- stunnel-users - stunnel.org

using a socks5 with user/name authentication
by Alberto P 21 Apr '24

21 Apr '24

Hello, I have a vpn service that provides a socks5 proxy using user/pass authentication. Using stunnel would allow me to use the service with other clients that allow for a socks5 proxy but normally no authentication. Could anybody tell me 1) is what I'd like feasible ? 2)How do I provide user/pass to the configuration file ? Your help would be very appreciated ! alberto

1 0

Wondering if process to create the g2.pem file is available?
by Michael D. Setzer II 19 Apr '24

19 Apr '24

Was wondering if the process to create the g2.pem file you shared is available. It does work with changes to the stunnel.conf file for both the smtp1.guam.net and mail.guam.net [guampop] client=yes accept = 127.0.0.1:20996 connect = mail.guam.net:995 debug = 7 verifyChain = yes CApath = /etc/ssl/certs CAfile = /etc/stunnel/g2.pem checkHost = mail.guam.net OCSPaia = yes [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 debug = 7 verifyChain = yes CApath = /etc/ssl/certs CAfile = /etc/stunnel/g2.pem checkHost = smtp1.guam.net OCSPaia = yes Not sure the the g2.pem would work for all time, or has an expiration date. Thanks. +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:[email protected] mailto:[email protected] mailto:[email protected] Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

1 0

Having strange issue with newer kernels? 6.8.
by Michael D. Setzer II 19 Apr '24

19 Apr '24

3 2

unknow TCP service 11702
by tomoyalin＠yahoo.co.jp 18 Apr '24

18 Apr '24

how to solve problem from stunnel config file when using port is not 80 or 443. ( our config tcp service port is 11702)

2 1

Having strange issue with newer kernels? 6.8.
by Michael D. Setzer II 18 Apr '24

18 Apr '24

Having issues with stunnel not working with this settings that have work with previous kernels? [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 connect = smtp1.guam.net:465 debug = 7 verifyChain = yes CApath = /etc/ssl/certs checkHost = mail.guam.net OCSPaia = yes But now changing to [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 connect = smtp1.guam.net:465 debug = 7 Seems to work. systemctl status stunnel. stunnel.service - TLS tunnel for network daemons Loaded: loaded (/usr/lib/systemd/system/stunnel.service; enabled; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: active (running) since Thu 2024-04-18 14:48:15 ChST; 5s ago Process: 15349 ExecStart=/usr/bin/stunnel (code=exited, status=0/SUCCESS) Main PID: 15352 (stunnel) Tasks: 3 (limit: 18938) Memory: 3.6M CPU: 1.618s CGroup: /system.slice/stunnel.service └─15352 /usr/bin/stunnel Apr 18 14:48:14 setzconote.dyndns.org systemd[1]: Starting stunnel.service - TLS tunnel for network daemons... Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: stunnel 5.72 on x86_64-redhat-linux-gnu platform Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,> Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.co> Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: UTF-8 byte order mark not detected Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: FIPS mode disabled Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Configuration successful Apr 18 14:48:15 setzconote.dyndns.org systemd[1]: Started stunnel.service - TLS tunnel for network daemons. Using the longer one gives this after attempting to sent smtp. stunnel.service - TLS tunnel for network daemons Loaded: loaded (/usr/lib/systemd/system/stunnel.service; enabled; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: active (running) since Thu 2024-04-18 14:57:22 ChST; 1min 15s ago Process: 15616 ExecStart=/usr/bin/stunnel (code=exited, status=0/SUCCESS) Main PID: 15619 (stunnel) Tasks: 3 (limit: 18938) Memory: 4.0M CPU: 1.639s CGroup: /system.slice/stunnel.service └─15619 /usr/bin/stunnel Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG4[3]: CERT: Pre-verification error: unable to get local issuer> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG4[3]: Rejected by CERT at depth=0: CN=*.guam.net Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: TLS alert (write): fatal: unknown CA Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG3[3]: SSL_connect: ssl/statem/statem_clnt.c:1889: error:0A0000> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG5[3]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Deallocating application specific data for session conne> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Remote descriptor (FD=16) closed Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: local_rfd/local_wfd reset (FD=3) Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Local descriptor (FD=3) closed Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Service [guamsmtp] finished (0 left) lines 1-23/23 (END) Was using the Fedora stunnel the is 5.71, but downloaded the latest 5.72, but seem to get same results. Had some issues with nvidia drives that work fine with 6.7.11 kernels, but fail with the 6.8.x drivers, so not sure if it is linked to that? +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:[email protected] mailto:[email protected] mailto:[email protected] Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

1 0

stunnel doesn't allow two client certificates with the same Subject DN?
by Christopher Schultz 16 Apr '24

