG6[0]: s_connect: connecting 207.192.69.165:443 2017.11.07 15:51:53 LOG7[0]: s_connect: s_poll_wait 207.192.69.165:443: waiting 10 seconds 2017.11.07 15:51:53 LOG5[0]: s_connect: connected 207.192.69.165:443 2017.11.07 15:51:53 LOG5[0]: Service [https_test] connected remote server from XX.XXX.XXX.XXX:3198 2017.11.07 15:51:53 LOG7[0]: Option TCP_NODELAY set on remote socket 2017.11.07 15:51:53 LOG7[0]: Remote descriptor (FD=320) initialized 2017.11.07 15:51:53 LOG6[0]: SNI: sending servername: 207.192.69.165 2017.11.07 15:51:53 LOG6[0]: Peer certificate not required 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): before/connect initialization 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server certificate A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server key exchange A 2017.11.07 15:51:53 LOG6[0]: Client certificate not requested 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server done A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 write finished A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 flush data 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server session ticket A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read finished A 2017.11.07 15:51:53 LOG7[0]: 1 client connect(s) requested 2017.11.07 15:51:53 LOG7[0]: 1 client connect(s) succeeded 2017.11.07 15:51:53 LOG7[0]: 0 client renegotiation(s) requested 2017.11.07 15:51:53 LOG7[0]: 0 session reuse(s) 2017.11.07 15:51:53 LOG6[0]: TLS connected: new session negotiated 2017.11.07 15:51:53 LOG7[0]: Peer certificate was cached (7519 bytes) 2017.11.07 15:51:53 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.07 15:51:53 LOG7[0]: Compression: null, expansion: null 2017.11.07 15:51:58 LOG7[0]: TLS alert (read): warning: close notify 2017.11.07 15:51:58 LOG6[0]: TLS closed (SSL_read) 2017.11.07 15:51:58 LOG7[0]: Sent socket write shutdown 2017.11.07 15:51:59 LOG3[0]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2017.11.07 15:51:59 LOG5[0]: Connection reset: 483 byte(s) sent to TLS, 429 byte(s) sent to socket 2017.11.07 15:51:59 LOG7[0]: Remote descriptor (FD=320) closed 2017.11.07 15:51:59 LOG7[0]: Local descriptor (FD=300) closed 2017.11.07 15:51:59 LOG7[0]: Service [https_test] finished (0 left)

2 2

Re: [stunnel-users] stunnel 5.43 released
by Ian Bamforth 07 Nov '17

07 Nov '17

Hi, I'm having trouble installing the new release on Ubuntu 14.04. The command I'm running is: execute ./configure --with-ssl=/usr/local/openssl-1.1.0g && make && make check && sudo make install I get this output: 15:13:06 stunnel 5.43 on x86_64-pc-linux-gnu platform 15:13:06 Compiled/running with OpenSSL 1.1.0g 2 Nov 2017 15:13:06 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 15:13:06 15:13:06 test 010_require_cert ok 15:13:06 test 011_verify_peer ok 15:13:06 test 012_verify_chain ok 15:13:06 test 013_CRL_file failed 15:13:06 error logs logs/013_CRL_file.log 15:13:06 test 014_PSK_secrets ok 15:13:06 test 015_p12_cert ok 15:13:06 test 020_IPv6 skipped 15:13:06 test 021_FIPS skipped 15:13:06 test 030_simple_execute ok 15:13:06 test 031_redirect ok 15:13:06 test 032_no_redirect ok 15:13:06 test 033_redirect_exec ok 15:13:06 test 034_no_redirect_exec ok 15:13:06 test 035_SNI ok 15:13:06 test 036_no_SNI ok 15:13:06 test 037_failover_prio1 failed 15:13:06 error logs logs/037_failover_prio1.log 15:13:06 test 038_failover_prio2 failed 15:13:06 error logs logs/038_failover_prio2.log 15:13:06 test 039_failover_rr ok 15:13:06 test 040_reload ok 15:13:06 test 110_failure_require_cert ok 15:13:06 test 111_failure_verify_peer ok 15:13:06 test 112_failure_verify_chain ok 15:13:06 test 113_failure_CRL_file ok 15:13:06 test 114_failure_PSK_secrets ok 15:13:06 test 120_failure_no_cert ok 15:13:06 test 121_failure_wrong_config ok 15:13:06 summary: success 21, skip 2, fail 3 15:13:06 ./make_test finished 15:13:06 make[2]: Leaving directory `/opt/stunnel/stunnel-5.43/tests' 15:13:06 make[1]: Leaving directory `/opt/stunnel/stunnel-5.43/tests' 15:13:06 STDERR: make[2]: *** [check-local] Error 1 15:13:06 make[1]: *** [check-am] Error 2 15:13:06 make: *** [check-recursive] Error 1 15:13:06 ---- End output of ./configure --with-ssl=/usr/local/openssl-1.1.0g && make && make check && sudo make install ---- 15:13:06 Ran ./configure --with-ssl=/usr/local/openssl-1.1.0g && make && make check && sudo make install returned 2 This was working until the new release (we were on 5.42), is there some change required? Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division W: www.tracsis.com www.tracsisops.com Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error. -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: 05 November 2017 23:03 To: stunnel-users(a)stunnel.org; stunnel-announce(a)stunnel.org; openssl-users(a)openssl.org Subject: [stunnel-users] stunnel 5.43 released Dear Users, I have released version 5.43 of stunnel. Version 5.43, 2017.11.05, urgency: LOW * New features - OpenSSL DLLs updated to version 1.0.2m. - Android build updated to OpenSSL 1.1.0g. - Allow for multiple "accept" ports per section. - Self-test framework (make check). - Added config load before OpenSSL init (thx to Dmitrii Pichulin). - OpenSSL 1.1.0 support for Travis CI. - OpenSSL 1.1.1-dev compilation fixes. * Bugfixes - Fixed a memory fault on Solaris. - Fixed round-robin failover in the FORK threading model. - Fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown(). - Minor fixes of the logging subsystem. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 05915babf705a0494886a72a7367913d403d07fc908ebb7b380d639e2d8bcee2 stunnel-5.43.tar.gz 5249479d295f482ecac9cd3d5c89c0e5d41ae6ff8e265d4634ecfd8761834201 stunnel-5.43-win32-installer.exe e628fa7027d19bf4f0a62392f9dc042d97959498c292e13ebdf30c65a545dd6d stunnel-5.43-android.zip Best regards, Mike

