- stunnel-users - stunnel.org

help with tls config in stunnel
by Daniel Trickett 10 May '18

10 May '18

Hi, We are running stunnel 5.44 on Solaris. Our b2b legacy system is using TLS 1.0. We have a supplier who recently switched to TLS 1.2 and we can no longer connect to the site from our b2b. How can I configure stunnel to connect to the supplier site using TLS 1.2? TIA. Dan T This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

How to tell if commuications are encrypted?
by Alex Birchall 10 May '18

10 May '18

Hello, I have Stunnel installed on Windows Server 2008 R2, running as a service. I have it installed as a client on a Windows POS 2009 device. This setup is working, in that the client is operating correctly and using Stunnel. But how can I tell if communications between the Stunnel client and the Stunnel server are being encrypted, rather than Stunnel just doing port forwarding? I did read the client needs to have access to the server's certificate, but at the moment it does not. Alex

2 1

Stunnel to Outlook
by DPS Support 09 May '18

09 May '18

I am trying to get a device on my network to send pop email notifications to my outlook account but can't seem to get it to work. I have enabled the outlook account to accept pop and enabled the client to send them. I'm not sure if I'm missing something or what, any help would be greatly appreciated. Here is my config: debug = info output = stunnel.log [outlook-pop3] client = yes accept = 110 connect = pop-mail.outlook.com:995 [outlook-imap] client = yes accept = 143 connect = imap-mail.outlook.com:993 [outlook-smtp] protocol = smtp client = yes accept = 25 connect = smtp-mail.outlook.com:587 Here is the log as well: 2018.05.08 15:15:03 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.05.08 15:15:03 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.05.08 15:15:03 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.05.08 15:15:03 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.08 15:15:03 LOG5[main]: UTF-8 byte order mark detected 2018.05.08 15:15:03 LOG5[main]: FIPS mode disabled 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-pop3] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-pop3] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-imap] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-imap] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-smtp] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-smtp] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG5[main]: Configuration successful 2018.05.08 15:15:03 LOG5[main]: Logging to C:\Users\dps_engineer\AppData\Local\stunnel.log 2018.05.08 15:15:53 LOG5[0]: Service [outlook-pop3] accepted connection from 126.10.230.254:52629 2018.05.08 15:15:53 LOG6[0]: failover: round-robin, starting at entry #1 2018.05.08 15:15:53 LOG6[0]: s_connect: connecting 40.97.135.130:995 2018.05.08 15:15:53 LOG5[0]: s_connect: connected 40.97.135.130:995 2018.05.08 15:15:53 LOG5[0]: Service [outlook-pop3] connected remote server from 126.10.218.222:60145 2018.05.08 15:15:53 LOG6[0]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:15:53 LOG6[0]: Peer certificate not required 2018.05.08 15:15:54 LOG6[0]: Certificate verification disabled 2018.05.08 15:15:54 LOG6[0]: Certificate verification disabled 2018.05.08 15:15:54 LOG6[0]: Client certificate not requested 2018.05.08 15:15:54 LOG6[0]: TLS connected: new session negotiated 2018.05.08 15:15:54 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:15:55 LOG6[0]: Read socket closed (readsocket) 2018.05.08 15:15:55 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2018.05.08 15:15:55 LOG6[0]: TLS socket closed (SSL_read) 2018.05.08 15:15:55 LOG5[0]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:15:55 LOG5[1]: Service [outlook-smtp] accepted connection from 126.10.230.254:52639 2018.05.08 15:15:55 LOG6[1]: failover: round-robin, starting at entry #2 2018.05.08 15:15:55 LOG6[1]: s_connect: connecting 40.97.162.162:587 2018.05.08 15:15:55 LOG5[1]: s_connect: connected 40.97.162.162:587 2018.05.08 15:15:55 LOG5[1]: Service [outlook-smtp] connected remote server from 126.10.218.222:60147 2018.05.08 15:15:55 LOG6[1]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:15:55 LOG6[1]: Peer certificate not required 2018.05.08 15:15:55 LOG6[1]: Certificate verification disabled 2018.05.08 15:15:55 LOG6[1]: Certificate verification disabled 2018.05.08 15:15:55 LOG6[1]: Empty client CA list 2018.05.08 15:15:55 LOG6[1]: TLS connected: new session negotiated 2018.05.08 15:15:55 LOG6[1]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:00 LOG6[1]: TLS socket closed (SSL_read) 2018.05.08 15:16:00 LOG5[1]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket 2018.05.08 15:16:00 LOG5[2]: Service [outlook-pop3] accepted connection from 126.10.230.254:52644 2018.05.08 15:16:00 LOG6[2]: failover: round-robin, starting at entry #2 2018.05.08 15:16:00 LOG6[2]: s_connect: connecting 40.97.161.50:995 2018.05.08 15:16:00 LOG5[2]: s_connect: connected 40.97.161.50:995 2018.05.08 15:16:00 LOG5[2]: Service [outlook-pop3] connected remote server from 126.10.218.222:60149 2018.05.08 15:16:00 LOG6[2]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:16:00 LOG6[2]: Peer certificate not required 2018.05.08 15:16:00 LOG6[2]: Certificate verification disabled 2018.05.08 15:16:00 LOG6[2]: Certificate verification disabled 2018.05.08 15:16:00 LOG6[2]: Client certificate not requested 2018.05.08 15:16:00 LOG6[2]: TLS connected: new session negotiated 2018.05.08 15:16:00 LOG6[2]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:01 LOG6[2]: TLS socket closed (SSL_read) 2018.05.08 15:16:01 LOG5[2]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:16:01 LOG5[3]: Service [outlook-smtp] accepted connection from 126.10.230.254:52647 2018.05.08 15:16:01 LOG6[3]: failover: round-robin, starting at entry #3 2018.05.08 15:16:01 LOG6[3]: s_connect: connecting 40.97.162.146:587 2018.05.08 15:16:01 LOG5[3]: s_connect: connected 40.97.162.146:587 2018.05.08 15:16:01 LOG5[3]: Service [outlook-smtp] connected remote server from 126.10.218.222:60150 2018.05.08 15:16:01 LOG6[3]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:16:01 LOG6[3]: Peer certificate not required 2018.05.08 15:16:01 LOG6[3]: Certificate verification disabled 2018.05.08 15:16:01 LOG6[3]: Certificate verification disabled 2018.05.08 15:16:01 LOG6[3]: Empty client CA list 2018.05.08 15:16:01 LOG6[3]: TLS connected: new session negotiated 2018.05.08 15:16:01 LOG6[3]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:03 LOG6[cron]: Executing cron jobs 2018.05.08 15:16:03 LOG6[cron]: Cron jobs completed in 0 seconds 2018.05.08 15:16:06 LOG6[3]: TLS socket closed (SSL_read) 2018.05.08 15:16:06 LOG5[3]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket 2018.05.08 15:16:06 LOG5[4]: Service [outlook-pop3] accepted connection from 126.10.230.254:52653 2018.05.08 15:16:06 LOG6[4]: failover: round-robin, starting at entry #3 2018.05.08 15:16:06 LOG6[4]: s_connect: connecting 40.97.134.18:995 2018.05.08 15:16:06 LOG5[4]: s_connect: connected 40.97.134.18:995 2018.05.08 15:16:06 LOG5[4]: Service [outlook-pop3] connected remote server from 126.10.218.222:60153 2018.05.08 15:16:06 LOG6[4]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:16:06 LOG6[4]: Peer certificate not required 2018.05.08 15:16:06 LOG6[4]: Certificate verification disabled 2018.05.08 15:16:06 LOG6[4]: Certificate verification disabled 2018.05.08 15:16:06 LOG6[4]: Client certificate not requested 2018.05.08 15:16:06 LOG6[4]: TLS connected: new session negotiated 2018.05.08 15:16:06 LOG6[4]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:07 LOG6[4]: Read socket closed (readsocket) 2018.05.08 15:16:07 LOG6[4]: SSL_shutdown successfully sent close_notify alert 2018.05.08 15:16:07 LOG6[4]: TLS socket closed (SSL_read) 2018.05.08 15:16:07 LOG5[4]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:16:07 LOG5[5]: Service [outlook-smtp] accepted connection from 126.10.230.254:52656 2018.05.08 15:16:07 LOG6[5]: failover: round-robin, starting at entry #4 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:101::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:101::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:108::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:108::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:cc::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:cc::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:8f::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:8f::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 40.97.161.50:587 2018.05.08 15:16:08 LOG5[5]: s_connect: connected 40.97.161.50:587 2018.05.08 15:16:08 LOG5[5]: Service [outlook-smtp] connected remote server from 126.10.218.222:60158 2018.05.08 15:16:08 LOG6[5]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:16:08 LOG6[5]: Peer certificate not required 2018.05.08 15:16:08 LOG6[5]: Certificate verification disabled 2018.05.08 15:16:08 LOG6[5]: Certificate verification disabled 2018.05.08 15:16:08 LOG6[5]: Empty client CA list 2018.05.08 15:16:08 LOG6[5]: TLS connected: new session negotiated 2018.05.08 15:16:08 LOG6[5]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:13 LOG6[5]: TLS socket closed (SSL_read) 2018.05.08 15:16:13 LOG5[5]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket Sent from Outlook<http://aka.ms/weboutlook>

