- stunnel-users - stunnel.org

stunnel ignores chroot /etc/hosts
by kmx1818＠gmail.com 10 Aug '21

10 Aug '21

Hello all! On my localhost I've got a java 1.4 tls1.0 app/service running, which is hard-coded to http-call a soap service (tls1.0 level too) running on a remote host, say, svchost. Host resolution is "files" only (ie /etc/hosts) - no dns. The aim is to make this java client tls1.2-compliant. My solution is: 1/ configure svchost to be (an alias of) localhost - in global /etc/hosts 127.0.0.1 localhost svchost 2/ configure a chroot env for stunell with its own /etc/hosts 1.2.3.4 svchost (needless to say that to make it work I had to copy /etc's nsswitch.conf resolv.conf, a bunch of libraries, esp libnsl and nsl_files etc, and create another lot of /dev entries) I've tested it with the native getent command: $ getent hosts svchost 127.0.0.1 $ chroot /var/run/stunnel/chroot getent hosts svchost 1.2.3.4 3/ run stunnel in chroot mode: # /opt/csw/bin/stunnel -version stunnel 5.59 on sparc-sun-solaris2.10 platform Compiled/running with OpenSSL 1.0.2u 20 Dec 2019 ; for tls1 clients client = yes sslVersion = TLSv1.2 delay = yes chroot = /var/run/stunnel/chroot [tls12] accept = localhost:80 connect = svchost:443 ; Alas, stunnel still resolves svchost from the global /etc/hosts - not from chroot's!: $ curl -kL http://svchost/service curl: (52) Empty reply from server ...and in /var/adm/messages: …LOG[4]: Service [tls12] accepted connection from 127.0.0.1:47944 …LOG[4]: s_connect: connecting 127.0.0.1:443 …LOG[4]: s_connect: s_poll_wait 127.0.0.1:443: waiting 10 seconds …LOG[4]: s_connect: connect 127.0.0.1:443: Connection refused (146) …LOG[4]: No more addresses to connect I've tried foreground yes/no, truss/strace - nothing useful... What am I missing!? Thank you in advance!