1 0

Web browsing over stunnel
by Osvald Brko 02 Nov '17

02 Nov '17

Hello, I try to use stunnel for web browsing (https), and I am not successful. (While mail client against IMAP server works fine). Can anybody give me a hint what to try? The situation: Windows XP SP3, MSIE 8 (or Firefox 43.0.1. for check), stunnel 5.42 stunnel.conf : debug = 7 [https_test] client = yes accept = 127.0.0.1:8888 connect = www.stunnel.org:443 http://127.0.0.1:8888/ -> Error HTTP 404 Not Found 2017.11.02 13:01:50 LOG7[main]: Running on Windows 5.1 2017.11.02 13:01:50 LOG7[main]: No limit detected for the number of clients 2017.11.02 13:01:50 LOG5[main]: stunnel 5.42 on x86-pc-msvc-1500 platform 2017.11.02 13:01:50 LOG5[main]: Compiled/running with OpenSSL 1.0.2l-fips 25 May 2017 2017.11.02 13:01:50 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.11.02 13:01:50 LOG7[main]: errno: (*_errno()) 2017.11.02 13:01:50 LOG7[ui]: GUI message loop initialized 2017.11.02 13:01:50 LOG7[main]: Running on Windows 5.1 2017.11.02 13:01:50 LOG5[main]: Reading configuration from file stunnel.conf 2017.11.02 13:01:50 LOG5[main]: UTF-8 byte order mark detected 2017.11.02 13:01:50 LOG5[main]: FIPS mode disabled 2017.11.02 13:01:50 LOG7[main]: Compression disabled 2017.11.02 13:01:50 LOG7[main]: PRNG seeded successfully 2017.11.02 13:01:50 LOG6[main]: Initializing service [XXXXXX-imap] 2017.11.02 13:01:50 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.11.02 13:01:50 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.11.02 13:01:50 LOG7[main]: No certificate or private key specified 2017.11.02 13:01:50 LOG6[main]: Initializing service [https_test] 2017.11.02 13:01:50 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.11.02 13:01:50 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.11.02 13:01:50 LOG7[main]: No certificate or private key specified 2017.11.02 13:01:50 LOG4[main]: Service [https_test] needs authentication to prevent MITM attacks 2017.11.02 13:01:50 LOG5[main]: Configuration successful 2017.11.02 13:01:50 LOG7[main]: Listening file descriptor created (FD=236) 2017.11.02 13:01:50 LOG7[main]: Service [XXXXXX-imap] (FD=236) bound to 127.0.0.1:143 2017.11.02 13:01:50 LOG7[main]: Listening file descriptor created (FD=260) 2017.11.02 13:01:50 LOG7[main]: Service [https_test] (FD=260) bound to 127.0.0.1:8888 2017.11.02 13:01:50 LOG7[cron]: Cron thread initialized 2017.11.02 13:02:11 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.02 13:02:11 LOG7[main]: FD=236 ifds=r-x ofds=--- 2017.11.02 13:02:11 LOG7[main]: FD=248 ifds=r-x ofds=--- 2017.11.02 13:02:11 LOG7[main]: Service [https_test] accepted (FD=304) from 127.0.0.1:3424 2017.11.02 13:02:11 LOG7[main]: Creating a new thread 2017.11.02 13:02:11 LOG7[main]: New thread created 2017.11.02 13:02:11 LOG7[0]: Service [https_test] started 2017.11.02 13:02:11 LOG7[0]: Option TCP_NODELAY set on local socket 2017.11.02 13:02:11 LOG5[0]: Service [https_test] accepted connection from 127.0.0.1:3424 2017.11.02 13:02:11 LOG6[0]: s_connect: connecting 207.192.69.165:443 2017.11.02 13:02:11 LOG7[0]: s_connect: s_poll_wait 207.192.69.165:443: waiting 10 seconds 2017.11.02 13:02:11 LOG5[0]: s_connect: connected 207.192.69.165:443 2017.11.02 13:02:11 LOG5[0]: Service [https_test] connected remote server from XX.XXX.XXX.XXX:3425 2017.11.02 13:02:11 LOG7[0]: Option TCP_NODELAY set on remote socket 2017.11.02 13:02:11 LOG7[0]: Remote descriptor (FD=320) initialized 2017.11.02 13:02:11 LOG6[0]: SNI: sending servername: www.stunnel.org 2017.11.02 13:02:11 LOG6[0]: Peer certificate not required 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): before/connect initialization 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server certificate A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server key exchange A 2017.11.02 13:02:11 LOG6[0]: Client certificate not requested 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server done A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 write finished A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 flush data 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server session ticket A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read finished A 2017.11.02 13:02:11 LOG7[0]: 1 client connect(s) requested 2017.11.02 13:02:11 LOG7[0]: 1 client connect(s) succeeded 2017.11.02 13:02:11 LOG7[0]: 0 client renegotiation(s) requested 2017.11.02 13:02:11 LOG7[0]: 0 session reuse(s) 2017.11.02 13:02:11 LOG6[0]: TLS connected: new session negotiated 2017.11.02 13:02:11 LOG7[0]: Peer certificate was cached (7519 bytes) 2017.11.02 13:02:11 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.02 13:02:11 LOG7[0]: Compression: null, expansion: null 2017.11.02 13:02:16 LOG7[0]: TLS alert (read): warning: close notify 2017.11.02 13:02:16 LOG6[0]: TLS closed (SSL_read) 2017.11.02 13:02:16 LOG7[0]: Sent socket write shutdown 2017.11.02 13:02:21 LOG3[0]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2017.11.02 13:02:21 LOG5[0]: Connection reset: 565 byte(s) sent to TLS, 399 byte(s) sent to socket 2017.11.02 13:02:21 LOG7[0]: Remote descriptor (FD=320) closed 2017.11.02 13:02:21 LOG7[0]: Local descriptor (FD=304) closed 2017.11.02 13:02:21 LOG7[0]: Service [https_test] finished (0 left) 2017.11.02 13:02:50 LOG6[cron]: Executing cron jobs 2017.11.02 13:02:50 LOG6[cron]: Cron jobs completed in 0 seconds 2017.11.02 13:02:50 LOG7[cron]: Waiting 86400 seconds

1 0

Problem: eMail over SMTP on port 587 accepted without error but not forwarded
by Ben Stover 02 Nov '17

02 Nov '17

After a long time of successful usage of stunnel on a Windows 7 system I experienced now permanent problems with sending messages from my local email client over stunnel + SMTP to the remote smtp-server on port 587. Again: my local client+stunnel setup is/was untouched. When I send now messages to remote port 587 (as before) they are silently accepted but NOT forwarded to the final destination. No error messages was returned. The only thing I could imagine is that the webhoster changed the mail server certificate. How does stunnel handle this scenario? Do I have to tell stunnel that the remote certificate changed? how? Receiving eMails through POP3 on port 995 works. WebHoster has no clue what the reason is. The (anonymized) log below shows the transfer Any help is welcomed. Thank you Peter 2017.11.02 13:03:51 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.02 13:03:51 LOG7[main]: FD=388 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=464 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=468 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=472 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=476 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=480 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=484 ifds=r-x ofds=r-- 2017.11.02 13:03:51 LOG7[main]: FD=488 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=492 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=496 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=500 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=504 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=508 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=512 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=516 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=520 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=524 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=528 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: Service [mail-smtp] accepted (FD=904) from 127.0.0.1:47872 2017.11.02 13:03:51 LOG7[main]: Creating a new thread 2017.11.02 13:03:51 LOG7[main]: New thread created 2017.11.02 13:03:51 LOG7[537]: Service [mail-smtp] started 2017.11.02 13:03:51 LOG7[537]: Option TCP_NODELAY set on local socket 2017.11.02 13:03:51 LOG5[537]: Service [mail-smtp] accepted connection from 127.0.0.1:47872 2017.11.02 13:03:51 LOG6[537]: s_connect: connecting 195.54.77.83:587 2017.11.02 13:03:51 LOG7[537]: s_connect: s_poll_wait 195.54.77.83:587: waiting 10 seconds 2017.11.02 13:03:51 LOG5[537]: s_connect: connected 195.54.77.83:587 2017.11.02 13:03:51 LOG5[537]: Service [mail-smtp] connected remote server from 192.168.0.10:47873 2017.11.02 13:03:51 LOG7[537]: Option TCP_NODELAY set on remote socket 2017.11.02 13:03:51 LOG7[537]: Remote descriptor (FD=876) initialized 2017.11.02 13:03:51 LOG7[537]: <- 220 foobar.testserver.com ESMTP Postfix 2017.11.02 13:03:51 LOG7[537]: -> 220 foobar.testserver.com ESMTP Postfix 2017.11.02 13:03:51 LOG7[537]: -> EHLO localhost 2017.11.02 13:03:51 LOG7[537]: <- 250-foobar.testserver.com 2017.11.02 13:03:51 LOG7[537]: <- 250-PIPELINING 2017.11.02 13:03:51 LOG7[537]: <- 250-SIZE 104857600 2017.11.02 13:03:51 LOG7[537]: <- 250-ETRN 2017.11.02 13:03:51 LOG7[537]: <- 250-STARTTLS 2017.11.02 13:03:51 LOG7[537]: <- 250-ENHANCEDSTATUSCODES 2017.11.02 13:03:51 LOG7[537]: <- 250-8BITMIME 2017.11.02 13:03:51 LOG7[537]: <- 250 DSN 2017.11.02 13:03:51 LOG7[537]: -> STARTTLS 2017.11.02 13:03:51 LOG7[537]: <- 220 2.0.0 Ready to start TLS 2017.11.02 13:03:51 LOG6[537]: SNI: sending servername: foobar.testserver.com 2017.11.02 13:03:51 LOG6[537]: Peer certificate not required 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): before/connect initialization 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write client hello A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server hello A 2017.11.02 13:03:51 LOG6[537]: Certificate verification disabled 2017.11.02 13:03:51 LOG6[537]: Certificate verification disabled 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server certificate A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server key exchange A 2017.11.02 13:03:51 LOG6[537]: Client certificate not requested 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server done A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write client key exchange A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write finished A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 flush data 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server session ticket A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read finished A 2017.11.02 13:03:51 LOG7[537]: 2 client connect(s) requested 2017.11.02 13:03:51 LOG7[537]: 2 client connect(s) succeeded 2017.11.02 13:03:51 LOG7[537]: 0 client renegotiation(s) requested 2017.11.02 13:03:51 LOG7[537]: 0 session reuse(s) 2017.11.02 13:03:51 LOG6[537]: TLS connected: new session negotiated 2017.11.02 13:03:51 LOG7[537]: Deallocating application specific data for session connect address 2017.11.02 13:03:51 LOG6[537]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.02 13:03:51 LOG7[537]: Compression: null, expansion: null 2017.11.02 13:03:52 LOG6[537]: Read socket closed (readsocket) 2017.11.02 13:03:52 LOG7[537]: Sending close_notify alert 2017.11.02 13:03:52 LOG7[537]: TLS alert (write): warning: close notify 2017.11.02 13:03:52 LOG6[537]: SSL_shutdown successfully sent close_notify alert 2017.11.02 13:03:52 LOG7[537]: TLS alert (read): warning: close notify 2017.11.02 13:03:52 LOG6[537]: TLS closed (SSL_read) 2017.11.02 13:03:52 LOG7[537]: Sent socket write shutdown 2017.11.02 13:03:52 LOG5[537]: Connection closed: 2954 byte(s) sent to TLS, 337 byte(s) sent to socket 2017.11.02 13:03:52 LOG7[537]: Remote descriptor (FD=876) closed 2017.11.02 13:03:52 LOG7[537]: Local descriptor (FD=904) closed 2017.11.02 13:03:52 LOG7[537]: Service [mailo-smtp] finished (0 left)