2 1

Stunnel Time out Error
by Sedick Cloete 07 May '18

07 May '18

HI All, We recently moved our email server from an in-house server to Office 365. We are now in the process of replacing all our XP boxes with Windows 10. One of the boxes are running the email service which collects emails from Office 365, that we have just recently upgraded. This process works on the XP but times out on windows 10. Attached, is the time out the log file. Below is the code I am using: Basic program code * variables ChannelNo = 0 Pop3Server = 'outlook.office365.com' Pop3User = UserName Pop3Pass = Password Pop3Port = '995' ProxYServer = '127.0.0.1' ProxyPort = '110' ProxyDir = 'C:\see4OI\SSL\' ProxyExe = 'stunnel.exe' ProxyCert = 'stunnel.pem' * retreives mail in MIME format Gosub GET_EMAILS return Mail_Rec * ---------------------------------------------------------------------------- ------------- GET_EMAILS: * close previous session If it wasnt closed properly Code = seeClose(ChannelNo) Code = seeRelease() * attach key code Code = seeAttach(1, KeyCode) if Code < 0 then RetFlag = 1 return end * start stunnel Code = seeSetProxySSL(0, 1, ProxyDir, ProxyCert, ProxyExe) If Code < 0 Then RETURN end * connect to email server Code = seePop3ConnectSSL(ChannelNo, ProxyPort, Pop3Port, Pop3Server, Pop3User, Pop3Pass, ProxyServer) If Code < 0 Then RETURN End Your assistance in this regard will be highly appreciated. Thank you. Kind Regards, Logicore SEDICK CLOETE IT Business Consultant Cell: 083 228 7058 Fax: 086 515 9695 email: sedick(a)logicore.co.za If you are not the intended recipient of this communication, please notify the sender immediately. The information and/or attachment contained in this email is confidential and may contain proprietary and/or personal information. It is meant solely for the intended recipient. Access to this email by anyone else is unauthorised. If you are not the intended recipient, any processing of the email or the information contained therein (including disclosure, copying, distribution, storage) or any action taken or omitted in reliance on this, is prohibited and may be unlawful.

