- stunnel-users - stunnel.org

Fwd: Comments/questions to Debian patches
by Michal Trojnara 24 Apr '15

24 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Peter Pentchev, the Debian package maintainer for the "stunnel4" package, does not reply to my emails. I hope he is still alive and well, just too busy to maintain the package. I decided to share with you my comments to the patches that are applied to the Debian package. Hopefully, someone will find them useful. Mike - -------- Forwarded Message -------- Subject: Comments/questions to Debian patches Date: Tue, 28 Oct 2014 21:13:25 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: Peter Pentchev <roam(a)ringlet.net> Hi Peter, Just a few comments/questions to improve the quality of Debian package. I'll be glad to discuss if you disagree with my opinions. 01-fix-paths.patch The patch description is quite outdated. Translation from sbin to bin was performed upstream in stunnel 4.21 released 27 Oct 2007. 8-) I guess: /usr/bin/stunnel -fd 10 \ should be: /usr/bin/stunnel4 -fd 10 \ Probably this should be added to the next patch: 02-rename-binary.patch 05-logrotate-warning-in-sample-conf.patch Good idea. I'll add it to stunnel 5.07. 08-client-example.patch I've already added this example in stunnel 5.02. Your patch adds it once again. Just remove it. 10-no-zlib-compression.patch I'm completely confused by this patch. According to my tests it only makes stunnel reporting different errors when a user tries to enable compression on Debian. Why would anyone need this patch? 11-no-rle-compression.patch IMHO OpenSSL bugs should be fixed in OpenSSL, and not in stunnel. YMMV 12-restore-pidfile-default.patch I strongly disagree with this approach, as it breaks configuration file compatibility with the upstream. Debian should instead rewrite stunnel.conf when upgrading from stunnel 4.xx. 14-lsb-init-functions.patch 8-) 15-upstream-systemd-libs.patch This (and more) will be included in stunnel 5.07. 16-upstream-sslv23-method.patch This will be included in stunnel 5.07. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVNsCAAAoJEC78f/DUFuAUpfUP/j13koMgtnVLfsACIqUEaZw3 1uADOP/Dugqbn/QcwSqWAlcTrf7So98AQrB88xAhN8C3fwP375GmcNmPgJx4RRme fU/Wo0aFaCq0JOReiQkNiyj3pqf+J2NxZlZM5ZpzzpA80x8AlyLqBwPfBAtxgYNJ rb5AyIoGPkzfXM8OSz8YJXZtgXT4lrSCE5djlWHHBqy9ioUZCEuyVXeT5Y90sXOg wOA/EX3fTKEJZckoiNoTPAh9pLZ9M29lLM7wLEu5BFWwh/TtHk0ZFADo3Kzi/+4G Q6h9236DmH1NHA/FzMfFbKEYz/0yeOUMfet8LsRNNRRrFJEp+miMemSYajGMA3IT UVW4UNOa+CppVgkRpVMGfl/Lw53GP63xbLIRuZs17py03hNBHz2pyZneWWKTJEun xJQC4QJ3Z3YYXd71jpHIKjcDBXmIzcG8Z9QylaTywk8MBBBpjuRTXkIAlWWj2Iyk LVRsAgtooUKlQzUoAoseRygDv+Wbp/qVNL1Zogy7PmfORmqZOz08jRpDlXFgjPjR evGztgApTR+FSMO9f052z/Sql0chb5mhtdAtdBKpRE3CgtIrCHfcalSOyeCleHJK NMEbqfed9Oq2WA0/W89ilGtJWRH4v0GnYCfbYhbSoXp9DytdHPbhRUsiJL8LO34b 1cuMSsQ9LjF+3WyRie4m =SrZs -----END PGP SIGNATURE-----

2 2

Redis with stunnel, need to reset a client connection if the remote server drops
by Cocytus 20 Apr '15

20 Apr '15

Hello all, I've spent some time digging through the archives, but have yet to turn up a solution to the issue I'm having. We're using Redis instances on 'cloud' resources, and have successfully gotten stunnel setup as a server on these nodes. Additionally an internal process runs and connects to a local stunnel client that then connects to the remote cloud instance. This is working well enough at the moment, however there is one issue I'm bumping into. If the remote EC2 node goes dark for a bit (ie: reboot), the local stunnel client will reconnect, however the internal process which is establishing its connection to the local stunnel client does not get disconnected and therefore doesn't know that redis became unavailable and needs to re-subscribe to the redis stream. I need to invalidate the established session when the remote reconnects. Can this be accomplished with either a TIMEOUT value or session statement? Below is a sample of the configuration: ########### [some-ec2-node.com] client = yes verify = 2 CApath = /etc/ssl/certs sslVersion = TLSv1 accept = 127.0.0.1:10008 connect = some-ec2-node.com:6379 ########### $ stunnel4 -version stunnel 4.53 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1f 6 Jan 2014 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 Global options: debug = daemon.notice pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 session = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- Josh

2 1

stunnel 5.16 release
by Michal Trojnara 19 Apr '15

19 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.16 of stunnel. This release only fixes a compilation issue with old versions of gcc. The Win32/Android binaries are basically the same as for version 5.15. The ChangeLog entry: Version 5.16, 2015.04.19, urgency: MEDIUM: * Bugfixes - Fixed compilation with old versions of gcc. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: b6b7e93fb2626eaabae1c8474e1dfa23962cfde8fa35c8602289fcaa4f53608d stunnel-5.16.tar.gz a701e6421c3020cc832ecb0e3a897c427a3838e0e180999ed8d905a9283fbb97 stunnel-5.16-installer.exe 2e559cc300b678fb2d05c2d2d3dc13d16cb44915f0165bea6290f741fccaa54c stunnel-5.16-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVM7KGAAoJEC78f/DUFuAUWwoQAJUnjUpyNLhjUQxRwScKjgNx AJ5OPZHXwVjX+xvtSSOjlkK/pk5l4SaEbNtq6hwMGliDpowXXDGXeYwNbmACXGuM sZWzdTUC69WKLQcwfTmn5BmsPQtczaCDQdyBVGSII4qg0mFIU4e1GYT0t8od7OcU n17nnRCLEaS2xlDwR5ImMuRjD+BdpEgZdiRXqtJkyjX8+aSRsEtSVjDBJ5wtsYNN 9pyMp8xU+7+sxX5GiLQ8+IcqcUq+W53nMJQZmN5vQ8O2ShxuBeZYdvembPhybvlE NrnfmjvDtl6A0iFs8ZhRRPTJZTKqj88UGhn49g3eQBH+CbNK08GalWCwR/uX8yFb +Z801mNIxJQrPnSlSaWLDPGNQ9GBqxliui1IR+Biv1KpmcPWBDAOI+Y7Hqyy1/5r MUDT9GB4HLZTC6aWtR0IyG30w3CvUmNr+sENu91ewvl0I1Z04yWyK+wQ3L3CbWyk aVBaNmt09pR8zgU9nvw8aAE2MLJ5oCgoangGpO6rEL0frh7TZhzD9sOMMVefKZDY rPPApyOiphH+3nnh9EiM357S9saXJMFe8/gNh6+lNXmYJ0ngMcPybz9mNV+RbbZU P1itA5RYBAwDTEJcpvATEj8ni9YPdDdFVmMrvC7ay5KZo0HWHxH23ryShBN9XYjC diuX4vtV2LMVYV5dlmAj =Eer2 -----END PGP SIGNATURE-----

1 0

Rewriting HTTP host header
by Veit Guna 19 Apr '15

19 Apr '15

Hi. After disabling SSLv3 I've got the same problem as: https://www.stunnel.org/pipermail/stunnel-users/2014-October/004814.html Sadly, he never got an answer. So I ask again, is it possible that stunnel could set the HTTP Host header to match the "connect = " setting? This way, Apache would accept that request instead of returning BAD REQUEST with AH02032. Thanks Veit

2 1

openvms and stunnel
by Coviello, Paul 17 Apr '15

17 Apr '15

Hello I'm trying to setup stunnel 4.20 yes it is an old version but the only one on HP's website for VMS. I need a little help in the conf files. Since I will be using telnet, do I need to put in each machines ip address that will be connecting? So in the example below do I create a listing of connects? [telnet] accept = 999 connect = 192.168.0.1:993 Thanks Paul Paul J Coviello Senior System Administrator CCS Corporate Headquarters Two Wells Avenue, Newton, MA 02459 617.965.2000, Ext. 4004 [cid:[email protected]] [cid:[email protected]] CCS Commercial, LLC | CCS Resources, Inc. | ClaimAssist, LLC | Credit Control Services, Inc. Customer Contact Solutions, LLC | Enterprise Associates, LLC

4 21

stunnel 5.15 release
by Michal Trojnara 16 Apr '15

16 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.15 of stunnel. The ChangeLog entry: Version 5.15, 2015.04.16, urgency: LOW: * New features - Added new service-level options "checkHost", "checkEmail" and "checkIP" for additional checks of the peer certificate subject. These options require OpenSSL version 1.0.2 or higher. - Win32 binary distribution now ships with the Mozilla root CA bundle. This bundle is intended be used together with the new "checkHost" option to validate server certs accepted by Mozilla. - New commandline options "-reload" to reload the configuration file and "-reopen" to reopen the log file of stunnel running as a Windows service (thx to Marc McLaughlin). - Added session persistence based on negotiated TLS sessions. https://en.wikipedia.org/wiki/Load_balancing_%28computing%29#Persistence The current implementation does not support external TLS session caching with sessiond. - MEDIUM ciphers (currently SEED and RC4) are removed from the default cipher list. - The "redirect" option was improved to not only redirect sessions established with an untrusted certificate, but also sessions established without a client certificate. - OpenSSL version checking modified to distinguish FIPS and non-FIPS builds. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. - Removed support for OpenSSL versions older than 0.9.7. The final update for the OpenSSL 0.9.6 branch was 17 Mar 2004. - "sessiond" support improved to also work in OpenSSL 0.9.7. - Randomize the initial value of the round-robin counter. - New stunnel.conf templates are provided for Windows and Unix. * Bugfixes - Fixed compilation against old versions of OpenSSL. - Fixed memory leaks in certificate verification. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 58ff4645eb5d6bd64e6ddedaa683534302f75625c531e8a6364badcac0541cba stunnel-5.15.tar.gz 08316dc39f72f10f7b28a67e25ddf90f3f189208b09562c12d81478c6ca2e782 stunnel-5.15-installer.exe db96edbe66f1c3524e51f21b47cc541953d1659e746765a43d0272cfe60712b0 stunnel-5.15-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVL7wqAAoJEC78f/DUFuAU+30P/Ar197tSUJC0+sLBXwddWkm4 J7d9lFThQFECDDSIqaFYfCuecIgGHk8LUVq8nQHh21H1tvpPp7SnYHkzOLsb2w/y G7rLdA+a8BgRTUF3rMxTyghL78Yor88OLI8J93U7pkQkl0bIZpiITn838R5x9/NP +nGTgqy3U5tNoXALBQ/tLZCNML/XaEyxfrbdStOslV5Ay3m23RPw9wqgD4tJoWqe 5x52sMmLh0nhE5lX3xAKxzabVcioAaqVlBEgK1/ZKJj709Olcv14HZcOWzWhWkka MR0ItrZMkYf3lLk/StDm3s2BakKRraRustxlK8wAV4ci7t/IBnWshIpYIij9Nzct HNOT10GjWpN6pwwixNcMBUn7/wDNjiRVw/1n/keL84qSYry54Czo1LpBra1lMCmg 8WENkpJbaNFHvXI4rEzZkiPdlG16tXHF33CcYxwrT8bCXa+Uk4i8c98TJ2jfOaUv VFVLWxFtK4ydoppgOo2eRuymVPNK4HbLZnLPL874xPlHpYjRl5ndClLeDpkDzgJv 8y6zdYwJLFbinWGGHTZIVlyQQfKzB1NDCfXxknsbxtCpZt5Ja0Ka+oS6kcOMZz6f CjYpmd52wjEtAoxxxsjGGrYsO3q0sn0UU3Kc97lGGS/MsgbXFYDnSGqP+p8lzDoq urHG9EjMxXNMcnmKp9JQ =XLyZ -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] Understanding communication
by josealf＠rocketmail.com 16 Apr '15