1 0

Re: [stunnel-users] How to distinguish stunnel definition between SMTP through SSL-TLS vs. STARTTLS?
by Harris, Douglas (SSC/SPC) 26 Oct '17

26 Oct '17

> Ok, if I specify > > protocol=smtp > > what does that mean: "Connect through SSL-TLS protocol" or "connect through STARTTLS protocol"? That means connect using STARTTLS. > It seems to me that I ALWAYS have to specify "protocol=smtp" for ALL smtp-server connects. You don't. If you are not using STARTTLS you don't specify "protocol=". > Is this done only by port number 465 vs 587? No. > That would mean there is a hidden configuration by convention! Indeed. That would be bad. > What if the webhoster would set up a special mail server at port 8888? Then you would specify port 8888 in your "connect=" config

1 0

How to distinguish stunnel definition between SMTP through SSL-TLS vs. STARTTLS?
by Ben Stover 26 Oct '17

26 Oct '17

As yyou know there are two types of letting a local email client connect to remote secured SMTP server: 1.) through SSL-TLS and 2.) through STARTTLS How do I distinguish betwen these connection types in the stunnel.conf setup file? In a previous post I was told to look at the "protocol" parameter. Ok, if I specify protocol=smtp what does that mean: "Connect through SSL-TLS protocol" or "connect through STARTTLS protocol"? It seems to me that I ALWAYS have to specify "protocol=smtp" for ALL smtp-server connects. The stunnel documentation does not explain how to setup the *.conf file for each of the variants. Is this done only by port number 465 vs 587? That would mean there is a hidden configuration by convention! What if the webhoster would set up a special mail server at port 8888? Ben

1 0

stunnel and TLS1.2 for IE
by Thomas GMX 20 Oct '17

20 Oct '17

Hello. I have successfully configured my email client (Outlook 2010) to my provider with TLS1.2 via stunnel running as a service. config: debug = 5 engine = capi [freenet-pop3s] client = yes EngineID = capi accept = localhost:2110 connect = mx.freenet.de:995 [freenet-smpts] client = yes EngineID = capi accept = localhost:2025 connect = mx.freenet.de:465 That was no problem. But at this point I am wondering if it is possible and how I can configure stunnel so that "all" https traffic from Internet Explorer is going through stunnel and connect to internet with highest secure level supported. Not only to one specific server (connect = xyz.net) but to all servers given in IE address. By now I guess that I have to set IE so that it uses a https-proxy at "localhost:xxx" with stunnel config "accept = localhost:xxx". But how is stunnel config for "connect x.x.x.x:443" that it connect to the right server in internet I specified in IE address line? Can someone give me a hint? Or impossible? Thanks a lot Thomas

2 1

Connection setup for STARTTLS vs. SSL/TLS for POP3/SMTP mail servers?
by Ben Stover 20 Oct '17

20 Oct '17

In stunnels *.conf file I can specify the mail server name and the port for a connection. How can I tell stunnel to use STARTTLS as connect type? How can I tell stunnel to use SSL/TLS as connect type? Does stunnel support both connect types at all or only one? Is the connect type for SMTP completely determined by port e.g.: STARTTLS over port 587 and SSL/TLS over port 465 or can both connect types use both ports? Assume I do not get the supported connect type information from my webhoster: How can I find it out from my (client) side? What are there error messages? Ben

2 1

Stunnel on Android 7.x not working?
by John Appleseed 14 Oct '17

14 Oct '17

Hello, I have trouble with stunnel on Android 7.x.. I'm trying to connect to OpenVPN server through SSL tunneling with stunnel. On phone I'm using stunnel installed in Termux and OpenVPN. Everything is correctly configured, Im using the same config on other devices in same network and it works perfectly. I tried it with different devices with Android 7.x and it is not working at all :( Immediately after succesful connection I am receiving: TLS fd: Software caused connection abort (103) TLS socket closed (SSL_read) And it is still reconnecting again and again with the same error. I also tried it with stunnel downloaded directly from stunnel.org site.. Anyone with new Android who have working stunnel? Where can be the problem? Example stunnel.conf on Android: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = debug [openvpn] client = yes accept = 1337 connect = *****.ddns.net:993 cert = /path/to/stunnel.pem and on server: chroot = /var/lib/stunnel4 pid = /stunnel.pid output = /stunnel.log setuid = stunnel4 setgid = stunnel4 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [openvpn] client = no accept = 993 connect = 127.0.0.1:1194 cert = /etc/stunnel/stunnel.pem Example stunnel.log is in attachment. Thank you very much

1 0

No certificate or private key specified
by Hugo Darley 12 Oct '17

12 Oct '17

Hi, After overcoming some initial more obvious problems I have still been unable to get this client's stunnel configured correctly. "No certificate or private key specified" - is this significant? Stunnel.conf looks like the below: debug = 2 output = stunnel.log CAfile=.\ca-verisign.crt client=yes verify=0 sslVersion = TLSv1.2 options = NO_SSLv2 options = NO_SSLv3 [TRD] accept=16002 connect= our.ip.com:443 [INV] accept=16003 connect= our.ip.com:443 Stunnel output log below 2017.10.12 10:53:22 LOG7[main]: Found 1 ready file descriptor(s) 2017.10.12 10:53:22 LOG7[main]: FD=276 ifds=r-x ofds=--- 2017.10.12 10:53:22 LOG7[main]: FD=284 ifds=r-x ofds=--- 2017.10.12 10:53:22 LOG7[main]: Dispatching signals from the signal pipe 2017.10.12 10:53:22 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2017.10.12 10:53:22 LOG7[main]: Running on Windows 6.1 2017.10.12 10:53:22 LOG5[main]: Reading configuration from file stunnel.conf 2017.10.12 10:53:22 LOG5[main]: UTF-8 byte order mark detected 2017.10.12 10:53:22 LOG5[main]: FIPS mode disabled 2017.10.12 10:53:22 LOG7[main]: Compression disabled 2017.10.12 10:53:22 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2017.10.12 10:53:22 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2017.10.12 10:53:22 LOG7[main]: PRNG seeded successfully 2017.10.12 10:53:22 LOG6[main]: Initializing service [TRD] 2017.10.12 10:53:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.10.12 10:53:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.10.12 10:53:22 LOG7[main]: No certificate or private key specified 2017.10.12 10:53:22 LOG4[main]: Service [TRD] needs authentication to prevent MITM attacks 2017.10.12 10:53:22 LOG6[main]: Initializing service [INV] 2017.10.12 10:53:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.10.12 10:53:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.10.12 10:53:22 LOG7[main]: No certificate or private key specified 2017.10.12 10:53:22 LOG4[main]: Service [INV] needs authentication to prevent MITM attacks 2017.10.12 10:53:22 LOG5[main]: Configuration successful 2017.10.12 10:53:22 LOG7[main]: Closing service [TRD] 2017.10.12 10:53:22 LOG7[main]: Service [TRD] closed (FD=284) 2017.10.12 10:53:22 LOG7[main]: Service [TRD] closed 2017.10.12 10:53:22 LOG7[main]: Closing service [INV] 2017.10.12 10:53:22 LOG7[main]: Service [INV] closed (FD=276) 2017.10.12 10:53:22 LOG7[main]: Service [INV] closed We tried giving the certification a hard location but still it seems unable to find it. Is there anything in the cfg you can see missing? Bearing in mind this is standard cfg for our clients connecting in. Kind regards, Hugo Darley The information contained in and accompanying this communication is strictly confidential and intended solely for the use of the intended recipient(s). If you have received it by mistake please let us know by reply and then delete it from your system; you should not copy the message or disclose its content to anyone. MarketAxess reserves the right to monitor the content of emails sent to or from its systems. Any comments or statements made are not necessarily those of MarketAxess. For more information, please visit www.marketaxess.com. MarketAxess Europe Limited is authorised and regulated by the UK Financial Conduct Authority, registered in England no. 4017610, registered office at 5 Aldermanbury Square, London EC2V 7HR. Telephone (020) 7709 3100. MarketAxess Corporation is regulated in the USA by the SEC and FINRA, incorporated in Delaware, executive offices at 299 Park Avenue, New York, NY 10171. Telephone (1) 212 813 6000.

