- stunnel-users - stunnel.org

I NEED A HELP TO SETUP THE SSL/TLS EMAILS SUPPORT
by Muj 02 Jan '22

02 Jan '22

HI TECHNICAL SUPPORT, FIRSTLY, I AM APOLOGIZING TO YOU FOR WRITING WITH LARGE CAPS ONLY, IT IS BECAUSE RECENTLY I GOT A BRAIN STROKE AND AM NOT RECOVERED YET. AS FOR MY ISSUE, TO UNDERSTAND IT BETTER, THE FOLLOWING IS MY INFO. - I HAVE AN OLD WINDOWS-XP 32BIT OS. - I AM USING TERABYTE 2.99 TO BACKUP AND RESTORE MY OS, BUT LOOSING MANY EMAILS BECAUSE TERABYTE IS NO LONGER SUPPORTING 2.99 VERSION. THEY SUPPORT RESTORING ALL EMAILS BEGINNING FROM 3 VERSION. THEREFORE, THEY HAVE RECOMMENDED ME TO CONTACT YOU DIRECTLY. NOW WHAT I DID SO FAR. - I DOWNLOADED AND INSTALLED YOUR STUNNEL 4.53 - AFTER AUTOMATIC SETTING, EDITING STUNNEL.CONF FILE, MAKING SOME CHANGES IN IT AND SAVING IT, THE SERVER WENT DOWN. ATTACHED PLEASE FIND STUNNEL.CONF TXT FILE. - BECAUSE THE SERVER WENT DOWN, I TRIED TO DOWNLOAD AND INSTALL STUNNEL AGAIN, BUT ALWAYS GOT THE SAME ERROR MESSAGE.PLEASE CAN YOU HELP ME WITH THIS ISSUE? - I HAVE 3 POP3 EMAIL ACCOUNTS AND 1 IMAP. ALL REQUIRE A CONNECTION SECURITY SSL/TLS. *PLEASE, I NEED TO KNOW HOW **TO COMPLETELY REMOVE THE CURRENT STUNNEL PROGRAM AND AFTER THAT, WHAT STUNNEL VERSION I SHOULD **DOWNLOAD AGAIN **TO BE ABLE TO SET IT UP*. AFTER A SUCCESSFUL NEW INSTALLATION I WOULD GIVE YOU MORE NEEDED INFO FOR SETTING UP MY EMAILS. PLEASE LET ME KNOW IN YOUR BEST CONVENIENCE AND HAVE A BEAUTIFUL NEW YEAR 2022. KIND REGARDS, MARTIN

1 0

stunnel 5.61transfer() loop executes not transferring any data Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket inetd mode
by Roberto CORRADO 29 Dec '21

