- stunnel-users - stunnel.org

Log File Not Appending
by K Monz 06 Oct '15

06 Oct '15

Hi, I am a new STUNNEL user, so I apologize if this is a ridiculously simple and insignificant problem. I have STUNNEL running in a Windows 7 (32 bit) environment, and have the following in stunnel.conf: output = C:\STUNNEL\stunnel.log log = append The log file is placed where I've asked, but the contents represent only the most current STUNNEL execution. I am trying to have a running log in this file. STUNNEL is, of course, doing what it is supposed to do, it is only the logging that has me puzzled. Thanks, in advance.

2 1

Error on Windows 2008r2
by Chris 01 Oct '15

01 Oct '15

Just downloaded and installed the latest windows version. When trying to run stunnel I get the following error: The application has failed to start because its side-by-side configuration is incorrect..... When I check the application event view logs I see "Activation context generation failed for "C:\Program Files (x86)\stunnel\bin\stunnel.exe". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found. Please use sxstrace.exe for detailed diagnosis." It seems I might be missing a pre-req but I can't not determine what that is. Any ideas? Thanks, Chris

1 0

Support for DTLS
by Kanungo, Rajesh 25 Sep '15

25 Sep '15

Hi, I am looking for support for a DTLS proxy. Does Stunnel support DTLS and, if yes, how do I configure it? Here is the scenario: 1. Remote Server supports DTLS. 2. My client does not support DTLS (yet). Support all our platforms is a pretty arduous task. Possible solutions: 1. Ask customer to use Stunnel, drop DTLS and use plain UDP, and use Stunnel/TCP. Other clients support only DTLS so this does not work. 2. Use VPN. Requires customer configuration. Less painful than 1. 3. Use a UDP-DTLS proxy. Regards Rajesh Kanungo North America Security CTO Department, Itron, Inc. (408) 431-3035 Rajesh.kanungo(a)itron.com

1 0

Missing pid from log file since ~5.19
by Philippe Anctil 17 Sep '15

17 Sep '15

Hi, After upgrading to stunnel 5.19 I noticed the log file no long reports the pid of stunnel processes. Instead I find the constant string [0]. Sep 14 12:15:30 hostname stunnel: LOG6[0]: SSL closed (SSL_read) This information is very useful to isolate individual connections. Do later stunnel versions report the pid correctly? I am using fork mode. My syslog is defined as local6.debug and stunnel.conf contains debug=local6.info. Thank you. -- Philippe Anctil

2 3

How to install CA at client side?
by MingHeng Wang 15 Sep '15

15 Sep '15

Hello Stunnel maintainers, I try to use real certificates of my web server for stunnel. I combine private key, my site's cert, and ca-bundle into a pem file, and it works fine when the client doesn't verify any certificate. Then I specify CAfile which is the ca bundle file from my registrar, at client side and turn on verification and always get errors below, whatever level 2 or 3: Sep 15 14:53:28 y400 stunnel[11666]: LOG5[11]: Service [http-proxy3] connected remote server from 192.168.1.104:45746 Sep 15 14:53:28 y400 stunnel[11666]: LOG4[11]: CERT: Pre-verification error: unable to get issuer certificate Sep 15 14:53:28 y400 stunnel[11666]: LOG4[11]: Rejected by CERT at depth=2: However, level 4 works. I want to prevent man-in-middle-attack, so can level 4 achieve that regarding to my current setup? Both server and client side use stunnel 5.17 which are fairly recent.

2 1

Windows 2012 R2 Error on startup
by Han-Earl Guhm 13 Sep '15

13 Sep '15

I installed the latest version of stunnel and am having problems starting it up. I have attached an error log and my config file. I tested on Windows 7 and it worked with no problems, but I would really like it to work on my Windows 2012 server. Thank you, Han-Earl Guhm Coventry Christian Schools hanguhm(a)educatingforlife.com

2 1

The Error with Engine
by Donne, Ann 08 Sep '15

08 Sep '15

Hi all, Need your help. When I configured the Stunnel without the Engine LunaCA3 (product from SafeNet), everything worked fine. After add the global option with the engine: engine=LunaCA3 engineCtrl=SO_PATH:/usr/local/ssl/lib/engines/liblunaca3.so I got the following error. I also searched previous engine issues and saw someone else with the similar issues. Hope that the issue was resolved. The Stunnel and the open SSL info: stunnel 5.20 on x86_64 Linux. Compiled/running with OpenSSL 1.0.1i-fips. The setting is for server with sslVersion = TLSv1 and ciphers = AES128-SHA. 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read client certificate A 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A 2015.09.08 11:11:01 LOG7[0]: SSL alert (write): fatal: bad record mac 2015.09.08 11:11:01 LOG3[0]: SSL_accept: 1408F119: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2015.09.08 11:11:01 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.09.08 11:11:01 LOG7[0]: Deallocating application specific data for addr index 2015.09.08 11:11:01 LOG7[0]: Local socket (FD=3) closed Any help and info are greatly appreciated!! Thanks Ann Donne ---------------------------------------------------------------------- This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer. If you are not the intended recipient, please delete this message.

1 0

stunnel 5.23 released
by Michal Trojnara 02 Sep '15

02 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.23 of stunnel. The ChangeLog entry: Version 5.23, 2015.09.02, urgency: LOW * New features - Client-side support for the SOCKS protocol. See https://www.stunnel.org/socksvpn.html for details. - Reject SOCKS requests to connect loopback addresses. - New service-level option "OCSPnonce". The default value is "OCSPnonce = no". - Win32 directory structure rearranged. The installer script provides automatic migration for common setups. - Added Win32 installer option to install stunnel for the current user only. This feature does not deploy the NT service, but it also does not require aministrative privileges to install and configure stunnel. - stunnel.cnf was renamed to openssl.cnf in order to to prevent users from mixing it up with stunnel.conf. - Win32 desktop is automatically refreshed when the icon is created or removed. - The ca-certs.pem file is now updated on stunnel upgrade. - Inactive ports were removed from the PORTS file. - Added IPv6 support to the transparent proxy code. * Bugfixes - Compilation fix for OpenSSL version older than 1.0.0. - Compilation fix for mingw. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0fc4a702afd2e857bae8ad1f39c51546eb282c3d0ff4f4d55d62aece7328ddea stunnel-5.23.tar.gz 40739ac4124bbe5192d7f68b020758295586ae65a16c1612829bffd1d3873363 stunnel-5.23-installer.exe 001e7d0a6d53b05b64fe62b0ca0623077d89f090b473e2cabed1eafa49196725 stunnel-5.23-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJV5q76AAoJEC78f/DUFuAUG54P/2ycqSOKbP3CN1MMKJj9NxBM 1uDuv/voF9OT/Y064X2bjy6dApo5HA9a4VHr1EaF+3x+Wofemhc5puLsgbfuFJKl nogN8cNdR2sk+GLooytfKp+jRZ8NAl2Rv5lLi/YE57RsMe91wI5kRxWKpeIDeG4L y7LhsCLmHNYkffsGSeOaXfc3rBBWOY39Lc78t3kezK14jIGZiCH/V32HRHMaWGiw 9oLBIRxGOVAscKcC2+MOGtXelKeJFrnAfW+v6qcZE1/SL4JnGHz8jBxOcvFbfrko 5yJfWYpgQg7NeLNovY+o1EXVxxw4Ty9ppLob9cRTGmx1Fgb6eE1uYVSAbx53lYKF 2z0J2MkKgMj07Mao5j45DiqRqa/kWDzKIN4sTCm5atDKB2ozrcfuDLLEU3W6XKrw 7XHPSs+FdkXQXYsfK7wbftLKfNEu8ojGKyMTMuKQcX/SkxyQuV6rYXA8gBm3HJCY dNp5lU5FdoiMv9S+uQpDL2j9GjOSNAV7qPzyRk8ivl1a1LonkbjQxHApvktSwkHt Gey6xweW5vt7FsKb15mFhx6ctBldM9lR7u4EacXWy+hq5UY6/5Rr/rbyCkCvG/NU Oq5LD2bqX22Xl4XeiVCW2gpLcqPWdbREY3YklGt22ln+PdyA+iGpxbeczUHjV5qX a6P76JpGk/pL5lhWfRV4 =i2gK -----END PGP SIGNATURE-----

