- stunnel-users - stunnel.org

clarification on Security BugFix released in version 5.57
by svitatissimo2004＠hotmail.com 15 Oct '20

15 Oct '20

looking the changelog of latest version of stunnle (version 5.57) I see the following statement: "The "redirect" option was fixed to properly handle "verifyChain = yes" (thx to Rob Hoes)." It is possible to have more information on the vulnerability fixed?

1 0

clarification on Security BugFix released in version 5.57
by svitatissimo2004＠hotmail.com 15 Oct '20

15 Oct '20

looking the changelog of latest version of stunnle (version 5.57) I see the following statement: "The "redirect" option was fixed to properly handle "verifyChain = yes" (thx to Rob Hoes)." It is possible to have more information on the vulnerability fixed?

1 0

CERT: Pre-verification error: unsupported certificate purpose
by Bob Bob 12 Oct '20

12 Oct '20

Hi, I just updated to version 5.57 and the config I used for ever does not work anymore. I regenerated the self certs using the "Build a Self-signed stunnel.pem" in Windows and made sure the CN was matching the hostname of the server machine. I understand there is an issue with the self signed certificate... ...but it was working fine under 5.56. Server configuration [Server_SyncThing] cert = stunnel.pem accept = 999 connect = 127.0.0.1:24596 ciphers = PSK PSKsecrets = psk.txt Client configuration [SyncThing] client = yes accept = 127.0.0.1:24596 connect = 192.168.0.102:999 verifyPeer = yes CAfile = stunnel.pem PSKsecrets = psk.txt Service [SyncThing] connected remote server from 192.168.1.44:5455 2020.10.12 14:25:06 LOG7[33]: Setting remote socket options (FD=1516) 2020.10.12 14:25:06 LOG7[33]: Option TCP_NODELAY set on remote socket 2020.10.12 14:25:06 LOG7[33]: Remote descriptor (FD=1516) initialized 2020.10.12 14:25:06 LOG6[33]: SNI: sending servername: 192.168.0.102 2020.10.12 14:25:06 LOG6[33]: Peer certificate required 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): before SSL initialization 2020.10.12 14:25:06 LOG7[33]: Initializing application specific data for session authenticated 2020.10.12 14:25:06 LOG6[33]: PSK client configured for identity "user1" 2020.10.12 14:25:06 LOG7[33]: Initializing application specific data for session authenticated 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): SSLv3/TLS write client hello 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): SSLv3/TLS write client hello 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): SSLv3/TLS read server hello 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): TLSv1.3 read encrypted extensions 2020.10.12 14:25:06 LOG7[33]: Verification started at depth=0: C=FR, ST=Centre, L=Marseilles, O=CA, OU=CA, CN= TRUCK-D98J8TY 2020.10.12 14:25:06 LOG4[33]: CERT: Pre-verification error: unsupported certificate purpose 2020.10.12 14:25:06 LOG4[33]: Rejected by CERT at depth=0: C=FR, ST=Centre, L=Marseilles, O=CA, OU=CA, CN= TRUCK-D98J8TY 2020.10.12 14:25:06 LOG7[33]: TLS alert (write): fatal: unsupported certificate 2020.10.12 14:25:06 LOG3[33]: SSL_connect: ssl/statem/statem_clnt.c:1913: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed 2020.10.12 14:25:06 LOG5[33]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.10.12 14:25:06 LOG7[33]: Deallocating application specific data for session connect address 2020.10.12 14:25:06 LOG7[33]: Deallocating application specific data for session connect address 2020.10.12 14:25:06 LOG7[33]: Remote descriptor (FD=1516) closed Any help would be welcome. Thanks.

2 1

Stunnel inetd Linux configuration
by Marco Marchi 30 Sep '20

30 Sep '20

Good morning, I'm trying to configure Stunnel on Linux (Slackware 14). Can anybody post an example of configuration file in order to run and manage Stunnel by means of inetd, keeping in mind that goal is to secure pop3 and imap? Openssl is already installed and running (version 1.1.1g, april 2020). Stunnel version downloaded and installed is 5.56. Certifcate has been generated by means of Openssl. Issues are related to the right syntax in stunnel.conf. Thank you in advance. Marco

1 0

sslVersion
by Ray 25 Sep '20

25 Sep '20

Hi Is sslVersion a global parameter that belongs to all segments or can it be inside a segment to only affect that segment? Example: output = /tmp/stunnel.log debug = emerg sslVersion = all # I assume it is applied to all Stunnel connection definitions [Stunnel_1] sslVersion = tls1_2 # How about this? I only want Stunnel_1 to be affected with sslVersion tls1_2 option. client = yes accept = 2222 connect = some_domain.com.au:8449 verify = 2 CAfile = /etc/stunnel/certs/root_digicert_ca.crt Thanks Ray

1 0

Address already in use (98) error trying to run stunnel client in Ubuntu Docker container
by greg＠yesenergy.com 24 Sep '20

24 Sep '20

Hello all, I'm getting the following error when I try to connect to a remote server from inside a running Docker container: "Binding service [client] to 127.0.0.1:1589: Address already in use (98)". I don't think this port is actually in use, and I've tried other ports with the same results. I know that this configuration works in my Windows dev machine, from which I have consistently connected to the remote server, no problem. I suspect this might be related to Docker's internal networking schema and port-forwarding, but I thought I would ask this group if anyone knows how to overcome this hurdle. Thanks for listening! Here is the config: [client] client = yes accept = 127.0.0.1:1589 connect = nn.nnn.nnn.nnn:443 checkHost = xxxxxxxxx.com sslVersion = TLSv1.2 CAfile = /usr/local/etc/stunnel/my_pemfile.pem verifyPeer = yes Here is the log trace: [ ] Clients allowed=512000 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled/running with OpenSSL 1.1.1d 10 Sep 2019 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /usr/local/etc/stunnel/stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [client] [ ] Ciphers: DES-CBC3-SHA:IDEA-CBC-MD5-DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA [ ] TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 [ ] TLS options: 0x02100004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [.] Configuration successful [ ] Binding service [client] [ ] Listening file descriptor created (FD=8) [ ] Setting accept socket options (FD=8) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [client] to 127.0.0.1:1589: Address already in use (98) [ ] Listening file descriptor created (FD=8) [ ] Setting accept socket options (FD=8) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [client] to 127.0.0.1:1589: Address already in use (98) [!] Binding service [client] failed [ ] Deallocating section defaults [ ] Unbinding service [client] [ ] Service [client] closed [ ] Deallocating section [client]

1 0

Stunnel to smtp-relay.gmail.com
by Anton Palmgård 22 Sep '20

22 Sep '20

Hi, a few days ago up to a week my stunnel connection to smtp-gmail.gmail.com. stopped working with the error: ep 21 17:25:57 stunnel LOG50: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Sep 21 17:25:57 stunnel LOG30: Remote server is not RFC 1425 compliant Sep 21 17:25:57 stunnel LOG50: Service [to_gmail] connected remote server from xxx.xxx.xxx.xxx:29662 Tried from 2 different Locations / sites (i.e companies) same error. The relay work fine without client settings but that leaves TLS to the endpoint.. Office 365 relay works fine with TLS. Contacted Google support but the claimed nothing have been changed. I assume somehting with the TLS version/ CIPHERS is wrong ? Conf simply looks like this: cert = /usr/local/etc/stunnel/stunnel.pem chroot = /var/tmp/stunnel setuid = stunnel setgid = stunnel [to_gmail] client = yes accept = 0.0.0.0:587 connect = smtp-relay.gmail.com:587 debug = 7 TIMEOUTclose = 0 protocol = smtp BR, Anton.

2 4

Stunnel failover
by Ray 16 Sep '20

16 Sep '20

Stunnel's failover option with prio settings works fine but the application first tries 3 syn to connect to the first endpoint and if failed then it tries the second endpoint. Is there any way to configure stunnel to try only once and failover to the second connection endpoint?

1 0

using Android Keystore with stunnel
by blacksun＠directbox.com 09 Sep '20

09 Sep '20

Hello, i am using stunnel 5.56 on Android 7.0. It is a non-rooted device. Android stores keys and certs in the android keystore. I am using a Let's Encrypt Cert on serverside, and on clients the options veryChain and chechHost. How can i use the System-integrated CA-Certs of Android for verifying the server-cert issued by Let's Encrypt? When i am searching the net, there are infos saying that the certs and keys are not accessible by filestructure, but there would be apis to access the keystore. The keystore would be protected with the PIN of the device. Thanks.

1 0

How to configure stunnel as HTTP proxy on Windows?
by Jason Long 08 Sep '20

08 Sep '20

Hello, I want to use stunnel on Windows as HTTP proxy, I changed the configuration as below: ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store [example-proxy] client = yes accept = 127.0.0.1:8080 connect = google.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token [example-pkcs11] client = yes accept = 127.0.0.1:8080 connect = google.com:8443 ;engineId = pkcs11 cert = pkcs11:token=MyToken;object=MyCert key = pkcs11:token=MyToken;object=MyKey But, it show me configuration error. How can I solve it? Thank you.

1 0

Stunnel - how to block IPs?
by Brent Kimberley 04 Sep '20

04 Sep '20

Hi James.To the best of my knowledge, your options include Darwin firewall and HAProxy - geoip. >>Just wondering if there is a way to have Stunnel not accept connection from certain IPs? stunnel -version stunnel 5.56 on x86_64-apple-darwin18.7.0 platform Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI

1 0

Stunnel - how to block IPs?
by James Brown 03 Sep '20

03 Sep '20

Just wondering if there is a way to have Stunnel not accept connection from certain IPs? stunnel -version stunnel 5.56 on x86_64-apple-darwin18.7.0 platform Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Thanks, James.