2 1

How to configure stunnel client on Mac
by Mark Foley 04 May '18

04 May '18

I've successfully set up stunnel for Windows and Linux clients. Now to set up for Mac. I've gone to the website http://macappstore.org/stunnel/ and followed the instructions there which are: 1. Press Command+Space and type Terminal and press enter/return key. 2. Run in Terminal app: ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" < /dev/null 2> /dev/null and press enter/return key. 3. Run: brew install stunnel And then it says, "Done! You can now use stunnel." Well, not exactly. Where do I put my stunnel.conf and certificate.pem? How do I make stunnel run automatically at boot time? The web instructions aren't very complete. Need additional assistance. THX --Mark

1 1

Stunnel in Windows Failover cluster
by Tobias Gillstöm 27 Apr '18

27 Apr '18

Hi, I'm currently using stunnel in a windows fail over cluster: My problem is that when a fail over occurs stunnel switches too the other node and says that stunnel is running and everything is fine. But when I check the logs for stunnel and the program that uses stunnel, it does not appear to be running or sending any data. In the screenshot you can see my stunnel configuration, in the startup parameters section it says "-service -install" my question is if it shouldn't say "-service -start" instead, has anyone else encountered this problem? And if this is the problem why does the stunnel service install with these parameters?

1 0

Ubuntu 16.04.4 LTS SSLv3 and SSlv2 running stunnel 5.44
by Joe Phillips 25 Apr '18

25 Apr '18

I am running stunnel 5.44 on Ubuntu 16.04.4 LTS with all updates. I cannot get devices to connect using sslv2 or 3. My conf file Options line as seen below : ;Enable support for inecure SSLv3 protocol Options = -NO_SSLv3 Options = -NO_SSLv2 I continuously get error 1408A10B SSL routines: ssl3_get_client_hello:wrong version number Do I not have SSL3 and 2 correctly defined in my conf file? I realize 2 and 3 are no longer secure, but I need to support them while I transition to TLS 1.2 thanks [cid:[email protected]]

2 1

stunnel as a Windows Service
by Paul Muller 20 Apr '18

20 Apr '18

Does anyone have any documentation on how to setup stunnel as a Windows Service? I currently have it installed on a Windows Server 2012 R2 Standard. I noticed that stunnel stops running as soon as I log off of my RDP session on the server. [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

2 1

Rapid subsequent DNS resolution fails within stunnel
by Vincent Deschenes 20 Apr '18

20 Apr '18

Hi, We have had this weird problem for a long time where sometime DNS resolution will fail with this error: Error resolving 'domain name printed here': Neither nodename nor servname known (EAI_NONAME) Today I found out that this will happen when stunnel get 2 calls for the same outgoing endpoint very fast one after the other. One call will work no problem. But if you do 2 one after the other then the second one and all other subsequent will fail. Wait a bit and try again, the first one will pass and then others will fail. DNS resolution on the server (linux) itself work without problem, nslookup in loops no problem. But with stunnel we always have the problem. The only working solution is to add a record to the server host file. Any idea ? Could this be a bug in stunnel ? Thanks, Vincent

1 1

Authentication
by Paul Muller 20 Apr '18

20 Apr '18

When I first setup stunnel, I changed my software to reflect the [gmail-smtp] entries in my configuration file. When I tried to send an email from my application I received the following message: "No Email sent, Error 535-5.7.8 Username and Password not accepted." Then I remarked out the authentication credentials in my software. When I tried to send an email I received the following message: "No Email sent, Error-5.5.1 Authentication Required." My question is, can place my authentication credentials in the "stunnel.conf" file? And if so, where? Thanks, [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

2 2

/etc/hosts setting
by White Little 17 Apr '18

17 Apr '18

Hi All I found a interesting issue with /etc/hosts setting in different Linux system. My stunnel.conf setting like below [HOST] cert = client.crt key = client.key CAfile = server.crt client = yes accept = 10.160.160.88:57853 connect = 10.136.160.21:3520 I would like to connect server 10.136.160.21:3520 via stunnel 10.160.160.88:57853 Part A If my hostname and /etc/hosts setting in different System as followings all will works well 1. CentOS 7 32bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 2. Redhat 7 64bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 3. Ubuntu15.10 64bit $hostname virtual-machine $ cat /etc/hosts 127.0.0.1 localhost 10.136.160.88 virtual-machine Part B. If the "127.0.0.1" include the hostname in /etc/hosts, both CentOS and Fedora will fail, but Ubuntu still work 1. CentOS 7 32bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost* localhost.localdomain* localhost4 localhost4.localdomain4 10.136.160.253 localhost.localdomain 2. Redhat 7 64bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost *localhost.localdomain* localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 3. Ubuntu15.10 64bit $hostname virtual-machine $ cat /etc/hosts 127.0.0.1 localhost *virtual-machine* 10.136.160.88 virtual-machine I think it maybe not a stunnel issue, but I'd like to know why it has different behavior Thanks Jay

2 2

make_test failing
by Ian Bamforth 16 Apr '18

16 Apr '18

Morning, Our CI has been failing since Friday with the same errors seen at https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/stunnel4…. make_test fails on 012_verify_chain and 013_CRL_file. Anyone else seeing the same thing? We run Ubuntu 14.04, stunnel v5.44, automatically applying apt security patches to the OS. My initial assumption is that some dependency of stunnel has been updated, but I've not had chance to find out. We have been using the same version of stunnel since the day it was released without any other problems. Ian

2 2

Invalid certificate in tests, prevents make_test from running
by Ian Bamforth 16 Apr '18