1 0

(no subject)
by Eric Poythress 02 Sep '15

02 Sep '15

I am having some issues with getting Stunnel to work for my application. I'm using a logger that is able to email out alarms but it is not encrypted. I have Stunnel on the PC that connects to the logger. Both are able to see each other just fine but I have the following error in the log: Service [SMTP Outgoing] needs authentication to prevent MITM attacks I only want mail to go out and on the logger side of things my only inputs are SMTP Server, Use SMTP Authentication check box, Username, Password and Port. Any help or suggests would be greatly appreciated. Thank you, Eric Poythress Test Manager 1600 West Tacoma Street Broken Arrow, Oklahoma 74012 [Description: Air Hygiene Office - email signature] Direct - (918) 994-4171 Fax - (918) 307-9131 Mobile - (573) 587-0226 Toll Free - (888) 461-8778 virtual tour Air Hygiene: http://host.newspin360.net/airhygiene/ e-mail: epoythress(a)airhygiene.com<mailto:[email protected]> website: www.airhygiene.com<http://www.airhygiene.com/>

2 3

Security suggestions on stunnel with SSL/TLS and SNI configuration
by Secure-Mail User 28 Aug '15

28 Aug '15

2 2

Re: [stunnel-users] stunk closing connections with RST
by Ade Ajibade 26 Aug '15

26 Aug '15

> > Hi All, > > I am having the same problem in my lab. > > I am trying to set up a secure connection between my Bluecoat proxy and stunnel running on windows. I need to encrypt the connection between the 2 devices. > > I am new to stunnel. > > My Bluecoat is configured to do health checks to the stunnel on the specified stunnel port. However every now and again, it reports the server is down. Looking at the capture, I can see the stunnel is sending RESETS back to the proxy. > > The TLS connection to the proxy appears to be working fine. But I need to be able to monitor the servers health. > > How do I do this? > > You have mentioned in your post the stunnel configured of client = yes. > > On what side does this need to be configured and what exactly does this mean? If it is configured as client = no what will be the implication. > > I have been looking at how you solved the F5 issue but how does that apply to what I am doing from my proxy. > > Please any help will be useful. I just subscribed to your site. > > Thank you > > > > Adekunle

1 0

New Windows installer
by Michal Trojnara 19 Aug '15

19 Aug '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have performed a major rewrite of the stunnel installer for Windows. It now allows installing stunnel for all users (as before), and also for the current user (in the user's home directory). It also no longer installs all the files into a single directory. The installer attempts to automatically migrate the previous layout into the new one. https://www.stunnel.org/downloads/beta/stunnel-5.23b4-installer.exe Please give it a try and let me know your comments and any bugs you can find. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVziEpAAoJEC78f/DUFuAUFFIP/1CN9Bh5PFvpUlmnC67exLA4 CfPLXK4jj3PjFISF3scKAGJJjaCmyWQzF3mmTTn5HXprCfwOtZXf3jJQVI0YFZjE 8OgxpdcWhAyuOr2wQLSs5DX+WBILuxHBpIIJrjYIlrAsKMwmB7ucLHf17K+AkCjb j++ctJdFDQygpX0w9Qp0oyIbiEGlgaFHAn/aeYKdLSzTGaDkTptswMsM+SZzNcHF bK9VxQ15xFE6EwOp45roxc7eMuOd6VGQ9uyj1DcLaHygE0m5ALzXFN2Xsnii9UIq ZbzoOMBYlGYAya8Hbgrrb3D+53CwwQrhjVgE27FbMp3qc4ijboaBlfSzd+Bci3Rg B84EkJjBNC1cOcl5JvB/QAuJgXReBbFecS5+8PYNTzii6HU4bFXKb9JlbxCA7eGm HiCkn+DM4GJ3RXtWYjcyWfhlgCx69SUaEJvtphHl9QLbyGnDsJTE7rLlmpnp4B2N MNvZFhxuZrBsMmDRydQSYKaJ7S5e9H6soi630OfLxHDIbOGD+vDVvO9XrjtdYWBO 6Fm4ed0lDuTcqTzCxy93vbwPkWzvPyOykQPCED/UQ1RgtC8AIi6JVXhCwLs30pwj rSHgBKGxC5E19MXYwrNq3cr0nJdkw4oh8NShaXiplfhdCMdjRZHZz1HpbQzW0WP/ Z5BrUzv9yYpA/aAk4r7V =RSFJ -----END PGP SIGNATURE-----

2 3

net::ERR_TIMED_OUT error when connecting to a websocket via stunnel
by Mike Alhayek 17 Aug '15

