- stunnel-users - stunnel.org

Stunnel aborted the workflow silently in half way
by ygaochn＠amazon.com 25 Mar '22

25 Mar '22

Hey stunnel-users, We are using stunnel as the encryption transit between our NFS client and server. Recently we detected that the stunnel aborted the workflow silently in half way for unknown reason. We'd like to understand what could be the potential reason that cause the issue. Stunnel version: 4.56/5.56, below logs are for 4.56, 5.56 is from customer report without detail log Occurance #1: 2022.03.17 02:19:58 LOG7[1105:139990955783936]: connect_blocking: s_poll_wait IP:PORT: waiting 10 seconds # -> There should be a `TIMEOUTconnect exceeded` failure if the connection failed, but there is no info about how is the waiting going on, there is no log further 2022.03.17 02:56:09 LOG7[1105:139990955789440]: Dispatching signals from the signal pipe Occurance #2: 2022.03.23 16:10:49 LOG6[19003:140551554406144]: CERT: Host name "**" matched with "**" # Aborted again, this is the handshake phase 2022.03.23 16:56:09 LOG7[19003:140551554411648]: Dispatching signals from the signal pipe From the PCAP of the #2 occurance, there is no client side cert and key send to server side, so we can rule out the network issue. 8510 2022-03-23 16:09:47.660910 A B TLSv1.2 5507 Server Hello, Certificate[Packet size limited during capture] 8511 2022-03-23 16:09:47.660919 B A TCP 68 38390 → 2049 [ACK] Seq=340 Ack=5440 Win=57472 Len=0 TSval=698509941 TSecr=1821371384 ... No other client side packet send to server side afterwards, server side are waiting Does anyone encounter this before? I searched the archive but there is no similar issue. What could cause stunnel swallow all the subsequent workflow? Thanks.

1 0

Fix the expansion of @sysconfdir@ in the sample config file
by Peter Pentchev 19 Mar '22

19 Mar '22

Hi, Thanks a lot for writing and maintaining stunnel over the years! What do you think about the attached trivial patch that makes sure @sysconfdir@ is expanded correctly in the sample config file? If something should go wrong with the attachment, it is also available at: https://salsa.debian.org/debian/stunnel/-/blob/master/debian/patches/05-sam… Thanks in advance, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)debian.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

the stunnel stops showing the ssl after a few hours of operation
by Daniel Cordero Gonzalez 18 Mar '22

18 Mar '22

I send an image of the error presented by the stunnel

1 0

the stunnel stops showing the ssl after a few hours of operation
by daniel＠hostingtico.com 18 Mar '22

18 Mar '22

hello, thank you very much for the opportunity to humbly ask for help, I had a server with centos 6 for approximately 3 years and the stunnel never gave me any problem, I recently changed my server with centos 7 but now after a few hours of being active it stops showing the ssl in the ports that I have configured to show shoutcast when viewing the stunnel status: service stunnel status after a few hours it shows most of the result in red and there it does not show the shoutcast in ssl, after giving restart: service stunnel restart everything returns to normal but before 6 hours the problem returns, Could someone give me a light to solve this problem, I'm running the latest version of stunnel my stunnel.conf: client=no [Orto] accept=7000 connect=208.77.20.179:8006 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [radio] accept=7002 connect=208.77.20.179:9942 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [Metro] accept=7004 connect=208.77.20.179:8014 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [arrge] accept=7006 connect=208.77.20.179:8016 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [radio2] accept=7008 connect=208.77.20.179:9932 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [Radiored] accept=7010 connect=208.77.20.179:8023 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2

1 0

stunnel error message
by Stephen McQuaid 18 Mar '22

18 Mar '22

Hello, I am getting the following error message in stunnel 2022.03.18 14:27:01 LOG3[0]: SSL_read (s_ssl_read_eof): Operation would block (WSAEWOULDBLOCK) (10035) 2022.03.18 14:27:01 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket But when I send a second email immediately after the first one, it goes through ok, does anyone know how to resolve this please?? Regards, Stephen McQuaid Local I.T. Office, Dublin, Ireland Henkel dx - creating the next [Ein Bild, das Schild, Ende, sitzend, Front enth?lt. Automatisch generierte Beschreibung] Office : +353-1-4046338 Mobile: +353-87-2470012 stephen.mcquaid(a)henkel.com<mailto:[email protected]> www.henkeldx.com<http://www.henkeldx.com/> Have a question visit Digital Business Norden<https://henkelgroup.sharepoint.com/teams/IBSNITInfoPortal/SitePages/IBS-Nor…>