29 Dec '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 """ 2021.12.28 14:03:40 LOG6[ui]: Initializing inetd mode configuration 2021.12.28 14:03:40 LOG5[ui]: stunnel 5.61 on i586-slackware-linux-gnu platform 2021.12.28 14:03:40 LOG5[ui]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2021.12.28 14:03:40 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.12.28 14:03:40 LOG6[ui]: Initializing inetd mode configuration 2021.12.28 14:03:40 LOG5[ui]: Reading configuration from file /etc/stunnel/imaps.conf 2021.12.28 14:03:40 LOG5[ui]: UTF-8 byte order mark not detected 2021.12.28 14:03:40 LOG5[ui]: FIPS mode disabled 2021.12.28 14:03:40 LOG6[ui]: Compression enabled: 0 methods 2021.12.28 14:03:40 LOG6[ui]: stunnel default security level set: 2 2021.12.28 14:03:40 LOG6[ui]: Session resumption enabled 2021.12.28 14:03:40 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: DH initialization skipped: no DH ciphersuites 2021.12.28 14:03:40 LOG5[ui]: Configuration successful 2021.12.28 14:03:40 LOG5[0]: Service [stunnel] accepted connection from 127.0.0.1:40876 2021.12.28 14:03:40 LOG6[0]: Peer certificate not required 2021.12.28 14:03:40 LOG6[0]: No peer certificate received 2021.12.28 14:03:40 LOG6[0]: Session id: 0E092C2715D12901219C3E0F54DFA029F7C50040C7EC8F8C88211BA6883B9D1F 2021.12.28 14:03:40 LOG6[0]: No peer certificate received 2021.12.28 14:03:40 LOG6[0]: Session id: 26CFB9D13C499CE27C4ED1575FDF3FB2604C616418BA6068849B49EF75AF2162 2021.12.28 14:03:40 LOG6[0]: TLS accepted: new session negotiated 2021.12.28 14:03:40 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2021.12.28 14:03:40 LOG6[0]: Peer temporary key: X25519, 253 bits 2021.12.28 14:03:40 LOG6[0]: Local mode child started (PID=4997) 2021.12.28 14:03:40 LOG3[0]: transfer() loop executes not transferring any data 2021.12.28 14:03:40 LOG3[0]: please report the problem to Michal.Trojnara(a)stunnel.org 2021.12.28 14:03:40 LOG3[0]: stunnel 5.61 on i586-slackware-linux-gnu platform 2021.12.28 14:03:40 LOG3[0]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2021.12.28 14:03:40 LOG3[0]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.12.28 14:03:40 LOG3[0]: protocol=TLSv1.3, SSL_pending=0, SSL_has_pending=0 2021.12.28 14:03:40 LOG3[0]: sock_open_rd=Y, sock_open_wr=Y 2021.12.28 14:03:40 LOG3[0]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2021.12.28 14:03:40 LOG3[0]: sock_can_rd=n, sock_can_wr=n 2021.12.28 14:03:40 LOG3[0]: ssl_can_rd=n, ssl_can_wr=n 2021.12.28 14:03:40 LOG3[0]: read_wants_read=Y, read_wants_write=n 2021.12.28 14:03:40 LOG3[0]: write_wants_read=n, write_wants_write=Y 2021.12.28 14:03:40 LOG3[0]: shutdown_wants_read=n, shutdown_wants_write=n 2021.12.28 14:03:40 LOG3[0]: socket input buffer: 154 byte(s), TLS input buffer: 0 byte(s) 2021.12.28 14:03:40 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket """ """ debug = info output = /var/log/stunnel-imaps.log cert = /etc/stunnel/stunnel.pem exec = /usr/sbin/imapd execargs = imapd sslVersion = all options = NO_SSLv2 options = NO_SSLv3 """ -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAmHLE48ACgkQWVOoL214ZeFpYwCfe+qv09KWSfjNixhhcb5MJbr2 yAkAoKOyXZJwnKddSXYzIhbi7k1yPkoU =oGR+ -----END PGP SIGNATURE-----

1 0

Config to only listen when connect port is up
by roartysa＠gmail.com 23 Dec '21

23 Dec '21

Is there a config flag that can be set in the conf file that will tell stunnel to listen on the https accept port only when the connect port is up and listening? The issue i am trying to address is when a load balancer talks to a server, I need to make sure the port that stunnel redirects to is healthy. Right now the load balancer will send traffic to the port all the time regardless of the health of the port that stunnel redirects the traffic to.