17 Aug '15

Hi, I hope someone can help me here as I have been stuck for the past 3 days. I need to allow a client to connect to a websocket running on server 10.0.4.160 on port 8080. I need to setup a secure tunnel to allow the client to connect to the websocket via port 58443. I installed the latest version of stunnel on my windows Server 2008 R2. Then I changed my stunnel.conf file to look like this [websockets] client = yes accept = 58443 connect = 8080 verify = 2 checkIP = 10.0.4.195 CAfile = ca-certs.pem debug = 7 OCSPaia = yes ##The rest have been removed I am expecting to open a connection from the user's console on port 58443 and the stunnel will allow the client to connect to port 8080 This is the code that I use in the client's console "Of course, the console is on a PC that is on my internal network" var conn = new WebSocket('wss://10.0.4.160:58443'); conn.onopen = function(e) { console.log("Connection established!"); }; conn.onmessage = function(e) { console.log(e.data); }; While on the server, I open up a command line and I execute this telnet localhost 8080 to open up a command line where I can see the incoming request. As soon as I fire the code above from a client javascript's console I see this in the server's command line [cid:[email protected]] But few seconds later I get this error in the client's console WebSocket connection to 'wss://10.0.4.160:58443/' failed: Error in connection establishment: net::ERR_TIMED_OUT If I try to send a command using conn.sent('Hello') I get this error VM289:2 Uncaught DOMException: Failed to execute 'send' on 'WebSocket': Still in CONNECTING state. at Error (native) at <anonymous>:2:6 at Object.InjectedScript._evaluateOn (<anonymous>:905:140) at Object.InjectedScript._evaluateAndWrap (<anonymous>:838:34) at Object.InjectedScript.evaluate (<anonymous>:694:21) Additionally, I tried to turn on debugging in strunnel by adding debug = 7 to the config file This is what I got in the stunnel console. I don't understand what is wrong as the logs show that the client is connected but I can't send messages from the client to the server 2015.08.16 16:40:06 LOG7[36]: Service [websockets] started 2015.08.16 16:40:06 LOG5[36]: Service [websockets] accepted connection from 10.0.4.195:21963 2015.08.16 16:40:06 LOG6[36]: s_connect: connecting 127.0.0.1:8080 2015.08.16 16:40:06 LOG7[36]: s_connect: s_poll_wait 127.0.0.1:8080: waiting 10 seconds 2015.08.16 16:40:06 LOG5[36]: s_connect: connected 127.0.0.1:8080 2015.08.16 16:40:06 LOG5[36]: Service [websockets] connected remote server from 127.0.0.1:50891 2015.08.16 16:40:06 LOG7[36]: Remote socket (FD=668) initialized 2015.08.16 16:40:06 LOG6[36]: SNI: sending servername: localhost 2015.08.16 16:40:06 LOG7[36]: SSL state (connect): before/connect initialization 2015.08.16 16:40:06 LOG7[36]: SSL state (connect): SSLv2/v3 write client hello A What am I doing wrong here? How come the connection keeps failing?

1 0

Accept connection from sub-net?
by v v 12 Aug '15

12 Aug '15

Hi, Is it possible to configure stunnel server to accept connection from any IP in some subnet. For example, 111.22.33.xx. The proxy I connect through every time uses the different IP (from some IP pool) to connect to stunnel server. I don't want to add to the config file 255 possible host addresses. I don't see any suitable option in the stunnel documentation. Do I miss something? Any idea it could be done? Thanks, vov

1 0

Problem in connecting with root directory with stunnel connection in Mac OS
by Saurabh Beriwal 07 Aug '15

07 Aug '15

Hello All I am installing stunnel as client in Mac machine. I am using below configuration. accept=127.0.0.1:119 connect=target server information I am able to start stunnel service and its getting bound also. Now when I try to open the remote server directory with root folder , this does not work. However if I specify a shared folder name then this does work. I am facing this problem in Mac OS 10.10. smb://127.0.0.1:119/ does not work. smb://127.0.0.1:119/folderName works fine. However, both cases work fine in case of windows using stunnel. Please let me know if someone has faced similar issue in Mac OS with stunnel connection. Kindly help. Regards Saurabh Beriwal

1 0

STunnel nCipher openssl chil problems
by Marc Phillips 06 Aug '15

06 Aug '15

Has anyone managed to get STunnel to work with nCipher using the chil engine? STunnel appears to load the engine just fine, but failes when loading the key: [ ] Enabling support for engine "chil" [ ] Initializing engine #1 (chil) [ ] Engine #1 (chil) initialized [.] FIPS mode disabled [ ] Compression disabled [ ] PRNG seeded successfully [ ] Initializing service [https-server] [ ] Loading certificate from file: /usr/local/stunnel/etc/keystores/servercert.crt [ ] Loading key from engine: /usr/local/stunnel/etc/keystores/servercert.key [!] error queue: 26096080: error:26096080:engine routines:ENGINE_load_private_key:failed loading private key [!] ENGINE_load_private_key: 80069066: error:80069066:CHIL engine:HWCRHK_LOAD_PRIVKEY:chil error [!] Service [https-server]: Failed to initialize SSL context Using openssl directly, the key works fine (both with s_server and s_client). My stunnel config is pretty simple: pid = /usr/local/var/log/stunnel.pid debug = 7 output = /usr/local/var/log/stunnel.log options = -NO_SSLv3 engine = chil CApath = /usr/local/etc/cacerts/ [https-server] engineNum=1 accept = 4466 connect = 4433 cert=/usr/local/stunnel/etc/keystores/servercert.crt key=/usr/local/stunnel/etc/keystores/servercert.key R. Marc

1 0

Install Guide for STunnel Version 5.22
by Deepak Subbanarasimha 05 Aug '15

05 Aug '15

All, Is there an install guide for Stunnel version 5.22 for windows? If so, could you point me to it? -Deepak IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

2 2

"Chained" stunnel instances
by Michael Gebis 02 Aug '15

02 Aug '15

Hello. I have a question about a strange stunnel configuration; specifically, I'm like to use 'chained' stunnel instances, and I'm running into an issue. We have a conceptually simple setup: a client that connects to a server. We use stunnel both for encryption and for the failover mechanism. Here's a diagram of our simplest setup: /----S1 / C--st0-----S2 \ \----S3 We have a client that connects to stunnel. Our stunnel configuration lists three connections with "prio" failover mode. So usually, connections go from C thru st and onto Server 1. If S1 is down, st0 fails to connect to S1 and instead tries S2, and all is good. However, sometimes we may place an optional second instance of stunnel in front of the servers. /----st1--S1 / C--st0-----st2--S2 \ \----st3--S3 The failover mode of stunnel does not work so well in this configuration. If S1 is down, st0's failover algorithm does not kick in. Instead, st0 happily connects to st1, which is still alive and running. st1 then detects S1 is down and immediately closes the connection, but st0 does not care. Since the initial connection was successful, it does not initiate the failover algorithm. You may ask "why not change to round-robin mode?" The answer is that S1 is a dedicated machine, and S2/S3 are underpowered backups that have other primary responsibilities. We really want to direct all connections to S1 and only use S2/S3 in emergencies. You may also ask, "Why the second layer of stunnel?"--unfortunately, there are several hairy implementation-specific details that make this hard to change. My question is: is there any stunnel configuration option that can help us out? We would like the failover to work with and without the second layer of stunnel. From looking at the source code, I think I'm out of luck, but I figured it couldn't hurt to ask. Thanks! Michael

3 3

stunnel 5.21 - fails to listen on both IPv4/IPv6 (Linux)
by Lonnie Abelbeck 30 Jul '15

30 Jul '15

Very long-time user with the AstLinux project... stunnel 5.19 works fine, when upgrading to stunnel 5.21 with the same config I get: -- Starting Stunnel Server Proxy... [.] stunnel 5.21 on i586-pc-linux-gnu platform [.] Compiled/running with OpenSSL 1.0.1p 9 Jul 2015 [.] Threading:FORK Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/server.conf [.] UTF-8 byte order mark not detected [ ] Compression disabled [ ] PRNG seeded successfully [!] Error resolving "::": Address family for nodename not supported (EAI_ADDRFAMILY) [!] /etc/stunnel/server.conf:14: "accept = :::8443": Failed to resolve accepting address -- Has the syntax changed to listen on both IPv4/IPv6 ? Lonnie

2 2

Configuring stunnel on multi tenant server
by Saurabh Beriwal 30 Jul '15

30 Jul '15

Hi All, I want to configure stunnel on multi tenant server. Please let us know the best possible way to do this. Also is it OK if I keep multiple accept and connect parameters in stunnel configuration file. Thank you.

