- stunnel-users - stunnel.org

Problem: eMail over SMTP on port 587 accepted without error but not forwarded
by Ben Stover 02 Nov '17

02 Nov '17

After a long time of successful usage of stunnel on a Windows 7 system I experienced now permanent problems with sending messages from my local email client over stunnel + SMTP to the remote smtp-server on port 587. Again: my local client+stunnel setup is/was untouched. When I send now messages to remote port 587 (as before) they are silently accepted but NOT forwarded to the final destination. No error messages was returned. The only thing I could imagine is that the webhoster changed the mail server certificate. How does stunnel handle this scenario? Do I have to tell stunnel that the remote certificate changed? how? Receiving eMails through POP3 on port 995 works. WebHoster has no clue what the reason is. The (anonymized) log below shows the transfer Any help is welcomed. Thank you Peter 2017.11.02 13:03:51 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.02 13:03:51 LOG7[main]: FD=388 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=464 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=468 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=472 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=476 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=480 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=484 ifds=r-x ofds=r-- 2017.11.02 13:03:51 LOG7[main]: FD=488 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=492 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=496 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=500 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=504 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=508 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=512 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=516 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=520 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=524 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=528 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: Service [mail-smtp] accepted (FD=904) from 127.0.0.1:47872 2017.11.02 13:03:51 LOG7[main]: Creating a new thread 2017.11.02 13:03:51 LOG7[main]: New thread created 2017.11.02 13:03:51 LOG7[537]: Service [mail-smtp] started 2017.11.02 13:03:51 LOG7[537]: Option TCP_NODELAY set on local socket 2017.11.02 13:03:51 LOG5[537]: Service [mail-smtp] accepted connection from 127.0.0.1:47872 2017.11.02 13:03:51 LOG6[537]: s_connect: connecting 195.54.77.83:587 2017.11.02 13:03:51 LOG7[537]: s_connect: s_poll_wait 195.54.77.83:587: waiting 10 seconds 2017.11.02 13:03:51 LOG5[537]: s_connect: connected 195.54.77.83:587 2017.11.02 13:03:51 LOG5[537]: Service [mail-smtp] connected remote server from 192.168.0.10:47873 2017.11.02 13:03:51 LOG7[537]: Option TCP_NODELAY set on remote socket 2017.11.02 13:03:51 LOG7[537]: Remote descriptor (FD=876) initialized 2017.11.02 13:03:51 LOG7[537]: <- 220 foobar.testserver.com ESMTP Postfix 2017.11.02 13:03:51 LOG7[537]: -> 220 foobar.testserver.com ESMTP Postfix 2017.11.02 13:03:51 LOG7[537]: -> EHLO localhost 2017.11.02 13:03:51 LOG7[537]: <- 250-foobar.testserver.com 2017.11.02 13:03:51 LOG7[537]: <- 250-PIPELINING 2017.11.02 13:03:51 LOG7[537]: <- 250-SIZE 104857600 2017.11.02 13:03:51 LOG7[537]: <- 250-ETRN 2017.11.02 13:03:51 LOG7[537]: <- 250-STARTTLS 2017.11.02 13:03:51 LOG7[537]: <- 250-ENHANCEDSTATUSCODES 2017.11.02 13:03:51 LOG7[537]: <- 250-8BITMIME 2017.11.02 13:03:51 LOG7[537]: <- 250 DSN 2017.11.02 13:03:51 LOG7[537]: -> STARTTLS 2017.11.02 13:03:51 LOG7[537]: <- 220 2.0.0 Ready to start TLS 2017.11.02 13:03:51 LOG6[537]: SNI: sending servername: foobar.testserver.com 2017.11.02 13:03:51 LOG6[537]: Peer certificate not required 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): before/connect initialization 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write client hello A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server hello A 2017.11.02 13:03:51 LOG6[537]: Certificate verification disabled 2017.11.02 13:03:51 LOG6[537]: Certificate verification disabled 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server certificate A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server key exchange A 2017.11.02 13:03:51 LOG6[537]: Client certificate not requested 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server done A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write client key exchange A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write finished A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 flush data 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server session ticket A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read finished A 2017.11.02 13:03:51 LOG7[537]: 2 client connect(s) requested 2017.11.02 13:03:51 LOG7[537]: 2 client connect(s) succeeded 2017.11.02 13:03:51 LOG7[537]: 0 client renegotiation(s) requested 2017.11.02 13:03:51 LOG7[537]: 0 session reuse(s) 2017.11.02 13:03:51 LOG6[537]: TLS connected: new session negotiated 2017.11.02 13:03:51 LOG7[537]: Deallocating application specific data for session connect address 2017.11.02 13:03:51 LOG6[537]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.02 13:03:51 LOG7[537]: Compression: null, expansion: null 2017.11.02 13:03:52 LOG6[537]: Read socket closed (readsocket) 2017.11.02 13:03:52 LOG7[537]: Sending close_notify alert 2017.11.02 13:03:52 LOG7[537]: TLS alert (write): warning: close notify 2017.11.02 13:03:52 LOG6[537]: SSL_shutdown successfully sent close_notify alert 2017.11.02 13:03:52 LOG7[537]: TLS alert (read): warning: close notify 2017.11.02 13:03:52 LOG6[537]: TLS closed (SSL_read) 2017.11.02 13:03:52 LOG7[537]: Sent socket write shutdown 2017.11.02 13:03:52 LOG5[537]: Connection closed: 2954 byte(s) sent to TLS, 337 byte(s) sent to socket 2017.11.02 13:03:52 LOG7[537]: Remote descriptor (FD=876) closed 2017.11.02 13:03:52 LOG7[537]: Local descriptor (FD=904) closed 2017.11.02 13:03:52 LOG7[537]: Service [mailo-smtp] finished (0 left)

