- stunnel-users - stunnel.org

Re: [stunnel-users] Using CAPI Engine for client authentication
by Michal Trojnara 22 Feb '16

22 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 21.02.2016 10:23, Shay Cohen wrote: > LOG6[10]: No client CA list It looks like your server does not request a client certificate. You may try connecting your service with MSIE, which natively uses client certificates from the Windows Certificate Store. If the server is configured correctly, MSIE should be able to establish TLS even if the service does not speak HTTPS. Just use https://1.2.3.4:9000/ Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWyslNAAoJEC78f/DUFuAUKowQALxsJAxHJsiglCmxlu7HevvI I7NE77SwJOh3rCQ7KrZ+HMlq36PpxzeiRmjkwstp2dMJ5KKu8+rzbGqvxcFQjKQG w3P7GE2sn3Kw1aakOj2sJBuzYTCM3mRpl4ARD10yiZv42leggWfhLHh3bU4eFmEn Mr7k2GM51uhjooDpYTY604wloxISC0m4FWcPl3elp0mDpDgYA1TehbsIsd0KxH13 poiCZGB44AuzX1As350fb3D31GLqQmZ9bCrgGY1OGepX14VeH304fFctCSqlrAa9 XGup/cmJy6URWZ26GUP7l3zOJtH5LRXEafbGPRfRKK2ZaDSt+NGCWypKA1pJ3XGK W1u6H8ggf6gER3z9Yvqemi8ukQ4C7zIt4vu10HYZ2hehxv7HpHL5Lkrj5lT+zGQQ nkOy4kckrAlk1RXTh2HO3DXlq5IHjh/8UrP/OhaRv7tb6tRVJ4I5L9Xl3kes9lJj BdgW5fS3E0F6iyJoWanviIUSjAAKT8mOhoxQhu3KvVL6Krm0J59hWTSCfdGjVwPY lMEIy2xLxUyEgDjO1r1XdPWsns5uq1wVz8BnQ6F6dgXrpOZwjUJ0DW4NZyK0m4pv +X9paNAOQaXOsSfMF8dHChL+UFuEIlCO0ILoISh3N+hJCyUJkPw8LK9Lr0cYRhif V8eUxUXA52BUqvGdzUHa =PZNb -----END PGP SIGNATURE-----

1 0

Using CAPI Engine for client authentication
by Shay Cohen 18 Feb '16

18 Feb '16

Hi, I am trying to configure one of my clients to use 'engine = capi', but cannot find a way to define which Key to actually use. debug = 7 does not show engine internal actions and engineCtrl = CAPI_CMD_DEBUG_LEVEL:2 gives an error, as well as engineCtrl = DEBUG_LEVEL:2 I'de appreciate any help with configuring this. Thanks in advance, Shay

2 2

Fw: new message
by mysql.jorge＠decimal.pt 09 Feb '16

09 Feb '16

Hey! Open message <http://sudarena.intelmedia.ro/back.php?5n11v> mysql.jorge(a)decimal.pt

1 0

User-defined headers to CONNECT
by Jason Whitener 05 Feb '16

05 Feb '16

"Add user-defined headers to CONNECT proxy requests. This can be used to impersonate other software (e.g. web browsers)." My search skills are lacking today apparently. I can't find any documentation or examples about sending custom headers back to the server. Can someone please provide an example or a link to an example? I need to send "WL-Proxy-SSL:true" back to a Web Logic server in the header with each request. Nothing too tricky I assume. Jason

1 0

Log to file WSS Websocket packet traffic
by Francesco Alfano 05 Feb '16

05 Feb '16

How can I log to file all packet traffic coming from a wss web socket on port 1234 using stunnel, openssl and tcpdump ? I have already seen https://gist.github.com/jeremiahsnapp/6426298#file-stunnel-mitm-proxy-conf , but I would like to know how to configure it

1 0

Microsoft Exchange 2010 - SMTP issue
by mahdi＠kadtekautomation.com 04 Feb '16

04 Feb '16

Hey all, Has anybody here been successful connecting to Microsoft Exchange 2010 servers usnig STunnel? Here is what I have in my stunnel.conf: ******************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [ssmtp] accept = 127.0.0.1:587 connect = smtp.ex3.secureserver.net:587 ******************* And this is what I see in the log: ******************* 2016.02.03 18:55:14 LOG5[63]: Service [ssmtp] accepted connection from 127.0.0.1:57314 2016.02.03 18:55:14 LOG5[63]: s_connect: connected 184.168.131.205:587 2016.02.03 18:55:14 LOG5[63]: Service [ssmtp] connected remote server from 10.10.10.10:57315 2016.02.03 18:55:14 LOG3[63]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2016.02.03 18:55:14 LOG5[63]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket ******************* I am quite sure that my server address and port is correct, and obviously the other application is pushing data to stunnel. Seems like what's coming back from server is puzzling. Any help regarding this? Thanks, Mahdi.

