- stunnel-users - stunnel.org

Academic doubt about firewall bypass
by Brent Kimberley 09 Jul '19

09 Jul '19

Which scenario did you have in mind? [HTTP CLIENT] -->[STUNNEL CLIENT]--><whatever>-->[STUNNEL SERVER]-->[HTTP Server] OR[HTTP Client] -->[Forward-proxy client]-> [STUNNEL CLIENT]--> <whatever>-->[STUNNEL SERVER]-->[REVERSE-PROXY server]--><whatever>--> [HTTP SERVER ] From: Hugo Marello <hugo.marello(a)gmail.com> To: stunnel-users(a)stunnel.org Hello guys, I'm new to using stunnel but I find it quite a powerful tool. I'm doing a POC on how we can bypass our firewall even with DPI, and chose to use stunnel for an extra layer of cryptography. You don't have to worry about access to any VM mentioned here. Here is my scenario: [CLIENT BROWSER] -->[STUNNEL CLIENT]-->[FIREWALL]-->[STUNNEL SERVER]-->[REVERSE PROXY]-->[FREE INTERNET] So far I succeeded in getting HTTP working using stunnel CONNECT protocol to the firewall and going all the way through. The problem is when I try to access HTTPS, the connection get set to the stunnel server but it keeps waiting for something. Double checked all the logs, firewall can't discern, stunnel server get the connection, reverse proxy also get the socket connection. My hypothesis is that stunnel client gets the CONNECT from the browser and discard it, it uses its own way to connect to the firewall, instead of encrypting the CONNECT all the way through. As it may seems, I need a way to send 2 CONNECT packages. Does anyone know how can I proceed? Follow my configs: client = yes output = /var/log/stunnel4/stunnel.log debug = 7 [bypassclient] accept = 4000 connect = firewall.example:3128 protocolHost = destination.com:443 protocol = connect requireCert = no verifyChain = no verifyPeer = no -------------------------------------------------------------------------------------------------------------------- [bypassserver] accept = 0.0.0.0:443 connect = reverseproxy.com:8888 cert = /etc/ssl/cert.pem key = /etc/ssl/key.pem ----------------------------------------------------------------------------------------------------------------------- Thank you all in advance, already digging throw the source code (quite lost tough), Hugo

1 1

Re: [stunnel-users] stunnel-users Digest, Vol 180, Issue 1
by Hugo Marello 09 Jul '19

09 Jul '19

I was thinking something more simple like the first scenario. [HTTP?CLIENT] -->[STUNNEL CLIENT]--><whatever>-->[STUNNEL SERVER]-->[HTTP Server] But the end would be an HTTPS server, which would require a CONNECT to get things going. So: [HTTP Client] -->[STUNNEL CLIENT]--> <whatever>-->[STUNNEL SERVER]-->[REVERSE-PROXY server]--> [HTTPS SERVER] Em ter, 9 de jul de 2019 às 07:00, <stunnel-users-request(a)stunnel.org> escreveu: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Academic doubt about firewall bypass (Brent Kimberley) > 2. How to turn off logging (David Yunker) > 3. Re: How to turn off logging (Thomas Eifert) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 8 Jul 2019 16:42:39 +0000 (UTC) > From: Brent Kimberley <brent_kimberley(a)rogers.com> > To: <stunnel-users(a)stunnel.org> > Cc: "hugo.marello(a)gmail.com" <hugo.marello(a)gmail.com> > Subject: [stunnel-users] Academic doubt about firewall bypass > Message-ID: <182803560.2815516.1562604159801(a)mail.yahoo.com> > Content-Type: text/plain; charset="utf-8" > > Which scenario did you have in mind? > [HTTP?CLIENT] -->[STUNNEL CLIENT]--><whatever>-->[STUNNEL SERVER]-->[HTTP > Server]?OR[HTTP Client] -->[Forward-proxy client]->?[STUNNEL CLIENT]--> > <whatever>-->[STUNNEL SERVER]-->[REVERSE-PROXY server]--><whatever>--> > [HTTP SERVER ] > > > > From: Hugo Marello <hugo.marello(a)gmail.com> > To: stunnel-users(a)stunnel.org > > Hello guys, > I'm new to using stunnel but I find it quite a powerful tool. I'm doing a > POC on how we can bypass our firewall even with DPI, and chose to use > stunnel for an extra layer of cryptography. You don't have to worry about > access to any VM mentioned here. Here is my scenario: > > [CLIENT BROWSER] -->[STUNNEL CLIENT]-->[FIREWALL]-->[STUNNEL > SERVER]-->[REVERSE PROXY]-->[FREE INTERNET] > > So far I succeeded in getting HTTP working using stunnel CONNECT protocol > to the firewall and going all the way through. The problem is when I try to > access HTTPS, the connection get set to the stunnel server but it keeps > waiting for something. Double checked all the logs, firewall can't discern, > stunnel server get the connection, reverse proxy also get the socket > connection. My hypothesis is that stunnel client gets the CONNECT from the > browser and discard it, it uses its own way to connect to the firewall, > instead of encrypting the CONNECT all the way through. As it may seems, I > need a way to send 2 CONNECT packages. Does anyone know how can I proceed? > > Follow my configs: > client = yes > output = /var/log/stunnel4/stunnel.log > debug = 7 > > [bypassclient] > accept = 4000 > connect = firewall.example:3128 > protocolHost = destination.com:443 > protocol = connect > requireCert = no > verifyChain = no > verifyPeer = no > > -------------------------------------------------------------------------------------------------------------------- > [bypassserver] > accept = 0.0.0.0:443 > connect = reverseproxy.com:8888 > cert = /etc/ssl/cert.pem > key = /etc/ssl/key.pem > > ----------------------------------------------------------------------------------------------------------------------- > > > Thank you all in advance, already digging throw the source code (quite lost > tough), > Hugo >

1 0

Re: [stunnel-users] Error during linking Stunnel 5.55
by Eric Eberhard 09 Jul '19

09 Jul '19

The whole 32 bit vs 64 bit thing is a pain. On Windows and Linux you have to load all kinds of unobvious things. On AIX it just works. Code from 1988 (when I lost source code for half a dozen programs) still works on current machines. Why the others make it SO HARD is beyond me. In AIX old code works. One flag – saying you want 64 bit – is all you need to add to the Makefile. Otherwise is just works as always. It took me MONTHS to figure out how to make Linuc work – had to yum 32 bit, 64 bit, a compat set, etc. Nightmare. Wish people would consider keeping things compatible like IBM does. Ditto on new features. Any new feature you merely need to add a flag, and all is good. Otherwise the old ones keep working. An example is POSIX. With IBM/AIX you could do things the old way, or set a flag for POSIX. Yes, we have had the same source (with updates, I did do the POSIX updates) since 1988. Never a problem. Partly, I think, because they don’t deprecate ANYTHING. Use the old routines if you like. Or not if you chose. Your problem is not having ALL of the required libraries! That is it. Finding what you need is the challenge. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Heinsbroek, Peter Sent: Tuesday, July 09, 2019 6:20 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Error during linking Stunnel 5.55 I tried to build stunnel from the sources. The compiling goes well ,but the linking gives an error When comping 32bit I get : sthreads.obj : error LNK2019: unresolved external symbol _CRYPTO_set_id_callback referenced in function _sthreads_init ..\bin\win32\stunnel.exe : fatal error LNK1120: 1 unresolved externals NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\VC\Tools\MSVC\14.16.27023\bin\HostX86\x86\link.EXE"' : return code '0x460' Stop. Anyone knows how to solve. Met vriendelijke groet, Peter Heinsbroek ICT Specialist – IDM TTS BTN/NL-TEC-Generic-Infra-S2 T: +31 (0) 88 265 9869 M: +31 (0) 6 53753244 Burg. Rijnderslaan 30 – Nederland <https://atos.net/> atos.net <https://www.linkedin.com/in/peter-heinsbroek-10467b52/> This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Re: [stunnel-users] How to turn off logging
by Eric Eberhard 09 Jul '19

09 Jul '19

Yes - just difficult :) We have our own logging in our application and we don't want stunnel's logging (or on screen error messages) to occur. We want them to go to our log files. So simply go to log.c and change the log_error() routines. I keep notes of any changes I make so that when I get new version I can repeat them. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of David Yunker Sent: Monday, July 08, 2019 2:47 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] How to turn off logging To whom it may concern, I would like to know if there is a way to disable logging or set a size limit or to have it overwrite the log file each time a new log is started? I am using the Windows version of Stunnel. Thank you for your help.

1 0

Error during linking Stunnel 5.55
by Heinsbroek, Peter 09 Jul '19

09 Jul '19

I tried to build stunnel from the sources. The compiling goes well ,but the linking gives an error When comping 32bit I get : sthreads.obj : error LNK2019: unresolved external symbol _CRYPTO_set_id_callback referenced in function _sthreads_init ..\bin\win32\stunnel.exe : fatal error LNK1120: 1 unresolved externals NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\VC\Tools\MSVC\14.16.27023\bin\HostX86\x86\link.EXE"' : return code '0x460' Stop. Anyone knows how to solve. Met vriendelijke groet, [Atos logo] Peter Heinsbroek ICT Specialist – IDM TTS BTN/NL-TEC-Generic-Infra-S2 T: +31 (0) 88 265 9869 M: +31 (0) 6 53753244 Burg. Rijnderslaan 30 – Nederland atos.net<https://atos.net/> [LinkedIn icon]<https://www.linkedin.com/in/peter-heinsbroek-10467b52/> This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

How to turn off logging
by David Yunker 08 Jul '19

08 Jul '19

To whom it may concern, I would like to know if there is a way to disable logging or set a size limit or to have it overwrite the log file each time a new log is started? I am using the Windows version of Stunnel. Thank you for your help.