1 0

Re: [stunnel-users] How to distinguish stunnel definition between SMTP through SSL-TLS vs. STARTTLS?
by Harris, Douglas (SSC/SPC) 26 Oct '17

26 Oct '17

> Ok, if I specify > > protocol=smtp > > what does that mean: "Connect through SSL-TLS protocol" or "connect through STARTTLS protocol"? That means connect using STARTTLS. > It seems to me that I ALWAYS have to specify "protocol=smtp" for ALL smtp-server connects. You don't. If you are not using STARTTLS you don't specify "protocol=". > Is this done only by port number 465 vs 587? No. > That would mean there is a hidden configuration by convention! Indeed. That would be bad. > What if the webhoster would set up a special mail server at port 8888? Then you would specify port 8888 in your "connect=" config

1 0

How to distinguish stunnel definition between SMTP through SSL-TLS vs. STARTTLS?
by Ben Stover 26 Oct '17

26 Oct '17

As yyou know there are two types of letting a local email client connect to remote secured SMTP server: 1.) through SSL-TLS and 2.) through STARTTLS How do I distinguish betwen these connection types in the stunnel.conf setup file? In a previous post I was told to look at the "protocol" parameter. Ok, if I specify protocol=smtp what does that mean: "Connect through SSL-TLS protocol" or "connect through STARTTLS protocol"? It seems to me that I ALWAYS have to specify "protocol=smtp" for ALL smtp-server connects. The stunnel documentation does not explain how to setup the *.conf file for each of the variants. Is this done only by port number 465 vs 587? That would mean there is a hidden configuration by convention! What if the webhoster would set up a special mail server at port 8888? Ben

1 0

stunnel and TLS1.2 for IE
by Thomas GMX 20 Oct '17

20 Oct '17

Hello. I have successfully configured my email client (Outlook 2010) to my provider with TLS1.2 via stunnel running as a service. config: debug = 5 engine = capi [freenet-pop3s] client = yes EngineID = capi accept = localhost:2110 connect = mx.freenet.de:995 [freenet-smpts] client = yes EngineID = capi accept = localhost:2025 connect = mx.freenet.de:465 That was no problem. But at this point I am wondering if it is possible and how I can configure stunnel so that "all" https traffic from Internet Explorer is going through stunnel and connect to internet with highest secure level supported. Not only to one specific server (connect = xyz.net) but to all servers given in IE address. By now I guess that I have to set IE so that it uses a https-proxy at "localhost:xxx" with stunnel config "accept = localhost:xxx". But how is stunnel config for "connect x.x.x.x:443" that it connect to the right server in internet I specified in IE address line? Can someone give me a hint? Or impossible? Thanks a lot Thomas

2 1

Connection setup for STARTTLS vs. SSL/TLS for POP3/SMTP mail servers?
by Ben Stover 20 Oct '17

20 Oct '17

In stunnels *.conf file I can specify the mail server name and the port for a connection. How can I tell stunnel to use STARTTLS as connect type? How can I tell stunnel to use SSL/TLS as connect type? Does stunnel support both connect types at all or only one? Is the connect type for SMTP completely determined by port e.g.: STARTTLS over port 587 and SSL/TLS over port 465 or can both connect types use both ports? Assume I do not get the supported connect type information from my webhoster: How can I find it out from my (client) side? What are there error messages? Ben

