- stunnel-users - stunnel.org

Re: [stunnel-users] Connect using TLS with public Web Server
by peter＠easthope.ca 06 Mar '18

06 Mar '18

From: Carlos Castro <carlos.castro.guerrero(a)gmail.com> Date: Fri, 2 Feb 2018 12:04:08 +0100 > I have older application and now I need connect with external server HTTPS > using TLS . My application doesn't support with TLS and I think use Stunnel > to connect with this Server HTTPS. Same requirement here. Have you tried this configuration? ; yourhost:/etc/stunnel4/stunnel.conf ... [https] client = yes accept = 443 transparent = destination Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca https://en.wikibooks.org/wiki/Medical_Suction_Machines https://en.wikibooks.org/wiki/Oberon

3 6

Stunnel in server mode with certificate from the Windows Certificate Store
by merlin＠mp3merlin.net 06 Mar '18

06 Mar '18

Hello, I'm trying to use stunnel in server mode with certificates from the Windows Certificate Store. I have a basic configuration which is working with a PEM certificate file and I'm trying to get it to use a cert via the CAPI engine. Here is my basic (working) config: debug = debug output = C:\stunnel\stunnel.log options = -NO_SSLv3 [https] accept = 443 connect = 80 cert = stunnel.pem Here is my config using the CAPI engine: debug = debug output = C:\stunnel\stunnel.log engine = capi engineCtrl = debug_level:2 engineCtrl = debug_file:c:\stunnel\capi.log engineCtrl = store_flags:1 engineCtrl = list_certs options = -NO_SSLv3 [https] accept = 443 connect = 80 engineId = capi However stunnel does not seem to find a certificate to use: [...] 2018.03.06 10:22:05 LOG7[main]: Enabling support for engine "capi" 2018.03.06 10:22:05 LOG7[main]: Executing engine control command debug_level:2 2018.03.06 10:22:05 LOG7[main]: Executing engine control command debug_file:c:\stunnel\capi.log 2018.03.06 10:22:05 LOG7[main]: Executing engine control command store_flags:1 2018.03.06 10:22:05 LOG7[main]: Executing engine control command list_certs 2018.03.06 10:22:05 LOG7[main]: Initializing engine #1 (capi) 2018.03.06 10:22:05 LOG6[main]: Engine #1 (capi) initialized [...] 2018.03.06 10:22:05 LOG6[main]: Initializing service [https] 2018.03.06 10:22:05 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.03.06 10:22:05 LOG7[main]: TLS options: 0x01004004 (+0x03004000, -0x02000000) 2018.03.06 10:22:05 LOG7[main]: No certificate or private key specified [...] And I have no certificates listed in the CAPI debug log: Setting debug level to 2 Setting debug file to c:\stunnel\capi.log Setting flags to 1 Listing certs for store MY Opening certificate store MY capi_cert_get_fname When I load the engine via OpenSSL, I can see that a certificate is present in the store: C:\stunnel\bin>openssl.exe engine -t dynamic -pre "SO_PATH:C:\stunnel\engines\capi.dll" -pre LOAD -post store_flags:1 -post store_name:MY -post list_certs WARNING: can't open config file: /devel/win32/openssl/openssl.cnf (dynamic) Dynamic engine loading support [Success]: SO_PATH:C:\stunnel\engines\capi.dll [Success]: LOAD Loaded: (capi) CryptoAPI ENGINE [ available ] [Success]: store_flags:1 Certificate 0 Friendly Name "test" Subject: CN = test Issuer: CN = test [Success]: list_certs This certificate (and the associated private key) has been generated via the IIS Manager console and I have imported it in the Local Computer Store (with the private key). Does anybody have any idea what I am missing to get this to work ? I can provide more logs and run more tests if necessary. I'm using Stunnel 5.44 on Windows 2008 R2. I tried with an older version (5.40) but same problem. Thanks. Kevin

1 0

Re: [stunnel-users] Re: Connect using TLS with public Web Server
by Carlos Castro 06 Mar '18