1 0

OpenService: Error 1060: The specified service does not exist as an installed service.
by Hugo Darley 09 Oct '17

09 Oct '17

User has recently installed v5.4.2 on a windows machine and gets this error: [cid:[email protected]] Downloaded the .exe file from the website, installed into a D: drive folder (not the C: program files x86 folder), edited the config file to what we have advised countless users in the past and added the verisign crt to the same folder. Has reinstalled a couple of times to no avail. I have searched on the net for help but nothing specific to STunnel. Can anyone advise? Many thanks Hugo The information contained in and accompanying this communication is strictly confidential and intended solely for the use of the intended recipient(s). If you have received it by mistake please let us know by reply and then delete it from your system; you should not copy the message or disclose its content to anyone. MarketAxess reserves the right to monitor the content of emails sent to or from its systems. Any comments or statements made are not necessarily those of MarketAxess. For more information, please visit www.marketaxess.com. MarketAxess Europe Limited is authorised and regulated by the UK Financial Conduct Authority, registered in England no. 4017610, registered office at 5 Aldermanbury Square, London EC2V 7HR. Telephone (020) 7709 3100. MarketAxess Corporation is regulated in the USA by the SEC and FINRA, incorporated in Delaware, executive offices at 299 Park Avenue, New York, NY 10171. Telephone (1) 212 813 6000.

1 1

Re: [stunnel-users] Need some info
by Heinsbroek, Peter 09 Oct '17

09 Oct '17

I know. I have a module that reads and writes the pin encrypted from/into a disk file. Till stunnel 5.38 it worked via engine_pkcs and now I try to build it into stunnel. I works ,but the only thing now is where to store the pin after decrypting it. __________________ With regards Peter Heinsbroek Tel. +31 (0)88 265 9869 -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Malgorzata Olszówka Sent: Thursday, October 05, 2017 3:03 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Need some info W dniu 05.10.2017 o 14:39, Heinsbroek, Peter pisze: > How can I get the pin info from the config file entry “engineCtrl = > PIN:12345” into a variable in the ctx.c source With regards, Peter > Heinsbroek SQL & Unix Administrator Hello Peter, This is an example pin to the SoftHSM token. Regards, Malgorzata Olszowka _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Professional support agreement
by alper erbakan 07 Oct '17

07 Oct '17

Hi, I am trying to find a company that willing to glve professional support for stunnel Windows version. I tried to reach from stunnel.org e-mail addresses is not working. Would you please help? Best regards iPhone'umdan gönderildi

2 1

Comments on daily DH Parameters regeneration...
by Taed Wynnell 06 Oct '17

06 Oct '17

We've been experiencing pain due to the daily STunnel regeneration of the DH Parameters. On our single-core machines in the field, this process will use 100% of the CPU for possibly an extended time. This interferes with other tasks that the machine is intended for. What's odd is that this process time ranges wildly, ranging from as low as 3 seconds to 90 minutes, even on the same machine. We see this behavior on all (thousands) of our machines, now that we know what to look for (the "Cron jobs completed in" trace in stunnel.log). We now know that we can set the DH Parameters in the configuration file, and that's what we'll be doing going forward. (Unless someone has another idea to offer.) I'd like to suggest some ideas for the future since I've seen on the mailing list that there are others who have run into this issue: * If the DH Parameter regeneration would run at Idle priority instead of Normal priority, it would not be nearly as noticeable, in that the CPU usage would still be there, but it wouldn't impact other services. The recomputation may be done in a separate thread, if so, this is straight-forward. * If there were a configuration file parameter to specify the regeneration interval. It would default to 24 hours (which is the current behavior), but could be set to a longer interval, a shorter interval for extreme security, or even to never. STunnel would still regenerate at the time of the service starting, unless a fixed DH is found in the configuration file. If a fixed DH were specified in the configuration file, that would avoid the service start computation and the interval would default to never. If both a fixed DH and the interval were specified in the configuration file, it would use the specified interval and recompute only after that interval.

1 0

Need some info
by Heinsbroek, Peter 05 Oct '17

05 Oct '17

How can I get the pin info from the config file entry “engineCtrl = PIN:12345” into a variable in the ctx.c source With regards, Peter Heinsbroek SQL & Unix Administrator Tel. +31 (0)88 265 9869 Mob. +31 6 5375 3244 Werner von Siemensstraat 3 2712 PN Zoetermeer, Nederland Org. unit B&PS-BTN/NL-TS-PS Central Unit 04 Email peter.heinsbroek(a)atos.net<mailto:[email protected]> Web www.nl.atos.net<UrlBlockedError.aspx> Atos IT Solutions and Services B.V. Comm. Register The Hague no. 27380688 This e-mail is intended exclusively for the addressee(s), and may not be forwarded or made available for use to any person other than the addressee(s). If you are not the intended recipient, please notify the sender thereof and destroy/delete the message. The sender disclaims any liability as regards (the content of) this e-mail. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Using Chrome directly as an STunnel Client to connect to an STunnel Server
by Dipen Doshi 05 Oct '17

05 Oct '17

Hello, I am new to STunnel and I am running into a problem. Here is my setup. I use an ASUS router with Merlin firmware. I have STunnel installed via Entware on this router. Running "stunnel -version" gives me: stunnel 5.41 on mipsel-openwrt-linux-gnu platform Compiled/running with OpenSSL 1.0.2k 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: RNDbytes = 64 RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:!DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------------------------------------------------------------------- I use my own server certificate signed by my own CA. This cert has the proper SANs with correct DNS/IP entries. I use this server certificate both for my router's HTTPS web gui and for the "cert" and "key" files listed in the config file below. Also, the "CAfile" in the config is pointing to my Root CA's certificate. My Root CA is also imported in my Windows box's certificate store. I can directly access my router's web gui from LAN side via these ports: 80 (HTTP), 2000 (HTTPS). Router's LAN subnet is 10.49.49.0/24 and the router's WAN IP is 10.76.5.3 (it is double NAT for testing, this router is for testing) Also, STunnel is running as a server accepting connections on port 443 (all interfaces) on the router. ------------------------------------------------------------------------------------------- I want to use Chrome directly as an STunnel client on my Windows box. So, I don't run STunnel on my Windows box in the client mode. SITUATION 1: WORKS FINE!! -- PURPOSE: Use Chrome to connect to "https://WAN_IP:443" This should forward to the router's port 80 (HTTP protocol used). My STunnel config file on the router has: setuid = nobody setgid = nobody foreground foreground = yes syslog = yes debug = 7 [Test-Service] accept = 443 connect = 10.49.49.1:80 requireCert = yes verifyChain = yes CAfile = /mnt/Merlin/entware/etc/stunnel/ca.crt cert = /mnt/Merlin/entware/etc/stunnel/server.crt key = /mnt/Merlin/entware/etc/stunnel/server.key SITUATION 2: DOES NOT WORK!! -- PURPOSE: Use Chrome to connect to "https://WAN_IP:443" This should forward to the router's port 2000 (HTTPS protocol used). There is only one change from the Situation 1 config file. The line for "connect" changed to "connect = 10.49.49.1:2000) This does not work. Note that I can directly access my router's web gui over https with "https://LAN_IP:2000" via Chrome, with no warnings. ------------------------------------------------------------------------------ My thoughts: So, my current path is Chrome (Acting as STunnel Client) --> STunnel Server (on the router) --> Router's Web GUI. The "Chrome --> STunnel" Server connection is fine. Chrome prompts for private key and STunnel server correctly shows this incoming Chrome connection. The problem is the "STunnel Server --> Router" relay that uses HTTPS protocol. 1. STunnel does not like HTTPS to HTTPS relay. HTTP to HTTPS works, but not HTTPS to HTTPS. 2. STunnel server on my router is a client to my router's web gui. Is STunnel verifying the certificate of my router's HTTPS certificate? 3. If the above answer is yes, my guess is that STunnel sees a self signed certificate for this router and kills the connection? 4. How do I tell STunnel server to ignore certificate warnings for a remote connection, like when connecting to this router? 5. Or how do I explicitly tell STunnel to trust my Root CA while making this connection to my router? I couldn't find any options in STunnel for this. Regards, Dipen Doshi

2 3

Missing librairies
by Heinsbroek, Peter 26 Sep '17

26 Sep '17

I’m getting unresolved external symbol errors. I like to know what library I need for s_log. log.obj : error LNK2019: unresolved external symbol _stunnel_process_id referenced in function _log_id log.obj : error LNK2019: unresolved external symbol _stunnel_thread_id referenced in function _log_id log.obj : error LNK2019: unresolved external symbol _file_open referenced in function _log_open log.obj : error LNK2019: unresolved external symbol _file_close referenced in function _log_close log.obj : error LNK2019: unresolved external symbol _file_putline referenced in function _log_raw log.obj : error LNK2019: unresolved external symbol _tls_alloc referenced in function _s_log str.obj : error LNK2001: unresolved external symbol _tls_alloc log.obj : error LNK2019: unresolved external symbol _tls_get referenced in function _s_log str.obj : error LNK2001: unresolved external symbol _tls_get log.obj : error LNK2019: unresolved external symbol _ui_new_log referenced in function _log_raw log.obj : error LNK2019: unresolved external symbol _message_box referenced in function _fatal_debug log.obj : error LNK2019: unresolved external symbol _global_options referenced in function _log_open log.obj : error LNK2019: unresolved external symbol _stunnel_locks referenced in function _log_close str.obj : error LNK2001: unresolved external symbol _stunnel_locks str.obj : error LNK2019: unresolved external symbol _num_clients referenced in function _leak_threshold str.obj : error LNK2019: unresolved external symbol _number_of_sections referenced in function _str_leak_debug str.obj : error LNK2019: unresolved external symbol _tls_initialized referenced in function _str_stats __________________ With regards Peter Heinsbroek Tel. +31 (0)88 265 9869 This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Bug: Modifying configure.ac results in error
by Reschke, Sven (VWIF G-TS/P) 22 Sep '17