2 1

stunnel 5.22 released
by Michal Trojnara 30 Jul '15

30 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.22 of stunnel. The ChangeLog entry: Version 5.22, 2015.07.30, urgency: HIGH * New features - "OCSPaia = yes" added to the configuration file templates. - Improved double free detection. * Bugfixes - Fixed a number of OCSP bugs. The most severe of those bugs caused stunnel to treat OCSP responses that failed OCSP_basic_verify() checks as if they were successful. - Fixed the passive IPv6 resolver (broken in stunnel 5.21). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 8ad628a6948153cdb2044283f6988384a30585ea7e14778c2ee616a6678cb83f stunnel-5.22.tar.gz 9b3fe70bcfeb64b013b7b926e475a7d100ef1fdf5ce352ad90ac1034f780ea2a stunnel-5.22-installer.exe 2f49313debe7af27feeab246a771dc513e5e368e1839e92fba4cfe0b2735aeba stunnel-5.22-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVufy2AAoJEC78f/DUFuAUHVYQAK+keyqWyllv3ky5hRi8DlXe LLtuUdTYTalI64Fg5/TYL6+fbrEjWoAWtGwg+X/muVNj7KW4twlKrakMtkDpSDNd 0xSh94/u/PCrPVThxCq7AUbTPLyrG6ox5RKYDkOKfyGQ3q5ix6yba0l6fQqHXPCr OAbaRuwn5U6u7lPxXa69ozwyY5JHIiGqhMfQJBRXwFoeNbWak3HM7+Pe5DZ0ACLa SRY0iCseR1aQ12pZaaNoknkAAL9kmHgRP+fuPFqKMkp8TgZ2469qg30s/Bzn7n0U h5GvAuhYkQdDDbC7ozWgqaNxRNpOe+3RZ50fpCueyAlZESe8agHcyXchoj4JUVx+ 5ihOms4WujamCtP4MzHrRo6eQpeoGbw1EZ2P//Q9TlxX4METgEfV0lzaR7n376jr y24xIFEMl2tnqJ81lKQZWlxAP4MiKZgr//GOueRewRCtYSSQcK/mHvxZMDFfHAc7 N2LUmzm+PpsHwto7VkUy1m4eEAb34Tr3QubzvrT1yD4YMQDR6tID+xkRmuJWjMhf qBcXecKetIQq70KuI+VVqJxdP3Ekgjb+xnNOSKelUP/TkHpvubjTViSIVPu+5DSb x2viDBKAbgWcER2aZsB6UWXfQwjT/apDhqu6XrwjAcFfBk0ul0QazmH0HMc9ouVd yziOHVATYgcXYcTIQvj9 =DTOg -----END PGP SIGNATURE-----

1 0

Questions between stunnel 4.56 and 5.21 (current version)
by Guy.Gaudreau.TCR06＠ssss.gouv.qc.ca 28 Jul '15

28 Jul '15

Will a 4.56 installation be able to establish a tunnel to a 5.21 version. Will a 5.21 installation be able to establsih a tunnel to a 4.56 version What happends If I have a server that is currently running a 4.56 version and we install the 5.21 version on the same server. Will both versions co-exist on the same server peacefully or will the install process uninstall the 4.56 version. in that last scenario will the tunnels already configured under versio 4.56 work under the 5.21 install? Thank you Guy Gaudreau

1 0

stunnel 5.21 released
by Michal Trojnara 27 Jul '15

27 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.21 of stunnel. The ChangeLog entry: Version 5.21, 2015.07.27, urgency: MEDIUM * New features - Signal names are displayed instead of numbers. - First resolve IPv4 addresses on passive resolver requests. This speeds up stunnel startup on Win32 with a slow/defunct DNS service. - The "make check" target was modified to only build Win32 executables when stunnel is built from a git repository (thx to Peter Pentchev). - More elaborate descriptions were added to the warning about using "verify = 2" without "checkHost" or "checkIP". - Performance optimization was performed on the debug code. * Bugfixes - Fixed the FORK and UCONTEXT threading support. - Fixed "failover=prio" (broken since stunnel 5.15). - Added a retry when sleep(3) was interrupted by a signal in the cron thread scheduler. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 2aef568b1955f5e233f6a8e17ebce3d30755f1be44c813f5a48e621f785596e3 stunnel-5.21.tar.gz d5ec83140060af2b373a82abab0f7fd34c76a68c4f2990d46be460526b325de6 stunnel-5.21-installer.exe 2788d9e11b65dd4b111616bab1d7f09943916c924ba023cc3ad4260ac1f6f6d7 stunnel-5.21-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVtfz2AAoJEC78f/DUFuAUey4P/0tQ8yj3Yt7K5yLIorDGu9lI w95Vs2MtyOvFQyoX24dPKrDULKmxE28Dg8RJt51ZuT9q8mIfPdBA+jphyfjbpzl0 BeNQNbzEfN36dhOa2+dvr4+fcna/lnRpNMQg6sP/z4KHDLoI72lAg9vVwv5VX/4X JAMAaTxbrOXuXOmVPLSdHBeug7Y/0Q/+jPg9tSEslMtBaJvMd4CcHs4q8dCW9OQv AUWLtOiSsubfCvQ9rwGODObFJCA3BINrmh3a9EyhKJTov+8JKHlJY02r4zGJYMC4 PIVAVZWit9mEFefG6BuEWwOw4gohAInDXpsN2X9BNNDfUAVlUtp6OoxATcGv/H45 Uf25Dz2Bu8WtKIuuCIhN79PBfqSG8f2mSwNsec8OcYNOTzkAHKoFQQfKbJ1FUD5+ lTBhOFfo/B5haQA1EHNf0z8JxDulnsL7JsQQo4hF3ShSiCZpEAVvSkixpwCjm2kR WCtQ0w5eLccD/CnfjNrcOp3QKGLacZ+PCm9MH+cQDQvnmhAaelWK+OL67L9FKwBf hbJMA2RwwjN7efwEeUlnzVTBiJS9fsPTJghh8CzYuDWlnhEEnB9WX2FI1yVZVxM+ 8tGifpdOkRCFhpQSQkj0pWy/qf/cU8mL2uM31hBNcsRjCt6PfjQfKQ7jyMFvicmc rWJhvWvAfLAJXl+rgn5r =WvhQ -----END PGP SIGNATURE-----

1 0

Disable TLSv1
by Smith, Michael 23 Jul '15

23 Jul '15

I am running stunnel version 5.20. How do I disable TLSv1 and leave only TLSv1.2 and TSLv2 enabled? Michael Smith System Specialist II 281-283-2930

