- stunnel-users - stunnel.org

the stunnel stops showing the ssl after a few hours of operation
by daniel＠hostingtico.com 18 Mar '22

18 Mar '22

hello, thank you very much for the opportunity to humbly ask for help, I had a server with centos 6 for approximately 3 years and the stunnel never gave me any problem, I recently changed my server with centos 7 but now after a few hours of being active it stops showing the ssl in the ports that I have configured to show shoutcast when viewing the stunnel status: service stunnel status after a few hours it shows most of the result in red and there it does not show the shoutcast in ssl, after giving restart: service stunnel restart everything returns to normal but before 6 hours the problem returns, Could someone give me a light to solve this problem, I'm running the latest version of stunnel my stunnel.conf: client=no [Orto] accept=7000 connect=208.77.20.179:8006 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [radio] accept=7002 connect=208.77.20.179:9942 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [Metro] accept=7004 connect=208.77.20.179:8014 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [arrge] accept=7006 connect=208.77.20.179:8016 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [radio2] accept=7008 connect=208.77.20.179:9932 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [Radiored] accept=7010 connect=208.77.20.179:8023 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2

1 0

stunnel error message
by Stephen McQuaid 18 Mar '22

18 Mar '22

Hello, I am getting the following error message in stunnel 2022.03.18 14:27:01 LOG3[0]: SSL_read (s_ssl_read_eof): Operation would block (WSAEWOULDBLOCK) (10035) 2022.03.18 14:27:01 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket But when I send a second email immediately after the first one, it goes through ok, does anyone know how to resolve this please?? Regards, Stephen McQuaid Local I.T. Office, Dublin, Ireland Henkel dx - creating the next [Ein Bild, das Schild, Ende, sitzend, Front enth?lt. Automatisch generierte Beschreibung] Office : +353-1-4046338 Mobile: +353-87-2470012 stephen.mcquaid(a)henkel.com<mailto:[email protected]> www.henkeldx.com<http://www.henkeldx.com/> Have a question visit Digital Business Norden<https://henkelgroup.sharepoint.com/teams/IBSNITInfoPortal/SitePages/IBS-Nor…>

1 0

stunnel 5.63 released
by Michał Trojnara 15 Mar '22

15 Mar '22

Dear Users, I have released version 5.63 of stunnel. ### Version 5.63, 2022.03.15, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.2. * New features - Updated stunnel.spec to support bash completion. * Bugfixes - Fixed a PRNG initialization crash (thx to Gleydson Soares). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c74c4e15144a3ae34b8b890bb31c909207301490bd1e51bfaaa5ffeb0a994617 stunnel-5.63.tar.gz 723f54c28073f17b1ac095a2ab9922735c69f73fba6144a5c68cc160dc673b10 stunnel-5.63-win64-installer.exe c77850c39dfb42f95d26d4f5830a261a95c3785d8c39bdd9f28764ba43ee1d7d stunnel-5.63-android.zip Best regards, Mike

1 0

src/ssl.c:319 - RAND_get_rand_method() may return NULL
by Gleydson Soares 03 Mar '22

03 Mar '22

Hello, The following patch avoids crashess. In src/ssl.c:prng_init(), the RAND_get_rand_method() may return NULL so strict the check to skip PRNG initialization. Diff inline below, against 5.62 gsoares --- ssl.c.orig Thu Mar 3 16:10:39 2022 +++ ssl.c Thu Mar 3 16:13:17 2022 @@ -354,7 +354,7 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *global) { const RAND_METHOD *meth=RAND_get_rand_method(); /* skip PRNG initialization when no seeding methods are available */ - if(meth->status==NULL || meth->add==NULL) { + if(meth==NULL || meth->status==NULL || meth->add==NULL) { s_log(LOG_DEBUG, "No PRNG seeding methods"); return 0; /* success */ }

1 0

Error -63 when connecting to Office 365 to retrieve emails
by sedick＠logicore.co.za 01 Mar '22

01 Mar '22

Hi All, A problem started recently with error -63 when connecting to office 365 server to retrieve emails. The code I am using are as follows: * variables ChannelNo = 0 Pop3Server = 'outlook.office365.com' Pop3User = UserName Pop3Pass = Password Pop3Port = '995' ProxYServer = '127.0.0.1' ProxyPort = '110' ProxyDir = 'C:\see4OI\SSL\' ProxyExe = 'stunnel.exe' ProxyCert = 'stunnel.pem' * retreives mail in MIME format Gosub GET_EMAILS return Mail_Rec * ----------------------------------------------------------------------------------------- GET_EMAILS: * close previous session If it wasnt closed properly Code = seeClose(ChannelNo) Code = seeRelease() * attach key code Code = seeAttach(1, KeyCode) if Code < 0 then RetFlag = 1 return end * start stunnel Code = seeSetProxySSL(0, 1, ProxyDir, ProxyCert, ProxyExe) If Code < 0 Then RETURN end * connect to email server Code = seePop3ConnectSSL(ChannelNo, ProxyPort, Pop3Port, Pop3Server, Pop3User, Pop3Pass, ProxyServer) If Code < 0 Then RETURN End Help urgently required please. Stunnel version 5.42 with a special exception for OpenSSL Kind Regards, Sedick

1 0

SmtpConnectSSL question
by sportman7＠netzero.com 28 Feb '22

28 Feb '22

When I use SmtpConectSSL I establish the SSL connection but Stunnel opens a Stunnel window. I would like the connection to run without this window. Anyone know how I can stop the window from opening? Is there a setting in .conf or a parameter for SmtpConnectSSL I need?

1 0

Re: tunnel for IMAP/SMTP
by Eberhard 13 Feb '22

13 Feb '22

Just saying -- if something is deprecated it does not mean you MUST stop using it. Use an older version of the software. You can of course have both -- put the older version in one place and the newer one in another. Configure your system to use whichever version you need. The habit of always updating "just because" is sometimes not good for you 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com https://www.facebook.com/groups/286143052248115 -----Original Message----- From: Germano Massullo <germano.massullo(a)gmail.com> On Behalf Of Caterpillar Sent: Saturday, February 12, 2022 7:18 AM To: Josealf.rm <josealf(a)rocketmail.com> Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: tunnel for IMAP/SMTP Il 10/02/22 01:56, Josealf.rm ha scritto: > OK, I see you’re using stunnel only on your client and it looks you’re > connecting using TLS 1.0 which is deprecated. > > My proposed solution runs stunnel on your server and aims to implement > a front end proxy to the imap/smtp product. This can give you the > support for new TLS versions and no need to run stunnel on your clients. No, I don't have access to the mail server machine. I just installed stunnel on a localhost VM, then lowered the VM minimum accepted TLS to 1.0, and then run Thunderbird from host machine. The latter will connect to the stunnel running in the VM _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org

1 0

tunnel for IMAP/SMTP
by Caterpillar 12 Feb '22

12 Feb '22

Good day. I need to be able to use Thunderbird to connect to a mail server (IMAP/SMTP) that has an obsolete TLS version (1.1) and I don't want to low the TLS minimum version on my computers. For this need I would like to use stunnel between Thunderbid clients and the mail server. I tried to use tutorial [1] plus "sslVersion = all" option, but I think the guide is quite incomplete. Do you have any other guide/tutoral that is more complete? Thank you [1]: https://petermolnar.com/secure-smtp-and-imap-sessions-with-stunnel/

3 4

stunnel (5.62 and 5.59) causing high load...
by erik＠baigar.de 06 Feb '22

06 Feb '22

Hi there, I was running stunnel successfully for many years (4.26 with older openssl) wrapping http and imap and upgraded for security reasons to openssl 1.1.1 with stunnel 5.59. The platform is somewhat exotic: SPARC Solaris 10 using gcc 3.4.6. The stunnel works for imap and https without problems for some time but after heavy load conditions it starts consuming 100% CPU load although it still works. In this case it is not the DH computation as no ciphers depending on that one are used: 2022.02.06 11:56:33 LOG6[ui]: DH initialization skipped: no DH ciphersuites On the life machine it happens e.g. after some script based port scan attacks and in a way to trigger the phenomenon I found, that running a cipher enumberate for example triggers the "high-load" state. Running nmap 7.80 the command doing the job is nmap --script ssl-enum-ciphers -p PORT SERVER-IP Checking the log-file (level 7) the end of the logfile after such a burst of acitity with the stunnel ennding up at 100% CPU load looks like that: 2022.02.06 14:23:17 LOG7[39]: Deallocating application specific data for session connect address 2022.02.06 14:23:17 LOG7[39]: linger (local): Invalid argument (22) 2022.02.06 14:23:17 LOG7[39]: Local descriptor (FD=22) closed 2022.02.06 14:23:17 LOG7[39]: Service [imaps] finished (6 left) 2022.02.06 14:23:14 LOG7[main]: FD=4 events=0x1 revents=0x1 2022.02.06 14:23:17 LOG7[main]: FD=11 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=12 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=13 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=14 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: Dispatching a signal from the signal pipe 2022.02.06 14:23:17 LOG7[main]: Processing SIGCHLD 2022.02.06 14:23:17 LOG7[main]: Retrieving pid statuses with waitpid() 2022.02.06 14:23:17 LOG7[main]: Retrieving pid statuses with waitpid() - DONE Remarkable is that some imaps (we named the IMAP service to be wrapped imaps) still seem to remain active (6 left). The last entry always is the one with the waitpid() and to be sure that it is not the while loop in that one (stunnel.c) I added an additional log entry "DONE" in the source whenever the routine is left - so it is not that easy. The workaround currently is a script monitoring the CPU usage of stunnel and killing/restarting it if >80% for extended period of time is observed, but that can just be a temporary solution. Any ideas what to try/debug locating the reason for the problem? Thanks, Erik. P.S. Experimenting with the timeouts does not alter the phenomenon. P.P.S. Here the active lines of the config file (deleted comments and unused lines to remove clutter): cert = /usr/local/etc/stunnel/stunnel.pem sslVersion = all chroot = /var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [imaps] accept = 14310 connect = 143 local = 127.0.0.1

