- stunnel-users - stunnel.org

stunnel - slowness
by Luciano Bonifácio 15 Dec '23

15 Dec '23

Good morning guys! I started using stunnel very recently with GLPI to authenticate to Google LDAP, and it is working, but with extreme slowness at Login. Something around 35 seconds. I believe there may be some parameters, adjustments to make. I'm sending the stunnel.conf configuration below, as well as the attached log file(txt). Could you give me a suggestion. Thanks, Luciano # stunnel.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - debug = 7 output = /var/log/stunnel4/stunnel.log [ldap] client = yes accept = 127.0.0.1:1636 connect = ldap.google.com:636 cert = /etc/certificates/glpi_ldap.crt key = /etc/certificates/glpi_ldap.key - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

1 0

Paho connection to stunnel
by jesramsing＠hotmail.com 15 Dec '23

15 Dec '23

I have a strange problem connecting from a C++ application using the Paho framework to the stunnel. The certificates are self signed, and MQTT Explorerr hooks up nicely and validates the certificate when fed with the appropriate ca certificate. So, stunnel seems to behave nicely on some cases, others not. The stunnel log shows a SSL_accept: ssl/record/ssl3_record_c:354: errror: 0A00010B:SSL wrong version. I have tried version 1.1 and 1.2 in the Paho library, both failing with the same error code. Any ideas or suggestions?

1 0

Re: Getting logs in systemd environment
by Christopher Schultz 13 Dec '23

13 Dec '23

Michael, On 12/13/23 15:43, Michael D. Setzer II wrote: > /var/log/secure Thank you for your reply, but /var/log is basically empty (meaning very few files located there). journald has absorbed everything and files are no longer the way to get logs from systemd-based environments. The only thing which contains non-trivial information is /var/log/journal/* which is a bunch of binary files. My reply below shows how you can get the stunnel-related log messages. I don't believe they are available through any traditional text-based log file. -chris > On 13 Dec 2023 at 15:37, Christopher Schultz wrote: > > Date sent: Wed, 13 Dec 2023 15:37:04 -0500 > To: "'stunnel-users(a)stunnel.org'" > <stunnel-users(a)stunnel.org> > From: Christopher Schultz > <chris(a)christopherschultz.net> > Subject: [stunnel-users] Re: Getting logs in systemd > environment > patches" <stunnel-users.stunnel.org> > >> Carter, >> >> On 12/13/23 14:53, cbrowne wrote: >>> Have you tried doing "find / -name stunnel.log -print" as root. I have >>> found that the log file can be in a number of different locations >>> depending on the system. >> >> There are no files named stunnel.log on my system. >> >> I do not have a specific setting for "output". I was expecting syslog to >> be used for that purpose without a specific setting. syslog=yes appears >> to be the default given the man page for stunnel. >> >> But your comment got me more interested in exactly what was happening, >> so I tried /not/ limiting journalctl --follow to a specific service and >> I can see all kinds of things coming from stunnel: >> >> >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready >> file descriptor(s) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 >> events=0x2001 revents=0x1 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service >> [ORU-outbound] accepted (FD=3) from ::ffff:20.204.213.204:55455 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Service >> [ORU-outbound] started >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Setting local >> socket options (FD=3) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Option >> TCP_NODELAY set on local socket >> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Service >> [ORU-outbound] accepted connection from ::ffff:20.204.213.204:55455 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174806]: Peer >> certificate required >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Initializing >> application specific data for session authenticated >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: SNI: no >> virtual services defined >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS read client hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write server hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write certificate >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write key exchange >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write certificate request >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write server done >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready >> file descriptor(s) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 >> events=0x2001 revents=0x1 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service >> [ORU-outbound] accepted (FD=15) from ::ffff:client.ip:44905 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Service >> [ORU-outbound] started >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Setting local >> socket options (FD=15) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Option >> TCP_NODELAY set on local socket >> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174807]: Service >> [ORU-outbound] accepted connection from ::ffff:client.ip:44905 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174807]: Peer >> certificate required >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Initializing >> application specific data for session authenticated >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: SNI: no >> virtual services defined >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS read client hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write server hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write certificate >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write key exchange >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write certificate request >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write server done >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS alert >> (read): fatal: certificate unknown >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Remove >> session callback >> Dec 13 20:31:00 example.com stunnel[300695]: LOG3[174806]: SSL_accept: >> ssl/record/rec_layer_s3.c:1605: error:0A000416:SSL routines::sslv3 alert >> certificate unknown >> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Connection >> reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket >> >> So this probably just comes down to either systemd/journalctl or me >> being stupid. >> >> Instead of asking for the journal/log for the "unit" stunnel (i.e. >> journalctl -u stunnel), you need instead to ask for the "systelog >> identifier" called stunnel like this: >> >> $ journalctl -t stunnel >> >> If you use --follow you get tail -f behavior, which is nice to see >> what's happening in real-time. >> >> -chris >> >>> On 12/13/2023 2:39 PM, Christopher Schultz wrote: >>>> other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears >>>> the case that I should be able to view the journals using this command: >>>> >>>> sudo journalctl --follow -u stunnel.service >>>> >>>> But nothing is ever printed there. >>> >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org >> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org > > > +------------------------------------------------------------+ > Michael D. Setzer II - Computer Science Instructor > (Retired) > mailto:[email protected] > mailto:[email protected] > mailto:[email protected] > Guam - Where America's Day Begins > G4L Disk Imaging Project maintainer > http://sourceforge.net/projects/g4l/ > +------------------------------------------------------------+ > > >