2 2

Unexpected socket close while sending mail
by zfefm＠gmx.de 27 Jul '21

27 Jul '21

Hi, since several days I try to get stunnel working to add TLS1.2 or higher support to my outdated email client program (Applemail 4.6) as my service provider will stop supporting the old protocols soon. The protocol of stunnel looks as if the connection gets established well. But as soon I want to send a mail my mail program tries for 10-15s to send an then gives up. In the stunnel protocol (time stamp 16:54:22) the server seems to accept the connection, but about 10-15s later I get: Unexpected socket close (s_read) Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Any ideas what could be the problem? Thanks. conf and protocol attached. conf: setuid = nobody setgid = nogroup foreground = yes debug = 7 output = /usr/local/etc/stunnel/stunnel.log [strato-pop3] client = yes verifyChain = yes accept = 127.0.0.1:110 connect = pop3.strato.de:995 CApath = /usr/local/etc/stunnel/ cert = /usr/local/etc/stunnel/stunnel.pem checkHost = pop3.strato.de protocol = pop3 [strato-smtp] client = yes verifyChain = yes accept = 127.0.0.1:25 connect = smtp.strato.de:465 checkHost = smtp.strato.de CApath = /usr/local/etc/stunnel/ cert = /usr/local/etc/stunnel/stunnel.pem protocol = smtp protocol : 2021.07.22 16:53:49 LOG6[ui]: Initializing inetd mode configuration 2021.07.22 16:53:49 LOG7[ui]: Clients allowed=125 2021.07.22 16:53:49 LOG5[ui]: stunnel 5.59 on x86_64-apple-darwin10.8.0 platform 2021.07.22 16:53:49 LOG5[ui]: Compiled/running with OpenSSL 1.1.1k 25 Mar 2021 2021.07.22 16:53:49 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.07.22 16:53:49 LOG7[ui]: errno: (*__error()) 2021.07.22 16:53:49 LOG6[ui]: Initializing inetd mode configuration 2021.07.22 16:53:49 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2021.07.22 16:53:49 LOG5[ui]: UTF-8 byte order mark detected 2021.07.22 16:53:49 LOG5[ui]: FIPS mode disabled 2021.07.22 16:53:49 LOG6[ui]: Compression enabled: 0 methods 2021.07.22 16:53:49 LOG7[ui]: No PRNG seeding was required 2021.07.22 16:53:49 LOG6[ui]: Initializing service [strato-pop3] 2021.07.22 16:53:49 LOG6[ui]: stunnel default security level set: 2 2021.07.22 16:53:49 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2021.07.22 16:53:49 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2021.07.22 16:53:49 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2021.07.22 16:53:49 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG7[ui]: Private key check succeeded 2021.07.22 16:53:49 LOG6[ui]: DH initialization skipped: client section 2021.07.22 16:53:49 LOG7[ui]: ECDH initialization 2021.07.22 16:53:49 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2021.07.22 16:53:49 LOG6[ui]: Initializing service [strato-smtp] 2021.07.22 16:53:50 LOG6[ui]: stunnel default security level set: 2 2021.07.22 16:53:50 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2021.07.22 16:53:50 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2021.07.22 16:53:50 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2021.07.22 16:53:50 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG7[ui]: Private key check succeeded 2021.07.22 16:53:50 LOG6[ui]: DH initialization skipped: client section 2021.07.22 16:53:50 LOG7[ui]: ECDH initialization 2021.07.22 16:53:50 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2021.07.22 16:53:50 LOG5[ui]: Configuration successful 2021.07.22 16:53:50 LOG7[ui]: Deallocating deployed section defaults 2021.07.22 16:53:50 LOG7[ui]: Binding service [strato-pop3] 2021.07.22 16:53:50 LOG7[ui]: Listening file descriptor created (FD=8) 2021.07.22 16:53:50 LOG7[ui]: Setting accept socket options (FD=8) 2021.07.22 16:53:50 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2021.07.22 16:53:50 LOG6[ui]: Service [strato-pop3] (FD=8) bound to 127.0.0.1:110 2021.07.22 16:53:50 LOG7[ui]: Binding service [strato-smtp] 2021.07.22 16:53:50 LOG7[ui]: Listening file descriptor created (FD=10) 2021.07.22 16:53:50 LOG7[ui]: Setting accept socket options (FD=10) 2021.07.22 16:53:50 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2021.07.22 16:53:50 LOG6[ui]: Service [strato-smtp] (FD=10) bound to 127.0.0.1:25 2021.07.22 16:53:50 LOG7[ui]: No pid file being created 2021.07.22 16:53:50 LOG7[cron]: Cron thread initialized 2021.07.22 16:53:50 LOG6[cron]: Executing cron jobs 2021.07.22 16:53:50 LOG6[cron]: Cron jobs completed in 0 seconds 2021.07.22 16:53:50 LOG7[cron]: Waiting 86400 seconds 2021.07.22 16:54:22 LOG7[ui]: Found 1 ready file descriptor(s) 2021.07.22 16:54:22 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[ui]: FD=8 events=0x1 revents=0x1 2021.07.22 16:54:22 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[ui]: Service [strato-pop3] accepted (FD=3) from 127.0.0.1:49864 2021.07.22 16:54:22 LOG7[0]: Service [strato-pop3] started 2021.07.22 16:54:22 LOG7[0]: Setting local socket options (FD=3) 2021.07.22 16:54:22 LOG7[0]: Option TCP_NODELAY set on local socket 2021.07.22 16:54:22 LOG5[0]: Service [strato-pop3] accepted connection from 127.0.0.1:49864 2021.07.22 16:54:22 LOG6[0]: s_connect: connecting 81.169.145.131:995 2021.07.22 16:54:22 LOG7[0]: s_connect: s_poll_wait 81.169.145.131:995: waiting 10 seconds 2021.07.22 16:54:22 LOG7[0]: FD=6 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[0]: FD=13 events=0x5 revents=0x0 2021.07.22 16:54:22 LOG5[0]: s_connect: connected 81.169.145.131:995 2021.07.22 16:54:22 LOG5[0]: Service [strato-pop3] connected remote server from 192.168.17.130:49865 2021.07.22 16:54:22 LOG7[0]: Setting remote socket options (FD=13) 2021.07.22 16:54:22 LOG7[0]: Option TCP_NODELAY set on remote socket 2021.07.22 16:54:22 LOG7[0]: Remote descriptor (FD=13) initialized 2021.07.22 16:55:22 LOG3[0]: Unexpected socket close (s_read) 2021.07.22 16:55:22 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2021.07.22 16:55:22 LOG7[0]: Remote descriptor (FD=13) closed 2021.07.22 16:55:22 LOG7[0]: Local descriptor (FD=3) closed 2021.07.22 16:55:22 LOG7[0]: Service [strato-pop3] finished (0 left) 2021.07.22 16:55:22 LOG7[0]: str_stats: 1 block(s), 32 data byte(s), 90 control byte(s) 2021.07.22 16:55:22 LOG7[0]: str_stats: 32 byte(s) at network.c:735