22 Sep '17

Hallo, I've encounter a problem when editing the configure.ac. I've upgraded to Stunnel 5.42, the problem wasn't existent with Stunnel 5.41. The normal operation is that "./configure" and "make" will run without an error. So far, so good. Now, if I edit the configure.ac, running again "./configure" and "make", "make" will report: CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/sh <path_to_stunnel_sources>/stunnel-5.42 /auto/missing aclocal-1.14 -I m4 cd . && /bin/sh <path_to_stunnel_sources>/stunnel-5.42 /auto/missing automake-1.14 --gnu CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/sh <path_to_stunnel_sources>/stunnel-5.42 /auto/missing autoconf configure.ac:4: error: possibly undefined macro: AC_MSG_NOTICE If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. configure.ac:23: error: possibly undefined macro: AC_DEFINE make: *** [configure] Error 1 Here it doesn't matter what I change in configure.ac. Even the slightest modification results in the error. After some investigation, running "make" with "-d" showed that it will call auto/missing, because of the newer version of configure.ac. Comparing aclocal.m4 before and after calling "make" shows, that mainly the lines added between the version 5.41 and 5.42 are missing now (lines #23 - #741). As I'm not so familiar with the whole compile process, I found a simple hack, which solves the problem for the moment: Adding these missing lines to a new file named m4/acinclude.m4. After that, compiling, installing and running Stunnel works fine. Can someone verify? If you have questions, I'll try my best to answer them :) Best Regards, Sven Reschke Embedded System SW Developer G-TS/P

1 0

Help with connectivity issue
by Rob Allen 15 Sep '17

15 Sep '17

I’ve installed stunnel on an Amazon EC2 instance: stunnel 4.56 on x86_64-redhat-linux-gnu platform Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP Global options: debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none I’ve created the stunnel.conf file: [smtp-tls-wrapper] accept = 2525 client = yes connect = email-smtp.us-west-2.amazonaws.com:465 protocol=smtp delay = yes I’ve tested the connection to SES (successfully) via openssl: [ec2-user@ip-172-31-4-68 ~]$ openssl s_client -quiet -crlf -connect email-smtp.us-west-2.amazonaws.com:465 depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5 verify return:1 depth=1 C = US, O = Symantec Corporation, OU = Symantec Trust Network, CN = Symantec Class 3 Secure Server CA - G4 verify return:1 depth=0 C = US, ST = Washington, L = Seattle, O = "Amazon.com, Inc.", CN = email-smtp.us-west-2.amazonaws.com verify return:1 220 email-smtp.amazonaws.com ESMTP SimpleEmailService-2370111491 wa7VtNk9b7c4TX0jNpdG But when I try to access through stunnel via localhost with telnet, I get this: [ec2-user@ip-172-31-4-68 ~]$ telnet localhost 2525 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. I’ve tried everything I can think of; I’ve read all the blogs and pages related to connecting from ec2 to SES via stunnel and I just can’t get it to work. Does anyone have any suggestions for other things I could try? Thanks in advance, Rob Allen, CPO Software Engineer | Eyefinity NOTICE: This message is intended only for the individual to whom it is addressed and may contain information that is confidential or privileged. If you are not the intended recipient, or the employee or person responsible for delivering it to the intended recipient, you are hereby notified that any dissemination, distribution, copying or use is strictly prohibited. If you have received this communication in error, please notify the sender and destroy or delete this communication immediately.

2 2

Stunnel Config Error
by Jay Jenney 21 Aug '17

21 Aug '17

Trying to see why Stunnel like this config file (attached) for an office365 email account [cid:[email protected]] Harriscomputer Register today<http://www.harriscomputer.com/en/conference/> for HCTC2017 - Early Bird deadline is August 31! Jay Jenney Support Specialist P: 800-274-2911 x64272 F: E: jjenney(a)caliberpublicsafety.com [cid:Caliber_PS_left_CMYK_247aef3c-9961-4e6c-a9f4-053e52f0093f.jpg] , Iowa www.caliberpublicsafety.com<http://www.caliberpublicsafety.com> This message has been sent on behalf of a company that is part of the Harris Operating Group of Constellation Software Inc. These companies are listed at the following link: http://subscribe.harriscomputer.com Unsubscribe Option: If you do not wish to receive any future email, please unsubscribe by clicking on the following link:http://subscribe.harriscomputer.com This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.

1 0

stunnel w & w/o data compression
by Daniele Basaldella 18 Aug '17

18 Aug '17

Dear all, I use stunnel in clinet configuration to get data feeds from several sources. Until now none of them requested data compression, so the configuration was easy. Now I need to connect to a new data feeder that requires zlib compression. I found the compression method is a global setting, so it will be not compatible with current setup. The server runs Ubuntu 16.04LTS, ker 4.4.0.92.lowlatency, stunnel 5.30, openssl 1.0.2.g. I looked for a solution on internet but seems no one have my issue. Someone could suggest how to get both compressed/uncompressed data feed connections on same system. Thank you Best Regards Daniele

2 1

Timeout issue I think
by Ben Bazian 16 Aug '17

16 Aug '17

I have a legacy server that uses IMAP but does not support TLS. I am using stunnel and since implementation I am getting errors when an email has a larger attachment. My application process these attachments and when done (sometimes can take 5-10 minutes) it marks the message for deletion. When all messages are completed it purges the emails from the box. My app is throwing an error when it tries to delete the message (see below). I think it may be due to stunnel closing the connection to the server? Not quite sure. javax.mail.FolderClosedException at com.sun.mail.imap.IMAPMessage.getProtocol(IMAPMessage.java:105) at com.sun.mail.imap.IMAPMessage.loadEnvelope(IMAPMessage.java:941) at com.sun.mail.imap.IMAPMessage.getSubject(IMAPMessage.java:238) at com.softlinx.docurouter.source.email.EmailSourceConnector.processMess ages(EmailSourceConnector.java:1213) at com.softlinx.docurouter.source.email.EmailSourceConnector.process(Ema ilSourceConnector.java:1455) at com.softlinx.docurouter.source.email.EmailSourceConnector.main(EmailS ourceConnector.java:1622) My configuration is pretty simple. I saw somewhere that I could put a timeoutidle on the connector but that does not seem to help. Any ideas are appreciated. Here is the config. # Stunnel configuration file for Office 365 SMTP and POP3 # Author: MessageOps, www.messageops.com<http://www.messageops.com> # GLOBAL OPTIONS client = yes output = /etc/stunnel/stunnel-log.txt debug=3 # taskbar=yes # SERVICE-LEVEL OPTIONS [POP3 Incoming] accept = 110 connect = outlook.office365.com:995 timeoutidle = 14400 [SMTP Outgoing] protocol = smtp accept = 25 connect = outlook.office365.com:587 [IMAP] accept = 143 connect = outlook.office365.com:993 timeoutidle = 14400 Here is a printout of the global options. Global options: debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -Ben

1 0

logging real client IP in Apache
by Stoyan Stoyanov 07 Jul '17

07 Jul '17

I have an Apache server serving only HTTP requests on port 80 and an stunnel daemon on the same server listening on port 443 and tunneling HTTPS requests to Apache. Is there a way for the client IP to be passed on to Apache so that I can capture and log that instead of the IP of stunnel, which in this case is 127.0.0.1? Ability to add a variable to the HTTP header would be perfect, but any other suggestions to solve this problem are welcome. Thanks! Stoyan

2 2

Error on startup of Stunnel
by Shelstone Lorde 30 Jun '17

30 Jun '17

I installed version 5.41, the latest version, on a Windows 10 Pro machine. I placed a link to the Stunnel.exe file in the Startup folder. I am getting the error "The ordinal 3253 could not be located in the dynamic link library c:\Users\...Programs\Startup\stunnel.exe". May be there has been a previous posting concerning this error but I have not been able to find it. Any help or suggestion will be appreciated. Thanks.