2 1

Stunnel on Android 7.x not working?
by John Appleseed 14 Oct '17

14 Oct '17

Hello, I have trouble with stunnel on Android 7.x.. I'm trying to connect to OpenVPN server through SSL tunneling with stunnel. On phone I'm using stunnel installed in Termux and OpenVPN. Everything is correctly configured, Im using the same config on other devices in same network and it works perfectly. I tried it with different devices with Android 7.x and it is not working at all :( Immediately after succesful connection I am receiving: TLS fd: Software caused connection abort (103) TLS socket closed (SSL_read) And it is still reconnecting again and again with the same error. I also tried it with stunnel downloaded directly from stunnel.org site.. Anyone with new Android who have working stunnel? Where can be the problem? Example stunnel.conf on Android: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = debug [openvpn] client = yes accept = 1337 connect = *****.ddns.net:993 cert = /path/to/stunnel.pem and on server: chroot = /var/lib/stunnel4 pid = /stunnel.pid output = /stunnel.log setuid = stunnel4 setgid = stunnel4 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [openvpn] client = no accept = 993 connect = 127.0.0.1:1194 cert = /etc/stunnel/stunnel.pem Example stunnel.log is in attachment. Thank you very much

1 0

No certificate or private key specified
by Hugo Darley 12 Oct '17

12 Oct '17

Hi, After overcoming some initial more obvious problems I have still been unable to get this client's stunnel configured correctly. "No certificate or private key specified" - is this significant? Stunnel.conf looks like the below: debug = 2 output = stunnel.log CAfile=.\ca-verisign.crt client=yes verify=0 sslVersion = TLSv1.2 options = NO_SSLv2 options = NO_SSLv3 [TRD] accept=16002 connect= our.ip.com:443 [INV] accept=16003 connect= our.ip.com:443 Stunnel output log below 2017.10.12 10:53:22 LOG7[main]: Found 1 ready file descriptor(s) 2017.10.12 10:53:22 LOG7[main]: FD=276 ifds=r-x ofds=--- 2017.10.12 10:53:22 LOG7[main]: FD=284 ifds=r-x ofds=--- 2017.10.12 10:53:22 LOG7[main]: Dispatching signals from the signal pipe 2017.10.12 10:53:22 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2017.10.12 10:53:22 LOG7[main]: Running on Windows 6.1 2017.10.12 10:53:22 LOG5[main]: Reading configuration from file stunnel.conf 2017.10.12 10:53:22 LOG5[main]: UTF-8 byte order mark detected 2017.10.12 10:53:22 LOG5[main]: FIPS mode disabled 2017.10.12 10:53:22 LOG7[main]: Compression disabled 2017.10.12 10:53:22 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2017.10.12 10:53:22 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2017.10.12 10:53:22 LOG7[main]: PRNG seeded successfully 2017.10.12 10:53:22 LOG6[main]: Initializing service [TRD] 2017.10.12 10:53:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.10.12 10:53:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.10.12 10:53:22 LOG7[main]: No certificate or private key specified 2017.10.12 10:53:22 LOG4[main]: Service [TRD] needs authentication to prevent MITM attacks 2017.10.12 10:53:22 LOG6[main]: Initializing service [INV] 2017.10.12 10:53:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.10.12 10:53:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.10.12 10:53:22 LOG7[main]: No certificate or private key specified 2017.10.12 10:53:22 LOG4[main]: Service [INV] needs authentication to prevent MITM attacks 2017.10.12 10:53:22 LOG5[main]: Configuration successful 2017.10.12 10:53:22 LOG7[main]: Closing service [TRD] 2017.10.12 10:53:22 LOG7[main]: Service [TRD] closed (FD=284) 2017.10.12 10:53:22 LOG7[main]: Service [TRD] closed 2017.10.12 10:53:22 LOG7[main]: Closing service [INV] 2017.10.12 10:53:22 LOG7[main]: Service [INV] closed (FD=276) 2017.10.12 10:53:22 LOG7[main]: Service [INV] closed We tried giving the certification a hard location but still it seems unable to find it. Is there anything in the cfg you can see missing? Bearing in mind this is standard cfg for our clients connecting in. Kind regards, Hugo Darley The information contained in and accompanying this communication is strictly confidential and intended solely for the use of the intended recipient(s). If you have received it by mistake please let us know by reply and then delete it from your system; you should not copy the message or disclose its content to anyone. MarketAxess reserves the right to monitor the content of emails sent to or from its systems. Any comments or statements made are not necessarily those of MarketAxess. For more information, please visit www.marketaxess.com. MarketAxess Europe Limited is authorised and regulated by the UK Financial Conduct Authority, registered in England no. 4017610, registered office at 5 Aldermanbury Square, London EC2V 7HR. Telephone (020) 7709 3100. MarketAxess Corporation is regulated in the USA by the SEC and FINRA, incorporated in Delaware, executive offices at 299 Park Avenue, New York, NY 10171. Telephone (1) 212 813 6000.