1 0

stunnel 5.63 released
by Michał Trojnara 15 Mar '22

15 Mar '22

Dear Users, I have released version 5.63 of stunnel. ### Version 5.63, 2022.03.15, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.2. * New features - Updated stunnel.spec to support bash completion. * Bugfixes - Fixed a PRNG initialization crash (thx to Gleydson Soares). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c74c4e15144a3ae34b8b890bb31c909207301490bd1e51bfaaa5ffeb0a994617 stunnel-5.63.tar.gz 723f54c28073f17b1ac095a2ab9922735c69f73fba6144a5c68cc160dc673b10 stunnel-5.63-win64-installer.exe c77850c39dfb42f95d26d4f5830a261a95c3785d8c39bdd9f28764ba43ee1d7d stunnel-5.63-android.zip Best regards, Mike

1 0

src/ssl.c:319 - RAND_get_rand_method() may return NULL
by Gleydson Soares 03 Mar '22

03 Mar '22

Hello, The following patch avoids crashess. In src/ssl.c:prng_init(), the RAND_get_rand_method() may return NULL so strict the check to skip PRNG initialization. Diff inline below, against 5.62 gsoares --- ssl.c.orig Thu Mar 3 16:10:39 2022 +++ ssl.c Thu Mar 3 16:13:17 2022 @@ -354,7 +354,7 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *global) { const RAND_METHOD *meth=RAND_get_rand_method(); /* skip PRNG initialization when no seeding methods are available */ - if(meth->status==NULL || meth->add==NULL) { + if(meth==NULL || meth->status==NULL || meth->add==NULL) { s_log(LOG_DEBUG, "No PRNG seeding methods"); return 0; /* success */ }

1 0

Error -63 when connecting to Office 365 to retrieve emails
by sedick＠logicore.co.za 01 Mar '22

01 Mar '22

Hi All, A problem started recently with error -63 when connecting to office 365 server to retrieve emails. The code I am using are as follows: * variables ChannelNo = 0 Pop3Server = 'outlook.office365.com' Pop3User = UserName Pop3Pass = Password Pop3Port = '995' ProxYServer = '127.0.0.1' ProxyPort = '110' ProxyDir = 'C:\see4OI\SSL\' ProxyExe = 'stunnel.exe' ProxyCert = 'stunnel.pem' * retreives mail in MIME format Gosub GET_EMAILS return Mail_Rec * ----------------------------------------------------------------------------------------- GET_EMAILS: * close previous session If it wasnt closed properly Code = seeClose(ChannelNo) Code = seeRelease() * attach key code Code = seeAttach(1, KeyCode) if Code < 0 then RetFlag = 1 return end * start stunnel Code = seeSetProxySSL(0, 1, ProxyDir, ProxyCert, ProxyExe) If Code < 0 Then RETURN end * connect to email server Code = seePop3ConnectSSL(ChannelNo, ProxyPort, Pop3Port, Pop3Server, Pop3User, Pop3Pass, ProxyServer) If Code < 0 Then RETURN End Help urgently required please. Stunnel version 5.42 with a special exception for OpenSSL Kind Regards, Sedick

1 0

SmtpConnectSSL question
by sportman7＠netzero.com 28 Feb '22

28 Feb '22

When I use SmtpConectSSL I establish the SSL connection but Stunnel opens a Stunnel window. I would like the connection to run without this window. Anyone know how I can stop the window from opening? Is there a setting in .conf or a parameter for SmtpConnectSSL I need?