16 Apr '24

Hello, I was recently rotating a certificate for a service and I went through my usual procedure: 1. Generate a new client key+cert; don't place them into service, yet 2. Distribute the new certificate to all my stunnel servers that need to trust it by placing it at the end of each of my servers' CAFile files 3. Restart all stunnel services 4. Swap the old key+cert for the client with the new key+cert 5. Test that all is well I've found that if the Distinguished Name of both the old and new certificate are the same, stunnel will only trust the one that is mentioned /first/ in the CAFile. For example, if the CAFile contains: -----BEGIN CERTIFICATE----- certificate A Serial Number: 12345678 Subject: C=US, OU=Testing, O=Example.com, CN=test -----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE----- certificate B Serial Number: 87654321 Subject: C=US, OU=Testing, O=Example.com, CN=test -----BEGIN CERTIFICATE----- Certificate A will be trusted but Certificate B will not be trusted. The error shown in the logs is: CERT: Pre-verification error: self signed certificate Apr 15 21:33:06 mirth-pcc.chadis.com stunnel[23421]: Certificate check failed: depth=0, /C=US/OU=Testing/O=Example.com/CN=test While the certificates are both self-signed, that should not cause an error. Removing the old certificate from the CAFile or moving it to the bottom of the file resolves the problem. (But of course then Certificate A is no longer trusted despite it appearing in the CAFile.) Is this expected behavior? It would be very helpful if stunnel could support two different certificates with the same Subject DN for these kinds of cert-rotation processes. The alternatives are to always use a new DN each time or to add/remove at the same time which makes rolling-back more difficult. Note that everything else about these certificates is different: serial number, fingerprint, generating-key, etc. It's only the Subject DN that is the same. This is stunnel 4.56 on x86_64-koji-linux-gnu platform, on Amazon Linux 2. Thanks! -chris

2 1

HELO handshake problem (?)
by Ducale Ducale 10 Apr '24

10 Apr '24

In a Windows 10 machine I'm using a tool (Netwrix Service Monitor) with a SMTP notification feature that doesn't support authentication, so I'm using Stunnel 5.72 as a local relay for SMTP2GO (smtp2go.com) with this configuration: [smtp2go] client = yes accept = 127.0.0.1:25 connect = mail.smtp2go.com:2525 protocol = smtp protocolAuthentication = plain protocolHost = cloud.mydomain.com protocolUsername = smtp2go(a)mydomain.com protocolPassword = P@ssw0rd debug = 7 I try both PLAIN and LOGIN as authentication mode, with this is error: LOGIN: " ... TLS connected: new session negotiated TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) Peer temporary key: X25519, 253 bits Compression: null, expansion: null -> HELO cloud.mydomain.com <- 250 mail.smtp2go.com Hello cloud.mydomain.com [x.x.x.x] -> AUTH LOGIN <- 503 AUTH command used when not advertised Remote server does not support LOGIN authentication ... " PLAIN: " ... TLS connected: new session negotiated TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) Peer temporary key: X25519, 253 bits Compression: null, expansion: null -> HELO cloud.mydomain.com <- 250 mail.smtp2go.com Hello cloud.mydomain.com [x.x.x.x] -> AUTH PLAIN ******************************************** <- 503 AUTH command used when not advertised PLAIN Authentication Failed Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Deallocating application specific data for session connect address ... " Can anyone help me solve this problem? Thanks!

3 3

help configuration for socks5 nordvpn requiring authentication
by Alberto P 10 Apr '24

10 Apr '24

Hello, I would like to use stunnel to use a socks5 server requiring user/pass authentication (nordvpn) with different clients that allow for a socks5 proxy but no authentication. Could someone help me with the configuration (linux or windows is good). In detail, I don't know how to provide user/pass to the configuration, and if it is actually feasible. Any help will be very appreciated !

1 1

Stunnel - Silent switch to change the install directory
by Meena Prabhakaran 27 Mar '24

27 Mar '24

Hi Team, We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. For more details, please have a look at Autonomous Patching for Every Third-Party Windows App (adaptiva.com) (https://adaptiva.com/products/autonomous-patch) We are willing to add the latest stable version of Stunnel product to our catalogue. Downloaded https://www.stunnel.org/downloads/stunnel-5.72-win64-installer.exe We are testing this app on Windows 10 64Bit VM. Please help us on below points: 1. Is there any switch/parameter which can be passed along with "stunnel-5.72-win64-installer.exe" for changing the "Install directory" silently? Tried these switches - /D, /DIR, /APPDIR, /INSTALLDIR, /TARGETDIR, /INSTALLLOCATION Thanks & Regards, Meena Prabhakaran Application Packager, Adaptiva M +91 9080759487 meena.prabhakaran(a)adaptiva.com<mailto:[email protected]> www.adaptiva.com<http://www.adaptiva.com/> Data Protection and Privacy: Your privacy is important to us. We are committed to protecting your personal information and handling it responsibly. For more information on how we process and protect your data, please review our Privacy Policy (https://adaptiva.com/privacy) Confidentiality Notice: Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of Adaptiva. The recipient should check for the presence of viruses, as Adaptiva accepts no liability for any virus transmitted by this email.

3 3

Received trusted client CA list not found
by allmail 16 Mar '24

16 Mar '24

I see this message in the Stunnel (client) logs during SSL handshake with the server The server requires a client certificate which has been configured in the stunnel configuration. The handshake is working fine but I was wondering what exactly does this line mean. From what I found so far, seems like there is a way for the server to specify which CA's it will accept for the client certificate and it can specify them in the ClientCertificate request that it sends This server doesnt send anything like that, so I am guessing that is the reason for this log line? Can someone please confirm? Btw, I see this line only when using TLSv1.3. When I restrict the client to TLSv1.2, I dont see this line. thanks LOG Peer certificate required TLS state (connect): before SSL initialization Initializing application specific data for session authenticated TLS state (connect): SSLv3/TLS write client hello TLS state (connect): SSLv3/TLS write client hello TLS state (connect): SSLv3/TLS read server hello TLS state (connect): TLSv1.3 read encrypted extensions Received trusted client CA list not found TLS state (connect): SSLv3/TLS read server certificate request

1 0