2 2

Getting logs in systemd environment
by Christopher Schultz 13 Dec '23

13 Dec '23

All, I recently built a server from scratch in Amazon EC2 using Amazon Linux 2023 which is systemd-based. When having trouble with a client failing to connect to our stunnel-based service, I tried raising the log level: debug=7 and restarted the service. I can't find any indication that the logs are available. There is no /var/log/stunnel directory. There are none of the usual files I might expect these logs to be in on other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears the case that I should be able to view the journals using this command: sudo journalctl --follow -u stunnel.service But nothing is ever printed there. Does anyone know how to get logging from stunnel in this kind of environment? (BTW, *I* am able to connect to this service, so I know it's running, etc. This is only a logging-problem, not an stunnel-isnt-working problem.) Thanks, -chris

2 1

Re: Getting logs in systemd environment
by Christopher Schultz 13 Dec '23

13 Dec '23

Carter, On 12/13/23 14:53, cbrowne wrote: > Have you tried doing "find / -name stunnel.log -print" as root. I have > found that the log file can be in a number of different locations > depending on the system. There are no files named stunnel.log on my system. I do not have a specific setting for "output". I was expecting syslog to be used for that purpose without a specific setting. syslog=yes appears to be the default given the man page for stunnel. But your comment got me more interested in exactly what was happening, so I tried /not/ limiting journalctl --follow to a specific service and I can see all kinds of things coming from stunnel: Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready file descriptor(s) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 events=0x2001 revents=0x1 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service [ORU-outbound] accepted (FD=3) from ::ffff:20.204.213.204:55455 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Service [ORU-outbound] started Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Setting local socket options (FD=3) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Option TCP_NODELAY set on local socket Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Service [ORU-outbound] accepted connection from ::ffff:20.204.213.204:55455 Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174806]: Peer certificate required Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Initializing application specific data for session authenticated Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: SNI: no virtual services defined Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS read client hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write server hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write certificate Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write key exchange Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write certificate request Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write server done Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready file descriptor(s) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 events=0x2001 revents=0x1 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service [ORU-outbound] accepted (FD=15) from ::ffff:client.ip:44905 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Service [ORU-outbound] started Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Setting local socket options (FD=15) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Option TCP_NODELAY set on local socket Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174807]: Service [ORU-outbound] accepted connection from ::ffff:client.ip:44905 Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174807]: Peer certificate required Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Initializing application specific data for session authenticated Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: SNI: no virtual services defined Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS read client hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write server hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write certificate Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write key exchange Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write certificate request Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write server done Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS alert (read): fatal: certificate unknown Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Remove session callback Dec 13 20:31:00 example.com stunnel[300695]: LOG3[174806]: SSL_accept: ssl/record/rec_layer_s3.c:1605: error:0A000416:SSL routines::sslv3 alert certificate unknown Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket So this probably just comes down to either systemd/journalctl or me being stupid. Instead of asking for the journal/log for the "unit" stunnel (i.e. journalctl -u stunnel), you need instead to ask for the "systelog identifier" called stunnel like this: $ journalctl -t stunnel If you use --follow you get tail -f behavior, which is nice to see what's happening in real-time. -chris > On 12/13/2023 2:39 PM, Christopher Schultz wrote: >> other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears >> the case that I should be able to view the journals using this command: >> >> sudo journalctl --follow -u stunnel.service >> >> But nothing is ever printed there. >

1 0

Connect multiple clients to one server port
by egig＠gmv.com 12 Dec '23

12 Dec '23

Hi all I was wondering if there is a way to connect multiple stunnel clients running on different machines to the same stunnel server service, also running on a different machine. All the clients must connect to the same server port. I have tried it with my current config but I haven't been able to make it work, is this even possible?? Thanks, Esteban.