1 0

Re: [stunnel-users] Stunnel Connectivity Issue
by Ludolf Holzheid 13 Jun '17

13 Jun '17

On Tue, 2017-06-13 22:51:27 +0530, Dheeraj Gautam wrote: > Hi Browne, > > > > I am not understand like what config I have to do in stunnel config file. > > > > As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port. > Dheeraj, I'm afraid you confused the directions: In you configuration file, you told Stunnel to accept connections on localhost, port 9233 ("accept = 127.0.0.1:9233"). Then, you told Stunnel, if such a connection is accepted, to connect to a remote server at port 8228 ("connect = 69.191.198.34:8228"). As long as both connections are established, Stunnel will forward data from localhost to 69.191.198.34 and vice versa, while encrypting the data in the localhost -> 69.191.198.34 direction and decrypting the data in the opposite direction (69.191.198.34 -> localhost). With this setup, a client program (such as Thunderbird) sends and receives plain-text data to/from a Stunnel instance on the same machine, while a server program on a remote machine (such as the Google mail server) sends and receives encrypted data to/from Stunnel. Is this about the setup you have in mind? Is your application server or client? Does it send and receive plain-text data or encrypted data? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Configuring stunnel and openssl on Windows to support TLS 1.2
by Liz Turi 13 Jun '17

13 Jun '17

Good morning, I'm hoping you can help point me in the right direction. The problem I'm trying to solve is enabling TLS 1.2 connections on a Windows (environment has both Windows 2008 and Windows 10 environments) platform. Currently, my private keys are managed by the Windows certificate store, using the capi engineId within stunnel (v 5.41), which uses OpenSSL 1.0.1. Because of this, stunnel can only negotiate a TLS 1.1 connection. I've tried compiling OpenSSL 1.1.0f and stunnel 5.41, but no luck either cross compiling under CentOS, nor under Windows using either MSYS2/MINGW32 or Cygwin. What I'm looking for is any one of the following 1) solid current cross-compiling examples or references 2) solid current Windows compiling examples or references using extant versions 3) a way to manage the pfx/p12 (private key) in stunnel without resorting to the Windows certificate store. Option 3 is preferred. I see how to manage pkcs11, but not pkcs12. Thank you in advance! Liz Turi Sr. Consultant Massachusetts eHealth Collaborative 860 Winter Street, Waltham, MA 02451 (m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589 www.maehc.org<http://www.maehc.org> [fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=ty…>[tw_icon]<https://twitter.com/MAeHC_org> CONFIDENTIALITY NOTICE The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

1 1

Memleak sTunnel Win32 5.41 ?
by Dod 12 Jun '17

12 Jun '17

Hello, I just noticed that stunnel memory usage is growing slowly but surely using 5.41 on Win7 64 Bits. Using a few POP3 SSL tunnels. Now it is using 290MB memory I don't know if it is since 5.41 (didn't pay attention). Is there a way to trace/log something that could be useful ? (apart from the process memory usage curve that I guess will not help). regards.

1 0

TLS-SRP patch
by Kevin Sheldrake 06 Jun '17

06 Jun '17

Hello I recently produced a patch that permits use of TLS-SRP; it is based on the TLS-PSK code and this blog post: https://matthewarcus.wordpress.com/2014/05/10/srp-in-openssl/ It’s not the cleanest of code but it does work as a POC. The patch is available here: https://github.com/rtfcode/tls-srp The README.txt provides some info on testing the patch and how it might be used to help dev web browsers and servers that support TLS-SRP (for IoT work). There is a page on the forthcoming OWASP Summit ‘TLS for Local IoT’ workshop (for which it was developed) at: https://owaspsummit.org/Working-Sessions/IoT/TLS-for-Local-IoT.html In terms of using TLS-SRP support in stunnel as a proxy, it might be useful as a replacement for TLS-PSK where the credentials are user-memorable (pass phrase, for example) as TLS-SRP has lower entropy requirements than TLS-PSK. For example, the creds could be stored in the user’s head rather than in a file and be less open to compromise if a device was seized. I don’t know if that’s useful for anyone; it’s just a thought. Thanks Kev

1 0

Connect to sub-directory path
by Shamim Uz Zaman 25 May '17

25 May '17

Hi Looking for an example to connect to subdirectory path such that [connect] client = yes accept = 127.0.0.1:441 connect = xxx.website.com:443/Connect/topath verifyChain = yes verifyPeer=yes CAfile = ca-certs.pem checkHost = xxx.mywebsite.com OCSPaia = yes When I only use xxx.mywebsite.com:443 it works. However, below three url gives TCP error (Unknown TCP service) xxx.mywebsite.com:443/Connect/topath xxx.mywebsite.com/Connect/topath https://xxx.mywebsite.com/Connect/topath My proxy connection requires to translate to the directory path of the domain. Regards, *Shamim Zaman*

2 1

Stunnel Connectivity Issue
by Dheeraj Gautam 24 May '17

24 May '17

Hi Team, We are using 5.41 release of Stunnel software to establish TCP connection with remote server using by TLSV1.2 protocol. Enclosed configuration file wherein we are trying to establish TCP connection with one my server along with provided certificate and key which are pointed in config file. Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server. Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not, below is the artifact for your easy ref. Could you please help us here to resolve this issue. Regards, Dheeraj Gautam -- www.arborfs.com This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged. It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail. Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

1 0

Stunnel on Suse 8.1, connections refused, pid remains
by InvalidPath 09 May '17

09 May '17

So I have this server, I can start stunnel via /etc/rc.d/stunnel start. The pid is there as witnessed by ps -aux | grep stunnel, I have 4 customers that access this server. The customers pull data files that contain certain client records. Anyway my test user connects to the server and is able to pull a handful of files before their process begins timing out. When this happens I can no longer SSH to the host without restarting stunnel. Weird thing is, is that I can see the pid still running when this happens. I have the debug = 7 but the log files according to stunnel - version is set to a level of 5. No clue where it''s getting a 5 from. But I am unable to determine why or what is causing this. And it's starting to cost the company lost revenue. Any help would be greatly appreciated. Ben

1 0

Graceful config reload when -fd option was used
by z a 09 May '17

09 May '17

Hi, Since version 4.30, sending a HUP signal to a running stunnel process will cause it to gracefully reload with the given config file. Is there a way to accomplish this when the running stunnel process was started with the "-fd" flag as in the example below? cat foo.conf | stunnel-fd 0 I tried writing to /proc/$pid/fd/0 but that didn't work. I'm hoping someone here has overcome this issue and might be able to whisper a hint in my direction. I am on Centos 7.2. Thanks

1 0

Trouble with stunnel.conf (version 5.41)
by Mark Garciano 02 May '17

02 May '17

Hi Stunnel users, Any ideas why I get a "server down" message"? Below is the conf file: ;--------------------------------------------------------------------------- ; ************************************************************************** ; * Global options * ; ************************************************************************** ; ; Debugging stuff (may useful for troubleshooting) debug = 7 output = stunnel.log ;Disable FIPS mode to allow non-approved protocols and algorithms fips = no ;************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 key = stunnel.pem cert = stunnel.pem client = yes accept = 5001 connect = XXXXXXXXXXX.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 ;--------------------------------------------------------------------------- HERE IS THE LOG WINDOW MESSAGE: [!] Server is down [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing inetd mode configuration [!] Service [(null)]: 'accept' option is only allowed in a [section] Mark Garciano Systems Programmer II USC Libraries Integrated Library Systems 213-740-3568

2 1

Re: [stunnel-users] Help in setting stunnel in client mode to connect webservice in mutual authentication
by Chokkalingam, Jothish 28 Apr '17

28 Apr '17

Hi Can you help in sorting it out below scenario We have a URL whose TLS is 1.0 and now it is being upgraded to 1.2. Since the current application doesn't support V1.0 I am planning to use stunnel in between to fix the gap. Can you help if my below config is correct or not. The communication between client and server is MASSL(mutual authentication SSL) [Billpay46200] client = yes CApath = /apps/bss/CCBTrustStore-->trust store where the remote webservice certificates are stored in cert format accept = 46200-->port configured from client machine to connect using http connect = xxx.in.xxx.com.au:46200-->port where the incoming http request need to be changed from http to https cert = /stunnel/bin/client.pem-->identity certificate used for client key = /stunnel/bin/key.pem-->corresponding key for the above identity certificate. While hitting using the URL http://localhost:46200 it is shown in stunnel log as below 2017.04.28 17:17:51 LOG5[2627:3]: Billpay46200 accepted connection from 127.0.0.1:58382 2017.04.28 17:17:51 LOG5[2627:3]: Billpay46200 connected remote server from 10.116.194.24:58383 2017.04.28 17:17:51 LOG3[2627:3]: SSL_connect: Peer suddenly disconnected 2017.04.28 17:17:51 LOG5[2627:3]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