1 0

TLS1.0 fallback when only TLS1.2 allowed
by Wojciech Machula 31 Aug '20

31 Aug '20

So I've configured my stunnel to only use TLS1.2 and usually works ok. However when client gets some bad L7 response it send a TCP RST, after which all subsequent stunnel TLS Client Hellos are some hybrid of TLS1.0/TLS1.2, as can be seen in tshark output below. Once I restart the whole stunnel process subsequent TLS handshakes work fine using TLS1.2, until the next client RST is received. $ stunnel -version stunnel 4.56 on x86_64-redhat-linux-gnu platform $ cat /etc/centos-release CentOS Linux release 7.8.2003 (Core) $cat /etc/stunnel/dsr2rtcg-stunnel.conf output = /var/log/stunnel pid = /etc/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [poc] cert = /etc/pki/tls/certs/stunnel/aaa.crt key = /etc/pki/tls/private/stunnel/aaa.key CAfile = /etc/pki/tls/certs/stunnel/bbb.crt client = yes sslVersion = TLSv1.2 options = NO_TLSv1 accept = 172.18.180.78:45154 connect = 10.74.0.196:45154 ciphers = TLSv1.2+HIGH:!aNULL $ tshark -nn -V -d tcp.port==45154,ssl -r 20200729_09:42:44-port45154.pcap -2R "ssl.handshake" -c 1 | grep -i tls -B3 Secure Sockets Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) -- Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 1610 Version: TLS 1.2 (0x0303)

6 14

Sslkeylog
by Brent Kimberley 22 Aug '20

22 Aug '20

>>Any suggestions on sslkeylog via stunnel application Call SSL_CTX_set_keylog_callback() !? On Thu, Aug 13, 2020, 16:44 tayyib ahmed <tayyib76(a)gmail.com> wrote: > Hi Guys > > Is there any option to set sslkeylog to get ssl session id for stunnel > session? > > Br xx >

2 2

How to archive DNS load balance in stunnel client?
by Peter Zhao 22 Aug '20

22 Aug '20

Hi, We are trying to use DNS load balance in a stunnel client with round-robin algorithm. service.example.com is mapping to two ips. But when we update DNS to remove one of ips for service.example.com stunnel client still forward requests to both ips. How to make stunnel client to resolve domain name and refresh its cache? Here is stunnel configuration. sslVersion=TLSv1.2 cert = /etc/stunnel/stunnel.pem output=/var/log/stunnel.log [service-client] client = yes accept = localhost:4680 connect = service.example.com:4680 [service-server] client = no accept = 10.10.0.16:4680 connect = loclhost:80 Here is the resolving result for service.example.com. ;; ANSWER SECTION: service.example.com. 5 IN A 10.10.0.16 service.example.com. 5 IN A 10.10.0.8

3 3

Sslkeylog
by tayyib ahmed 16 Aug '20

16 Aug '20

Hi Guys Is there any option to set sslkeylog to get ssl session id for stunnel session? Br xx

1 1

Stunnel 5.56 Windows 10 Service - Not functioning after Reboot
by Rod Marr 16 Aug '20

16 Aug '20

Hi all, I have installed Stunnel 5.56 win64 on a fully updated Windows 10 machine to work with Blue Iris. Stunnel operates well when I manually start it however I cannot get it to work automatically after a reboot. I have run the run the “stunnel Service Install” and “stunnel Service Start” shortcuts supplied, and in the first instance the service installs and starts. I can then connect through Stunnel to my Blue Iris server. I have found that after I reboot, the Stunnel service appears to start automatically but it is not functional. I cannot connect through it to Blue Iris. Stunnel is visible and Running in the Windows 10 Services list (from services.msc) and the Windows Task Manager shows a Process and Service active. To rectify this I can manually issue the “stunnel Service Stop”, followed by the “stunnel Service Start” shortcuts and the service becomes functional again. I have tried turning on debug info and the stunnel log file in stunnel.conf and see that log entries only begin after I have done the stop/start manual process. Thanks for any insight to what I’m sure I am missing here. Rod Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10

2 2

Sslkeylog
by Brent Kimberley 14 Aug '20

14 Aug '20

No sign of SSL_CTX_set_keylog_callback()... Date: Thu, 13 Aug 2020 16:44:22 +0100 From: tayyib ahmed <tayyib76(a)gmail.com> To: stunnel-users(a)stunnel.org Subject:Hi Guys Is there any option to set sslkeylog to get ssl session id for stunnel session? Br xx

1 0

Timeout issues
by gorf＠hyperfunk.club 05 Aug '20

05 Aug '20

Hi, I'm using stunnel v5.56 on FreeBSD to proxy connections to a web server (running Apache), for a small number of users. Users connecting to the service keep running into issues with timeouts. I see timeout errors in the stunnel log messages: services stunnel[7510]: LOG3[188]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing I tried changing stunnel to use the proxy protocol and enabled it on Apache, too. I don't know if that will help but at least then the web server gets the correct, remote IP address. Can anyone offer ideas/suggestions to fix this problem? Is there anything I can test or check to help diagnose the issue? The configuration is very basic: [apache] accept = 20888 protocol = proxy connect = 192.168.0.10:8000 PSKsecrets = /usr/local/etc/psksecrets.txt

1 0

Getting incoming Exchange online (Office 365) emails to go to port 110 and not 995
by Brent Kimberley 23 Jul '20

23 Jul '20

Office365 IMAP4S + POP3S is dropping legacy authentication in favour of OAUTH2.0 authentication -- effective October 2020. (Some may have longer.) How do you you plan to migrate to authentication? Do you plan to upgrade your client(s) or inject an OAUTH2.0 transparent proxy ? ---------------------------------------------------------------------- Message: 1 Date: Thu, 23 Jul 2020 01:22:06 +0000 From: Mel Gilbert <m.gilbert(a)baymedicalgroup.com.au> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Getting incoming Exchange online (Office 365) emails to go to port 110 and not 995 Message-ID: <SY4P282MB074766F32238B92A3D951499C1760(a)SY4P282MB0747.AUSP282.PROD.OUTLOOK.COM> Content-Type: text/plain; charset="us-ascii" Hi Trying to get an application with inbuilt email to receive emails using POP and port 110. However we use Office 365 and I have tried below config but it is not working. I want people to send email to an Exchange Online Account port 995 and it gets forwarded on to the email app on port 110 client = yes output = stunnel-log.txt debug=7 taskbar=yes [POP3 Incoming] accept = 110 connect = Outlook.office365.com:995 cert = stunnel.pem [SMTP Outgoing] protocol = smtp accept = 25 connect = smtp.office365.com:587 cert = stunnel.pem The outgoing email works fine using SMTP relay that I've set up on Office 365 but cant get the incoming emails to work. Any help would be appreciated Thanks Mel

1 0

Re: [stunnel-users] Getting incoming Exchange online (Office 365) emails to go to port 110 and not 995
by Mel Gilbert 23 Jul '20

23 Jul '20

Hi Trying to get an application with inbuilt email to receive emails using POP and port 110. However we use Office 365 and I have tried below config but it is not working. I want people to send email to an Exchange Online Account port 995 and it gets forwarded on to the email app on port 110 client = yes output = stunnel-log.txt debug=7 taskbar=yes [POP3 Incoming] accept = 110 connect = Outlook.office365.com:995 cert = stunnel.pem [SMTP Outgoing] protocol = smtp accept = 25 connect = smtp.office365.com:587 cert = stunnel.pem The outgoing email works fine using SMTP relay that I've set up on Office 365 but cant get the incoming emails to work. Any help would be appreciated Thanks Mel

1 0

Transparent Proxy help.
by Steven Relf 21 Jul '20

21 Jul '20

Hello List, I am working on a small project where I need to encrypt nfs traffic, and Stunnel looks to be ideal, the only issue I'm having is getting the transparent part to work I have a client machine, running stunnel config below #GLOBAL####################################################### sslVersion = TLSv1.2 TIMEOUTidle = 600 renegotiation = no FIPS = no options = NO_SSLv2 options = NO_SSLv3 options = SINGLE_DH_USE options = SINGLE_ECDH_USE options = CIPHER_SERVER_PREFERENCE syslog = yes debug = 7 ;chroot = /var/empty/stunnel libwrap = yes service = 3d-nfsd curve = secp521r1 #CREDENTIALS################################################## verify = 4 CAfile = /etc/stunnel/nfs-tls.pem cert = /etc/stunnel/nfs-tls.pem #ROLE######################################################### client = yes connect = fqdn:2363 and the client which is running ontop of the nfs-ganesha server config below #GLOBAL####################################################### TIMEOUTidle = 600 renegotiation = no FIPS = no options = NO_SSLv2 options = NO_SSLv3 options = SINGLE_DH_USE options = SINGLE_ECDH_USE options = CIPHER_SERVER_PREFERENCE syslog = yes debug = 7 setuid = nobody setgid = nobody chroot = /var/empty/stunnel libwrap = yes service = MC-nfsd ; cd /var/empty; mkdir -p stunnel/etc; cd stunnel/etc; ; echo 'MC-nfsd: ALL EXCEPT 5.6.7.8' >> hosts.deny; ; chcon -t stunnel_etc_t hosts.deny curve = secp521r1 #CREDENTIALS################################################## verify = 4 CAfile = /etc/stunnel/nfs-tls.pem cert = /etc/stunnel/nfs-tls.pem #ROLE######################################################### connect = 127.0.0.1:2049 I have had a look through the documentation and I believe I need to set transparent = source on the client side, and then set some ip tables firewall rules. Does anyone have a guide, or some advice on how to get this to work. Generally what happens if I set the firewall rules, on the client, and set the transparent to source I just get connection closed by remote host. I never actually see the traffic leave the client host. To confirm, when not using transparent everything works correctly, accept the server side sees the connection coming from 127.0.0.1 Thanks Rgds Steve. The future has already arrived. It's just not evenly distributed yet - William Gibson Steven Relf - Technical Authority: Cloud Native Infrastructure srelf(a)ukcloud.com +44 1252 936019 / +44 7500 085 864 www.ukcloud.com A8, Cody Technology Park, Ively Road, Farnborough, GU14 0LX Notice: This message contains information that may be privileged or confidential and is the property of UKCloud Ltd. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorised to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message. UKCloud reserves the right to monitor all e-mail communications through its networks. UKCloud Ltd is registered in England and Wales: Company No: 07619797. Registered office: Hartham Park, Hartham, Corsham, Wiltshire SN13 0RP.