2 1

Academic doubt about firewall bypass
by Hugo Marello 28 Jun '19

28 Jun '19

Hello guys, I'm new to using stunnel but I find it quite a powerful tool. I'm doing a POC on how we can bypass our firewall even with DPI, and chose to use stunnel for an extra layer of cryptography. You don't have to worry about access to any VM mentioned here. Here is my scenario: [CLIENT BROWSER] -->[STUNNEL CLIENT]-->[FIREWALL]-->[STUNNEL SERVER]-->[REVERSE PROXY]-->[FREE INTERNET] So far I succeeded in getting HTTP working using stunnel CONNECT protocol to the firewall and going all the way through. The problem is when I try to access HTTPS, the connection get set to the stunnel server but it keeps waiting for something. Double checked all the logs, firewall can't discern, stunnel server get the connection, reverse proxy also get the socket connection. My hypothesis is that stunnel client gets the CONNECT from the browser and discard it, it uses its own way to connect to the firewall, instead of encrypting the CONNECT all the way through. As it may seems, I need a way to send 2 CONNECT packages. Does anyone know how can I proceed? Follow my configs: client = yes output = /var/log/stunnel4/stunnel.log debug = 7 [bypassclient] accept = 4000 connect = firewall.example:3128 protocolHost = destination.com:443 protocol = connect requireCert = no verifyChain = no verifyPeer = no -------------------------------------------------------------------------------------------------------------------- [bypassserver] accept = 0.0.0.0:443 connect = reverseproxy.com:8888 cert = /etc/ssl/cert.pem key = /etc/ssl/key.pem ----------------------------------------------------------------------------------------------------------------------- Thank you all in advance, already digging throw the source code (quite lost tough), Hugo

1 0

SOLVED, I cannot get Outlook Express email to work after Cox changes
by Brent Kimberley 28 Jun '19

28 Jun '19

Thank you Brent, >> I found if I have Avast running with mail shield enabled I get this error in the Stunnel log window: >> SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol >> Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket. >> >> This results in no emails being abled to be sent by SMPT. >> >> If I disable Avast's mail shield the mail is sent with no errors. >> Is there a work around for to be able to use Stunnel without disabling Avast's mail shield? >> POP3 Connection >> CERT: Pre-verification error: self signed certificate in certificate chain >> Rejected by CERT at depth=1: OU=generated by Avast Antivirus for SSL/TLS scanning, O=Avast Web/Mail Shield, CN=Avast Web/Mail Shield Root >> SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed If you need avast, sign your stunnel leaf with a well known root CA, and exchange certificates accordingly. cox_mail : avast_dpi : stunnel_TLS_proxy : client https://support.postbox-inc.com/hc/en-us/articles/204602300-Invalid-Securit…

1 0

stunnel-users Digest, Vol 179, Issue 11
by David Yunker 28 Jun '19

28 Jun '19

Brent, Here is more log information that occurs when using Avast Mail shield. CERT: Pre-verification error: self signed certificate in certificate chain Rejected by CERT at depth=1: OU=generated by Avast Antivirus for SSL/TLS scanning, O=Avast Web/Mail Shield, CN=Avast Web/Mail Shield Root SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed This occurs in the POP3 connection. Hope this helps.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 179, Issue 11
by Brent Kimberley 28 Jun '19

28 Jun '19

>>Does anybody know how to prevent this from happening? Try adding the following: #verify the peer certificate chain starting from the root CA #pre-requisite #1: checkHost (OR checkIP) #pre-requisite #2: CAfile (OR CApath) verifyChain = yes checkHost = pop.cox.com #verify the peer certificate chain starting from the root CA #pre-requisite #1: checkHost (ORcheckIP) #pre-requisite #2: CAfile (OR CApath) verifyChain = yes checkHost = smtp.cox.net ref: https://www.stunnel.org/config_windows.html https://www.stunnel.org/static/stunnel.html From: David Yunker <davidyunker(a)hotmail.com> Subject: [stunnel-users] SOLVED, I cannot get Outlook Express email to work after Cox changes To anybody interested, Here is how to configure Stunnel for Outlook Express v6 in Windows XP to work: Modify Stunnel configuration to this: [cox-pop3] client = yes accept = 127.0.0.1:110 connect = pop.cox.net:995 CAfile = ca-certs.perm OCSPaia = yes [cox-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.cox.net:587 CAfile = ca-certs.perm OCSPaia = yes Now configure Outlook Express as follows: Set incoming mail(POP3) to 127.0.0.1 Set outgoing mail(SMTP) to 127.0.0.1 Have "Logon using secure password authentication" unchecked. Have "My server requires authentication" unchecked For POP3 set incoming mail (POP3) to port 110. For SMTP set outgoing mail (SMTP) to port 25. Have "This server requires a secure connection(SSL)" for POP3 unchecked. Have "This server requires a secure connection(SSL)" for SMTP unchecked. Everything works except I have the following error message in the Stunnel log: "Service [service name] needs authentication to prevent MITM attacks" Does anybody know how to prevent this from happening? I tried having the "My server requires authentication" checked but I still have the message when Stunnel starts. Thank you for any help.

2 1

openssl integration
by Brent Kimberley 27 Jun '19

27 Jun '19

Try the following: .\openssl engine -vvvv https://github.com/openssl/openssl/blob/OpenSSL_1_1_1-stable/README.ENGINE

2 1

Problem with pkcs11
by Heinsbroek, Peter 25 Jun '19

25 Jun '19

Hallo everybody. I’m running Stunnel 5.44 with pkcs11 on windows ,with the use of a HSM containing the private keys. That’s working fine. Now I want to upgrade to 5.55,so from 32 bit to 64 bit. I replaced the 32 bit cryptoki with a 64 bit cryptoki. But now it isn’t working. I looked with sysinternals ,and it seems the hsm login isn’t working. I also placed the 64bit ssleay32 & libeap32 in the windows\system32 folder. Did I forget something? If anyone can help ,it’s highly appreciated. Met vriendelijke groet, [Atos logo] Peter Heinsbroek ICT Specialist – IDM TTS BTN/NL-TEC-Generic-Infra-S2 T: +31 (0) 88 265 9869 M: +31 (0) 6 53753244 Burg. Rijnderslaan 30 – Nederland atos.net<https://atos.net/> [LinkedIn icon]<https://www.linkedin.com/in/peter-heinsbroek-10467b52/> This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

last version of stunnel that works on Windows XP
by David Yunker 25 Jun '19

25 Jun '19

What is the last version of stunnel that works on Windows XP? Thank you.

1 0

Latest Stunnel for Windows XP
by David Yunker 24 Jun '19

24 Jun '19

To whom it may concern, What was the last version of stunnel that worked on Windows XP? Thanks for the info.

2 1

SOLVED, I cannot get Outlook Express email to work after Cox changes
by David Yunker 22 Jun '19

22 Jun '19

To anybody interested, Here is how to configure Stunnel for Outlook Express v6 in Windows XP to work: Modify Stunnel configuration to this: [cox-pop3] client = yes accept = 127.0.0.1:110 connect = pop.cox.net:995 CAfile = ca-certs.perm OCSPaia = yes [cox-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.cox.net:587 CAfile = ca-certs.perm OCSPaia = yes Now configure Outlook Express as follows: Set incoming mail(POP3) to 127.0.0.1 Set outgoing mail(SMTP) to 127.0.0.1 Have "Logon using secure password authentication" unchecked. Have "My server requires authentication" unchecked For POP3 set incoming mail (POP3) to port 110. For SMTP set outgoing mail (SMTP) to port 25. Have "This server requires a secure connection(SSL)" for POP3 unchecked. Have "This server requires a secure connection(SSL)" for SMTP unchecked. Everything works except I have the following error message in the Stunnel log: "Service [service name] needs authentication to prevent MITM attacks" Does anybody know how to prevent this from happening? I tried having the "My server requires authentication" checked but I still have the message when Stunnel starts. Thank you for any help.

1 0

Help, I cannot get Outlook Express email to work after Cox changes
by David Yunker 21 Jun '19

21 Jun '19

To anybody who can help, I am currently using Stunnel version 5.24. I cannot update it to the latest version because I am using it on a Windows XP system. My problem is that I am currently using COX for my internet provider and COX recently change the email protocol from SSL to TSL. This is a problem since I am currently using Outlook Express v6 and it does not work with TSL. I recently discovered your Stunnel program and believe it will solve my problem. I tried changing the items in the configuration file to the following: fips = yes [cox-pop3] client = yes accept = 127.0.0.1:995 connect = pop.cox.net:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.cox.net OCSPaia = yes Stunnel shows no errors but my email still does not work. This is what happens when setting up the configuration for Outlook express: My POP account is pop.cox.net. My SMTP account is smtp.cox.net. If I set the POP port to 110 and leave the SMTP port to 25 and I have checked "logon using secure password authentication". But I do NOT have checked "this server requires a secure connection (SSL)". Then when I attempt to send/receive I get the following error: "Unable to logon to the server using secure password authentication account 'pop.cox.net server ...." If I do check "this server requires a secure connection (SSL)" and leave the POP port to 110 then when I attempt to send/receive I get the following error: "Your server has unexpectedly terminated the connection ..." If I change the POP port from 110 to 995 and remove the check mark for "this server require a secure connection (SSL)". Then when I attempt to send/receive I get a time out condition. If I check "this server requires a secure connection (SSL)" and attempt a send/receive I get this error: "Your server has unexpectedly terminated the connection.." No matter how I configure my Outlook Express I do not receive any email. I have a friend who has a Windows 7 system and a virtual windows xp installed in it that he uses for his email but is using Outlook in windows xp and this same configuration works fine for him. Except he has to have "verify = 2" removed from the configuration for Stunnel and his SMTP port is 587. For it to work. What am I doing wrong? Please help!