2 1

Question about behavior with "failover = prio"
by Michael Gebis 22 Jul '15

22 Jul '15

Hello again. We recently noticed a behavior in stunnel that surprised us, and seems to be inconsistent with the man page description. We use "failover = prio" in our configuration file. To refresh everyone's memory, the man page describes this option here: failover = rr | prio Failover strategy for multiple "connect" targets. rr (round robin) - fair load distribution prio (priority) - use the order specified in config file default: rr Our config file contains a list of connect targets, like this: [...] connect = h1.example.com connect = h2.example.com connect = h3.example.com connect = h4.example.com [...] Based on the description, we expect the connection to try h1 first, and if h1 fails, failover through the remainder of the list, in-order. However, what we observe is that the connections start at a seemingly random place in the list. It does appear to proceed in-order...it's just the starting place that seems incorrect. For example, we might get a sequence that proceeds "h3->h4->h1->h2". Please let me know if I am misunderstanding the intended behavior of the 'prio' failover strategy. Here is a trial patch that hard-codes the starting place for the failover to the beginning of the list. I am not sure if this change has any unintended consequences for other configurations. But as a proof-of-concept, it does seem to fix the behavior to be consistent with our reading of the man page. This patch is against 5.20 but it appears that 5.21b2 acts the same way. Thanks! Michael diff -ru stunnel-5.20.orig/src/client.c stunnel-5.20-prio-fix/src/client.c --- stunnel-5.20.orig/src/client.c 2015-07-16 15:55:52.213064746 -0700 +++ stunnel-5.20-prio-fix/src/client.c 2015-07-17 16:13:12.129184507 -0700 @@ -1285,7 +1285,8 @@ *c->connect_addr.rr_ptr=(i+1)%c->connect_addr.num; s_log(LOG_INFO, "failover: round-robin"); } else { - s_log(LOG_INFO, "failover: priority"); + s_log(LOG_INFO, "failover: priority, starting at first entry"); + i=0; } return i; }

2 1

stunnel 5.20 issue using "--with-threads=ucontext"
by Michael Gebis 22 Jul '15

22 Jul '15

Hello. We recently upgraded from stunnel 5.10 to 5.20. We compile using "--with-threads=ucontext" and with this flag, compilation of 5.20 fails in two places. Both failures seem like minor oversights. Here is a proposed patch to fix the two failures. This patch is against 5.20, but I just checked the most recent 5.21b2 and it appears to require the same changes. Thanks! Michael diff -ru stunnel-5.20.orig/src/cron.c stunnel-5.20-ucontext-fix/src/cron.c --- stunnel-5.20.orig/src/cron.c 2015-07-16 15:55:52.214064748 -0700 +++ stunnel-5.20-ucontext-fix/src/cron.c 2015-07-16 16:15:56.593107354 -0700 @@ -47,7 +47,9 @@ #if defined(USE_PTHREAD) || defined(USE_WIN32) NOEXPORT void cron_worker(void); NOEXPORT void cron_dh_param(void); -#endif +#elif !defined(OPENSSL_NO_DH) +NOEXPORT void cron_dh_param(void); +#endif #if defined(USE_PTHREAD) diff -ru stunnel-5.20.orig/src/tls.c stunnel-5.20-ucontext-fix/src/tls.c --- stunnel-5.20.orig/src/tls.c 2015-07-16 15:55:52.180064660 -0700 +++ stunnel-5.20-ucontext-fix/src/tls.c 2015-07-16 15:56:30.520164252 -0700 @@ -110,7 +110,7 @@ if(ready_head) ready_head->tls=tls_data; else /* ucontext threads not initialized */ - global_tls=tls; + global_tls=tls_data; } TLS_DATA *tls_get() {

2 1

Unable to open log file
by Matt brancato 16 Jul '15

16 Jul '15

Hi all, Did a search but didn't see an answer so i figured i'd ask. I'm trying to runstunnel but am having some issues. I attempt to run stunnel but i run into an issue where it can't read the log file and then closes up. Any ideas? sudo stunnel stunnel.conf [ ] Clients allowed=500 [.] stunnel 5.19 on x86_64-unknown-linux-gnu platform [.] Compiled/running with OpenSSL 1.0.1 14 Mar 2012 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from /root/.rnd [ ] Wrote 1024 new random bytes to /root/.rnd [ ] PRNG seeded successfully [ ] Initializing service [<service>] [ ] Loading certificate from file: /etc/stunnel/server.pem [ ] Loading key from file: /etc/stunnel/server.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from /etc/stunnel/server.pem [ ] DH parameters will be generated [ ] Cron started [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=7) [ ] Service [<service>] (FD=7) bound to 127.0.0.1:9999 [ ] Executing cron jobs [.] Updating DH parameters [!] Cannot open log file: /home/tim/Desktop/stunnel.log [ ] Closing service [<service>] [ ] Service [<service>] closed (FD=7) [ ] Service [<service>] closed -- *CONFIDENTIALITY NOTICE* THE INFORMATION CONTAINED IN THIS COMMUNICATION IS INTENDED FOR THE NAMED RECEIVER ONLY. THE TRANSMISSION MAY CONTAIN PRIVILEGED AND CONFIDENTIAL MATERIAL. IF YOU ARE NOT THE NAMED RECIPIENT, PLEASE BE ADVISED THAT ANY USE, DISSEMINATION OR UNAUTHORIZED COPYING OF THE MATERIAL IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS TRANSMISSION IN ERROR, PLEASE NOTIFY SUPPORT(a)TRUEEX.COM AND DESTROY THE RECEIVED COPY. THANK YOU.