1 0

OpenService: Error 1060: The specified service does not exist as an installed service.
by Hugo Darley 09 Oct '17

09 Oct '17

User has recently installed v5.4.2 on a windows machine and gets this error: [cid:[email protected]] Downloaded the .exe file from the website, installed into a D: drive folder (not the C: program files x86 folder), edited the config file to what we have advised countless users in the past and added the verisign crt to the same folder. Has reinstalled a couple of times to no avail. I have searched on the net for help but nothing specific to STunnel. Can anyone advise? Many thanks Hugo The information contained in and accompanying this communication is strictly confidential and intended solely for the use of the intended recipient(s). If you have received it by mistake please let us know by reply and then delete it from your system; you should not copy the message or disclose its content to anyone. MarketAxess reserves the right to monitor the content of emails sent to or from its systems. Any comments or statements made are not necessarily those of MarketAxess. For more information, please visit www.marketaxess.com. MarketAxess Europe Limited is authorised and regulated by the UK Financial Conduct Authority, registered in England no. 4017610, registered office at 5 Aldermanbury Square, London EC2V 7HR. Telephone (020) 7709 3100. MarketAxess Corporation is regulated in the USA by the SEC and FINRA, incorporated in Delaware, executive offices at 299 Park Avenue, New York, NY 10171. Telephone (1) 212 813 6000.

1 1

Re: [stunnel-users] Need some info
by Heinsbroek, Peter 09 Oct '17

09 Oct '17

I know. I have a module that reads and writes the pin encrypted from/into a disk file. Till stunnel 5.38 it worked via engine_pkcs and now I try to build it into stunnel. I works ,but the only thing now is where to store the pin after decrypting it. __________________ With regards Peter Heinsbroek Tel. +31 (0)88 265 9869 -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Malgorzata Olszówka Sent: Thursday, October 05, 2017 3:03 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Need some info W dniu 05.10.2017 o 14:39, Heinsbroek, Peter pisze: > How can I get the pin info from the config file entry “engineCtrl = > PIN:12345” into a variable in the ctx.c source With regards, Peter > Heinsbroek SQL & Unix Administrator Hello Peter, This is an example pin to the SoftHSM token. Regards, Malgorzata Olszowka _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Professional support agreement
by alper erbakan 07 Oct '17

07 Oct '17

Hi, I am trying to find a company that willing to glve professional support for stunnel Windows version. I tried to reach from stunnel.org e-mail addresses is not working. Would you please help? Best regards iPhone'umdan gönderildi

2 1

Comments on daily DH Parameters regeneration...
by Taed Wynnell 06 Oct '17

06 Oct '17

We've been experiencing pain due to the daily STunnel regeneration of the DH Parameters. On our single-core machines in the field, this process will use 100% of the CPU for possibly an extended time. This interferes with other tasks that the machine is intended for. What's odd is that this process time ranges wildly, ranging from as low as 3 seconds to 90 minutes, even on the same machine. We see this behavior on all (thousands) of our machines, now that we know what to look for (the "Cron jobs completed in" trace in stunnel.log). We now know that we can set the DH Parameters in the configuration file, and that's what we'll be doing going forward. (Unless someone has another idea to offer.) I'd like to suggest some ideas for the future since I've seen on the mailing list that there are others who have run into this issue: * If the DH Parameter regeneration would run at Idle priority instead of Normal priority, it would not be nearly as noticeable, in that the CPU usage would still be there, but it wouldn't impact other services. The recomputation may be done in a separate thread, if so, this is straight-forward. * If there were a configuration file parameter to specify the regeneration interval. It would default to 24 hours (which is the current behavior), but could be set to a longer interval, a shorter interval for extreme security, or even to never. STunnel would still regenerate at the time of the service starting, unless a fixed DH is found in the configuration file. If a fixed DH were specified in the configuration file, that would avoid the service start computation and the interval would default to never. If both a fixed DH and the interval were specified in the configuration file, it would use the specified interval and recompute only after that interval.