2 1

Re: [stunnel-users] stunnel client: accept on connect success
by Eric Eberhard 19 Jun '19

19 Jun '19

I'm a dummy so what I do is write a "wrapper" -- you connect to your wrapper and manage your problem. If all is good exec stunnel. If not send appropriate messages back. Dummy idea, Eric -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of mihertz(a)gmx.de Sent: Tuesday, June 18, 2019 11:19 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel client: accept on connect success Hi everyone, could use some help for a stunnel client-mode question. Found no corresponding config directives in the manpage, not sure i am searching with the correct terms... or going for the correct approach at all. So there is a scenario where the stunnel client plaintext side does the tcp-handshake (S/S./.) and directly terminates the connected client afterwards (R.). This is caused because the corresponding connect-target fails to establish a TCP/TLS connection with the server (rejected by target server for whatever reason). This could cause a first regular tcp-packet to be send and lost, before stunnel disconnects on the plaintext-side and the application becomes aware of that eventually. I wonder if there is a way to configure stunnel to behave in a similar way to haproxy /w acl? Where it denies all tcp connects unless at least 1 backend server is available. So that stunnel would like "delay" the accept-side TCP handshake while trying to connect to the connect-side via TLS. Based on TCP/TLS success/failure on the connect-side then continues the accept-side TCP handshake or quits its. This way the client would never have the short moment of "ok, i can start" I know that this behaviour is not optimal/desired with the majority of cases, just have the impression I have a use-case for this in my scenario. There is no way to modify the plaintext-side connected application in any way. Tx/Rx data is just a few bytes, so its always 1 packet for requests/answers. And relatively often that first packet sent goes out before the reset (R.) is received by the stunnel client-mode to the software connected on the accept-side. Would be happy for your input and ideas on how to work around that. Best Regards Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

stunnel client: accept on connect success
by mihertz＠gmx.de 19 Jun '19

19 Jun '19

Hi everyone, could use some help for a stunnel client-mode question. Found no corresponding config directives in the manpage, not sure i am searching with the correct terms... or going for the correct approach at all. So there is a scenario where the stunnel client plaintext side does the tcp-handshake (S/S./.) and directly terminates the connected client afterwards (R.). This is caused because the corresponding connect-target fails to establish a TCP/TLS connection with the server (rejected by target server for whatever reason). This could cause a first regular tcp-packet to be send and lost, before stunnel disconnects on the plaintext-side and the application becomes aware of that eventually. I wonder if there is a way to configure stunnel to behave in a similar way to haproxy /w acl? Where it denies all tcp connects unless at least 1 backend server is available. So that stunnel would like "delay" the accept-side TCP handshake while trying to connect to the connect-side via TLS. Based on TCP/TLS success/failure on the connect-side then continues the accept-side TCP handshake or quits its. This way the client would never have the short moment of "ok, i can start" I know that this behaviour is not optimal/desired with the majority of cases, just have the impression I have a use-case for this in my scenario. There is no way to modify the plaintext-side connected application in any way. Tx/Rx data is just a few bytes, so its always 1 packet for requests/answers. And relatively often that first packet sent goes out before the reset (R.) is received by the stunnel client-mode to the software connected on the accept-side. Would be happy for your input and ideas on how to work around that. Best Regards Michael

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 179, Issue 5
by Brent Kimberley 16 Jun '19

16 Jun '19

>> Is there something missing ? Can you please elaborate? https://www.stunnel.org/auth.html Subject: Using STunnel4 with both SSL/TLS proxy AND PSK authentication Hi, all. We've got a specific use case where we need to implement an stunnel4 'tunnel' in the following format: Client <---> client-side stunnel4 <---> server-side stunnel4 <---> server The specific case for this is because of a server that does NOT support SSL on the remote side nor client side, and we need to use two stunnel4 instances to establish the "secure" tunnel. We can get it working with straight SSL/TLS certificates for a secure connection between the two but can't seem to add authentication to this, we want to get the stunnel4 on the client side and the stunnel4 on the server side to have to have some kind of authentication/exchange between them. Whenever we add the PSK options or client certs to the thing, we immediately get SSL/TLS problems, as it doesn't seem to support SSL/TLS handshakes properly at that point. Is there something I'm missing within the STunnel4 documentation about establishing the SSL/TLS tunnel AND adding an authentication component, or is this not possible?? It doesn't currently seem possible based on my testing... Thomas

2 2

Stunnel 5.55 on Win 10 x64 GUI Mode
by Thomas Eifert 16 Jun '19

16 Jun '19

Tonight, I downloaded and installed Stunnel version 5.55 and installed it on Windows 10 x64 1903. If I run Stunnel as a service, everything works beautifully. No issues whatsoever. However, I just can't seem to get it to run in GUI mode. When I fire up the GUI, the configuration file loads fine with no errors. However, when attempting to establish any connection, the GUI simply crashes and the log file just terminates with nothing revealing: 2019.06.15 20:26:02 LOG7[main]: Service [ircs.3] accepted (FD=956) from 127.0.0.1:52874 2019.06.15 20:26:02 LOG7[main]: Creating a new thread 2019.06.15 20:26:02 LOG7[main]: New thread created 2019.06.15 20:26:02 LOG7[0]: Service [ircs.3] started 2019.06.15 20:26:02 LOG7[0]: Setting local socket options (FD=956) 2019.06.15 20:26:02 LOG7[0]: Option TCP_NODELAY set on local socket 2019.06.15 20:26:02 LOG5[0]: Service [ircs.3] accepted connection from 127.0.0.1:52874 2019.06.15 20:26:02 LOG6[0]: s_connect: connecting 154.35.138.250:6697 2019.06.15 20:26:02 LOG7[0]: s_connect: s_poll_wait 154.35.138.250:6697: waiting 10 seconds 2019.06.15 20:26:02 LOG7[0]: FD=1080 ifds=rwx ofds=--- (end of log) This is, of course, with the service stopped and de-installed. I've tried several remedies, including running Stunnel in compatibility modes, running it as an administrator, and I even tried to install it completely outside of the normal "program files (x86)" location. Also, the firewall is not the issue. Nothing seems to help. I can't figure out what on earth is occurring. Any insight/ideas would be appreciated. Thanks and regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 1

Using STunnel4 with both SSL/TLS proxy AND PSK authentication
by Thomas Ward 14 Jun '19

14 Jun '19

Hi, all. We've got a specific use case where we need to implement an stunnel4 'tunnel' in the following format: Client <---> client-side stunnel4 <---> server-side stunnel4 <---> server The specific case for this is because of a server that does NOT support SSL on the remote side nor client side, and we need to use two stunnel4 instances to establish the "secure" tunnel. We can get it working with straight SSL/TLS certificates for a secure connection between the two but can't seem to add authentication to this, we want to get the stunnel4 on the client side and the stunnel4 on the server side to have to have some kind of authentication/exchange between them. Whenever we add the PSK options or client certs to the thing, we immediately get SSL/TLS problems, as it doesn't seem to support SSL/TLS handshakes properly at that point. Is there something I'm missing within the STunnel4 documentation about establishing the SSL/TLS tunnel AND adding an authentication component, or is this not possible? It doesn't currently seem possible based on my testing... Thomas