16 Apr '15

Claudia, Yes, to create a tunnel you need to configure stunnel on both sides, except in those cases when one of the extremes already supports TLS. Looks like yours is not one of those cases. Regards, Jose -----Original Message----- From: "Claudia Porta" <claudia.porta(a)bancaakros.it> Sender: "stunnel-users" <stunnel-users-bounces(a)stunnel.org> Date: Wed, 15 Apr 2015 14:51:07 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Understanding communication _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Verifying TLS authentication via stunnel logs
by shanmuganathan sedukumar 16 Apr '15

16 Apr '15

We have a requirement to send emails via a SMTP server which requires TLS authentication. Going through some logs we tried changing the parameter "SSLversion = TLSv1", but still getting authentication failure. So, we would like to verify if stunnel is trying to sending request via TLS method before looking for any issues at SMTP end. Is there a way we can verify from stunnel logs if the request is sent via TLS? Thanks & Regards,Shanmu

1 0

Session is active but I cannot connect
by daninho dj 09 Apr '15

09 Apr '15

Hi guys, I am struggling with a problem for some time. I searched about this problem in the stunnel mails archives and also on Google but couldn't find a solution and I ran out of ideas so I was thinking to write you about it. I am using Eclipse to access and manipulate the data from a linux server. I want to use stunnel when I connect to the server via Eclipse, so I installed and configured everything as it follows: The server I am using is SuSE Linux and the stunnel version which I installed is this one: *stunnel 4.27 on x86_64-suse-linux-gnu with OpenSSL 0.9.8j-fips 07 Jan 2009* The stunnel version on Windows 7 is: *stunnel version 5.10* In the conf file from linux (server) I have the following configuration for stunnel.conf: *client = no* *chroot = /var/lib/stunnel/* *setuid = root* *setgid = root* *pid = /var/run/stunnel.pid* *debug = 7* *output = /var/log/stunnel/stunnel.log* *cert = /etc/ssl/certs/stunnel.pem* *sslVersion = SSLv3* *[test]* *accept = 2404* *connect = 2406* In the conf file from windows (client) I have the following configuration in stunnel.conf: *debug = 7* *output = C:\Program Files (x86)\stunnel\stunnel.log* *cert = C:\Program Files (x86)\stunnel\stunnel.pem* *sslVersion = SSLv3* *[test]* *client = yes* *accept = 127.0.0.1:2404 <http://127.0.0.1:2404>* *connect = xx.xxx.xxx.xxx:2406* In the log I have this: 2015.04.09 13:48:04 LOG5[11060]: Configuration successful 2015.04.09 13:48:04 LOG7[11060]: Listening file descriptor created (FD=452) 2015.04.09 13:48:04 LOG7[11060]: Service [test] (FD=452) bound to 127.0.0.1:2404 2015.04.09 13:48:07 LOG7[11060]: Service [test] accepted (FD=496) from 127.0.0.1:56675 2015.04.09 13:48:07 LOG7[11060]: Creating a new thread 2015.04.09 13:48:07 LOG7[11060]: New thread created 2015.04.09 13:48:07 LOG7[2088]: Service [test] started 2015.04.09 13:48:07 LOG5[2088]: Service [test] accepted connection from 127.0.0.1:56675 2015.04.09 13:48:07 LOG6[2088]: s_connect: connecting xx.xxx.xxx.xxx:2406 2015.04.09 13:48:07 LOG7[2088]: s_connect: s_poll_wait xx.xxx.xxx.xxx:2406: waiting 10 seconds 2015.04.09 13:48:07 LOG5[2088]: s_connect: connected xx.xxx.xxx.xxx:2406 2015.04.09 13:48:07 LOG5[2088]: Service [test] connected remote server from 127.0.0.1:56676 2015.04.09 13:48:07 LOG7[2088]: Remote socket (FD=516) initialized 2015.04.09 13:48:07 LOG6[2088]: SNI: sending servername: *my_server_name* 2015.04.09 13:48:07 LOG7[2088]: SSL state (connect): before/connect initialization 2015.04.09 13:48:07 LOG7[2088]: SSL state (connect): SSLv3 write client hello A 2015.04.09 13:48:08 LOG3[2088]: SSL_connect: Peer suddenly disconnected 2015.04.09 13:48:08 LOG5[2088]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.04.09 13:48:08 LOG7[2088]: Remote socket (FD=516) closed 2015.04.09 13:48:08 LOG7[2088]: Local socket (FD=496) closed 2015.04.09 13:48:08 LOG7[2088]: Service [test] finished (0 left) Although in the stunnel log it's showing *s_connect: connected* I cannot connect at all. When I try to connect via port 2406, the stunnel icon shows that the server is idle and I have nothing in the log about it. When I try to connect via port 2404, the stunnel icon shows that the there are 2 active sessions but I cannot connect to the server. I tried switching the ports (2404 with 2406 and 2406 with 2404 in the stunnel.conf file) but stunnel doesn't even open in that case. Do you have any idea what might could be the problem and how could I solve it? Thanks in advance! Best Regards, Daninho --

3 6

Stunnel 5.0x compile issues
by Michael Curran 06 Apr '15

06 Apr '15

Hello -- I am running the following commands to compile openssl (with FIPS support) and stunnel * Base config for FIPS cd openssl-fips-2.0.9 echo "./config" ./config * OpenSSL with shared and custom install location cd openssl-1.0.1m echo "./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib" ./config fips shared --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib/ * Stunnel with FIPs (autodetect is working , I just added it to force it) cd stunnel-5.09 echo "make clean" make clean echo "./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips" ./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips You can see that my custom OpenSSL is reporting that it is built with -fips root@host:/var/tmp# /usr/local/openssl-100/bin/openssl version OpenSSL 1.0.1m-fips 19 Mar 2015 But when I'm done with all the compile options -- I only see the base version of OpenSSL 1.0.1m , and this same script with Stunnel 4.53 shows OpenSSL 1.0.1m-fips Is there something I am missing during the configure for Stunnel that is causing it to NOT see openssl is compiled with FIPs? root@host:/var/tmp# stunnel -version stunnel 5.09 on x86_64-unknown-linux-gnu platform Compiled with OpenSSL 1.0.1m 19 Mar 2015 Running with OpenSSL 1.0.1 14 Mar 2012 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

Disconnect immediately after sending a message successfully
by Swallow 02 Apr '15

02 Apr '15

Hi, Can you give me a hand? We sent messages to a server over SSL. But stunnel showed disconnect from remote server as soon as we sent out logon message correctly. We close down the fire wall. Dose we misunderstand the mechanism of stunnel? Could someone help me? Thank you very much. Regards, Yan

1 0

Log rotation for Windows
by John Smith 31 Mar '15

31 Mar '15

Hi I came across this thread, I know it's old... http://mailing.unix.stunnel-users.narkive.com/QOEx4XQz/stunnel-users-log-ro… And it says that's it's on the todo list, though I don't see anything indicating this on the list. So is log rotation implemented for Windows and if so what is the config parameter? Thanks

2 5

Stunnel not receiving connections on ports 465 & 587
by James Brown 31 Mar '15

31 Mar '15

I am running Stunnel 5.14 on my Mac mail server (OS X 10.7.5), but trying to send emails using ports 465 & 587 does not work: Mail.app says: Mail was unable to connect to server “mail.bordo.com.au <http://mail.bordo.com.au/>” using SSL on port 587. Verify that this server supports SSL and that your account settings are correct. Log from Stunnel is: 2015.03.31 09:27:56 LOG7[ui]: Clients allowed=500 2015.03.31 09:27:56 LOG5[ui]: stunnel 5.14 on x86_64-apple-darwin11.4.2 platform 2015.03.31 09:27:56 LOG5[ui]: Compiled/running with OpenSSL 1.0.2a 19 Mar 2015 2015.03.31 09:27:56 LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2015.03.31 09:27:56 LOG7[ui]: errno: (*__error()) 2015.03.31 09:27:56 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2015.03.31 09:27:56 LOG5[ui]: UTF-8 byte order mark not detected 2015.03.31 09:27:56 LOG5[ui]: FIPS mode disabled 2015.03.31 09:27:56 LOG7[ui]: Compression disabled 2015.03.31 09:27:56 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2015.03.31 09:27:56 LOG7[ui]: PRNG seeded successfully 2015.03.31 09:27:56 LOG6[ui]: Initializing service [ssmtp] 2015.03.31 09:27:56 LOG6[ui]: Loading certificate from file: /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG6[ui]: Loading key from file: /usr/local/etc/postfix/smtpd.key 2015.03.31 09:27:56 LOG7[ui]: Private key check succeeded 2015.03.31 09:27:56 LOG7[ui]: DH initialization 2015.03.31 09:27:56 LOG7[ui]: Using DH parameters from /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG7[ui]: DH initialized with 2048-bit key 2015.03.31 09:27:56 LOG7[ui]: ECDH initialization 2015.03.31 09:27:56 LOG7[ui]: ECDH initialized with curve prime256v1 2015.03.31 09:27:56 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.03.31 09:27:56 LOG6[ui]: Initializing service [ssmtp2] 2015.03.31 09:27:56 LOG6[ui]: Loading certificate from file: /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG6[ui]: Loading key from file: /usr/local/etc/postfix/smtpd.key 2015.03.31 09:27:56 LOG7[ui]: Private key check succeeded 2015.03.31 09:27:56 LOG7[ui]: DH initialization 2015.03.31 09:27:56 LOG7[ui]: Using DH parameters from /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG7[ui]: DH initialized with 2048-bit key 2015.03.31 09:27:56 LOG7[ui]: ECDH initialization 2015.03.31 09:27:56 LOG7[ui]: ECDH initialized with curve prime256v1 2015.03.31 09:27:56 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.03.31 09:27:56 LOG5[ui]: Configuration successful 2015.03.31 09:27:56 LOG7[ui]: Listening file descriptor created (FD=6) 2015.03.31 09:27:56 LOG7[ui]: Service [ssmtp] (FD=6) bound to 0.0.0.0:465 2015.03.31 09:27:56 LOG7[ui]: Listening file descriptor created (FD=7) 2015.03.31 09:27:56 LOG7[ui]: Service [ssmtp2] (FD=7) bound to 0.0.0.0:587 /usr/local/etc/stunnel/stunnel.conf has: [ssmtp] client = no accept = 465 connect = 127.0.0.1:25 [ssmtp2] client = no accept = 587 connect = 127.0.0.1:25 The mail server is running on the same machine. I can send emails using port 25 with no SSL. (I have to have the ‘Allow insecure authentication’ ticked). When I try to send using ports 587 or 465 there is nothing logged by stunnel (or anywhere else that I can see). Firewall is not blocking anything: sudo ipfw list 65535 allow ip from any to any Postfix is the SMTP server, Dovecot for IMAP. Any suggestions? Thanks, James.