06 Mar '18

Hi All , it's mandatory for use stunnel wich the infrastructure has client stunnel and server stunnel ?? Or I can have client stunnel vs Web server HTTPS without stunnel server , only web server https . I newbie in stunnel , but i think is mandatory install stunnel in both sites , that's is correct? Regards On 05/03/18 20:23, Carlos Castro wrote: > > Thanks @Mike > > If possible use Squid + stunnel to solve the problem with host > header? The application is very very old . > > Thanks > > > On 05/03/18 20:06, Mike Spooner wrote: >> >> The problem is the "Host: ..." header that is being sent to the >> remote server. You need to configure 127.0.0.1:19021 as a proxy in >> your app (and curl) and then have the app (curl) fetch >> https://ctm.omego.net >> >> >> Not sure how to do that in curl, but search the curl manpage for any >> mentions of "proxy". >> >> -- Mike Spooner >> >> --------- Original Message --------- >> *From*: Carlos Castro >> *Date*: Mon Mar 05 12:28:15 GMT+00:00 2018 >> *Subject*: Re: [stunnel-users] Connect using TLS with public Web Server >> Hello >> >> Thanks @Peter >> >> >> Yes , my application not support TLS and I need the application connect >> using TLS , for this i using stunnel (i hope) >> >> When I make curl -v http://127.0.0.1:19021 : >> >> curl -v http://127.0.0.1:19201 >> * Rebuilt URL to: http://127.0.0.1:19201/ >> * Trying 127.0.0.1... >> * Connected to 127.0.0.1 (127.0.0.1) port 19201 (#0) >> > GET / HTTP/1.1 >> > Host: 127.0.0.1:19201 >> > User-Agent: curl/7.47.0 >> > Accept: */* >> > >> * HTTP 1.0, assume close after body >> < HTTP/1.0 400 Bad Request >> < Server: AkamaiGHost >> < Mime-Version: 1.0 >> < Content-Type: text/html >> < Content-Length: 208 >> < Expires: Mon, 05 Mar 2018 12:25:53 GMT >> < Date: Mon, 05 Mar 2018 12:25:53 GMT >> < Connection: close >> >> The web ctm.omgeo.net only works in mode HTTPS , . >> >> Thanks Peter >> >> >> On 05/03/18 13:22, Peter Pentchev wrote: >> > On Mon, Mar 05, 2018 at 12:32:41PM +0100, Carlos Castro wrote: >> >> Hello , >> >> >> >> Thanks @Peter >> >> >> >> I'm trying to configure to connect with my PC to this Public server >> >> https://ctm.omgeo.net using TLS1.2 but i don't can. >> >> >> >> I'm need setup stunnel for old application doesn't support TLS , >> and this >> >> application need connect with this public server to send data. >> >> >> >> >> >> I'm using the Peter config , but nothing . I try this config : >> >> >> >> [omgeo] >> >> client = yes >> >> accept = 127.0.0.1:19201 >> >> connect = ctm.omgeo.net:443 >> >> verify = 2 >> >> CApath = /etc/ssl/certs/ >> >> >> >> >> >> I'm using Curl to try connect , I'm recive this error >> >> >> >> /etc/ssl/certs# curl -v https://127.0.0.1:19201 >> > Maybe I'm reading this wrong, but if your client application does not >> > support TLS, then it won't speak HTTPS, it would speak plain HTTP. >> > That's what the configuration you're using does - it tells stunnel to >> > run in client mode, i.e. something will connect to stunnel using >> > an unencrypted connection and stunnel will connect to a TLS server >> > (in this case an HTTPS server). >> > >> > So what happens when you try almost the same query, but with the "http" >> > scheme instead of the "https" one? >> > >> > curl -v http://127.0.0.1:19201 >> > >> > G'luck, >> > Peter >> > >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

Client cert auth ?
by Brian Ipsen 27 Feb '18

27 Feb '18

Hi I am trying to see if I can get stunnel to authenticate using a client certificate towards a F5 setup - but I am having trouble getting it to work. Certificates are issued froma Microsoft PKI - where the F5 checks validity via an OCSP responder. In my stunnel config file, I have: [F5Cert] client=yes accept = 127.0.0.1:1598 connect = F5test.xxx.dk:443 delay = yes CAFile = GlobalSign-cert-Chain.pem Cert = BaaSClientCertificatePlain.pem key = BaaSClientCertificatePlain.key verify = 2 In the CAFile, I have the root CA and issuing certificate from GlobalSign - which have created the SSL certificate being used on the F5 (server side). Cert and Key points to the certificate and private key from my internal Microsoft based PKI.. But should the certificate chain from my internal PKI be listed somewhere as well ? Is this the way to do it - and is stunnel capable of handling client certificate validation ? Regards Brian