3 4

Accepted connection and then TIMEOUTconnection exceeded:
by trashrap22＠gmail.com 07 Dec '23

07 Dec '23

Hi All, I can ssh to my VM with terminal etc. However my stunnel has something stopping the packet flow? What could be the problem and what should I check / troubleshoot: client log file: 2023.12.07 07:21:05 LOG7[0]: Service [Sql_Silicon] started 2023.12.07 07:21:05 LOG7[0]: Setting local socket options (FD=636) 2023.12.07 07:21:05 LOG7[0]: Option TCP_NODELAY set on local socket 2023.12.07 07:21:05 LOG5[0]: Service [Sql_Silicon] accepted connection from 127.0.0.1:50474 2023.12.07 07:21:05 LOG6[0]: s_connect: connecting <IP>:<Port> 2023.12.07 07:21:05 LOG7[0]: s_connect: s_poll_wait <IP>:<Port>: waiting 10 seconds 2023.12.07 07:21:05 LOG7[0]: FD=676 ifds=rwx ofds=--- 2023.12.07 07:21:15 LOG3[0]: s_connect: s_poll_wait <IP>:<Port>: TIMEOUTconnect exceeded 2023.12.07 07:21:15 LOG3[0]: No more addresses to connect 2023.12.07 07:21:15 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.12.07 07:21:15 LOG7[0]: local_rfd/local_wfd reset (FD=636) 2023.12.07 07:21:15 LOG7[0]: Local descriptor (FD=636) closed 2023.12.07 07:21:15 LOG7[0]: Service [Sql_Silicon] finished (0 left) My VM is a linux server, on startup of stunnel I get this concerning message which might be the cause? However, I checked and stunnel4:stunnel4 has permissions on the folder and psk file. 2023.12.07 07:40:45 LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/pskSQL_.txt server log file on start service: 2023.12.07 07:40:45 LOG7[ui]: Clients allowed=500 2023.12.07 07:40:45 LOG5[ui]: stunnel 5.56 on x86_64-pc-linux-gnu platform 2023.12.07 07:40:45 LOG5[ui]: Compiled with OpenSSL 1.1.1k 25 Mar 2021 2023.12.07 07:40:45 LOG5[ui]: Running with OpenSSL 1.1.1w 11 Sep 2023 2023.12.07 07:40:45 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2023.12.07 07:40:45 LOG7[ui]: errno: (*__errno_location ()) 2023.12.07 07:40:45 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2023.12.07 07:40:45 LOG5[ui]: UTF-8 byte order mark not detected 2023.12.07 07:40:45 LOG5[ui]: FIPS mode disabled 2023.12.07 07:40:45 LOG7[ui]: Compression disabled 2023.12.07 07:40:45 LOG7[ui]: No PRNG seeding was required 2023.12.07 07:40:45 LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/pskSQL_.txt 2023.12.07 07:40:45 LOG6[ui]: PSKsecrets line 1: 64-byte hexadecimal key configured for identity "siliconServer" 2023.12.07 07:40:45 LOG6[ui]: Initializing service [SQL-<port>] 2023.12.07 07:40:45 LOG6[ui]: PSK identities: 1 retrieved 2023.12.07 07:40:45 LOG7[ui]: Ciphers: PSK 2023.12.07 07:40:45 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.12.07 07:40:45 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2023.12.07 07:40:45 LOG7[ui]: No certificate or private key specified 2023.12.07 07:40:45 LOG6[ui]: DH initialization needed for DHE-PSK-AES256-GCM-SHA384 2023.12.07 07:40:45 LOG7[ui]: DH initialization 2023.12.07 07:40:45 LOG7[ui]: No certificate available to load DH parameters 2023.12.07 07:40:45 LOG6[ui]: Using dynamic DH parameters 2023.12.07 07:40:45 LOG7[ui]: ECDH initialization 2023.12.07 07:40:45 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.12.07 07:40:45 LOG5[ui]: Configuration successful 2023.12.07 07:40:45 LOG7[ui]: Binding service [SQL-<port>] 2023.12.07 07:40:45 LOG7[ui]: Listening file descriptor created (FD=9) 2023.12.07 07:40:45 LOG7[ui]: Setting accept socket options (FD=9) 2023.12.07 07:40:45 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2023.12.07 07:40:45 LOG6[ui]: Service [SQL-<port>] (FD=9) bound to <IP>:<port> 2023.12.07 07:40:45 LOG5[ui]: Switched to chroot directory: /var/lib/stunnel4/ 2023.12.07 07:40:45 LOG7[main]: Created pid file /stunnel.pid 2023.12.07 07:40:45 LOG7[cron]: Cron thread initialized 2023.12.07 07:40:45 LOG6[cron]: Executing cron jobs 2023.12.07 07:40:45 LOG5[cron]: Updating DH parameters

2 1

Stunnel load balancing through F5
by caspernetherlands＠gmail.com 05 Dec '23

05 Dec '23

Hello, Was wondering if anyone has tried to setup an HA like setup, specifically active/passive through two Stunnel servers and F5 load balancers. The problem I have is that TCP health checks (active checks) from the F5 are causing session initiation all the way to the 3rd party on the other side and this is causing a lot of unnecessary TCP traffic at the transport layer. The good thing is that the F5 closes these TCP sessions, but the problem is the 3rd party thinks someone is trying to brute force or something. Does anyone know how to maintain the TCP active health checks that the F5 does, but at the same time not cause a session initiation all the way to the 3rd party? Or if it’s not possible to stop the session initiation, would there be any option where something can be adjusted in the stunnel side so that the other side sees only one TCP health check as opposed to multiple every few seconds?