1 0

stunnel 5.30 released
by Michal Trojnara 28 Jan '16

28 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.30 of stunnel. The ChangeLog entry: Version 5.30, 2016.01.28, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2f. https://www.openssl.org/news/secadv_20160128.txt * New features - Improved compatibility with the current OpenSSL 1.1.0-dev tree. - Added OpenSSL autodetection for the recent versions of Xcode. * Bugfixes - Fixed references to /etc removed from stunnel.init.in. - Stopped even trying -fstack-protector on unsupported platforms (thx to Rob Lockhart). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 7d6eb389f6a1954b3bcf6c71d4ae3c5f9dde1990dd0b9e0cb1c7caf138d60570 stunnel-5.30.tar.gz cf13a881d2f19b8db5e70fafac6e5dad31f041ee6b9c0316dbd8f9f425c16418 stunnel-5.30-installer.exe 102c54d0f58937fc3c3de2a6fb6295622222e48eae200123d6357889defa45c1 stunnel-5.30-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWqkhcAAoJEC78f/DUFuAUbZoP/iH+4dndQdh5SSpSH8NR2dUf Nx10nPHP9WXZIVF9C0pISDGpRcpRi6k+4p3NU8SblGsTRm78zCpWYmeEso46Q9ve IHCrUrmQntygZ5xL5Igij9rvN8s6VeucxiMX1pZBJWAvtV5Mj2XDWFEgGiUc+sPC leCJIhj+2G6hNZJzl5whptW48+smqQvh8LC5jEtFaAUp5C0ptjrmz/vebEDlVKOs qZOZMwLmNojP3WGWWrt5fkBCLZXKvkDipgI4ln3aro/fCYQZ5fikGYbW7dTOvNCT lFmCS2vXg1hqFNM3qBWp8HKqiyYR9nVYNesW5vQW/INp6wRSqul9QSJQwsVge37N wbl19KLZL0bqXYV5a5OTovi5X1X+wRbKkcGE8yozptifV4n1AgZL4rbLkKqFu/BF zHHUmOi1m5SkRAoN8pmaTmNFe/Zp72o6unN1kfrXyvJj6NCiDKXMqTmYw4bfoSBM UUg6uKtc7k7XGPvgca/HrdEu8DJPQIWcRqNVqQ5AxVnub9gBFsJC15XdgutHJK97 XuLhZhHBdm10Frf2u/nk2Q2GpPdHAPK67QgERzO2Nr35KGOxwMXahyxKK0jI5ue5 bekTLYjZYUKS94Lt/uUgxaVmwG0x1qjurfhdXoUemuYKUAzv2tZlNF1NiGme3feP WqLyTnuGhYIxEbltnFif =gYXk -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] Access an arbitrary https website on http://localhost:3000 via stunnel.
by Hongyi Zhao 15 Jan '16

15 Jan '16

2016-01-14 16:51 GMT+08:00 Michal Trojnara <Michal.Trojnara(a)stunnel.org>: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > Hi Hongyi, > > My hint: > > $ curl -s http://localhost:3000/ > Cannot GET / > > $ curl -s -H 'Host: coolaj86.com' http://localhost:3000/ Thanks a lot, I still have some issues: 1- Why must we use the ''-H 'Host: coolaj86.com' '' in this command for getting the correct result? 2- If I want to use internet explorer, such as firefox/chrome to open the corresponding url, i.e., http://localhost:3000/, how should I do? 3- There are 3 certificates given by the owner of the website https://coolaj86.com/. They are all stored here: https://gist.github.com/coolaj86/327cee3eee6fc119b389/ Just as you can see, the 3 certificates are named as follows: cert.pem chain.pem root.pem What's the relationship between the above 3 certificates? And the first certificate, i.e., the cert.pem, is the one used for the website https://coolaj86.com/. So, I just want to know why we must the root.pem in the stunnel's conf file? Regards > <!DOCTYPE html> > <html lang="en"> > <head> > <meta charset="utf-8"> > <title>AJ ONeal</title> > ... > > Best regards, > Mike > > On 14.01.2016 05:51, Hongyi Zhao wrote: >> Hi all, >> >> Based on the descriptions on the following webpage: >> >> http://plug.org/pipermail/plug/2015-August/033939.html >> >> I do the following testing: >> >> 1- Complile and install the lastest stunnel, i.e., the >> stunnel-5.29. >> >> 2- Obtaining the root cert >> >> wget -q >> https://gist.githubusercontent.com/coolaj86/327cee3eee6fc119b389/raw/r > oot.pem >> >> > - -O /tmp/root.pem >> >> 3- Prepare the following config file for stunnel: >> >> pid = /tmp/stunnel-tlsvpn.pid >> >> client = yes verify = 1 foreground = yes >> >> [tlsvpn] accept = localhost:3000 sni = coolaj86.com connect = >> coolaj86.com:443 CAfile = /tmp/root.pem >> >> 4- Starting the stunnel: >> >> $ stunnel ./stunnel-tlsvpn.conf >> >> 5- Testing: >> >> At this moment, I use the firefox to open the following url: >> >> http://localhost:3000 >> >> But the firefox will only give the following line in its windows: >> >> Cannot GET / >> >> Any hints on this issue? >> >> Regards >> > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2 > > iQIcBAEBCAAGBQJWl2GYAAoJEC78f/DUFuAUwlAP/3w4sq5u4Wp1SV9mbB4Sr7D4 > nP++WO10HLpSFQRnO85BaX2XHwU5aC+AxDI9wztvkEXLE9gup3KfT9Dvk9cfrHHv > Vb+EmOnspKslsOI1X/pHbSxB7tuc816aqqW9Q2Vmwh9RoVnt0djFIIB/GpKQa/0m > YhJrfcpT+WmZ3xrKQUcsahVFTzgxWxZCbDO26c/B3n/ORSmCvs4lRuYXtAuqfGlX > q0+qHt4+gi69lc6PMLeGWEonFhgHCl3Mc2Oa5Y3atb52uWG3KS2b4KF+ZQWfhPFK > qMggrXNnGgtxrb52rTw8C0/e14v3ZmENB2NX3qZGOvgiS4YujbjE2yGOgjeJzaxo > x/UEOFY2X879TECrThEWS87e6BiMog5iKYw8VneJ6rAYn40vGPEji5Lg8kTUU3kC > Du5u2zyIdPmqHhTKqpSoIgFKt1w80VpM7wZ/Z8H12yJJh1MHvh7EFUZTZ987nMpt > UNf8wCTTDxMEnQI/kMODLBLO9ntGnCHF0PXQ3s24zQ10/BftLyNbTMMTs14bktQG > hyWV/aGqF7+dtgcTgirLn1cypxKW5wrF8JOt5I/B1c3/fafHny/I4NyuF5MQuEB9 > GDDjYwbcQrU4shSA4Hoe5mWQDpdBJUBb5+8wHkgZg2neU8wcfyzEPucS960eG46Q > zSbvpAgUjmvP91qZhWyI > =oyVS > -----END PGP SIGNATURE----- -- Hongyi Zhao <hongyi.zhao(a)gmail.com> Xinjiang Technical Institute of Physics and Chemistry Chinese Academy of Sciences GnuPG DSA: 0xD108493