1 0

HELP! SSLv3 to TLSv1.2
by Eric Eberhard 07 Jun '19

07 Jun '19

Everyone, It goes to show that even after having used stunnel forever there is more to learn. I have a weird problem. A remote site that has always used SSLv3 wants to use TLSv1.2 - normally that takes 5 seconds in the config file. However, the remote site supplied the software that sends to them . and does not supply a version we can use unless we upgrade O/S and JAVA and who knows what else for hundreds of customers. In four days. Normally stunnel takes in clear text and sends it out in whatever you like (TLSv1.2 in this case). And the reverse. Can it take in SSLv3 and convert to TLSv1.2? Of course conceptually this is easy and just a logical extension of stunnel - in practice, if not there, it would be a job. Which I might tackle - but I first wanted to get community input. And if anyone wants to get paid to do this for me, we can talk :) Thanks All, Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 Oh - help me out and please join this group. I need to get large numbers of members to take to the politicians. https://www.facebook.com/groups/286143052248115/ This might work to just join? <table border="0" width="100%" cellspacing="0" cellpadding="0" style="border-collapse:collapse;"><tr style=""><td height="28" style="line-height:28px;"> </td></tr><tr><td style=""><table border="0" width="280" cellspacing="0" cellpadding="0" style="border-collapse:separate;background-color:#ffffff;border:1px solid #dddfe2;border-radius:3px;font-family:Helvetica, Arial, sans-serif;margin:0px auto;"><tr style="padding-bottom: 8px;"><td style=""><img class="img" src="https://scontent.fhhr1-1.fna.fbcdn.net/v/t1.0-0/c0.0.584.305a/p320x320/ 50521766_10218655229077782_1167298564032823296_n.jpg?_nc_cat=101&_nc_ht= scontent.fhhr1-1.fna&oh=d725734d9126b706d402e635740dcd29&oe=5D00A5A4 " width="280" height="146" alt="" /></td></tr><tr><td style="font-size:14px;font-weight:bold;padding:8px 8px 0px 8px;text-align:center;">Save The Middle Verde</td></tr><tr><td style="color:#90949c;font-size:12px;font-weight:normal;text-align:center;">P ublic group . 228 members</td></tr><tr><td style="padding:8px 12px 12px 12px;"><table border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse;width:100%;"><tr><td style="background-color:#4267b2;border-radius:3px;text-align:center;"><a style="color:#3b5998;text-decoration:none;cursor:pointer;width:100%;" href="https://www.facebook.com/plugins/group/join/popup/?group_id=2861430522 48115&source=email_campaign_plugin" target="_blank" rel="noopener"><table border="0" cellspacing="0" cellpadding="3" align="center" style="border-collapse:collapse;"><tr><td style="border-bottom:3px solid #4267b2;border-top:3px solid #4267b2;color:#FFF;font-family:Helvetica, Arial, sans-serif;font-size:12px;font-weight:bold;">Join Group</td></tr></table></a></td></tr></table></td></tr><tr><td style="border-top:1px solid #dddfe2;font-size:12px;padding:8px 12px;">This group is to help preserve the Middle Verde River, the Middle Verde Character area as defined in the Town of Camp Verde's General Plan, the 260 co...</td></tr></table></td></tr><tr style=""><td height="28" style="line-height:28px;"> </td></tr></table>

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 179, Issue 1
by Larry Alba 03 Jun '19

03 Jun '19

Please Stop my subscription to the Stunnel list. Sent from Yahoo Mail on Android On Mon, Jun 3, 2019 at 3:00 AM, stunnel-users-request(a)stunnel.org<stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. latest stable version for Windows (Meike Stone) ---------------------------------------------------------------------- Message: 1 Date: Mon, 3 Jun 2019 11:07:33 +0200 From: Meike Stone <meike.stone(a)googlemail.com> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] latest stable version for Windows Message-ID: <CAFNHiA9=NRqkrBGjS+8sEbMjgQPYqvt4=XKuWxOz=pjYOw+FqA(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Hello dear list, I like to use stunnel under windows. I tried version stunnel-5.54 and it didn't work, it took a long time, until I've realized, that a bug was responsible for that. So two days after, I've seen the version 5.55b1, installed it and it works fine. But I don't see any comments in the change log on the website, in the mailing list "stunnel-announce", there was a note about that release, but now for the new release 5.55b12 not. What was changed there? I like to install a stable release on the server, so is there any recommendation which version I can or should use? Someone stated he will use version 5.49 until a new working version for windows is released .... Thanks Meike ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 179, Issue 1 *********************************************

1 0

latest stable version for Windows
by Meike Stone 03 Jun '19

03 Jun '19

Hello dear list, I like to use stunnel under windows. I tried version stunnel-5.54 and it didn't work, it took a long time, until I've realized, that a bug was responsible for that. So two days after, I've seen the version 5.55b1, installed it and it works fine. But I don't see any comments in the change log on the website, in the mailing list "stunnel-announce", there was a note about that release, but now for the new release 5.55b12 not. What was changed there? I like to install a stable release on the server, so is there any recommendation which version I can or should use? Someone stated he will use version 5.49 until a new working version for windows is released .... Thanks Meike

2 1

Re: [stunnel-users] RE stunnel process owner
by Eric Eberhard 30 May '19

30 May '19

We use it solely on 100s of our customer’s Unix computers. My suggestion (that not everyone agrees with) is to run it under inetd. Unix does not function without inetd (or related like xinetd). You don’t have to start or manage a server. It is dead reliable and when processes die it cleans it up and so forth. You connect to localhost on some port, have a configuration that directs it to the right place, off to the races. I am not sure what you mean by container hardening. When connecting to localhost it never touches the network – the TCP/IP goes directly to the TCP/IP stack on the local machine. I am really sure I don’t know what check out is :) If you give me more info I can probably be of more use. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Brent Kimberley Sent: Wednesday, May 29, 2019 11:53 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] RE stunnel process owner Hi Dan. >>Wondering what user people are running the stunnel process under on a unix server? Any suggestions re container hardening & check-out (a la SCAP)?

2 3

Re: [stunnel-users] stunnel process owner
by Daniel Trickett 29 May '19

29 May '19

I'm not running on a Windows server. We are running on unix servers. Get Outlook for Android<https://aka.ms/ghei36> ________________________________ From: Mario Ricciardi <spam(a)ocode.net> Sent: Wednesday, May 29, 2019 4:59:14 PM To: Daniel Trickett; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel process owner This runs on a Windows server. The inbound email process needs a win based jde server Sent from my Verizon, Samsung Galaxy smartphone -------- Original message -------- From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> Date: 5/29/19 11:58 AM (GMT-07:00) To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel process owner Hi, Wondering what user people are running the stunnel process under on a unix server? Best regards, Dan

1 1

stunnel process owner
by Daniel Trickett 29 May '19

29 May '19

Hi, Wondering what user people are running the stunnel process under on a unix server? Best regards, Dan

2 1

RE stunnel process owner
by Brent Kimberley 29 May '19

29 May '19

Hi Dan. >>Wondering what user people are running the stunnel process under on a unix server?Any suggestions re container hardening & check-out (a la SCAP)?

1 0

Questions/comments about the 64-bit installer.
by Thomas Eifert 25 May '19

25 May '19

I just upgraded to Windows 10 pro x64. I attempted to install Stunnel version 5.55b1. I made a couple of basic observations that I'd like to pass along. 1. The installer attempts to install Stunnel in the windows "Program Files (x86) directory. I thought Stunnel is now a 64-bit program. As such, why does it attempt to install in that directory? 2. The new version of Stunnel doesn't seem to want to run under Windows 10. If I attempt to run it as an app, the program terminates when I attempt to establish a connection and pass traffic through it. Running it as a service, it passes a few dozen bytes of traffic, then stalls. Changing compatibility modes had little effect. 3. Stunnel version 5.49 runs beautifully under Win 10. I'll continue to use it until i find a newer version that works. Has anyone else had similar experience trying to use Stunnel under Win 10? If so, I'd like to know if you were able to resolve these issues. Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

Re: [stunnel-users] stunnel 5.54 on x64-pc-mingw32-gnu platform
by Brent Kimberley 24 May '19

24 May '19

>> Stunnel v5.54 (local) halts during tunnel setup with stunnel v4.56 (remote) FYI. stunnel-5.55b1-win64-installer.exe does not halt during tunnel setup. Thanks! <Snip><Snip>[ ] Running on Windows 6.2[ ] No limit detected for the number of clients[.] stunnel 5.55 on x64-pc-mingw32-gnu platform[.] Compiled/running with OpenSSL 1.1.1b 26 Feb 2019[.] Reading configuration from file ...[.] UTF-8 byte order mark detected..[ ] Initializing service [..][ ] Ciphers: ..[ ] TLSv1.3 ...[ ] TLS options: ..[ ] Loading certificate from file: [ ] Certificate loaded from file: [ ] Loading private key from file: [ ] Private key loaded from file: [ ] Private key check succeeded[.] Configuration successful[ ] Binding service [ ] Listening file descriptor created [ ] Setting accept socket options [ ] Service bound to 2019.05.23 20:26:54 LOG6[cron]: Executing cron jobs2019.05.23 20:26:54 LOG6[cron]: Cron jobs completed in 0 seconds2019.05.23 20:27:09 LOG5[0]: Service accepted connection from 2019.05.23 20:27:09 LOG6[0]: s_connect: connecting 2019.05.23 20:27:09 LOG6[0]: CERT: 2019.05.23 20:27:09 LOG6[0]: CERT: 2019.05.23 20:27:09 LOG5[0]: Certificate accepted at 2019.05.23 20:27:09 LOG6[0]: Session id: 2019.05.23 20:27:09 LOG6[0]: TLS connected: new session negotiated2019.05.23 20:27:09 LOG6[0]: TLSv1.2 ciphersuite: 2019.05.23 20:27:16 LOG6[0]: Read socket closed 2019.05.23 20:27:16 LOG6[0]: SSL_shutdown successfully sent close_notify alert2019.05.23 20:27:16 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing2019.05.23 20:27:16 LOG5[0]: Connection closed: </Snip> On Friday, May 17, 2019, 9:18:41 a.m. EDT, Brent Kimberley <brent_kimberley(a)rogers.com> wrote: Hi.Stunnel v5.54 (local) halts during tunnel setup with stunnel v4.56 (remote) whereas stunnel v5.53 (local) successfully establishes tunnels with stunnel v4.56 (remote). Debug 7 (local) doesn't detect any issues. Does remote 4.56 need to be upgraded? Does local 5.54 need to be patched? Best Regards,BK v5.54 x v4.56[local]s_connect: s_poll_wait <someip>:443: waiting 10 secondshalt...[remote]2019.05.17 08:47:34 LOG5[13009:140578290554624]: Service [httpsx] accepted connection from 2019.05.17 08:52:35 LOG6[13009:140578290554624]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2019.05.17 08:52:35 LOG5[13009:140578290554624]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket v5.53 x v4.56[local] 2019.05.17 08:57:18 LOG7[0]: s_connect: s_poll_wait <someip>:443: waiting 10 seconds2019.05.17 08:57:18 LOG5[0]: s_connect: connected <someip>:443...[remote]2019.05.17 09:11:10 LOG5[13009:140578290333440]: Service [httpsx] accepted connection from 2019.05.17 09:11:10 LOG5[13009:140578290333440]: Certificate accepted: depth=....