16 Apr '18

Morning, I posted earlier about `make_test` failing, apologies for not replying to that thread but I didn't receive the email myself. I've tracked this down to `tests/certs/CACert.pem` containing an expired certificate - see below output: openssl x509 -in tests/certs/CACert.pem -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha1WithRSAEncryption Issuer: C=pl, O=CA_cert, OU=CA_cert, CN=CA_cert/emailAddress=CA_cert(a)example.com Validity Not Before: Apr 26 18:41:00 2017 GMT Not After : Apr 13 15:45:00 2018 GMT Subject: C=pl, O=CA_cert, OU=CA_cert, CN=CA_cert/emailAddress=CA_cert(a)example.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:af:cc:61:f5:73:2b:49:3c:62:c0:b0:d6:1b:0f: 5e:32:d1:49:48:01:b2:35:36:a8:04:a3:e0:7e:e4: 1d:f9:cb:fe:11:0a:c3:2e:b1:3e:87:4c:b0:72:d7: 73:04:ba:28:c7:2b:b4:67:13:0e:5d:05:7f:67:bd: ba:7f:c5:89:b0:48:d6:21:4b:e8:3a:70:ac:dc:e4: f5:43:c3:c9:57:7f:73:f1:3b:b0:e5:a5:90:44:9f: 6e:c3:2a:f5:ab:e6:15:f3:de:cd:44:23:5e:4f:c2: eb:44:59:6c:f5:76:46:b0:7c:fc:59:df:20:97:0c: 0f:43:ae:df:47:f6:d2:78:fd:c6:be:11:cf:26:a1: 8d:87:74:2f:c9:b5:1b:2b:9d:a4:95:44:0c:54:de: 0c:12:d4:8d:14:57:31:a7:a8:70:11:68:6e:20:3d: 76:c9:c8:45:50:d5:4e:2f:f1:6e:78:25:23:05:45: 6e:7d:11:2a:b3:e8:88:6e:68:29:2c:a2:c2:3d:cf: 41:50:b5:e1:51:8f:8e:f4:36:0f:f5:a8:63:5e:29: 1d:b4:fe:71:43:d0:2a:be:2a:2c:b1:62:c6:b9:bc: 4d:95:80:4e:60:ec:e9:79:92:19:31:9c:b2:00:74: 3b:a1:80:57:b4:22:45:c8:d3:1a:a7:4f:f6:00:12: 35:b7 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha1WithRSAEncryption 97:03:b2:c1:a2:44:8a:2a:9c:1d:3c:cb:61:a6:f9:bc:7f:4f: 21:fc:69:d8:f3:31:7b:4b:e5:2b:34:42:19:03:1a:40:af:fa: 7e:18:93:99:a8:78:cb:32:15:23:75:6e:49:6d:ac:ee:ca:5e: d6:d2:69:5a:b5:4a:13:cd:7c:77:e4:f2:6d:a0:2d:63:2f:62: b5:be:24:ee:12:d7:22:3e:dd:d2:56:07:81:ca:c4:cf:4c:2c: 36:64:32:52:b1:76:76:5f:c7:45:86:b9:34:1a:c7:37:0c:38: ce:8b:20:8b:70:a1:33:a0:e1:3d:ed:9a:26:c0:04:e7:35:c5: 41:ab:bd:f9:cc:10:8d:12:3f:7a:ee:b3:a3:98:35:09:b2:e5: 5f:aa:22:16:7e:18:df:61:ac:3d:30:48:f7:77:41:5c:25:bd: 6f:dc:53:d0:f3:d7:cc:33:f6:77:36:99:0b:e4:8f:3e:83:e4: ca:3a:58:6f:73:55:83:6e:a7:01:b2:21:bf:09:54:28:e3:e0: a5:4f:bd:d7:66:a2:f8:c2:81:6f:0d:aa:ba:6f:7d:a9:cf:6f: 06:a8:a2:b1:5b:3b:f9:7b:89:bf:f5:c4:ed:f0:5e:cf:64:87: 39:84:90:6c:c9:e0:5d:b4:54:ae:a7:6c:e7:b4:2a:29:fe:ab: 62:4f:91:d0 As a (horrible) workaround I've had to skip "make_test" in my CI - if there are any better ideas please let me know! Ian