3 3

Connection failed: no suitable signature algorithm
by Martin K. 01 Dec '23

01 Dec '23

I'm trying to understand this error: SSL_accept: ssl/t1_lib.c:2827: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm How can I fix that? Is it because of the openssl version? I'm using Stunnel 5.71 on both sides. The server-side stunnel is built from source.

1 0

WG: stunnel core dumps, "SSL3_GET_RECORD:decryption failed or bad record mac"
by Sacha Hottinger 27 Nov '23

27 Nov '23

Hello, We are using stunnel 5.71 on Solaris 10 to tunnel NFS on more than 50 systems. In the past we saw stunnel dumping cores without any errors or hints in the stunnel log file. It was believed to be an OpenSSL 1.x problem. We got an stunnel version with SSL 2.x and 3.x but we had to go back to 1.x because of other problems. We noticed the dumps to happen at regular times and found a script that made NFS requests every 10 Min. After changing the script so there are less NFS requests it was stable. It looked like the problem accumulated over time and a counter or something alike reached its limit which then resulted in the core dump. Then the core dumps started again. It still seems to be related to the amount of requests because the problem occurs on the two NFS Servers with the highest number of connections. This time, we see errors in the stunnel log. The error slightly varies: 2023.10.12 22:05:43 LOG3[10745]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac // There were also a few cases with an additional "internal error". I.e: 2023.10.16 00:23:53 LOG5[2968]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:38270 2023.10.16 00:40:19 LOG3[2968]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.16 00:40:19 LOG3[2967]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.16 00:40:19 LOG5[2968]: Connection reset: 2476 byte(s) sent to TLS, 3324 byte(s) sent to socket 2023.10.16 00:40:19 LOG5[2967]: Connection reset: 2500 byte(s) sent to TLS, 3100 byte(s) sent to socket INTERNAL ERROR: Bad magic at ssl.c, line 192 2023.10.16 00:40:20 LOG6[ui]: Initializing inetd mode configuration // or 2023.10.23 07:33:53 LOG5[62]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:50626 2023.10.23 07:38:37 LOG3[62]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.23 07:38:37 LOG5[62]: Connection reset: 364 byte(s) sent to TLS, 336 byte(s) sent to socket ... 2023.10.23 07:44:37 LOG5[61]: Connection reset: 1704 byte(s) sent to TLS, 2360 byte(s) sent to socket INTERNAL ERROR: Bad magic at OpenSSL, line 0 // or 2023.10.24 08:20:59 LOG5[52]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:43966 2023.10.24 08:56:13 LOG6[52]: Read socket closed (readsocket) ... 2023.10.24 09:00:01 LOG5[53]: Service [tls-nfs-srv] accepted connection from 1.2.3.4:59973 2023.10.24 09:00:01 LOG6[53]: Peer certificate not required 2023.10.24 09:00:01 LOG3[49]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.24 09:00:01 LOG5[49]: Connection reset: 7112 byte(s) sent to TLS, 9188 byte(s) sent to socket INTERNAL ERROR: Dead canary at OpenSSL, line 0 I have attached a file with more details. Although this looks like an OpenSSL problem at first glance, we think it still could be a problem with stunnel. Can you make more out of this data? Do you know a way to log more information about the connections? i.e. not all requests were accepted. What happened here? 2023.11.24 02:50:13 LOG7[359]: 354 server accept(s) requested 2023.11.24 02:50:13 LOG7[359]: 351 server accept(s) succeeded Thank you in advance. Best regards Sasha This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager.

1 0

Proxy an unencrypted Oracle client
by Randall Smith 15 Nov '23

15 Nov '23

I'm trying to determine if it is possible to connect an Oracle client that is not configured for encrypted connections to a TLS or mTLS connected Oracle Autonomous database using an stunnel client connection. First I tested a TLS capable client to verify connectivity. Next I set up stunnel to make the same TLS connection. I have configured stunnel as follows: foreground = yes debug = info [oracle] accept = 127.0.0.1:1521 connect = adb.us-ashburn-1.oraclecloud.com:1521 client = yes Next, I attempted a non-encrypted Oracle database connection to 127.0.0.1:1521, but got the following errors from stunnel: 2023.11.14 10:58:50 LOG6[0]: TLS connected: new session negotiated 2023.11.14 10:58:50 LOG6[0]: TLSv1.2 ciphersuite: AES256-GCM-SHA384 (256-bit encryption) 2023.11.14 10:58:50 LOG3[0]: SSL_read: ../ssl/record/ssl3_record.c:1065: error:14191044:SSL routines:tls1_enc:internal error 2023.11.14 10:58:50 LOG5[0]: Connection reset: 752 byte(s) sent to TLS, 8 byte(s) sent to socket ^C2023.11.14 10:58:57 LOG3[ui]: Received SIGINT; terminating Could this be a configuration issue in stunnel or might there be something in the Oracle database protocol itself that is different for TLS connections that would prevent tunneling?