3 2

Question on reconnection after TCP RST
by Chawla, Vikas 27 Feb '18

27 Feb '18

Hi, We ran into an issue where stunnel after TCP RST from server, retries to re-establish connection after 5 seconds with exponential back off. Wanted to check if there is configuration parameter for us to modify the reconnection time to be a lower number. Thanks, Vikas

1 0

[PATCH] Address already in use (98) when binding to localhost
by Christian Kujau 06 Feb '18

06 Feb '18

Hi, I reported the following to the Fedora bugtracker[0], but only then realized that this happens with the upstream version too. In short: since stunnel 5.44 I am no longer able to have stunnel bind to localhost, when "localhost" is literally mentioned in the configuration file: $ cat stunnel.test [test] client = yes protocol = smtp accept = localhost:12345 connect = localhost:2025 $ stunnel-5.44 stunnel.test [...] [ ] Binding service [test] [ ] Listening file descriptor created (FD=6) [ ] Option SO_REUSEADDR set on accept socket [ ] Service [test] (FD=6) bound to 127.0.0.1:12345 [ ] Listening file descriptor created (FD=7) [ ] Option SO_REUSEADDR set on accept socket [!] bind: Address already in use (98) [!] Error binding service [test] to 127.0.0.1:12345 [ ] Unbinding service [test] [ ] Service [test] closed (FD=6) [ ] Service [test] closed When using "127.0.0.1" or "::1" instead of "localhost" in the configuration file, stunnel-5.44 works. However, then one can only connect to either the IPv4 _or_ the IPv6 address, depending on what's configured. With stunnel-5.43 and "accept=localhost:12345" both IPv4 and IPv6 was available. I suspect that this is related to the following change log entry for 5.44: > Default accept address restored to INADDR_ANY. I have attached a patch to revert that (?) change and also included a test script that fails on my system when the patch is not applied. I see "Version 5.45" already mention in the changelog on the website, but now download yet? Thanks, Christian. [0] https://bugzilla.redhat.com/show_bug.cgi?id=1542361 -- BOFH excuse #424: operation failed because: there is no message for this error (#1014)

1 0

Re: [stunnel-users] stunnel.log not generated in window server 2012 R2
by Zhang, Joanne 02 Feb '18

02 Feb '18

Hello. I installed a Stunnel-5.44-win32 on a Window Server 2012 R2 box. I am using it in client mode only as it is required by the Vendor. It works fine, I can connect to my Vendor's server via Stunnel . However, I don't see any stunnel.log generated when it is run as a service and I searched the entire directory on the server. I know the output path is working . As when I run Stunnel GUI Start, the log is created in the output folder specified in the conf file. Have anyone seen this problem before please? Here is my setting for stunnel.conf that relates to the debug log. debug = 7 output = C:\Program Files (x86)\stunnel\stunnel.log Thanks very much for your help ahead. Joanne _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

1 0

Connect using TLS with public Web Server
by Carlos Castro 02 Feb '18

02 Feb '18

Hi All, I have older application and now I need connect with external server HTTPS using TLS . My application doesn't support with TLS and I think use Stunnel to connect with this Server HTTPS. Wich is the mode I should choose to configurate this connection ? Proxy mode? or like examples created over gmail in default configuration File? The external server , is public server for all people ? should be necesary special certs ? or whit predeterminate certs inside windows (for use IE, chroome , firefox etc..etcc) is necesary ? Many thanks Regards

1 0

Re (2): Relationship to Netfilter.
by peter＠easthope.ca 26 Jan '18

26 Jan '18

From: Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> Date: Thu, 25 Jan 2018 18:23:58 +0100 > If it was in this diagram, it would be a 'local process' on the > application layer. So, two softwares, netfilter and stunnel, in a computer system. stunnel in the OSI application layer and netfilter in the protocol, network and link layers. That's a relationship. > Obviously nowhere. (Stunnel is not related to the Linux Netfilter.). Depends on your personal definition of a relationship. Thanks for explaining, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca https://en.wikibooks.org/wiki/Medical_Suction_Machines https://en.wikibooks.org/wiki/Oberon