1 0

Need some info
by Heinsbroek, Peter 05 Oct '17

05 Oct '17

How can I get the pin info from the config file entry “engineCtrl = PIN:12345” into a variable in the ctx.c source With regards, Peter Heinsbroek SQL & Unix Administrator Tel. +31 (0)88 265 9869 Mob. +31 6 5375 3244 Werner von Siemensstraat 3 2712 PN Zoetermeer, Nederland Org. unit B&PS-BTN/NL-TS-PS Central Unit 04 Email peter.heinsbroek(a)atos.net<mailto:[email protected]> Web www.nl.atos.net<UrlBlockedError.aspx> Atos IT Solutions and Services B.V. Comm. Register The Hague no. 27380688 This e-mail is intended exclusively for the addressee(s), and may not be forwarded or made available for use to any person other than the addressee(s). If you are not the intended recipient, please notify the sender thereof and destroy/delete the message. The sender disclaims any liability as regards (the content of) this e-mail. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Using Chrome directly as an STunnel Client to connect to an STunnel Server
by Dipen Doshi 05 Oct '17

05 Oct '17

Hello, I am new to STunnel and I am running into a problem. Here is my setup. I use an ASUS router with Merlin firmware. I have STunnel installed via Entware on this router. Running "stunnel -version" gives me: stunnel 5.41 on mipsel-openwrt-linux-gnu platform Compiled/running with OpenSSL 1.0.2k 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: RNDbytes = 64 RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:!DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------------------------------------------------------------------- I use my own server certificate signed by my own CA. This cert has the proper SANs with correct DNS/IP entries. I use this server certificate both for my router's HTTPS web gui and for the "cert" and "key" files listed in the config file below. Also, the "CAfile" in the config is pointing to my Root CA's certificate. My Root CA is also imported in my Windows box's certificate store. I can directly access my router's web gui from LAN side via these ports: 80 (HTTP), 2000 (HTTPS). Router's LAN subnet is 10.49.49.0/24 and the router's WAN IP is 10.76.5.3 (it is double NAT for testing, this router is for testing) Also, STunnel is running as a server accepting connections on port 443 (all interfaces) on the router. ------------------------------------------------------------------------------------------- I want to use Chrome directly as an STunnel client on my Windows box. So, I don't run STunnel on my Windows box in the client mode. SITUATION 1: WORKS FINE!! -- PURPOSE: Use Chrome to connect to "https://WAN_IP:443" This should forward to the router's port 80 (HTTP protocol used). My STunnel config file on the router has: setuid = nobody setgid = nobody foreground foreground = yes syslog = yes debug = 7 [Test-Service] accept = 443 connect = 10.49.49.1:80 requireCert = yes verifyChain = yes CAfile = /mnt/Merlin/entware/etc/stunnel/ca.crt cert = /mnt/Merlin/entware/etc/stunnel/server.crt key = /mnt/Merlin/entware/etc/stunnel/server.key SITUATION 2: DOES NOT WORK!! -- PURPOSE: Use Chrome to connect to "https://WAN_IP:443" This should forward to the router's port 2000 (HTTPS protocol used). There is only one change from the Situation 1 config file. The line for "connect" changed to "connect = 10.49.49.1:2000) This does not work. Note that I can directly access my router's web gui over https with "https://LAN_IP:2000" via Chrome, with no warnings. ------------------------------------------------------------------------------ My thoughts: So, my current path is Chrome (Acting as STunnel Client) --> STunnel Server (on the router) --> Router's Web GUI. The "Chrome --> STunnel" Server connection is fine. Chrome prompts for private key and STunnel server correctly shows this incoming Chrome connection. The problem is the "STunnel Server --> Router" relay that uses HTTPS protocol. 1. STunnel does not like HTTPS to HTTPS relay. HTTP to HTTPS works, but not HTTPS to HTTPS. 2. STunnel server on my router is a client to my router's web gui. Is STunnel verifying the certificate of my router's HTTPS certificate? 3. If the above answer is yes, my guess is that STunnel sees a self signed certificate for this router and kills the connection? 4. How do I tell STunnel server to ignore certificate warnings for a remote connection, like when connecting to this router? 5. Or how do I explicitly tell STunnel to trust my Root CA while making this connection to my router? I couldn't find any options in STunnel for this. Regards, Dipen Doshi