2 2

5.xx Windows binaries - FIPS compliant?
by Rob Lockhart 30 Mar '15

30 Mar '15

I apologize if this was asked in the past. I couldn't find any references to my question in the lists except this (related but not answering the question): http://www.stunnel.org/pipermail/stunnel-users/2014-July/004673.html http://www.stunnel.org/pipermail/stunnel-users/2012-November/003963.html I understand how to compile Stunnel from source, and the FIPS canister for OpenSSL, then build OpenSSL with this FIPS canister, then build Stunnel using that OpenSSL. My question is for the Windows version with filename "stunnel-5.13-installer.exe". That compiled version doesn't seem to be built with FIPS canister, as the log shows: "Compiled/running with OpenSSL 1.0.2a 19 Mar 2015" without a "-fips" appendage after the OpenSSL version. In other words, if it was built as FIPS-compliant, it would show: "Compiled/running with OpenSSL 1.0.2a-fips 19 Mar 2015" It may support the FIPS options (in the config file) but it's not FIPS-compliant. I also assume that this doesn't preclude the FIPS options in the config file from working. Specifically, FIPS-compliant does NOT imply that FIPS mode cannot be enabled. Am I understanding this correctly? Thanks, -Rob

2 2

Libressl with stunnel
by jungle Boogie 29 Mar '15

29 Mar '15

Hello All, It appears that stunnel still requires openssl and cannot use libressl. Have the developers considered this patch: https://github.com/sabotage-linux/sabotage/commit/9b47cbbf3ce903dee042c45c8… This is from stunnel 5.02 days but are there any issues with applying this with 5.14? -- ------- inum: 883510009027723 sip: jungleboogie(a)sip2sip.info xmpp: jungle-boogie(a)jit.si

2 2

stunnel 5.14 release
by Michal Trojnara 25 Mar '15

25 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.14 of stunnel. The ChangeLog entry: Version 5.14, 2015.03.25, urgency: HIGH: * Security bugfixes - The "redirect" option now also redirects clients on SSL session reuse. In stunnel versions 5.00 to 5.12 reused sessions were never redirected regardless of their certificate verification result. This vulnerability was reported by Johan Olofsson. * New features - Windows service is automatically restarted after upgrade. * Bugfixes - Fixed a memory allocation error during Unix daemon shutdown. - Fixed handling multiple connect/redirect destinations. - OpenSSL FIPS builds are now correctly reported on startup. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 2197b4fc1db82eba69c8baf1fac30f0767af26e9f8c7e9e1d5a4a8fbb264695a stunnel-5.14.tar.gz 29364b3f07a84245fe1b0f8373d96c9924650a8058e602670a67a2da07a801bd stunnel-5.14-installer.exe e3b48534bb4a5f8237e4ed1aa4990ed8485bdf97f6e0b8da2507dbd9b5cad34c stunnel-5.14-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVEs/mAAoJEC78f/DUFuAUNq4P/A7Ap1NkzfhZQJWJMJthar1P hoVHIzuH7dGbRt4C5s0PgbC4S9UOz8wdcKbsNcPJRQf0PXP5oVARo2bx+3dV9uAC /6GRL+a5Rj8HU5vG4UX/9D5D0pvwcyFkk7sIxUhyeKSHcEH354Vgw0AlJM6GiWKG nwE5RJ3JTdxi8A4e10p3ZKnPg4Y0eWmpkm1qkqH9RWKj9+BbLaPt7ZvRBNYNicq3 3BtVaJ5KLGvWaQRww+llhvPnR2K+h7PnJiaIKm/cIHzbP8VLjoVWy/Dk5EOku6Zg iCfz8uFzezz+9NwwjjEl2KfGUNdBaZf02R2LqN57pTZyBPZNVH9G7IE1/BGJh7Ai f440LTC29OB7qnJThDRdU16x/Iz+NTcc1QFK4x7eTD+nTouUuyZh9Md0x4DD9jwk CL3dHZ6abUO9j7V04Sb8+wfWzP/pZdilWLyY1jj8L41EPXyb0DE3ZsrHyN7lJ2Fx OihfevJhB9bzCzXiLg0oW61YRUm5prRTxMaeTAC53fITlvx0yf9pHFNy0OtoTNr+ t0Skf/LMaZnvU0rE0UBSjqQbpKNaRff5zsGrI/NLgk98X/NTdakgrgsS0jjaQgYm 7mgH4mKoI9qL2YUMw7d9eGg8j8I9qewhaQYjVz4kGoq9YOCVhh69XormcGMAXXjY gf3RNVLzQH4N19TYz5a8 =lrVy -----END PGP SIGNATURE-----

1 0

Multiple versions of TLS in config?
by Rob Lockhart 25 Mar '15

25 Mar '15

Unless I'm mistaken, stunnel version 5 currently supports the options shown below for sslVersion: all => TLS v1.0, TLS v1.1, TLS v1.2, SSLv2, SSLv3 TLSv1 => TLS v1.0 only (not TLS v1.1, TLSv1.2, SSLv2 or SSLv3) TLSv1.1 => TLS v1.1 only TLSv1.2 => TLS v1.2 only In order to support TLS v1.0, TLS v1.1 and TLS v1.2 but disable SSLv2 and SSLv3, you should have in the config file: sslVersion = all options = NO_SSLv2 options = NO_SSLv3 (those last two lines may be default in the new Stunnel). However, what if I want to just have TLSv1.1 and TLSv1.2 but NOT TLSv1.0? I last tried this with Stunnel v5.10 but nothing in the changelogs tells me that this behavior has been changed to choose a list of protocols; only one parameter is accepted. Is there a way to allow TLSv1.1 and TLSv1.2 but disallow TLSv1.0? Thanks, -Rob

2 1

Stunnel urgency: HIGH versus LOW
by Rob Lockhart 24 Mar '15

24 Mar '15

Hello, I just noticed a urgency discrepancy for Stunnel 5.12 on the website (both of these links are under the Downloads section): https://www.stunnel.org/versions.html - shows 5.12 urgency as HIGH https://www.stunnel.org/sdf_ChangeLog.html - shows 5.12 urgency as LOW I don't know if it makes a difference with 5.13 available (assuming urgency = LOW) but I think 5.12 should have urgency=HIGH. Thanks, -Rob

1 0

Definition of accept/local/remote sockets
by David Wittman 21 Mar '15

21 Mar '15

Is there a clear definition of what stunnel defines as the accept, local, and remote sockets below? > socket = a|l|r:OPTION=VALUE[:VALUE] > Set an option on accept/local/remote socket From: http://www.stunnel.org/static/stunnel.html It seems to me that the accept and local socket would be the same thing. Thanks, Dave

3 3

Receive from secure servers
by Info ITsatWork 21 Mar '15

21 Mar '15

Hello, A company which we work with wants to send secure (TLS) mails to our server. I think stunnel can do the trick for me, as our own server (Scalix) doesn't support TLS for itself. Now I set up stunnel and it looks like its working, except it's not receiving secured mails. I can still receive normal mails, so somehow it is not working. I used the sample config and filled in the things I thought I needed. My config: ; Sample stunnel configuration file for Unix by Michal Trojnara 2002-2015 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; A copy of some devices and system files is needed within the chroot jail ; Chroot conflicts with configuration file reload and many other features ; Remember also to update the logrotate configuration. ;chroot = /usr/local/var/lib/stunnel/ ; Chroot jail can be escaped if setuid option is not used ;setuid = nobody ;setgid = nogroup ; PID file is created inside the chroot jail (if enabled) ;pid = /usr/local/var/run/stunnel.pid ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** client = no ; Certificate/key is needed in server mode and optional in client mode cert = /usr/local/etc/stunnel/stunnel.pem ;key = /usr/local/etc/stunnel/mail.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /usr/local/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively CRLfile can be used ;CRLfile = /usr/local/etc/stunnel/crls.pem ;sslVersion = all ; Enable support for the insecure SSLv2 protocol ;options = NO_SSLv2 ; Enable support for the insecure SSLv3 protocol ;options = NO_SSLv3 ; Workaround for Eudora bug ; options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Service definitions (remove all services for inetd mode) * ; ************************************************************************** ; Example SSL server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 192.168.1.102:25 connect = 192.168.1.102:26 protocol = smtp ; Example SSL client mode services ;[gmail-pop3] ;client = yes ;accept = 127.0.0.1:110 ;connect = pop.gmail.com:995 ;[gmail-imap] ;client = yes ;accept = 127.0.0.1:143 ;connect = imap.gmail.com:993 ;[gmail-smtp] ;client = yes ;accept = 127.0.0.1:25 ;connect = smtp.gmail.com:465 ; Example SSL front-end to a web server ;[https] ;accept = 443 ;connect = 80 ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL ; Microsoft implementations do not use SSL close-notify alert and thus ; they are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; vim:ft=dosini This is what I see in the logfiles for the mails I don't receive: 2015.03.21 14:56:46 LOG7[main]: Service [ssmtp] accepted (FD=12) from 207.46.163.207:8478 2015.03.21 14:56:46 LOG7[2]: <- EHLO na01-by2-obe.outbound.protection.outlook.com 2015.03.21 14:56:46 LOG7[2]: -> 250-mailserver.mydomain.nl 2015.03.21 14:56:46 LOG7[2]: -> 250 STARTTLS 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 read client key exchange A 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 read finished A 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 write change cipher spec A 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 write finished A 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 flush data 2015.03.21 14:56:46 LOG7[1]: 1 items in the session cache 2015.03.21 14:56:46 LOG7[1]: 0 client connects (SSL_connect()) 2015.03.21 14:56:46 LOG7[1]: 0 client connects that finished 2015.03.21 14:56:46 LOG7[1]: 0 client renegotiations requested 2015.03.21 14:56:46 LOG7[1]: 1 server connects (SSL_accept()) 2015.03.21 14:56:46 LOG7[1]: 1 server connects that finished 2015.03.21 14:56:46 LOG7[1]: 0 server renegotiations requested 2015.03.21 14:56:46 LOG7[1]: 0 session cache hits 2015.03.21 14:56:46 LOG7[1]: 0 external session cache hits 2015.03.21 14:56:46 LOG7[1]: 0 session cache misses 2015.03.21 14:56:46 LOG7[1]: 0 session cache timeouts 2015.03.21 14:56:46 LOG6[1]: No peer certificate received 2015.03.21 14:56:46 LOG6[1]: SSL accepted: new session negotiated 2015.03.21 14:56:46 LOG6[1]: Negotiated TLSv1 ciphersuite AES256-SHA (256-bit encryption) 2015.03.21 14:56:46 LOG7[1]: Compression: null, expansion: null 2015.03.21 14:56:46 LOG7[3]: Service [ssmtp] started 2015.03.21 14:56:46 LOG5[3]: Service [ssmtp] accepted connection from 207.46.163.207:8478 2015.03.21 14:56:46 LOG6[3]: s_connect: connecting 192.168.1.102:26 2015.03.21 14:56:46 LOG7[3]: s_connect: s_poll_wait 192.168.1.102:26: waiting 10 seconds 2015.03.21 14:56:46 LOG5[3]: s_connect: connected 192.168.1.102:26 2015.03.21 14:56:46 LOG5[3]: Service [ssmtp] connected remote server from 192.168.1.102:22148 2015.03.21 14:56:46 LOG7[3]: Remote socket (FD=13) initialized 2015.03.21 14:56:46 LOG6[1]: Read socket closed (readsocket) 2015.03.21 14:56:46 LOG7[1]: Sending close_notify alert 2015.03.21 14:56:46 LOG7[1]: SSL alert (write): warning: close notify 2015.03.21 14:56:46 LOG6[1]: SSL_shutdown successfully sent close_notify alert 2015.03.21 14:56:46 LOG7[2]: <- STARTTLS 2015.03.21 14:56:46 LOG7[2]: -> 220 Go ahead 2015.03.21 14:56:46 LOG7[2]: SSL state (accept): before/accept initialization 2015.03.21 14:56:46 LOG7[3]: RFC 2487 detected 2015.03.21 14:56:46 LOG7[3]: <- 220 mailserver.rsconsultancy.nl ESMTP Scalix SMTP Relay 11.4.6.13676; Sat, 21 Mar 2015 14:56:46 +0100 (CET) 2015.03.21 14:56:46 LOG7[3]: -> 220 mailserver.rsconsultancy.nl stunnel for ESMTP Scalix SMTP Relay 11.4.6.13676; Sat, 21 Mar 2015 14:56:46 2015.03.21 14:56:46 LOG6[1]: SSL socket closed (SSL_read) 2015.03.21 14:56:46 LOG7[1]: Sent socket write shutdown 2015.03.21 14:56:46 LOG5[1]: Connection closed: 52 byte(s) sent to SSL, 6 byte(s) sent to socket 2015.03.21 14:56:46 LOG7[1]: Remote socket (FD=9) closed 2015.03.21 14:56:46 LOG7[1]: Local socket (FD=3) closed 2015.03.21 14:56:46 LOG7[1]: Service [ssmtp] finished (2 left) Could anyone please tell me what I'm doing wrong? Jeroen