3 6

Access an arbitrary https website on http://localhost:3000 via stunnel.
by Hongyi Zhao 14 Jan '16

14 Jan '16

Hi all, Based on the descriptions on the following webpage: http://plug.org/pipermail/plug/2015-August/033939.html I do the following testing: 1- Complile and install the lastest stunnel, i.e., the stunnel-5.29. 2- Obtaining the root cert wget -q https://gist.githubusercontent.com/coolaj86/327cee3eee6fc119b389/raw/root.p… -O /tmp/root.pem 3- Prepare the following config file for stunnel: pid = /tmp/stunnel-tlsvpn.pid client = yes verify = 1 foreground = yes [tlsvpn] accept = localhost:3000 sni = coolaj86.com connect = coolaj86.com:443 CAfile = /tmp/root.pem 4- Starting the stunnel: $ stunnel ./stunnel-tlsvpn.conf 5- Testing: At this moment, I use the firefox to open the following url: http://localhost:3000 But the firefox will only give the following line in its windows: Cannot GET / Any hints on this issue? Regards -- Hongyi Zhao <hongyi.zhao(a)gmail.com> Xinjiang Technical Institute of Physics and Chemistry Chinese Academy of Sciences GnuPG DSA: 0xD108493

2 1

Re: [stunnel-users] Fwd: Stunnel log file format
by Ludolf Holzheid 12 Jan '16

12 Jan '16

On Tue, 2016-01-12 11:23:43 -0430, Jesús Alfredo Cambera wrote: > Hello Ludof, > > Thanks for answering so fast. I think this information would be really > useful for other users. I'd would be great if it could be included the the > manual page (https://www.stunnel.org/static/stunnel.html). > > I had just completed the logstash filters but still I have one last > question: What do the log levels correspond to: error, warning, info? Hi Alfredo, always answer to the list, so others may read along and/or chime in. >From the stunnel man page: >> >> Level is a one of the syslog level names or numbers emerg (0), alert (1), crit (2), >> err (3), warning (4), notice (5), info (6), or debug (7). All logs for the specified >> level and all levels numerically less than it will be shown. Use debug = debug or >> debug = 7 for greatest debugging output. The default is notice (5). This seems to perfectly match the 'conventional meaning of the log level' used for most POSIX system log daemons (e.g. the linux syslogd). I don't know how significant the level /names/ actually are - Maybe all you can read from this is that level 0 gives the fewest and level 7 gives the most messages. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

2 1

Fwd: Stunnel log file format
by Jesús Alfredo Cambera 12 Jan '16

12 Jan '16

Hi everybody, I'm pretty new on stunnel and I'm still learning a lot through the documentation. One of the tasks that i need to accomplish is to consolidate all the log information using logstash and ELK. So far I had managed to figure out most of the log file format. Here is an example of my log file 2013.01.11 11:26:35 LOG5[13520:140223486400256]: stunnel3 accepted connection from 127.0.0.1:45939 2013.01.11 11:26:35 LOG6[13520:140223486400256]: connect_blocking: connecting 123.4.5.6:9130 2013.01.11 11:26:35 LOG5[13520:140223486498560]: connect_blocking: connected 7.8.9.10:9130 The first two fields are date and hour but I don't understand what do the next field means (LOG5, LOG6). Next is the pid, but I don't know anything about the next field. The last one is the error explanation. Is there documentation about log file format? I'd really appreciate your help. Greetings from Venezuela, Alfredo

2 1

Re: [stunnel-users] Help: sTunnel http to Apache https?
by Hathor27 11 Jan '16

11 Jan '16

Please everybody out there, can anybody tell me, if I can wrap a http-proxy request into http over ssl (https, with sTunnel) and receive it by an Apache https server (without sTunnel server)? Best regards Hathor27

1 0

stunnel 5.29 released
by Michal Trojnara 08 Jan '16

08 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.29 of stunnel. The ChangeLog entry: Version 5.29, 2016.01.08, urgency: LOW * New features - New WIN32 icons. - Performance improvement: rwlocks used for locking with pthreads. * Bugfixes - Compilation fix for *BSD. - Fixed configuration file reload for relative stunnel.conf path on Unix. - Fixed ignoring CRLfile unless CAfile was also specified (thx to Strukov Petr). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 43909625403ea634fa7cb8399d58faf8e7f11c1b7b29097491469951f56df551 stunnel-5.29.tar.gz c92ccc98cc9eb0c5d95d9550af39ab502e7ea45ed4d9ccc821aa261856f958b1 stunnel-5.29-installer.exe f9db8676e8e2ec6db355bae41eb625eb8ebd45a836ad8cbf06ce60a3c305fde2 stunnel-5.29-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWj/AqAAoJEC78f/DUFuAUZagQAMbBLW8VSgB8x8WGK1ZueSun HJAqXQgCYFY3+Vdz/41gdGy4T8kMB0MHarCwUbI4Wuk/JEvJLIs7OtFzycm1pTBU vXOgk962OkKs/RGD6tygnzIMmYU+BjxPLcfuj0JZR8Z3/Skt2ssFh4RrgCwoFM7/ VxseTRf487dBTU8n2EduWS1naNSIZCN6MlM0Ql1NNenZIGUSYlOfpxXSYo2ZTbe9 At+oVJ5J23eZrv5Vd48cZY7ArfXqCFDkUsCVyBOjUoSSJQ3qZ7srr7tWj4AVY6Pp Nk4Q1w1o7vWpEMDovjEmiLJMUGY2AUiQMpKoZDyfTnDRdtEfEDb7+P9sa++sruSY uauMZ4IL2zjUhWh2RJVnYHgCYCvjAWVw3GeUoM092svR0NXqf0fnBqAGgXNA/uHg zXy2Ljp8yLSK73oR3z7BaSmM3+q1NS2fZBEfWOVpZoOdG+hoyCZvsvuvDpNXh+y8 7WBPiGMl+Umti8HxKDsF/HEiLoSRrBZFZ1t2jwmLM+kZAsA06j3s5ExttK+FNsSC s/yoISPBGIRJyM/xOwYugyO2mDI8xLm3w7YbJADlJ0R2UiaRFVRqJErITv1/i18c Xek1mhk6HgyhQSCns4gxjM/Xc3VuOGJCP6umwUuiXQvyHvP+oypAyYlgshxNmKD1 Ccn+1DCtt3jw83qNLrZE =yIQ7 -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] Help: sTunnel http to Apache https?
by Hathor27 05 Jan '16