1 0

Re: stunnel 5-15 minute outages
by Eberhard 05 Feb '22

05 Feb '22

I a hate to sound like a broken record – why not at least try inetd mode for a few days? If nothing else it will tell you if it is stunnel (either server issues or problems with continuing running programs) with little cost to you to try it. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com> Sent: Saturday, February 5, 2022 3:01 AM To: john.robertson.arnold(a)gmail.com Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: stunnel 5-15 minute outages We haven't taken any actions yet. We have so far believed that it was a network side issue, so we have been looking hard at the network devices and getting vendor cases open. We have been looking at packet captures to see if we can figure it out. We haven't found anything that points to the network, but still looking at that. Do you happen to have any load balancers in front of stunnel? I plan to recommend some changes to stunnel suggested in this thread. Thanks, and sorry you are facing this same issue. On Fri, Feb 4, 2022 at 11:36 PM <john.robertson.arnold(a)gmail.com <mailto:[email protected]> > wrote: I second your problem! We are experiencing what sounds like the same issue. We have had 8 outages since November. They come in pairs, roughly 48 hours apart. Each outage is between 10-12 minutes, then self resolves. I literally just came to this thread tonight while troubleshooting the latest outage. Did the suggestion in the thread work for you? _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org <mailto:[email protected]> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org <mailto:[email protected]> -- Steve Clement steve3279(a)gmail.com <mailto:[email protected]> 614-632-7380

1 0

Re: stunnel 5-15 minute outages
by Eberhard 05 Feb '22

05 Feb '22

Which is why my advice is “strange.” We support so many Unix versions with thousands of users of various capabilities. I don’t want to have to learn secret tricks – especially as they change with versions of the O/S. So I use inetd – all the same on every O/S and always works. I see no reason not to do this unless you have a belief that there is a performance issue with it, which is possible I suppose but I suspect completely unlikely in modern computers. Further, inetd is running anyway so the server part is hardly affected by stunnel whereas if you use stunnel in server mode it has overhead … so a real picky person would do performance analysis and it still may be more efficient to use inetd depending on server overhead. Which is like different by O/S and computer hardware and … I worry about performance only when it actually matters. I’d rather concern myself with reliable with less maintenance on my part. My primary O/S is AIX which is stone reliable and requires little fussing with – hence using AIX to do the server part (inetd) makes my life easier. And probably 95% of the people here will disagree with me and that is fine because there is no “right” answer, just choices. I just think some people dismiss inetd out of hand because they were told a decade or two ago (I am old 😊 ) that performance was an issue and that remains the legend. And, I have helped several people overcome issues by changing to inetd, especially those with little experience in server management and/or O/S settings like Danny did (good job!). So please don’t flame me people – this is just explaining why one might consider using inetd mode, not making a case to always use it. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Danny Clowes <danny0809881(a)gmail.com> Sent: Friday, February 4, 2022 1:21 PM To: Eric Eberhard <flash(a)vicsmba.com> Cc: Steve Clement <steve3279(a)gmail.com>; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re: stunnel 5-15 minute outages Hi, Ive been using stunnel on number of servers for very long time over all experience has been very good not had any issues or concerns with the stunnel they never crash always online. Ive just tested stunnel on debian 11 it's working brilliant. The Linux system do have limitations in place and the client will only allow so many connections before it will close down say can't take anymore connections however I edited the Linux server remove limitation in place. These where teething issues when started to use stunnel. If anyone interested I would provide hidden scrects how make stunnel work like dream. On Fri, 4 Feb 2022, 19:04 Eberhard, <flash(a)vicsmba.com <mailto:[email protected]> > wrote: I will give you strange advice assuming you are on Unix of some flavor. Use inetd. It always works or the O/S does not work 😊 It then becomes the actual server and a new instance of stunnel is fired for every connection. I use it because it is the most reliable way and takes no server software management. There is an old argument against this – it is in theory has less performance when a correction is created. I say theoretical as modern computers are so fast that creating a process millions of times does not stress a machine. I run 100s of millions of connections daily on a single computer and have zero performance issues. I also have zero issues like you described and I always had them before. Even if you do have an issue it would only affect one connection. Because each connection is unique. From your description it is the server process having an issue or perhaps some of the children not getting “clean” as they keep them running in a loop. With inetd it does it’s business and ends. There are no cross-connection or server issues. I give this advice several times a year and may ¼ take it and thank me. The rest mock the idea citing the theoretical performance difference (without even trying it) and continue to struggle. This is not just an issue with this version. Many versions have had trouble with running in a loop like that – memory management, variables not cleared, etc. And remember openssl is tied to this as well. The other thing I would recommend (also weird) is using static links. That way an install of say a new openssl (where your encryption issue appears to be now) won’t affect you. There is no way anyone is testing the software with every version of every O/S with every version of openssl. If you do a static link and have a working version, no need to change. Until a new TLS comes out or something but you can control that well when you have a static link. And that, BTW, theoretically loads faster. The program is much bigger but in need not load dynamic libraries from all over the place when it is fired up. Let me know what you find out and do 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com <mailto:[email protected]> > Sent: Friday, February 4, 2022 4:52 AM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] stunnel 5-15 minute outages Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com <mailto:[email protected]> 614-632-7380 _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org <mailto:[email protected]> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org <mailto:[email protected]>

3 2

stunnel 5-15 minute outages
by Steve Clement 05 Feb '22

05 Feb '22

Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com 614-632-7380

2 2

Re: stunnel 5-15 minute outages
by Eberhard 04 Feb '22

04 Feb '22

I will give you strange advice assuming you are on Unix of some flavor. Use inetd. It always works or the O/S does not work 😊 It then becomes the actual server and a new instance of stunnel is fired for every connection. I use it because it is the most reliable way and takes no server software management. There is an old argument against this – it is in theory has less performance when a correction is created. I say theoretical as modern computers are so fast that creating a process millions of times does not stress a machine. I run 100s of millions of connections daily on a single computer and have zero performance issues. I also have zero issues like you described and I always had them before. Even if you do have an issue it would only affect one connection. Because each connection is unique. From your description it is the server process having an issue or perhaps some of the children not getting “clean” as they keep them running in a loop. With inetd it does it’s business and ends. There are no cross-connection or server issues. I give this advice several times a year and may ¼ take it and thank me. The rest mock the idea citing the theoretical performance difference (without even trying it) and continue to struggle. This is not just an issue with this version. Many versions have had trouble with running in a loop like that – memory management, variables not cleared, etc. And remember openssl is tied to this as well. The other thing I would recommend (also weird) is using static links. That way an install of say a new openssl (where your encryption issue appears to be now) won’t affect you. There is no way anyone is testing the software with every version of every O/S with every version of openssl. If you do a static link and have a working version, no need to change. Until a new TLS comes out or something but you can control that well when you have a static link. And that, BTW, theoretically loads faster. The program is much bigger but in need not load dynamic libraries from all over the place when it is fired up. Let me know what you find out and do 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com> Sent: Friday, February 4, 2022 4:52 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel 5-15 minute outages Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com <mailto:[email protected]> 614-632-7380

2 1

Use Stunnel with CMD
by gilaguigui＠gmail.com 02 Feb '22

02 Feb '22

Hi, I am trying to use stunnel with CMD (as a service) I get pop up message for each command (service installed \ service stopped etc.) the command in CMD: stunnel.exe -install\ -uninstall.... how can I disable it? run stunnel with no pop up? thanks GG.

1 0

New to stunnel! Need help connecting to a REST API
by Tim Townsend 18 Jan '22

18 Jan '22

Hello! I need help! We have an integration from an ERP package to a REST API (Avatax) that will soon be requiring TLS 1.2 connections. Our tech platform does not have built-in support for TLS 1.2, so I'm hoping to be able to use stunnel to make that happen. Where do I start? What would the conf file section look like for this? I don't see this directly discussed in the documentation. Any help appreciated! [cid:[email protected]] Tim Townsend Programmer Earnest & Associates * Profitability Improvement Specialists Voice: 410.766.6076<tel:+14107666076> ext 210 Email: tim.townsend(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/>

1 0

stunnel 5.62 released
by Michał Trojnara 17 Jan '22

17 Jan '22

Dear Users, I have released version 5.62 of stunnel. ### Version 5.62, 2022.01.17, urgency: MEDIUM * New features - Added a bash completion script. * Bugfixes - Fixed a transfer() loop bug. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 9cf5bb949022aa66c736c1326554cca27d0641605a6370274edc4951eb5bd339 stunnel-5.62.tar.gz fbfcc5759344bcafff9ff3bc6cf56c7fb75cb1244b76d4934c5d9a3eb7eee32d stunnel-5.62-win64-installer.exe 4b52ed6e4bb8293fdefb10ee8c271400a8c1749254a11b674ff690eae00b3c5e stunnel-5.62-android.zip Best regards, Mike

1 0

Re: stunnel 5.61transfer() loop executes not transferring any data Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket inetd mode
by Roberto CORRADO 17 Jan '22