1 0

Re: [stunnel-users] Connection never completes
by Joe Fitzgerald 22 May '19

22 May '19

I am observing the same behavior Mario is seeing with STunnel 5.54 on Windows Server 2012 R2 running as a client. In my case I am upgrading the client side from STunnel 5.01. The client and server connected without difficulty when both were at STunnel 5.01. >From the STunnel v 5.54 client log: 2019.05.22 16:58:19 LOG7[main]: Found 1 ready file descriptor(s) 2019.05.22 16:58:19 LOG7[main]: FD=332 ifds=r-x ofds=--- 2019.05.22 16:58:19 LOG7[main]: FD=352 ifds=r-x ofds=--- 2019.05.22 16:58:19 LOG7[main]: Service [EchoClient] accepted (FD=440) from 127.0.0.1:62387 2019.05.22 16:58:19 LOG7[main]: Creating a new thread 2019.05.22 16:58:19 LOG7[main]: New thread created 2019.05.22 16:58:19 LOG7[0]: Service [EchoClient] started 2019.05.22 16:58:19 LOG7[0]: Setting local socket options (FD=440) 2019.05.22 16:58:19 LOG7[0]: Option TCP_NODELAY set on local socket 2019.05.22 16:58:19 LOG5[0]: Service [EchoClient] accepted connection from 127.0.0.1:62387 2019.05.22 16:58:19 LOG6[0]: s_connect: connecting 192.168.128.162:40007 2019.05.22 16:58:19 LOG7[0]: s_connect: s_poll_wait 192.168.128.162:40007: waiting 10 seconds >From the STunnel v 5.01 server log: 2019.05.22 16:58:19 LOG7[5072]: Service [EchoServer] accepted (FD=572) from 192.168.128.104:62388 2019.05.22 16:58:19 LOG7[5072]: Creating a new thread 2019.05.22 16:58:19 LOG7[5072]: New thread created 2019.05.22 16:58:19 LOG7[3724]: Service [EchoServer] started 2019.05.22 16:58:19 LOG5[3724]: Service [EchoServer] accepted connection from 192.168.128.104:62388 2019.05.22 16:58:19 LOG7[3724]: SSL state (accept): before/accept initialization

1 1

Connection never completes
by Mario Ricciardi 22 May '19

22 May '19

I have Stunnel on two computers, both Win10 version 5.54. One works flawlessly on my home network, but the second will not complete the connection to POP3 Office365 on the work network. It gets to s_connect and freezes: 2019.05.21 22:50:19 LOG7[main]: Found 1 ready file descriptor(s) 2019.05.21 22:50:19 LOG7[main]: FD=220 ifds=r-x ofds=--- 2019.05.21 22:50:19 LOG7[main]: Service [POP3 Incoming] accepted (FD=780) from 127.0.0.1:51378 2019.05.21 22:50:19 LOG7[main]: Creating a new thread 2019.05.21 22:50:19 LOG7[main]: New thread created 2019.05.21 22:50:19 LOG7[2]: Service [POP3 Incoming] started 2019.05.21 22:50:19 LOG7[2]: Setting local socket options (FD=780) 2019.05.21 22:50:19 LOG7[2]: Option TCP_NODELAY set on local socket 2019.05.21 22:50:19 LOG5[2]: Service [POP3 Incoming] accepted connection from 127.0.0.1:51378 2019.05.21 22:50:19 LOG6[2]: failover: priority, starting at entry #0 2019.05.21 22:50:19 LOG6[2]: s_connect: connecting 52.96.24.210:995 2019.05.21 22:50:19 LOG7[2]: s_connect: s_poll_wait 52.96.24.210:995: waiting 10 seconds The sessions stay active, but this is as far as they get. I start stunnel GUI and attempt to connect to the active port and the above behavior is what I get. Using OpenSSL I can connect just fine, so there doesn't appear to be a firewall issue: +OK The Microsoft Exchange POP3 service is ready. [WQBRAFgAUABSADAAMQBDAEEAMAAwA DgANgAuAEMAQQBOAFAAUgBEADAAMQAuAFAAUgBPAEQALgBPAFUAVABMAE8ATwBLAC4AQwBPAE0A] user LoadAccept(a)example.com +OK pass LAxxxxxx +OK User successfully logged on. list +OK 4 356828 1 70284 2 70415 3 108104 4 108025 The stunnel config is super simple: ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ;Microsoft Outlook [POP3 Incoming] client = yes accept = 127.0.0.1:110 connect = outlook.office365.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = outlook.office365.com OCSPaia = yes I won't bother showing the log for the working machine, but it has the same config. I'm really hoping there is simply something missing from the Windows install. A coworker has the same problem on their fresh company provided Win10 install. My functioning Win10 pc is my personal machine. Thanks, Mario --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

hostapd & stunnel
by Johannes Eckhardt 20 May '19

20 May '19

Hi, I'm running stunnel 5.39 on a Raspberry Pi with Raspbian 9 (stretch). The Pi has two network interfaces (eth0, wlan0) and I'm running an access point with hostapd. What I want to do is to route all traffic from my wifi-clients (connected via wlan0) through stunnel/socks. working iptables configuration to access the internet from eth0/wlan0: iptables -A FORWARD -i eth0 -o wlan0 -m state --state \ RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT iptables -P OUTPUT ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; if add the following lines (from stunnel.org) local traffic on eth0 goes to the stunnel-server but my wireless clients can't access the internet anymore. I tried several configurations, but without success... # stunnel socks iptables -t nat -A OUTPUT -p tcp -d TARGET-SERVER --dport 9080 -j ACCEPT iptables -t nat -A OUTPUT -o lo -j ACCEPT iptables -t nat -A OUTPUT -p tcp --dport 9050 -j ACCEPT iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-ports 9051 iptables -t nat -A PREROUTING -p tcp --dport 9050 -j ACCEPT iptables -t nat -A PREROUTING -p tcp -j REDIRECT --to-ports 9051 # /etc/stunnel/stunnel.conf [SOCKS Client Direct] client = yes PSKsecrets = secrets.txt accept = :::9050 connect = TARGET-SERVER:9080 [SOCKS Client Transparent IPv4] client = yes PSKsecrets = secrets.txt accept = 127.0.0.1:9051 connect = TARGET-SERVER:9080 protocol = socks Has anyone a solution for that? Best regards, Johannes

1 0

Version 5.54 'make check' fails test 042_inetd
by James Brown 20 May '19

20 May '19

Sorry, posted with incorrect subject. > On 20 May 2019, at 3:29 pm, James Brown <jlbrown(a)bordo.com.au <mailto:[email protected]>> wrote: > > Having problems installing version 5.54 on macOS X with this configure command: > > ./configure --with-ssl=/usr/local/Cellar/openssl(a)1.1/1.1.1b > > Configure runs OK, as does make. > > But ‘make check’ ends with: > > $ make check > Making check in src > make[1]: Nothing to be done for `check'. > Making check in doc > make[1]: Nothing to be done for `check'. > Making check in tools > make[1]: Nothing to be done for `check'. > Making check in tests > Making check in certs > /Library/Developer/CommandLineTools/usr/bin/make check-local > ./maketestcert.sh > keys & certificates successfully generated > ./maketestcert.sh finished > /Library/Developer/CommandLineTools/usr/bin/make check-local > ./make_test > Mon 20 May 2019 15:21:58 AEST > stunnel 5.54 on x86_64-apple-darwin18.5.0 platform > Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 > Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI > > test 010_require_cert ok > test 011_verify_peer ok > test 012_verify_chain ok > test 013_CRL_file ok > test 014_PSK_secrets ok > test 015_p12_cert ok > test 020_IPv6 skipped > test 021_FIPS skipped > test 022_bind ok > test 030_simple_execute ok > test 031_redirect ok > test 032_no_redirect ok > test 033_redirect_exec ok > test 034_no_redirect_exec ok > test 035_SNI ok > test 036_no_SNI ok > test 037_failover_prio1 ok > test 038_failover_prio2 ok > test 039_failover_rr ok > test 040_reload ok > test 041_exec_connect ok > test 042_inetd failed > error logs logs/042_inetd.log > test 043_session_delay ok > test 044_session_nodelay ok > test 045_include ok > test 046_resume_PSK ok > test 047_resume_redirect ok > test 048_resume_noredirect ok > test 050_ticket_secrets ok > test 110_failure_require_cert ok > test 111_failure_verify_peer ok > test 112_failure_verify_chain ok > test 113_failure_CRL_file ok > test 114_failure_PSK_secrets ok > test 115_failure_wrong_config ok > summary: success 32, skip 2, fail 1 > ./make_test finished > make[3]: *** [check-local] Error 1 > make[2]: *** [check-am] Error 2 > make[1]: *** [check-recursive] Error 1 > make: *** [check-recursive] Error 1 > > How can I fix this 042_ inetd failure? > > Also, why did it skip the IPv6 test? > > Thanks, > > James. > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:[email protected]> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 2