2 1

stunnel 5.13 released
by Michal Trojnara 20 Mar '15

20 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.13 of stunnel. The ChangeLog entry: Version 5.13, 2015.03.20, urgency: MEDIUM: * New features - The "service" option was modified to also control the syslog service name. * Bugfixes - Fixed Windows service crash. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 71b4efb3814ec298124ec78386d756ee2cba9c999e7f9571bb8abcef317f04b5 stunnel-5.13.tar.gz bc5e8dc34ef32d92fb088afd18bae504ae4619b860f2a3ebb5e0af5e6b3531cd stunnel-5.13-installer.exe 1740861d1ff0e6f0146d181e832a4634ed4a13fdf52b50e12bb63c41d550579e stunnel-5.13-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVC/XkAAoJEC78f/DUFuAUtvwP/jUHwfoKRfT9eF5q8KV/gINx DxIs6bEf84hjw43n+tHCuPEJgXp8p9UYKR2MF5wHrYv7Wv0MqvRGZZvImY9qIwU/ ev3ZXpZTCo3hOn+kNeeQczuBfLfdNx/O11J0BxkSAJFz9mTeM4mxWoPqx/PP/Q54 mih/Jg17VobRPJXJRZlX8pabevO3wPteGT2t8Vd+JB3jTZzVgZBZXI+S9tr9evuD G2vHVz2f7aLRIw9wXIcM5k4HgNM4F8Oe0t9Y/RPkugvLJq7UZ5tskhNIa5+So3qG O/sYQSGfL77KI82N/k89tMj2ksGK9oNvKLCI1rpCKJOIIv58m3zyMlaXWWTJkETP vxxeSzwCvGkoL2Jzwomi2a1ev1Tqjwia2zjzFexPgHZCTxVLa4rGRJDBZcwWDtAl So7g7JjKI9QASP38ZT0G/0X8LQjtrMiKrfcU7eDhgRLfiQbyaV5h1g5GNJv4uAac 0qA8ho0VwOLXHT4Ny1V2d/wDuWTrcUl8f2wqlRnUGcEfoHH9ejkoLw0FcQ7RFm51 B9QCE/ntTKXknMWys9A/NSEmQ02KYGlVnTq++gjfvR927Wkr1dFCW3xj3fx8K+JW uWRLf61VjT72s2Qsx6HxyoYw3Yh9ehJo5Xm48iFAkvSnnk/7rQu8c1lazDtuRgRr YYViDon00Bx1ktaxlJPN =Q4iO -----END PGP SIGNATURE-----

1 0

stunnel 5.12 released
by Michal Trojnara 19 Mar '15

19 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.12 of stunnel. The ChangeLog entry: Version 5.12, 2015.03.19, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.2a. https://www.openssl.org/news/secadv_20150319.txt * New features - New service-level option "logId" to specify the connection identifier type. Currently supported types: "sequential" (default), "unique", and "thread". - New service-level option "debug" to individually control logging verbosity of defined services. * Bugfixes - OCSP fixed on Windows platform (thx to Alec Kosky). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 80c3d350c9b3e4438143fcc77c915026ae338f8174bb730ff117ca438ba84847 stunnel-5.12.tar.gz aa1a241009172636e07eb2260e43cec28ba1da4348e74abae52598a41eed478a stunnel-5.12-installer.exe 6c377c045768007ef14830227ae8637ba97a2bb225e3bad98179febd020ef6b2 stunnel-5.12-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVCuLXAAoJEC78f/DUFuAUDPkQAM22z+jWYIfzUHqg5o2cDzLS KBinjzmymoYw2mpGRjjBW/dNIVcBBnk2DhaYMaTrVFSxdFhDjZATXekFxiIotBGn YjM5EKmdkiguNQcEcR+a72Lh+fjDB3w7o0tDtXoD9+cfLr7tiwV7WLo1WwqeAdOi Do4u0RJZE6INd7O5EMKDMWpsEp1AxIGEXyEY9brZxptS6pow0+fwJnIaLcE3ZYje 6XAIFw4nSIyvfEhe6d7vmB5pmSidNrJlvOpi2ui3MxdS1ZBYEhNbwiPujeG3mb02 5i0RnJLocY0gBa/j5wTWnpamQt8HdO6L2MP/vo7Wqg66663/4k0KtfaNmY5azQ98 JrCibZNU9GlXkhgAz65ORVHVr4Bh7Aq65W5mlrKt1DRopnI4/dawWORjKN6rJYeU vcwsStAG/adukFO++TaDq+4NJTZ9GEn7XrNp3cgfVkd8L68vTTgbwRzQ1kWoAlz4 D2AozchqPfe2QIlsGQ7JfcnZsEgAy34HSLpst5LntudXDwZiHmxRzcg0604YWe2I 7Y4XGs1SxVBsURRi/KCLRKDwH8SiAqB4SP79tOtxEqMEIN6kpiagsKn0yMgFzVBH Irdbz/WfFmJzwh1YZ2uXjBT9U6H7lYrkz1AEMJ7DzKwGcP8B1sdDBzBtppkfZdam Y4NUI7wsPUexvBb8AB8h =dqXf -----END PGP SIGNATURE-----

1 0

STunnel v5.11 Multi SNI
by Scott McKeown 18 Mar '15

18 Mar '15

Hi Michal, Thank you for the update and yes this does work but I feel that this is incorrect. Lets say that I have two domains domain.com newdomain.com If I'm load balancing these domains to different backend servers this will not work as it will always hit domain.com using this style of wildcard. I think it should be: sni = http:*.domain.com This will then split out the domains, I know that the chance of this being the case is low but I do believe that this should be how SNI is handled for this type of case. Regards, Scott -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 (24x7) Tel (US) - +1 888.867.9504 (Toll Free)(24x7)

1 0

STunnel v5.11 Multi SNI
by Scott McKeown 17 Mar '15

17 Mar '15

Hi Guys, I've got a small issue where I'm trying to use multiple SNI rules in an STunnel frontend: STunnel Version is: stunnel -version stunnel 5.11 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none stunnel.conf is: [https] accept = 443 connect = 80 [www_test] sni = https:test.com sni = https:www.test.com connect = 192.168.64.220:80 [testing] sni = https:testing.com sni = https:www.testing.com connect = 192.168.64.253:80 I've created local DNS rules for each of these Hosts but the problem is that only the last entered sni rule gets matched so for example www.test.com works but test.com does not. Its the same for testing.com and www.testing.com This is what the log file show too: 2015.03.03 20:01:19 LOG7[12776]: Service [https] accepted (FD=21) from 192.168.63.50:53123 2015.03.03 20:01:19 LOG7[12808]: Service [https] started 2015.03.03 20:01:19 LOG5[12808]: Service [https] accepted connection from 192.168.63.50:53123 2015.03.03 20:01:19 LOG7[12808]: SSL state (accept): before/accept initialization 2015.03.03 20:01:19 LOG6[12808]: SNI: requested servername: testing.com 2015.03.03 20:01:19 LOG3[12808]: SNI: no pattern matched servername: testing.com 2015.03.03 20:01:19 LOG7[12808]: SSL alert (write): fatal: unrecognized name 2015.03.03 20:01:19 LOG3[12808]: SSL_accept: 1408A0E2: error:1408A0E2:SSL routines:SSL3_GET_CLIENT_HELLO:clienthello tlsext 2015.03.03 20:01:19 LOG5[12808]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.03.03 20:01:19 LOG7[12808]: Local socket (FD=21) closed 2015.03.03 20:01:19 LOG7[12808]: Service [https] finished (7 left) 2015.03.03 20:01:29 LOG6[12805]: Read socket closed (readsocket) 2015.03.03 20:01:29 LOG7[12805]: Sending close_notify alert 2015.03.03 20:01:29 LOG7[12805]: SSL alert (write): warning: close notify 2015.03.03 20:01:29 LOG6[12805]: SSL_shutdown successfully sent close_notify alert 2015.03.03 20:01:30 LOG6[12805]: SSL socket closed (SSL_read) 2015.03.03 20:01:30 LOG7[12805]: Sent socket write shutdown 2015.03.03 20:01:30 LOG5[12805]: Connection closed: 485 byte(s) sent to SSL, 642 byte(s) sent to socket 2015.03.03 20:01:30 LOG7[12805]: Remote socket (FD=14) closed 2015.03.03 20:01:30 LOG7[12805]: Local socket (FD=13) closed 2015.03.03 20:01:30 LOG7[12805]: Service [www_test] finished (6 left) 2015.03.03 20:01:49 LOG7[12776]: Service [https] accepted (FD=13) from 192.168.63.50:53128 2015.03.03 20:01:49 LOG7[12809]: Service [https] started 2015.03.03 20:01:49 LOG5[12809]: Service [https] accepted connection from 192.168.63.50:53128 2015.03.03 20:01:49 LOG7[12809]: SSL state (accept): before/accept initialization 2015.03.03 20:01:49 LOG6[12809]: SNI: requested servername: testing.com 2015.03.03 20:01:49 LOG3[12809]: SNI: no pattern matched servername: testing.com 2015.03.03 20:01:49 LOG7[12809]: SSL alert (write): fatal: unrecognized name 2015.03.03 20:01:49 LOG3[12809]: SSL_accept: 1408A0E2: error:1408A0E2:SSL routines:SSL3_GET_CLIENT_HELLO:clienthello tlsext 2015.03.03 20:01:49 LOG5[12809]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.03.03 20:01:49 LOG7[12809]: Local socket (FD=13) closed 2015.03.03 20:01:49 LOG7[12809]: Service [https] finished (6 left) I have seen a couple of patch files floating around but they are for older versions and I can't get them to compile into the v5.11 version. Any thoughts? -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 (24x7) Tel (US) - +1 888.867.9504 (Toll Free)(24x7)