2 3

Missing librairies
by Heinsbroek, Peter 26 Sep '17

26 Sep '17

I’m getting unresolved external symbol errors. I like to know what library I need for s_log. log.obj : error LNK2019: unresolved external symbol _stunnel_process_id referenced in function _log_id log.obj : error LNK2019: unresolved external symbol _stunnel_thread_id referenced in function _log_id log.obj : error LNK2019: unresolved external symbol _file_open referenced in function _log_open log.obj : error LNK2019: unresolved external symbol _file_close referenced in function _log_close log.obj : error LNK2019: unresolved external symbol _file_putline referenced in function _log_raw log.obj : error LNK2019: unresolved external symbol _tls_alloc referenced in function _s_log str.obj : error LNK2001: unresolved external symbol _tls_alloc log.obj : error LNK2019: unresolved external symbol _tls_get referenced in function _s_log str.obj : error LNK2001: unresolved external symbol _tls_get log.obj : error LNK2019: unresolved external symbol _ui_new_log referenced in function _log_raw log.obj : error LNK2019: unresolved external symbol _message_box referenced in function _fatal_debug log.obj : error LNK2019: unresolved external symbol _global_options referenced in function _log_open log.obj : error LNK2019: unresolved external symbol _stunnel_locks referenced in function _log_close str.obj : error LNK2001: unresolved external symbol _stunnel_locks str.obj : error LNK2019: unresolved external symbol _num_clients referenced in function _leak_threshold str.obj : error LNK2019: unresolved external symbol _number_of_sections referenced in function _str_leak_debug str.obj : error LNK2019: unresolved external symbol _tls_initialized referenced in function _str_stats __________________ With regards Peter Heinsbroek Tel. +31 (0)88 265 9869 This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Bug: Modifying configure.ac results in error
by Reschke, Sven (VWIF G-TS/P) 22 Sep '17

22 Sep '17

Hallo, I've encounter a problem when editing the configure.ac. I've upgraded to Stunnel 5.42, the problem wasn't existent with Stunnel 5.41. The normal operation is that "./configure" and "make" will run without an error. So far, so good. Now, if I edit the configure.ac, running again "./configure" and "make", "make" will report: CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/sh <path_to_stunnel_sources>/stunnel-5.42 /auto/missing aclocal-1.14 -I m4 cd . && /bin/sh <path_to_stunnel_sources>/stunnel-5.42 /auto/missing automake-1.14 --gnu CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/sh <path_to_stunnel_sources>/stunnel-5.42 /auto/missing autoconf configure.ac:4: error: possibly undefined macro: AC_MSG_NOTICE If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. configure.ac:23: error: possibly undefined macro: AC_DEFINE make: *** [configure] Error 1 Here it doesn't matter what I change in configure.ac. Even the slightest modification results in the error. After some investigation, running "make" with "-d" showed that it will call auto/missing, because of the newer version of configure.ac. Comparing aclocal.m4 before and after calling "make" shows, that mainly the lines added between the version 5.41 and 5.42 are missing now (lines #23 - #741). As I'm not so familiar with the whole compile process, I found a simple hack, which solves the problem for the moment: Adding these missing lines to a new file named m4/acinclude.m4. After that, compiling, installing and running Stunnel works fine. Can someone verify? If you have questions, I'll try my best to answer them :) Best Regards, Sven Reschke Embedded System SW Developer G-TS/P

1 0

Help with connectivity issue
by Rob Allen 15 Sep '17

15 Sep '17

I’ve installed stunnel on an Amazon EC2 instance: stunnel 4.56 on x86_64-redhat-linux-gnu platform Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP Global options: debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none I’ve created the stunnel.conf file: [smtp-tls-wrapper] accept = 2525 client = yes connect = email-smtp.us-west-2.amazonaws.com:465 protocol=smtp delay = yes I’ve tested the connection to SES (successfully) via openssl: [ec2-user@ip-172-31-4-68 ~]$ openssl s_client -quiet -crlf -connect email-smtp.us-west-2.amazonaws.com:465 depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5 verify return:1 depth=1 C = US, O = Symantec Corporation, OU = Symantec Trust Network, CN = Symantec Class 3 Secure Server CA - G4 verify return:1 depth=0 C = US, ST = Washington, L = Seattle, O = "Amazon.com, Inc.", CN = email-smtp.us-west-2.amazonaws.com verify return:1 220 email-smtp.amazonaws.com ESMTP SimpleEmailService-2370111491 wa7VtNk9b7c4TX0jNpdG But when I try to access through stunnel via localhost with telnet, I get this: [ec2-user@ip-172-31-4-68 ~]$ telnet localhost 2525 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. I’ve tried everything I can think of; I’ve read all the blogs and pages related to connecting from ec2 to SES via stunnel and I just can’t get it to work. Does anyone have any suggestions for other things I could try? Thanks in advance, Rob Allen, CPO Software Engineer | Eyefinity NOTICE: This message is intended only for the individual to whom it is addressed and may contain information that is confidential or privileged. If you are not the intended recipient, or the employee or person responsible for delivering it to the intended recipient, you are hereby notified that any dissemination, distribution, copying or use is strictly prohibited. If you have received this communication in error, please notify the sender and destroy or delete this communication immediately.