1 0

Used Multi Service
by Ramin Malekgahsemi 09 Jul '20

09 Jul '20

Hi Dear Friends I used Stunnel 5.49 32 bit For server This Config cert = C:\Program Files\stunnel\config\stunnel.pem fips = no [socks] accept = 443 connect = 1010 If define New Service For example cert = C:\Program Files\stunnel\config\stunnel.pem fips = no [s1] accept = 443 connect = 1010 [s2] accept = 445 connect = 1020 Service Not work How Solve This Problem THX

1 0

Re: [stunnel-users] winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D)
by flash＠vicsmba.com 29 Jun '20

29 Jun '20

It will never be entirely random. Some range more than likely. You may be able to restrict the range. You could certainly set stunnel up for each “random” port. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Brent Kimberley Sent: Friday, June 26, 2020 4:11 PM To: Thomas Ward <teward(a)thomas-ward.net>; stunnel-users(a)stunnel.org; Coviello, Paul <pcoviello(a)ccsusa.com> Subject: Re: [stunnel-users] winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D) What are you trying to accomplish? I.e. Is TLS the best wrapper for the job? (i.e. TCP over TCP.) On Thursday, June 25, 2020, 11:44:38 a.m. EDT, Coviello, Paul <pcoviello(a)ccsusa.com <mailto:[email protected]> > wrote: Maybe, I also just found out that the port it goes out is not what I thought it was. It’s a random port. Not sure if it’s doable now. Thanks for your help

1 0

winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D)
by Brent Kimberley 26 Jun '20

26 Jun '20

Hi Paul. With respect to your winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D), did you open the port in your firewall and authorize communication via anti-virus? > Hi I have a windows 10 machine that I?ve got this running on, and the > screen shot below is what I keep getting and I am unable to find the issue, > > Can someone please shed some light as to what is wrong? And what else you may need.

3 4

server is down message
by Coviello, Paul 24 Jun '20

24 Jun '20

Hi I have a windows 10 machine that I've got this running on, and the screen shot below is what I keep getting and I am unable to find the issue, Can someone please shed some light as to what is wrong? And what else you may need. Thanks Paul [cid:[email protected]]

3 4

Fwd: Update Stunnel 5.44 - Ubuntu 18.04
by Juan Amores 19 Jun '20

19 Jun '20

---------- Forwarded message --------- De: Juan Amores <canalamores(a)gmail.com> Date: jue., 18 jun. 2020 a las 20:03 Subject: *Update Stunnel 5.44 - Ubuntu 18.04* I installed Stunnel4 via apt-get install command. The version you installed for me is old (5.44), I have tried updating it via apt-get update but there are no updated packages in Ubuntu 18.04. Is there a way to update it and keep it working as a service like before? Attached screenshot with linux, stunnel and openssl versions. Any other additional data you need to provide just ask me. [image: stunnel.png] Greetings, Juan Amores

2 2

Fw: How to configure STunnel so that new log file is automatically created after a certain threshold
by Muhammad Muneeb Hashmi 17 Jun '20

17 Jun '20

Hi STunnel Team, Is there a way where a new STunnel log file is automatically generated when the current log file reaches a certain threshold in Windows. Any help will be highly appreciated. Regards,Muneeb

1 0

CAPI_GET_KEY:cryptacquirecontext error
by Michael S. Chusovitin 04 Jun '20

04 Jun '20

Dear stunnel users, whereas Stunnel itself looks fine for me, it seems to have some troubles with CAPI engine. The one I cannot manage still is *"CAPI_GET_KEY:cryptacquirecontext error"* logged when attempting to export the client's key. I tried to add *"engineCtrl = csp_name:Microsoft Enhanced RSA and AES Cryptographic Provider"* to stunnel.conf, and then *"CAPI_**CTX_SET_PROVNAME:**cryptacquirecontext error"* was logged instead of the above one. The same certificate is used happily with no-capi configuration. I suppose the problem is somehow related to sha256 signature in the certificate. Are there any chances to workaround? Stunnel version is 5.48 with OpenSSL 1.0.2o-fips. (in this very case I need to use 32bit version, so no possibility to upgrade). Thanks!

2 5

Re: [stunnel-users] Need help connecting Eudora to mail servers
by Phil Smith III 28 May '20

28 May '20

I'm still tinkering here, trying to get Yahoo+stunnel working to help out Joe Slaven. I still can't get it to work. Yahoo userid is y_phsiii. I manually logged into Yahoo and verified that I have the right password. The config section: -- [Yahoo] client = yes accept = localhost:1234 connect = pop.mail.yahoo.com:995 sslVersion = TLSv1.2 -- Eudora has -- POPPort=1234 -- for that personality. Log: -- 2020.05.27 11:36:48 LOG5[29]: Service [Yahoo] accepted connection from 127.0.0.1:50287 2020.05.27 11:36:48 LOG6[29]: failover: priority, starting at entry #0 2020.05.27 11:36:48 LOG6[29]: s_connect: connecting 98.137.157.46:995 2020.05.27 11:36:48 LOG5[29]: s_connect: connected 98.137.157.46:995 2020.05.27 11:36:48 LOG5[29]: Service [Yahoo] connected remote server from 192.168.1.4:50288 2020.05.27 11:36:48 LOG6[29]: SNI: sending servername: pop.mail.yahoo.com 2020.05.27 11:36:48 LOG6[29]: Peer certificate not required 2020.05.27 11:36:48 LOG6[29]: Certificate verification disabled 2020.05.27 11:36:48 LOG6[29]: Certificate verification disabled 2020.05.27 11:36:48 LOG6[29]: Client certificate not requested 2020.05.27 11:36:48 LOG6[29]: Session id: F26CEF81143B96B8BD0D2C504CBB534082242BF337D3D29DE911CD5AC05B6DE0 2020.05.27 11:36:48 LOG6[29]: TLS connected: new session negotiated 2020.05.27 11:36:48 LOG6[29]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2020.05.27 11:37:48 LOG6[29]: TLS socket closed (SSL_read) 2020.05.27 11:37:48 LOG5[29]: Connection closed: 38 byte(s) sent to TLS, 130 byte(s) sent to socket -- Eudora error (Personality is named just "y" since it's just a test): -- y, Logging into POP Server, PASS [11:33:29 AM] There has been an error transferring your mail. I said: PASS <shhhh! Don't tell anyone.> and then the POP server (y_phsiii(a)127.0.0.1) said: ERR [SYS/TEMP] Server error - Please try again later. --

3 3

blackhole problem - please help to tune stunnel
by Michael S. Chusovitin 28 May '20

28 May '20

Dear stunnel users, please advise how to solve the following: - an Application connects to stunnel-client (installed at the same machine); - stunnel-client tries to connect to stunnel-server (remote), fails and sends RST to the App; - but the App has already sent some datagrams to stunnel-client during TIMEOUTconnect period and they aren't transferred to stunnel-server. Is there any way to make stunnel-client delay its ACK to the App until the connection to stunnel-server is established? Thanks!

1 0

Need help connecting Eudora to mail servers
by Joe Slaven 26 May '20

26 May '20

Below are the contents of my config file: Question 1. Is the output statement correct? I cannot find the log file. I expected it to be in the stunnel folder in the Program (x86) folders Question 2. Is it permissable to install code for all three email servers, using the same ports and settings in Eudora? Question 3. All three have error messages in Eudora ie none of them work via stunnel. Can anyone please show me where I am going wrong? I have listed the error message for Gmail below. There is no log file that I can find. Bigpond error message: There has been an error transferring your mail POP server [JoeS4814(a)127.0.0.1 ] said ERR[AUTH] Username and Password not accepted thanks for helping out, Joe ;*************************************************************** ; STUNNEL LOG output = stunnel.log ; ;***************************************************************** ;******************************************************* ;Yahoo connection ;******************************************************* [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes ; ;******************************************************* ;Bigpond connection ;***************************************************** [bigpond-pop3] client = yes accept = 127.0.0.1:110 connect = pop.bigpond.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.bigpond.com OCSPaia = yes [bigpond-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.bigpond.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.bigpond.com OCSPaia = yes ;************************************* ;Gmail connection ;******************************************** [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes

3 7

[PATCH] Use libcap to keep CAP_NET_RAW so that IP_TRANSPARENT works after setuid
by Simon Arlott 26 May '20