1 0

stunnel 5.20 released
by Michal Trojnara 15 Jul '15

15 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.20 of stunnel. The ChangeLog entry: Version 5.20, 2015.07.09, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2d. https://www.openssl.org/news/secadv_20150709.txt * New features - poll(2) re-enabled on MacOS X 10.5 and later. - Xcode SDK is automatically used on MacOS X if no other locally installed OpenSSL directory is found. - The SSL library detection algorithm was made a bit smarter. - Warnings about insecure authentication were modified to include the name of the affected service section. - A warning was added to stunnel.init if no pid file was specified in the configuration file (thx to Peter Pentchev). - Optional debugging symbols are included in the Win32 installer. - Documentation updates (closes Debian bug #781669). * Bugfixes - Signal pipe reinitialization added to prevent turning the main accepting thread into a busy wait loop when an external condition breaks the signal pipe. This bug was found to surface on Win32, but other platforms may also be affected. - Fixed removing the disabled taskbar icon. - Generated temporary DH parameters are used for configuration reload instead of the static defaults. - LSB compatibility fixes added to the stunnel.init script (thx to Peter Pentchev). - Fixed the manual page headers (thx to Gleydson Soares). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 4a36a3729a7287d9d82c4b38bf72c4d3496346cb969b86129c5deac22b20292b stunnel-5.20.tar.gz 9d9d38241e972713cd0937e2cf66fdacf3adcb357fbea82d8e46648de4e26fa4 stunnel-5.20-installer.exe cfc1e94cb7c7bf14c832ac8799db4a3438ae7542aa04ec5e9c6695a1a3c3843d stunnel-5.20-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVnoXOAAoJEC78f/DUFuAUGvoP/1WQ2DliVyQQNGDYPkE2Rbqk BJ7lMEseYdPLjZVtkNPQIuH9PCc/qbWMrDFK1sJg+R7d0yyp+Ip+ucH4i5GCfW6o xIZQ00WVa/qV52AcEDGTZ+43EBPBIFNMkSeJlkwyj81ISZ+my0YpqPNSF77fZFdN IqGln9e+1n4gM+8SOgPnJs2XiR2EsbQzmwaZcTCOoKp56j6q2bLXlYC802B9KezJ ex2dmbGV2JEHmNarSUxWO45VnFdqhjhz4qHySm6KnLD2hoyS9Ex2XyynuuyIiIVx yU9M1zliZvgQSQ4RTpO3Ko2b9Qy2cYDECrFwk7i5rlwmiCw1zH5zWGh1rnAsLJHn 7SAxc5BfiB3VQl16CgoLM65no2mJ60f499ab3LA0uTNbt03PrPkc5cK8w+ec3YNU 6E59R4FXC6ae5T4iR7b9mBGifUHWtg53I1H7qbD6Pye/EH5QciSSPizEHeORYlPy fC3jOMEIUDlXjqI7k/XMGVPJ7SSKFkBNiqHKTKoM12QhiZXLLh4Ig3aQJgqX5IBQ VdML1/W9MdBlZNAHYaUBrkSls99aVbIsHJ5yAE0gsF5Lgi6hK6zDkXiKoVEozN5A N6MtfQHs/JS2nvlmCbtGWrK66EXKxW409f0JS3AJG6tjOquuSZYmR944EPzQD+zA WPivIUH2TVk63kULw/ui =Uw+D -----END PGP SIGNATURE-----

3 10

keyfile is not encrypted
by Madhava Gaikwad (madgaikw) 15 Jul '15

15 Jul '15

Hello, I am asking too much, but keyfile with stunnel is required to be stored on disk (I am aware about file permission applied) and is in plain text. Is there any way we can encrypt the keyfile and then store, and then subsequently ask stunnel to obtain the decryption key somehow and then use it. For encryption/decryption of the key, stunnel (or some other program) can give network based ability(service over socket) to provide the key so key can be encrypted by the third party(who generates the config for stunnel). Stunnel config option will specify key is encrypted and therefore stunnel knows why and how to decrypt it. Of course you will ask me to implement my own custom algo for this, but I am checking if anybody has thought about it or in such case, how they have worked on it. I was told, there is also basic level of FIPS compliance requirement that requires key not to be stored on disk in plain text irrespective of file permission. Thank you. Madhava

2 1

please remove me from the mailing list
by Kjell Osness 14 Jul '15

14 Jul '15

Thank you. Kjell Osness IT Technician American Home Entertainment cell (619) 520-9417 office (858) 430-1701 fax (858) 430-1702

1 0

help on options and sslversion
by Madhava Gaikwad (madgaikw) 14 Jul '15

14 Jul '15

Hi, I am using stunnel 5.03 version. I want to understand how the config option "sslVersion " and "options " works. The problem I am trying to solve is: I want to enable say only particular ssl connect methods, for example sslv3 and TLs1.2. I am not able to do it. For me if I do below setting: Options = all Option = NO_SSLv2 Option = NO_SSLv3 Option = NO_TLSv1 Option = NO_TLSv1.1 Option = NO_TLSv1.2 Still I see all methods are being enabled. I removed Option = all, but no effect. What is expected behavior? Also, The sslVersion seems enables either particular sslversion, or else all the versions. So wondering what can be the escape mechanism. Any help will be highly appreciated. Thank you. Madhava

2 2

"make check" tries to build Windows binary on Unix
by Dagobert Michelsen 13 Jul '15

13 Jul '15

Hi, I just tries to build stunnel 5.20 on Solaris 10 Sparc and noticed a strange behaviour during „make check“ which yields in a try to build Windows executables: > dam@unstable10s [unstable10s]:/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20 > gmake check > Making check in src > gmake[1]: Entering directory '/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20/src' > gmake stunnel.exe tstunnel.exe > gmake[2]: Entering directory '/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20/src' > i686-w64-mingw32-gcc -c -I/usr/src/openssl-1.0.2d-i686/include -mthreads -fstack-protector -O2 -Wall -Wextra -Wpedantic -Wformat=2 -Wconversion -Wno-long-long -D_FORTIFY_SOURCE=2 -DUNICODE -D_UNICODE -o tls.obj tls.c > /bin/bash: i686-w64-mingw32-gcc: command not found > Makefile:1206: recipe for target 'tls.obj' failed > gmake[2]: *** [tls.obj] Error 127 > gmake[2]: Leaving directory '/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20/src' > Makefile:1054: recipe for target 'check-am' failed I think this comes from these lines in src/Makefile.am: > # Just check if the programs can be built, don't perform any actual tests > check_PROGRAMS = stunnel.exe tstunnel.exe Essentially the „check“ phase could just not be called during build, but it would be cleaner to not bail out on Unix. Best regards — Dago -- "You don't become great by trying to be great, you become great by wanting to do something, and then doing it so hard that you become great in the process." - xkcd #896

3 6

Re: [stunnel-users] problem with buffering data on stunnel
by Michal Trojnara 10 Jul '15

10 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10.07.2015 20:17, wujot/Adalbert wrote: > But unencrypted session on path between Stunnel server and hi-speed > end server (both in LAN) is using TcpWindowSize on level 64KB - > 131KB Did you consider also tuning SO_SNDBUF of the sending application? > (in Windows 2008 or newer it is calculated automatically). So I > steel have at least 64KB buffer in stunnel. IMHO Windows is probably not the best server platform... > Is there any possibility to force stunnel to use on faster part of > connection (LAN side) the value of TcpWindowSize similar to > calculated on slower part (on WAN side)? I don't think such tricks are possible with BSD sockets. BTW: You can also change BUFFSIZE in common.h and rebuild stunnel. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVoDm6AAoJEC78f/DUFuAURJQQAM1ix6ZkSqOCa9iLiBDIFvrS DajgeGDGeSE75WkyI+IQrPYjWJGNielOeXhCPjYdQh+5o/bddYPaRlQRsu0HlY6F Nncj1kP8Xy0WNO4uxz1YWpnnJtE/Ph9VUVLqS/63tJgkrhmvXF1HODeu677JLzEb wjOn0kv6SmPnzkFMpjbBmkRPt5GeSRc43POGoHcuqFKijeaTDGoqhBLo+tGLhtNV ezYN+QFvyyzMVPe8tscWa+vyXYdbMzgLBXXCHFMbFmlpu6QKHKb0823Q7g7OgMCb DYkVbw0a0ys6hdreBHejvAbgfG8fTKOtYfdOa7lnjCuivGpVKLa018yTk/1qjUbs dmr08MFPGkkMSfV/sQ+PMgZ0Dxaoczt1yXanzURNDXC4eiUlgEXfs4S5J2NYxTOe g4ZG7ZXQIHrux1AcQD9TQF+G9h7YxXeRMt0K29qA54dH+x+Xie920OJMXohMAZJ0 ddkblmt7SHO2XiEV6C2ie1VvB/roZ+aeqKQME4T8oZliy/kaDgXgs/eFLT2Kxw9B WwlWt4r4pLHFkJfExJF/nMWe0qRt/tlVoqyvOFE1hnTxOGr5pGLnY0XOoHX13kr/ ow1TC0N0UPWV++Uydm2oJwXA+o7a/TRs8O+PEhhHTqLDi4O/apC7kL9fM6DjESGr Zj+br1nUiaF+LscAiC/D =kA2M -----END PGP SIGNATURE-----