1 0

Re: tunnel for IMAP/SMTP
by Eberhard 13 Feb '22

13 Feb '22

Just saying -- if something is deprecated it does not mean you MUST stop using it. Use an older version of the software. You can of course have both -- put the older version in one place and the newer one in another. Configure your system to use whichever version you need. The habit of always updating "just because" is sometimes not good for you 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com https://www.facebook.com/groups/286143052248115 -----Original Message----- From: Germano Massullo <germano.massullo(a)gmail.com> On Behalf Of Caterpillar Sent: Saturday, February 12, 2022 7:18 AM To: Josealf.rm <josealf(a)rocketmail.com> Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: tunnel for IMAP/SMTP Il 10/02/22 01:56, Josealf.rm ha scritto: > OK, I see you’re using stunnel only on your client and it looks you’re > connecting using TLS 1.0 which is deprecated. > > My proposed solution runs stunnel on your server and aims to implement > a front end proxy to the imap/smtp product. This can give you the > support for new TLS versions and no need to run stunnel on your clients. No, I don't have access to the mail server machine. I just installed stunnel on a localhost VM, then lowered the VM minimum accepted TLS to 1.0, and then run Thunderbird from host machine. The latter will connect to the stunnel running in the VM _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org

1 0

tunnel for IMAP/SMTP
by Caterpillar 12 Feb '22

12 Feb '22

Good day. I need to be able to use Thunderbird to connect to a mail server (IMAP/SMTP) that has an obsolete TLS version (1.1) and I don't want to low the TLS minimum version on my computers. For this need I would like to use stunnel between Thunderbid clients and the mail server. I tried to use tutorial [1] plus "sslVersion = all" option, but I think the guide is quite incomplete. Do you have any other guide/tutoral that is more complete? Thank you [1]: https://petermolnar.com/secure-smtp-and-imap-sessions-with-stunnel/

3 4

stunnel (5.62 and 5.59) causing high load...
by erik＠baigar.de 06 Feb '22

06 Feb '22

Hi there, I was running stunnel successfully for many years (4.26 with older openssl) wrapping http and imap and upgraded for security reasons to openssl 1.1.1 with stunnel 5.59. The platform is somewhat exotic: SPARC Solaris 10 using gcc 3.4.6. The stunnel works for imap and https without problems for some time but after heavy load conditions it starts consuming 100% CPU load although it still works. In this case it is not the DH computation as no ciphers depending on that one are used: 2022.02.06 11:56:33 LOG6[ui]: DH initialization skipped: no DH ciphersuites On the life machine it happens e.g. after some script based port scan attacks and in a way to trigger the phenomenon I found, that running a cipher enumberate for example triggers the "high-load" state. Running nmap 7.80 the command doing the job is nmap --script ssl-enum-ciphers -p PORT SERVER-IP Checking the log-file (level 7) the end of the logfile after such a burst of acitity with the stunnel ennding up at 100% CPU load looks like that: 2022.02.06 14:23:17 LOG7[39]: Deallocating application specific data for session connect address 2022.02.06 14:23:17 LOG7[39]: linger (local): Invalid argument (22) 2022.02.06 14:23:17 LOG7[39]: Local descriptor (FD=22) closed 2022.02.06 14:23:17 LOG7[39]: Service [imaps] finished (6 left) 2022.02.06 14:23:14 LOG7[main]: FD=4 events=0x1 revents=0x1 2022.02.06 14:23:17 LOG7[main]: FD=11 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=12 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=13 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=14 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: Dispatching a signal from the signal pipe 2022.02.06 14:23:17 LOG7[main]: Processing SIGCHLD 2022.02.06 14:23:17 LOG7[main]: Retrieving pid statuses with waitpid() 2022.02.06 14:23:17 LOG7[main]: Retrieving pid statuses with waitpid() - DONE Remarkable is that some imaps (we named the IMAP service to be wrapped imaps) still seem to remain active (6 left). The last entry always is the one with the waitpid() and to be sure that it is not the while loop in that one (stunnel.c) I added an additional log entry "DONE" in the source whenever the routine is left - so it is not that easy. The workaround currently is a script monitoring the CPU usage of stunnel and killing/restarting it if >80% for extended period of time is observed, but that can just be a temporary solution. Any ideas what to try/debug locating the reason for the problem? Thanks, Erik. P.S. Experimenting with the timeouts does not alter the phenomenon. P.P.S. Here the active lines of the config file (deleted comments and unused lines to remove clutter): cert = /usr/local/etc/stunnel/stunnel.pem sslVersion = all chroot = /var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [imaps] accept = 14310 connect = 143 local = 127.0.0.1