05 Jan '16

Thank you for your fast response, Jhon. My target https-server is a Synology DS211+ with Apache 2.2(Unix). Its VirtualHost config looks like: <VirtualHost *:443> ServerName myhost.mydomain.com ServerAlias internal.name.local DocumentRoot /somepath/not/used/at/all/ SSLEngine On SSLProtocol all -SSLv2 -SSLv3 # TLSv1 or higher SSLProxyEngine On ProxyRequests On ProxyBadHeader Ignore ProxyVia Full AllowCONNECT myInternalPort <Proxy *> Order deny,allow Deny from all </Proxy> <ProxyMatch (internal\.name\.local)> Order allow,deny Allow from all </ProxyMatch> LogLevel debug ErrorLog /logpath/sshserver-proxy_error_log CustomLog /logpath/sshserver-proxy_request_log combined </VirtualHost> The sTunnel client config on Win7 is: debug = 7 log = overwrite output = C:\userpath\stunnel\stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [http-2-ssl] accept = 127.0.0.1:80 connect = proxy.gateway:gwPort protocol = connect protocolHost = myhost.mydomain.com:443 retry = yes config = Protocol:ALL config = Protocol:-SSLv3 Finally still remains my initial question: Can I wrap my http-proxy request into http over ssl (https) and receive it on an Apache https server? If 'yes', how? Best regards Hathor27 Btw: Hopefully better posted

1 0

Upcoming stunnel 5.29 release
by Michal Trojnara 05 Jan '16

05 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Guys, This Friday I intend to release stunnel 5.29. The planned list of changes: * New features - New WIN32 icons. - Performance improvement: rwlocks used for locking with pthreads. * Bugfixes - Compilation fix for *BSD. - Fixed configuration file reload for relative stunnel.conf path on Unix. - Fixed ignoring CRLfile unless CAfile was also specified (thx to Strukov Petr). Feel free to try stunnel 5.29b3, so I can fix any discovered issues before the final release: https://www.stunnel.org/downloads.html Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJWit/iAAoJEC78f/DUFuAUtv8P/izyH0DIhUsDCWbYlyWRJDjr 2lwE1sYwmmMqtArM31N25QtRidEbZgTbuWQXaXY7/HALTnnI1VbDrbtAntVkovQr FDXGlVvkife2IuSDS92b8ezEuq5swCQoT6KoHJDj9yLBSTQdZNxGHv9GfbS90mmv fX3zcWmh+SklYnVgGrnc3GfgecaUS261KArdW1BTfA5ucydzse9z9X+2/iA7zl7i wwvSHkfH3+Q3VsmJaSmoHTiMqzRzvH0NpKnbm0J5OfOql/fT9Mfn57U5ZGnC5iWP bLlPmmP+fC7WLX8Cwl2DWESJ8kxPn2xEJbDGeCn9uzI0feKXMLwF/yrJopYVetIx fJDgts4iR8eFRcFcSIpBrnWxNoTi4RhCzuIj8U/zYOBsHJPs6gPcuDG9fYtPXhF8 D93e8HeOW7naNyi+mTDjBo8qdiGGh+/ITp1PkNonVgFCWkxLIpfS2k6iQ/DqNTXd szMU+uLeub5vt3ifRnSieTpIDTAsSbp0jarlXFRQNrUB0Cl8sgv/Ssl+ZYnDRyIa 2aTrK00eSc1nk+kZGJg5kTJM/t6PzfxtDUhVo5Pr6u9gwa94c34AHQ04W5dA7rTV 4pD4DxpFEk+2Syndjt6lncT/O2at3aYUkhyTZ/tN8/P22v1OWp+ci1WIpNXp/zVX z12IUAFfyQPIuvdwLzZr =CEXd -----END PGP SIGNATURE-----

2 4

Help: sTunnel http to Apache https?
by Hathor27 02 Jan '16

02 Jan '16

Dear List Members, I searched, tried and recovered for several days and found no solution that works. My topic is to establish an ssh remote session through a http-proxy (http connect). In case of port restrictions I can only use pure https (443). So I try to wrap my http-proxy request into http over ssl (https) and receive it on an Apache https server. I can establish a connection between sTunnel Client (Win7 Prof) and sTunnel Server (Synology, Linux), both on 443 - that works fine. But if I try to connect from sTunnel Client (443) to Apache Server https, they seem to speek not the same protocol. .are there any examples for that? - or are sTunnel and Apache two different things of SSL? I would be very glad to get some help here :) Best Regards Hathor27

1 0

Do Not Make Stunnel on El Capitan
by WATANABE Takeo 02 Jan '16

02 Jan '16

Dear all. Hi. My name is WATANABE, Takeo in Japan. There is a thing that is very troubled, it will post to this ML. It is in OS X El Capitan(10.11.x), it is stunnel of make it is that does not pass. The rootkill mechanism I think is causing, but tried again to disable this, even doing several times, not as make is. Even latest Stunnel, make will fail. Where everyone is, what you can well Build. If you have person there know what measures and successes such as a, please tell me. Warm Regards. Sincerely yours.