1 0

Cannot open log file
by Matt brancato 10 Jul '15

10 Jul '15

Hi all, Did a search but didn't see an answer so i figured i'd ask. I'm trying to run stunnel but am having some issues. I attempt to run stunnel but i run into an issue where it can't read the log file and then closes up. Any ideas? sudo stunnel stunnel.conf [ ] Clients allowed=500 [.] stunnel 5.19 on x86_64-unknown-linux-gnu platform [.] Compiled/running with OpenSSL 1.0.1 14 Mar 2012 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from /root/.rnd [ ] Wrote 1024 new random bytes to /root/.rnd [ ] PRNG seeded successfully [ ] Initializing service [<service>] [ ] Loading certificate from file: /etc/stunnel/server.pem [ ] Loading key from file: /etc/stunnel/server.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from /etc/stunnel/server.pem [ ] DH parameters will be generated [ ] Cron started [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=7) [ ] Service [<service>] (FD=7) bound to 127.0.0.1:9999 [ ] Executing cron jobs [.] Updating DH parameters [!] Cannot open log file: /home/tim/Desktop/stunnel.log [ ] Closing service [<service>] [ ] Service [<service>] closed (FD=7) [ ] Service [<service>] closed -- *CONFIDENTIALITY NOTICE* THE INFORMATION CONTAINED IN THIS COMMUNICATION IS INTENDED FOR THE NAMED RECEIVER ONLY. THE TRANSMISSION MAY CONTAIN PRIVILEGED AND CONFIDENTIAL MATERIAL. IF YOU ARE NOT THE NAMED RECIPIENT, PLEASE BE ADVISED THAT ANY USE, DISSEMINATION OR UNAUTHORIZED COPYING OF THE MATERIAL IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS TRANSMISSION IN ERROR, PLEASE NOTIFY SUPPORT(a)TRUEEX.COM AND DESTROY THE RECEIVED COPY. THANK YOU.

1 0

Support for SHA-2 256
by Deepak Subbanarasimha 10 Jul '15

10 Jul '15

Does Stunnel support VeriSign SHA-2 256 certificate? If so, which version was this added in? Thanks, Deepak IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

2 1

problem with buffering data on stunnel
by wujot 09 Jul '15

09 Jul '15

I have a problem with transmission from LAN server, which use another server on LAN with running stunnel, to pass encrypted data to remote SSL clients if they are on very slow GPRS network. If server in LAN starts to transfer big amount of data to such slow remote client, stunnel is buffering data and slowly transmits them to the GPRS client. TCP Window on connection from LAN server to stunnel is big (64 - 131kB), and TCP Window on connection from stunnel to slow client is small (about 5kB). And additionally stunnel is buffering data. So, server is finishing transmission in seconds, but in fact most of data are still in buffers of stunnel. And it makes a timeout problem (server is waiting for the confirmation from client if it received all data, but time between last byte sent from server and confirmation from client could be even several minutes). So, stunnel is working in "store and forward" model. Is it possible to switch it to something like "cut through"? Or how to force stunnel to more synchronized transmission between client and server? Regards, Adalbert

2 1

password protected key in client certificate
by Giona Il Profeta 03 Jul '15

03 Jul '15

Hi all, I have inherited an old stunnel installation, configured for mutual authentication (verify=3) and I'm trying to figure out some of the choices of the old sysadmin. One of the client certificates in the CApath directory has its private key encrypted with a password. Is the client supposed to provide the password to decrypt the key when it connects? Thank you G

2 2

Older versions of stunnel
by daninho dj 03 Jul '15

03 Jul '15

Hi guys, Where can I find some older versions of stunnel? I would like to get 5.17 version. Thanks, Daninho

2 1

Problem with read and unreald mails via POP3 SSL
by David Tedjo 30 Jun '15

30 Jun '15

Hi everybody, i bought an Logitech keyboard with display. I use now stunnel to bring my email account to my display. Logitech got a applet for this. Now i can use it but i got a problem with the unread mails. My display shows me 6 unread messages, but thats all my messages in my in-box and i read it already. Is this a problem of stunnel or a problem in the software of the keyboard? Best Regards David

2 1

automation of installation of loopback adapter
by Saurabh Beriwal 29 Jun '15

29 Jun '15

Hi All, I'd like to programmatically install the MS loopback adapter to automate tunneling of SMB over SSH. All the code which i found on net uses MS devcon utility. Please let us know if there is any simple way to automate the installation of MS loopback adapter. Thank you. Regards, Saurabh Beriwal

2 1

Re: [stunnel-users] installing stunnel on Mac Machine
by William Dockery 26 Jun '15

26 Jun '15

1. I’m an stunnel newbie. 2. I thought I would give the Mac install script a try: downloaded it to ~/Documents, did the chmod, and ran script; looks like it can’t create/find the config file? Is that something I need to do manually? WDDMBPW80336XHAGV:Documents williamdockery$ ./stunnel-5.20b8-osx [ ] Cron started [ ] Clients allowed=125 [.] stunnel 5.20 on x86_64-apple-darwin14.3.0 platform [.] Compiled/running with OpenSSL 0.9.8zd 8 Jan 2015 [.] Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,OCSP [ ] errno: (*__error()) [.] Reading configuration from file /etc/stunnel/stunnel.conf [!] Cannot open configuration file [.] [.] Syntax: [.] stunnel [<filename>] ] -fd <n> | -help | -version | -sockets [.] <filename> - use specified config file [.] -fd <n> - read the config file from a file descriptor [.] -help - get config file help [.] -version - display version and defaults [.] -sockets - display default socket options Thoughts? Thanks, William > > Message: 1 > Date: Thu, 25 Jun 2015 12:48:02 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] installing stunnel on Mac Machine > Message-ID: <558BDC62.9080606(a)mirt.net> > Content-Type: text/plain; charset=utf-8 > > Signed PGP part > On 25.06.2015 08:04, Saurabh Beriwal wrote: > > Is it possible to automate the installation on Mac machine? > > I built an executable for you: > ftp://ftp.stunnel.org/stunnel/stunnel-5.20b8-osx > Just copy to a directory, chmod a+x, and run it. > > Mike > >