2 2

Stunnel Config Error
by Jay Jenney 21 Aug '17

21 Aug '17

Trying to see why Stunnel like this config file (attached) for an office365 email account [cid:[email protected]] Harriscomputer Register today<http://www.harriscomputer.com/en/conference/> for HCTC2017 - Early Bird deadline is August 31! Jay Jenney Support Specialist P: 800-274-2911 x64272 F: E: jjenney(a)caliberpublicsafety.com [cid:Caliber_PS_left_CMYK_247aef3c-9961-4e6c-a9f4-053e52f0093f.jpg] , Iowa www.caliberpublicsafety.com<http://www.caliberpublicsafety.com> This message has been sent on behalf of a company that is part of the Harris Operating Group of Constellation Software Inc. These companies are listed at the following link: http://subscribe.harriscomputer.com Unsubscribe Option: If you do not wish to receive any future email, please unsubscribe by clicking on the following link:http://subscribe.harriscomputer.com This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.

1 0

stunnel w & w/o data compression
by Daniele Basaldella 18 Aug '17

18 Aug '17

Dear all, I use stunnel in clinet configuration to get data feeds from several sources. Until now none of them requested data compression, so the configuration was easy. Now I need to connect to a new data feeder that requires zlib compression. I found the compression method is a global setting, so it will be not compatible with current setup. The server runs Ubuntu 16.04LTS, ker 4.4.0.92.lowlatency, stunnel 5.30, openssl 1.0.2.g. I looked for a solution on internet but seems no one have my issue. Someone could suggest how to get both compressed/uncompressed data feed connections on same system. Thank you Best Regards Daniele

2 1

Timeout issue I think
by Ben Bazian 16 Aug '17

16 Aug '17

I have a legacy server that uses IMAP but does not support TLS. I am using stunnel and since implementation I am getting errors when an email has a larger attachment. My application process these attachments and when done (sometimes can take 5-10 minutes) it marks the message for deletion. When all messages are completed it purges the emails from the box. My app is throwing an error when it tries to delete the message (see below). I think it may be due to stunnel closing the connection to the server? Not quite sure. javax.mail.FolderClosedException at com.sun.mail.imap.IMAPMessage.getProtocol(IMAPMessage.java:105) at com.sun.mail.imap.IMAPMessage.loadEnvelope(IMAPMessage.java:941) at com.sun.mail.imap.IMAPMessage.getSubject(IMAPMessage.java:238) at com.softlinx.docurouter.source.email.EmailSourceConnector.processMess ages(EmailSourceConnector.java:1213) at com.softlinx.docurouter.source.email.EmailSourceConnector.process(Ema ilSourceConnector.java:1455) at com.softlinx.docurouter.source.email.EmailSourceConnector.main(EmailS ourceConnector.java:1622) My configuration is pretty simple. I saw somewhere that I could put a timeoutidle on the connector but that does not seem to help. Any ideas are appreciated. Here is the config. # Stunnel configuration file for Office 365 SMTP and POP3 # Author: MessageOps, www.messageops.com<http://www.messageops.com> # GLOBAL OPTIONS client = yes output = /etc/stunnel/stunnel-log.txt debug=3 # taskbar=yes # SERVICE-LEVEL OPTIONS [POP3 Incoming] accept = 110 connect = outlook.office365.com:995 timeoutidle = 14400 [SMTP Outgoing] protocol = smtp accept = 25 connect = outlook.office365.com:587 [IMAP] accept = 143 connect = outlook.office365.com:993 timeoutidle = 14400 Here is a printout of the global options. Global options: debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -Ben

1 0

logging real client IP in Apache
by Stoyan Stoyanov 07 Jul '17

07 Jul '17

I have an Apache server serving only HTTP requests on port 80 and an stunnel daemon on the same server listening on port 443 and tunneling HTTPS requests to Apache. Is there a way for the client IP to be passed on to Apache so that I can capture and log that instead of the IP of stunnel, which in this case is 127.0.0.1? Ability to add a variable to the HTTP header would be perfect, but any other suggestions to solve this problem are welcome. Thanks! Stoyan

2 2

Error on startup of Stunnel
by Shelstone Lorde 30 Jun '17

30 Jun '17

I installed version 5.41, the latest version, on a Windows 10 Pro machine. I placed a link to the Stunnel.exe file in the Startup folder. I am getting the error "The ordinal 3253 could not be located in the dynamic link library c:\Users\...Programs\Startup\stunnel.exe". May be there has been a previous posting concerning this error but I have not been able to find it. Any help or suggestion will be appreciated. Thanks.

