- stunnel-users - stunnel.org

No peer temporary key received
by Michael S. Chusovitin 17 Feb '23

17 Feb '23

Hi folks, is there any chance to grasp why such a line - "No peer temporary key received" - is logged immediately after successful negotiation? It does not look harmful but I cannot understand *how ECDHE can do without the ephemeral key*. 2023.02.17 20:33:41 LOG6[4]: TLS accepted: new session negotiated 2023.02.17 20:33:41 LOG6[4]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2023.02.17 20:33:41 LOG6[4]: No peer temporary key received 2023.02.17 20:33:41 LOG7[4]: Compression: null, expansion: null 2023.02.17 20:33:41 LOG6[4]: s_connect: connecting 127.0.0.1:9000 2023.02.17 20:33:41 LOG7[4]: s_connect: s_poll_wait 127.0.0.1:9000: waiting 10 seconds 2023.02.17 20:33:41 LOG7[4]: FD=524 ifds=--- ofds=r-- 2023.02.17 20:33:41 LOG7[4]: FD=540 ifds=rwx ofds=--- 2023.02.17 20:33:41 LOG5[4]: s_connect: connected 127.0.0.1:9000 The above is logged by Stunnel 5.67/5.68; whereas Stunnel 5.66 logs the very same moments differently: it says "SSL_get_peer_tmp_key: Peer suddenly disconnected" (but this can hardly be true). 2023.02.17 20:27:15 LOG6[4]: TLS accepted: new session negotiated 2023.02.17 20:27:15 LOG6[4]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2023.02.17 20:27:15 LOG3[4]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2023.02.17 20:27:15 LOG7[4]: Compression: null, expansion: null 2023.02.17 20:27:15 LOG6[4]: s_connect: connecting 127.0.0.1:9000 2023.02.17 20:27:15 LOG7[4]: s_connect: s_poll_wait 127.0.0.1:9000: waiting 10 seconds 2023.02.17 20:27:15 LOG7[4]: FD=512 ifds=--- ofds=r-- 2023.02.17 20:27:15 LOG7[4]: FD=528 ifds=rwx ofds=--- 2023.02.17 20:27:15 LOG5[4]: s_connect: connected 127.0.0.1:9000 Thanks in advance, Mikhail

1 0

blat, stunnel, and gmail with an app password
by blat_stunnel2023＠protonmail.com 17 Feb '23

17 Feb '23

I was using a Windows command line blat.exe mailer with stunnel along with a gmail account to send emails from a Windows command line batch file. Gmail started requiring I se the gmail account to allow "less secure" sign in options. That worked for a while, but in May 2022, gmail discontinued that option. It sounds like you can set two factor on the gmail account and then generate an app password for the gmail account. So I did that. I'm stumped on how to get either blat or stunnel to use that gmail app password though. Any ideas? Blat is looking super old though. I see when I set up this computer to with blat-stunnel-gmail, that I ran a line with blat.exe to store the gmail password. I don't see a way to store an app password, but blat is old. This is blat. http://www.blat.net./ Looks like the last update was in 2012, so app passwords may not have even existed then. Is there any way to stunnel to store a gmail app password? My goal is just to send an email from a Windows machine with either a Windows batch file or PowerShell script. It's not mission critical. It's for home use. I just like to get email alerts when my home machines complete some task. If something else works, I'm interested. It needs to work in a batch file though, or at least powershell if a batch file can't work. For my previous set up, I just kept stunnel updated, initially set up blat with the email information, and used only a batch file with blat to send emails from a gmail account. And then it was making sure less secure apps was an option on the gmail account. Now it's been broken for almost a year.

2 2

Windows offical release - Anyone knows which compiler is used ? VS or minigw ?
by roie rachamim 13 Feb '23

13 Feb '23

Many thanks, Roie

1 0

stunnel 5.68 released
by Michał Trojnara 12 Feb '23

12 Feb '23

Dear Users, I have released version 5.68 of stunnel. ### Version 5.68, 2023.02.07, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.8. * New features - Added the new 'CAengine' service-level option to load a trusted CA certificate from an engine. - Added requesting client certificates in server mode with 'CApath' besides 'CAfile'. * Bugfixes - Fixed EWOULDBLOCK errors in protocol negotiation. - Fixed handling TLS errors in protocol negotiation. - Prevented following fatal TLS alerts with TCP resets. - Improved OpenSSL initialization on WIN32. - Improved testing suite stability. - Improved file read performance. - Improved logging performance. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: dcd895ab088b043d4e0bafa8b934e7ab3e697293828dbe9fce46cb7609a7dacf stunnel-5.68.tar.gz 62807f6233c8a5693104c09b44ebde6cc395877d948651c3ff0767e07ccdd316 stunnel-5.68-win64-installer.exe 93291060fdfc889431e8bce5cfe875b23be2bac11e2338f8f8f84d509f1b33fa stunnel-5.68-android.zip Best regards, Mike