2 1

SSH connection problems inside stunnel
by debian＠bercot.org 13 Mar '15

13 Mar '15

Hello, I've installed a stunnel between my laptop and my server (both in Debian SID) [v5.06-2]. Here is my client stunnel.conf : pid = /var/run/stunnel.pid client = yes sslVersion = TLSv1.2 debug = 7 [ssh] accept = 5000 protocol = connect protocolHost = myserver:443 connect = myproxy:8080 The server one : cert = mycert key = mykey chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 sslVersion = TLSv1.2 ; https ou ssh encapsulé dans du ssl [sslh] accept = 443 connect = myserver:444 And my .ssh/config : Host myserver HostName localhost Port 5000 IdentityFile ~/.ssh/mykey ProtocolKeepAlives 6 At home (I use tinyproxy to test), everything is OK. At work, with a "true" proxy, sometimes I can connect (but I'm quickly disconnected), sometimes I can't... I've watch the logs but find nothing. Do you have any idea ? Something to look in the logs ? Here is an example of a short connection : ~ $ ssh myserver root@myserver:~# cat /var/log/syslog | grep stunnel [...] root@myserver~# Timeout, server localhost not responding. More often I have : ~ $ ssh myserver ssh_exchange_identification: Connection closed by remote host In my local logs : Mar 12 13:24:41 mylaptop stunnel: LOG7[3984]: Service [ssh] accepted (FD=3) from 127.0.0.1:44794 Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: Service [ssh] started Mar 12 13:24:41 mylaptop stunnel: LOG5[3223]: Service [ssh] accepted connection from 127.0.0.1:44794 Mar 12 13:24:41 mylaptop stunnel: LOG6[3223]: s_connect: connecting myproxy:8080 Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: s_connect: s_poll_wait myproxy:8080: waiting 10 seconds Mar 12 13:24:41 mylaptop stunnel: LOG5[3223]: s_connect: connected myproxy:8080 Mar 12 13:24:41 mylaptop stunnel: LOG5[3223]: Service [ssh] connected remote server from myIP:58282 Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: Remote socket (FD=8) initialized Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: -> CONNECT myserver:443 HTTP/1.1 Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: -> Host: myserver:443 Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: -> Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: <- HTTP/1.1 200 Connection established Mar 12 13:24:41 mylaptop stunnel: LOG6[3223]: CONNECT request accepted Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: <- Mar 12 13:24:41 mylaptop stunnel: LOG6[3223]: SNI: sending servername: myserver Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): before/connect initialization Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): unknown state Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): unknown state Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): unknown state Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): unknown state Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): unknown state Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): unknown state Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 54 items in the session cache Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 109 client connects (SSL_connect()) Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 110 client connects that finished Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 0 client renegotiations requested Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 0 server connects (SSL_accept()) Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 0 server connects that finished Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 0 server renegotiations requested Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 56 session cache hits Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 0 external session cache hits Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 0 session cache misses Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: SSL alert (read): warning: close notify Mar 12 13:24:43 mylaptop stunnel: LOG6[3223]: SSL closed (SSL_read) Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: Sent socket write shutdown Mar 12 13:24:43 mylaptop stunnel: LOG6[3223]: Read socket closed (readsocket) Mar 12 13:24:43 mylaptop stunnel: LOG6[3223]: Read socket closed (hangup) Mar 12 13:24:43 mylaptop stunnel: LOG6[3223]: Write socket closed (hangup) Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: Sending close_notify alert Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: SSL alert (write): warning: close notify Mar 12 13:24:43 mylaptop stunnel: LOG6[3223]: SSL_shutdown successfully sent close_notify alert Mar 12 13:24:43 mylaptop stunnel: LOG5[3223]: Connection closed: 32 byte(s) sent to SSL, 0 byte(s) sent to socket Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: Remote socket (FD=8) closed Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: Local socket (FD=3) closed Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: Service [ssh] finished (0 left) Thank you. David.

4 5

stunnel 5.11 released
by Michal Trojnara 11 Mar '15

11 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.11 of stunnel. The ChangeLog entry: Version 5.11, 2015.03.11, urgency: LOW: * New features - OpenSSL DLLs updated to version 1.0.2. - Removed dereferences of internal OpenSSL data structures. - PSK key lookup algorithm performance improved from O(N) (linear) to O(log N) (logarithmic). * Bugfixes - Fixed peer certificate list in the main window on Win32 (thx to @fyer for reporting it). - Fixed console logging in tstunnel.exe. - _tputenv_s() replaced with more portable _tputenv() on Win32. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 71a8bc37e58e34509b0267ade02292994c7a127f14d6e5ba03081db695edff8c stunnel-5.11.tar.gz 3511a4bf27bcffdb69c3b2b2d5989d0b1d7b033a28f0c8d53cdd622555326487 stunnel-5.11-installer.exe ccebef146d5c28854aa538e2ff8f7d1d1eb822d2ab51689aa88d39a1c3026776 stunnel-5.11-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVAG9SAAoJEC78f/DUFuAUT2YP+weeIxK38dCe5O49Tj/2Yh5p msWRsK3JPcLe9uFobCYfpuSvm5+rWKAF+tOBjPkKL024z1V9XTFca4aRK+0EJWdp 8ndM0HBKW9LzlQZ7IR1jIV23BWwKnBJi3D4xpTVFgxFHn6fO/WJzggOBSLsp299o pE643meivz8O182b54EhD4shLCm5XTtrltYSoi0fVMZ2MIBH4LoLVTknF3pH4St1 GrqAcV+5KgsMInRtJjtgkCDPsVYbCYze+8U+Lq1wehdZ/8n90rCsPqLvzDtff76O 99ohHSIPyhnZM5C1VWb1XADIrdsXoaS5hjcWv2ujS8h4zSW4wcugYC+LRTrDqrOo OaRuHvPF/vdHu8Jok+roxHh7IKxBSJ/W58+ubjwKVYRP+JRKn6JkK4FRcMVy9kMM HRFr/o1rzXk0O6epogSLuGT/mSJhy+o/VV781Ce5d+QkUswviVT6WSAjvT3/3VMM odkm2t7JIpvC06naVjjKzMg84BLLW8Phuyp3+6LBCqoTRj7FbjsRd1pSFYn3D/3L GMWt1kZ6YHam2mWE0j9AlW9hOyfbqlsgX4nux1x6ckUs0KvRMm34RONaECqV/VuU swf0PciswFa3739Ln3O47uDHVfPviW/CT4+HHMVXN7xmqMSnWqYkh9/oE05mNLFY xtbFUaOMt1K0phJkBsx9 =u9oG -----END PGP SIGNATURE-----

2 3

Download page broken
by Lukáš Helebrandt 09 Mar '15

09 Mar '15

Dear all, Downloads on https://www.stunnel.org/downloads.html seem to be broken. Clicking any link brings one back to the Downloads page (serves the downloads.html file). I noticed when deploying Streisand ( https://github.com/jlund/streisand ), which mirrors stunnel on each installation. Best, Lukas

3 2

Re: [stunnel-users] [stunnel-announce] stunnel 5.10 released - Problem compiling stunnel 5.10 with openssl 1.0.2
by WNSDEV 26 Feb '15

26 Feb '15

stunnel 5.10 openssl 1.0.2 Ubuntu 10.04 Server lucid after installing automake-1.14.1 (required as of 5.08) and running configure without a problem, make fails with this message: /usr/bin/ld: /ssl-1.0.2/lib/libssl.a(s2_srvr.o): relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC /ssl-1.0.2/lib/libssl.a: could not read symbols: Bad value I can resolve this issue by commenting the assignment of CFLAGS and LDFLAGS in the stunnel configure script so -fPIE and -pie -fPIE are not implemented. # stunnel_CFLAGS="$stunnel_CFLAGS -fPIE" # stunnel_LDFLAGS="$stunnel_LDFLAGS -pie -fPIE" This is not required in stunnel 5.07 or earlier versions. I'm not sure exactly what the issue is here.. can anyone explain what the conflict is? Thx Pete -----Original Message----- From: Michal Trojnara [mailto:[email protected]] Sent: Thursday, January 22, 2015 9:20 AM To: stunnel-users(a)stunnel.org; stunnel-announce(a)stunnel.org; openssl-users(a)openssl.org Subject: [stunnel-announce] stunnel 5.10 released -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.10 of stunnel. The ChangeLog entry: Version 5.10, 2015.01.22, urgency: LOW: * New features - OCSP AIA (Authority Information Access) support. This feature can be enabled with the new service-level option "OCSPaia". - Additional security features of the linker are enabled: "-z relro", "-z now", "-z noexecstack". * Bugfixes - OpenSSL DLLs updated to version 1.0.1l. https://www.openssl.org/news/secadv_20150108.txt - FIPS canister updated to version 2.0.9 in the Win32 binary build. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 032bfc1854f8a0b9e452343c36ec6b52c7e0daef0863423c6b13a61a7c92eb23 stunnel-5.10.tar.gz 7c29753b6488f37b29f365e9c4a6060c3da8a89000af1cd29eab7c37d419d148 stunnel-5.10-installer.exe 93cd0941580eaa7815ed62ec88a111cb449e9bad97cd1a35d7524867a8238234 stunnel-5.10-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlTBMTsACgkQ/NU+nXTHMtE+uQCg9N0butSpAQ2mM1M5ySe7T18i oe8AoOAHKJ9F7jMlUfHnmuzBtIPbbghN =e9ed -----END PGP SIGNATURE----- _______________________________________________ stunnel-announce mailing list stunnel-announce(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-announce

2 1

Gmail POP3 retrieval, SSL-Error and Cert Chain
by Tobias Ruch 24 Feb '15

24 Feb '15

Hi, I want to use stunnel to enable ssl on port 995. Unfortunately, I got "SSL error: Unable to verify the first certificate." when using the gmail pop3 retrieval My Certificate is signed by wosign and included in the mozialla truststore list. https://www.ssllabs.com/ssltest/analyze.html gives me a grad A for my apache configuration and chrome and firefox are also fine with this certificate. So it's no self signed one. For a test I have configured stunnel to serve https. I get than the message that the chain is incomplete. According to https://www.digicert.com/ssl-support/gmail-pop3-troubleshooting.htm this could be one reason for this error. My Apache-config looks like this SSLCertificateFile /etc/apache2/ssl/mydomain.crt SSLCertificateKeyFile /etc/apache2/ssl//mydomain.key SSLCertificateChainFile /etc/apache2/ssl/1_root_bundle.crt SSLCACertificateFile /etc/apache2/ssl/ca-certs.pem for stunnel I used cert = /etc/apache2/ssl/mydomain.crt key = /etc/apache2/ssl//mydomain.key CAfile = /etc/apache2/ssl/1_root_bundle.crt or ca-certs.pem (I have tried both). What is the a similar configuration in stunnel? The Post https://www.stunnel.org/pipermail/stunnel-users/2010-February/002594.html mentioned, that the chain must be completely in the crt-file. But a description how to achieve this is missing and I found no other resources describing this. Thanks a lot Tobias

1 0

Stunnel for EWS servers?
by shanmuganathan sedukumar 20 Feb '15

20 Feb '15

HI, We are already using stunnel as SSL wrapper for retrieving emails from POP3 servers to our application server. In future the mailboxes are planned to be migrated to EWS servers. Would like to know if stunnel holds good for EWS servers as well. Regards,Shanmuganathan