1 0

Re: stunnel 5-15 minute outages
by Eberhard 05 Feb '22

05 Feb '22

I a hate to sound like a broken record – why not at least try inetd mode for a few days? If nothing else it will tell you if it is stunnel (either server issues or problems with continuing running programs) with little cost to you to try it. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com> Sent: Saturday, February 5, 2022 3:01 AM To: john.robertson.arnold(a)gmail.com Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: stunnel 5-15 minute outages We haven't taken any actions yet. We have so far believed that it was a network side issue, so we have been looking hard at the network devices and getting vendor cases open. We have been looking at packet captures to see if we can figure it out. We haven't found anything that points to the network, but still looking at that. Do you happen to have any load balancers in front of stunnel? I plan to recommend some changes to stunnel suggested in this thread. Thanks, and sorry you are facing this same issue. On Fri, Feb 4, 2022 at 11:36 PM <john.robertson.arnold(a)gmail.com <mailto:[email protected]> > wrote: I second your problem! We are experiencing what sounds like the same issue. We have had 8 outages since November. They come in pairs, roughly 48 hours apart. Each outage is between 10-12 minutes, then self resolves. I literally just came to this thread tonight while troubleshooting the latest outage. Did the suggestion in the thread work for you? _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org <mailto:[email protected]> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org <mailto:[email protected]> -- Steve Clement steve3279(a)gmail.com <mailto:[email protected]> 614-632-7380

1 0

Re: stunnel 5-15 minute outages
by Eberhard 05 Feb '22

05 Feb '22

Which is why my advice is “strange.” We support so many Unix versions with thousands of users of various capabilities. I don’t want to have to learn secret tricks – especially as they change with versions of the O/S. So I use inetd – all the same on every O/S and always works. I see no reason not to do this unless you have a belief that there is a performance issue with it, which is possible I suppose but I suspect completely unlikely in modern computers. Further, inetd is running anyway so the server part is hardly affected by stunnel whereas if you use stunnel in server mode it has overhead … so a real picky person would do performance analysis and it still may be more efficient to use inetd depending on server overhead. Which is like different by O/S and computer hardware and … I worry about performance only when it actually matters. I’d rather concern myself with reliable with less maintenance on my part. My primary O/S is AIX which is stone reliable and requires little fussing with – hence using AIX to do the server part (inetd) makes my life easier. And probably 95% of the people here will disagree with me and that is fine because there is no “right” answer, just choices. I just think some people dismiss inetd out of hand because they were told a decade or two ago (I am old 😊 ) that performance was an issue and that remains the legend. And, I have helped several people overcome issues by changing to inetd, especially those with little experience in server management and/or O/S settings like Danny did (good job!). So please don’t flame me people – this is just explaining why one might consider using inetd mode, not making a case to always use it. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Danny Clowes <danny0809881(a)gmail.com> Sent: Friday, February 4, 2022 1:21 PM To: Eric Eberhard <flash(a)vicsmba.com> Cc: Steve Clement <steve3279(a)gmail.com>; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re: stunnel 5-15 minute outages Hi, Ive been using stunnel on number of servers for very long time over all experience has been very good not had any issues or concerns with the stunnel they never crash always online. Ive just tested stunnel on debian 11 it's working brilliant. The Linux system do have limitations in place and the client will only allow so many connections before it will close down say can't take anymore connections however I edited the Linux server remove limitation in place. These where teething issues when started to use stunnel. If anyone interested I would provide hidden scrects how make stunnel work like dream. On Fri, 4 Feb 2022, 19:04 Eberhard, <flash(a)vicsmba.com <mailto:[email protected]> > wrote: I will give you strange advice assuming you are on Unix of some flavor. Use inetd. It always works or the O/S does not work 😊 It then becomes the actual server and a new instance of stunnel is fired for every connection. I use it because it is the most reliable way and takes no server software management. There is an old argument against this – it is in theory has less performance when a correction is created. I say theoretical as modern computers are so fast that creating a process millions of times does not stress a machine. I run 100s of millions of connections daily on a single computer and have zero performance issues. I also have zero issues like you described and I always had them before. Even if you do have an issue it would only affect one connection. Because each connection is unique. From your description it is the server process having an issue or perhaps some of the children not getting “clean” as they keep them running in a loop. With inetd it does it’s business and ends. There are no cross-connection or server issues. I give this advice several times a year and may ¼ take it and thank me. The rest mock the idea citing the theoretical performance difference (without even trying it) and continue to struggle. This is not just an issue with this version. Many versions have had trouble with running in a loop like that – memory management, variables not cleared, etc. And remember openssl is tied to this as well. The other thing I would recommend (also weird) is using static links. That way an install of say a new openssl (where your encryption issue appears to be now) won’t affect you. There is no way anyone is testing the software with every version of every O/S with every version of openssl. If you do a static link and have a working version, no need to change. Until a new TLS comes out or something but you can control that well when you have a static link. And that, BTW, theoretically loads faster. The program is much bigger but in need not load dynamic libraries from all over the place when it is fired up. Let me know what you find out and do 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com <mailto:[email protected]> > Sent: Friday, February 4, 2022 4:52 AM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] stunnel 5-15 minute outages Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com <mailto:[email protected]> 614-632-7380 _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org <mailto:[email protected]> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org <mailto:[email protected]>