17 Jan '22

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Mike, Good job! Stunnel 5.62 beta 1 work fine! """ 2022.01.16 22:08:47 LOG6[ui]: Initializing inetd mode configuration 2022.01.16 22:08:47 LOG5[ui]: stunnel 5.62 on i586-slackware-linux-gnu platform 2022.01.16 22:08:47 LOG5[ui]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2022.01.16 22:08:47 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2022.01.16 22:08:47 LOG6[ui]: Initializing inetd mode configuration 2022.01.16 22:08:47 LOG5[ui]: Reading configuration from file /etc/stunnel/imaps.conf 2022.01.16 22:08:47 LOG5[ui]: UTF-8 byte order mark not detected 2022.01.16 22:08:47 LOG5[ui]: FIPS mode disabled 2022.01.16 22:08:47 LOG6[ui]: Compression enabled: 0 methods 2022.01.16 22:08:47 LOG6[ui]: stunnel default security level set: 2 2022.01.16 22:08:47 LOG6[ui]: Session resumption enabled 2022.01.16 22:08:47 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: DH initialization needed for DHE-RSA-AES256-GCM-SHA384 2022.01.16 22:08:47 LOG6[ui]: 4096-bit DH parameters loaded 2022.01.16 22:08:47 LOG5[ui]: Configuration successful 2022.01.16 22:08:47 LOG5[0]: Service [stunnel] accepted connection from 10.19.79.235:41136 2022.01.16 22:08:47 LOG6[0]: Peer certificate not required 2022.01.16 22:08:47 LOG6[0]: No peer certificate received 2022.01.16 22:08:47 LOG6[0]: Session id: 65640462303D0DA1CD16CAB4977F22B04FFB74693150104FC69AB9FBDC48AED9 2022.01.16 22:08:47 LOG6[0]: No peer certificate received 2022.01.16 22:08:47 LOG6[0]: Session id: B9505D917FA6F2E9C8A0EF14D6E4B01C3ED54599271D93E325ED7412CA2AC5F3 2022.01.16 22:08:47 LOG6[0]: TLS accepted: new session negotiated 2022.01.16 22:08:47 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.01.16 22:08:47 LOG6[0]: Peer temporary key: X25519, 253 bits 2022.01.16 22:08:47 LOG6[0]: Local mode child started (PID=16984) 2022.01.16 22:08:47 LOG6[0]: TLS closed (SSL_read) 2022.01.16 22:08:47 LOG6[0]: Read socket closed (readsocket) 2022.01.16 22:08:47 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2022.01.16 22:08:47 LOG5[0]: Connection closed: 979 byte(s) sent to TLS, 128 byte(s) sent to socket """ Thanks a lot! - -Roberto -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAmHkjDoACgkQWVOoL214ZeGntwCbBtV1G/J2uThR06ftFC+F2XTP KeQAnjnCTOrk26zzcsNsCOQoWg54MWhD =alm2 -----END PGP SIGNATURE----- ----- Original Message ----- Sent: Sunday, January 16, 2022 9:52 PM Michał Trojnara wrote: > Hi Roberto, > > Could you try https://www.stunnel.org/downloads/beta/stunnel-5.62b1.tar.gz ? > > Best regards, > Mike

2 1

I NEED A HELP TO SETUP THE SSL/TLS EMAILS SUPPORT
by Muj 01 Jan '22

01 Jan '22

HI TECHNICAL SUPPORT, FIRSTLY, I AM APOLOGIZING TO YOU FOR WRITING WITH LARGE CAPS ONLY, IT IS BECAUSE RECENTLY I GOT A BRAIN STROKE AND AM NOT RECOVERED YET. AS FOR MY ISSUE, TO UNDERSTAND IT BETTER, THE FOLLOWING IS MY INFO. - I HAVE AN OLD WINDOWS-XP 32BIT OS. - I AM USING TERABYTE 2.99 TO BACKUP AND RESTORE MY OS, BUT LOOSING MANY EMAILS BECAUSE TERABYTE IS NO LONGER SUPPORTING 2.99 VERSION. THEY SUPPORT RESTORING ALL EMAILS BEGINNING FROM 3 VERSION. THEREFORE, THEY HAVE RECOMMENDED ME TO CONTACT YOU DIRECTLY. NOW WHAT I DID SO FAR. - I DOWNLOADED AND INSTALLED YOUR STUNNEL 4.53 - AFTER AUTOMATIC SETTING, EDITING STUNNEL.CONF FILE, MAKING SOME CHANGES IN IT AND SAVING IT, THE SERVER WENT DOWN. ATTACHED PLEASE FIND STUNNEL.CONF TXT FILE. - BECAUSE THE SERVER WENT DOWN, I TRIED TO DOWNLOAD AND INSTALL STUNNEL AGAIN, BUT ALWAYS GOT THE SAME ERROR MESSAGE.PLEASE CAN YOU HELP ME WITH THIS ISSUE? - I HAVE 3 POP3 EMAIL ACCOUNTS AND 1 IMAP. ALL REQUIRE A CONNECTION SECURITY SSL/TLS. *PLEASE, I NEED TO KNOW HOW **TO COMPLETELY REMOVE THE CURRENT STUNNEL PROGRAM AND AFTER THAT, WHAT STUNNEL VERSION I SHOULD **DOWNLOAD AGAIN **TO BE ABLE TO SET IT UP*. AFTER A SUCCESSFUL NEW INSTALLATION I WOULD GIVE YOU MORE NEEDED INFO FOR SETTING UP MY EMAILS. PLEASE LET ME KNOW IN YOUR BEST CONVENIENCE AND HAVE A BEAUTIFUL NEW YEAR 2022. KIND REGARDS, MARTIN

1 0

stunnel 5.61transfer() loop executes not transferring any data Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket inetd mode
by Roberto CORRADO 29 Dec '21

29 Dec '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 """ 2021.12.28 14:03:40 LOG6[ui]: Initializing inetd mode configuration 2021.12.28 14:03:40 LOG5[ui]: stunnel 5.61 on i586-slackware-linux-gnu platform 2021.12.28 14:03:40 LOG5[ui]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2021.12.28 14:03:40 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.12.28 14:03:40 LOG6[ui]: Initializing inetd mode configuration 2021.12.28 14:03:40 LOG5[ui]: Reading configuration from file /etc/stunnel/imaps.conf 2021.12.28 14:03:40 LOG5[ui]: UTF-8 byte order mark not detected 2021.12.28 14:03:40 LOG5[ui]: FIPS mode disabled 2021.12.28 14:03:40 LOG6[ui]: Compression enabled: 0 methods 2021.12.28 14:03:40 LOG6[ui]: stunnel default security level set: 2 2021.12.28 14:03:40 LOG6[ui]: Session resumption enabled 2021.12.28 14:03:40 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: DH initialization skipped: no DH ciphersuites 2021.12.28 14:03:40 LOG5[ui]: Configuration successful 2021.12.28 14:03:40 LOG5[0]: Service [stunnel] accepted connection from 127.0.0.1:40876 2021.12.28 14:03:40 LOG6[0]: Peer certificate not required 2021.12.28 14:03:40 LOG6[0]: No peer certificate received 2021.12.28 14:03:40 LOG6[0]: Session id: 0E092C2715D12901219C3E0F54DFA029F7C50040C7EC8F8C88211BA6883B9D1F 2021.12.28 14:03:40 LOG6[0]: No peer certificate received 2021.12.28 14:03:40 LOG6[0]: Session id: 26CFB9D13C499CE27C4ED1575FDF3FB2604C616418BA6068849B49EF75AF2162 2021.12.28 14:03:40 LOG6[0]: TLS accepted: new session negotiated 2021.12.28 14:03:40 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2021.12.28 14:03:40 LOG6[0]: Peer temporary key: X25519, 253 bits 2021.12.28 14:03:40 LOG6[0]: Local mode child started (PID=4997) 2021.12.28 14:03:40 LOG3[0]: transfer() loop executes not transferring any data 2021.12.28 14:03:40 LOG3[0]: please report the problem to Michal.Trojnara(a)stunnel.org 2021.12.28 14:03:40 LOG3[0]: stunnel 5.61 on i586-slackware-linux-gnu platform 2021.12.28 14:03:40 LOG3[0]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2021.12.28 14:03:40 LOG3[0]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.12.28 14:03:40 LOG3[0]: protocol=TLSv1.3, SSL_pending=0, SSL_has_pending=0 2021.12.28 14:03:40 LOG3[0]: sock_open_rd=Y, sock_open_wr=Y 2021.12.28 14:03:40 LOG3[0]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2021.12.28 14:03:40 LOG3[0]: sock_can_rd=n, sock_can_wr=n 2021.12.28 14:03:40 LOG3[0]: ssl_can_rd=n, ssl_can_wr=n 2021.12.28 14:03:40 LOG3[0]: read_wants_read=Y, read_wants_write=n 2021.12.28 14:03:40 LOG3[0]: write_wants_read=n, write_wants_write=Y 2021.12.28 14:03:40 LOG3[0]: shutdown_wants_read=n, shutdown_wants_write=n 2021.12.28 14:03:40 LOG3[0]: socket input buffer: 154 byte(s), TLS input buffer: 0 byte(s) 2021.12.28 14:03:40 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket """ """ debug = info output = /var/log/stunnel-imaps.log cert = /etc/stunnel/stunnel.pem exec = /usr/sbin/imapd execargs = imapd sslVersion = all options = NO_SSLv2 options = NO_SSLv3 """ -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAmHLE48ACgkQWVOoL214ZeFpYwCfe+qv09KWSfjNixhhcb5MJbr2 yAkAoKOyXZJwnKddSXYzIhbi7k1yPkoU =oGR+ -----END PGP SIGNATURE-----

1 0

Config to only listen when connect port is up
by roartysa＠gmail.com 23 Dec '21

23 Dec '21

Is there a config flag that can be set in the conf file that will tell stunnel to listen on the https accept port only when the connect port is up and listening? The issue i am trying to address is when a load balancer talks to a server, I need to make sure the port that stunnel redirects to is healthy. Right now the load balancer will send traffic to the port all the time regardless of the health of the port that stunnel redirects the traffic to.