2 1

TLSv1 - Linux vs Windows ?
by Brian Ipsen 16 Feb '15

16 Feb '15

Hi I have a strange issue with stunnel 5.09 - which connects up to a F5 loadbalancer/SSL-offloading engine. In my config, I specify that the protocol must be TLSv1 - from Linux, I can connect - but it does not work from Windows.. Linux log: 2015.02.10 15:58:29 LOG7[22779]: Service [rb20] accepted (FD=3) from 127.0.0.1:33247 2015.02.10 15:58:29 LOG7[22887]: Service [rb20] started 2015.02.10 15:58:29 LOG5[22887]: Service [rb20] accepted connection from 127.0.0.1:33247 2015.02.10 15:58:29 LOG6[22887]: s_connect: connecting A.B.C.D:443 2015.02.10 15:58:29 LOG7[22887]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds 2015.02.10 15:58:29 LOG5[22887]: s_connect: connected A.B.C.D:443 2015.02.10 15:58:29 LOG5[22887]: Service [rb20] connected remote server from 10.11.12.101:33477 2015.02.10 15:58:29 LOG7[22887]: Remote socket (FD=11) initialized 2015.02.10 15:58:29 LOG6[22887]: SNI: sending servername: host.domain.com 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): before/connect initialization 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 write client hello A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 read server hello A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 read finished A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 write change cipher spec A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 write finished A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 flush data 2015.02.10 15:58:29 LOG7[22887]: 1 items in the session cache 2015.02.10 15:58:29 LOG7[22887]: 5 client connects (SSL_connect()) 2015.02.10 15:58:29 LOG7[22887]: 5 client connects that finished 2015.02.10 15:58:29 LOG7[22887]: 0 client renegotiations requested 2015.02.10 15:58:29 LOG7[22887]: 0 server connects (SSL_accept()) 2015.02.10 15:58:29 LOG7[22887]: 0 server connects that finished 2015.02.10 15:58:29 LOG7[22887]: 0 server renegotiations requested 2015.02.10 15:58:29 LOG7[22887]: 4 session cache hits 2015.02.10 15:58:29 LOG7[22887]: 0 external session cache hits 2015.02.10 15:58:29 LOG7[22887]: 0 session cache misses 2015.02.10 15:58:29 LOG7[22887]: 0 session cache timeouts 2015.02.10 15:58:29 LOG6[22887]: SSL connected: previous session reused 2015.02.10 15:58:29 LOG7[22779]: Service [rb20] accepted (FD=12) from 127.0.0.1:33249 2015.02.10 15:58:29 LOG6[22887]: Read socket closed (read hangup) 2015.02.10 15:58:29 LOG7[22887]: Sending close_notify alert 2015.02.10 15:58:29 LOG7[22887]: SSL alert (write): warning: close notify 2015.02.10 15:58:29 LOG6[22887]: SSL_shutdown successfully sent close_notify alert 2015.02.10 15:58:29 LOG7[22888]: Service [rb20] started 2015.02.10 15:58:29 LOG5[22888]: Service [rb20] accepted connection from 127.0.0.1:33249 2015.02.10 15:58:29 LOG6[22888]: s_connect: connecting A.B.C.D:443 2015.02.10 15:58:29 LOG7[22888]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds 2015.02.10 15:58:29 LOG5[22888]: s_connect: connected A.B.C.D:443 2015.02.10 15:58:29 LOG5[22888]: Service [rb20] connected remote server from 10.11.12.101:33479 2015.02.10 15:58:29 LOG7[22888]: Remote socket (FD=13) initialized 2015.02.10 15:58:29 LOG6[22888]: SNI: sending servername: ssl39.dmsave.com 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): before/connect initialization 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 write client hello A 2015.02.10 15:58:29 LOG6[22887]: SSL socket closed (SSL_read) 2015.02.10 15:58:29 LOG7[22887]: Sent socket write shutdown 2015.02.10 15:58:29 LOG5[22887]: Connection closed: 136 byte(s) sent to SSL, 52 byte(s) sent to socket 2015.02.10 15:58:29 LOG7[22887]: Remote socket (FD=11) closed 2015.02.10 15:58:29 LOG7[22887]: Local socket (FD=3) closed 2015.02.10 15:58:29 LOG7[22887]: Service [rb20] finished (1 left) 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 read server hello A 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 read finished A 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 write change cipher spec A 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 write finished A 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 flush data 2015.02.10 15:58:29 LOG7[22888]: 1 items in the session cache 2015.02.10 15:58:29 LOG7[22888]: 6 client connects (SSL_connect()) 2015.02.10 15:58:29 LOG7[22888]: 6 client connects that finished 2015.02.10 15:58:29 LOG7[22888]: 0 client renegotiations requested 2015.02.10 15:58:29 LOG7[22888]: 0 server connects (SSL_accept()) 2015.02.10 15:58:29 LOG7[22888]: 0 server connects that finished 2015.02.10 15:58:29 LOG7[22888]: 0 server renegotiations requested 2015.02.10 15:58:29 LOG7[22888]: 5 session cache hits 2015.02.10 15:58:29 LOG7[22888]: 0 external session cache hits 2015.02.10 15:58:29 LOG7[22888]: 0 session cache misses 2015.02.10 15:58:29 LOG7[22888]: 0 session cache timeouts 2015.02.10 15:58:29 LOG6[22888]: SSL connected: previous session reused Windows log: 2015.02.10 16:07:36 LOG7[9528]: Service [rb20] accepted (FD=1128) from 127.0.0.1:50353 2015.02.10 16:07:36 LOG7[9528]: Creating a new thread 2015.02.10 16:07:36 LOG7[9528]: New thread created 2015.02.10 16:07:36 LOG7[7056]: Service [rb20] started 2015.02.10 16:07:36 LOG5[7056]: Service [rb20] accepted connection from 127.0.0.1:50353 2015.02.10 16:07:36 LOG6[7056]: s_connect: connecting A.B.C.D:443 2015.02.10 16:07:36 LOG7[7056]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds 2015.02.10 16:07:36 LOG5[7056]: s_connect: connected A.B.C.D:443 2015.02.10 16:07:36 LOG5[7056]: Service [rb20] connected remote server from 192.168.225.103:50354 2015.02.10 16:07:36 LOG7[7056]: Remote socket (FD=1124) initialized 2015.02.10 16:07:36 LOG6[7056]: SNI: sending servername: host.domain.com 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): before/connect initialization 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write client hello A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read server hello A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read server certificate A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read server done A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write client key exchange A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write change cipher spec A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write finished A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 flush data 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read finished A 2015.02.10 16:07:36 LOG7[7056]: 1 items in the session cache 2015.02.10 16:07:36 LOG7[7056]: 1 client connects (SSL_connect()) 2015.02.10 16:07:36 LOG7[7056]: 1 client connects that finished 2015.02.10 16:07:36 LOG7[7056]: 0 client renegotiations requested 2015.02.10 16:07:36 LOG7[7056]: 0 server connects (SSL_accept()) 2015.02.10 16:07:36 LOG7[7056]: 0 server connects that finished 2015.02.10 16:07:36 LOG7[7056]: 0 server renegotiations requested 2015.02.10 16:07:36 LOG7[7056]: 0 session cache hits 2015.02.10 16:07:36 LOG7[7056]: 0 external session cache hits 2015.02.10 16:07:36 LOG7[7056]: 0 session cache misses 2015.02.10 16:07:36 LOG7[7056]: 0 session cache timeouts 2015.02.10 16:07:36 LOG7[7056]: Peer certificate was cached (1521 bytes) 2015.02.10 16:07:36 LOG6[7056]: SSL connected: new session negotiated 2015.02.10 16:07:36 LOG6[7056]: Negotiated TLSv1 ciphersuite RC4-MD5 (128-bit encryption) 2015.02.10 16:07:36 LOG7[7056]: Compression: null, expansion: null 2015.02.10 16:07:36 LOG6[7056]: Read socket closed (readsocket) 2015.02.10 16:07:36 LOG7[7056]: Sending close_notify alert 2015.02.10 16:07:36 LOG7[7056]: SSL alert (write): warning: close notify 2015.02.10 16:07:36 LOG6[7056]: SSL_shutdown successfully sent close_notify alert 2015.02.10 16:07:36 LOG7[9528]: Service [rb20] accepted (FD=1132) from 127.0.0.1:50355 2015.02.10 16:07:36 LOG7[9528]: Creating a new thread 2015.02.10 16:07:36 LOG7[9528]: New thread created 2015.02.10 16:07:36 LOG7[2164]: Service [rb20] started 2015.02.10 16:07:36 LOG5[2164]: Service [rb20] accepted connection from 127.0.0.1:50355 2015.02.10 16:07:36 LOG6[2164]: s_connect: connecting A.B.C.D:443 2015.02.10 16:07:36 LOG7[2164]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds 2015.02.10 16:07:36 LOG5[2164]: s_connect: connected A.B.C.D:443 2015.02.10 16:07:36 LOG5[2164]: Service [rb20] connected remote server from 192.168.225.103:50356 2015.02.10 16:07:36 LOG7[2164]: Remote socket (FD=1152) initialized 2015.02.10 16:07:36 LOG6[2164]: SNI: sending servername: host.domain.com 2015.02.10 16:07:36 LOG7[2164]: SSL state (connect): before/connect initialization 2015.02.10 16:07:36 LOG7[2164]: SSL state (connect): SSLv3 write client hello A 2015.02.10 16:07:36 LOG6[7056]: SSL socket closed (SSL_read) 2015.02.10 16:07:36 LOG7[7056]: Sent socket write shutdown 2015.02.10 16:07:36 LOG5[7056]: Connection closed: 89 byte(s) sent to SSL, 52 byte(s) sent to socket 2015.02.10 16:07:36 LOG7[7056]: Remote socket (FD=1124) closed 2015.02.10 16:07:36 LOG7[7056]: Local socket (FD=1128) closed 2015.02.10 16:07:36 LOG7[7056]: Service [rb20] finished (1 left) The main difference I can see, is that on Linux I get: 2015.02.10 15:58:29 LOG6[22887]: SSL connected: previous session reused Whereas Windows gives me: 2015.02.10 16:07:36 LOG7[7056]: Peer certificate was cached (1521 bytes) 2015.02.10 16:07:36 LOG6[7056]: SSL connected: new session negotiated Any idea why this happens ? The final result is that connections are possible from linux - but not Windows - and this is a problem for me... Regards /Brian

2 2

stunnel transparent mode stuck in timeout
by shushant.kakkar＠lhsystems.com 09 Feb '15

09 Feb '15

Hi, we would like to use stunnel in transpartent mode. Therefore we already applied iptable changes as mentioned in the man page : Re-write address to appear as if wrapped daemon is connecting from the SSL client machine instead of the machine running stunnel. This option is currently available in: remote mode (I<connect> option) on Linux >=2.6.28 Linux >=2.6.28 requires the following setup for iptables and routing (possibly in /etc/rc.local or equivalent file): iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 However the connection to the services cannot be established and we run into a timeout. 2015.02.09 10:00:03 LOG7[6658:139940568909760]: ldaps-in accepted FD=12 from xxxxxx:51018 2015.02.09 10:00:03 LOG7[6658:139940568905472]: ldaps-in started 2015.02.09 10:00:03 LOG7[6658:139940568905472]: FD 12 in non-blocking mode 2015.02.09 10:00:03 LOG7[6658:139940568905472]: Waiting for a libwrap process 2015.02.09 10:00:03 LOG7[6658:139940568905472]: Acquired libwrap process #0 2015.02.09 10:00:03 LOG7[6658:139940568905472]: Releasing libwrap process #0 2015.02.09 10:00:03 LOG7[6658:139940568905472]: Released libwrap process #0 2015.02.09 10:00:03 LOG7[6658:139940568905472]: ldaps-in permitted by libwrap from xxxxxxx:51018 2015.02.09 10:00:03 LOG5[6658:139940568905472]: ldaps-in accepted connection from xxxxxxx:51018 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): before/accept initialization 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 read client hello A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write server hello A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write certificate A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write server done A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 flush data 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 read client key exchange A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 read finished A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write change cipher spec A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write finished A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 flush data 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 1 items in the session cache 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 client connects (SSL_connect()) 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 client connects that finished 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 client renegotiations requested 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 1 server connects (SSL_accept()) 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 1 server connects that finished 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 server renegotiations requested 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 session cache hits 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 external session cache hits 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 session cache misses 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 session cache timeouts 2015.02.09 10:00:03 LOG6[6658:139940568905472]: SSL accepted: new session negotiated 2015.02.09 10:00:03 LOG6[6658:139940568905472]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2015.02.09 10:00:03 LOG7[6658:139940568905472]: FD 13 in non-blocking mode 2015.02.09 10:00:03 LOG6[6658:139940568905472]: local_bind succeeded on the original port 2015.02.09 10:00:03 LOG6[6658:139940568905472]: connect_blocking: connecting 127.0.0.1:10389 2015.02.09 10:00:03 LOG7[6658:139940568905472]: connect_blocking: s_poll_wait 127.0.0.1:10389: waiting 10 seconds 2015.02.09 10:00:13 LOG3[6658:139940568905472]: connect_blocking: s_poll_wait 127.0.0.1:10389: timeout 2015.02.09 10:00:13 LOG5[6658:139940568905472]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.02.09 10:00:13 LOG7[6658:139940568905472]: ldaps-in finished (0 left) Any idea why the timeout is occuring? Best regards, Shushant