2 1

stunnel 5.61 released
by Michał Trojnara 22 Dec '21

22 Dec '21

Dear Users, I have released version 5.61 of stunnel. ### Version 5.61, 2021.12.22, urgency: LOW * New features sponsored by the University of Maryland - Added new "protocol = capwin" and "protocol = capwinctrl" configuration file options. * New features for the Windows platform - Added client mode allowing authenticated users to view logs, reconfigure and terminate running stunnel services. - Added support for multiple GUI and service instances distinguised by the location of stunnel.conf. - Improved log window scrolling. - Added a new 'Pause auto-scroll' GUI checkbox. - Double click on the icon tray replaced with single click. - OpenSSL DLLs updated to version 3.0.1. * Other new features - Rewritten the testing framework in python (thx to Peter Pentchev for inspiration and initial framework). - Added support for missing SSL_set_options() values. - Updated stunnel.spec to support RHEL8. * Bugfixes - Fixed OpenSSL 3.0 build. - Fixed reloading configuration with "systemctl reload stunnel.service". - Fixed incorrect messages logged for OpenSSL errors. - Fixed printing IPv6 socket option defaults on FreeBSD. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 91ea0ca6482d8f7e7d971ee64ab4f86a2817d038a372f0893e28315ef2015d7a stunnel-5.61.tar.gz 19c5ff1f4101af1e69585328303c14249db2ec9063542101ca31edb6f6cc502f stunnel-5.61-win64-installer.exe 928ec94690564498bf523228946b2cdc90c7e346d6f0baf1f71b76cbe769b96c stunnel-5.61-android.zip Best regards, Mike

1 0

Log4j Vulnerability
by Tracy Drake - IQGC-C 17 Dec '21

17 Dec '21

Hello! Can you please tell me if Stunnel uses log4j and/or if it is vulnerable to it? Your feedback would be greatly appreciated! Thanks in advance! -- *TRACY DRAKE | CSM URSA/Infoconnect Training and Support* GSA COMET Hale Bopp Contract Work Phone: 704-253-5193 | Email: tracy.drake(a)gsa.gov

2 1

issue with connection sending cxml out
by Daniel Trickett 09 Dec '21

09 Dec '21

Hi, We are trying to send a cxml message from an old app using ssl_v3 to a client server using tls 1.2. We negotiate a connection and then the below happens. Any thoughts? This is on our test server. 2021.12.08 14:26:55 LOG6[12]: TLS connected: new session negotiated 2021.12.08 14:26:55 LOG6[12]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2021.12.08 14:26:55 LOG7[12]: Compression: null, expansion: null 2021.12.08 14:26:55 LOG7[12]: TLS alert (read): warning: close notify <<< 2021.12.08 14:26:55 LOG6[12]: TLS closed (SSL_read) 2021.12.08 14:26:55 LOG7[12]: Sent socket write shutdown 2021.12.08 14:26:55 LOG6[12]: Read socket closed (readsocket) 2021.12.08 14:26:55 LOG7[12]: Sending close_notify alert 2021.12.08 14:26:55 LOG7[12]: TLS alert (write): warning: close notify 2021.12.08 14:26:55 LOG6[12]: SSL_shutdown successfully sent close_notify alert 2021.12.08 14:26:55 LOG5[12]: Connection closed: 10187 byte(s) sent to TLS, 561 byte(s) sent to socket Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here emdgroup.com/en/privacy-statement.html<https://www.emdgroup.com/en/privacy-statement.html>

1 0

Revert automatically to https
by cnocera＠hyhat.com 08 Dec '21

08 Dec '21

With stunnel, is there a way for the website to automatically revert to https by just typing in the url without https:// in front of it?

1 0

Insecure file permissions on /etc/ssl/private.key
by jose isaias cabrera 29 Nov '21

29 Nov '21

Greetings! I have duckduckgo'ed and I have not found an answer, but what should be the permissions for the private key since the stunnel is giving me a warning/error regarding that: ... [ ] Loading private key from file: /etc/ssl/private.key [:] Insecure file permissions on /etc/ssl/private.key [ ] Private key loaded from file: /etc/ssl/private.key ... this is that I have set: jic@web:~$ ls -l /etc/ssl/private.key -rw-r--r-- 1 root www-data 1702 Oct 13 02:54 /etc/ssl/private.key the www-data is the user that runs the website. All is running well, apparently, but, I would like to set the correct permission on the private.key file. Thanks for your support. josé -- What if eternity is real? Where will you spend it? Hmmmm...