2 1

stunnel 5.61 released
by Michał Trojnara 22 Dec '21

22 Dec '21

Dear Users, I have released version 5.61 of stunnel. ### Version 5.61, 2021.12.22, urgency: LOW * New features sponsored by the University of Maryland - Added new "protocol = capwin" and "protocol = capwinctrl" configuration file options. * New features for the Windows platform - Added client mode allowing authenticated users to view logs, reconfigure and terminate running stunnel services. - Added support for multiple GUI and service instances distinguised by the location of stunnel.conf. - Improved log window scrolling. - Added a new 'Pause auto-scroll' GUI checkbox. - Double click on the icon tray replaced with single click. - OpenSSL DLLs updated to version 3.0.1. * Other new features - Rewritten the testing framework in python (thx to Peter Pentchev for inspiration and initial framework). - Added support for missing SSL_set_options() values. - Updated stunnel.spec to support RHEL8. * Bugfixes - Fixed OpenSSL 3.0 build. - Fixed reloading configuration with "systemctl reload stunnel.service". - Fixed incorrect messages logged for OpenSSL errors. - Fixed printing IPv6 socket option defaults on FreeBSD. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 91ea0ca6482d8f7e7d971ee64ab4f86a2817d038a372f0893e28315ef2015d7a stunnel-5.61.tar.gz 19c5ff1f4101af1e69585328303c14249db2ec9063542101ca31edb6f6cc502f stunnel-5.61-win64-installer.exe 928ec94690564498bf523228946b2cdc90c7e346d6f0baf1f71b76cbe769b96c stunnel-5.61-android.zip Best regards, Mike

1 0

Log4j Vulnerability
by Tracy Drake - IQGC-C 17 Dec '21

17 Dec '21

Hello! Can you please tell me if Stunnel uses log4j and/or if it is vulnerable to it? Your feedback would be greatly appreciated! Thanks in advance! -- *TRACY DRAKE | CSM URSA/Infoconnect Training and Support* GSA COMET Hale Bopp Contract Work Phone: 704-253-5193 | Email: tracy.drake(a)gsa.gov

2 1

issue with connection sending cxml out
by Daniel Trickett 08 Dec '21

08 Dec '21

Hi, We are trying to send a cxml message from an old app using ssl_v3 to a client server using tls 1.2. We negotiate a connection and then the below happens. Any thoughts? This is on our test server. 2021.12.08 14:26:55 LOG6[12]: TLS connected: new session negotiated 2021.12.08 14:26:55 LOG6[12]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2021.12.08 14:26:55 LOG7[12]: Compression: null, expansion: null 2021.12.08 14:26:55 LOG7[12]: TLS alert (read): warning: close notify <<< 2021.12.08 14:26:55 LOG6[12]: TLS closed (SSL_read) 2021.12.08 14:26:55 LOG7[12]: Sent socket write shutdown 2021.12.08 14:26:55 LOG6[12]: Read socket closed (readsocket) 2021.12.08 14:26:55 LOG7[12]: Sending close_notify alert 2021.12.08 14:26:55 LOG7[12]: TLS alert (write): warning: close notify 2021.12.08 14:26:55 LOG6[12]: SSL_shutdown successfully sent close_notify alert 2021.12.08 14:26:55 LOG5[12]: Connection closed: 10187 byte(s) sent to TLS, 561 byte(s) sent to socket Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here emdgroup.com/en/privacy-statement.html<https://www.emdgroup.com/en/privacy-statement.html>

1 0

Revert automatically to https
by cnocera＠hyhat.com 08 Dec '21

08 Dec '21

With stunnel, is there a way for the website to automatically revert to https by just typing in the url without https:// in front of it?

1 0

Insecure file permissions on /etc/ssl/private.key
by jose isaias cabrera 29 Nov '21

29 Nov '21

Greetings! I have duckduckgo'ed and I have not found an answer, but what should be the permissions for the private key since the stunnel is giving me a warning/error regarding that: ... [ ] Loading private key from file: /etc/ssl/private.key [:] Insecure file permissions on /etc/ssl/private.key [ ] Private key loaded from file: /etc/ssl/private.key ... this is that I have set: jic@web:~$ ls -l /etc/ssl/private.key -rw-r--r-- 1 root www-data 1702 Oct 13 02:54 /etc/ssl/private.key the www-data is the user that runs the website. All is running well, apparently, but, I would like to set the correct permission on the private.key file. Thanks for your support. josé -- What if eternity is real? Where will you spend it? Hmmmm...

4 6

Althttpd web server setup using ZeroSSL
by jose isaias cabrera 29 Nov '21

29 Nov '21

Greetings! I have the ssl files from ZeroSSL, and I am trying to set up https using stunnel4 on an ubuntu server. I am new to https, I would love some of your help setting this up. Here is what I have done so far: 1. Installed Althttpd and http is working fine on the home network and from the external network. 2. I have installed stunnel4 on the ubuntu server jcabrera@selva:~$ stunnel -v [ ] Clients allowed=500 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled with OpenSSL 1.1.1c 28 May 2019 [.] Running with OpenSSL 1.1.1f 31 Mar 2020 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [!] Invalid configuration file name "-v" [!] realpath: No such file or directory (2) [ ] Deallocating section defaults 3. I have placed the ZeroSSl ssl files on the ssl directory as per ZeroSSL instructions jcabrera@selva:~$ ls -l /etc/ssl/*.crt -rw-r--r-- 1 root root 2431 Oct 20 16:27 /etc/ssl/ca_bundle.crt -rw-r--r-- 1 root root 2354 Oct 20 16:31 /etc/ssl/certificate.crt root@selva:/home/jcabrera# ls -l /etc/ssl/private/*.key -rw-r--r-- 1 root root 1702 Oct 20 16:33 /etc/ssl/private/private.key 4. Created the the /etc/stunnel/stunnel.conf file with these entries: root@selva:/home/jcabrera# cat /etc/stunnel/stunnel.conf cert = /etc/ssl/certificate.crt key = /etc/ssl/private/private.key \[https\] accept = :::443 TIMEOUTclose = 0 exec = /usr/bin/althttpd execargs = /usr/bin/althttpd -logfile ~/www/http.log -root ~/www -user www-data -https 1 And, I don't know what else to do. Any help would be greatly appreciated. Thanks. josé -- What if eternity is real? Where will you spend it? Hmmmm...

2 3

Office 365 connections stopped working
by Ben Bazian 26 Nov '21

26 Nov '21

This has been working for years and recently stopped. I am a novice here. Can someone look at this and please tell me what is happening? It is an old server that does not support TLS so we put Stunnel in front of it. I am sure the version of stunnel is pretty old. Maybe a TLS level issue? 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG6[21968:139797665822784]: Initializing service [SMTP Outgoing] 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG6[21968:139797665822784]: Initializing service [IMAP] 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG5[21968:139797665822784]: Configuration successful 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [POP3 Incoming] (FD=12) bound to 0.0.0.0:110 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [SMTP Outgoing] (FD=13) bound to 0.0.0.0:25 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [IMAP] (FD=14) bound to 0.0.0.0:143 2021.10.26 14:47:30 LOG7[21974:139797665822784]: Created pid file /var/run/stunnel.pid 2021.10.26 14:48:30 LOG7[21974:139797665822784]: Service [IMAP] accepted (FD=3) from 10.55.3.159:1852 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] started 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Waiting for a libwrap process 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Acquired libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Releasing libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Released libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] permitted by libwrap from 10.55.3.159:1852 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Service [IMAP] accepted connection from 10.55.3.159:1852 2021.10.26 14:48:30 LOG6[21974:139797665818368]: connect_blocking: connecting 52.96.87.226:993 2021.10.26 14:48:30 LOG7[21974:139797665818368]: connect_blocking: s_poll_wait 52.96.87.226:993: waiting 10 seconds 2021.10.26 14:48:30 LOG5[21974:139797665818368]: connect_blocking: connected 52.96.87.226:993 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Service [IMAP] connected remote server from 10.55.3.200:51358 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Remote socket (FD=16) initialized 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SNI: sending servername: outlook.office365.com 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SSL state (connect): before/connect initialization 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SSL state (connect): SSLv3 write client hello A 2021.10.26 14:48:30 LOG3[21974:139797665818368]: SSL_connect: Peer suddenly disconnected 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Remote socket (FD=16) closed 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Local socket (FD=3) closed 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] finished (0 left)

4 5

setting permissions on a unix socket
by David Mandelberg 03 Nov '21

03 Nov '21

Hi, Is there any way for stunnel to set permissions on a unix socket created with the `accept` option? I see setuid and setgid at https://www.stunnel.org/static/stunnel.html but nothing about a umask or permissions. P.S. The link on https://www.stunnel.org/lists.html to see the archive is broken. Apologies if this has come up before.