1 0

transfer: s_poll_wait: TIMEOUTclose exceeded: closing
by Michael Calder 29 Dec '15

29 Dec '15

Hi, I'm new to stunnel and I'm trying to troubleshoot why it currently isn't working. When I first set it up and tested it everything worked fine. I rebuilt everything to do it all again and now it's not working. I'm pretty sure I set everything up the same way. I'm trying to get it to work with AWS SES. Here is my stunnel config: ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2015 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = debug ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verify = 2 CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;ciphers = PSK ;PSKsecrets = secrets.txt ; vim:ft=dosini [smtp-tls-wrapper] accept = 2525 client = yes connect = email-smtp.us-east-1.amazonaws.com:2465 delay = yes Here is the debug from the log file: 2015.12.29 17:42:38 LOG7[main]: No limit detected for the number of clients 2015.12.29 17:42:38 LOG5[main]: stunnel 5.28 on x86-pc-msvc-1500 platform 2015.12.29 17:42:38 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2015.12.29 17:42:38 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2015.12.29 17:42:38 LOG7[main]: errno: (*_errno()) 2015.12.29 17:42:38 LOG5[main]: Reading configuration from file stunnel.conf 2015.12.29 17:42:38 LOG5[main]: UTF-8 byte order mark detected 2015.12.29 17:42:38 LOG5[main]: FIPS mode disabled 2015.12.29 17:42:38 LOG7[main]: Compression disabled 2015.12.29 17:42:38 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2015.12.29 17:42:38 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2015.12.29 17:42:38 LOG7[main]: PRNG seeded successfully 2015.12.29 17:42:38 LOG6[main]: Initializing service [gmail-pop3] 2015.12.29 17:42:38 LOG7[ui]: GUI message loop initialized 2015.12.29 17:42:38 LOG7[cron]: Cron thread initialized 2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified 2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.12.29 17:42:38 LOG6[main]: Initializing service [gmail-imap] 2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified 2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.12.29 17:42:38 LOG6[main]: Initializing service [gmail-smtp] 2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified 2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.12.29 17:42:38 LOG6[main]: Initializing service [smtp-tls-wrapper] 2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified 2015.12.29 17:42:38 LOG4[main]: Service [smtp-tls-wrapper] needs authentication to prevent MITM attacks 2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.12.29 17:42:38 LOG5[main]: Configuration successful 2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=372) 2015.12.29 17:42:38 LOG7[main]: Service [gmail-pop3] (FD=372) bound to 127.0.0.1:110 2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=376) 2015.12.29 17:42:38 LOG7[main]: Service [gmail-imap] (FD=376) bound to 127.0.0.1:143 2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=380) 2015.12.29 17:42:38 LOG7[main]: Service [gmail-smtp] (FD=380) bound to 127.0.0.1:25 2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=384) 2015.12.29 17:42:38 LOG7[main]: Service [smtp-tls-wrapper] (FD=384) bound to 0.0.0.0:2525 2015.12.29 17:43:25 LOG7[main]: Found 1 ready file descriptor(s) 2015.12.29 17:43:25 LOG7[main]: FD=332 ifds=r-x ofds=--- 2015.12.29 17:43:25 LOG7[main]: FD=372 ifds=r-x ofds=--- 2015.12.29 17:43:25 LOG7[main]: FD=376 ifds=r-x ofds=--- 2015.12.29 17:43:25 LOG7[main]: FD=380 ifds=r-x ofds=--- 2015.12.29 17:43:25 LOG7[main]: Service [smtp-tls-wrapper] accepted (FD=444) from 127.0.0.1:49510 2015.12.29 17:43:25 LOG7[main]: Creating a new thread 2015.12.29 17:43:25 LOG7[main]: New thread created 2015.12.29 17:43:25 LOG7[0]: Service [smtp-tls-wrapper] started 2015.12.29 17:43:25 LOG5[0]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:49510 2015.12.29 17:43:25 LOG6[0]: failover: round-robin, starting at entry #0 2015.12.29 17:43:25 LOG6[0]: s_connect: connecting 54.243.71.143:2465 2015.12.29 17:43:25 LOG7[0]: s_connect: s_poll_wait 54.243.71.143:2465: waiting 10 seconds 2015.12.29 17:43:25 LOG5[0]: s_connect: connected 54.243.71.143:2465 2015.12.29 17:43:25 LOG5[0]: Service [smtp-tls-wrapper] connected remote server from 172.31.49.212:49511 2015.12.29 17:43:25 LOG7[0]: Remote descriptor (FD=468) initialized 2015.12.29 17:43:25 LOG6[0]: SNI: sending servername: email-smtp.us-east-1.amazonaws.com 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): before/connect initialization 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2015.12.29 17:43:25 LOG6[0]: Certificate verification disabled 2015.12.29 17:43:25 LOG6[0]: Certificate verification disabled 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server done A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 write finished A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 flush data 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server session ticket A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read finished A 2015.12.29 17:43:25 LOG7[0]: 1 client connect(s) requested 2015.12.29 17:43:25 LOG7[0]: 1 client connect(s) succeeded 2015.12.29 17:43:25 LOG7[0]: 0 client renegotiation(s) requested 2015.12.29 17:43:25 LOG7[0]: 0 session reuse(s) 2015.12.29 17:43:25 LOG6[0]: SSL connected: new session negotiated 2015.12.29 17:43:25 LOG7[0]: Peer certificate was cached (3667 bytes) 2015.12.29 17:43:25 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2015.12.29 17:43:25 LOG7[0]: Compression: null, expansion: null 2015.12.29 17:43:36 LOG7[0]: SSL alert (read): warning: close notify 2015.12.29 17:43:36 LOG6[0]: SSL closed (SSL_read) 2015.12.29 17:43:36 LOG7[0]: Sent socket write shutdown 2015.12.29 17:43:38 LOG6[cron]: Executing cron jobs 2015.12.29 17:43:38 LOG6[cron]: Cron jobs completed in 0 seconds 2015.12.29 17:43:38 LOG7[cron]: Waiting 86400 seconds 2015.12.29 17:44:36 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2015.12.29 17:44:36 LOG5[0]: Connection closed: 995 byte(s) sent to SSL, 397 byte(s) sent to socket 2015.12.29 17:44:36 LOG7[0]: Remote descriptor (FD=468) closed 2015.12.29 17:44:36 LOG7[0]: Local descriptor (FD=444) closed 2015.12.29 17:44:36 LOG7[0]: Service [smtp-tls-wrapper] finished (0 left) I've searched the web for that TIMEOUTclose message and haven't come up with a solution. I've also attached a packet capture. Any suggestions would be helpful. Thanks! Mike