26 May '20

Use libcap to keep CAP_NET_RAW so that IP_TRANSPARENT works after setuid I'd like to be able to use "transparent = source" and "setuid" to drop full root privileges. It is possible to do this by keeping either the CAP_NET_ADMIN or CAP_NET_RAW capability. This is based on https://github.com/dlundquist/sniproxy/commit/0ab83f8f45f73ba18ea5f84ccccd9… The capability will not be inherited if "exec" is used: Name: stunnel Uid: 996 996 996 996 Gid: 988 988 988 988 ... CapInh: 0000000000000000 CapPrm: 0000000000002000 CapEff: 0000000000002000 --- It would be possible to keep CAP_NET_BIND_SERVICE too, to allow reloading a configuration that binds to ports below 1024. I don't think stunnel should keep this capability unless a service needs it at startup. CREDITS.md | 25 ++++++++++ configure.ac | 33 ++++++++++++++ doc/stunnel.8.in | 2 +- doc/stunnel.html.in | 2 +- doc/stunnel.pod.in | 2 +- src/stunnel.c | 109 ++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 170 insertions(+), 3 deletions(-) diff --git a/CREDITS.md b/CREDITS.md index 6567392..5f12f92 100644 --- a/CREDITS.md +++ b/CREDITS.md @@ -27,6 +27,31 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +libcap usage in version 5.57 (from sniproxy): +Copyright 2017 Dustin Lundquist <dustin(a)null-ptr.net> +Copyright 2020 Simon Arlott + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE HOLDERS OR +CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, +EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR +PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF +LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + Several bugfixes and improvements mostly in versions 3.xx: * Brian Hatch <bri(a)stunnel.org> diff --git a/configure.ac b/configure.ac index 9c2b2b6..f454710 100644 --- a/configure.ac +++ b/configure.ac @@ -352,6 +352,39 @@ AC_ARG_ENABLE(systemd, ] ) +# Disable POSIX capabilities support +AC_MSG_CHECKING([whether to enable POSIX capabilities support]) +AC_ARG_ENABLE(libcap, +[ --disable-libcap disable POSIX capabilities support], + [ + case "$enableval" in + yes) AC_MSG_RESULT([yes]) + AC_SEARCH_LIBS([cap_get_proc], [cap]) + AC_DEFINE([USE_LIBCAP], [1], + [Define to 1 to enable POSIX capabilities]) + ;; + no) AC_MSG_RESULT([no]) + ;; + *) AC_MSG_RESULT([error]) + AC_MSG_ERROR([Bad value \"${enableval}\"]) + ;; + esac + ], + [ + AC_MSG_RESULT([autodetecting]) + AC_SEARCH_LIBS([cap_get_proc], [cap], + [ AC_CHECK_HEADERS([sys/capability.h], [ + AC_DEFINE([USE_LIBCAP], [1], + [Define to 1 to enable POSIX capabilities]) + AC_MSG_NOTICE([libcap support enabled]) + ], [ + AC_MSG_NOTICE([libcap header not found]) + ]) ], [ + AC_MSG_NOTICE([libcap library not found]) + ]) + ] +) + # Disable use of libwrap (TCP wrappers) # it should be the last check! AC_MSG_CHECKING([whether to enable TCP wrappers support]) diff --git a/doc/stunnel.8.in b/doc/stunnel.8.in index b3df016..4b121bc 100644 --- a/doc/stunnel.8.in +++ b/doc/stunnel.8.in @@ -1251,7 +1251,7 @@ setuid .RS 4 .Sp The use of the 'setuid' option will also prevent \fBstunnel\fR from binding to privileged -(<1024) ports during configuration reloading. +(<1024) ports during configuration reloading or enabling of 'transparent = source'. .Sp When the 'chroot' option is used, \fBstunnel\fR will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot diff --git a/doc/stunnel.html.in b/doc/stunnel.html.in index ee9e5d9..95a1b51 100644 --- a/doc/stunnel.html.in +++ b/doc/stunnel.html.in @@ -1506,7 +1506,7 @@ </li> </ul> -The use of the 'setuid' option will also prevent stunnel from binding to privileged (<1024) ports during configuration reloading. +The use of the 'setuid' option will also prevent stunnel from binding to privileged (<1024) ports during configuration reloading or enabling of 'transparent = source'. When the 'chroot' option is used, stunnel will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot jail. diff --git a/doc/stunnel.pod.in b/doc/stunnel.pod.in index e9abd4f..8f14fd9 100644 --- a/doc/stunnel.pod.in +++ b/doc/stunnel.pod.in @@ -1360,7 +1360,7 @@ setuid =back The use of the 'setuid' option will also prevent B<stunnel> from binding to privileged -(<1024) ports during configuration reloading. +(<1024) ports during configuration reloading or enabling of 'transparent = source'. When the 'chroot' option is used, B<stunnel> will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot diff --git a/src/stunnel.c b/src/stunnel.c index 8121e0c..b84ce72 100644 --- a/src/stunnel.c +++ b/src/stunnel.c @@ -58,6 +58,11 @@ #endif /* USE_WIN32 */ +#ifdef USE_LIBCAP +#include <sys/prctl.h> +#include <sys/capability.h> +#endif + /**************************************** prototypes */ #ifdef __INNOTEK_LIBC__ @@ -191,6 +196,59 @@ int drop_privileges(int critical) { #ifdef HAVE_SETGROUPS gid_t gr_list[1]; #endif +#ifdef USE_LIBCAP + SERVICE_OPTIONS *opt; + int need_caps = 0; + cap_t caps; + cap_value_t cap_list[1]; + int keepcaps = 0; +#endif + +#ifdef USE_LIBCAP + for (opt = service_options.next; opt; opt = opt->next) { + if (opt->option.transparent_src) { /* transparent_src is enabled for this service */ + need_caps = 1; + break; + } + } + + /* add permitted flag to capability needed for IP_TRANSPARENT */ + if (CAP_IS_SUPPORTED(CAP_NET_RAW) && need_caps) { + const char *cap_failed = NULL; + + caps = cap_get_proc(); + if (caps != NULL) { + cap_list[0] = CAP_NET_RAW; + if (cap_set_flag(caps, CAP_PERMITTED, 1, cap_list, CAP_SET) == -1) { + cap_failed = "cap_set_flags[before]"; + goto cap_cleanup_before; + } + + if (cap_set_proc(caps) == -1) { + cap_failed = "cap_set_proc[before]"; + goto cap_cleanup_before; + } + + /* keep capabilities after setuid */ + if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) { + cap_failed = "prctl[before]"; + goto cap_cleanup_before; + } else { + keepcaps = 1; + } + +cap_cleanup_before: + cap_free(caps); + if (cap_failed != NULL && critical) { + sockerror(cap_failed); + return 1; + } + } else if (critical) { + sockerror("cap_get_proc[before]"); + return 1; + } + } +#endif /* set uid and gid */ if(service_options.gid) { @@ -212,6 +270,57 @@ int drop_privileges(int critical) { return 1; } } + +#ifdef USE_LIBCAP + /* enable capability needed for IP_TRANSPARENT */ + if (CAP_IS_SUPPORTED(CAP_NET_RAW) && need_caps) { + const char *cap_failed = NULL; + + caps = cap_get_proc(); + if (caps != NULL) { + /* remove every capability from the list */ + cap_clear(caps); + cap_list[0] = CAP_NET_RAW; + + /* take back capability */ + if (cap_set_flag(caps, CAP_PERMITTED, 1, cap_list, CAP_SET) == -1) { + cap_failed = "cap_set_flag[after]"; + goto cap_cleanup_after; + } + + if (cap_set_flag(caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET) == -1) { + cap_failed = "cap_set_flag[after]"; + goto cap_cleanup_after; + } + + if (cap_set_proc(caps) == -1) { + cap_failed = "cap_set_proc[after]"; + goto cap_cleanup_after; + } + /* from now on it the new capability list is active, + * no other capabilities may be enabled */ + +cap_cleanup_after: + cap_free(caps); + if (cap_failed != NULL && critical) { + sockerror(cap_failed); + return 1; + } + } else if (critical) { + sockerror("cap_get_proc[after]"); + return 1; + } + } + + /* disable keeping capabilities across setuid */ + if (keepcaps && prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) == -1) { + if (critical) { + sockerror("prctl"); + return 1; + } + } +#endif + #endif /* standard Unix */ return 0; } -- 2.17.1 -- Simon Arlott

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 190, Issue 13
by Brent Kimberley 24 May '20