2 3

Equivalence of verify=2
by Yann RESCOURIO 22 Jul '21

22 Jul '21

Hello I would like to authenticate a server with only its CA file. What is the equivalence of verify=2 ? requireCert = yes verifyChain = no verifyPeer = yes Regards Yann

3 5

idea: linux stunnel mini-GUI
by Dmitry Bakshaev 13 Jul '21

13 Jul '21

we need start stunnel on linux desktop by ordinary user (like on windows): 1 click stunnel icon on system menu 2 enter user certificate password 3 use opened tunnels with users applications 4 on desktop session ends close all tunnels make XDG menu entry file: [Desktop Entry] Type=Application Name=stunnel Categories=Network; GenericName=TLS/SSL - Port Wrapper Comment[ru_RU]=Секретный туннель Icon=stunnel Exec=/usr/bin/stunnel Terminal=true X-KeepTerminal=true but only problem is how stunnel react on signals: HUP is daemon's "reload config". in X-session HUP signal is "session end" and stunnel is not exited on closing terminal or logout. attached patch change this behavior: if "foreground=yes" specified in stunnel.conf HUP signal is treated as TERM and stunnel exited. foreground=yes is "debug" or "desktop" mode of stunnel. XDG-desktop file and icon file may be included in default stunnel distributions.

1 0

Difficulty to select exact Cipher
by Sachin Deshmukh 12 Jul '21

12 Jul '21

Hello Together, I had been trying to use a stunnel to set PSK encrypted TLS. Below is my conf file. [client] client = yes accept = 127.0.0.1:8888 connect = 192.168.1.100:443 ciphers = PSK-AES128-CBC-SHA256 PSKsecrets = /data/dummy.txt I can see communication, but client e.g. Stunnel from Client side offer several other cipher in addition to exact one which is expected as per conf. I wish PSK-AES128-CBC-SHA256 (0x00ae) But I see the list below in actual communication. [image: image.png] Please let me know 1 .how we can inform stunnel to use exact and only 1 cipher provided in the conf file. Or 2. How can we state hex id instead of string. If I see a cipher list, with the same keyword as a part or whole there are more than 1 ciphers, I suppose this causes stunnel to take a list as per string match. ECDHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA256 RSA-PSK-AES128-CBC-SHA256 TLSv1 Kx=RSAPSK Au=RSA Enc=AES(128) Mac=SHA256 DHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=DHEPSK Au=PSK Enc=AES(128) Mac=SHA256 *PSK-AES128-CBC-SHA256 * TLSv1 Kx=PSK Au=PSK Enc=AES(128) Mac=SHA256 Can we make a stunnel to select only one exact cipher?