1 0

Possible memory leak with stunnel reload
by Mark Brookes 06 Apr '18

06 Apr '18

Hi all, we have noticed that when reloading (note reloading not restarting) stunnel it appears to be leaking between 12 and 32 bytes of memory (ish) per reload. There does not need to be any traffic passing through it at the time to view this problem. If its reloaded enough times the system will eventually run out of memory. Unless an stunnel restart if performed inbetween. We are running 5.41 tried with the latest 5.44 and have the same result. We are using openssl 1.0.2j-fips ive tried with 1.0.2n and 1.1.0e (to try and rule out openssl) We are reloading by running: kill -s HUP <pid> The stunnel configuration is - pid = /var/run/stunnel/stunnel.pid debug = 7 syslog = no output = /var/log/stunnel.log socket = a:IP_FREEBIND=yes fips = no sslVersion = all [VIP_Name] cert = /etc/loadbalancer.org/certs/server.pem ciphers = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES accept = 192.168.80.16:443 connect = 127.0.0.5:80 delay = yes options = NO_SSLv3 options = NO_TLSv1 options = DONT_INSERT_EMPTY_FRAGMENTS renegotiation = no local = 192.168.80.16 TIMEOUTclose = 0 The stunnel log file is as follows - 2018.04.03 11:09:59 LOG7[ui]: Clients allowed=62937 2018.04.03 11:09:59 LOG5[ui]: stunnel 5.44 on x86_64-pc-linux-gnu platform 2018.04.03 11:09:59 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j-fips 26 Sep 2016 2018.04.03 11:09:59 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.04.03 11:09:59 LOG7[ui]: errno: (*__errno_location ()) 2018.04.03 11:09:59 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2018.04.03 11:09:59 LOG5[ui]: UTF-8 byte order mark not detected 2018.04.03 11:09:59 LOG5[ui]: FIPS mode disabled 2018.04.03 11:09:59 LOG7[ui]: Compression disabled 2018.04.03 11:09:59 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2018.04.03 11:09:59 LOG7[ui]: PRNG seeded successfully 2018.04.03 11:09:59 LOG6[ui]: Initializing service [VIP_Name] 2018.04.03 11:09:59 LOG7[ui]: Ciphers: ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES 2018.04.03 11:09:59 LOG7[ui]: TLS options: 0x07004804 (+0x07004800, -0x00000000) 2018.04.03 11:09:59 LOG6[ui]: Loading certificate from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Certificate loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Loading private key from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Private key loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG7[ui]: Private key check succeeded 2018.04.03 11:09:59 LOG7[ui]: ECDH initialization 2018.04.03 11:09:59 LOG7[ui]: ECDH initialized with curve prime256v1 2018.04.03 11:09:59 LOG5[ui]: Configuration successful 2018.04.03 11:09:59 LOG7[ui]: Binding service [VIP_Name] 2018.04.03 11:09:59 LOG7[ui]: Listening file descriptor created (FD=6) 2018.04.03 11:09:59 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.04.03 11:09:59 LOG7[ui]: Option IP_FREEBIND set on accept socket 2018.04.03 11:09:59 LOG7[ui]: Service [VIP_Name] (FD=6) bound to 192.168.80.16:443 2018.04.03 11:09:59 LOG7[main]: Created pid file /var/run/stunnel/stunnel.pid 2018.04.03 11:09:59 LOG7[cron]: Cron thread initialized 2018.04.03 11:10:59 LOG6[cron]: Executing cron jobs 2018.04.03 11:10:59 LOG6[cron]: Cron jobs completed in 0 seconds 2018.04.03 11:10:59 LOG7[cron]: Waiting 86400 seconds 2018.04.03 11:11:08 LOG7[main]: Found 1 ready file descriptor(s) 2018.04.03 11:11:08 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.04.03 11:11:08 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.04.03 11:11:08 LOG7[main]: Dispatching signals from the signal pipe 2018.04.03 11:11:08 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2018.04.03 11:11:08 LOG5[main]: Reading configuration from file /etc/stunnel/stunnel.conf 2018.04.03 11:11:08 LOG5[main]: UTF-8 byte order mark not detected 2018.04.03 11:11:08 LOG5[main]: FIPS mode disabled 2018.04.03 11:11:08 LOG7[main]: Compression disabled 2018.04.03 11:11:08 LOG7[main]: Snagged 64 random bytes from /dev/urandom 2018.04.03 11:11:08 LOG7[main]: PRNG seeded successfully 2018.04.03 11:11:08 LOG6[main]: Initializing service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Ciphers: ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES 2018.04.03 11:11:08 LOG7[main]: TLS options: 0x07004804 (+0x07004800, -0x00000000) 2018.04.03 11:11:08 LOG6[main]: Loading certificate from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Certificate loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Loading private key from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Private key loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG7[main]: Private key check succeeded 2018.04.03 11:11:08 LOG7[main]: ECDH initialization 2018.04.03 11:11:08 LOG7[main]: ECDH initialized with curve prime256v1 2018.04.03 11:11:08 LOG5[main]: Configuration successful 2018.04.03 11:11:08 LOG7[main]: Unbinding service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] closed (FD=6) 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] closed 2018.04.03 11:11:08 LOG7[main]: Binding service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Listening file descriptor created (FD=6) 2018.04.03 11:11:08 LOG7[main]: Option SO_REUSEADDR set on accept socket 2018.04.03 11:11:08 LOG7[main]: Option IP_FREEBIND set on accept socket 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] (FD=6) bound to 192.168.80.16:443 2018.04.03 11:11:08 LOG7[main]: Signal pipe is empty Any help would be appreciated. Thanks -- Mark Brookes Loadbalancer.org Ltd. www.loadbalancer.org +44 (0)330 380 1064 mark(a)loadbalancer.org

2 2

Motion and Stunnel Query
by Vidya Govindan 04 Apr '18

04 Apr '18

Hi Everyone, I am trying to work on a video streaming project which uses the motion software to stream images from a usb camera. By default the streaming is done in a non-secure manner. So I installed Stunnel , generated a self signed certificate and I am not using it on top of the motion software to securely stream images. Now, I want to know exactly how Stunnel encrypts/decrypts image data that is generated by motion? I know that motion sends the data on port 8081 and Stunnel tunnels it to another port 8443. I can not understand where exactly the Openssl library functions are used to add the security feature in this scenario. Can anyone with a better understanding throw some light on the same? Thanks & Regards, Vidya