1 0

New PGP key
by Michal Trojnara 06 Feb '15

06 Feb '15

Dear Users, As of now I'm starting to sign my emails and code with a new PGP key. The new key is attached to this email message, and available at https://www.stunnel.org/pgp.asc Key fingerprint = AC91 5EA3 0645 D9D3 D4DA E4FE B104 8932 DD3A AAA3 The new key is also signed with my previous PGP key. This and other signatures can be verified with: gpg --check-sigs "AC91 5EA3 0645 D9D3 D4DA E4FE B104 8932 DD3A AAA3" Best regards, Mike

1 0

stunnel keeps using SSLv3 even after disabling it
by Or Yarimi 04 Feb '15

04 Feb '15

Hi, I'm using stunnel to communicate with FIX server. In order to do that, I disabled SSLv2 and SSLv3 and set the sslVersion to TLSv1. It seems like stunnel keeps trying using SSLv3 handshake, which isn't working. This is the configuration: client = yes debug = 7 output=stunnel.log cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Turning for LMAX options = NO_SSLv2 options = NO_SSLv3 [LMAX-fix-tunnel-DEMO-Trading] sslVersion = TLSv1 accept = 40001 connect = fix-ate.lmaxtrader.com:443 stunnel log: 2015.02.04 12:10:31 LOG7[12516]: Service [LMAX-fix-tunnel-DEMO-MktData] started 2015.02.04 12:10:31 LOG5[12516]: Service [LMAX-fix-tunnel-DEMO-MktData] accepted connection from 127.0.0.1:59475 2015.02.04 12:10:31 LOG6[12516]: s_connect: connecting 91.215.165.69:443 2015.02.04 12:10:31 LOG7[12516]: s_connect: s_poll_wait 91.215.165.69:443: waiting 10 seconds 2015.02.04 12:10:31 LOG5[12516]: s_connect: connected 91.215.165.69:443 2015.02.04 12:10:31 LOG5[12516]: Service [LMAX-fix-tunnel-DEMO-MktData] connected remote server from 10.0.0.62:59476 2015.02.04 12:10:31 LOG7[12516]: Remote socket (FD=620) initialized 2015.02.04 12:10:31 LOG6[12516]: SNI: sending servername: fix-md-ate.lmaxtrader.com 2015.02.04 12:10:31 LOG7[12516]: SSL state (connect): before/connect initialization 2015.02.04 12:10:31 LOG7[12516]: SSL state (connect): SSLv3 write client hello A Already burned around 4 hours understanding what I'm doing wrong, will be glad if you could help me. Thanks in advance, Or. -- *Attention:* This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the sender immediately by replying to this message, and delete the original message from your system without making a copy. This e-mail is attributed to the sender and does not necessarily reflect the view of Markets Pulse P.S. Ltd. or any affiliate. Please consider the environment before printing this email.

1 0

Can't compile stunnel 5.10 on Linux ... got fatal signal 11 error
by amontaron 03 Feb '15

03 Feb '15

Hi everybody ! I tried to compile stunnel 5.10 (latest) on my old Suse 7 Linux distrib and got "a fatal signal 11 error message" when doing the make command. Just before, openssl 1.0.2 (latest) compile fine with no errors. Also, I add some stuffs like xemacs 21.4.22 (latest) just to say that that rather old distrib is able to do all that :-D So, here is the latest messages from make I got : > Making all in src > make[1]: Entering directory `/root/stunnel-5.10/src' > make all-am > make[2]: Entering directory `/root/stunnel-5.10/src' > source='stunnel.c' object='stunnel-stunnel.o' libtool=no \ > DEPDIR=.deps depmode=gcc /bin/sh ../auto/depcomp \ > gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include > -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' > -DCONFDIR='"/usr/local/etc/stunnel"' -g -O2 -pthread -Wall > -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations > -D_FORTIFY_SOURCE=2 -c -o stunnel-stunnel.o `test -f 'stunnel.c' || > echo './'`stunnel.c > In file included from /usr/include/string.h:346, > from common.h:201, > from stunnel.c:38: > /usr/include/bits/string2.h: In function `__strsep_g': > /usr/include/bits/string2.h:1171: warning: passing arg 2 of > `__strpbrk_c2' with different width due to prototype > /usr/include/bits/string2.h:1171: warning: passing arg 3 of > `__strpbrk_c2' with different width due to prototype > /usr/include/bits/string2.h:1171: warning: passing arg 2 of > `__strpbrk_c3' with different width due to prototype > /usr/include/bits/string2.h:1171: warning: passing arg 3 of > `__strpbrk_c3' with different width due to prototype > /usr/include/bits/string2.h:1171: warning: passing arg 4 of > `__strpbrk_c3' with different width due to prototype > gcc: Internal compiler error: program cc1 got fatal signal 11 > make[2]: *** [stunnel-stunnel.o] Error 1 > make[2]: Leaving directory `/root/stunnel-5.10/src' > make[1]: *** [all] Error 2 > make[1]: Leaving directory `/root/stunnel-5.10/src' > make: *** [all-recursive] Error 1 Previously got lots of warning messages. Perhaps need "make report" also ? I've look at stunnel-users(a)stunnel.org mail archive up to July 2011 with no success. So, that's why I'm writting to you there... Then, I tried different versions of stunnel 4.xx like 4.00, 4.56, 4.28 and more. All simply don't compile with differents errors messages. The only one I could compile completly is stunnel 3.22 (so latest 3.xx) Note that I'm happy with that because I was running stunnel 3.3 just before and that everything works with the latest openssl version I download and everything works fine for what I would ! Remark: Suse7 distrib (not OpenSuse) is Linux 2.2.16 kernel (not latest :-D) Alex. PS: Another things, on the same machine I ran stunnel 4.56 on (old) Windows 98 with no problems. --- Ce courrier électronique ne contient aucun virus ou logiciel malveillant parce que la protection avast! Antivirus est active. http://www.avast.com

2 2

stunnel log shows SSLv3 protocol level even when TLSv1 was negotiated
by christian.tenvenne＠lhsystems.com 03 Feb '15

03 Feb '15

I'm running stunnel in server-mode with options "NO_SSLV2" and "NO_SSLV3" and sslVersion=all. My client also explicitly disables SSLv2 and SSLv3. My client's ssl-log (-Djavax.net.debug=ssl) confirms that, during handshake and for application data, the highest TLS protocol version is being used. How come, stunnel log still shows "SSLv3" ? 2015.02.03 14:42:46 LOG5[8415:140561397376768]: ldaps-in accepted connection from X.X.X.X:65158 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): before/accept initialization 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 read client hello A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write server hello A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write certificate A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write server done A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 flush data 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 read client key exchange A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 read finished A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write change cipher spec A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write finished A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 flush data 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 9 items in the session cache 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 client connects (SSL_connect()) 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 client connects that finished 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 client renegotiations requested 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 12 server connects (SSL_accept()) 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 9 server connects that finished 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 server renegotiations requested 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 session cache hits 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 external session cache hits 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 session cache misses 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 session cache timeouts 2015.02.03 14:42:46 LOG6[8415:140561397376768]: SSL accepted: new session negotiated 2015.02.03 14:42:46 LOG6[8415:140561397376768]: Negotiated ciphers: AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 Is my client's ssl-log wrong? Or stunnel's? Kind regards, Christian Tenvenne

2 1

issue with stunnel forwarding
by David 03 Feb '15

03 Feb '15

I am trying to configure stunnel on a bridge server which needs to use ssl to talk to 3 others servers. below is my conf file: ; ***************************************** Example SSL server mode services [ xyz ] accept=10.10.10.74:9908 connect= 127.0.0.10:1040 transparent = source[ hp ] accept=10.10.10.218:9904 connect=127.0.0.10:1041 transparent = source[ sql] accept=10.10.10.214:59053 connect=127.0.0.10:1042 transparent = source when I run the stunnel GUI start I get following message: [ ] No limit detected for the number of clients [.] stunnel 5.10 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.1l 15 Jan 2015 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [.] Reading configuration from file stunnel.conf [ ] GUI message loop initialized [.] UTF-8 byte order mark detected [ ] Enabling support for engine "capi" [ ] Initializing engine #1 (capi) [ ] Engine #1 (capi) initialized [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [!] Line 62: "transparent = source": Specified option name is not valid here[!] Server is down what am I missing here? thanks! nazja2015

2 1

stunnel-5.10, FreeBsd Package building, missing openssl and perl packages and config menue for Stunnel is missing ssl port
by mugetsu shinde 03 Feb '15

03 Feb '15

so ive noticed in the previous stunnel 5.07 i was able to select SSL_PORT when making the config for Stunnel , well now after downloading stunnel 5.10 with FreeBsd 10.1 over portsnap fetch extract , Stunnel is missing the option: SSL_PORT why , whats going on ? btw ive noticed openssl and perl arent downloaded from the portsnap server either apparently , help please , i need this for my pfsense 2.2 release vm to work with Stunnel again

2 1

Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3
by Sebastian Ochsenkühn 29 Jan '15

29 Jan '15

Hi Mike, thanks for your fast response, but I think there is a big issue. The latest version that is available in the CENTOS 6 Base Repo is "stunnel-4.29-3.el6_6.1.x86_64" - In this version the SSLv3 is disabled by default, but there is not option to enable it. I hope you understand my situation :-) ________________________________ Von: stunnel-users <stunnel-users-bounces(a)stunnel.org> im Auftrag von Michal Trojnara <Michal.Trojnara(a)mirt.net> Gesendet: Donnerstag, 29. Januar 2015 11:44 An: stunnel-users(a)stunnel.org Betreff: Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3 Hi Sebastian, My documentation describes the latest version of stunnel. For an old version please refer to the appropriate manual page distributed with the specific version you're using. Mike On 29.01.2015 11:40, Sebastian Ochsenkühn wrote: Hi, I have a big problem with the new stunnel version on CentOS 6.6 (stunnel-4.29-3.el6_6.1.x86_64) that is available in the CentOS base repository. You describe in your documentation that SSLv3 is disabled by default. -> OK for me, but I need SSLv3 and the option with -NO_SSLv3 is not working?! PS: this is also not working with -NO_SSLv2 option. options = -NO_SSLv3 = NOT Working option = NO_SSLv3 = Working. Currently i have installed an older version, where the SSLv3 protocoll is not disabled by default. Is there anything that I'm doing wrong? Thanks and Regards, Sebastian. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3
by Sebastian Ochsenkühn 29 Jan '15