1 0

installing stunnel on Mac Machine
by Saurabh Beriwal 25 Jun '15

25 Jun '15

Hi All, I need to install stunnel on Mac machine. If someone has already done this in past , then please share the installation steps with me. Do we need to install anything like loopback adopter in Mac Machine. Regards, Saurabh Beriwal

4 5

How to upgrade OpenSSL version that comes with Stunnel
by Paul Randall 24 Jun '15

24 Jun '15

Hi folks, Can you please tell me the process for swapping out the version of OpenSSL that comes with Stunnel for a newer version of OpenSSL? Is there a quick way to do this or does it require recompiling Stunnel? Thanks. Paul

1 0

Stunnel windows installer
by Deepak Subbanarasimha 22 Jun '15

22 Jun '15

Hi, Is there an MSI installer available for Stunnel version 5.19 ? If so, has anyone tried to call the stunnel MSI installer from an Install shield installer? Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:[email protected]> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

1 0

Re: [stunnel-users] stunnel 5.18 may keep high CPU usage
by Dod 22 Jun '15

22 Jun '15

Hello Michal, Same problem with 5.19b4 and nothing special in the logs. Now I know how to reproduce the problem instantly, I just have to put my computer in StanBy mode and Awake it. Using Process Explorer from Sysinternals I see that stunnel produce a permanent "Other I/O" flow when problem appear. I/O Other : "The rate at which the process is issuing bytes to I/O operations that do not involve data such as control operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os." OtherI/O is confirmed by Process Monitor that trace no File nor Registry nor Network activity. But as stunnel still respond correctly to a Quit menu or any other menus and SSL requests I assumed that it may be some Thread going crazy so I compared running thread between normal stunnel behavior with the 25% CPU behavior and found that in fact there is a thread that do no terminate correctly. Here is the Thread's stack : MSVCR90.dll!_endThread+0x7d ntoskrnl.exe!memset+0x61a ntoskrnl.exe!KeWaitForMultipleObjects+0xd52 ntoskrnl.exe!KeWaitForSingleObject+0x19f ntoskrnl.exe!PoStartNextPowerIrp+0xba4 ntoskrnl.exe!PoStartNextPowerIrp+0x1821 ntoskrnl.exe!PoStartNextPowerIrp+0x1a97 ntoskrnl.exe!KeReleaseInStackQueuedSpinLock+0x5a afd.sys+0x61c1c afd.sys+0x51d3b ntoskrnl.exe!NtMapViewOfSection+0x15b7 ntoskrnl.exe!NtDeviceIoControlFile+0x56 ntoskrnl.exe!KeSynchronizeExecution+0x3a23 wow64cpu.dll!TurboDispatchJumpAddressEnd+0x6c0 wow64cpu.dll!TurboDispatchJumpAddressEnd+0x1fb wow64.dll!Wow64SystemServiceEx+0x1ce wow64.dll!Wow64LdrpInitialize+0x42a ntdll.dll!RtlIsDosDeviceName_U+0x1f5c4 ntdll.dll!LdrInitializeThunk+0xe ntdll.dll!NtDeviceIoControlFile+0x15 WS2_32.dll!select+0x9f stunnel.exe!OPENSSL_Applink+0xd3ec stunnel.exe!OPENSSL_Applink+0x961 Hope it help... regards. MT> Please try stunnel 5.19b4: MT> https://www.stunnel.org/downloads.html

2 2

Fwd: Disabling window server service
by Saurabh Beriwal 22 Jun '15

22 Jun '15

Hi All, I am using stunnel to connect with SAMBA server and getting error in binding with server. Please let me know if it is mandatory to disable window server service for using stunnel. Also i would appreciate if some one can share knowledge\articles on window to SAMBA server connectivity through stunnel. Thank you. Regards, Saurabh Beriwal

1 0

Generate CONNECT
by reiner otto 22 Jun '15

22 Jun '15

I have following problem: I want to avoid the user to explicitly specify a https-proxy in his browser. Let me explain: For http, a transparent proxy can be interfaced via iptables DNAT, for example.Same for https will not work, without certificates installed etc.However, I only want some basic info about the https-session, like traffic volume or destination domain. In case, there is an explicit https-proxy defined in the browser, I can get this info from the connect request, preceding the secure data exchange.But I want to avoid this explicit declararion. Most likely I will need some custom programming for this, but may be there is a specialist here to give some direction.

2 2

Default Ciphers
by Clayton Keller 17 Jun '15

17 Jun '15

Looking at the Changelog I see the following from the 5.15 info: "MEDIUM ciphers (currently SEED and RC4) are removed from the default cipher list." And this from the 5.00 info: "Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2" due to AlFBPPS attack and bad performance of DH ciphersuites." Given these to comments would it be accurate to say that the current default "ciphers" value is: "HIGH:+3DES:+DH:!aNULL:!SSLv2" Also, some of the docs indicate what the default value currently is. Is there an easier way to determine that value via CLI or other means? Thanks Clay

2 1

stunnel 5.18 may keep high CPU usage
by Dod 17 Jun '15

17 Jun '15

Hello, I use sTunnel for years and ujpdated from 5.17 to 5.18 on my Win7 64bits. I use sTunnel for POP-SSL and SMTP-SSL for 12 accounts (gmail, yahoo ...) but I noticed that after a few connexions sTunnel may keep high CPU, 25% as reported by TaskManager (50% on core 1 and 3 on my Core-i5 quad-core). The problem, may appear after 10 cnx sometime more. The reading order the POP-S accounts that are checked do not matter. The POP accounts are never high loaded I mean I do not receive tons of e-mails and they are not oversized. Sometime the 25% CPU usage disappear by its own, sometime it can stay forever. Never noticed such problem on previous versions. Standard logs show nothing special. regards.

3 10

Stunnel 5.17 builds, 5.18 does not - AIX 6.1 - pod2man does not accept "-v"
by Rob Lockhart 17 Jun '15

17 Jun '15

Michal, I was able to build Stunnel 5.17 on AIX 6.1 using the "build" command, after completely removing the entire section for "-fstack-protector" in "configure" (my "stunnel-5.17.patch" file below). I used the following commands: mkdir $HOME/stunnel-bin-5.17 gzip -dc stunnel-5.17.tar.gz | tar xvf - patch -p0 <stunnel-5.17.patch cd stunnel-5.17 chmod 755 configure; ./configure --prefix=$HOME/stunnel-bin-5.17 make; make install However, for 5.18, those same commands (and patch file) no longer result in a successful compile due to AIX 6.1 not accepting the "-u" (Unicode) for pod2man. I looked into 5.17 and it looks like the same Makefiles are used in both (doc/Makefile.in and doc/Makefile.am) so perhaps the top-level Makefile for 5.18 adds the ".pod.8" file to the build process. Removing the "-u" in both files enables the build to complete. I just tested against Stunnel 5.19 but it looks like the step that ran "pod2html" was skipped by default (i.e., just "make") so I am able to compile stunnel correctly. Thanks for fixing this in Stunnel 5.19! For those that need the .pod.8 man pages on AIX 6.1, you'll need to remove the "-u" in the pod2man command. Regards, -Rob

2 1