5.54 fails - TLS directory not found
by James Brown 20 May '19

20 May '19

Having problems installing version 5.54 on macOS X with this configure command: ./configure --with-ssl=/usr/local/Cellar/openssl(a)1.1/1.1.1b Configure runs OK, as does make. But ‘make check’ ends with: $ make check Making check in src make[1]: Nothing to be done for `check'. Making check in doc make[1]: Nothing to be done for `check'. Making check in tools make[1]: Nothing to be done for `check'. Making check in tests Making check in certs /Library/Developer/CommandLineTools/usr/bin/make check-local ./maketestcert.sh keys & certificates successfully generated ./maketestcert.sh finished /Library/Developer/CommandLineTools/usr/bin/make check-local ./make_test Mon 20 May 2019 15:21:58 AEST stunnel 5.54 on x86_64-apple-darwin18.5.0 platform Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI test 010_require_cert ok test 011_verify_peer ok test 012_verify_chain ok test 013_CRL_file ok test 014_PSK_secrets ok test 015_p12_cert ok test 020_IPv6 skipped test 021_FIPS skipped test 022_bind ok test 030_simple_execute ok test 031_redirect ok test 032_no_redirect ok test 033_redirect_exec ok test 034_no_redirect_exec ok test 035_SNI ok test 036_no_SNI ok test 037_failover_prio1 ok test 038_failover_prio2 ok test 039_failover_rr ok test 040_reload ok test 041_exec_connect ok test 042_inetd failed error logs logs/042_inetd.log test 043_session_delay ok test 044_session_nodelay ok test 045_include ok test 046_resume_PSK ok test 047_resume_redirect ok test 048_resume_noredirect ok test 050_ticket_secrets ok test 110_failure_require_cert ok test 111_failure_verify_peer ok test 112_failure_verify_chain ok test 113_failure_CRL_file ok test 114_failure_PSK_secrets ok test 115_failure_wrong_config ok summary: success 32, skip 2, fail 1 ./make_test finished make[3]: *** [check-local] Error 1 make[2]: *** [check-am] Error 2 make[1]: *** [check-recursive] Error 1 make: *** [check-recursive] Error 1 How can I fix this 042_ inetd failure? Also, why did it skip the IPv6 test? Thanks, James.

1 0

stunnel 5.54 on x64-pc-mingw32-gnu platform vs 5.53
by Brent Kimberley 17 May '19

17 May '19

Hi.Stunnel v5.54 (local) halts during tunnel setup with stunnel v4.56 (remote) whereas stunnel v5.53 (local) successfully establishes tunnels with stunnel v4.56 (remote). Debug 7 (local) doesn't detect any issues. Does remote 4.56 need to be upgraded? Does local 5.54 need to be patched? Best Regards,BK v5.54 x v4.56[local]s_connect: s_poll_wait <someip>:443: waiting 10 secondshalt...[remote]2019.05.17 08:47:34 LOG5[13009:140578290554624]: Service [httpsx] accepted connection from 2019.05.17 08:52:35 LOG6[13009:140578290554624]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2019.05.17 08:52:35 LOG5[13009:140578290554624]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket v5.53 x v4.56[local] 2019.05.17 08:57:18 LOG7[0]: s_connect: s_poll_wait <someip>:443: waiting 10 seconds2019.05.17 08:57:18 LOG5[0]: s_connect: connected <someip>:443...[remote]2019.05.17 09:11:10 LOG5[13009:140578290333440]: Service [httpsx] accepted connection from 2019.05.17 09:11:10 LOG5[13009:140578290333440]: Certificate accepted: depth=....

1 0

Connection refused, then connects
by James Brown 17 May '19

17 May '19

Can anyone tell me why It tries ::1:25 first and fails before connecting to 127.0.0.1:25? 2019.05.17 13:48:34 LOG5[21]: Service [ssmtp465] accepted connection from ::ffff:192.168.1.76:49170 2019.05.17 13:48:34 LOG3[21]: s_connect: connect ::1:25: Connection refused (61) 2019.05.17 13:48:34 LOG5[21]: s_connect: connected 127.0.0.1:25 2019.05.17 13:48:34 LOG5[21]: Service [ssmtp465] connected remote server from 127.0.0.1:56701 /usr/local/etc/stunnel/stunnel.conf has: [ssmtp465] client = no accept = 465 connect = 25 options = NO_SSLv2 #transparent = source [ssmtp587] client = no accept = 587 connect = 127.0.0.1:25 options = NO_SSLv2 #transparent = source Not sure if this is relevant, but when I startup I get: 2019.05.17 12:45:27 LOG5[ui]: stunnel 5.53 on x86_64-apple-darwin18.5.0 platform 2019.05.17 12:45:27 LOG5[ui]: Compiled/running with OpenSSL 1.0.2r 26 Feb 2019 2019.05.17 12:45:27 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.17 12:45:27 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2019.05.17 12:45:27 LOG5[ui]: UTF-8 byte order mark detected 2019.05.17 12:45:27 LOG5[ui]: FIPS mode disabled 2019.05.17 12:45:27 LOG4[ui]: Insecure file permissions on /usr/local/etc/dovecot/mail.bordo.com.au.pem 2019.05.17 12:45:27 LOG4[ui]: Insecure file permissions on /usr/local/etc/dovecot/mail.bordo.com.au.pem 2019.05.17 12:45:27 LOG5[ui]: Configuration successful 2019.05.17 12:45:27 LOG5[ui]: Binding service [ssmtp465] to 0.0.0.0:465: Address already in use (48) 2019.05.17 12:45:27 LOG5[ui]: Binding service [ssmtp587] to 0.0.0.0:587: Address already in use (48) No idea what is already using those ports. Any suggestions? macOS 10.14.4 Thanks, James.

3 3

stunnel 5.54 released
by Michal Trojnara 15 May '19

15 May '19

Dear Users, I have released version 5.54 of stunnel. Version 5.54, 2019.05.15, urgency: LOW * New features - New "ticketKeySecret" and "ticketMacSecret" options to control confidentiality and integrity protection of the issued session tickets. These options allow for session resumption on other nodes in a cluster. - Added logging the list of active connections on SIGUSR2 or with Windows GUI. - Logging of the assigned bind address instead of the requested bind address. * Bugfixes - Service threads are terminated before OpenSSL cleanup to prevent occasional stunnel crashes at shutdown. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 5e8588a6c274b46b1d63e1b50f0725f4908dec736f6588eb48d1eb3d20c87902 stunnel-5.54.tar.gz ed8424731f7d6e0c9b11f4c7b597a072e558dae7979102d0b213759678079481 stunnel-5.54-win64-installer.exe 7659f605065e5155577a99abe1129dbc89523796196c8bf50d3fa9265ec34d93 stunnel-5.54-android.zip Best regards, Mike

1 0

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Eric Eberhard 15 May '19

15 May '19

Killing anything will change the PID. If the PID needs to be constant a zombie is bad news! Zombies stink! E -----Original Message----- From: Jochen Bern [mailto:[email protected]] Sent: Wednesday, May 15, 2019 1:42 AM To: stunnel-users(a)stunnel.org Cc: Florian Lohoff <f(a)zz.de>; Eric Eberhard <flash(a)vicsmba.com> Subject: Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug? On 05/15/2019 12:22 AM, Florian Lohoff wrote: > On Tue, May 14, 2019 at 11:30:29AM -0700, Eric Eberhard wrote: >> That is not a bad idea. I'd wrap it in a C program so I could check >> if the pppd is alive and not a zombie. > > pppd is a pretty solid piece of software. Never seen it hang as a > zombie. A zombie process is *terminated* and, basically, just a remaining entry in the kernel's process table. It's not hanging around because of something its own code did wrong, but because its parent process fails to "reap" its child (first and foremost, collect its exit code from the kernel). Killing the parent cleans up zombies because the zombies get re-parented to the init / systemd process (PID 1), which then does the reaping. Regards, -- Jochen Bern Systemingenieur

1 0

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Jochen Bern 15 May '19

15 May '19

On 05/15/2019 12:22 AM, Florian Lohoff wrote: > On Tue, May 14, 2019 at 11:30:29AM -0700, Eric Eberhard wrote: >> That is not a bad idea. I'd wrap it in a C program so I could check >> if the pppd is alive and not a zombie. > > pppd is a pretty solid piece of software. Never seen it hang as a > zombie. A zombie process is *terminated* and, basically, just a remaining entry in the kernel's process table. It's not hanging around because of something its own code did wrong, but because its parent process fails to "reap" its child (first and foremost, collect its exit code from the kernel). Killing the parent cleans up zombies because the zombies get re-parented to the init / systemd process (PID 1), which then does the reaping. Regards, -- Jochen Bern Systemingenieur

1 0

Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date?
by Eric Eberhard 14 May '19

14 May '19

Use openssl to make a private cert? E -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Christopher Schultz Sent: Monday, May 13, 2019 2:28 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? All, Does anyone know if it is possible to perform all other verification of a client certificate EXCEPT allow the certificate to have expired? We have a vendor whose certificate has expired, and we want to allow their old certificate to work while they chase their tails trying to figure out the best way to re-issue a new cert for us. *eyeroll* Is it possible? Thanks, -chris