1 0

stunnel 5.28 released
by Michal Trojnara 14 Dec '15

14 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.28 of stunnel. This is a bugfix release. I highly recommend upgrading your stunnel. The ChangeLog entry: Version 5.28, 2015.12.11, urgency: HIGH * New features - Build matrix (.travis.yml) extended with ./configure options. - mingw.mak updated to build tstunnel.exe (thx to Jose Alf.). * Bugfixes - Fixed incomplete initialization. - Fixed UCONTEXT threading on OSX. - Fixed exit codes for information requests (as in "stunnel -version" or "stunnel -help"). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 9a25b87b1ef0c08fa3d796edce07b4408e6a8acece23de2eb7ee9285b78852b5 stunnel-5.28.tar.gz 020b5bd8a97a1da91e9b379c0d2fa8a14606402e2b0c1eb9191fe99c7f4665f9 stunnel-5.28-installer.exe 0af65879343b37bcda89dbbde51f6cfde016a044a533f7bdec229f4e1ec25eb9 stunnel-5.28-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWarN7AAoJEC78f/DUFuAUKhcQAJ62DQW+GMpAmtggO42LhaEj NcAdpgYvCAJnemRnTj+YMHHAGGIn7MY7VQZVzIIHL0y4CS6yy8kg1WVQeDgxS7PM zil/CViLayNQUnEaUSpoD3yFlb5i6wqofPa5/ohObAvUwTejN/XtOlyT6OMTEovF ZWWLsqYnVTCkbrY1Usu9DNRlSWaCgGeqL5ZqhbiJHk7hDHIH5Yy8KXKw3dVuOxBZ 86uYNH0WW3qNHKJrI1z70cA+18c6Kab5/4NnzzmWG+TyYCVVLL8JVkahEHhCX5mc yBYcMyBrSkrUoS++IdEZtOKYjwxfiEFdre0junC1m5DqtbOc+vWcvqZRGUfCszHK bg4LlCoNs6VhaAFzY9dyXKWqFP+HvH1cqcVcagCaofcdAEaFrwP4dqwUUBKCT44z JNhEzyrI6+coGq92SZUeSiko2bj+rQWDf3s5pY+zWQVvUe12rTo427Mhbge3sBhQ QykwMsihtrP9s25YkDQHqlpBV85W3axq/O2veb15QlbETDM6eGfnMCFjqhxpBBMO sSgHOr9E1E4pxN4kcokPhwKizxSe0EHVQYM27qGfNXJkzVAvHE+mz0WR2kMPpjT5 N6th9lOMgrjXGo6aTBQO3DIEkw+BB0C9OVWnNXMWqmUnsKp80QVeZKZXgK5c2t1y Y8e0W7HH2xdaQemUQp+n =GrPO -----END PGP SIGNATURE-----

3 3

Upcoming stunnel 5.28 release
by Michal Trojnara 11 Dec '15

11 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Guys, I have found a serious bug in stunnel 5.27. The bug results in incomplete (partial) service initialization. The bugfix 5.28 release is scheduled for tomorrow. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJWac5NAAoJEC78f/DUFuAUcRUP/A1dOJW8Sag4YRfxnOZfW6bt SouaKMkFQDkQkLrZzQkUhkOFL35DNmesvA+HgCSp+StO/TagcLA34ZrpR355qcZ7 QjEXYftagy85c7DjDek4CU9vfb9u3J3kTcvhtpy6l5CPYV0TWCjApk438xk+saOn xItijYRVcpHbSUof0/E99Gb9mZ3qiI4AVkdSHT4qw3GV8GCdo9R66cHBNDKsYQy1 XWe7VJCEmXw9n0bmj2Soi1TWlU39Q2GcostWK2GuH9fzFyGqnde7RbMHeJ9KYvY/ oSnMjCRblJtoRn4Ucw/1FuOdEZSalpRuPSarmhKCkgc+tKgkK6mvhSbILUbwOMLL hO2nWbMrOhLOlu4UnM32A1djWQCiVRxTO87IAkd5jTTz8sNLCoJHqzcirug68Kjy ljuNf/A/LhkimkfCvZtY5ErMP6TzJ37iaXhaGRLZLoZtK75yKggXnJcJUAEI8ggI RR/mArBHyHG3IwcfdMt4a+AJvsHOJAApCB+0uCGwJnfnuqHJ41Z6WEHuwpBitN/0 4nTGLoOBOyUX/cnrpsx9FLxRdCKAVbGoebXBM5sA9qhCDskp7MMDUFU1pVER5QbZ VKzCpIdeyGKKvCOA5WiNOt3bBBmOGJKB4CXYyMEyDAbr8SL2FTNo5nJ2iUO/2iaU 6a5MITgIc1C6GacMauvo =rb0T -----END PGP SIGNATURE-----

3 3

Re: [stunnel-users] How do I use the Stunnel download on android?
by Research | FrenchFlorida 09 Dec '15