1 0

Relationship to Netfilter.
by Peter Easthope 25 Jan '18

25 Jan '18

Where is stunnel in this diagram? https://en.wikipedia.org/wiki/Netfilter#/media/File:Netfilter-packet-flow.s… Thanks, ... Peter E. -- Telephone 1 360 639 0202 or +13606390202. Bcc: peter at easthope.ca http://easthope.ca/Shop.html

2 1

stunnel + mjpeg_streamer issue
by Akos Schneemaier 23 Jan '18

23 Jan '18

HI stunnel users, i hope somebody have an idea what is going wrong in my config: I am runnung debian on an arm box with kernel 4.4.89 and stunnel 5.44. I use mjpeg_streamer to stream webcam images. mjpeg streamer is attaches to port 8080 for http, but for external access connection goes through stunnel on port 2970. The problem is when i connect to mjpeg streamer to get a snapshot via stunnel i receive a broken image 8 time out of 10: https:/ipaddress:2970/?action=snapshot. When i do this via http:/ipaddress:8080/?action=snapshot everything works fine. it seems when image size is below ~11k then it works fine with stunnel, when the size goes above then the chance to receive a broken image increases with stunnel, normal image size is around 22k. Futuremore when i connect to the mjpeg stream of mjpeg stream then everything works fine even over stunnel https:/ipaddress:2970/?action=stream Here is the service config file: pid=/tmp/cam.pid ;foreground=yes ;debug=7 [cam0] cert = /etc/letsencrypt/live/..../fullchain.pem key = /etc/letsencrypt/live/..../privkey.pem sslVersion = all client = no accept = 2970 connect = 8080 [cam1] cert = /etc/letsencrypt/live/..../fullchain.pem key = /etc/letsencrypt/live/..../privkey.pem sslVersion = all client = no accept = 2971 connect = 8081 [cam2] cert = /etc/letsencrypt/live/..../fullchain.pem key = /etc/letsencrypt/live/..../privkey.pem sslVersion = all client = no accept = 2972 connect = 8082 Any ideas welcome! Thanks

1 0

Update on my stunnel problems
by Phil Smith III 21 Jan '18

21 Jan '18

As I'm sure all of you were thinking, the localhost vs. 127.0.0.1 shouldn't have made a difference, and probably didn't: that was across two different machines, as I'd had to switch horses mid-stream (always a bad idea, I realize). Mind you, both machines are the same hardware, same OS, etc. And the 127.0.0.1 version started working on the first machine after a while; I suspect I was seeing Cox's authentication server problems muddying the waters-it has that problem from time to time. BTW, I did check, and I have localhost entries for both IPv4 and IPv6 in my hosts file. This morning when I finally got access to my wife's machine, I installed stunnel with the same config that was working on machine#2 and changed Eudora to point to localhost. I could see Eudora happily connecting to stunnel, but then nothing happened. After the usual checking everything, I decided to try port 1110 instead of 110 for one of the POP accounts. That necessitated closing and reopening Eudora so I could hack the .ini file. After doing so, it worked. Then I changed the other accounts to localhost and they kept working. "Odd", sez I: "I haven't changed them to port 1110!" Still not sure how they were working, since localhost is definitely not serving port 110 that I know of. As my wife was getting antsy about getting her machine back, I didn't investigate further (wish I'd had time): I just changed the stunnel port back to 110, put the one account back to 110, restarted Eudora and refreshed the stunnel config.and all is now working fine. So something was stuck in an old setting, but that doesn't explain either why it was connecting to stunnel but not getting past it, or how it was going to localhost 110 and still working. In any case, it's functioning beautifully (in time for the Wednesday shutdown of non-encrypted POP), and I share this in case it helps someone else down the line! I don't care about SMTP, as I don't use Cox's SMTP anyway. Thanks again for all the helpful suggestions. There wasn't any single "Aha!" moment, but they all helped lead me to the happy place. .phsiii