1 0

Re: Silent installation is not working for Stunnel v5.71
by Josealf.rm 10 Nov '23

10 Nov '23

Hi Pavan, AFAIK, there is no option to customise the components when you do a silent install. You get all components. If someone knows better, let me know. Regards Jose > On 9/11/2023, at 1:09 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: > > Hi Jose, > > Gentle Reminder !! > > Can we get an update on this. > > Regards, > PavanReddy. > > -----Original Message----- > From: Pavan Reddy > Sent: Tuesday, November 7, 2023 10:17 AM > To: Josealf.rm <josealf(a)rocketmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: RE: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Jose, > > I have re-attached the snapshots for your reference. > > Regards, > PavanReddy. > > -----Original Message----- > From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Thursday, November 2, 2023 4:49 PM > To: Pavan Reddy <pavan.reddy(a)adaptiva.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Pavan, > > Sorry, I don’t see the snapshots/customizations you talk about. > > Regards > Jose > >> On 30/10/2023, at 7:19 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: >> >> Hi Team, >> >> Could you please provide an update on this. >> >> Regards, >> PavanReddy. >> >> -----Original Message----- >> From: Pavan Reddy >> Sent: Wednesday, October 25, 2023 3:08 PM >> To: Josealf.rm <josealf(a)rocketmail.com> >> Cc: stunnel-users(a)stunnel.org >> Subject: RE: [stunnel-users] Silent installation is not working for >> Stunnel v5.71 >> >> Hi Team, >> >> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. >> For more details you may refer https://adaptiva.com/products/autonomous-patch. We are willing to add Stunnel 5.71 product to our catalogue. >> >> Application is installing silently by using /S. >> >> While installing the application we found these customizations. And I am attaching the snapshots. >> >> Could you please have a look and help us to handle these customizations with silent properties. >> >> Regards, >> PavanReddy. >> >> -----Original Message----- >> From: Josealf.rm <josealf(a)rocketmail.com> >> Sent: Monday, October 23, 2023 4:50 PM >> To: Meta Email <meta(a)adaptiva.com> >> Cc: stunnel-users(a)stunnel.org >> Subject: Re: [stunnel-users] Silent installation is not working for >> Stunnel v5.71 >> >> [Some people who received this message don't often get email from >> josealf(a)rocketmail.com. Learn why this is important at >> https://aka.ms/LearnAboutSenderIdentification ] >> >> Stunnel uses an NSIS based installer. Try using /S instead of -quiet. >> >> -quiet is a switch for stunnel.exe, not for the installer and is used to configure stunnel as a service. >> >> >> Regards >> Jose >> >>>> On 23/10/2023, at 3:30 AM, Meta Adaptiva via stunnel-users <stunnel-users(a)stunnel.org> wrote: >>> >>> Hi Team, >>> >>> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. >>> https://ada/ >>> p%2F&data=05%7C01%7Cpavan.reddy%40adaptiva.com%7C1d6b0f9facd740f536d4 >>> 08dbdb959b24%7C1264bc823da147f88a41e4c19cdc7499%7C0%7C0%7C63834520784 >>> 7265891%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiL >>> CJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=hWcJe3nMjxuwIPz9M >>> ee9qKT5xCAi6ubmK3l%2FIu45e94%3D&reserved=0 >>> tiva.com%2Fproducts%2Fautonomous-patch&data=05%7C01%7Cpavan.reddy%40a >>> d >>> aptiva.com%7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e >>> 4 >>> c19cdc7499%7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWI >>> j >>> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7 >>> C >>> %7C%7C&sdata=Vp%2FDHnulu3OEo%2BBnEnt5EY4GQfThzGQ5SC75YK%2Bb3V0%3D&res >>> e >>> rved=0 >>> >>> We have downloaded the binary from below URL – >>> https://www/. >>> stunnel.org%2Fdownloads.html&data=05%7C01%7Cpavan.reddy%40adaptiva.co >>> m >>> %7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4c19cdc749 >>> 9 >>> %7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjA >>> w >>> MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sd >>> a >>> ta=kIsTmj%2Bx3fIiPWKL85BDKJ8yN2K%2FKk077dWHsb82Q9M%3D&reserved=0 >>> >>> We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. >>> Could you please help us to install the application silently. >>> _______________________________________________ >>> stunnel-users mailing list -- stunnel-users(a)stunnel.org To >>> unsubscribe send an email to stunnel-users-leave(a)stunnel.org >> >> Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email. > > Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email.