1 0

curl 7.61 exit status 8 from stunnel service of tls1
by kmx1818＠gmail.com 09 Jul '21

09 Jul '21

Hello all, For a remote tls1 web service : $ # openssl s_client -connect myremote:7002 -tls1 CONNECTED(00000004) depth=0 CN = xxx, OU = xxx, O = xxx, C = xxx verify error:num=18:self signed certificate verify return:1 depth=0 CN = xxx, OU = xxx, O = xxx, C = xxx verify return:1 --- Certificate chain ... --- Server certificate -----BEGIN CERTIFICATE----- MIIC8zCCAdsCBGCvjhEwDQYJKoZIhvcNAQEFBQAwPjEOMAwGA1UEAxMFRUZXRUIx ... QG9sNNhQW65rRVmdqy/g0cBbLKRKhmRCS+ajRIzBcO9ZmMe42TES -----END CERTIFICATE----- subject=XXX issuer=XXX --- No client certificate CA names sent --- SSL handshake has read 889 bytes and written 509 bytes --- New, TLSv1/SSLv3, Cipher is RC4-MD5 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1 Cipher : RC4-MD5 Session-ID: 2D9F8D8833A459C16C1D01F0C92F8EB7 Session-ID-ctx: Master-Key: 1BF68D1AAEEC291A60252ECD63C374661FBBE028FB39A75DDA29E4E3FB6FE34CFC80F875F9E16F9D7C840F185757F583 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1625842735 Timeout : 7200 (sec) Verify return code: 18 (self signed certificate) --- closed $ I can test it alright with an "old" curl $ curl --version curl 7.15.4 (sparc-sun-solaris2.9) libcurl/7.15.4 OpenSSL/0.9.7g zlib/1.2.3 Protocols: tftp ftp telnet dict ldap http file https ftps Features: IPv6 Largefile NTLM SSL libz ...like this $ curl -skL https://myremote:7002/MyWebService?WSDL <?xml version="1.0" encoding="UTF-8"?> ... </soap:address> </port> </service> </definitions> I want to tls1.2-enable myremote:7002 with stunnel, and run a tls1.2 curl instead. My stunnel installation $ /opt/csw/bin/stunnel -version Initializing inetd mode configuration stunnel 5.59 on sparc-sun-solaris2.10 platform Compiled with OpenSSL 1.0.2u 20 Dec 2019 Running with OpenSSL 1.0.2o 27 Mar 2018 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP Global options: RNDbytes = 1024 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK curves = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 I start it with this service config: [my12] client = no accept = 7002 connect = myremote:7002 cert = /etc/opt/csw/stunnel/stunnel.crt key = /etc/opt/csw/stunnel/stunnel.key sslVersion = TLSv1.2 debug = 7 and test it with a fairly recent curl $ /opt/csw/bin/curl --version curl 7.61.0 (sparc-sun-solaris2.10) libcurl/7.61.0 OpenSSL/1.0.2o zlib/1.2.8 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) Release-Date: 2018-07-11 Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp Features: AsynchDNS IDN IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP UnixSockets HTTPS-proxy PSL Metalink Alas, the recent curl call $ /opt/csw/bin/curl -skL https://myremote:7002/MyWebService?WSDL ...fails with exit status 23 In verbose mode we get * Trying 127.0.0.1... * TCP_NODELAY set * Failed to set TCP_KEEPALIVE on fd 4 * Connected to localhost (127.0.0.1) port 7002 (#0) * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: none CApath: /etc/opt/csw/ssl/certs * TLSv1.2 (OUT), TLS header, Certificate Status (22): * TLSv1.2 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Client hello (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS change cipher, Client hello (1): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server did not agree to a protocol * Server certificate: * subject: C=TS; ST=Westfarthing; L=Hobbiton; O=Thorin and Company; OU=Burglars; CN=ahost.theshire.net; emailAddress=bilbo(a)theshire.net * start date: Jun 30 09:24:25 2021 GMT * expire date: Jun 30 09:24:25 2022 GMT * issuer: C=TS; ST=Westfarthing; L=Hobbiton; O=Thorin and Company; OU=Burglars; CN=ahost.theshire.net; emailAddress=bilbo(a)theshire.net * SSL certificate verify result: self signed certificate (18), continuing anyway. > GET /MyWebService?WSDL HTTP/1.1 > Host: localhost:7002 > User-Agent: curl/7.61.0 > Accept: */* > Warning: Binary output can mess up your terminal. Use "--output -" to tell Warning: curl to output it to your terminal anyway, or consider "--output Warning: <FILE>" to save to a file. * Failed writing body (0 != 7) * Closing connection 0 * TLSv1.2 (OUT), TLS alert, Client hello (1): $ I tried various curl flags - nothing works. In the meantime stunnel logs no errors Jul 9 16:16:45 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: Service [my12] accepted connection from 127.0.0.1:39165 Jul 9 16:16:45 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: s_connect: connected 10.240.28.69:7002 Jul 9 16:16:45 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: Service [my12] connected remote server from xxx.yyy.zzz.www:39166 Jul 9 16:17:10 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: Connection closed: 7 byte(s) sent to TLS, 116 byte(s) sent to socket What am i doing wrong!? Thanks in advance!