1 0

proxy with authentication
by Andreas Meier 03 Apr '18

03 Apr '18

3 3

First Time Troubles.
by me＠kilosierracharlie.me 22 Mar '18

22 Mar '18

Hello All, I'm trying to configure STunnel4 on Windows to connect to my VPS installed with STunnel, so I can use SSH through a DPI laden network. The configuration works if I try at home, or on a mobile data hotspot, but if I attempt within the DPI network, it does not work, and provides this console output: 2018.03.22 09:30:15 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.03.22 09:30:15 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.03.22 09:30:15 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.03.22 09:30:15 LOG5[main]: Reading configuration from file stunnel.conf 2018.03.22 09:30:15 LOG5[main]: UTF-8 byte order mark detected 2018.03.22 09:30:15 LOG5[main]: FIPS mode disabled 2018.03.22 09:30:15 LOG5[main]: Configuration successful 2018.03.22 09:30:24 LOG5[0]: Service [ssh] accepted connection from 127.0.0.1:65086 2018.03.22 09:30:24 LOG5[0]: s_connect: connected 130.185.251.28:443 2018.03.22 09:30:24 LOG5[0]: Service [ssh] connected remote server from 172.28.1.25:65087 2018.03.22 09:30:25 LOG4[0]: CERT: Certificate not found in local repository 2018.03.22 09:30:25 LOG4[0]: Rejected by CERT at depth=0: CN=130.185.251.28 2018.03.22 09:30:25 LOG3[0]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed 2018.03.22 09:30:25 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket This is the configuration I'm using: [ssh] client = yes accept = 443 connect = 130.185.251.28:443 CAfile = peer-ssh.pem verifyPeer = yes The odd thing, is that if I connect using my mobile data, and then switch over to filtered internet and try again, it works fine, and adds the following lines to the log: 2018.03.22 09:36:46 LOG5[1]: Service [ssh] accepted connection from 127.0.0.1:65237 2018.03.22 09:36:46 LOG5[1]: s_connect: connected 130.185.251.28:443 2018.03.22 09:36:46 LOG5[1]: Service [ssh] connected remote server from 192.168.43.115:65238 2018.03.22 09:36:46 LOG5[1]: Certificate accepted at depth=0: C=GB, ST=Lincolnshire, L=Horncastle, O=N/A, OU=N/A, CN=personal.kilosierracharlie.me, emailAddress=webmaster(a)kilosierracharlie.me Has anyone got any ideas regarding this issue? It's not mission critical, but it's quite annoyingly repetitive! Cheers, Kieran.

1 0

sTunnel client connecting to load balanced URL - stunnel 5.02 on x86-pc-msvc-1500 platform
by Tony 19 Mar '18

19 Mar '18

Hi all, I have a situation where I'm trying to use sTunnel as the client to connect to a service on a secure URL, but the hiccup is that the secure URL is load balanced. If a do an nslookup on the URL, the response comes back as it being an alias. Non-authoritative answer: Name: eu1571393051174.ssl.ondemand.com Address: 155.56.210.164 Aliases: l4884-iflmap.hcisbp.eu1.hana.ondemand.com Looking at the sTunnel log, it resolves to the IP of the server. But the IP itself does not host the service so I'm getting http:503 errors. 2018.03.16 14:44:44 LOG7[18796]: Service [ssl-OSRdev] (FD=564) bound to 0.0.0.0:8085 2018.03.16 14:44:55 LOG7[18796]: Service [ssl-OSRdev] accepted (FD=572) from 192.168.0.22:61093 2018.03.16 14:44:55 LOG7[18796]: Creating a new thread 2018.03.16 14:44:55 LOG7[18796]: New thread created 2018.03.16 14:44:55 LOG7[30864]: Service [ssl-OSRdev] started 2018.03.16 14:44:55 LOG5[30864]: Service [ssl-OSRdev] accepted connection from 192.168.0.22:61093 2018.03.16 14:44:55 LOG6[30864]: s_connect: connecting 155.56.210.164:443 2018.03.16 14:44:55 LOG7[30864]: s_connect: s_poll_wait 155.56.210.164:443: waiting 10 seconds 2018.03.16 14:44:56 LOG5[30864]: s_connect: connected 155.56.210.164:443 2018.03.16 14:44:56 LOG5[30864]: Service [ssl-OSRdev] connected remote server from 192.168.0.32:30269 2018.03.16 14:44:56 LOG7[30864]: Remote socket (FD=588) initialized 2018.03.16 14:44:56 LOG7[30864]: SNI: sending servername: l4884-iflmap.hcisbp.eu1.hana.ondemand.com 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): before/connect initialization 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv2/v3 write client hello A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server hello A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server certificate A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server key exchange A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server certificate request A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server done A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write client certificate A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write client key exchange A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write certificate verify A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write change cipher spec A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write finished A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 flush data 2018.03.16 14:44:57 LOG7[30864]: SSL state (connect): SSLv3 read finished A 2018.03.16 14:44:57 LOG7[30864]: 1 items in the session cache 2018.03.16 14:44:57 LOG7[30864]: 1 client connects (SSL_connect()) 2018.03.16 14:44:57 LOG7[30864]: 1 client connects that finished 2018.03.16 14:44:57 LOG7[30864]: 0 client renegotiations requested 2018.03.16 14:44:57 LOG7[30864]: 0 server connects (SSL_accept()) 2018.03.16 14:44:57 LOG7[30864]: 0 server connects that finished 2018.03.16 14:44:57 LOG7[30864]: 0 server renegotiations requested 2018.03.16 14:44:57 LOG7[30864]: 0 session cache hits 2018.03.16 14:44:57 LOG7[30864]: 0 external session cache hits 2018.03.16 14:44:57 LOG7[30864]: 0 session cache misses 2018.03.16 14:44:57 LOG7[30864]: 0 session cache timeouts 2018.03.16 14:44:57 LOG7[30864]: Peer certificate was cached (3826 bytes) 2018.03.16 14:44:57 LOG6[30864]: SSL connected: new session negotiated 2018.03.16 14:44:57 LOG6[30864]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2018.03.16 14:44:57 LOG6[30864]: Compression: null, expansion: null 2018.03.16 14:44:58 LOG6[30864]: SSL socket closed (SSL_read) 2018.03.16 14:44:58 LOG7[30864]: Sent socket write shutdown 2018.03.16 14:44:58 LOG5[30864]: Connection closed: 1730 byte(s) sent to SSL, 274 byte(s) sent to socket 2018.03.16 14:44:58 LOG7[30864]: Remote socket (FD=588) closed 2018.03.16 14:44:58 LOG7[30864]: Local socket (FD=572) closed 2018.03.16 14:44:58 LOG7[30864]: Service [ssl-OSRdev] finished (0 left) 2018.03.16 14:44:58 LOG7[30864]: str_stats: 3 block(s), 4294962489 data byte(s), 150 control byte(s) 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:413 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:412 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:411 I have tested the service using SoapUI and it works. Is it possible to have sTunnel follow the URL redirection? Regards, Tony

