- stunnel-users - stunnel.org

Log4j Vulnerability
by Tracy Drake - IQGC-C 17 Dec '21

17 Dec '21

Hello! Can you please tell me if Stunnel uses log4j and/or if it is vulnerable to it? Your feedback would be greatly appreciated! Thanks in advance! -- *TRACY DRAKE | CSM URSA/Infoconnect Training and Support* GSA COMET Hale Bopp Contract Work Phone: 704-253-5193 | Email: tracy.drake(a)gsa.gov

2 1

issue with connection sending cxml out
by Daniel Trickett 08 Dec '21

08 Dec '21

Hi, We are trying to send a cxml message from an old app using ssl_v3 to a client server using tls 1.2. We negotiate a connection and then the below happens. Any thoughts? This is on our test server. 2021.12.08 14:26:55 LOG6[12]: TLS connected: new session negotiated 2021.12.08 14:26:55 LOG6[12]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2021.12.08 14:26:55 LOG7[12]: Compression: null, expansion: null 2021.12.08 14:26:55 LOG7[12]: TLS alert (read): warning: close notify <<< 2021.12.08 14:26:55 LOG6[12]: TLS closed (SSL_read) 2021.12.08 14:26:55 LOG7[12]: Sent socket write shutdown 2021.12.08 14:26:55 LOG6[12]: Read socket closed (readsocket) 2021.12.08 14:26:55 LOG7[12]: Sending close_notify alert 2021.12.08 14:26:55 LOG7[12]: TLS alert (write): warning: close notify 2021.12.08 14:26:55 LOG6[12]: SSL_shutdown successfully sent close_notify alert 2021.12.08 14:26:55 LOG5[12]: Connection closed: 10187 byte(s) sent to TLS, 561 byte(s) sent to socket Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here emdgroup.com/en/privacy-statement.html<https://www.emdgroup.com/en/privacy-statement.html>

1 0

Revert automatically to https
by cnocera＠hyhat.com 08 Dec '21

08 Dec '21

With stunnel, is there a way for the website to automatically revert to https by just typing in the url without https:// in front of it?

1 0

Insecure file permissions on /etc/ssl/private.key
by jose isaias cabrera 29 Nov '21

29 Nov '21

Greetings! I have duckduckgo'ed and I have not found an answer, but what should be the permissions for the private key since the stunnel is giving me a warning/error regarding that: ... [ ] Loading private key from file: /etc/ssl/private.key [:] Insecure file permissions on /etc/ssl/private.key [ ] Private key loaded from file: /etc/ssl/private.key ... this is that I have set: jic@web:~$ ls -l /etc/ssl/private.key -rw-r--r-- 1 root www-data 1702 Oct 13 02:54 /etc/ssl/private.key the www-data is the user that runs the website. All is running well, apparently, but, I would like to set the correct permission on the private.key file. Thanks for your support. josé -- What if eternity is real? Where will you spend it? Hmmmm...

4 6

Althttpd web server setup using ZeroSSL
by jose isaias cabrera 28 Nov '21

28 Nov '21

Greetings! I have the ssl files from ZeroSSL, and I am trying to set up https using stunnel4 on an ubuntu server. I am new to https, I would love some of your help setting this up. Here is what I have done so far: 1. Installed Althttpd and http is working fine on the home network and from the external network. 2. I have installed stunnel4 on the ubuntu server jcabrera@selva:~$ stunnel -v [ ] Clients allowed=500 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled with OpenSSL 1.1.1c 28 May 2019 [.] Running with OpenSSL 1.1.1f 31 Mar 2020 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [!] Invalid configuration file name "-v" [!] realpath: No such file or directory (2) [ ] Deallocating section defaults 3. I have placed the ZeroSSl ssl files on the ssl directory as per ZeroSSL instructions jcabrera@selva:~$ ls -l /etc/ssl/*.crt -rw-r--r-- 1 root root 2431 Oct 20 16:27 /etc/ssl/ca_bundle.crt -rw-r--r-- 1 root root 2354 Oct 20 16:31 /etc/ssl/certificate.crt root@selva:/home/jcabrera# ls -l /etc/ssl/private/*.key -rw-r--r-- 1 root root 1702 Oct 20 16:33 /etc/ssl/private/private.key 4. Created the the /etc/stunnel/stunnel.conf file with these entries: root@selva:/home/jcabrera# cat /etc/stunnel/stunnel.conf cert = /etc/ssl/certificate.crt key = /etc/ssl/private/private.key \[https\] accept = :::443 TIMEOUTclose = 0 exec = /usr/bin/althttpd execargs = /usr/bin/althttpd -logfile ~/www/http.log -root ~/www -user www-data -https 1 And, I don't know what else to do. Any help would be greatly appreciated. Thanks. josé -- What if eternity is real? Where will you spend it? Hmmmm...