1 0

Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Now that's interesting. Note that the failed nslookup looked v6-ish. I wonder if Cox is doing some v6 stuff that I don't know about! -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Vincent Deschenes Sent: Thursday, January 18, 2018 1:17 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 >From my experience, this relates to IPv4 vs IPv6. 127.0.0.1 is explicitly V4. While localhost can be V6. Vincent Deschenes -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca Sent: Thursday, 18 January 2018 1:08 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Huh. It does have it. But why didn’t 127.0.0.1 work, I wonder? From: stunnel-users [mailto:[email protected]] On Behalf Of Carter Browne Sent: Thursday, January 18, 2018 2:11 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 You should check your hosts file in \windows\system32\drivers\etc. Make sure it has an entry: 127.0.0.1 localhost The text claims it doesn't need it, but it doesn't hurt to have it, and I'm not sure I totally believe the text. Carter On 1/18/2018 1:55 PM, Phil Smith III wrote: Oh, the logging works--it just doesn't like it there in the file. I have it earlier and it's fine. -------------- C:\Users\phsiii>ls -ld \temp\stunnel-log.txt -rw-r--r-- 1 phsiii None 266835 Jan 18 08:52 \temp\stunnel-log.txt # That's Cygwin ls -- remember, this is Windows 7 C:\Users\phsiii>nslookup localhost Server: UnKnown Address: 2001:4860:4860::8888 *** UnKnown can't find localhost: No response from server # Windows nslookup (per "which nslookup") -------------- Odd. -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca <mailto:[email protected]> Sent: Thursday, January 18, 2018 1:13 PM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <mailto:[email protected]> <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P.

1 0

Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Oh, the logging works--it just doesn't like it there in the file. I have it earlier and it's fine. -------------- C:\Users\phsiii>ls -ld \temp\stunnel-log.txt -rw-r--r-- 1 phsiii None 266835 Jan 18 08:52 \temp\stunnel-log.txt # That's Cygwin ls -- remember, this is Windows 7 C:\Users\phsiii>nslookup localhost Server: UnKnown Address: 2001:4860:4860::8888 *** UnKnown can't find localhost: No response from server # Windows nslookup (per "which nslookup") -------------- Odd. -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 1:13 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

2 1

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Well, I'm stunned (pun intended): while the output= wasn't accepted (it said it wasn't valid there), changing 127.0.0.1 to localhost seems to have fixed it! -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 12:20 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > Here's my stunnel.conf, with blank lines and comments removed: > client = yes > output = C:\temp\stunnel-log.txt > taskbar = yes > debug = 7 > [POP3 Incoming] > protocol = pop3 > accept = 127.0.0.1:1110 > connect = pop.cox.net:995 > protocol = smtp > accept = 127.0.0.1:25 > connect = smtp.cox.net:465 Here it worked for POP3 immediately. Not needed for SMTP. https://en.wikibooks.org/wiki/Oberon/Oberon#Receiving_and_Sending_Email Before using 1110, check. netstat -tulpn | grep 1110 Correct id, passwd and port are in the MUA? Separate configurations for POP3 and SMTP. Troubleshoot one at a time. "protocol" shouldn't be necessary. Try this. [POP3] client = yes output = C:\temp\stunnel-log.txt accept = localhost:1110 connect = pop.cox.net:995 Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: Andrew Culver <aculver(a)uwo.ca> Date: Thu, 18 Jan 2018 11:39:20 -0500 > Some protocols use a protocol-specific command to begin TLS negotiation > (STARTTLS for SMTP and POP3), so stunnel needs to know how (and be told) to > use that command. Phil, General troubleshooting rule, always try for a most elementary, ordinary case before resorting to a special case. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

P.s. From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > protocol = pop3 The stunnel(8) manual has this. "protocol = PROTO application protocol to negotiate TLS This option enables initial, protocol-specific negotiation of the TLS encryption." Is there any need for protocol-specific negotiation? Why? Stunnel provides a tunnel and POP3 works inside. That's all. Try the configuration without the protocol option. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