1 0

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

Re: Silent installation is not working for Stunnel v5.71
by Josealf.rm 02 Nov '23

02 Nov '23

Hi Pavan, Sorry, I don’t see the snapshots/customizations you talk about. Regards Jose > On 30/10/2023, at 7:19 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: > > Hi Team, > > Could you please provide an update on this. > > Regards, > PavanReddy. > > -----Original Message----- > From: Pavan Reddy > Sent: Wednesday, October 25, 2023 3:08 PM > To: Josealf.rm <josealf(a)rocketmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: RE: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Team, > > We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. > For more details you may refer https://adaptiva.com/products/autonomous-patch. We are willing to add Stunnel 5.71 product to our catalogue. > > Application is installing silently by using /S. > > While installing the application we found these customizations. And I am attaching the snapshots. > > Could you please have a look and help us to handle these customizations with silent properties. > > Regards, > PavanReddy. > > -----Original Message----- > From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Monday, October 23, 2023 4:50 PM > To: Meta Email <meta(a)adaptiva.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > [Some people who received this message don't often get email from josealf(a)rocketmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] > > Stunnel uses an NSIS based installer. Try using /S instead of -quiet. > > -quiet is a switch for stunnel.exe, not for the installer and is used to configure stunnel as a service. > > > Regards > Jose > >> On 23/10/2023, at 3:30 AM, Meta Adaptiva via stunnel-users <stunnel-users(a)stunnel.org> wrote: >> >> Hi Team, >> >> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. >> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fadap >> tiva.com%2Fproducts%2Fautonomous-patch&data=05%7C01%7Cpavan.reddy%40ad >> aptiva.com%7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4 >> c19cdc7499%7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIj >> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C >> %7C%7C&sdata=Vp%2FDHnulu3OEo%2BBnEnt5EY4GQfThzGQ5SC75YK%2Bb3V0%3D&rese >> rved=0 >> >> We have downloaded the binary from below URL – >> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww. >> stunnel.org%2Fdownloads.html&data=05%7C01%7Cpavan.reddy%40adaptiva.com >> %7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4c19cdc7499 >> %7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAw >> MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sda >> ta=kIsTmj%2Bx3fIiPWKL85BDKJ8yN2K%2FKk077dWHsb82Q9M%3D&reserved=0 >> >> We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. >> Could you please help us to install the application silently. >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe >> send an email to stunnel-users-leave(a)stunnel.org > > Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email.

1 0

two stunnels in the local network
by alessandro.deliperi＠ichnobyte.it 02 Nov '23

02 Nov '23

Hi everyone, this is my first question. I have successfully configured a stunnel (A) that does the job of it. I need to configure a second stunnel (B) that works in a more hidden network. When B connects to A, which connects to public mail server X I get a time out error. I bring you the logs, I think it is related to the fact that both stunnel servers are trying to establish a TLS session. Is there a way to solve? 2023.11.02 08:42:10 LOG7[0]: Option TCP_NODELAY set on local socket 2023.11.02 08:42:10 LOG5[0]: Service [smtp-tls] accepted connection from 192.168.0.109:46078 2023.11.02 08:42:10 LOG6[0]: s_connect: connecting 192.168.180.10:25 2023.11.02 08:42:10 LOG7[0]: s_connect: s_poll_wait 192.168.180.10:25: waiting 10 seconds 2023.11.02 08:42:10 LOG7[0]: FD=6 events=0x2001 revents=0x0 2023.11.02 08:42:10 LOG7[0]: FD=11 events=0x2005 revents=0x0 2023.11.02 08:42:10 LOG5[0]: s_connect: connected 192.168.180.10:25 2023.11.02 08:42:10 LOG5[0]: Service [smtp-tls] connected remote server from 192.168.0.23:41156 2023.11.02 08:42:10 LOG7[0]: Setting remote socket options (FD=11) 2023.11.02 08:42:10 LOG7[0]: Option TCP_NODELAY set on remote socket 2023.11.02 08:42:10 LOG7[0]: Remote descriptor (FD=11) initialized 2023.11.02 08:42:10 LOG7[0]: <- 220 mailservers 2023.11.02 08:42:10 LOG7[0]: -> 220 mailservers 2023.11.02 08:42:10 LOG7[0]: -> EHLO localhost 2023.11.02 08:42:11 LOG7[0]: <- 250-email-smtp.posta 2023.11.02 08:42:11 LOG7[0]: <- 250-8BITMIME 2023.11.02 08:42:11 LOG7[0]: <- 250-STARTTLS 2023.11.02 08:42:11 LOG7[0]: <- 250-AUTH PLAIN LOGIN 2023.11.02 08:42:11 LOG7[0]: <- 250 Ok 2023.11.02 08:42:11 LOG7[0]: -> STARTTLS 2023.11.02 08:42:11 LOG7[0]: <- 503 TLS not available due to temporary reason: TLS already active 2023.11.02 08:42:11 LOG3[0]: Remote server is not RFC 2487 compliant 2023.11.02 08:42:11 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