1 0

Remove session callback
by Florian Gossin 19 Apr '17

19 Apr '17

Hi, I have updated to the latest 5.41 version. I was troubleshooting another problem and I discovered dozens of lines in the log file with "Remove session callback, Deallocating application specific data for session connect address": 2017.04.19 14:49:49 LOG7[17483]: Service [pgbouncer-client] started 2017.04.19 14:49:49 LOG7[17483]: Option TCP_NODELAY set on local socket 2017.04.19 14:49:49 LOG5[17483]: Service [pgbouncer-client] accepted connection from x.x.x.x:36018 2017.04.19 14:49:49 LOG6[17483]: Peer certificate required 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): before/accept initialization 2017.04.19 14:49:49 LOG7[17483]: SNI: no virtual services defined 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 read client hello A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write server hello A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write change cipher spec A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write finished A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 flush data 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 read finished A 2017.04.19 14:49:49 LOG7[17483]: Remove session callback 2017.04.19 14:49:49 LOG7[17483]: Deallocating application specific data for session connect address 2017.04.19 14:49:49 LOG7[17483]: Remove session callback 2017.04.19 14:49:49 LOG7[17483]: Deallocating application specific data for session connect address ... Can anyone explain me what it is about ? Thank you, Florian

1 0

Windows Server 2012 stunnel service
by Adam Shackleton 18 Apr '17

18 Apr '17

Hi All I'm running stunnel on Windows Server 2012 R2 with the following config: [test-qa] client = yes accept = 127.0.0.1:8080 connect = webaddress.com:443 cert = API-q-response.pfx CAfile = ca-certs.pem OCSPaia = yes When I start the GUI I'm prompted for the certificate password then and then stunnel works fine, but I need it to run as a service. I've tried using the start menu stunnel Service Install button, I've also tried opening a command prompt in C:\Program Files (x86)\stunnel\config and running C:\Program Files (x86)\stunnel\bin\stunnel.exe -install, and I've also tried moving the config file and certs to the \bin directory and running stunnel -install there as well. In all case the service installs ok, and when you run it, it starts (I can see it in the services tool), you can click the stunnel Configuration File Reload button in the start menu and it says the configuration was successfully reloaded, but it doesn't work when I try to use it. I've noticed two things that might be relevant: 1. At no point does it prompt me for the certificate password like it does when I load the GUI 2. The dialog boxes that open when the service is installed or started say "stunnel 5.40 on Win32 (not configured) [cid:[email protected]] If anyone has any advice that would be greatly appreciated. Thanks Adam

2 1

SOCKS connection to the IPv4 loopback rejected.
by Robert de Bath 15 Apr '17

15 Apr '17

Hi everyone, How do I get rid of this message? I have a stunnel server setup on a remote machine using the socks protocol. I use two keys plus the certificates and a private CA to protect the SSL link. On a local machine I have an stunnel client running without a protocol option set. If I try to make a socks connection to an interface IP of the remote server it works perfectly, bypassing the intervening firewalls through the protected tunnel. But the interface IP changes and I only want to allow connections to the remote server through the tunnel. I could setup traditional tunnels, but while one of the services (remote desktop to the Windows server) is constant the others are dynamically configurable. I have even considered using SNI to distinguish the incoming connections to the various services but while this allows there to be just one tunnel port it will still need a remote reconfiguration of stunnel every time a service port is added or removed. The best way to express this limit is that the socks server should ONLY connect to localhost; but it's "rejected". In actual operation I will probably need to allow the local network too which will probably be an rfc1597 address. Looking at the source it appears that this condition is hard coded into the "validate" function so my question becomes: can you please remove this or add a flag to turn it off? -- Robert de Bath robert(a)tvisiontech.co.uk

1 0

Configure Error
by Kenway Ng 12 Apr '17

12 Apr '17

Hi I am running into an issue when I go into the src directory and I run the configure command, I get configure: error: Could not find your TLS library installation dir Use --with-ssl option to fix this problem I am trying to upgrade our version of stunnel. Our SME left and now I am trying to upgrade stunnel to fix a vulnerability . I am being told to use TLS1.1 or higher Here is our current version of stunnel $ ./stunnel -version stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Any help would be appreciated. Kenway

1 0

PSK, verifying the client
by Mike 05 Apr '17

05 Apr '17

Is it possible to verify the client using PSK? On the stunnel server I specify a PSKsecrets file with two lines in it, one for client01 and one for client02. The secret is about 36 characters long. On a client, I have a similar PSKsecrets file, but only containing the client01 line. Now, if I try to connect with, say, a client03, i.e., any client that does not have a matching line in the server's PSKsecrets file, how can I assure that the client connection will be rejected? What I'd like to see would be the following: any client that tries to connect, and does not present a PSK that is present in the server's PSKsecrets file, then that client's connection request is rejected, with an appropriate message logged. Can I do that with the current stunnel? thx.