3 2

stunnel 5-15 minute outages
by Steve Clement 05 Feb '22

05 Feb '22

Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com 614-632-7380

2 2

Re: stunnel 5-15 minute outages
by Eberhard 04 Feb '22

04 Feb '22

I will give you strange advice assuming you are on Unix of some flavor. Use inetd. It always works or the O/S does not work 😊 It then becomes the actual server and a new instance of stunnel is fired for every connection. I use it because it is the most reliable way and takes no server software management. There is an old argument against this – it is in theory has less performance when a correction is created. I say theoretical as modern computers are so fast that creating a process millions of times does not stress a machine. I run 100s of millions of connections daily on a single computer and have zero performance issues. I also have zero issues like you described and I always had them before. Even if you do have an issue it would only affect one connection. Because each connection is unique. From your description it is the server process having an issue or perhaps some of the children not getting “clean” as they keep them running in a loop. With inetd it does it’s business and ends. There are no cross-connection or server issues. I give this advice several times a year and may ¼ take it and thank me. The rest mock the idea citing the theoretical performance difference (without even trying it) and continue to struggle. This is not just an issue with this version. Many versions have had trouble with running in a loop like that – memory management, variables not cleared, etc. And remember openssl is tied to this as well. The other thing I would recommend (also weird) is using static links. That way an install of say a new openssl (where your encryption issue appears to be now) won’t affect you. There is no way anyone is testing the software with every version of every O/S with every version of openssl. If you do a static link and have a working version, no need to change. Until a new TLS comes out or something but you can control that well when you have a static link. And that, BTW, theoretically loads faster. The program is much bigger but in need not load dynamic libraries from all over the place when it is fired up. Let me know what you find out and do 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com> Sent: Friday, February 4, 2022 4:52 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel 5-15 minute outages Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com <mailto:[email protected]> 614-632-7380

2 1

Use Stunnel with CMD
by gilaguigui＠gmail.com 02 Feb '22

02 Feb '22

Hi, I am trying to use stunnel with CMD (as a service) I get pop up message for each command (service installed \ service stopped etc.) the command in CMD: stunnel.exe -install\ -uninstall.... how can I disable it? run stunnel with no pop up? thanks GG.

1 0

New to stunnel! Need help connecting to a REST API
by Tim Townsend 18 Jan '22

18 Jan '22

Hello! I need help! We have an integration from an ERP package to a REST API (Avatax) that will soon be requiring TLS 1.2 connections. Our tech platform does not have built-in support for TLS 1.2, so I'm hoping to be able to use stunnel to make that happen. Where do I start? What would the conf file section look like for this? I don't see this directly discussed in the documentation. Any help appreciated! [cid:[email protected]] Tim Townsend Programmer Earnest & Associates * Profitability Improvement Specialists Voice: 410.766.6076<tel:+14107666076> ext 210 Email: tim.townsend(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/>

1 0

stunnel 5.62 released
by Michał Trojnara 17 Jan '22

17 Jan '22

Dear Users, I have released version 5.62 of stunnel. ### Version 5.62, 2022.01.17, urgency: MEDIUM * New features - Added a bash completion script. * Bugfixes - Fixed a transfer() loop bug. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 9cf5bb949022aa66c736c1326554cca27d0641605a6370274edc4951eb5bd339 stunnel-5.62.tar.gz fbfcc5759344bcafff9ff3bc6cf56c7fb75cb1244b76d4934c5d9a3eb7eee32d stunnel-5.62-win64-installer.exe 4b52ed6e4bb8293fdefb10ee8c271400a8c1749254a11b674ff690eae00b3c5e stunnel-5.62-android.zip Best regards, Mike