4 6

Althttpd web server setup using ZeroSSL
by jose isaias cabrera 29 Nov '21

29 Nov '21

Greetings! I have the ssl files from ZeroSSL, and I am trying to set up https using stunnel4 on an ubuntu server. I am new to https, I would love some of your help setting this up. Here is what I have done so far: 1. Installed Althttpd and http is working fine on the home network and from the external network. 2. I have installed stunnel4 on the ubuntu server jcabrera@selva:~$ stunnel -v [ ] Clients allowed=500 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled with OpenSSL 1.1.1c 28 May 2019 [.] Running with OpenSSL 1.1.1f 31 Mar 2020 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [!] Invalid configuration file name "-v" [!] realpath: No such file or directory (2) [ ] Deallocating section defaults 3. I have placed the ZeroSSl ssl files on the ssl directory as per ZeroSSL instructions jcabrera@selva:~$ ls -l /etc/ssl/*.crt -rw-r--r-- 1 root root 2431 Oct 20 16:27 /etc/ssl/ca_bundle.crt -rw-r--r-- 1 root root 2354 Oct 20 16:31 /etc/ssl/certificate.crt root@selva:/home/jcabrera# ls -l /etc/ssl/private/*.key -rw-r--r-- 1 root root 1702 Oct 20 16:33 /etc/ssl/private/private.key 4. Created the the /etc/stunnel/stunnel.conf file with these entries: root@selva:/home/jcabrera# cat /etc/stunnel/stunnel.conf cert = /etc/ssl/certificate.crt key = /etc/ssl/private/private.key \[https\] accept = :::443 TIMEOUTclose = 0 exec = /usr/bin/althttpd execargs = /usr/bin/althttpd -logfile ~/www/http.log -root ~/www -user www-data -https 1 And, I don't know what else to do. Any help would be greatly appreciated. Thanks. josé -- What if eternity is real? Where will you spend it? Hmmmm...

2 3

Office 365 connections stopped working
by Ben Bazian 26 Nov '21

26 Nov '21

This has been working for years and recently stopped. I am a novice here. Can someone look at this and please tell me what is happening? It is an old server that does not support TLS so we put Stunnel in front of it. I am sure the version of stunnel is pretty old. Maybe a TLS level issue? 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG6[21968:139797665822784]: Initializing service [SMTP Outgoing] 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG6[21968:139797665822784]: Initializing service [IMAP] 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG5[21968:139797665822784]: Configuration successful 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [POP3 Incoming] (FD=12) bound to 0.0.0.0:110 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [SMTP Outgoing] (FD=13) bound to 0.0.0.0:25 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [IMAP] (FD=14) bound to 0.0.0.0:143 2021.10.26 14:47:30 LOG7[21974:139797665822784]: Created pid file /var/run/stunnel.pid 2021.10.26 14:48:30 LOG7[21974:139797665822784]: Service [IMAP] accepted (FD=3) from 10.55.3.159:1852 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] started 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Waiting for a libwrap process 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Acquired libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Releasing libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Released libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] permitted by libwrap from 10.55.3.159:1852 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Service [IMAP] accepted connection from 10.55.3.159:1852 2021.10.26 14:48:30 LOG6[21974:139797665818368]: connect_blocking: connecting 52.96.87.226:993 2021.10.26 14:48:30 LOG7[21974:139797665818368]: connect_blocking: s_poll_wait 52.96.87.226:993: waiting 10 seconds 2021.10.26 14:48:30 LOG5[21974:139797665818368]: connect_blocking: connected 52.96.87.226:993 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Service [IMAP] connected remote server from 10.55.3.200:51358 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Remote socket (FD=16) initialized 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SNI: sending servername: outlook.office365.com 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SSL state (connect): before/connect initialization 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SSL state (connect): SSLv3 write client hello A 2021.10.26 14:48:30 LOG3[21974:139797665818368]: SSL_connect: Peer suddenly disconnected 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Remote socket (FD=16) closed 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Local socket (FD=3) closed 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] finished (0 left)

4 5