24 May '20

Try: * Verifying the openssl version(s) * Verifying the 192.168.1.96:51400 port (nmap, netstat, etc.) * Verifying connection (openssl s_client -connect 192.168.1.96:51400) * Verifying the ciphersuite * Verifying the certificate >>Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second? Not sure. TIMEOUTclose? On Sunday, May 24, 2020, 6:00:07 a.m. EDT, stunnel-users-request(a)stunnel.org <stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. /var/log/syslog is filling up with stunnel errors (digitek) 2. Re: /var/log/syslog is filling up with stunnel errors (Thomas Ward) ---------------------------------------------------------------------- Message: 1 Date: Sat, 23 May 2020 18:17:49 -0500 From: digitek <digitek(a)charter.net> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] /var/log/syslog is filling up with stunnel errors Message-ID: <434e3153-d94c-bb71-fc51-1716db588290(a)charter.net> Content-Type: text/plain; charset=windows-1252; format=flowed Hi, I've been running stunnel for years to shuttle my syslogs off to a syslog server. It's performed flawlessly up until a few weeks ago. Recently, rebooting my syslog server results in the clients filling up /var/log/syslog with messages like below[1]. I'm not certain where the issue is. We've gone through some Ubuntu 16.04 > 18.04 upgrades on some hosts, as well as the syslog server. Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second? My config from a client is here[2] Last time this happened (few weeks ago) I googled around and found the TIMEOUTconnect parameter to try and get stunnel to at least wait 10 seconds before attempting another connect, but guess it doesn't work that way. Any thoughts? The stunnel client is on Ubuntu 18.04. I'd rather not compile out-of-band for the latest stunnel version unless I must. I"m assuming this is a config issue on my end. The version I'm stuck with right now is stunnel 5.44 on x86_64-pc-linux-gnu platform Thanks! [1] May 23 17:42:04 shuriken stunnel: LOG5[44922183]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55440 May 23 17:42:04 shuriken stunnel: LOG3[44922184]: s_connect: connect 192.168.1.96:51400: Connection refused (111) May 23 17:42:04 shuriken stunnel: LOG3[44922184]: No more addresses to connect May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 23 17:42:04 shuriken stunnel: LOG5[44922185]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55444 May 23 17:42:04 shuriken stunnel: LOG3[44922185]: s_connect: connect 192.168.1.96:51400: Connection refused (111) May 23 17:42:04 shuriken stunnel: LOG3[44922185]: No more addresses to connect [2] client = yes cert = /etc/stunnel/shared/stunnel.pem pid = /var/run/stunnel4/syslog_stunnel.pid [syslog_tunnel] accept = 127.0.0.1:5140 connect = 192.168.1.96:51400 TIMEOUTconnect = 10 ------------------------------ Message: 2 Date: Sat, 23 May 2020 20:09:48 -0400 From: Thomas Ward <teward(a)thomas-ward.net> To: digitek <digitek(a)charter.net>, stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] /var/log/syslog is filling up with stunnel errors Message-ID: <49V0wH16GWz2QGD(a)mail.syn-ack.link> Content-Type: text/plain; charset="utf-8" This is indicative of the remote server not running on the right ports normally or actively blocking you, given the "Connection Refused" errors.? Verify your system stunnel is on actually can connect to the specified IP and port combo independently of stunnel to start with.Sent from my Sprint Samsung Galaxy Note10+. -------- Original message --------From: digitek <digitek(a)charter.net> Date: 5/23/20 19:18 (GMT-05:00) To: stunnel-users(a)stunnel.org Subject: [stunnel-users] /var/log/syslog is filling up with stunnel errors Hi,I've been running stunnel for years to shuttle my syslogs off to a syslog server. It's performed flawlessly up until a few weeks ago. Recently, rebooting my syslog server results in the clients filling up /var/log/syslog with messages like below[1].I'm not certain where the issue is. We've gone through some Ubuntu 16.04 > 18.04 upgrades on some hosts, as well as the syslog server. Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second?? My config from a client is here[2]Last time this happened (few weeks ago) I googled around and found the TIMEOUTconnect parameter to try and get stunnel to at least wait 10 seconds before attempting another connect, but guess it doesn't work that way.Any thoughts? The stu nnel client is on Ubuntu 18.04. I'd rather not compile out-of-band for the latest stunnel version unless I must. I"m assuming this is a config issue on my end.? The version I'm stuck with right now is stunnel 5.44 on x86_64-pc-linux-gnu platformThanks![1]May 23 17:42:04 shuriken stunnel: LOG5[44922183]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socketMay 23 17:42:04 shuriken stunnel: LOG5[44922184]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55440May 23 17:42:04 shuriken stunnel: LOG3[44922184]: s_connect: connect 192.168.1.96:51400: Connection refused (111)May 23 17:42:04 shuriken stunnel: LOG3[44922184]: No more addresses to connectMay 23 17:42:04 shuriken stunnel: LOG5[44922184]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socketMay 23 17:42:04 shuriken stunnel: LOG5[44922185]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55444May 23 17:42:04 shuriken stunnel: LOG3[44922185]: s_connect: connect 192.168.1.96:51400: Conn ection refused (111)May 23 17:42:04 shuriken stunnel: LOG3[44922185]: No more addresses to connect[2]client?? = yescert???? = /etc/stunnel/shared/stunnel.pempid????? = /var/run/stunnel4/syslog_stunnel.pid[syslog_tunnel]accept?? = 127.0.0.1:5140connect? = 192.168.1.96:51400TIMEOUTconnect = 10_______________________________________________stunnel-users mailing [email protected]://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

/var/log/syslog is filling up with stunnel errors
by digitek 24 May '20

24 May '20

Hi, I've been running stunnel for years to shuttle my syslogs off to a syslog server. It's performed flawlessly up until a few weeks ago. Recently, rebooting my syslog server results in the clients filling up /var/log/syslog with messages like below[1]. I'm not certain where the issue is. We've gone through some Ubuntu 16.04 > 18.04 upgrades on some hosts, as well as the syslog server. Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second? My config from a client is here[2] Last time this happened (few weeks ago) I googled around and found the TIMEOUTconnect parameter to try and get stunnel to at least wait 10 seconds before attempting another connect, but guess it doesn't work that way. Any thoughts? The stunnel client is on Ubuntu 18.04. I'd rather not compile out-of-band for the latest stunnel version unless I must. I"m assuming this is a config issue on my end. The version I'm stuck with right now is stunnel 5.44 on x86_64-pc-linux-gnu platform Thanks! [1] May 23 17:42:04 shuriken stunnel: LOG5[44922183]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55440 May 23 17:42:04 shuriken stunnel: LOG3[44922184]: s_connect: connect 192.168.1.96:51400: Connection refused (111) May 23 17:42:04 shuriken stunnel: LOG3[44922184]: No more addresses to connect May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 23 17:42:04 shuriken stunnel: LOG5[44922185]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55444 May 23 17:42:04 shuriken stunnel: LOG3[44922185]: s_connect: connect 192.168.1.96:51400: Connection refused (111) May 23 17:42:04 shuriken stunnel: LOG3[44922185]: No more addresses to connect [2] client = yes cert = /etc/stunnel/shared/stunnel.pem pid = /var/run/stunnel4/syslog_stunnel.pid [syslog_tunnel] accept = 127.0.0.1:5140 connect = 192.168.1.96:51400 TIMEOUTconnect = 10

2 3

Re: [stunnel-users] Eudora -> Yahoo problems
by phs3stuff＠cox.net 20 May '20

20 May '20

Have you looked at the stunnel log? FWIW, I use stunnel to cox.net with Eudora (well, my wife does--I get to make it work) and just have the protocol, accept, and connect statements and it works. You might try commenting those out and see, but the log is probably more interesting. -----Original Message----- From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Joe Slaven Sent: Tuesday, May 19, 2020 8:48 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Eudora -> Yahoo problems Hello, new to stunnel, my first attempt is connecting Eudora to Yahoo Mail. My Yahoo Mail password and username are not being recognised when it is trying to access server 127.0.0.1 Can anyone suggest why this will not work? regards, Joe ******************************************************************************************************** ERROR MESSAGE There has been an error transferring your mail. POP Server [joeslaven(a)127.0.0.1] said ERR [AUTH] Username and password not accepted STUNNEL CONFIG FILE SETTINGS [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes EUDORA SETTINGS Checking Mail->Mail POP Server: 127.0.0.1 Sending Mail->SMTP Server: 127.0.0.1 Use submission port (587) is UNchecked Secure Sockets when Sending or Receiving : Never Default port settings : SMPT Port (25) POP Port (110) _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Eudora -> Yahoo problems
by Joe Slaven 20 May '20

20 May '20

Hello, new to stunnel, my first attempt is connecting Eudora to Yahoo Mail. My Yahoo Mail password and username are not being recognised when it is trying to access server 127.0.0.1 Can anyone suggest why this will not work? regards, Joe ******************************************************************************************************** ERROR MESSAGE There has been an error transferring your mail. POP Server [joeslaven(a)127.0.0.1] said ERR [AUTH] Username and password not accepted STUNNEL CONFIG FILE SETTINGS [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes EUDORA SETTINGS Checking Mail->Mail POP Server: 127.0.0.1 Sending Mail->SMTP Server: 127.0.0.1 Use submission port (587) is UNchecked Secure Sockets when Sending or Receiving : Never Default port settings : SMPT Port (25) POP Port (110)

1 0

Eudora -> Yahoo problems
by Joe Slaven 20 May '20

20 May '20

Hello, new to stunnel, my first attempt is connecting Eudora to Yahoo Mail. My Yahoo Mail password and username are not being recognised when it is trying to access server 127.0.0.1 Can anyone suggest why this will not work? regards, Joe ******************************************************************************************************** ERROR MESSAGE There has been an error transferring your mail. POP Server [joeslaven(a)127.0.0.1] said ERR [AUTH] Username and password not accepted STUNNEL CONFIG FILE SETTINGS [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes EUDORA SETTINGS Checking Mail->Mail POP Server: 127.0.0.1 Sending Mail->SMTP Server: 127.0.0.1 Use submission port (587) is UNchecked Secure Sockets when Sending or Receiving : Never Default port settings : SMPT Port (25) POP Port (110)

1 0

Eudora to Yahoo Mail -amended
by Joe Slaven 19 May '20

19 May '20

Hello, totally new to stunnel. Can anyone please point me in the direction of example config code to connect Eudora to POP Yahoo mail? Also what do I put in Eudora ? many thanks, Joe

1 0

Lost password
by Joe Slaven 19 May '20

19 May '20

Hello, I forgot to record my password used to subscribe to the list. Can anyone please tell me how I can reset it? Many thanks, joe

1 0

Eudora to Yahoo Mail
by Joe Slaven 19 May '20

19 May '20

Hello, totally new to stunnel. Can anyone please point me in the direction of example config code to connect Eudora to POP Yahoo mail? many thanks, Joe

1 0

newer version for VMS
by Coviello, Paul 19 May '20

19 May '20

Has anyone put together a package for OpenVMS particularly 8.4-1h1 from VSI? And if not is there a way to use an updated version of SSL in the current version I have? Which I believe is 4.20 FACS1>stunnel -version stunnel undefined on vax-OpenVMS with OpenSSL 0.9.8h 28 May 2008 Threading:PTHREAD Sockets:POLL,IPv4 Global options debug = 5 pid = SYS$LOGIN:STUNNEL.PID RNDbytes = 64 RNDoverwrite = yes Service-level options cert = stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

Windows tray icon
by Phil Smith III 19 May '20

19 May '20

If you hover on the stunnel tray icon, it just says "Server is idle". Right-clicking shows various options; none of those say "stunnel". Yes, they can go to "About", but it would be nice if the hover said "Stunnel server is idle" (and, perhaps, the "Exit" option said "Exit stunnel"). My user (my wife!) keeps forgetting what it is, hovering, and then still asking me what it is. Just a WIBNI. stunnel has been a lifesaver: she's wedded to Eudora, which doesn't support modern TLS, so when our ISP went all-TLS we had a problem. I also use it: I have a Bayesian mail proxy (K9) that doesn't support TLS, so my connections go MUA==>K9==>stunnel==>ISP. Any chance of this happening next rev? ...phsiii