1 0

Stunnel connection to Akamai Cloud Servers (Hostheaders) with SNI
by Alan C. Bonnici 06 Oct '21

06 Oct '21

Hi, I am trying to use stunnel to exchange data with a service hosted on Akamai Servers. There is a need to implement SNI. In posts dated from 2016 which I found online, Stunnel did not support Host Headers. Is there a workaround, or has Stunnel implemented this functionality? I will be testing using postman. A sample config to get me going would really be appreciated. The URL is related to plivo. It is ak-api.plivo.com. Thank you in anticipation.

3 6

Is it possible to inhibit writing the stunnel logs to the / var / log / messages file?
by simona vittori 28 Sep '21

28 Sep '21

Hello, I ask you if it's possible to inhibit writing the stunnel logs to the / var / log / messages file. How do you it? Thank you in advance Bye Simona

2 1

Need a clean way to reject a client IP
by robin.kerdiles＠emanrisk.fr 28 Sep '21

28 Sep '21

Hello everyone, I'm doing a few tests on a dockerized service for stunnel under Alpine. stunnel -version stunnel 5.60 on x86_64-alpine-linux-musl platform Compiled with OpenSSL 1.1.1k 25 Mar 2021 Running with OpenSSL 1.1.1l 24 Aug 2021 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI If I set a wrong certificate on client side, my server logs get spammed with these lines : 2021.09.28 07:43:52 LOG5[66]: Service [***] accepted connection from *** 2021.09.28 07:43:52 LOG4[66]: CERT: Pre-verification error: unable to get local issuer certificate 2021.09.28 07:43:52 LOG4[66]: Rejected by CERT at depth=2: C=***, O=***, CN=*** 2021.09.28 07:43:52 LOG3[66]: SSL_accept: ssl/statem/statem_srvr.c:3711: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed 2021.09.28 07:43:52 LOG5[66]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket The cpu usage goes up to 35% and it seems there is no way to set a timeout before trying to reconnect on client side (which is not the perfect fix by the way). On server side, I don't know if we are supposed to be able to do something about that (for example rate limiting the requests ?). Even the fail2ban filter doesn't seem to support this case. And anyway it seems it requires manual patching on stunnel source code for the logs. Would it be possible to put on the same line the client IP and a message about the connection which has been rejected ? fail2ban filter : https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/stunnel.co… What would be appreciated -> a log line in this format : 2021.09.28 07:43:52 LOG4[66]: HOST has been rejected by CERT at depth=2: C=***, O=***, CN=*** Of course, I don't have in mind the other possible cases (missing cert, etc...). Thank you in advance, Robin KERDILES

2 1

Disguising HTTP 503 services unavailable
by Haruka Takagi 18 Sep '21

18 Sep '21

It is my understanding that; stunnel clients give up connecting servers because of HTTP 503 services unavailable, tunneling failure causes stunnel clients to notify original senders of errors, and original senders acknowledge communication failure and stop program. I would like stunnel clients to reconnecting servers in cases of 503 and not to notify original senders of failure, in order that original senders are unaware of failure and can continue program. If possible, I want to do this by writing stunnel.conf without modifying souce codes. Is this configuration possible?

4 5

protocol = proxy with redirect
by Rob Hoes 15 Sep '21

15 Sep '21

Hi, I am using client certificate verification with the redirect option, so that the connection gets transferred to a separate socket in case the certificate is not accepted (rather than dropping the connection). This works well, unless I add the option “protocol = proxy” in order to get the client’s TCP params passed on. In this case, the redirect option seems to be ignored. Are the “redirect” and “protocol = proxy” options incompatible with one another? Is there an alternative? Thanks, Rob

2 1

How to resolve DNS by stunnel?
by shiga＠smart-cast.co.jp 14 Sep '21

14 Sep '21

Hi, I'm facing DNS issues when connecting to a server using a dynamic IP address. I think stunnel refers to DNS at startup, so if the IP address changes in the middle, it will get a connection error. Can this be resolved with the "delay=on" option? I'm looking for a way to handle a dynamic IP address in stunnel. Thanks.