2 1

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Right, I had done that: >Yes, I have protocol = pop3 and protocol = smtp; I’ve tried >commenting them out individually, no change that I can see. The doc really isn't clear about why you'd want/need these, by the way. But your earlier suggestion (localhost instead of 127.0.0.1) seems to have worked. Still a mystery. I'll be tinkering on machine2 tonight, and then will try on the wife's machine! -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 9:51 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7 P.s. From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > protocol = pop3 The stunnel(8) manual has this. "protocol = PROTO application protocol to negotiate TLS This option enables initial, protocol-specific negotiation of the TLS encryption." Is there any need for protocol-specific negotiation? Why? Stunnel provides a tunnel and POP3 works inside. That's all. Try the configuration without the protocol option. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > Here's my stunnel.conf, with blank lines and comments removed: > client = yes > output = C:\temp\stunnel-log.txt > taskbar = yes > debug = 7 > [POP3 Incoming] > protocol = pop3 > accept = 127.0.0.1:1110 > connect = pop.cox.net:995 > protocol = smtp > accept = 127.0.0.1:25 > connect = smtp.cox.net:465 Here it worked for POP3 immediately. Not needed for SMTP. https://en.wikibooks.org/wiki/Oberon/Oberon#Receiving_and_Sending_Email Before using 1110, check. netstat -tulpn | grep 1110 Correct id, passwd and port are in the MUA? Separate configurations for POP3 and SMTP. Troubleshoot one at a time. "protocol" shouldn't be necessary. Try this. [POP3] client = yes output = C:\temp\stunnel-log.txt accept = localhost:1110 connect = pop.cox.net:995 Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Cox has been warning us that as of next week, we need to use encrypted POP and SMTP. I have two reasons to use stunnel now: 1) I use the K9 Bayesian email proxy for spam filtering, and it doesn't do TLS 2) My wife still uses Eudora and doesn't want to switch, and while Eudora allegedly supports TLS, it's not trivial to make it work (and Cox certainly won't help) Thus stunnel looks like an ideal solution. But after tinkering for a few hours on two machines, I'm stumped. While I can type an SMTP or POP transaction in my sleep, I'm not so good at typing a TLS handshake, so I'm using Outlook 2013 as my test platform (and that's what I'll be using myself later anyway). I setup a new account, point to the right ports on 127.0.0.1, and the test times out, with: Log onto incoming mail server (POP3): The operation timed out waiting for a response from the receiving (POP) server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP). Send test e-mail message: The operation timed out waiting for a response from the sending (SMTP) server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP). Here's my stunnel.conf, with blank lines and comments removed: client = yes output = C:\temp\stunnel-log.txt taskbar = yes debug = 7 [POP3 Incoming] protocol = pop3 accept = 127.0.0.1:1110 connect = pop.cox.net:995 protocol = smtp accept = 127.0.0.1:25 connect = smtp.cox.net:465 Yes, that's port 1110, since K9 is using 110. Shouldn't matter, right? (As long as I point the client at 1110, obviously!) Yes, I have protocol = pop3 and protocol = smtp; I've tried commenting them out individually, no change that I can see. Yes, I'm running stunnel explicitly, not as a service-I found threads suggesting that it just doesn't work as a service on Windows 7 for some reason (and in fact beat my head against that wall for a while first). And here's the stunnel log: 2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1 2018.01.17 21:29:24 LOG7[main]: No limit detected for the number of clients 2018.01.17 21:29:24 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.01.17 21:29:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.01.17 21:29:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.01.17 21:29:24 LOG7[main]: errno: (*_errno()) 2018.01.17 21:29:24 LOG7[ui]: GUI message loop initialized 2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1 2018.01.17 21:29:24 LOG5[main]: Reading configuration from file stunnel.conf 2018.01.17 21:29:24 LOG5[main]: UTF-8 byte order mark not detected 2018.01.17 21:29:24 LOG5[main]: FIPS mode disabled 2018.01.17 21:29:24 LOG7[main]: Compression disabled 2018.01.17 21:29:24 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2018.01.17 21:29:24 LOG7[main]: Wrote 0 new random bytes to C:/.rnd 2018.01.17 21:29:24 LOG7[main]: PRNG seeded