2 1

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Eric Eberhard 14 May '19

14 May '19

Yes. Use inetd (or equivalent). Making an independent server work is difficult due to the problems like you are having. Inetd is in many O/S included and essential, others available. It always works. Always. Yes, there is a tiny amount of overhead for making connections. On an ancient AIX IBM I manage 2-4 million XML documents exchanged per day with no problems, all with inetd. Try it – save yourself some misery. Or maybe it won’t help at all except to add information :) E From: stunnel-users [mailto:[email protected]] On Behalf Of Martin Got Sent: Monday, May 13, 2019 9:08 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug? I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below. Stunnel client --connect--> Stunnel server pppd client --connect--> pppd server 10.0.1.2 <--data--> 10.0.1.1 OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started. So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection. Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this? Any suggestions highly appreciated. # ps -axu | grep pppd user 43231 0.0 0.0 476 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) user 39187 0.0 0.0 468 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) # tail -n 10 /var/log/daemon pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[43231] Using interface ppp1 pppd[43231] Connect: ppp0 <--> /dev/ttyp2 pppd[43231] Local IP address 10.0.1.1 pppd[43231] Remote IP address 10.0.1.2 pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[39187] Using interface ppp0 pppd[39187] Connect: ppp0 <--> /dev/ttyp5 pppd[39187] Couldn't set interface address: Address 10.0.1.1 or destination 10.0.1.2 already exists Stunnel configurations for server and client: 1. Server's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;socket = l:SO_LINGER=1:60 ; Session cache sessionCacheSize = 100 sessionCacheTimeout = 600 stack = 65536 TIMEOUTbusy = 600 TIMEOUTconnect = 10 TIMEOUTidle = 43200 TIMEOUTclose = 5 [ppp] accept = LOCAL-IP:PORT exec = /usr/sbin/pppd execargs = lock 10.0.1.1:10.0.1.2 local debug noauth ;execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth pty = yes CAfile = ca.crt cert = server.crt key = server.key verifyChain = yes 2. Stunnel client's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Session cache sessionCacheSize = 1 sessionCacheTimeout = 600 failover = rr [ppp] client = yes retry = yes connect = REMOTE-IP:PORT exec = /usr/sbin/pppd execargs = defaultroute persist lock passive 10.0.1.2:10.0.1.1 local debug noauth name ppp-client pty = yes CAfile = ca.crt cert = client.crt key = client.key verifyChain = yes checkHost = REMOTE-HOSTNAME ;checkIP = 1.2.3.4

2 1

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Eric Eberhard 13 May '19

13 May '19

Sounds good. The inetd will handle the dropping of connections just fine ... but the below sounds like it would help even more. E -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Peter Pentchev Sent: Monday, May 13, 2019 2:16 PM To: Martin Got <martingot(a)protonmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug? On Mon, May 13, 2019 at 04:07:57PM +0000, Martin Got wrote: > I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below. > > Stunnel client --connect--> Stunnel server > pppd client --connect--> pppd server > 10.0.1.2 <--data--> 10.0.1.1 > > OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started. > > So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection. > > Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this? Unfortunately, stunnel was not designed for your use case; it was designed to allow many different clients to make use of different instances of the same server program, one instance per client. You might try to do something else: if you really only have a single PPP client and you can really guarantee that anything that connects to stunnel must reuse the same connection, you could write a separate program that listens on a TCP port or on a local Unix socket, waits for the first connection, starts an instance of pppd, and then, from that point on, sends all the traffic from this instance to all the connections that it has received, even if a new connection appears before the old one has been torn down. Then you can point stunnel to the local Unix socket of that service, and anything that connects to stunnel will establish a new connection to your service, but it will not matter, since your service will be written in such a way as to send all the traffic to all the connections. So the service should do something like: 1. Create a local Unix socket and start listening on it. 2. Wait for the first connection. 3. Start an instance of pppd (at most one instance shall be running at any point in time) 4. Keep waiting for new connections; accept any and treat them all in the same way. 5. If any data comes from a remote connection, send it to pppd. 6. If any data comes from pppd, send it to *all* the remote connections. 7. If any of the remote connections is closed, well, so be it, good riddance, another one will come along presently (or maybe another one has already come along and has started talking to pppd through this service). 8. If the pppd child process dies, close all the remote connections and go back to step 2. Then you shall only have a problem if there are two "real" connections from different places at the same time - but if I understand your setup correctly, this should not really happen, since it is only you (your laptop or something like that) that connects to the PPP server. If you want, I could try to whip up some simple implementation of such a pseudo-multiplexer. G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Possible to verify client certificate BUT ignore expiration-date?
by Christopher Schultz 13 May '19

13 May '19

All, Does anyone know if it is possible to perform all other verification of a client certificate EXCEPT allow the certificate to have expired? We have a vendor whose certificate has expired, and we want to allow their old certificate to work while they chase their tails trying to figure out the best way to re-issue a new cert for us. *eyeroll* Is it possible? Thanks, -chris

1 0

Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Martin Got 13 May '19

13 May '19

I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below. Stunnel client --connect--> Stunnel server pppd client --connect--> pppd server 10.0.1.2 <--data--> 10.0.1.1 OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started. So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection. Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this? Any suggestions highly appreciated. # ps -axu | grep pppd user 43231 0.0 0.0 476 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) user 39187 0.0 0.0 468 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) # tail -n 10 /var/log/daemon pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[43231] Using interface ppp1 pppd[43231] Connect: ppp0 <--> /dev/ttyp2 pppd[43231] Local IP address 10.0.1.1 pppd[43231] Remote IP address 10.0.1.2 pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[39187] Using interface ppp0 pppd[39187] Connect: ppp0 <--> /dev/ttyp5 pppd[39187] Couldn't set interface address: Address 10.0.1.1 or destination 10.0.1.2 already exists Stunnel configurations for server and client: 1. Server's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;socket = l:SO_LINGER=1:60 ; Session cache sessionCacheSize = 100 sessionCacheTimeout = 600 stack = 65536 TIMEOUTbusy = 600 TIMEOUTconnect = 10 TIMEOUTidle = 43200 TIMEOUTclose = 5 [ppp] accept = LOCAL-IP:PORT exec = /usr/sbin/pppd execargs = lock 10.0.1.1:10.0.1.2 local debug noauth ;execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth pty = yes CAfile = ca.crt cert = server.crt key = server.key verifyChain = yes 2. Stunnel client's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Session cache sessionCacheSize = 1 sessionCacheTimeout = 600 failover = rr [ppp] client = yes retry = yes connect = REMOTE-IP:PORT exec = /usr/sbin/pppd execargs = defaultroute persist lock passive 10.0.1.2:10.0.1.1 local debug noauth name ppp-client pty = yes CAfile = ca.crt cert = client.crt key = client.key verifyChain = yes checkHost = REMOTE-HOSTNAME ;checkIP = 1.2.3.4

2 1

Stunnel for O365 Sending Some Reports but not Others
by David Schmidt 10 May '19

10 May '19

Hello, We needed to reconfigure Stunnel for the SAP Business Objects server that sent email reports from G Suite over to a configuration that sends from an O365 account. The problem is that some of the reports work fine after the reconfiguration, while others always fail and I can't find out why and nothing has changed other than the mail settings. Microsoft doesn't even see the failed reports hitting their servers but when I look at Stunnel it seems like the TLS connection is being established correctly and I can see the connection being established from our firewall logs. I've attached the current O365 config as well as the old GSuite conifg, as well as logs of the debug output I see when I run a report that succeeds versus a report that fails. Can anyone give me an idea as to why Stunnel seems to be working to send out some reports but not others? Thank you, David Schmidt | Administrateur TI / IT Administrator | MTYGroup.com<http://mtygroup.com/> T+1 514-336-8885 Ext 8236 | C+1 514-708-7299 | 8210, route Transcanadienne, St. Laurent, QC, H4S 1M5 [http://mtygroup.com/signature/gif/use_this_left.gif]<http://mtygroup.com> [http://mtygroup.com/signature/gif/use_this_right.gif] <http://mtygroup.com> AVERTISSEMENT CONCERNANT LA CONFIDENTIALIT? / WARNING CONCERNING CONFIDENTIALITY Ce message peut contenir des informations confidentielles, privil?gi?es, et seulement pour ses destinataires. Si vous avez re?u ce message par erreur, veuillez en informer imm?diatement l'exp?diteur par retour de courriel et supprimer cette communication de votre syst?me. This email message may contain information that is confidential, privileged, and for communication only to its intended recipient or recipients. If you have received this message in error, please immediately notify the sender and delete the original message without making a copy.