29 Jan '15

Hi Mike, yes your correct, but I have forced the installation with "stunnel-4.29-3.el6_4.x86_64" ( all other packages openssl, etc. updated) and SSLv3 is working again. So, for my understanding there must be a bug or they have disabled SSLv3 in version "stunnel-4.29-3.el6_6.1.x86_64". Regards, Sebastian. ________________________________ Von: stunnel-users <stunnel-users-bounces(a)stunnel.org> im Auftrag von Michal Trojnara <Michal.Trojnara(a)mirt.net> Gesendet: Donnerstag, 29. Januar 2015 12:12 An: stunnel-users(a)stunnel.org Betreff: Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3 Hi Sebastian, The ChangeLog does not say anything about disabling SSLv3: http://rpmfind.net/linux/RPM/centos/updates/6.6/x86_64/Packages/stunnel-4.2… I guess it may be disabled in the OpenSSL rather than in stunnel. Anyway, if you connect stunnel with some software that's so old that it doesn't support TLS, the software is almost certainly no longer supported, and most likely vulnerable to attacks. This is a serious risk! Mike On 29.01.2015 11:58, Sebastian Ochsenkühn wrote: Hi Mike, thanks for your fast response, but I think there is a big issue. The latest version that is available in the CENTOS 6 Base Repo is "stunnel-4.29-3.el6_6.1.x86_64" - In this version the SSLv3 is disabled by default, but there is not option to enable it. I hope you understand my situation :-) ________________________________ Von: stunnel-users <stunnel-users-bounces(a)stunnel.org><mailto:[email protected]> im Auftrag von Michal Trojnara <Michal.Trojnara(a)mirt.net><mailto:[email protected]> Gesendet: Donnerstag, 29. Januar 2015 11:44 An: stunnel-users(a)stunnel.org<mailto:[email protected]> Betreff: Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3 Hi Sebastian, My documentation describes the latest version of stunnel. For an old version please refer to the appropriate manual page distributed with the specific version you're using. Mike On 29.01.2015 11:40, Sebastian Ochsenkühn wrote: Hi, I have a big problem with the new stunnel version on CentOS 6.6 (stunnel-4.29-3.el6_6.1.x86_64) that is available in the CentOS base repository. You describe in your documentation that SSLv3 is disabled by default. -> OK for me, but I need SSLv3 and the option with -NO_SSLv3 is not working?! PS: this is also not working with -NO_SSLv2 option. options = -NO_SSLv3 = NOT Working option = NO_SSLv3 = Working. Currently i have installed an older version, where the SSLv3 protocoll is not disabled by default. Is there anything that I'm doing wrong? Thanks and Regards, Sebastian. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3
by Sebastian Ochsenkühn 29 Jan '15

29 Jan '15

Hi, I have a big problem with the new stunnel version on CentOS 6.6 (stunnel-4.29-3.el6_6.1.x86_64) that is available in the CentOS base repository. You describe in your documentation that SSLv3 is disabled by default. -> OK for me, but I need SSLv3 and the option with -NO_SSLv3 is not working?! PS: this is also not working with -NO_SSLv2 option. options = -NO_SSLv3 = NOT Working option = NO_SSLv3 = Working. Currently i have installed an older version, where the SSLv3 protocoll is not disabled by default. Is there anything that I'm doing wrong? Thanks and Regards, Sebastian.

1 0

Blue Iris
by Patrick wickline 22 Jan '15

22 Jan '15

I have stunnel set up on my machine. It works locally and lets me connect to my Blue Iris server with https. However, I am unable to do this remotely. I have forwarded the port in my router to stunnel, from stunnel to blue iris, but still doesn't work. Below is part of my conf file [Blue Iris] accept = 8344 (forwarded this in the router to my static IP of my machine) connect = 127.0.0.1:8081 (8081 is my blue iris web server) I hope someone is able to give some advice

2 1

stunnel 5.10 released
by Michal Trojnara 22 Jan '15

22 Jan '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.10 of stunnel. The ChangeLog entry: Version 5.10, 2015.01.22, urgency: LOW: * New features - OCSP AIA (Authority Information Access) support. This feature can be enabled with the new service-level option "OCSPaia". - Additional security features of the linker are enabled: "-z relro", "-z now", "-z noexecstack". * Bugfixes - OpenSSL DLLs updated to version 1.0.1l. https://www.openssl.org/news/secadv_20150108.txt - FIPS canister updated to version 2.0.9 in the Win32 binary build. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 032bfc1854f8a0b9e452343c36ec6b52c7e0daef0863423c6b13a61a7c92eb23 stunnel-5.10.tar.gz 7c29753b6488f37b29f365e9c4a6060c3da8a89000af1cd29eab7c37d419d148 stunnel-5.10-installer.exe 93cd0941580eaa7815ed62ec88a111cb449e9bad97cd1a35d7524867a8238234 stunnel-5.10-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlTBMTsACgkQ/NU+nXTHMtE+uQCg9N0butSpAQ2mM1M5ySe7T18i oe8AoOAHKJ9F7jMlUfHnmuzBtIPbbghN =e9ed -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] No DNS lookup?
by Colin van der Zanden 21 Jan '15

21 Jan '15

Ludolf, Thanks for your quick response. I have no clue on how to respond on the stunnel users list, so i'll try it this way. The support on the host we are trying to reach states to following: It really sounds like the stunnel is not connecting to "something.host.com" but perhaps to the IP address behind it? The use of the hostname something.host.com is however an requirement. Is there anyway we can force the stunnel to connect to the hostname instead of resolving it as an IP adress? Met vriendelijke groeten, H.N. Post en Zonen Colin van der Zanden c.vanderzanden(a)duurzaam-transport.com c.vanderzanden(a)hnpostenzonen.nl <dm.post(a)hnpostenzonen.nl> ---------------------------------------------- Dit e-mailbericht is uitsluitend bestemd voor de geadresseerde(n). Wilt u direct contact met ons opnemen indien deze e-mail bij vergissing bij u terecht is gekomen? Wij verzoeken u in dat geval de e-mail te vernietigen, de inhoud ervan niet te gebruiken en niet onder derden te verspreiden, omdat het bericht vertrouwelijke informatie kan bevatten, beschermd door een beroepsgeheim.

5 5

No DNS lookup?
by Colin vd Zanden 20 Jan '15

20 Jan '15

Hi, We've got a bit of a problem working with Stunnel. We are trying to connect to a domain, but the stunnel is somehow translating it to a IP adres. (We didn't know, we saw it in the log file). This is causing our connection to fail. Is there any way to prevent stunnel from translating the domain into a IP, and just connect to the domain name?

2 1

Stunnel, please add me to your LinkedIn network
by Neacsu Mihai Adrian 17 Jan '15

17 Jan '15

Hi Stunnel, I'd like to connect with you on LinkedIn. Neacsu Mihai Adrian Software Developer at RND Software Accept: https://www.linkedin.com/blink?simpleRedirect=0Qd3ASe34VcjAPcPsMcjcOdzARfkh… View Neacsu Mihai Adrian's profile: https://www.linkedin.com/blink?simpleRedirect=d3gTdPANcP8Ofkh9sClyrmlJ9C56m… You are receiving Invitation emails. Unsubscribe here: https://www.linkedin.com/blink?simpleRedirect=7wQbmcVemZCcjlFbj1SqPsRdjRAqm… This email was intended for Stunnel Users (stunnel user at n/a). Learn why we included this at the following link: https://www.linkedin.com/blink?simpleRedirect=0Ue3sQfmh9pmNzqnhOoioUcBZOpm9… © 2014, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA

2 1

HTTPS support for the webserver using STUNNEL
by Siva Kumar 13 Jan '15

13 Jan '15

Hi All, I am fairly new to stunnel and also to the networking concepts. Currently we are working on a surveillance device running on monta vista linux on the ARM11 architecture. We have crossed compiled and deployed a THTTPD server which is working fine. Once you connect to the device using any of the web client (from a windows PC), it will take you to a web page where you can select and stream live video's from all the camera's connected to the device. So far everything is working fine now.. Now the real problem is that we need to support https as well along with http. Since THTTPD web server doesn't support secure connection we thought we would accomplish that using the stunnel application. We were able to download and cross compile the stunnel application for the device. Now the doubts I have here is:- 1) Do we need a stunnel server application running on the windows PC from where we will be using the web browser to connect to the client? 2) Where should be the stunnel server and stunnel client be running. I mean should the linux device be running the stunnel client and the windows PC be running the stunnel server? In that case what should be the correct accept and connect parameters in the stunnel.conf file in both the device and the windows PC? 3) Since the device and the machine can have any random IP and port, so is it feasible to dynamically set the accept and connect parameters in the stunnel.conf file? 4) Can the stunnel be considered as a solution to the problem which I have reported here. The point 3 above makes me thing otherwise. I have tried all combinations mentioned in the point 1 and 2 without success. In none of the case my web browser was able to talk to the device using HTTPS (ie https://my_device_ip). I could see a "client hello" request from the browser to which the client sends an ACK and RST. In some combination an HTTPS request from the browser only triggered a TCP connection request for which the client responded with ACK and RST. Sorry for the long mail. Any inputs would be deeply appreciated. Regards, Siva

2 2

Using stunnel to secure clients instead of servers
by Leon Smith 07 Jan '15

07 Jan '15

Hi, this may be a slightly unusual request, but I was curious if stunnel could be used for securing clients that do not support TLS, to connect to services that optionally support TLS. So, really, stunnel already does almost everything that would be needed; except that in this use case, it would be listening for incoming unencrypted connections, and then serve as a proxy to an encrypted connection to the actual service. While it might be nice to offer certificate-based authentication options in this scenario, it wouldn't be necessary for my intended use case, so stunnel wouldn't need access to any private certificates. However, certificate pinning would be pretty essential to what I have in mind. Best, Leon.

2 5

stunnel 5.09 released
by Michal Trojnara 02 Jan '15

02 Jan '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.09 of stunnel. The ChangeLog entry: Version 5.09, 2015.01.02, urgency: LOW: * New features - Added PSK authentication with two new service-level configuration file options "PSKsecrets" and "PSKidentity". - Added additional security checks to the OpenSSL memory management functions. - Added support for the OPENSSL_NO_OCSP and OPENSSL_NO_ENGINE OpenSSL configuration flags. - Added compatibility with the current OpenSSL 1.1.0-dev tree. * Bugfixes - Removed defective s_poll_error() code occasionally causing connections to be prematurely closed (truncated). This bug was introduced in stunnel 4.34. - Fixed ./configure systemd detection (thx to Kip Walraven). - Fixed ./configure sysroot detection (thx to Kip Walraven). - Fixed compilation against old versions of OpenSSL. - Removed outdated French manual page. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 87b34a74061861d1edd2ab238c73eb989b3d0a17e44574b7b6ead1a16aae38c8 stunnel-5.09.tar.gz 4abbddf3c1dbedf54b14fa5a18ead11e4df6387f13189b665c2ec5759c4afd30 stunnel-5.09-installer.exe 23c33dc46cc1bfb1df77c88d3c48901822bc113dd1e67d138bcf5fb1bb3d4197 stunnel-5.09-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlSmt98ACgkQ/NU+nXTHMtGZowCfTspj4OZn8DRBUboG2S+1Qy2A ocoAoLdZpjJU7BjERXqQakhNIPOXFojN =/MD9 -----END PGP SIGNATURE-----

1 0

help with xforwarded-for
by Senthil Naidu 30 Dec '14

30 Dec '14

Hi, I am trying to use stunnel 5.08 can we enable xforwarded-for option using some patches , the last patch I see is in haproxy website for version stunnel version 4.32 Regards Senthil

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users