2 1

Session reuse problem
by Alen Loncaric 10 Sep '21

10 Sep '21

Hi guys, any reason my stunnel would not reuse sessions? 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): before SSL initialization 2021.09.09 13:14:00 LOG6[8]: writesocket: Socket is closed 2021.09.09 13:14:00 LOG7[9]: Initializing application specific data for session authenticated 2021.09.09 13:14:00 LOG5[8]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:00 LOG7[8]: Remote descriptor (FD=10) closed 2021.09.09 13:14:00 LOG7[8]: Local descriptor (FD=3) closed 2021.09.09 13:14:00 LOG7[8]: Service [squid] finished 2021.09.09 13:14:00 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:00 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:00 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:00 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:00 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:00 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:00 LOG6[ui]: Process 1933 finished with code 0 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server hello 2021.09.09 13:14:00 LOG6[9]: Certificate verification disabled 2021.09.09 13:14:00 LOG6[9]: Certificate verification disabled 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server certificate 2021.09.09 13:14:00 LOG6[9]: Client certificate not requested 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server done 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write client key exchange 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write change cipher spec 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server session ticket 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read change cipher spec 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read finished 2021.09.09 13:14:00 LOG7[9]: New session callback 2021.09.09 13:14:00 LOG7[9]: Peer certificate was cached (2037 bytes) 2021.09.09 13:14:00 LOG6[9]: Session id: DC783240F69C6910A2F8B9829504840EF619E30A14FEA982C944FBFB6828555F 2021.09.09 13:14:00 LOG7[9]: 1 client connect(s) requested 2021.09.09 13:14:00 LOG7[9]: 1 client connect(s) succeeded 2021.09.09 13:14:00 LOG7[9]: 0 client renegotiation(s) requested 2021.09.09 13:14:00 LOG7[9]: 0 session reuse(s) 2021.09.09 13:14:00 LOG6[9]: TLS connected: new session negotiated 2021.09.09 13:14:00 LOG6[9]: TLSv1.2 ciphersuite: AES128-GCM-SHA256 (128-bit encryption) 2021.09.09 13:14:00 LOG3[9]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2021.09.09 13:14:00 LOG7[9]: Compression: null, expansion: null 2021.09.09 13:14:01 LOG6[9]: Read socket closed (readsocket) 2021.09.09 13:14:01 LOG7[9]: Sending close_notify alert 2021.09.09 13:14:01 LOG6[9]: socket fd: Broken pipe (32) 2021.09.09 13:14:01 LOG7[9]: TLS alert (write): warning: close notify 2021.09.09 13:14:01 LOG6[9]: SSL_shutdown successfully sent close_notify alert 2021.09.09 13:14:01 LOG6[9]: writesocket: Socket is closed 2021.09.09 13:14:01 LOG5[9]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:01 LOG7[9]: Remote descriptor (FD=10) closed 2021.09.09 13:14:01 LOG7[9]: Local descriptor (FD=3) closed 2021.09.09 13:14:01 LOG7[9]: Service [squid] finished 2021.09.09 13:14:01 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:01 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:01 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:01 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:01 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:01 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:01 LOG6[ui]: Process 1934 finished with code 0 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: Service [squid] accepted (FD=3) from 127.0.0.1:49567 2021.09.09 13:14:03 LOG7[10]: Service [squid] started 2021.09.09 13:14:03 LOG7[10]: Setting local socket options (FD=3) 2021.09.09 13:14:03 LOG7[10]: Option TCP_NODELAY set on local socket 2021.09.09 13:14:03 LOG5[10]: Service [squid] accepted connection from 127.0.0.1:49567 2021.09.09 13:14:03 LOG6[10]: s_connect: connecting 44.44.44.44:522 2021.09.09 13:14:03 LOG7[10]: s_connect: s_poll_wait 44.44.44.44:522: waiting 10 seconds 2021.09.09 13:14:03 LOG7[10]: FD=6 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[10]: FD=10 events=0x5 revents=0x0 2021.09.09 13:14:03 LOG5[10]: s_connect: connected 44.44.44.44:522 2021.09.09 13:14:03 LOG5[10]: Service [squid] connected remote server from 10.1.3.57:42843 2021.09.09 13:14:03 LOG7[10]: Setting remote socket options (FD=10) 2021.09.09 13:14:03 LOG7[10]: Option TCP_NODELAY set on remote socket 2021.09.09 13:14:03 LOG7[10]: Remote descriptor (FD=10) initialized 2021.09.09 13:14:03 LOG6[10]: SNI: sending servername: 44.44.44.44 2021.09.09 13:14:03 LOG6[10]: Peer certificate not required 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): before SSL initialization 2021.09.09 13:14:03 LOG7[10]: Initializing application specific data for session authenticated 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server hello 2021.09.09 13:14:03 LOG6[10]: Certificate verification disabled 2021.09.09 13:14:03 LOG6[10]: Certificate verification disabled 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server certificate 2021.09.09 13:14:03 LOG6[10]: Client certificate not requested 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server done 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write client key exchange 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write change cipher spec 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server session ticket 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read change cipher spec 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read finished 2021.09.09 13:14:03 LOG7[10]: New session callback 2021.09.09 13:14:03 LOG7[10]: Peer certificate was cached (2037 bytes) 2021.09.09 13:14:03 LOG6[10]: Session id: 85FD50E2A9D57B12D315C834EBA949CF015B7776C6A18486B06CE53F4C52D689 2021.09.09 13:14:03 LOG7[10]: 1 client connect(s) requested 2021.09.09 13:14:03 LOG7[10]: 1 client connect(s) succeeded 2021.09.09 13:14:03 LOG7[10]: 0 client renegotiation(s) requested 2021.09.09 13:14:03 LOG7[10]: 0 session reuse(s) 2021.09.09 13:14:03 LOG6[10]: TLS connected: new session negotiated 2021.09.09 13:14:03 LOG6[10]: TLSv1.2 ciphersuite: AES128-GCM-SHA256 (128-bit encryption) 2021.09.09 13:14:03 LOG3[10]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2021.09.09 13:14:03 LOG7[10]: Compression: null, expansion: null 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: Service [squid] accepted (FD=3) from 127.0.0.1:49569 2021.09.09 13:14:03 LOG7[11]: Service [squid] started 2021.09.09 13:14:03 LOG7[11]: Setting local socket options (FD=3) 2021.09.09 13:14:03 LOG7[11]: Option TCP_NODELAY set on local socket 2021.09.09 13:14:03 LOG5[11]: Service [squid] accepted connection from 127.0.0.1:49569 2021.09.09 13:14:03 LOG6[11]: s_connect: connecting 44.44.44.44:522 2021.09.09 13:14:03 LOG7[11]: s_connect: s_poll_wait 44.44.44.44:522: waiting 10 seconds 2021.09.09 13:14:03 LOG7[11]: FD=6 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[11]: FD=10 events=0x5 revents=0x0 2021.09.09 13:14:03 LOG5[11]: s_connect: connected 44.44.44.44:522 2021.09.09 13:14:03 LOG5[11]: Service [squid] connected remote server from 10.1.3.57:42845 2021.09.09 13:14:03 LOG6[10]: Read socket closed (readsocket) 2021.09.09 13:14:03 LOG7[11]: Setting remote socket options (FD=10) 2021.09.09 13:14:03 LOG7[11]: Option TCP_NODELAY set on remote socket 2021.09.09 13:14:03 LOG7[11]: Remote descriptor (FD=10) initialized 2021.09.09 13:14:03 LOG7[10]: Sending close_notify alert 2021.09.09 13:14:03 LOG6[11]: SNI: sending servername: 44.44.44.44 2021.09.09 13:14:03 LOG6[10]: socket fd: Broken pipe (32) 2021.09.09 13:14:03 LOG6[11]: Peer certificate not required 2021.09.09 13:14:03 LOG7[10]: TLS alert (write): warning: close notify 2021.09.09 13:14:03 LOG6[10]: SSL_shutdown successfully sent close_notify alert 2021.09.09 13:14:03 LOG6[10]: writesocket: Socket is closed 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): before SSL initialization2021.09.09 13:14:03 LOG5[10]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:03 LOG7[11]: Initializing application specific data for session authenticated 2021.09.09 13:14:03 LOG7[10]: Remote descriptor (FD=10) closed 2021.09.09 13:14:03 LOG7[10]: Local descriptor (FD=3) closed 2021.09.09 13:14:03 LOG7[10]: Service [squid] finished 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:03 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:03 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:03 LOG6[ui]: Process 1937 finished with code 0 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server hello 2021.09.09 13:14:03 LOG6[11]: Certificate verification disabled 2021.09.09 13:14:03 LOG6[11]: Certificate verification disabled 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server certificate 2021.09.09 13:14:03 LOG6[11]: Client certificate not requested 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server done 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write client key exchange 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write change cipher spec 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server session ticket 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read change cipher spec 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read finished 2021.09.09 13:14:03 LOG7[11]: New session callback 2021.09.09 13:14:03 LOG7[11]: Peer certificate was cached (2037 bytes) 2021.09.09 13:14:03 LOG6[11]: Session id: B171BF0D4CDB808D50C3CE4CDAA6AE53F2396068A9BD947D8277294F91CCFBFE 2021.09.09 13:14:03 LOG7[11]: 1 client connect(s) requested 2021.09.09 13:14:03 LOG7[11]: 1 client connect(s) succeeded 2021.09.09 13:14:03 LOG7[11]: 0 client renegotiation(s) requested 2021.09.09 13:14:03 LOG7[11]: 0 session reuse(s) 2021.09.09 13:14:03 LOG6[11]: TLS connected: new session negotiated 2021.09.09 13:14:03 LOG6[11]: TLSv1.2 ciphersuite: AES128-GCM-SHA256 (128-bit encryption) 2021.09.09 13:14:03 LOG3[11]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2021.09.09 13:14:03 LOG7[11]: Compression: null, expansion: null 2021.09.09 13:14:03 LOG6[11]: Read socket closed (readsocket) 2021.09.09 13:14:03 LOG7[11]: Sending close_notify alert 2021.09.09 13:14:03 LOG6[11]: socket fd: Broken pipe (32) 2021.09.09 13:14:03 LOG7[11]: TLS alert (write): warning: close notify 2021.09.09 13:14:03 LOG6[11]: SSL_shutdown successfully sent close_notify alert 2021.09.09 13:14:03 LOG6[11]: writesocket: Socket is closed 2021.09.09 13:14:03 LOG5[11]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:03 LOG7[11]: Remote descriptor (FD=10) closed 2021.09.09 13:14:03 LOG7[11]: Local descriptor (FD=3) closed 2021.09.09 13:14:03 LOG7[11]: Service [squid] finished 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:03 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:03 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:03 LOG6[ui]: Process 1938 finished with code 0 If i test with s_client: openssl s_client -connect 44.44.44.44:522 -reconnect I see TLS reused every time. Thank you!

1 0

stunnel logfile and setuid/setgid
by Norbert Hanke 02 Sep '21

02 Sep '21

Hi, I'm new to this list and hope I don't raise a question that has been raised many times before. I searched the archive and couldn't find that discussed previously... I want to configure stunnel using setuid = nobody setgid = nobody while having it write its output to its own logfile, not using syslog, with output = /var/log/stunnel.log log = append syslog = no This works when user nobody has write-access to an existing logfile, or user nobody is allowed to create the file in the directory. Both is not a good idea: user nobody should not have write access there. I could limit potential damage by having a separate directory with such access to nobody, but that is still kind of wrong. Or I could create a separate user only for stunnel and give that user full access to a separate directory: that would be more secure, only a hijacked (hopefully not) stunnel could tamper with its own logfiles. Shouldn't stunnel create and/or open the logfile while it is still running as root, and only then switch to user nobody? Or is there an option that I did not see so far allowing for what I'm trying? Thanks for any help. Regards, Norbert

1 0

Stunnel 5.60 started via Stunnel TLS wrapper on Windows 10 machine doesn't seem to be working
by ling＠aliko.com 01 Sep '21

01 Sep '21

Hi, I am trying to get Stunnel 5.60 started automatically as a service. My stunnel.conf is stored under C:\Program Files (x86)\stunnel\config works fine if I run stunnel.exe manually from CMD or bring up the GUI and reload configuration. Now I would like it to start automatically after reboots. I tried running stunnel.exe -install which installs the Stunnel TLS wrapper service. Starting the service does not however do anything. The "Path to execute" it installs for the service is "C:\Program Files (x86)\stunnel\config" -service -install. I don't see anything in the log. I can see that the stunnel.exe process is running in task manager. But running netstat -ao shows that no port is being listened to by the PID. Tried removing my stunnel.conf file and the service will still starts but stunnel doesn't seem to be doing anything. What could be the problem?

2 2

Minor bugfix: parameter type
by Peter Pentchev 19 Aug '21

19 Aug '21

Hi, Thanks a lot for the continued development of stunnel! While checking whether my Debian packages can be built with the upcoming GCC 11, I found (or rather, GCC reported) a minor discrepancy in the type of the "hash" parameter to the crypt_DES() function in protocol.c. What do you think about the attached patch? It is also available at: https://salsa.debian.org/debian/stunnel/-/blob/master/debian/patches/06-des… Thanks again, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)debian.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

stunnel 60 released
by Michał Trojnara 16 Aug '21

16 Aug '21

Dear Users, I have released version 5.60 of stunnel. ### Version 5.60, 2021.08.16, urgency: LOW * New features - New 'sessionResume' service-level option to allow or disallow session resumption - Added support for the new SSL_set_options() values. - Download fresh ca-certs.pem for each new release. * Bugfixes - Fixed 'redirect' with 'protocol'. This combination is not supported by 'smtp', 'pop3' and 'imap' protocols. - Enforced minimum WIN32 log window size. - Fixed support for password-protected private keys with OpenSSL 3.0 (thx to Dmitry Belyavskiy). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c45d765b1521861fea9b03b425b9dd7d48b3055128c0aec673bba5ef9b8f787d stunnel-5.60.tar.gz 190b79cb94a4f70f362e44c32d150edf8ae660734d3fa0cbd990c3821e8f3083 stunnel-5.60-win64-installer.exe bac9bb4503cc5091d78c9deb6aa013fc07e39d67db0dfcc073b098db52f54427 stunnel-5.60-android.zip Best regards, Mike

1 0

Is it possible to tunnel all tcp sessions of docker containers
by Yichun Ding 15 Aug '21

15 Aug '21

Hi, We are looking for the possibility to encrypt all the tcp sessions of containers between hosts with stunnel. So far I had no luck to come up with an iptables rule to route the packets to stunnel running on the host. We cannot change the container code as there are too many of them. Any advice would be appreciated! -yd