1 0

Stunnel 5.57b2 OpenSSL 1.1.1g
by Olaf Brandt 19 May '20

19 May '20

Hi, I have an issue with stunnel since OpenSSL was updated to 1.1.1g. Stunnel has been build from scratch after the update and gives those errors: [ ] Clients allowed=500 [.] stunnel 5.57 on x86_64-pc-linux-gnu platform [.] Compiled/running with OpenSSL 1.1.1g 21 Apr 2020 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [dns_local] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x02100004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [!] error queue: crypto/x509/by_file.c:205: error:0B084009:x509 certificate routines:X509_load_cert_crl_file:PEM lib [!] error queue: crypto/pem/pem_info.c:196: error:0907400D:PEM routines:PEM_X509_INFO_read_bio:ASN1 lib [!] error queue: crypto/asn1/tasn_dec.c:290: error:0D07803A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error [!] error queue: crypto/asn1/tasn_dec.c:1118: error:0D068066:asn1 encoding routines:asn1_check_tlen:bad object header [!] SSL_CTX_load_verify_locations: crypto/asn1/asn1_lib.c:91: error:0D07209B:asn1 encoding routines:ASN1_get_object:too long [!] Service [dns_local]: Failed to initialize TLS context [ ] Deallocating section defaults [ ] Deallocating section [dns_local] [ ] Deallocating section defaults Config: chroot=/var/lib/stunnel pid=/var/run/stunnel.pid debug = debug [dns_local] sslVersion = TLSv1.3 client = yes accept = localhost:1053 connect = 185.95.218.42:853 checkHost = dns.digitale-gesellschaft.ch verifyPeer = yes CAfile = /etc/stunnel/cf.crt [dns_local_fallback] sslVersion = TLSv1.3 client = yes accept = localhost:1054 connect = 185.95.218.43:853 checkHost = dns.digitale-gesellschaft.ch verifyPeer = yes CAfile = /etc/stunnel/cf43.crt OpenSSL check of the cert files seems OK: openssl x509 -text -noout -in /etc/stunnel/cf.crt Certificate: Data: Version: 3 (0x2) Serial Number: 03:16:19:87:62:ac:be:ec:92:7b:6e:75:b8:a3:2e:ba:ea:28 Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 Validity Not Before: May 17 21:00:22 2020 GMT Not After : Aug 15 21:00:22 2020 GMT Subject: CN = dns.digitale-gesellschaft.ch Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:c0:01:03:42:24:5b:07:7e:46:06:fc:e0:21:56: 93:c4:6a:3c:88:c8:df:be:91:d6:d8:7a:b7:fc:3f: 8c:f1:b9:74:ec:c1:3b:2b:02:fe:27:93:1e:d6:d3: a1:95:31:ed:c7:06:26:28:74:60:7e:70:53:39:4b: e5:43:c2:81:dc:50:f3:d7:9e:0b:87:5b:2c:e8:a8: eb:71:bc:7b:04:92:d5:be:66:ba:0e:d8:9f:27:28: 77:9f:7c:68:2f:2f:64:2d:8a:86:f7:cf:c6:3a:c1: 1b:d4:e9:95:d6:c0:f3:77:f3:cd:79:16:40:86:ce: d5:dc:be:b2:c6:5b:7c:fe:e3:68:8d:25:61:41:a8: 99:b3:f4:62:60:19:bf:96:32:46:ef:e4:6a:c2:3d: 00:f6:44:b9:63:94:50:0e:fb:a0:e1:88:eb:79:cf: b7:a5:d1:29:0c:d6:bf:ee:ad:1b:9b:8e:7c:94:4f: f8:5a:0e:a7:5e:62:e7:67:61:9e:83:cb:a0:f7:56: f6:bc:ec:df:4d:60:6a:fe:08:fa:1c:ae:17:05:54: 0f:b0:f8:1f:6c:78:ca:a0:99:ec:4b:06:b3:79:97: 88:d1:7e:c8:93:cf:15:6b:9d:ea:d2:ef:88:da:1b: e8:2b:dd:0d:6e:f2:7e:f3:75:60:03:6a:87:64:79: e6:1f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Key Identifier: 9C:E3:0E:F4:F1:60:60:EC:21:7D:D8:D6:5F:0E:7B:FF:90:DB:68:01 X509v3 Authority Key Identifier: keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1 Authority Information Access: OCSP - URI:http://ocsp.int-x3.letsencrypt.org CA Issuers - URI:http://cert.int-x3.letsencrypt.org/ X509v3 Subject Alternative Name: DNS:dns.digitale-gesellschaft.ch, DNS:dns1.digitale-gesellschaft.ch, DNS:dns2.digitale-gesellschaft.ch X509v3 Certificate Policies: Policy: 2.23.140.1.2.1 Policy: 1.3.6.1.4.1.44947.1.1.1 CPS: http://cps.letsencrypt.org CT Precertificate SCTs: Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 07:B7:5C:1B:E5:7D:68:FF:F1:B0:C6:1D:23:15:C7:BA: E6:57:7C:57:94:B7:6A:EE:BC:61:3A:1A:69:D3:A2:1C Timestamp : May 17 22:00:22.318 2020 GMT Extensions: none Signature : ecdsa-with-SHA256 30:45:02:20:3D:7F:5A:57:E3:CE:42:A0:2A:16:FD:59: AE:7A:11:19:AE:BE:BE:AA:5A:4A:B0:1E:66:8E:D6:21: A8:35:F8:CB:02:21:00:DB:06:63:54:26:03:76:28:CD: 05:BF:08:8B:1B:95:2B:D2:A1:B3:AC:63:6A:DD:84:E7: 84:3A:70:A6:54:31:2B Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 6F:53:76:AC:31:F0:31:19:D8:99:00:A4:51:15:FF:77: 15:1C:11:D9:02:C1:00:29:06:8D:B2:08:9A:37:D9:13 Timestamp : May 17 22:00:22.412 2020 GMT Extensions: none Signature : ecdsa-with-SHA256 30:45:02:21:00:EA:BC:2D:B6:B1:71:0B:CE:75:A7:15: 86:D2:C0:05:49:08:38:CC:B9:EF:DA:1F:23:53:1A:5F: BD:31:19:A5:0A:02:20:21:2F:94:08:61:D0:A8:CA:3F: 71:D3:54:4D:E3:56:50:91:51:A6:01:16:77:9E:AE:31: 2E:43:E1:68:C0:CE:F2 Signature Algorithm: sha256WithRSAEncryption 9b:b8:24:f8:30:fc:77:5d:67:91:40:c7:bf:58:cf:64:67:7f: 87:33:8e:04:19:93:98:bb:35:cb:4e:b3:78:c0:04:5c:48:f4: 74:38:f2:57:02:38:3b:84:19:aa:9b:39:08:1d:f9:62:f4:c7: af:e4:17:40:02:99:7a:c5:24:fc:ee:b1:d5:95:b0:a2:58:f0: db:44:0f:50:3c:92:81:e8:8f:81:4d:e1:eb:e4:86:5d:d0:c8: 31:d2:30:07:7f:56:48:65:bd:a0:01:38:19:81:e4:80:38:21: 1f:ae:13:96:54:cd:9f:b1:cb:b2:47:00:f0:8b:d4:0d:61:29: 99:cb:71:ee:f6:53:ab:27:45:33:7b:0c:f4:e4:85:58:a7:8e: 58:8e:88:04:0d:e8:03:18:41:e6:8f:b5:c1:c1:9d:da:57:0a: 85:d7:19:05:4f:f9:8f:8c:b5:60:3f:67:f0:d8:fd:10:98:ad: de:25:88:7b:67:0f:bd:e1:7c:21:fb:35:8c:b2:26:78:de:b1: 54:a4:e9:9f:e0:48:d6:1a:0e:60:a6:f6:21:8c:b3:df:21:a1: 0c:16:d4:ab:93:3a:5d:94:22:34:40:5b:7e:ef:ea:f8:a1:15: d6:8d:69:aa:40:fe:ae:6f:79:dd:49:49:1a:88:0f:15:61:19: 00:f8:41:6c openssl x509 -text -noout -in /etc/stunnel/cf43.crt Certificate: Data: Version: 3 (0x2) Serial Number: 03:2b:84:39:5e:99:3d:2d:85:52:63:3a:d2:fa:bc:2e:60:4b Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 Validity Not Before: Mar 16 22:01:15 2020 GMT Not After : Jun 14 22:01:15 2020 GMT Subject: CN = dns.digitale-gesellschaft.ch Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:bc:0e:73:84:9c:89:7c:f8:2a:db:79:5f:78:ac: 39:a8:c5:25:b4:86:5b:9e:1c:3c:14:a6:17:ae:67: f1:02:17:0b:dc:36:ea:a1:9c:57:91:5b:5a:91:6b: df:7b:4c:74:7e:6c:e2:eb:5f:a5:95:02:25:43:c1: 3e:f0:67:5d:80:27:6f:37:72:0e:1f:b7:c3:13:e2: 3a:a5:13:b6:41:d0:01:aa:d0:7f:68:d4:5e:10:95: ee:17:bb:8d:8b:77:a3:7e:c8:9e:7a:8a:35:8a:09: 00:82:80:67:70:34:ac:f5:bc:24:4a:b9:c4:df:1f: 1e:e4:48:66:a8:76:60:d8:a3:d5:64:3b:9d:7e:7b: 18:99:f7:31:a5:28:4e:a4:47:24:25:af:18:32:d5: f9:98:67:21:f7:49:23:c2:72:00:73:e5:25:ca:af: a5:ae:df:00:62:d8:f2:5e:1e:8a:26:5a:63:5b:22: e1:eb:2d:b4:e9:57:de:16:8c:a0:72:db:ff:82:46: b8:d8:55:ad:55:84:e5:65:b5:86:8b:47:00:ea:85: 0d:74:c6:9d:9f:95:e4:3a:19:fe:3d:8f:5f:4b:f8: ed:a5:93:3f:ea:31:fd:41:74:7e:6b:ae:bf:98:9a: 70:85:d8:9f:51:85:fc:5e:11:eb:b9:60:6a:c3:bf: 81:f7 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Key Identifier: DE:64:78:2F:E4:81:84:C3:C9:3F:5C:01:DB:D0:42:E2:0D:CB:48:B8 X509v3 Authority Key Identifier: keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1 Authority Information Access: OCSP - URI:http://ocsp.int-x3.letsencrypt.org CA Issuers - URI:http://cert.int-x3.letsencrypt.org/ X509v3 Subject Alternative Name: DNS:dns.digitale-gesellschaft.ch, DNS:dns1.digitale-gesellschaft.ch, DNS:dns2.digitale-gesellschaft.ch X509v3 Certificate Policies: Policy: 2.23.140.1.2.1 Policy: 1.3.6.1.4.1.44947.1.1.1 CPS: http://cps.letsencrypt.org CT Precertificate SCTs: Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 5E:A7:73:F9:DF:56:C0:E7:B5:36:48:7D:D0:49:E0:32: 7A:91:9A:0C:84:A1:12:12:84:18:75:96:81:71:45:58 Timestamp : Mar 16 23:01:15.249 2020 GMT Extensions: none Signature : ecdsa-with-SHA256 30:44:02:20:04:32:96:55:70:AB:40:41:3B:E2:6C:E3: 8E:78:1E:82:F7:84:57:6A:76:2C:11:2B:24:A6:BB:72: 59:F1:F9:8A:02:20:67:12:DB:64:C1:D8:15:5D:3F:ED: 8B:8F:01:68:B8:A1:D2:B0:20:2B:32:54:11:14:82:72: 06:B8:E6:1C:1C:69 Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 07:B7:5C:1B:E5:7D:68:FF:F1:B0:C6:1D:23:15:C7:BA: E6:57:7C:57:94:B7:6A:EE:BC:61:3A:1A:69:D3:A2:1C Timestamp : Mar 16 23:01:15.303 2020 GMT Extensions: none Signature : ecdsa-with-SHA256 30:44:02:20:1B:C7:5B:F2:A9:04:12:6A:62:E8:33:F9: BD:08:39:1D:0F:F3:39:8D:F2:F8:37:E3:C8:05:CC:1B: E7:31:F7:83:02:20:12:47:02:D3:E3:93:48:9A:F3:5A: B9:F4:12:85:87:0F:D4:F2:B7:79:F5:8C:DD:77:D4:5E: BE:D0:95:27:83:9C Signature Algorithm: sha256WithRSAEncryption 82:30:ea:0a:6f:45:53:e7:f8:a0:80:69:47:a4:7d:ee:6a:78: a3:34:00:f1:bb:0d:c8:3a:1f:37:8e:25:f9:9d:cc:a5:e0:15: 03:a5:da:2a:28:af:89:97:f9:d6:20:61:ae:1e:16:80:f4:1a: 2c:08:ac:74:f3:80:2f:ae:17:f7:f4:b4:1c:b7:f1:59:f9:73: fd:12:cb:e3:48:36:bd:fe:99:38:69:44:7f:3b:dc:38:98:54: 75:f5:00:d0:de:93:eb:5a:4d:5e:65:d0:99:9e:64:75:8f:cd: e4:6f:1e:22:d5:8f:cb:4d:78:ef:0e:70:38:b7:f0:af:4d:30: 7b:9a:ea:1d:6c:b7:cb:18:2b:de:5a:18:d2:4b:bb:e6:79:b2: 45:8b:01:dc:d1:15:45:cc:cc:f0:5d:a6:98:10:90:72:d2:da: ef:7a:3c:1c:af:42:f0:7f:85:5b:49:53:e8:b3:51:11:e4:93: fc:b3:8a:dc:bc:5c:40:8d:bb:36:be:36:87:09:de:23:19:29: 1d:f3:7e:70:5b:43:43:ad:6e:a4:b4:55:ac:9e:f5:10:05:31: a7:a5:00:66:8a:e7:67:4e:02:2a:2d:40:d4:2c:e8:f1:bb:35: 8d:b7:cf:52:b0:71:04:72:d0:ab:fb:e6:f6:c7:45:33:db:88: d5:90:f0:32 Any suggestions? Thanks.