2 1

Cannot establish tunnel
by andrew.haworth＠roche.com 11 Feb '23

11 Feb '23

Hi, I am new to stunnel on a MAC. When I run stunnel with the enabled configuration [mllp-to-dip], I am prompted for a local password and then for my certificate passphrase. I am not able to establish a tunnel. See logs: Initializing service [mllp-to-dip] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] Loading certificate from file: /opt/homebrew/etc/stunnel/test_client.cert.pem [ ] Certificate loaded from file: /opt/homebrew/etc/stunnel/test_client.cert.pem [ ] Loading private key from file: /opt/homebrew/etc/stunnel/test_client_cert.pem [:] Insecure file permissions on /opt/homebrew/etc/stunnel/test_client_cert.pem [ ] Private key loaded from file: /opt/homebrew/etc/stunnel/test_client_cert.pem [ ] Private key check succeeded [:] Service [mllp-to-dip] needs authentication to prevent MITM attacks [ ] DH initialization skipped: client section [ ] ECDH initialization [ ] ECDH initialized with curves X25519:P-256:X448:P-521:P-384 [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [mllp-to-dip] [ ] Listening file descriptor created (FD=9) [ ] Setting accept socket options (FD=9) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [mllp-to-dip] to :::6661: Address already in use (48) [ ] Listening file descriptor created (FD=9) [ ] Setting accept socket options (FD=9) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [mllp-to-dip] to 0.0.0.0:6661: Address already in use (48) [!] Binding service [mllp-to-dip] failed [ ] Unbinding service [mllp-to-dip] [ ] Service [mllp-to-dip] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [mllp-to-dip] Can someone help with my troubleshooting steps?

4 5

Setup Error
by Paul Gabriel 11 Feb '23

11 Feb '23

Hi, I am attempting to setup stunnel 5.67 in Windows Server 2022 core. I believe I have enabled TLS 1.2. Here is the output of stunnel starting up: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.67 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.7 1 Nov 2022 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [Integration Profile 1] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] Loading certificate from file: art&music.pem [!] error queue: ssl/ssl_rsa.c:448: error:0A080002:SSL routines::system lib [!] error queue: crypto/bio/bss_file.c:300: error:10080002:BIO routines::system lib [!] SSL_CTX_use_certificate_chain_file: crypto/bio/bss_file.c:297: error:80000002:system library::No such file or directory [!] Service [Integration Profile 1]: Failed to initialize TLS context [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [Integration Profile 1] Any suggestions on what is wrong? Thanks, Paul

2 1

Long time to tear off the certificate
by nizdiminov＠itopcase.ru 02 Feb '23

02 Feb '23

Good afternoon, I observe a problem in the operation of the stunnel. There are 5 active connections. I get an error **** Server unexpectedly disconnected Error performing handshake Before that, there is a pattern, it takes a very long time to tear off the certificate 5 мин. 2023.01.31 17:13:37 LOG7[15674:140480621389568]: open file /etc/stunnel/cert/eis/dit.cer with certificate 2023.01.31 17:18:25 LOG3[15674:140480621389568]: Credentials complete /opt/cprocsp/sbin/amd64/stunnel_thread -version stunnel 4.18 on x86_64-pc-linux-gnu Threading:PTHREAD Sockets:POLL,IPv6 Auth:LIBWRAP

1 0

Monitoring stunnel
by nizdiminov＠itopcase.ru 01 Feb '23

01 Feb '23

Good afternoon, tell me how best to monitor the stunnel? I use zabbix monitoring 5.4 , in my stunnel 5 connections 3 server 2 clients, all with certificate verification. It is necessary to monitor each connection separately. Maybe there is a template for zabbix monitoring 5.4 ?

1 0

help
by Gurjit Singh Jhutti 27 Jan '23

27 Jan '23

Is it possible to configure username and password for SMTP connection on Windows Server, did try this with any success in stunnel.conf [client] username = user password = password error: LOG6[main]: Initializing service [client] LOG3[main]: ....\stunnel.conf:73: "username = user": Specified option name is not valid here LOG3[main]: Configuration failed

1 0

Odd stunnel problem
by Phil Smith III 26 Jan '23

26 Jan '23

Well, odd to me. I use K9, a free Bayesian spam proxy I've used for ~20 years. It doesn't do TLS. So I have: Outlook <-> K9 <-> stunnel <-> Internet for email connections. This morning I wasn't getting anything on my dozen or so POP connections that go through that (Exchange email was fine). Restarted Outlook (making sure it had really closed), no joy. Then I noticed that while doing a mail check, K9 was throbbing for long periods. There's not much to do with K9, so next I looked at stunnel, whose log was full of: 2023.01.26 09:39:26 LOG3[18110]: No more addresses to connect 2023.01.26 09:39:36 LOG3[18111]: s_connect: s_poll_wait 146.20.147.244:995: TIMEOUTconnect exceeded Reloaded stunnel config and all is well. So, not a big deal, but.any guesses what was going on here? stunnel 5.57, Windows 10.

1 0