1 0

Re: stunnel 5.61transfer() loop executes not transferring any data Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket inetd mode
by Roberto CORRADO 17 Jan '22

17 Jan '22

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Mike, Good job! Stunnel 5.62 beta 1 work fine! """ 2022.01.16 22:08:47 LOG6[ui]: Initializing inetd mode configuration 2022.01.16 22:08:47 LOG5[ui]: stunnel 5.62 on i586-slackware-linux-gnu platform 2022.01.16 22:08:47 LOG5[ui]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2022.01.16 22:08:47 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2022.01.16 22:08:47 LOG6[ui]: Initializing inetd mode configuration 2022.01.16 22:08:47 LOG5[ui]: Reading configuration from file /etc/stunnel/imaps.conf 2022.01.16 22:08:47 LOG5[ui]: UTF-8 byte order mark not detected 2022.01.16 22:08:47 LOG5[ui]: FIPS mode disabled 2022.01.16 22:08:47 LOG6[ui]: Compression enabled: 0 methods 2022.01.16 22:08:47 LOG6[ui]: stunnel default security level set: 2 2022.01.16 22:08:47 LOG6[ui]: Session resumption enabled 2022.01.16 22:08:47 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: DH initialization needed for DHE-RSA-AES256-GCM-SHA384 2022.01.16 22:08:47 LOG6[ui]: 4096-bit DH parameters loaded 2022.01.16 22:08:47 LOG5[ui]: Configuration successful 2022.01.16 22:08:47 LOG5[0]: Service [stunnel] accepted connection from 10.19.79.235:41136 2022.01.16 22:08:47 LOG6[0]: Peer certificate not required 2022.01.16 22:08:47 LOG6[0]: No peer certificate received 2022.01.16 22:08:47 LOG6[0]: Session id: 65640462303D0DA1CD16CAB4977F22B04FFB74693150104FC69AB9FBDC48AED9 2022.01.16 22:08:47 LOG6[0]: No peer certificate received 2022.01.16 22:08:47 LOG6[0]: Session id: B9505D917FA6F2E9C8A0EF14D6E4B01C3ED54599271D93E325ED7412CA2AC5F3 2022.01.16 22:08:47 LOG6[0]: TLS accepted: new session negotiated 2022.01.16 22:08:47 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.01.16 22:08:47 LOG6[0]: Peer temporary key: X25519, 253 bits 2022.01.16 22:08:47 LOG6[0]: Local mode child started (PID=16984) 2022.01.16 22:08:47 LOG6[0]: TLS closed (SSL_read) 2022.01.16 22:08:47 LOG6[0]: Read socket closed (readsocket) 2022.01.16 22:08:47 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2022.01.16 22:08:47 LOG5[0]: Connection closed: 979 byte(s) sent to TLS, 128 byte(s) sent to socket """ Thanks a lot! - -Roberto -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAmHkjDoACgkQWVOoL214ZeGntwCbBtV1G/J2uThR06ftFC+F2XTP KeQAnjnCTOrk26zzcsNsCOQoWg54MWhD =alm2 -----END PGP SIGNATURE----- ----- Original Message ----- Sent: Sunday, January 16, 2022 9:52 PM Michał Trojnara wrote: > Hi Roberto, > > Could you try https://www.stunnel.org/downloads/beta/stunnel-5.62b1.tar.gz ? > > Best regards, > Mike