1 0

Problem with stunnel 5.51
by Carter Browne 08 May '19

08 May '19

I received the following error trying to connect to a Windows host using RDP. I use stunnel as a connection point with secure messages coming in and then forwarded as secure messages going the desired end point. Stunnel is running on all three systems, the originator, the relay, and the destination. I have been using stunnel in this role for many years. As an additional point, 5.51 did work properly in the same role for secure telnet. The part of the log showing the failure is below. Thanks, Carter Before 2019.05.03 15:44:02 LOG5[ui]: stunnel 5.50 on armv7l-unknown-linux-gnueabihf platform 2019.05.03 15:44:02 LOG5[ui]: Compiled with OpenSSL 1.1.1a 20 Nov 2018 2019.05.03 15:44:02 LOG5[ui]: Running with OpenSSL 1.1.1b 26 Feb 2019 2019.05.03 15:44:02 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.03 15:44:02 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2019.05.03 15:44:02 LOG5[ui]: UTF-8 byte order mark not detected 2019.05.03 15:44:02 LOG5[ui]: FIPS mode disabled 2019.05.03 15:44:52 LOG5[ui]: Configuration successful 2019.05.03 15:44:52 LOG5[ui]: Switched to chroot directory: /var/run/stunnel/ ... 2019.05.08 08:26:08 LOG5[980]: Service [c13alt-rdp] accepted connection from 192.168.179.22:63218 2019.05.08 08:26:09 LOG5[980]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-39, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 08:26:09 LOG5[981]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49180 2019.05.08 08:26:09 LOG5[980]: s_connect: connected 127.0.1.127:3389 2019.05.08 08:26:09 LOG5[981]: s_connect: connected 10.251.129.118:8001 2019.05.08 08:26:09 LOG5[981]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44796 2019.05.08 08:26:09 LOG5[980]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49180 2019.05.08 08:26:09 LOG5[981]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-13.cbcsnet.local, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 08:26:23 LOG5[980]: Connection closed: 1615 byte(s) sent to TLS, 1061 byte(s) sent to socket 2019.05.08 08:26:23 LOG5[981]: Connection closed: 1061 byte(s) sent to TLS, 1615 byte(s) sent to socket 2019.05.08 08:26:23 LOG5[982]: Service [c13alt-rdp] accepted connection from 192.168.179.22:63243 2019.05.08 08:26:23 LOG5[983]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49184 2019.05.08 08:26:23 LOG5[982]: s_connect: connected 127.0.1.127:3389 2019.05.08 08:26:23 LOG5[982]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49184 2019.05.08 08:26:23 LOG5[983]: s_connect: connected 10.251.129.118:8001 2019.05.08 08:26:23 LOG5[983]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44800 After 2019.05.08 12:50:18 LOG5[ui]: stunnel 5.51 on armv7l-unknown-linux-gnueabihf platform 2019.05.08 12:50:18 LOG5[ui]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 2019.05.08 12:50:18 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.08 12:50:18 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2019.05.08 12:50:18 LOG5[ui]: UTF-8 byte order mark not detected 2019.05.08 12:50:18 LOG5[ui]: FIPS mode disabled 2019.05.08 12:50:42 LOG5[ui]: Configuration successful 2019.05.08 12:51:01 LOG5[2]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64139 2019.05.08 12:51:02 LOG5[2]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-39, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 12:51:02 LOG5[3]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49330 2019.05.08 12:51:02 LOG5[2]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:51:02 LOG5[2]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49330 2019.05.08 12:51:02 LOG5[3]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:51:02 LOG5[3]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44946 2019.05.08 12:51:02 LOG5[3]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-13.cbcsnet.local, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 12:51:15 LOG5[2]: Connection closed: 1615 byte(s) sent to TLS, 1061 byte(s) sent to socket 2019.05.08 12:51:15 LOG5[3]: Connection closed: 1061 byte(s) sent to TLS, 1615 byte(s) sent to socket 2019.05.08 12:51:15 LOG5[4]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64141 2019.05.08 12:51:15 LOG5[5]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49334 2019.05.08 12:51:15 LOG5[4]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:51:15 LOG5[4]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49334 2019.05.08 12:51:15 LOG5[5]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:51:15 LOG5[5]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44950 2019.05.08 12:51:18 LOG3[4]: transfer() loop executes not transferring any data 2019.05.08 12:51:18 LOG3[4]: please report the problem to Michal.Trojnara(a)stunnel.org 2019.05.08 12:51:18 LOG3[4]: stunnel 5.51 on armv7l-unknown-linux-gnueabihf platform 2019.05.08 12:51:18 LOG3[4]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 2019.05.08 12:51:18 LOG3[4]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.08 12:51:18 LOG3[4]: protocol=TLSv1.2, SSL_pending=0 2019.05.08 12:51:18 LOG3[4]: sock_open_rd=Y, sock_open_wr=Y 2019.05.08 12:51:18 LOG3[4]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2019.05.08 12:51:18 LOG3[4]: sock_can_rd=n, sock_can_wr=n 2019.05.08 12:51:18 LOG3[4]: ssl_can_rd=n, ssl_can_wr=n 2019.05.08 12:51:18 LOG3[4]: read_wants_read=Y, read_wants_write=n 2019.05.08 12:51:18 LOG3[4]: write_wants_read=n, write_wants_write=n 2019.05.08 12:51:18 LOG3[4]: shutdown_wants_read=n, shutdown_wants_write=n 2019.05.08 12:51:18 LOG3[4]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) 2019.05.08 12:51:18 LOG5[4]: Connection reset: 2786 byte(s) sent to TLS, 5077 byte(s) sent to socket 2019.05.08 12:51:18 LOG5[5]: Connection closed: 5077 byte(s) sent to TLS, 2989 byte(s) sent to socket 2019.05.08 12:52:03 LOG5[6]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64144 2019.05.08 12:52:03 LOG5[6]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:52:03 LOG5[6]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49340 2019.05.08 12:52:03 LOG5[7]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49340 2019.05.08 12:52:03 LOG5[7]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:52:03 LOG5[7]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44956 2019.05.08 12:52:14 LOG5[6]: Connection closed: 1615 byte(s) sent to TLS, 1061 byte(s) sent to socket 2019.05.08 12:52:14 LOG5[7]: Connection closed: 1061 byte(s) sent to TLS, 1615 byte(s) sent to socket 2019.05.08 12:52:14 LOG5[8]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64147 2019.05.08 12:52:14 LOG5[9]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49344 2019.05.08 12:52:14 LOG5[9]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:52:14 LOG5[9]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44960 2019.05.08 12:52:14 LOG5[8]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:52:14 LOG5[8]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49344 2019.05.08 12:52:16 LOG3[8]: transfer() loop executes not transferring any data 2019.05.08 12:52:16 LOG3[8]: please report the problem to Michal.Trojnara(a)stunnel.org

2 2

Automatic stunnel-client reconnect and keep initial session
by Martin Got 01 May '19

01 May '19

Which commands to stunnel can perform keeping session ID in case of stunnel-client reconnection? Do I add commands to both stunnel-client and stunnel-server to keep the initial session?

1 0

Keep initial session-ID when stunnel-client reconnect to a stunnel-server
by Martin Got 01 May '19

01 May '19

Trying to establish link using pppd connection overlapped into stunnel 5.44. Server runs on OpenBSD 6.4, client uses the same stunnel and OS versions. From the client's side I have to reconnect to stunnel-server in case of Internet link is dropped. And expecting that pppd session is kept by stunnel over reconnections possible. But stunnel-server runs another pppd instance when stunnel-client reconnects. After reconnection in system processes I see two pppd processes (as shows below), and pppd link has no pings after it. # ps -aux | grep pppd user 45359 0.0 0.0 440 1672 ?? I Tue11PM 0:00.01 lock passive 10.0.1.1:10.0.1.2 local debug noauth (pppd) user 1156 0.0 0.0 321 1210 ?? I Tue12PM 0:00.01 lock passive 10.0.1.1:10.0.1.2 local debug noauth (pppd) 1. The question is how to keep initial session established by stunnel-client and do not run second pppd process by stunnel-server? 2. May I keep session by cache-ID on the client's side only or do I need to do it on both client and server? Can it help not to run another pppd process? Both server config and client config parts are below: # cat /etc/stunnel/stunnel-server.conf ... [ppp] ;SERVER accept 1.2.3.4:443 exec = /usr/sbin/pppd execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth pty = yes CAfile = ca.crt cert = server.crt key = server.key verifyChain = yes TIMEOUTclose = 0 ... # cat /etc/stunnel/stunnel-client.conf ... [ppp] ;CLIENT client = yes retry = yes connect = 1.2.3.4:443 exec = /usr/sbin/pppd execargs = persist lock 10.0.1.2:10.0.1.1 local debug noauth name ppp-client pty = yes CAfile = ca.crt cert = client.crt key = client.key verifyChain = yes checkHost = hostname ;checkIP = 1.2.3.4 ... Thank you for answer in advance.

1 0

Re: [stunnel-users] illegal instruction crash 5.50 Debian/Stretch
by Michal Trojnara 29 Apr '19

29 Apr '19

On 24.04.2019 16:06, Florian Lohoff wrote: > with the stunnel4 in Debian/Stretch i am experiencing pretty regular > crashes with illegal instruction. Version is 5.50. > In Bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=880659 > you can see the drill down to a Lock beeing unlocked although > not locked. When i look at the code its some usage of openssl > primitives. (Unlock happens in openssl code) > I had a quick look at the changelog and this: > "Service threads are terminated before OpenSSL cleanup to prevent occasional stunnel crashes at shutdown." > sounds a bit like the issue i am experiencing. > Can you confirm this? Yes, I do confirm this is the issue described in the Debian bug #880659. It wasn't a simple coding error, but rather a design flaw introduced in version 3.0 that took 20 years to identify and fix. Before version 5.18, released almost 4 years ago, the shutdown race condition mostly manifested itself while terminating stunnel under extremely heavy load, such as stress testing. The probability has increased with the introduction of periodic DH parameter regeneration in version 5.18. I didn't test it, but I suspect some changes in the OpenSSL internals may have also cause the crashes to only surface fairly recently, and not 20 years ago. The fix itself involves a major redesign of the stunnel threading subsystem, so I made a beta version and I'd appreciate your help with testing it: https://www.stunnel.org/downloads/beta/stunnel-5.54b2.tar.gz Best regards, Mike

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users