1 0

client with two source IPs and one destination
by Daniele Basaldella 12 May '20

12 May '20

Dear group, I've to configure a couple of tunneled connections (call them TC1 and TC2), client side, on a linux system. The target of both such connections is the same (destination ip and port are the same, call it DST). At source side (my server) I have a two IP addresses (call them IP1 and IP2) assigned and currently working to its unique NIC. I normally use iptables SNAT to split the traffic between IP1 and IP2 depending on destination addresses but in this case I've to distinguish it at application level (TC1 and TC2). I'd like to get TC1 to set the outgoing traffic with source address IP1 and TC2 to set outgoing traffic with source address IP2. Tunnel Tunnel Client Server TC1: IP1 --\ >--> DST TC2: IP2 --/ I'm thinking to set one entry in stunnel.conf for each TC1 and TC2 and use *transparent* = source clause to set the source address but it seems my case is not so common and I didn't find documentation. Please could you suggest a solution. Thanks

3 3

iOS 13.4.1 Blue Iris now working
by John McClymont 12 May '20

12 May '20

After more research, stunnel and blue iris now working on IOS 13.4.1 sslVersion = TLSv1.2 <--- added this to stunnel.conf [BlueIris] accept=1440 connect=192.168.0.2:8080 <---- tried 8080 failed, tried 127.0.0.1 failed cert = stunnel.pem Like I said not an expert,

1 0

client with two source IPs and one destination
by Brent Kimberley 11 May '20

11 May '20

Hi Daniele.I haven't looked at exact scenario. Have you considered stunnel+HAproxy? Dear group, I've to configure a couple of tunneled connections (call them TC1 and TC2), client side, on a linux system. The target of both such connections is the same (destination ip and port are the same, call it DST). At source side (my server) I have a two IP addresses (call them IP1 and IP2) assigned and currently working to its unique NIC. I normally use iptables SNAT to split the traffic between IP1 and IP2 depending on destination addresses but in this case I've to distinguish it at application level (TC1 and TC2). I'd like to get TC1 to set the outgoing traffic with source address IP1 and TC2 to set outgoing traffic with source address IP2. Tunnel Tunnel Client Server TC1: IP1 --\ >--> DST TC2: IP2 --/ I'm thinking to set one entry in stunnel.conf for each TC1 and TC2 and use *transparent* = source clause to set the source address but it seems my case is not so common and I didn't find documentation. Please could you suggest a solution. Thanks