1 0

Re: [stunnel-users] Stunnel Connectivity Issue
by Ludolf Holzheid 13 Jun '17

13 Jun '17

On Tue, 2017-06-13 22:51:27 +0530, Dheeraj Gautam wrote: > Hi Browne, > > > > I am not understand like what config I have to do in stunnel config file. > > > > As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port. > Dheeraj, I'm afraid you confused the directions: In you configuration file, you told Stunnel to accept connections on localhost, port 9233 ("accept = 127.0.0.1:9233"). Then, you told Stunnel, if such a connection is accepted, to connect to a remote server at port 8228 ("connect = 69.191.198.34:8228"). As long as both connections are established, Stunnel will forward data from localhost to 69.191.198.34 and vice versa, while encrypting the data in the localhost -> 69.191.198.34 direction and decrypting the data in the opposite direction (69.191.198.34 -> localhost). With this setup, a client program (such as Thunderbird) sends and receives plain-text data to/from a Stunnel instance on the same machine, while a server program on a remote machine (such as the Google mail server) sends and receives encrypted data to/from Stunnel. Is this about the setup you have in mind? Is your application server or client? Does it send and receive plain-text data or encrypted data? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Configuring stunnel and openssl on Windows to support TLS 1.2
by Liz Turi 13 Jun '17

13 Jun '17

Good morning, I'm hoping you can help point me in the right direction. The problem I'm trying to solve is enabling TLS 1.2 connections on a Windows (environment has both Windows 2008 and Windows 10 environments) platform. Currently, my private keys are managed by the Windows certificate store, using the capi engineId within stunnel (v 5.41), which uses OpenSSL 1.0.1. Because of this, stunnel can only negotiate a TLS 1.1 connection. I've tried compiling OpenSSL 1.1.0f and stunnel 5.41, but no luck either cross compiling under CentOS, nor under Windows using either MSYS2/MINGW32 or Cygwin. What I'm looking for is any one of the following 1) solid current cross-compiling examples or references 2) solid current Windows compiling examples or references using extant versions 3) a way to manage the pfx/p12 (private key) in stunnel without resorting to the Windows certificate store. Option 3 is preferred. I see how to manage pkcs11, but not pkcs12. Thank you in advance! Liz Turi Sr. Consultant Massachusetts eHealth Collaborative 860 Winter Street, Waltham, MA 02451 (m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589 www.maehc.org<http://www.maehc.org> [fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=ty…>[tw_icon]<https://twitter.com/MAeHC_org> CONFIDENTIALITY NOTICE The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

1 1

Memleak sTunnel Win32 5.41 ?
by Dod 12 Jun '17

12 Jun '17

Hello, I just noticed that stunnel memory usage is growing slowly but surely using 5.41 on Win7 64 Bits. Using a few POP3 SSL tunnels. Now it is using 290MB memory I don't know if it is since 5.41 (didn't pay attention). Is there a way to trace/log something that could be useful ? (apart from the process memory usage curve that I guess will not help). regards.

1 0

TLS-SRP patch
by Kevin Sheldrake 06 Jun '17

06 Jun '17

Hello I recently produced a patch that permits use of TLS-SRP; it is based on the TLS-PSK code and this blog post: https://matthewarcus.wordpress.com/2014/05/10/srp-in-openssl/ It’s not the cleanest of code but it does work as a POC. The patch is available here: https://github.com/rtfcode/tls-srp The README.txt provides some info on testing the patch and how it might be used to help dev web browsers and servers that support TLS-SRP (for IoT work). There is a page on the forthcoming OWASP Summit ‘TLS for Local IoT’ workshop (for which it was developed) at: https://owaspsummit.org/Working-Sessions/IoT/TLS-for-Local-IoT.html In terms of using TLS-SRP support in stunnel as a proxy, it might be useful as a replacement for TLS-PSK where the credentials are user-memorable (pass phrase, for example) as TLS-SRP has lower entropy requirements than TLS-PSK. For example, the creds could be stored in the user’s head rather than in a file and be less open to compromise if a device was seized. I don’t know if that’s useful for anyone; it’s just a thought. Thanks Kev

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users