09 Dec '15

Thanks for the reply. I'm not sure what " statically linked ELF executable for Android/ARM" means yet, but I will look it up. ;) Since I sent the message I did a lot of digging that yielded me very little details. In fact I only came a cross a few mentions that stunnel could be used on android but no examples of how that was implemented. After a vague hint I managed to deduced how the file worked, but it took me a little more independent research to understand how to make it, at least execute. I'm not new to linux but am new to android so not as familiar to how the system works in general. I did see that an android app was on your todo list. In the meanwhile however, may I suggest a little howto for Android that could get a user started in using the app. Stunnel is an amazing application and since I was able to figure it out I made myself a guide on how to set it up (Minus actually creating the configuration) so that I can at least know how to execute stunnel. Since I already did the research I offer you my very unorganized primer on how to set it up below. Perhaps it would be useful for some to have a better version of this doc on the site, and if not, well at least a well determined person can find this topic in the mailing list, because there will be only one other topic with the word "Android" in the title so it can perhaps get a user out of jam more quickly without. Here is my guide: ----------------------------- Chances are that "It is a statically linked ELF executable for Android/ARM." Means that within the stunnel-android.zip resides one file, and that file is the executable file for stunnel. It is in fact the defacto program that under linux you would see in /etc/local/bin/stunnel if that was where you installed it. This means that the requirements to use this file are as such: 1. Your phone probably needs to be rooted 2. You will need access to a terminal on your phone (Terminal Emulator) 3. There is no "APP" to run stunnel it is a command line file There are probably two reasons you would want to use stunnel on your phone. 1. You are an app developer that wants to use stunnel to connect one part of your app to something else, and therefore will incorporate this script within your app. I don't know how to make apps yet so that's probably as useful as I can make the description for you. 2. You are a user that has already used stunnel on your machine and wants to use it on your phone too. [The rest of the guide assumes this is the case.] Assuming the latter, what do you need to do to get it running? 1. Move the stunnel application to your phone. 2. As you would do in linux open the terminal 3. Run stunnel like a command If you get an error message saying it is not executable, or that permission is denied it is because of one of two things. Maybe you need to mark the file as executable Chmod +x ./stunnel Terminal Emulator's chmod does not understand "+x" so you will have to change the permission to Chmod 700 ./stunnel 700 means Read-Write-Execute for the user. If it doesn't work try 770 and 777 However you are likely to still receive that error on some phones. (I'm guessing, just because it happened to my phone I am not assuming it will happen to all phones.) Some phones forbid there to be an executable script within the /sdcard/ directory. Therefore you have to move it somewhere else. I don’t know where the proper place for such a file is, I moved mine to /system/bin/ therefore the script is callable by /system/bin/stunnel Another Caveat!! My phone's /system folder is not writable!! Therefore before you can even move the file you need to make the system folder writable: mount -o rw,remount /system Once moved needs to be made readonly again: mount -o ro,remount /system So In summary, here is a step-by-step of what might work in getting the script to an executable state on Android: 1. Root phone 2. install terminal emulator 3. get stunnel script onto your phone somehow 4. mount -o rw,remount /system 5. cp /sdcard/Download/stunnel /system/bin/stunnel 6. chown 700 /system/bin/stunnel 7. mount -o ro,remount /system 8. /system/bin/stunnel /path/to/conf/file* Now as if you are on linux you should probably** be able to run stunnel. *I haven't tested it out with conf files yet. ** I'm able to run stunnel --version so stunnel in and of itself is "working" ----------------------------- If this guide is any good to you guys, please feel free to use, I would love to contribute in some way. :) Thanks! -Cotex -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Tuesday, December 08, 2015 7:00 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 137, Issue 10 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: How do I use the Stunnel download on android? (Michal Trojnara) ---------------------------------------------------------------------- Message: 1 Date: Mon, 7 Dec 2015 16:14:05 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] How do I use the Stunnel download on android? Message-ID: <5665A23D.8050408(a)mirt.net> Content-Type: text/plain; charset=utf-8 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi cotex, It is a statically linked ELF executable for Android/ARM. It is only useful for people who customize their Android, and not for end-users. A proper Android GUI is on my TODO list: https://www.stunnel.org/sdf_todo.html Best regards, Mike On 04.12.2015 11:02, Research | FrenchFlorida wrote: > In the download section of the site, there is a zip for android. > > Inside this file is a single file, without any extention. > > How do I install this, I have found no documentation anywhere on the > web. > > > > Can anybody guide me, or give me a hint. Is this something I do on the > phone, or that I do from the computer first? > > > > -cotex > > > > _______________________________________________ stunnel-users mailing > list stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJWZaI9AAoJEC78f/DUFuAUJiAQAKYo2XM39WbeebhZlYa4pER2 hYfCkybWypYlOdiqRo5UGthG4SD/G74MXMJNR5ggKiApW6YBe4/Q983hKMWRSbp6 X803HQPyN8BxwnkZM9tzAcCh57SQXH/Y+VjTD9necLK9bOMMZlZsWg5u3TSp9qP1 jpV7+5NkMlID0KaKzpjaw+ruIY1zwmBUDrs0xT713TEZnVvaqhFDv2vYB8szG0p0 fe5Ppm/ZU/7vWMbFO8eWsWj6TpeoVpq2EI/4iK7VbnCVnSEosJi/C4C5nZ3GrcTv xRk0xDK9I733FfBTmHU5Dkzx6fcDqFekWyea+qYT+JhOmtRqdnyrQM0OCRv3z/b/ fOv36zkuru6DhoO1El2QwQOZlTqFnWYfgvfYDWI1zeIMCSz/qqpn5ojQXk7i87zH cMVG9whVZGWf0DXjwRo9/cHkmjdX46UA5FZwhxADY6Atu9OtdEabTcbNj6BPPh8Q xX7GNEgRFnbZsz50wqZbZJZfE4ticWFkLH37eT7z3WeEU8+HdFk1w24JNGFaZt3H GcJ6TN6/fMTkQP2ch0l0X2vXhWLkBh5puYOVBnsnKKUl8UUzeGa1T3OJAnKJF07Q 0mtP6lyPtuEGy9vUiP+2h0yIICJD1IGhEdkEm3xWJcagp3XJ+0PFN5Mo2juDfg4S FHvDTHxF4/y4PQodabav =+omM -----END PGP SIGNATURE----- ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 137, Issue 10 **********************************************