1 0

stunnel ignores chroot /etc/hosts
by kmx1818＠gmail.com 10 Aug '21

10 Aug '21

Hello all! On my localhost I've got a java 1.4 tls1.0 app/service running, which is hard-coded to http-call a soap service (tls1.0 level too) running on a remote host, say, svchost. Host resolution is "files" only (ie /etc/hosts) - no dns. The aim is to make this java client tls1.2-compliant. My solution is: 1/ configure svchost to be (an alias of) localhost - in global /etc/hosts 127.0.0.1 localhost svchost 2/ configure a chroot env for stunell with its own /etc/hosts 1.2.3.4 svchost (needless to say that to make it work I had to copy /etc's nsswitch.conf resolv.conf, a bunch of libraries, esp libnsl and nsl_files etc, and create another lot of /dev entries) I've tested it with the native getent command: $ getent hosts svchost 127.0.0.1 $ chroot /var/run/stunnel/chroot getent hosts svchost 1.2.3.4 3/ run stunnel in chroot mode: # /opt/csw/bin/stunnel -version stunnel 5.59 on sparc-sun-solaris2.10 platform Compiled/running with OpenSSL 1.0.2u 20 Dec 2019 ; for tls1 clients client = yes sslVersion = TLSv1.2 delay = yes chroot = /var/run/stunnel/chroot [tls12] accept = localhost:80 connect = svchost:443 ; Alas, stunnel still resolves svchost from the global /etc/hosts - not from chroot's!: $ curl -kL http://svchost/service curl: (52) Empty reply from server ...and in /var/adm/messages: …LOG[4]: Service [tls12] accepted connection from 127.0.0.1:47944 …LOG[4]: s_connect: connecting 127.0.0.1:443 …LOG[4]: s_connect: s_poll_wait 127.0.0.1:443: waiting 10 seconds …LOG[4]: s_connect: connect 127.0.0.1:443: Connection refused (146) …LOG[4]: No more addresses to connect I've tried foreground yes/no, truss/strace - nothing useful... What am I missing!? Thank you in advance!

2 2

Unexpected socket close while sending mail
by zfefm＠gmx.de 27 Jul '21

27 Jul '21

Hi, since several days I try to get stunnel working to add TLS1.2 or higher support to my outdated email client program (Applemail 4.6) as my service provider will stop supporting the old protocols soon. The protocol of stunnel looks as if the connection gets established well. But as soon I want to send a mail my mail program tries for 10-15s to send an then gives up. In the stunnel protocol (time stamp 16:54:22) the server seems to accept the connection, but about 10-15s later I get: Unexpected socket close (s_read) Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Any ideas what could be the problem? Thanks. conf and protocol attached. conf: setuid = nobody setgid = nogroup foreground = yes debug = 7 output = /usr/local/etc/stunnel/stunnel.log [strato-pop3] client = yes verifyChain = yes accept = 127.0.0.1:110 connect = pop3.strato.de:995 CApath = /usr/local/etc/stunnel/ cert = /usr/local/etc/stunnel/stunnel.pem checkHost = pop3.strato.de protocol = pop3 [strato-smtp] client = yes verifyChain = yes accept = 127.0.0.1:25 connect = smtp.strato.de:465 checkHost = smtp.strato.de CApath = /usr/local/etc/stunnel/ cert = /usr/local/etc/stunnel/stunnel.pem protocol = smtp protocol : 2021.07.22 16:53:49 LOG6[ui]: Initializing inetd mode configuration 2021.07.22 16:53:49 LOG7[ui]: Clients allowed=125 2021.07.22 16:53:49 LOG5[ui]: stunnel 5.59 on x86_64-apple-darwin10.8.0 platform 2021.07.22 16:53:49 LOG5[ui]: Compiled/running with OpenSSL 1.1.1k 25 Mar 2021 2021.07.22 16:53:49 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.07.22 16:53:49 LOG7[ui]: errno: (*__error()) 2021.07.22 16:53:49 LOG6[ui]: Initializing inetd mode configuration 2021.07.22 16:53:49 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2021.07.22 16:53:49 LOG5[ui]: UTF-8 byte order mark detected 2021.07.22 16:53:49 LOG5[ui]: FIPS mode disabled 2021.07.22 16:53:49 LOG6[ui]: Compression enabled: 0 methods 2021.07.22 16:53:49 LOG7[ui]: No PRNG seeding was required 2021.07.22 16:53:49 LOG6[ui]: Initializing service [strato-pop3] 2021.07.22 16:53:49 LOG6[ui]: stunnel default security level set: 2 2021.07.22 16:53:49 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2021.07.22 16:53:49 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2021.07.22 16:53:49 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2021.07.22 16:53:49 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG7[ui]: Private key check succeeded 2021.07.22 16:53:49 LOG6[ui]: DH initialization skipped: client section 2021.07.22 16:53:49 LOG7[ui]: ECDH initialization 2021.07.22 16:53:49 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2021.07.22 16:53:49 LOG6[ui]: Initializing service [strato-smtp] 2021.07.22 16:53:50 LOG6[ui]: stunnel default security level set: 2 2021.07.22 16:53:50 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2021.07.22 16:53:50 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2021.07.22 16:53:50 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2021.07.22 16:53:50 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG7[ui]: Private key check succeeded 2021.07.22 16:53:50 LOG6[ui]: DH initialization skipped: client section 2021.07.22 16:53:50 LOG7[ui]: ECDH initialization 2021.07.22 16:53:50 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2021.07.22 16:53:50 LOG5[ui]: Configuration successful 2021.07.22 16:53:50 LOG7[ui]: Deallocating deployed section defaults 2021.07.22 16:53:50 LOG7[ui]: Binding service [strato-pop3] 2021.07.22 16:53:50 LOG7[ui]: Listening file descriptor created (FD=8) 2021.07.22 16:53:50 LOG7[ui]: Setting accept socket options (FD=8) 2021.07.22 16:53:50 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2021.07.22 16:53:50 LOG6[ui]: Service [strato-pop3] (FD=8) bound to 127.0.0.1:110 2021.07.22 16:53:50 LOG7[ui]: Binding service [strato-smtp] 2021.07.22 16:53:50 LOG7[ui]: Listening file descriptor created (FD=10) 2021.07.22 16:53:50 LOG7[ui]: Setting accept socket options (FD=10) 2021.07.22 16:53:50 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2021.07.22 16:53:50 LOG6[ui]: Service [strato-smtp] (FD=10) bound to 127.0.0.1:25 2021.07.22 16:53:50 LOG7[ui]: No pid file being created 2021.07.22 16:53:50 LOG7[cron]: Cron thread initialized 2021.07.22 16:53:50 LOG6[cron]: Executing cron jobs 2021.07.22 16:53:50 LOG6[cron]: Cron jobs completed in 0 seconds 2021.07.22 16:53:50 LOG7[cron]: Waiting 86400 seconds 2021.07.22 16:54:22 LOG7[ui]: Found 1 ready file descriptor(s) 2021.07.22 16:54:22 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[ui]: FD=8 events=0x1 revents=0x1 2021.07.22 16:54:22 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[ui]: Service [strato-pop3] accepted (FD=3) from 127.0.0.1:49864 2021.07.22 16:54:22 LOG7[0]: Service [strato-pop3] started 2021.07.22 16:54:22 LOG7[0]: Setting local socket options (FD=3) 2021.07.22 16:54:22 LOG7[0]: Option TCP_NODELAY set on local socket 2021.07.22 16:54:22 LOG5[0]: Service [strato-pop3] accepted connection from 127.0.0.1:49864 2021.07.22 16:54:22 LOG6[0]: s_connect: connecting 81.169.145.131:995 2021.07.22 16:54:22 LOG7[0]: s_connect: s_poll_wait 81.169.145.131:995: waiting 10 seconds 2021.07.22 16:54:22 LOG7[0]: FD=6 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[0]: FD=13 events=0x5 revents=0x0 2021.07.22 16:54:22 LOG5[0]: s_connect: connected 81.169.145.131:995 2021.07.22 16:54:22 LOG5[0]: Service [strato-pop3] connected remote server from 192.168.17.130:49865 2021.07.22 16:54:22 LOG7[0]: Setting remote socket options (FD=13) 2021.07.22 16:54:22 LOG7[0]: Option TCP_NODELAY set on remote socket 2021.07.22 16:54:22 LOG7[0]: Remote descriptor (FD=13) initialized 2021.07.22 16:55:22 LOG3[0]: Unexpected socket close (s_read) 2021.07.22 16:55:22 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2021.07.22 16:55:22 LOG7[0]: Remote descriptor (FD=13) closed 2021.07.22 16:55:22 LOG7[0]: Local descriptor (FD=3) closed 2021.07.22 16:55:22 LOG7[0]: Service [strato-pop3] finished (0 left) 2021.07.22 16:55:22 LOG7[0]: str_stats: 1 block(s), 32 data byte(s), 90 control byte(s) 2021.07.22 16:55:22 LOG7[0]: str_stats: 32 byte(s) at network.c:735

2 3

Equivalence of verify=2
by Yann RESCOURIO 22 Jul '21

22 Jul '21

Hello I would like to authenticate a server with only its CA file. What is the equivalence of verify=2 ? requireCert = yes verifyChain = no verifyPeer = yes Regards Yann

3 5

idea: linux stunnel mini-GUI
by Dmitry Bakshaev 13 Jul '21

13 Jul '21

we need start stunnel on linux desktop by ordinary user (like on windows): 1 click stunnel icon on system menu 2 enter user certificate password 3 use opened tunnels with users applications 4 on desktop session ends close all tunnels make XDG menu entry file: [Desktop Entry] Type=Application Name=stunnel Categories=Network; GenericName=TLS/SSL - Port Wrapper Comment[ru_RU]=Секретный туннель Icon=stunnel Exec=/usr/bin/stunnel Terminal=true X-KeepTerminal=true but only problem is how stunnel react on signals: HUP is daemon's "reload config". in X-session HUP signal is "session end" and stunnel is not exited on closing terminal or logout. attached patch change this behavior: if "foreground=yes" specified in stunnel.conf HUP signal is treated as TERM and stunnel exited. foreground=yes is "debug" or "desktop" mode of stunnel. XDG-desktop file and icon file may be included in default stunnel distributions.