1 0

iOS 13.4.1 Blue Iris
by John McClymont 11 May '20

11 May '20

Hi I have been using stunnel or a number of years to create a secure connect to CCTV recording software. Today after upgrading to IOS 13.4.1 I can no longer connect I ran generate self signed certificate, still fails. Searching I found others with similar problem, some have created a cert using other providers. I would prefer to generate from stunnel as I have always done config [BlueIris] accept=1440 connect=8080 cert = stunnel.pem I am no expert, basically followed a simple setup read few comments that it maybe due to IOS no longer supporting certain version of ssl Hopefully you can help Log 2020.05.11 22:59:04 LOG5[main]: stunnel 5.56 on x64-pc-mingw32-gnu platform 2020.05.11 22:59:04 LOG5[main]: Compiled/running with OpenSSL 1.1.1c 28 May 2019 2020.05.11 22:59:04 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2020.05.11 22:59:04 LOG5[main]: Reading configuration from file stunnel.conf 2020.05.11 22:59:04 LOG5[main]: UTF-8 byte order mark detected 2020.05.11 22:59:04 LOG6[main]: Initializing service [BlueIris] 2020.05.11 22:59:04 LOG6[main]: Loading certificate from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Certificate loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Loading private key from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Private key loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: DH initialization not needed 2020.05.11 22:59:04 LOG6[main]: Initializing service [gmail-pop3] 2020.05.11 22:59:04 LOG6[main]: Initializing service [gmail-imap] 2020.05.11 22:59:04 LOG6[main]: Initializing service [gmail-smtp] 2020.05.11 22:59:04 LOG6[main]: Initializing service [meinberg-smtp] 2020.05.11 22:59:04 LOG6[main]: Loading certificate from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Certificate loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Loading private key from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Private key loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG4[main]: Service [meinberg-smtp] needs authentication to prevent MITM attacks 2020.05.11 22:59:04 LOG5[main]: Configuration successful 2020.05.11 22:59:04 LOG6[main]: Service [BlueIris] (FD=564) bound to 0.0.0.0:1440 2020.05.11 22:59:04 LOG6[main]: Service [gmail-pop3] (FD=728) bound to 127.0.0.1:110 2020.05.11 22:59:04 LOG6[main]: Service [gmail-imap] (FD=732) bound to 127.0.0.1:143 2020.05.11 22:59:04 LOG6[main]: Service [gmail-smtp] (FD=736) bound to 0.0.0.0:25 2020.05.11 22:59:04 LOG6[main]: Service [meinberg-smtp] (FD=740) bound to 192.168.0.2:2525 2020.05.11 22:59:04 LOG6[cron]: Executing cron jobs 2020.05.11 22:59:04 LOG6[cron]: Cron jobs completed in 0 seconds 2020.05.11 22:59:55 LOG5[0]: Service [BlueIris] accepted connection from 192.168.0.142:58797 2020.05.11 22:59:55 LOG6[0]: Peer certificate not required 2020.05.11 22:59:55 LOG3[0]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[1]: Service [BlueIris] accepted connection from 192.168.0.142:58798 2020.05.11 22:59:55 LOG6[1]: Peer certificate not required 2020.05.11 22:59:55 LOG3[1]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[2]: Service [BlueIris] accepted connection from 192.168.0.142:58799 2020.05.11 22:59:55 LOG6[2]: Peer certificate not required 2020.05.11 22:59:55 LOG3[2]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[3]: Service [BlueIris] accepted connection from 192.168.0.142:58800 2020.05.11 22:59:55 LOG6[3]: Peer certificate not required 2020.05.11 22:59:55 LOG3[3]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[4]: Service [BlueIris] accepted connection from 192.168.0.142:58801 2020.05.11 22:59:55 LOG6[4]: Peer certificate not required 2020.05.11 22:59:55 LOG3[4]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[5]: Service [BlueIris] accepted connection from 192.168.0.142:58802 2020.05.11 22:59:55 LOG6[5]: Peer certificate not required 2020.05.11 22:59:55 LOG3[5]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[5]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[6]: Service [BlueIris] accepted connection from 192.168.0.142:58803 2020.05.11 22:59:55 LOG6[6]: Peer certificate not required 2020.05.11 22:59:55 LOG3[6]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[6]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[7]: Service [BlueIris] accepted connection from 192.168.0.142:58804 2020.05.11 22:59:55 LOG6[7]: Peer certificate not required 2020.05.11 22:59:55 LOG3[7]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[7]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[8]: Service [BlueIris] accepted connection from 192.168.0.142:58805 2020.05.11 22:59:55 LOG6[8]: Peer certificate not required 2020.05.11 22:59:55 LOG3[8]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[8]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[9]: Service [BlueIris] accepted connection from 192.168.0.142:58806 2020.05.11 22:59:55 LOG6[9]: Peer certificate not required 2020.05.11 22:59:55 LOG3[9]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[10]: Service [BlueIris] accepted connection from 192.168.0.142:58807 2020.05.11 22:59:55 LOG6[10]: Peer certificate not required 2020.05.11 22:59:55 LOG3[10]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[10]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[11]: Service [BlueIris] accepted connection from 192.168.0.142:58808 2020.05.11 22:59:55 LOG6[11]: Peer certificate not required 2020.05.11 22:59:55 LOG3[11]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[11]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[12]: Service [BlueIris] accepted connection from 192.168.0.142:58809 2020.05.11 22:59:55 LOG6[12]: Peer certificate not required 2020.05.11 22:59:55 LOG3[12]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[12]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[13]: Service [BlueIris] accepted connection from 192.168.0.142:58810 2020.05.11 22:59:55 LOG6[13]: Peer certificate not required 2020.05.11 22:59:55 LOG3[13]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[13]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[14]: Service [BlueIris] accepted connection from 192.168.0.142:58811 2020.05.11 22:59:55 LOG6[14]: Peer certificate not required 2020.05.11 22:59:55 LOG3[14]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[14]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:56 LOG5[15]: Service [BlueIris] accepted connection from 192.168.0.142:58812 2020.05.11 22:59:56 LOG6[15]: Peer certificate not required 2020.05.11 22:59:56 LOG3[15]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:56 LOG5[15]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:56 LOG5[16]: Service [BlueIris] accepted connection from 192.168.0.142:58813 2020.05.11 22:59:56 LOG6[16]: Peer certificate not required 2020.05.11 22:59:56 LOG3[16]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:56 LOG5[16]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:56 LOG5[17]: Service [BlueIris] accepted connection from 192.168.0.142:58814 2020.05.11 22:59:56 LOG6[17]: Peer certificate not required 2020.05.11 22:59:56 LOG3[17]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:56 LOG5[17]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[18]: Service [BlueIris] accepted connection from 192.168.0.142:58815 2020.05.11 23:00:04 LOG6[18]: Peer certificate not required 2020.05.11 23:00:04 LOG3[18]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[18]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[19]: Service [BlueIris] accepted connection from 192.168.0.142:58816 2020.05.11 23:00:04 LOG6[19]: Peer certificate not required 2020.05.11 23:00:04 LOG3[19]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[19]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[20]: Service [BlueIris] accepted connection from 192.168.0.142:58817 2020.05.11 23:00:04 LOG6[20]: Peer certificate not required 2020.05.11 23:00:04 LOG3[20]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[20]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[21]: Service [BlueIris] accepted connection from 192.168.0.142:58818 2020.05.11 23:00:04 LOG6[21]: Peer certificate not required 2020.05.11 23:00:04 LOG3[21]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[22]: Service [BlueIris] accepted connection from 192.168.0.142:58819 2020.05.11 23:00:04 LOG6[22]: Peer certificate not required 2020.05.11 23:00:04 LOG3[22]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[23]: Service [BlueIris] accepted connection from 192.168.0.142:58820 2020.05.11 23:00:04 LOG6[23]: Peer certificate not required 2020.05.11 23:00:04 LOG3[23]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[23]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[24]: Service [BlueIris] accepted connection from 192.168.0.142:58821 2020.05.11 23:00:04 LOG6[24]: Peer certificate not required 2020.05.11 23:00:04 LOG3[24]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[24]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[25]: Service [BlueIris] accepted connection from 192.168.0.142:58822 2020.05.11 23:00:04 LOG6[25]: Peer certificate not required 2020.05.11 23:00:04 LOG3[25]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[25]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[26]: Service [BlueIris] accepted connection from 192.168.0.142:58823 2020.05.11 23:00:04 LOG6[26]: Peer certificate not required 2020.05.11 23:00:04 LOG3[26]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[26]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[27]: Service [BlueIris] accepted connection from 192.168.0.142:58824 2020.05.11 23:00:04 LOG6[27]: Peer certificate not required 2020.05.11 23:00:04 LOG3[27]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[27]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[28]: Service [BlueIris] accepted connection from 192.168.0.142:58825 2020.05.11 23:00:04 LOG6[28]: Peer certificate not required 2020.05.11 23:00:04 LOG3[28]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[28]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[29]: Service [BlueIris] accepted connection from 192.168.0.142:58826 2020.05.11 23:00:04 LOG6[29]: Peer certificate not required 2020.05.11 23:00:04 LOG3[29]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[29]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[30]: Service [BlueIris] accepted connection from 192.168.0.142:58827 2020.05.11 23:00:04 LOG6[30]: Peer certificate not required 2020.05.11 23:00:04 LOG3[30]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[31]: Service [BlueIris] accepted connection from 192.168.0.142:58828 2020.05.11 23:00:04 LOG6[31]: Peer certificate not required 2020.05.11 23:00:04 LOG3[31]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[31]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[32]: Service [BlueIris] accepted connection from 192.168.0.142:58829 2020.05.11 23:00:04 LOG6[32]: Peer certificate not required 2020.05.11 23:00:04 LOG3[32]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[32]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[33]: Service [BlueIris] accepted connection from 192.168.0.142:58830 2020.05.11 23:00:04 LOG6[33]: Peer certificate not required 2020.05.11 23:00:04 LOG3[33]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[33]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[34]: Service [BlueIris] accepted connection from 192.168.0.142:58831 2020.05.11 23:00:04 LOG6[34]: Peer certificate not required 2020.05.11 23:00:04 LOG3[34]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[34]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[35]: Service [BlueIris] accepted connection from 192.168.0.142:58832 2020.05.11 23:00:04 LOG6[35]: Peer certificate not required 2020.05.11 23:00:04 LOG3[35]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[35]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

1 0

Solution: REDIR not Working in Chrome, Edge (new), Opera
by Joe Sterk 08 May '20

08 May '20

I found the solution to the REDIR issue posted in April. You can find more information at https://support.google.com/chrome/forum/AAAAP1KN0B02tttvx4VCDQ/?hl=en&gpf=%…. The issue is going from https --> http or https. Our software company added an additional CRLR at the end so it looks like this now: "HTTP/1.1 301 Moved Permanently\r\n" + "Location: https://www.abc.com<https://www.abc.com/>" + http.req.url.path_and_query.http_url_safe + "\r\n\r\n". Joe Sterk

1 0

Stunnel 4 with Shoutcast 2.6
by Ali 02 May '20

02 May '20

I am trying to add ssl to my shoutcast stream. I get the messages below when I try to start or restart shoutcast. I have purchased an ssl cert and key for this and it did not work via the shoutcast config, so I gave this a shot. The key and certs with combined into the stunnel.pem. See below and thanks for the help. I also added the stunnel config below. client=no [shoutcast] accept=8002 (I also tried 443) connect=localhost:8000 cert = /etc/stunnel/stunnel.pem pid=/etc/stunnel/stunnel.pid -permissions are set to chmod 600 Stunnel Dir root@kwaxstreamserver:/etc/stunnel# l cert.pem key.pem README stunnel.conf stunnel.pem Stunnel on START Clients allowed=500 stunnel 4.53 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1f 6 Jan 2014 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 Reading configuration from file stunnel.conf Compression not enabled Snagged 64 random bytes from /root/.rnd Wrote 1024 new random bytes to /root/.rnd PRNG seeded successfully Line 6: "pid = /etc/stunnel/stunnel.pid": Specified option name is not valid here str_stats: 7 block(s), 1063 data byte(s), 406 control byte(s) Stunnel on RESTART root@kwaxstreamserver:/etc/stunnel# /etc/init.d/stunnel4 restart Restarting SSL tunnels: Clients allowed=500 stunnel 4.53 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1f 6 Jan 2014 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 Reading configuration from file /etc/stunnel/stunnel.conf Compression not enabled Snagged 64 random bytes from /root/.rnd Wrote 1024 new random bytes to /root/.rnd PRNG seeded successfully Line 6: "pid = /etc/stunnel/stunnel.pid": Specified option name is not valid here str_stats: 7 block(s), 1076 data byte(s), 406 control byte(s) [Failed: /etc/stunnel/stunnel.conf] You should check that you have specified the pid= in you configuration file

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users