successfully 2018.01.17 21:29:24 LOG6[main]: Initializing service [POP3 Incoming] 2018.01.17 21:29:24 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.01.17 21:29:24 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2018.01.17 21:29:24 LOG7[main]: No certificate or private key specified 2018.01.17 21:29:24 LOG4[main]: Service [POP3 Incoming] needs authentication to prevent MITM attacks 2018.01.17 21:29:24 LOG5[main]: Configuration successful 2018.01.17 21:29:24 LOG7[main]: Binding service [POP3 Incoming] 2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=460) 2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=460) bound to 127.0.0.1:1110 2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=464) 2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=464) bound to 127.0.0.1:25 2018.01.17 21:29:24 LOG7[cron]: Cron thread initialized 2018.01.17 21:29:50 LOG7[main]: Found 1 ready file descriptor(s) 2018.01.17 21:29:50 LOG7[main]: FD=424 ifds=r-x ofds=--- 2018.01.17 21:29:50 LOG7[main]: FD=460 ifds=r-x ofds=r-- 2018.01.17 21:29:50 LOG7[main]: Service [POP3 Incoming] accepted (FD=488) from 127.0.0.1:54855 2018.01.17 21:29:50 LOG7[main]: Creating a new thread 2018.01.17 21:29:50 LOG7[main]: New thread created 2018.01.17 21:29:50 LOG7[0]: Service [POP3 Incoming] started 2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on local socket 2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] accepted connection from 127.0.0.1:54855 2018.01.17 21:29:50 LOG6[0]: failover: round-robin, starting at entry #1 2018.01.17 21:29:50 LOG6[0]: s_connect: connecting 68.6.19.8:465 2018.01.17 21:29:50 LOG7[0]: s_connect: s_poll_wait 68.6.19.8:465: waiting 10 seconds 2018.01.17 21:29:50 LOG5[0]: s_connect: connected 68.6.19.8:465 2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] connected remote server from 192.168.1.17:54856 2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.01.17 21:29:50 LOG7[0]: Remote descriptor (FD=508) initialized 2018.01.17 21:30:24 LOG6[cron]: Executing cron jobs 2018.01.17 21:30:24 LOG6[cron]: Cron jobs completed in 0 seconds 2018.01.17 21:30:24 LOG7[cron]: Waiting 86400 seconds 2018.01.17 21:31:05 LOG7[main]: Found 1 ready file descriptor(s) 2018.01.17 21:31:05 LOG7[main]: FD=424 ifds=r-x ofds=--- 2018.01.17 21:31:05 LOG7[main]: FD=460 ifds=r-x ofds=--- 2018.01.17 21:31:05 LOG7[main]: Service [POP3 Incoming] accepted (FD=528) from 127.0.0.1:54891 2018.01.17 21:31:05 LOG7[main]: Creating a new thread 2018.01.17 21:31:05 LOG7[main]: New thread created 2018.01.17 21:31:05 LOG7[1]: Service [POP3 Incoming] started 2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on local socket 2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] accepted connection from 127.0.0.1:54891 2018.01.17 21:31:05 LOG6[1]: failover: round-robin, starting at entry #0 2018.01.17 21:31:05 LOG6[1]: s_connect: connecting 146.20.147.245:995 2018.01.17 21:31:05 LOG7[1]: s_connect: s_poll_wait 146.20.147.245:995: waiting 10 seconds 2018.01.17 21:31:05 LOG5[1]: s_connect: connected 146.20.147.245:995 2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] connected remote server from 192.168.1.17:54892 2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on remote socket 2018.01.17 21:31:05 LOG7[1]: Remote descriptor (FD=336) initialized 2018.01.17 21:34:05 LOG3[1]: Unexpected socket close (s_read) 2018.01.17 21:34:05 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.01.17 21:34:05 LOG7[1]: Remote descriptor (FD=336) closed 2018.01.17 21:34:05 LOG7[1]: Local descriptor (FD=528) closed 2018.01.17 21:34:05 LOG7[1]: Service [POP3 Incoming] finished (1 left) 2018.01.17 21:34:05 LOG7[1]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2018.01.17 21:34:05 LOG7[1]: str_stats: 32 byte(s) at ..\src\network.c:680 2018.01.17 21:34:50 LOG6[0]: s_read: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2018.01.17 21:34:50 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.01.17 21:34:50 LOG7[0]: Remote descriptor (FD=508) closed 2018.01.17 21:34:50 LOG7[0]: Local descriptor (FD=488) closed 2018.01.17 21:34:50 LOG7[0]: Service [POP3 Incoming] finished (0 left) 2018.01.17 21:34:50 LOG7[0]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2018.01.17 21:34:50 LOG7[0]: str_stats: 32 byte(s) at ..\src\network.c:680 It looks like it connects, but then just sits there?! I see these: No certificate or private key specified Service [POP3 Incoming] needs authentication to prevent MITM attacks but that's during startup. Or are those significant? I feel like I'm one setting away from having this all work.! Thanks in advance for any suggestions. -- ...phsiii