1 0

Difficulty to select exact Cipher
by Sachin Deshmukh 12 Jul '21

12 Jul '21

Hello Together, I had been trying to use a stunnel to set PSK encrypted TLS. Below is my conf file. [client] client = yes accept = 127.0.0.1:8888 connect = 192.168.1.100:443 ciphers = PSK-AES128-CBC-SHA256 PSKsecrets = /data/dummy.txt I can see communication, but client e.g. Stunnel from Client side offer several other cipher in addition to exact one which is expected as per conf. I wish PSK-AES128-CBC-SHA256 (0x00ae) But I see the list below in actual communication. [image: image.png] Please let me know 1 .how we can inform stunnel to use exact and only 1 cipher provided in the conf file. Or 2. How can we state hex id instead of string. If I see a cipher list, with the same keyword as a part or whole there are more than 1 ciphers, I suppose this causes stunnel to take a list as per string match. ECDHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA256 RSA-PSK-AES128-CBC-SHA256 TLSv1 Kx=RSAPSK Au=RSA Enc=AES(128) Mac=SHA256 DHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=DHEPSK Au=PSK Enc=AES(128) Mac=SHA256 *PSK-AES128-CBC-SHA256 * TLSv1 Kx=PSK Au=PSK Enc=AES(128) Mac=SHA256 Can we make a stunnel to select only one exact cipher?

1 0

curl 7.61 exit status 8 from stunnel service of tls1
by kmx1818＠gmail.com 09 Jul '21

09 Jul '21

Hello all, For a remote tls1 web service : $ # openssl s_client -connect myremote:7002 -tls1 CONNECTED(00000004) depth=0 CN = xxx, OU = xxx, O = xxx, C = xxx verify error:num=18:self signed certificate verify return:1 depth=0 CN = xxx, OU = xxx, O = xxx, C = xxx verify return:1 --- Certificate chain ... --- Server certificate -----BEGIN CERTIFICATE----- MIIC8zCCAdsCBGCvjhEwDQYJKoZIhvcNAQEFBQAwPjEOMAwGA1UEAxMFRUZXRUIx ... QG9sNNhQW65rRVmdqy/g0cBbLKRKhmRCS+ajRIzBcO9ZmMe42TES -----END CERTIFICATE----- subject=XXX issuer=XXX --- No client certificate CA names sent --- SSL handshake has read 889 bytes and written 509 bytes --- New, TLSv1/SSLv3, Cipher is RC4-MD5 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1 Cipher : RC4-MD5 Session-ID: 2D9F8D8833A459C16C1D01F0C92F8EB7 Session-ID-ctx: Master-Key: 1BF68D1AAEEC291A60252ECD63C374661FBBE028FB39A75DDA29E4E3FB6FE34CFC80F875F9E16F9D7C840F185757F583 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1625842735 Timeout : 7200 (sec) Verify return code: 18 (self signed certificate) --- closed $ I can test it alright with an "old" curl $ curl --version curl 7.15.4 (sparc-sun-solaris2.9) libcurl/7.15.4 OpenSSL/0.9.7g zlib/1.2.3 Protocols: tftp ftp telnet dict ldap http file https ftps Features: IPv6 Largefile NTLM SSL libz ...like this $ curl -skL https://myremote:7002/MyWebService?WSDL <?xml version="1.0" encoding="UTF-8"?> ... </soap:address> </port> </service> </definitions> I want to tls1.2-enable myremote:7002 with stunnel, and run a tls1.2 curl instead. My stunnel installation $ /opt/csw/bin/stunnel -version Initializing inetd mode configuration stunnel 5.59 on sparc-sun-solaris2.10 platform Compiled with OpenSSL 1.0.2u 20 Dec 2019 Running with OpenSSL 1.0.2o 27 Mar 2018 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP Global options: RNDbytes = 1024 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK curves = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 I start it with this service config: [my12] client = no accept = 7002 connect = myremote:7002 cert = /etc/opt/csw/stunnel/stunnel.crt key = /etc/opt/csw/stunnel/stunnel.key sslVersion = TLSv1.2 debug = 7 and test it with a fairly recent curl $ /opt/csw/bin/curl --version curl 7.61.0 (sparc-sun-solaris2.10) libcurl/7.61.0 OpenSSL/1.0.2o zlib/1.2.8 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) Release-Date: 2018-07-11 Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp Features: AsynchDNS IDN IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP UnixSockets HTTPS-proxy PSL Metalink Alas, the recent curl call $ /opt/csw/bin/curl -skL https://myremote:7002/MyWebService?WSDL ...fails with exit status 23 In verbose mode we get * Trying 127.0.0.1... * TCP_NODELAY set * Failed to set TCP_KEEPALIVE on fd 4 * Connected to localhost (127.0.0.1) port 7002 (#0) * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: none CApath: /etc/opt/csw/ssl/certs * TLSv1.2 (OUT), TLS header, Certificate Status (22): * TLSv1.2 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Client hello (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS change cipher, Client hello (1): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server did not agree to a protocol * Server certificate: * subject: C=TS; ST=Westfarthing; L=Hobbiton; O=Thorin and Company; OU=Burglars; CN=ahost.theshire.net; emailAddress=bilbo(a)theshire.net * start date: Jun 30 09:24:25 2021 GMT * expire date: Jun 30 09:24:25 2022 GMT * issuer: C=TS; ST=Westfarthing; L=Hobbiton; O=Thorin and Company; OU=Burglars; CN=ahost.theshire.net; emailAddress=bilbo(a)theshire.net * SSL certificate verify result: self signed certificate (18), continuing anyway. > GET /MyWebService?WSDL HTTP/1.1 > Host: localhost:7002 > User-Agent: curl/7.61.0 > Accept: */* > Warning: Binary output can mess up your terminal. Use "--output -" to tell Warning: curl to output it to your terminal anyway, or consider "--output Warning: <FILE>" to save to a file. * Failed writing body (0 != 7) * Closing connection 0 * TLSv1.2 (OUT), TLS alert, Client hello (1): $ I tried various curl flags - nothing works. In the meantime stunnel logs no errors Jul 9 16:16:45 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: Service [my12] accepted connection from 127.0.0.1:39165 Jul 9 16:16:45 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: s_connect: connected 10.240.28.69:7002 Jul 9 16:16:45 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: Service [my12] connected remote server from xxx.yyy.zzz.www:39166 Jul 9 16:17:10 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: Connection closed: 7 byte(s) sent to TLS, 116 byte(s) sent to socket What am i doing wrong!? Thanks in advance!

1 0

stunnel and rsyslog
by Yann RESCOURIO 28 Jun '21

28 Jun '21

Hello I use stunnel for rsyslog. And on the client equipment, I use also rsyslog queues for buffering in case of disconnection. But in case of reboot: * without stunnel, the buffered log messages are received on the rsyslog server * with stunnel, no buffered log messages are received on the rsyslog server On the client equipment, is it possible to refuse the local stunnel connections as long as the remote stunnel connection is down ? Regards Yann Rescourio

3 2

FIPS 140-2 & Ubuntu Pro
by Patrick Kaeding 23 Jun '21

23 Jun '21

Hi I am trying to set up stunnel with FIPS 140-2 compliance. I found some discussion of this on this mailing list from many years ago, but I'm not sure how much of that is still relevant today. I am running Ubuntu Pro 18.04, with FIPS mode (including the userspace modules: https://security-certs.docs.ubuntu.com/en/fips) If I simply `apt-get install stunnel4`, I can create a config with `fips = yes`, and when I start it up, I see this line logged: 2021.06.23 15:45:24 LOG5[ui]: FIPS mode enabled Does this mean I am all set, without needing to compile anything from source? In this message (from almost a decade ago), it sounds like this might be the validation I need: > BTW: "fips" option is only available when stunnel is built with FIPS support. FIPS mode is also clearly logged on startup https://www.stunnel.org/pipermail/stunnel-users/2012-November/003963.html Or do I need to build stunnel from scratch, using my local openssl distribution? Thanks! -- Patrick Kaeding pkaeding(a)launchdarkly.com

1 0

Number of tunnels open in Stunnel
by Moti Berger 21 Jun '21

21 Jun '21

Hi Is there a command I can run to get the current number of opened tunnels? I'm running Stunnel version 5.57. Thanks, Moti

1 0

Help needed for email client
by Ian Huysman 15 Jun '21

15 Jun '21

Hi, I just tried to configure stunnel as proxy between an email client (Outlook Express) and the email server (SMTP and IMAP). The problem is that the connection times out in the client while synchronising the IMAP folders. But I can send emails from the client. This is my relatively basic configuration: [SMTP] client = yes accept = 25 connect = smtp.office365.com:587 protocol = smtp [IMAP] client = yes accept = 143 connect = outlook.office365.com:993 protocol = imap Any help would be greatly appreciated! Regards, Ian.

3 2