1 0

SSL compression in 5.27
by Udo Erdelhoff 08 Dec '15

08 Dec '15

Hi, while testing the upgrade from stunnel 5.26 to stunnel 5.27 on Solaris, one of the tools I use reported that SSL compression was now supported/possible on connections to an stunnel 5.27 instance; this was not the case with 5.26 or earlier. Unfortunately, it is not possible to demonstrate this using openssl as client, I found this using TestSSLServer, which is java-based and available from http://www.bolet.org/TestSSLServer/. With 5.26: | $ java -jar TestSSLServer.jar $server 443 | Supported versions: TLSv1.2 | Deflate compression: no | Supported cipher suites (ORDER IS NOT SIGNIFICANT): | TLSv1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | ---------------------- | Server certificate(s): | 4c57045b3f8f9cdd6f487e59a5b008ccb9d38693: CN=***, OU=***, O=***, C=*** | ---------------------- | Minimal encryption strength: strong encryption (96-bit or more) | Achievable encryption strength: strong encryption (96-bit or more) | BEAST status: protected | CRIME status: protected Note: "Deflate compression: no", "CRIME status: protected" With 5.27: | $ java -jar /prod/certmon2/bin/TestSSLServer.jar $server 443 | Supported versions: TLSv1.2 | Deflate compression: YES | Supported cipher suites (ORDER IS NOT SIGNIFICANT): | TLSv1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | ---------------------- | Server certificate(s): | 4c57045b3f8f9cdd6f487e59a5b008ccb9d38693: CN=***, OU=***, O=***, C=*** | ---------------------- | Minimal encryption strength: strong encryption (96-bit or more) | Achievable encryption strength: strong encryption (96-bit or more) | BEAST status: protected | CRIME status: vulnerable With 5.27, I get "Deflate compression: YES" and "CRIME status: vulnerable". Server OS: Solaris 10/SPARC or Solaris 11/SPARC (others not tested) OpenSSL: 1.0.1p or 1.0.1q (others not tested) Client: TestSSLServer Both stunnel and OpenSSL are self-compiled using Solaris Studio 12.4. The stunnel.conf in question: sslVersion = TLSv1.2 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256 cert = test1.crt key = test1.key verify = 2 [test] client = no accept = A.B.C.D:443 connect = 127.0.0.1:8080 The scanner from SSL Labs should be able to check this as well, but I do not have the neccessary modern Python available. I will check if I can reproduce the problem on something a little more mainstream than Solaris 10/11 over the weekend. --

2 1

How do I use the Stunnel download on android?
by Research | FrenchFlorida 07 Dec '15

07 Dec '15

In the download section of the site, there is a zip for android. Inside this file is a single file, without any extention. How do I install this, I have found no documentation anywhere on the web. Can anybody guide me, or give me a hint. Is this something I do on the phone, or that I do from the computer first? -cotex

2 1

stunnel for syslogd of busybox
by Girish Kumar 06 Dec '15

06 Dec '15

Hi All, Stunnel expects TCP-based syslog. Please let me know whether syslogd of busybox supports TCP communication. The busybox version is 1.24.1 If it doesn't support , can it be enhanced to support TCP communication Regards, Girish

1 1

stunnel 5.27 released
by Michal Trojnara 03 Dec '15

03 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.27 of stunnel. The ChangeLog entry: Version 5.27, 2015.12.03, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 1.0.2e. https://www.openssl.org/news/secadv_20151203.txt * New features - Automated build testing configured with .travis.yml. - Added reading server certificates from hardware engines. For example: cert = id_45 - Only attempt to use potentially harmful compiler or linker options if gcc was detected. - /opt/csw added to the OpenSSL directory lookup list. - mingw.mak updates (thx to Jose Alf.). - TODO list updated. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 7474e986710e88a5cc3330b6b1762f9449f01eccf826fa0f97e56d064c05ead3 stunnel-5.27.tar.gz 04b11dea9a29e7a16d46b2c4e6c66a5ca6f588abb29a827dcca2c6f6456eb4c6 stunnel-5.27-installer.exe 76e4297212eaa99a674191f3e955ec3959abcdd0c081d2df0ce8786a577a6883 stunnel-5.27-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWYG/VAAoJEC78f/DUFuAUKloP/jRcbtEuSpiLbFTg2hQqJcZf T6C6x+pCRDqefPZMQNgN5HIU9TBUAm1dGNH3KxRqrfCTlYKnhqafDoj66fsQe6sm vUDOxxxwCcKBZaiO4II5cLxd05d9GX9FnI86GBfiztSX0nr2wMLu1EdKHdTO2R5s VXsjRl1ey2X0ukhzQ+gsD2bOf2tz0gkCjrcoAZZyGqBE+Zy3hMGSlK8mXeTfU8Of ygUT+nEcUmQb+zbEBrJCp+Q2TP0dMzXSgpKz67toH1wJJ85iTpxqPa6L6LcKwHXd kA2c75Y7HXmc4C+eKpXessifbHTHdJXbsF4ZOc06IxIg2+v47Fqqz13sL2rMKdYQ aldOP7NiOyCxywjQ3bZElvF8f8Q1RJz/+qMKG0QEWwe1cRHmDOweZ2BrqsBsZNbE Pxx2lavAqRruREL9PnL12mH/u9e0SBIaXsgmN1xo9IvaVy98K9+VL23m2GpXeVMp cPGOtfwX2M0NWRIU6keQ8FOqszuP0A7CSFTKwmM2/ZGNjPOk00/NCJk9qchyqZcr 8RDnkMOknvqEp5Uf0PWpBafK0yUps7aPwyTQX9SQ8uvz3ra/30ghkpEyAeIeEP3p Y5DqlSXupIbPAmUw3fNblU7E7SgflPP4LXF8oznLUkWFmPpR/wPUiHC1EnEOGtEQ GHF3H9CS1fr51rPm0UaK =hfT6 -----END PGP SIGNATURE-----

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users