2 1

Re: [stunnel-users] basic usage question
by Mark Foley 19 Mar '18

19 Mar '18

Solved! I've fixed up the various ports and now I am able to connect. For the edification of other list readers I'll summarize. I have a local Linux host acting as firewall/router. It routes requests on port 1234 to port 3389 on a local Linux workstation which is running x11vnc server listening on its local port 5900. I want to connect to this VNC server from a remote vnc viewer. (Why does the router forward to port 3389? Because the workstaion can dual-boot Windows, so the forward works regardless of booted OS.) Remote vnc viewer, stunnel client stunnel.conf: verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [x11vnc] accept = 5900 connect = router.obfuscate.org:1234 Local workstation vnc server, stunnel server stunnel.conf: pid = /var/run/stunnel.pid debug = 7 [x11vnc] accept = 3389 key = /root/privatekey.pem cert = /root/certificate.pem connect = 127.0.0.1:5900 The certificate is self-signed and created on the stunnel/vnc server host using the following commands: openssl genrsa -out privatekey.pem 2048 openssl req -new -x509 -days 365 -key privatekey.pem -out certificate.pem The certificate.pem is copied to the stunnel client host. With x11vnc listening on 5900 on the local workstation and with 'stunnel stunnel.conf' running on both stunnel client (as the normal user) and server hosts, I use the remote vnc viewer, logged in as a normal user, with the connection 127.0.0.1:5900 I'm guessing I could configure my vnc viewers to connect to multiple clients with difference [service] sections, for example: verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [remoteHost1] accept = 5900 connect = router.obfuscate.org:1234 [remoteHost2] accept = 5901 connect = router.obfuscate.org:4321 I haven't tried that, but I will. I futher guess that I could have different CAfiles per server if I moved that directive to the respective service defintions (can someone confirm?), but I haven't tried that either. Thanks especially to Flo Rance for helping me work through this. Now, I have to figure out how to do this from a Windows client! --Mark

2 1

Creating CSR for GoDaddy
by John McClymont 15 Mar '18

15 Mar '18

Good Morning, As a novice user of stunnel. I use stunnel to make and encrypted video connection to home security system. I wish to create an SSL certificate request to obtain an SSL from GoDaddy I use the following command openssl req -new -newkey rsa:2048 -nodes -keyout c:\key\private_key.key -out c:\key\request.csr Is this correct? thanks in advance for suggestions

2 1

Re: [stunnel-users] basic usage question
by Mark Foley 15 Mar '18

15 Mar '18

Nitin - sorry, I didn't realize this was a response to my message and I sent a followup message before reading this one. I have your patch in a previous message. I'm not familiar with "patching". Can you give me quickie instructions on doing that, or refer me to a link that explains it? I assume I need to patch the source code, right? If so, I have stunnel version 5.35. Do I need to apply this patch to a more recent version? Are there any other sslVersions stunnel supports? Thanks --Mark -----Original Message----- On Tue, 13 Mar 2018 22:21:24 +0400 Nitin Mutkawoa <jmutkawoa(a)hackers.mu> wrote: > > hello > > Sorry, I was not clear enough in my previous mail. > The patch allows you to specify TLS 1.3 in the configuration file and do a > TLS 1.3 only. > > regards > > Nitin J Mutkawoa > > https://tunnelix.com > https://hackers.mu > > Twitter: @TheTunnelix > > On Tue, Mar 13, 2018 at 3:13 PM, Ma??gorzata Olszówka < > Malgorzata.Olszowka(a)stunnel.org> wrote: > > > I'm also working on TLS 1.3 compatibility with Stunnel. I will reach the > >> mailing list as soon as possible with a tested patch. > >> > > > > Hello Nitin, > > Could you specify what problem do you have with TLS 1.3. > > It works for me: > > > > 2018.03.13 11:39:06 LOG5[ui]: stunnel 5.44 on x86_64-unknown-linux-gnu > > platform > > 2018.03.13 11:39:06 LOG5[ui]: Compiled/running with OpenSSL > > 1.1.1-pre2-dev xx XXX xxxx > > ??? > > 2018.03.13 11:39:23 LOG6[0]: Negotiated TLSv1.3 ciphersuite > > TLS13-AES-256-GCM-SHA384 (256-bit encryption) > > > > > > Regards, > > Ma??gorzata > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > >

1 1

Re: [stunnel-users] basic usage question
by Mark Foley 14 Mar '18

14 Mar '18

Thanks to help from Nitin, I've made a tiny bit of progress with stunnel. I've created the certificates per Nitin's instructions at https://tunnelix.com/securing-mysql-traffic-with-stunnel-in-a-jail-environm… Certificates have permissions 0600. I want to use a VNC client on Linux to connect to a VNC Server also on Linux. In between these two computers I have a Linux router which routes all request to port 1914 to port 3389 on the VNC Server. stunnel on the server is run at the command line by root: 'stunnel /root/stunnel.conf'. Here is my VNC Server computer's stunnel.conf: foreground = yes pid = /var/run/stunnel.pid debug = 7 ; output = /root/stunnel.log output = /dev/stdout [x11vnc] accept = 3389 key = /root/privatekey.pem cert = /root/certificate.pem connect = 127.0.0.1:5900 stunnel on the client is run by a normal user, stunnel $HOME/.stunnel/stunnel.conf. Below is my client stunnel.conf: foreground = yes verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [x11vnc] accept = 5900 connect = mail.ohprs.org:1914 When I run stunnel on the client I get: 2018.03.13 13:21:17 LOG5[ui]: stunnel 5.35 on x86_64-slackware-linux-gnu platform 2018.03.13 13:21:17 LOG5[ui]: Compiled with OpenSSL 1.0.2h 3 May 2016 2018.03.13 13:21:17 LOG5[ui]: Running with OpenSSL 1.0.2n 7 Dec 2017 2018.03.13 13:21:17 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2018.03.13 13:21:17 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2018.03.13 13:21:17 LOG5[ui]: Reading configuration from file /home/mfoley/.stunnel/stunnel.conf 2018.03.13 13:21:17 LOG5[ui]: UTF-8 byte order mark not detected 2018.03.13 13:21:17 LOG5[ui]: FIPS mode disabled 2018.03.13 13:21:17 LOG4[ui]: Service [x11vnc] uses "verify = 2" without subject checks 2018.03.13 13:21:17 LOG4[ui]: Use "checkHost" or "checkIP" to restrict trusted certificates 2018.03.13 13:21:17 LOG5[ui]: Configuration successful On the client, I then run tigerVNCViewer connecting to 127.0.0.1::5900. I get the following messages on the client: 2018.03.13 13:22:03 LOG5[0]: Service [x11vnc] accepted connection from 127.0.0.1:35034 2018.03.13 13:22:03 LOG5[0]: s_connect: connected 98.102.63.107:1914 2018.03.13 13:22:03 LOG5[0]: Service [x11vnc] connected remote server from 192.168.0.17:40512 2018.03.13 13:22:03 LOG3[0]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2018.03.13 13:22:03 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Just guessing, but is it failing with the SSLVersion? Help appreciated. Thanks, Mark

1 1

[PATCH] TLS 1.3 Compatibility
by Nitin Mutkawoa 13 Mar '18

13 Mar '18

Hello, To add TLS 1.3 compatibility on Stunnel, the following patch was applied and tested. --- options.c.orig 2018-03-13 04:06:01.410477727 +0000 +++ options.c 2018-03-13 05:42:51.883782519 +0000 @@ -2675,6 +2675,18 @@ NOEXPORT char *parse_service_option(CMD #else /* defined(OPENSSL_NO_TLS1_2) */ return "TLSv1.2 not supported"; #endif /* !defined(OPENSSL_NO_TLS1_2) */ + } else if(!strcasecmp(arg, "TLSv1.3")) { +#ifndef OPENSSL_NO_TLS1_3 + section->client_method=(SSL_METHOD *)TLS_client_method(); + section->server_method=(SSL_METHOD *)TLS_server_method(); + section->ssl_options_set|= SSL_OP_NO_SSLv2; + section->ssl_options_set|= SSL_OP_NO_SSLv3; + section->ssl_options_set|= SSL_OP_NO_TLSv1; + section->ssl_options_set|= SSL_OP_NO_TLSv1_1; + section->ssl_options_set|= SSL_OP_NO_TLSv1_2; +#else /* defined(OPENSSL_NO_TLS1_3) */ + return "TLSv1.3 not supported"; +#endif #endif /* OPENSSL_API_COMPAT<0x10100000L */ } else return "Incorrect version of TLS protocol"; Please see this link for more info about the test for TLS 1.3 https://gist.github.com/jmutkawoa/c97f5d67ded592f6ad04389a3ade623e Regards Nitin J Mutkawoa https://tunnelix.com https://hackers.mu Twitter: @TheTunnelix

1 0

basic usage question
by Mark Foley 10 Mar '18

10 Mar '18

I'm trying to set up an ssl tunnel for VNC per the instructions at https://www.ibm.com/developerworks/library/l-sslvnc/index.html. I've not gotten very far into the steps. I tried: # stunnel -d 5905 -r 5900 -p /root/combined.pem [ ] Clients allowed=500 [.] stunnel 5.35 on x86_64-slackware-linux-gnu platform [.] Compiled with OpenSSL 1.0.2h 3 May 2016 [.] Running with OpenSSL 1.0.2n 7 Dec 2017 [.] Update OpenSSL shared libraries or rebuild stunnel [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [!] Invalid configuration file name "-d" [!] realpath: No such file or directory (2) [ ] Cron thread initialized I find nothing on the -d, -r or -p options in the manpage. This is my 1st posting to this list. I have very rudimentary skills with ssl, ssh, and certificates, mainly limited to getting certificates from a provider and installing for web and email; and creating public keys for ssh login using ssh-keygen. That's about it, so I'm pretty much a certified newbie. Help getting past the starting gate would be greatly appreciated. THX --Mark

1 0

[PATCH] Spectre v2 Vulnerability Mitigations
by Nitin Mutkawoa 07 Mar '18

07 Mar '18

Hello To prevent any leakage (Spectre v2) from a compromised VM on same physical host, this patch would mitigate the impact. --- configure.ac.orig 2018-03-04 01:46:55.877067173 +0400 +++ configure.ac 2018-03-04 01:49:26.422625147 +0400 @@ -101,6 +101,11 @@ if test "$GCC" = yes; then fi AX_APPEND_COMPILE_FLAGS([-D_FORTIFY_SOURCE=2]) +# Spectre v2 mitigations +AX_APPEND_COMPILE_FLAGS([-mfunction-return=thunk]) +AX_APPEND_COMPILE_FLAGS([-mindirect-branch=thunk]) + AC_MSG_NOTICE([**************************************** libtool]) LT_INIT([disable-static]) AC_SUBST([LIBTOOL_DEPS]) Kind regards, Nitin J Mutkawoa https://tunnelix.com https://hackers.mu

1 0