1 0

Suppressing warnings
by Ian Pilcher 31 Oct '23

31 Oct '23

I am using stunnel (along with an Apache reverse proxy) to enable my browser to connect to my old managed switches. An example configuration looks like this: debug = warning syslog = yes [switch1] client = yes accept = 127.0.0.1:8081 connect = 192.168.4.1:443 verifyChain = yes checkHost = switch1.example.com CAfile = /etc/pki/ca-trust/source/anchors/example-com-ca.crt sslVersion = TLSv1 ciphers = DHE-RSA-AES256-SHA options = ALLOW_UNSAFE_LEGACY_RENEGOTIATION securityLevel = 1 OCSPrequire = no Everything is working, but I'm seeing a lot of warnings in my system log: OCSP: No OCSP stapling response received transfer: s_poll_wait: TIMEOUTclose exceeded: closing Are there any settings that I can use to suppress these warnings? Thanks! -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

1 0

TLSV1.0
by Stefano Pelli 27 Oct '23

27 Oct '23

Dear all, as my first post, I am asking a confirmation: is TLS ver 1.0 still supported by stunnel (unfortunately, I need that deprecated version to access a server)? It all worked fine, then I upgraded to Kubuntu 22.04 and for some reason that broke the support of this protocol. I get the connection closed right after trying to open it. Before upgrading all was working without a hitch. Since then (1 year ago), I have been looking for solutions and trying all sorts of fixes by changing stunnel.conf, but with no success. Can you be so kind to give me some info about this and if possible a remedy until the server gets updated (not under my control)? Thank you in advance, Stefano

3 3

Re: TLSV1.0
by Stefano Pelli 26 Oct '23

26 Oct '23

At 04:26 AM 10/26/2023, Thomas Ward via stunnel-users wrote: >This is not an STunnel issue but an OpenSSL libraries/defaults issue. Thank you Thomas. After your input I made some more tests. Following advice founf in the net, I had already included: >[system_default_sect] >CipherString = DEFAULT@SECLEVEL=1 in openssl.cnf But still it would not work through stunnel. Today I tried a connection directly from openssl and I managed to succesfully initiate and conclude a proper POP3 dialog with the culprit server. Then, looking at the messages from openssl, I saw that the connection was established, as expected, by TLSV1 and AES256-SHA protocol. Therefore, I tried to force this in the relevant section of stunnel.conf: >ciphers = AES256-SHA But with the same result when trying to open the connection through stunnel (5.71) >telnet 127.0.1.1 110 >Trying 127.0.1.1... >Connected to 127.0.1.1. >Escape character is '^]'. >Connection closed by foreign host. With the other servers I can this way estblish a POP3 dialog, as I managed directly through openssl. What am I missing here? Thank you for any addition insights! Stefano

1 0

Silent installation is not working for Stunnel v5.71
by meta＠adaptiva.com 23 Oct '23

23 Oct '23

Hi Team, We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. https://adaptiva.com/products/autonomous-patch We have downloaded the binary from below URL – https://www.stunnel.org/downloads.html We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. Could you please help us to install the application silently.

2 1

Re: Silent installation is not working for, Stunnel v5.71
by Miroslav Geisselreiter 23 Oct '23

23 Oct '23

Hi, we use /S switch which works for us for a long time. Miroslav Geisselreiter > Message: 1 > Date: Mon, 23 Oct 2023 08:30:30 -0000 > From: meta(a)adaptiva.com > Subject: [stunnel-users] Silent installation is not working for > Stunnel v5.71 > To: stunnel-users(a)stunnel.org > Message-ID: <169804983049.1982.1603425052292506533(a)stunnel.org> > Content-Type: text/plain; charset="utf-8" > > Hi Team, > > We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. > https://adaptiva.com/products/autonomous-patch > > We have downloaded the binary from below URL – > https://www.stunnel.org/downloads.html > > We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. > Could you please help us to install the application silently. >