2 3

Office 365 connections stopped working
by Ben Bazian 25 Nov '21

25 Nov '21

This has been working for years and recently stopped. I am a novice here. Can someone look at this and please tell me what is happening? It is an old server that does not support TLS so we put Stunnel in front of it. I am sure the version of stunnel is pretty old. Maybe a TLS level issue? 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG6[21968:139797665822784]: Initializing service [SMTP Outgoing] 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG6[21968:139797665822784]: Initializing service [IMAP] 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG5[21968:139797665822784]: Configuration successful 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [POP3 Incoming] (FD=12) bound to 0.0.0.0:110 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [SMTP Outgoing] (FD=13) bound to 0.0.0.0:25 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [IMAP] (FD=14) bound to 0.0.0.0:143 2021.10.26 14:47:30 LOG7[21974:139797665822784]: Created pid file /var/run/stunnel.pid 2021.10.26 14:48:30 LOG7[21974:139797665822784]: Service [IMAP] accepted (FD=3) from 10.55.3.159:1852 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] started 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Waiting for a libwrap process 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Acquired libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Releasing libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Released libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] permitted by libwrap from 10.55.3.159:1852 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Service [IMAP] accepted connection from 10.55.3.159:1852 2021.10.26 14:48:30 LOG6[21974:139797665818368]: connect_blocking: connecting 52.96.87.226:993 2021.10.26 14:48:30 LOG7[21974:139797665818368]: connect_blocking: s_poll_wait 52.96.87.226:993: waiting 10 seconds 2021.10.26 14:48:30 LOG5[21974:139797665818368]: connect_blocking: connected 52.96.87.226:993 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Service [IMAP] connected remote server from 10.55.3.200:51358 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Remote socket (FD=16) initialized 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SNI: sending servername: outlook.office365.com 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SSL state (connect): before/connect initialization 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SSL state (connect): SSLv3 write client hello A 2021.10.26 14:48:30 LOG3[21974:139797665818368]: SSL_connect: Peer suddenly disconnected 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Remote socket (FD=16) closed 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Local socket (FD=3) closed 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] finished (0 left)

4 5

setting permissions on a unix socket
by David Mandelberg 02 Nov '21

02 Nov '21

Hi, Is there any way for stunnel to set permissions on a unix socket created with the `accept` option? I see setuid and setgid at https://www.stunnel.org/static/stunnel.html but nothing about a umask or permissions. P.S. The link on https://www.stunnel.org/lists.html to see the archive is broken. Apologies if this has come up before.

1 0

Stunnel connection to Akamai Cloud Servers (Hostheaders) with SNI
by Alan C. Bonnici 06 Oct '21

06 Oct '21

Hi, I am trying to use stunnel to exchange data with a service hosted on Akamai Servers. There is a need to implement SNI. In posts dated from 2016 which I found online, Stunnel did not support Host Headers. Is there a workaround, or has Stunnel implemented this functionality? I will be testing using postman. A sample config to get me going would really be appreciated. The URL is related to plivo. It is ak-api.plivo.com. Thank you in anticipation.

3 6

Is it possible to inhibit writing the stunnel logs to the / var / log / messages file?
by simona vittori 28 Sep '21

28 Sep '21

Hello, I ask you if it's possible to inhibit writing the stunnel logs to the / var / log / messages file. How do you it? Thank you in advance Bye Simona

2 1

Need a clean way to reject a client IP
by robin.kerdiles＠emanrisk.fr 28 Sep '21

28 Sep '21

Hello everyone, I'm doing a few tests on a dockerized service for stunnel under Alpine. stunnel -version stunnel 5.60 on x86_64-alpine-linux-musl platform Compiled with OpenSSL 1.1.1k 25 Mar 2021 Running with OpenSSL 1.1.1l 24 Aug 2021 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI If I set a wrong certificate on client side, my server logs get spammed with these lines : 2021.09.28 07:43:52 LOG5[66]: Service [***] accepted connection from *** 2021.09.28 07:43:52 LOG4[66]: CERT: Pre-verification error: unable to get local issuer certificate 2021.09.28 07:43:52 LOG4[66]: Rejected by CERT at depth=2: C=***, O=***, CN=*** 2021.09.28 07:43:52 LOG3[66]: SSL_accept: ssl/statem/statem_srvr.c:3711: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed 2021.09.28 07:43:52 LOG5[66]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket The cpu usage goes up to 35% and it seems there is no way to set a timeout before trying to reconnect on client side (which is not the perfect fix by the way). On server side, I don't know if we are supposed to be able to do something about that (for example rate limiting the requests ?). Even the fail2ban filter doesn't seem to support this case. And anyway it seems it requires manual patching on stunnel source code for the logs. Would it be possible to put on the same line the client IP and a message about the connection which has been rejected ? fail2ban filter : https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/stunnel.co… What would be appreciated -> a log line in this format : 2021.09.28 07:43:52 LOG4[66]: HOST has been rejected by CERT at depth=2: C=***, O=***, CN=*** Of course, I don't have in mind the other possible cases (missing cert, etc...). Thank you in advance, Robin KERDILES

2 1