2 1

I NEED A HELP TO SETUP THE SSL/TLS EMAILS SUPPORT
by Muj 01 Jan '22

01 Jan '22

HI TECHNICAL SUPPORT, FIRSTLY, I AM APOLOGIZING TO YOU FOR WRITING WITH LARGE CAPS ONLY, IT IS BECAUSE RECENTLY I GOT A BRAIN STROKE AND AM NOT RECOVERED YET. AS FOR MY ISSUE, TO UNDERSTAND IT BETTER, THE FOLLOWING IS MY INFO. - I HAVE AN OLD WINDOWS-XP 32BIT OS. - I AM USING TERABYTE 2.99 TO BACKUP AND RESTORE MY OS, BUT LOOSING MANY EMAILS BECAUSE TERABYTE IS NO LONGER SUPPORTING 2.99 VERSION. THEY SUPPORT RESTORING ALL EMAILS BEGINNING FROM 3 VERSION. THEREFORE, THEY HAVE RECOMMENDED ME TO CONTACT YOU DIRECTLY. NOW WHAT I DID SO FAR. - I DOWNLOADED AND INSTALLED YOUR STUNNEL 4.53 - AFTER AUTOMATIC SETTING, EDITING STUNNEL.CONF FILE, MAKING SOME CHANGES IN IT AND SAVING IT, THE SERVER WENT DOWN. ATTACHED PLEASE FIND STUNNEL.CONF TXT FILE. - BECAUSE THE SERVER WENT DOWN, I TRIED TO DOWNLOAD AND INSTALL STUNNEL AGAIN, BUT ALWAYS GOT THE SAME ERROR MESSAGE.PLEASE CAN YOU HELP ME WITH THIS ISSUE? - I HAVE 3 POP3 EMAIL ACCOUNTS AND 1 IMAP. ALL REQUIRE A CONNECTION SECURITY SSL/TLS. *PLEASE, I NEED TO KNOW HOW **TO COMPLETELY REMOVE THE CURRENT STUNNEL PROGRAM AND AFTER THAT, WHAT STUNNEL VERSION I SHOULD **DOWNLOAD AGAIN **TO BE ABLE TO SET IT UP*. AFTER A SUCCESSFUL NEW INSTALLATION I WOULD GIVE YOU MORE NEEDED INFO FOR SETTING UP MY EMAILS. PLEASE LET ME KNOW IN YOUR BEST CONVENIENCE AND HAVE A BEAUTIFUL NEW YEAR 2022. KIND REGARDS, MARTIN

1 0

stunnel 5.61transfer() loop executes not transferring any data Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket inetd mode
by Roberto CORRADO 29 Dec '21

29 Dec '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 """ 2021.12.28 14:03:40 LOG6[ui]: Initializing inetd mode configuration 2021.12.28 14:03:40 LOG5[ui]: stunnel 5.61 on i586-slackware-linux-gnu platform 2021.12.28 14:03:40 LOG5[ui]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2021.12.28 14:03:40 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.12.28 14:03:40 LOG6[ui]: Initializing inetd mode configuration 2021.12.28 14:03:40 LOG5[ui]: Reading configuration from file /etc/stunnel/imaps.conf 2021.12.28 14:03:40 LOG5[ui]: UTF-8 byte order mark not detected 2021.12.28 14:03:40 LOG5[ui]: FIPS mode disabled 2021.12.28 14:03:40 LOG6[ui]: Compression enabled: 0 methods 2021.12.28 14:03:40 LOG6[ui]: stunnel default security level set: 2 2021.12.28 14:03:40 LOG6[ui]: Session resumption enabled 2021.12.28 14:03:40 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: DH initialization skipped: no DH ciphersuites 2021.12.28 14:03:40 LOG5[ui]: Configuration successful 2021.12.28 14:03:40 LOG5[0]: Service [stunnel] accepted connection from 127.0.0.1:40876 2021.12.28 14:03:40 LOG6[0]: Peer certificate not required 2021.12.28 14:03:40 LOG6[0]: No peer certificate received 2021.12.28 14:03:40 LOG6[0]: Session id: 0E092C2715D12901219C3E0F54DFA029F7C50040C7EC8F8C88211BA6883B9D1F 2021.12.28 14:03:40 LOG6[0]: No peer certificate received 2021.12.28 14:03:40 LOG6[0]: Session id: 26CFB9D13C499CE27C4ED1575FDF3FB2604C616418BA6068849B49EF75AF2162 2021.12.28 14:03:40 LOG6[0]: TLS accepted: new session negotiated 2021.12.28 14:03:40 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2021.12.28 14:03:40 LOG6[0]: Peer temporary key: X25519, 253 bits 2021.12.28 14:03:40 LOG6[0]: Local mode child started (PID=4997) 2021.12.28 14:03:40 LOG3[0]: transfer() loop executes not transferring any data 2021.12.28 14:03:40 LOG3[0]: please report the problem to Michal.Trojnara(a)stunnel.org 2021.12.28 14:03:40 LOG3[0]: stunnel 5.61 on i586-slackware-linux-gnu platform 2021.12.28 14:03:40 LOG3[0]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2021.12.28 14:03:40 LOG3[0]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.12.28 14:03:40 LOG3[0]: protocol=TLSv1.3, SSL_pending=0, SSL_has_pending=0 2021.12.28 14:03:40 LOG3[0]: sock_open_rd=Y, sock_open_wr=Y 2021.12.28 14:03:40 LOG3[0]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2021.12.28 14:03:40 LOG3[0]: sock_can_rd=n, sock_can_wr=n 2021.12.28 14:03:40 LOG3[0]: ssl_can_rd=n, ssl_can_wr=n 2021.12.28 14:03:40 LOG3[0]: read_wants_read=Y, read_wants_write=n 2021.12.28 14:03:40 LOG3[0]: write_wants_read=n, write_wants_write=Y 2021.12.28 14:03:40 LOG3[0]: shutdown_wants_read=n, shutdown_wants_write=n 2021.12.28 14:03:40 LOG3[0]: socket input buffer: 154 byte(s), TLS input buffer: 0 byte(s) 2021.12.28 14:03:40 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket """ """ debug = info output = /var/log/stunnel-imaps.log cert = /etc/stunnel/stunnel.pem exec = /usr/sbin/imapd execargs = imapd sslVersion = all options = NO_SSLv2 options = NO_SSLv3 """ -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAmHLE48ACgkQWVOoL214ZeFpYwCfe+qv09KWSfjNixhhcb5MJbr2 yAkAoKOyXZJwnKddSXYzIhbi7k1yPkoU =oGR+ -----END PGP SIGNATURE-----