1 0

Re: How do I hide my browsing?
by Eberhard 21 Oct '23

21 Oct '23

Exactly! If people could get around the Forti products that easily they would not have the reputation they have! Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 From: Thomas Ward via stunnel-users <stunnel-users(a)stunnel.org> Sent: Friday, October 20, 2023 6:11 AM To: Jason Long <hack3rcon(a)yahoo.com>; Stewart Anderson via Stunnel-users <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Re: How do I hide my browsing? Stunnel is not a VPN, so no it can't "hide your browsing". Hiding your browsing needs more than just stunnel because of how DNS and other components for browsing work. Question 2 is beyond the scope of stunnel's list to answer. This said: If you have to ask how to hide your browsing that means you're violating your network's use policies, and with Fortinet and Fortigate in line it sounds like you're on a workplace network. Just don't use your workplace network for whatever shady stuff you're concerned about them finding you doing. Sent from my Galaxy -------- Original message -------- From: Jason Long via stunnel-users <stunnel-users(a)stunnel.org <mailto:[email protected]> > Date: 10/20/23 09:05 (GMT-05:00) To: Stewart Anderson via Stunnel-users <stunnel-users(a)stunnel.org <mailto:[email protected]> > Subject: [stunnel-users] How do I hide my browsing? Hello, In an internal network, they monitor web browsing through firewalls (Fortinet and FortiGate). I have two questions: 1- Can I use Stunnel to hide my browsing? 2- Can they capture usernames and passwords for email and other websites? Thank you.

3 4

How do I hide my browsing?
by Jason Long 20 Oct '23

20 Oct '23

Hello,In an internal network, they monitor web browsing through firewalls (Fortinet and FortiGate). I have two questions: 1- Can I use Stunnel to hide my browsing? 2- Can they capture usernames and passwords for email and other websites? Thank you.

3 2

stunnel cmvp number
by Seray Tokadli 09 Oct '23

09 Oct '23

Hi, for our company i need to find the cvmp number for stunnel however I am not able to find it. Is there anyone who can help me with that? https://csrc.nist.gov/projects/cryptographic-module-validation-program/vali… I could not find stunnel here. -- Seray TOKADLI KILIÇ +420778116052

2 1

Re: stunnel smtp tls frontend server/proxy for remote backend postfix
by James Thornton 09 Oct '23

09 Oct '23

The direction is mail sent from an external email address to stunnel (running on google cloud) for delivery to a postfix mailbox running on a local network. I posted this question on serverfault ( https://serverfault.com/questions/1145279/stunnel-smtp-tls-frontend-server-…) and someone said the problem may be either stunnel strips the ip and/or the the sender is trying to switch to TLS on postfix, not realizing the TLS connection has already been made by stunnel. On Sat, Oct 7, 2023 at 9:22 AM Stewart Anderson <stuson_2000(a)yahoo.co.uk> wrote: > Client and server will both negotiate SSL. Your server mode is presenting > a certificate. > > It's not clear from your config /text which direction your traffic is > going !! > > If it's incoming from Google to your postfix server then server mode is > correct. Stunnel will negotiate the SSL and then forward to postfix in > clear. If the handshake isn't happening, have you put Google's cert in > your CA certs somewhere? > > What confuses it for me is the Google internal IP reference. If you are > getting traffic from Google then stunnel would need to be accepting on the > host where stunnel is, so only a port is required in the accept. This can > be on a machine in your DMZ or behind a firewall, e.g. on or close to your > postfix server. > > Hope that helps. > > > > > Stewart > stuson_2000(a)yahoo.co.uk > > On 6 October 2023 05:51:14 "james(a)jamesthornton.com" < > james(a)jamesthornton.com> wrote: > > I'm running stunnel in server mode and listening on port 587 and trying to >> connect to a remote postfix server running on port 25. >> >> NB: the two servers are connected via zerortier, which may or may no be >> relevant to the issue. >> >> DEBUG = 7 >> >> [ssmtp] >> protocol = smtp >> accept = google_cloud_internal_ip:587 >> connect = remote_zerotier_postfix_ip:25 >> cert = /etc/stunnel/domain.pem >> >> I thought this would set up stunnel to handle the TLS handshake and >> terminate the TLS connection, while proxing to the backend postfix server >> without requiring postfix to worry about TLS. But I'm getting LOG3[0]: >> STARTTLS expected when stunnel tries to connect to postfix. If I put >> stunnel in client mode, then it doesn't negotiate the incoming TLS >> (right?). >> >> What am I missing? >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org >> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org >> > > -- James Thornton, *http://electricspeed.com <http://electricspeed.com>*

2 1

stunnel smtp tls frontend server/proxy for remote backend postfix
by james＠jamesthornton.com 06 Oct '23

06 Oct '23

I'm running stunnel in server mode and listening on port 587 and trying to connect to a remote postfix server running on port 25. NB: the two servers are connected via zerortier, which may or may no be relevant to the issue. DEBUG = 7 [ssmtp] protocol = smtp accept = google_cloud_internal_ip:587 connect = remote_zerotier_postfix_ip:25 cert = /etc/stunnel/domain.pem I thought this would set up stunnel to handle the TLS handshake and terminate the TLS connection, while proxing to the backend postfix server without requiring postfix to worry about TLS. But I'm getting LOG3[0]: STARTTLS expected when stunnel tries to connect to postfix. If I put stunnel in client mode, then it doesn't negotiate the incoming TLS (right?). What am I missing?

1 0