1 0

TLS socket closed (SSL_write) with unsent byte(s)
by Cotswold Group - Stephen Murray 16 Jan '18

16 Jan '18

Hi All, We use stunnel to send emails from our scanners to our hosted mail provider (that now only accept TLS connections). This has been working well for a number of years, but just recently the scanners (all Lexmark) have sporadically been giving errors of 'connection failed'. If I check the stunnel logs, the failed send has an extra line in of TLS socket closed (SSL_write) with 418 unsent byte(s) Below are 2 examples, 59 was sent successfully, 60 was not. 2018.01.16 14:37:24 LOG5[59]: Service [fasthosts-smtp] accepted connection from 10.226.174.95:11473 2018.01.16 14:37:24 LOG5[59]: s_connect: connected 213.171.216.50:465 2018.01.16 14:37:24 LOG5[59]: Service [fasthosts-smtp] connected remote server from 10.226.150.9:52577 2018.01.16 14:37:24 LOG5[59]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.01.16 14:37:24 LOG5[59]: s_connect: connected 23.55.155.27:80 2018.01.16 14:37:24 LOG5[59]: OCSP: Certificate accepted 2018.01.16 14:37:24 LOG5[59]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.01.16 14:37:25 LOG5[59]: s_connect: connected 23.55.155.27:80 2018.01.16 14:37:25 LOG5[59]: OCSP: Certificate accepted 2018.01.16 14:37:25 LOG5[59]: Certificate accepted at depth=0: C=GB, ST=Gloucestershire, L=Gloucester, O=Fasthosts Internet Limited, OU=NOC, CN=smtp.livemail.co.uk 2018.01.16 14:37:29 LOG5[59]: Connection closed: 167106 byte(s) sent to TLS, 376 byte(s) sent to socket 2018.01.16 14:38:19 LOG5[60]: Service [fasthosts-smtp] accepted connection from 10.226.174.95:11483 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 213.171.216.50:465 2018.01.16 14:38:19 LOG5[60]: Service [fasthosts-smtp] connected remote server from 10.226.150.9:52620 2018.01.16 14:38:19 LOG5[60]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 23.55.155.27:80 2018.01.16 14:38:19 LOG5[60]: OCSP: Certificate accepted 2018.01.16 14:38:19 LOG5[60]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 23.55.155.27:80 2018.01.16 14:38:19 LOG5[60]: OCSP: Certificate accepted 2018.01.16 14:38:19 LOG5[60]: Certificate accepted at depth=0: C=GB, ST=Gloucestershire, L=Gloucester, O=Fasthosts Internet Limited, OU=NOC, CN=smtp.livemail.co.uk 2018.01.16 14:38:24 LOG3[60]: TLS socket closed (SSL_write) with 418 unsent byte(s) 2018.01.16 14:38:24 LOG5[60]: Connection reset: 964 byte(s) sent to TLS, 392 byte(s) sent to socket Has anyone come across this before? Our mail provider has send limits in place of 50 every 10 minutes, but I am confident we are not reaching those amounts. Any help appreciated. Regards, Stephen

1 0

Connecting a HTTP browser to a HTTPS server.
by peter＠easthope.ca 12 Jan '18

12 Jan '18

Hello, I'm interested to configure stunnel to allow my local non-TLS Web browser to receive pages from a remote server providing only HTTPS. This section of https://www.stunnel.org/static/stunnel.html appears relevant. transparent = none | source | destination | both (Unix only) enable transparent proxy support on selected platforms ... destination The original destination is used instead of the connect option. A service section for transparent destination may look like this: [transparent] client = yes accept = <stunnel_port> transparent = destination This configuration requires iptables setup to work, possibly in /etc/rc.local or equivalent file. ... For a connect target installed on a remote host: /sbin/iptables -I INPUT -i eth0 -p tcp --dport <stunnel_port> -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport <redirected_port> \ -i eth0 -j DNAT --to-destination <local_ip>:<stunnel_port> The transparent destination option is currently only supported on Linux. ==================================== Substitution of parameters for my context gives these configurations.. [transparent] client = yes accept = 127.0.0.1:954 transparent = destination /sbin/iptables -I INPUT -i eth0 -p tcp --dport 954 -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport 443 \ -i eth0 -j DNAT --to-destination 127.0.0.1:954 The non-TLS browser would address http://www.stunnel.org:954/ and receive the page from https://www.stunnel.org:443/. According to Wikipedia, 954 is not assigned. The browser would continue to receive the page http://www.website.org/ without involvement of stunnel or iptables. Plausible? Thanks, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0