1 0

Config to only listen when connect port is up
by roartysa＠gmail.com 23 Dec '21

23 Dec '21

Is there a config flag that can be set in the conf file that will tell stunnel to listen on the https accept port only when the connect port is up and listening? The issue i am trying to address is when a load balancer talks to a server, I need to make sure the port that stunnel redirects to is healthy. Right now the load balancer will send traffic to the port all the time regardless of the health of the port that stunnel redirects the traffic to.

2 1

stunnel 5.61 released
by Michał Trojnara 22 Dec '21

22 Dec '21

Dear Users, I have released version 5.61 of stunnel. ### Version 5.61, 2021.12.22, urgency: LOW * New features sponsored by the University of Maryland - Added new "protocol = capwin" and "protocol = capwinctrl" configuration file options. * New features for the Windows platform - Added client mode allowing authenticated users to view logs, reconfigure and terminate running stunnel services. - Added support for multiple GUI and service instances distinguised by the location of stunnel.conf. - Improved log window scrolling. - Added a new 'Pause auto-scroll' GUI checkbox. - Double click on the icon tray replaced with single click. - OpenSSL DLLs updated to version 3.0.1. * Other new features - Rewritten the testing framework in python (thx to Peter Pentchev for inspiration and initial framework). - Added support for missing SSL_set_options() values. - Updated stunnel.spec to support RHEL8. * Bugfixes - Fixed OpenSSL 3.0 build. - Fixed reloading configuration with "systemctl reload stunnel.service". - Fixed incorrect messages logged for OpenSSL errors. - Fixed printing IPv6 socket option defaults on FreeBSD. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 91ea0ca6482d8f7e7d971ee64ab4f86a2817d038a372f0893e28315ef2015d7a stunnel-5.61.tar.gz 19c5ff1f4101af1e69585328303c14249db2ec9063542101ca31edb6f6cc502f stunnel-5.61-win64-installer.exe 928ec94690564498bf523228946b2cdc90c7e346d6f0baf1f71b76cbe769b96c stunnel-5.61-android.zip Best regards, Mike

1 0

Log4j Vulnerability
by Tracy Drake - IQGC-C 17 Dec '21

17 Dec '21

Hello! Can you please tell me if Stunnel uses log4j and/or if it is vulnerable to it? Your feedback would be greatly appreciated! Thanks in advance! -- *TRACY DRAKE | CSM URSA/Infoconnect Training and Support* GSA COMET Hale Bopp Contract Work Phone: 704-253-5193 | Email: tracy.drake(a)gsa.gov

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users