1 0

Scan to email failure: RapbianPi3 to Office365
by Graeme Ellisson 03 Apr '17

03 Apr '17

Hi. I recently bought a Pi3 and have loaded Raspbian with Doobs (Previously I had this running faultlessly under a Windows Server for my Canon multi function printer that does not support SSL/TLS but only authentication). After about 8 attempts to get Stunnel4 working (there doesn't seem to be a later version to install via the command line) I eventually found that Stunnel4 works fine as long as one doesn't update Dabian from the initial Doobs install. So, I now have the service running and listening on port 25 with the following config file: debug=7 output=/etc/stunnel/stunnel.log client=yes options=NO_SSLv2 (I added this last night after reading a blog) [SMTP OUT] sslVersion=TLSv1 (I added this last night after reading a blog) protocol=smtp accept=25 connect=smtp.office365.com:587 On restarting the service I see the following which looks okay to my untrained eye: 2017.04.03 09:42:09 LOG7[3570]: Dispatching signals from the signal pipe 2017.04.03 09:42:09 LOG7[3570]: Processing SIGNAL_TERMINATE 2017.04.03 09:42:09 LOG5[3570]: Terminated 2017.04.03 09:42:09 LOG7[3570]: Closing service [SMTP OUT] 2017.04.03 09:42:09 LOG7[3570]: Service [SMTP OUT] closed (FD=7) 2017.04.03 09:42:09 LOG7[3570]: Service [SMTP OUT] closed 2017.04.03 09:42:09 LOG7[3570]: removing pid file /var/run/stunnel4.pid 2017.04.03 09:42:09 LOG7[3926]: Clients allowed=500 2017.04.03 09:42:09 LOG5[3926]: stunnel 5.06 on arm-unknown-linux-gnueabihf platform 2017.04.03 09:42:09 LOG5[3926]: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2017.04.03 09:42:09 LOG5[3926]: Running with OpenSSL 1.0.1t 3 May 2016 2017.04.03 09:42:09 LOG5[3926]: Update OpenSSL shared libraries or rebuild stunnel 2017.04.03 09:42:09 LOG5[3926]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD SSL:ENGINE,OCSP,FIPS Auth:LIB$ 2017.04.03 09:42:09 LOG7[3926]: errno: (*__errno_location ()) 2017.04.03 09:42:09 LOG5[3926]: Reading configuration from file /etc/stunnel/stunnel4.conf 2017.04.03 09:42:09 LOG5[3926]: FIPS mode disabled 2017.04.03 09:42:09 LOG7[3926]: Compression disabled 2017.04.03 09:42:09 LOG7[3926]: Snagged 64 random bytes from /dev/urandom 2017.04.03 09:42:09 LOG7[3926]: PRNG seeded successfully 2017.04.03 09:42:09 LOG6[3926]: Initializing service [SMTP OUT] 2017.04.03 09:42:09 LOG7[3926]: No private key specified 2017.04.03 09:42:09 LOG7[3926]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2017.04.03 09:42:09 LOG5[3926]: Configuration successful 2017.04.03 09:42:09 LOG7[3926]: Listening file descriptor created (FD=7) 2017.04.03 09:42:09 LOG7[3926]: Service [SMTP OUT] (FD=7) bound to 0.0.0.0:25 2017.04.03 09:42:09 LOG7[3927]: Created pid file /var/run/stunnel4.pid When sending a scan from the printer to an email address I see the following in the log file: 2017.04.03 10:00:05 LOG7[3927]: Service [SMTP OUT] accepted (FD=3) from 192.168.8.99:1085 2017.04.03 10:00:05 LOG7[3960]: Service [SMTP OUT] started 2017.04.03 10:00:05 LOG5[3960]: Service [SMTP OUT] accepted connection from 192.168.8.99:1085 2017.04.03 10:00:05 LOG6[3960]: s_connect: connecting 40.101.73.162:587 2017.04.03 10:00:05 LOG7[3960]: s_connect: s_poll_wait 40.101.73.162:587: waiting 10 seconds 2017.04.03 10:00:05 LOG5[3960]: s_connect: connected 40.101.73.162:587 2017.04.03 10:00:05 LOG5[3960]: Service [SMTP OUT] connected remote server from 192.168.8.33:59792 2017.04.03 10:00:05 LOG7[3960]: Remote socket (FD=9) initialized 2017.04.03 10:00:05 LOG7[3960]: <- 220 DB6PR07CA0179.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:05 LOG7[3960]: -> 220 DB6PR07CA0179.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:05 LOG7[3960]: -> EHLO localhost 2017.04.03 10:00:05 LOG7[3960]: <- 250-DB6PR07CA0179.outlook.office365.com Hello [46.208.253.189] 2017.04.03 10:00:05 LOG7[3960]: <- 250-SIZE 157286400 2017.04.03 10:00:05 LOG7[3960]: <- 250-PIPELINING 2017.04.03 10:00:05 LOG7[3960]: <- 250-DSN 2017.04.03 10:00:05 LOG7[3960]: <- 250-ENHANCEDSTATUSCODES 2017.04.03 10:00:05 LOG7[3960]: <- 250-STARTTLS 2017.04.03 10:00:05 LOG7[3960]: <- 250-8BITMIME 2017.04.03 10:00:05 LOG7[3960]: <- 250-BINARYMIME 2017.04.03 10:00:05 LOG7[3960]: <- 250-CHUNKING 2017.04.03 10:00:05 LOG7[3960]: <- 250 SMTPUTF8 2017.04.03 10:00:05 LOG7[3960]: -> STARTTLS 2017.04.03 10:00:05 LOG7[3960]: <- 220 2.0.0 SMTP server ready 2017.04.03 10:00:05 LOG6[3960]: SNI: sending servername: outlook.office365.com 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): before/connect initialization 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: 0 items in the session cache 2017.04.03 10:00:05 LOG7[3960]: 2 client connects (SSL_connect()) 2017.04.03 10:00:05 LOG7[3960]: 2 client connects that finished 2017.04.03 10:00:05 LOG7[3960]: 0 client renegotiations requested 2017.04.03 10:00:05 LOG7[3960]: 0 server connects (SSL_accept()) 2017.04.03 10:00:05 LOG7[3960]: 0 server connects that finished 2017.04.03 10:00:05 LOG7[3960]: 0 server renegotiations requested 2017.04.03 10:00:05 LOG7[3960]: 0 session cache hits 2017.04.03 10:00:05 LOG7[3960]: 0 external session cache hits 2017.04.03 10:00:05 LOG7[3960]: 0 session cache misses 2017.04.03 10:00:05 LOG7[3960]: 0 session cache timeouts 2017.04.03 10:00:05 LOG6[3960]: SSL connected: new session negotiated 2017.04.03 10:00:05 LOG6[3960]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES128-SHA (128-bit encryption) 2017.04.03 10:00:05 LOG6[3960]: Compression: null, expansion: null 2017.04.03 10:00:10 LOG6[3960]: SSL socket closed (SSL_read) 2017.04.03 10:00:10 LOG7[3960]: Sent socket write shutdown 2017.04.03 10:00:10 LOG5[3960]: Connection closed: 23 byte(s) sent to SSL, 79 byte(s) sent to socket 2017.04.03 10:00:10 LOG7[3960]: Remote socket (FD=9) closed 2017.04.03 10:00:10 LOG7[3960]: Local socket (FD=3) closed 2017.04.03 10:00:10 LOG7[3960]: Service [SMTP OUT] finished (0 left) 2017.04.03 10:00:20 LOG7[3927]: Service [SMTP OUT] accepted (FD=3) from 192.168.8.99:1086 2017.04.03 10:00:20 LOG7[3961]: Service [SMTP OUT] started 2017.04.03 10:00:20 LOG5[3961]: Service [SMTP OUT] accepted connection from 192.168.8.99:1086 2017.04.03 10:00:20 LOG6[3961]: s_connect: connecting 40.101.72.194:587 2017.04.03 10:00:20 LOG7[3961]: s_connect: s_poll_wait 40.101.72.194:587: waiting 10 seconds 2017.04.03 10:00:20 LOG5[3961]: s_connect: connected 40.101.72.194:587 2017.04.03 10:00:20 LOG5[3961]: Service [SMTP OUT] connected remote serve from 192.168.8.33:57422 2017.04.03 10:00:20 LOG7[3961]: Remote socket (FD=9) initialized 2017.04.03 10:00:21 LOG7[3961]: <- 220 DB6PR07CA0014.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:21 LOG7[3961]: -> 220 DB6PR07CA0014.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:21 LOG7[3961]: -> EHLO localhost 2017.04.03 10:00:21 LOG7[3961]: <- 250-DB6PR07CA0014.outlook.office365.com Hello [46.208.253.189] 2017.04.03 10:00:21 LOG7[3961]: <- 250-SIZE 157286400 2017.04.03 10:00:21 LOG7[3961]: <- 250-PIPELINING 2017.04.03 10:00:21 LOG7[3961]: <- 250-DSN 2017.04.03 10:00:21 LOG7[3961]: <- 250-ENHANCEDSTATUSCODES 2017.04.03 10:00:21 LOG7[3961]: <- 250-STARTTLS 2017.04.03 10:00:21 LOG7[3961]: <- 250-8BITMIME 2017.04.03 10:00:21 LOG7[3961]: <- 250-BINARYMIME 2017.04.03 10:00:21 LOG7[3961]: <- 250-CHUNKING 2017.04.03 10:00:21 LOG7[3961]: <- 250 SMTPUTF8 2017.04.03 10:00:21 LOG7[3961]: -> STARTTLS 2017.04.03 10:00:21 LOG7[3961]: <- 220 2.0.0 SMTP server ready 2017.04.03 10:00:21 LOG6[3961]: SNI: sending servername: outlook.office365.com 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): before/connect initialization 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: 0 items in the session cache 2017.04.03 10:00:21 LOG7[3961]: 3 client connects (SSL_connect()) 2017.04.03 10:00:21 LOG7[3961]: 3 client connects that finished 2017.04.03 10:00:21 LOG7[3961]: 0 client renegotiations requested 2017.04.03 10:00:21 LOG7[3961]: 0 server connects (SSL_accept()) 2017.04.03 10:00:21 LOG7[3961]: 0 server connects that finished 2017.04.03 10:00:21 LOG7[3961]: 0 server renegotiations requested 2017.04.03 10:00:21 LOG7[3961]: 0 session cache hits 2017.04.03 10:00:21 LOG7[3961]: 0 external session cache hits 2017.04.03 10:00:21 LOG7[3961]: 0 session cache misses 2017.04.03 10:00:21 LOG7[3961]: 0 session cache timeouts 2017.04.03 10:00:21 LOG6[3961]: SSL connected: new session negotiated 2017.04.03 10:00:21 LOG6[3961]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES128-SHA (128-bit encryption) 2017.04.03 10:00:21 LOG6[3961]: Compression: null, expansion: null 2017.04.03 10:00:26 LOG6[3961]: SSL socket closed (SSL_read) 2017.04.03 10:00:26 LOG7[3961]: Sent socket write shutdown 2017.04.03 10:00:26 LOG5[3961]: Connection closed: 23 byte(s) sent to SSL, 79 byte(s) sent to socket 2017.04.03 10:00:26 LOG7[3961]: Remote socket (FD=9) closed 2017.04.03 10:00:26 LOG7[3961]: Local socket (FD=3) closed 2017.04.03 10:00:26 LOG7[3961]: Service [SMTP OUT] finished (0 left) At the end of this, no email is received. I can't tell from the above if the document is not being received by Stunnel from the printer or if Stunnel can not pass the document to Office365. It looks like TLSv1 is being negotiated and some data is being sent but then it closes the connection. Any help would be much appreciated. Regards, Graeme

2 1

Stunnel Version Vulnerability-Currently using 5.04
by Tracy Drake - IQGC-C 28 Mar '17

28 Mar '17

Hello Stunnel Users Forum! I wonder if anyone may have suggestions of what, if anything can be done to surmount a reported vulnerability for Stunnel versions prior to 5.34. I have limited savvy in this arena so please excuse this "Stunnel for Dummies" question. The following statements surfaced in a "security vulnerabilities" report... The version of stunnel installed on the remote host is 4.46 or later but prior to 5.34. It is, therefore, affected by a security bypass vulnerability related to the validation of level 4 peer certificates. An unauthenticated, remote attacker can exploit this to have an impact on confidentiality, integrity, and/or availability. No other details are available. I am of the mind that perhaps an entry in Stunnel.conf until we can deploy an upgrade? Thanks in advance for any feedback! Upgrade to stunnel version 5.34 or later. -- Tracy Drake CSM Senior Consultant GSA-FAS CAMEO Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

1 0

Multi source VPN connectivity
by Aykut SAY 24 Mar '17

24 Mar '17

Hi, We are working on a integration project and we need to connect our application to three different sources. These three sources have their own VPN. Can stunnel connect to three different vpn from one server? If yes, which version of stunnel we need to install to our server? Thanks, Aykut

1 0

stunnel public private key authentication like ssh
by Michael Power 23 Mar '17

23 Mar '17

Is there a way to configure stunnel just to check the public key of the provided certificate? I want authentication between the server and the client to take place by public key only, no PKI just like ssh. Is this possible? Is this verify level 4, or does that still check the CN against the host that I am connecting to? Michael Power

1 0