1 0

stunnel and rsyslog
by Yann RESCOURIO 28 Jun '21

28 Jun '21

Hello I use stunnel for rsyslog. And on the client equipment, I use also rsyslog queues for buffering in case of disconnection. But in case of reboot: * without stunnel, the buffered log messages are received on the rsyslog server * with stunnel, no buffered log messages are received on the rsyslog server On the client equipment, is it possible to refuse the local stunnel connections as long as the remote stunnel connection is down ? Regards Yann Rescourio

3 2

FIPS 140-2 & Ubuntu Pro
by Patrick Kaeding 23 Jun '21

23 Jun '21

Hi I am trying to set up stunnel with FIPS 140-2 compliance. I found some discussion of this on this mailing list from many years ago, but I'm not sure how much of that is still relevant today. I am running Ubuntu Pro 18.04, with FIPS mode (including the userspace modules: https://security-certs.docs.ubuntu.com/en/fips) If I simply `apt-get install stunnel4`, I can create a config with `fips = yes`, and when I start it up, I see this line logged: 2021.06.23 15:45:24 LOG5[ui]: FIPS mode enabled Does this mean I am all set, without needing to compile anything from source? In this message (from almost a decade ago), it sounds like this might be the validation I need: > BTW: "fips" option is only available when stunnel is built with FIPS support. FIPS mode is also clearly logged on startup https://www.stunnel.org/pipermail/stunnel-users/2012-November/003963.html Or do I need to build stunnel from scratch, using my local openssl distribution? Thanks! -- Patrick Kaeding pkaeding(a)launchdarkly.com

1 0

Number of tunnels open in Stunnel
by Moti Berger 21 Jun '21

21 Jun '21

Hi Is there a command I can run to get the current number of opened tunnels? I'm running Stunnel version 5.57. Thanks, Moti

1 0

Help needed for email client
by Ian Huysman 15 Jun '21

15 Jun '21

Hi, I just tried to configure stunnel as proxy between an email client (Outlook Express) and the email server (SMTP and IMAP). The problem is that the connection times out in the client while synchronising the IMAP folders. But I can send emails from the client. This is my relatively basic configuration: [SMTP] client = yes accept = 25 connect = smtp.office365.com:587 protocol = smtp [IMAP] client = yes accept = 143 connect = outlook.office365.com:993 protocol = imap Any help would be greatly appreciated! Regards, Ian.

3 2