- stunnel-users - stunnel.org

Academic doubt about firewall bypass
by Hugo Marello 28 Jun '19

28 Jun '19

Hello guys, I'm new to using stunnel but I find it quite a powerful tool. I'm doing a POC on how we can bypass our firewall even with DPI, and chose to use stunnel for an extra layer of cryptography. You don't have to worry about access to any VM mentioned here. Here is my scenario: [CLIENT BROWSER] -->[STUNNEL CLIENT]-->[FIREWALL]-->[STUNNEL SERVER]-->[REVERSE PROXY]-->[FREE INTERNET] So far I succeeded in getting HTTP working using stunnel CONNECT protocol to the firewall and going all the way through. The problem is when I try to access HTTPS, the connection get set to the stunnel server but it keeps waiting for something. Double checked all the logs, firewall can't discern, stunnel server get the connection, reverse proxy also get the socket connection. My hypothesis is that stunnel client gets the CONNECT from the browser and discard it, it uses its own way to connect to the firewall, instead of encrypting the CONNECT all the way through. As it may seems, I need a way to send 2 CONNECT packages. Does anyone know how can I proceed? Follow my configs: client = yes output = /var/log/stunnel4/stunnel.log debug = 7 [bypassclient] accept = 4000 connect = firewall.example:3128 protocolHost = destination.com:443 protocol = connect requireCert = no verifyChain = no verifyPeer = no -------------------------------------------------------------------------------------------------------------------- [bypassserver] accept = 0.0.0.0:443 connect = reverseproxy.com:8888 cert = /etc/ssl/cert.pem key = /etc/ssl/key.pem ----------------------------------------------------------------------------------------------------------------------- Thank you all in advance, already digging throw the source code (quite lost tough), Hugo

1 0

SOLVED, I cannot get Outlook Express email to work after Cox changes
by Brent Kimberley 28 Jun '19

28 Jun '19

Thank you Brent, >> I found if I have Avast running with mail shield enabled I get this error in the Stunnel log window: >> SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol >> Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket. >> >> This results in no emails being abled to be sent by SMPT. >> >> If I disable Avast's mail shield the mail is sent with no errors. >> Is there a work around for to be able to use Stunnel without disabling Avast's mail shield? >> POP3 Connection >> CERT: Pre-verification error: self signed certificate in certificate chain >> Rejected by CERT at depth=1: OU=generated by Avast Antivirus for SSL/TLS scanning, O=Avast Web/Mail Shield, CN=Avast Web/Mail Shield Root >> SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed If you need avast, sign your stunnel leaf with a well known root CA, and exchange certificates accordingly. cox_mail : avast_dpi : stunnel_TLS_proxy : client https://support.postbox-inc.com/hc/en-us/articles/204602300-Invalid-Securit…

1 0

stunnel-users Digest, Vol 179, Issue 11
by David Yunker 28 Jun '19

28 Jun '19

Brent, Here is more log information that occurs when using Avast Mail shield. CERT: Pre-verification error: self signed certificate in certificate chain Rejected by CERT at depth=1: OU=generated by Avast Antivirus for SSL/TLS scanning, O=Avast Web/Mail Shield, CN=Avast Web/Mail Shield Root SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed This occurs in the POP3 connection. Hope this helps.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 179, Issue 11
by Brent Kimberley 28 Jun '19

28 Jun '19

>>Does anybody know how to prevent this from happening? Try adding the following: #verify the peer certificate chain starting from the root CA #pre-requisite #1: checkHost (OR checkIP) #pre-requisite #2: CAfile (OR CApath) verifyChain = yes checkHost = pop.cox.com #verify the peer certificate chain starting from the root CA #pre-requisite #1: checkHost (ORcheckIP) #pre-requisite #2: CAfile (OR CApath) verifyChain = yes checkHost = smtp.cox.net ref: https://www.stunnel.org/config_windows.html https://www.stunnel.org/static/stunnel.html From: David Yunker <davidyunker(a)hotmail.com> Subject: [stunnel-users] SOLVED, I cannot get Outlook Express email to work after Cox changes To anybody interested, Here is how to configure Stunnel for Outlook Express v6 in Windows XP to work: Modify Stunnel configuration to this: [cox-pop3] client = yes accept = 127.0.0.1:110 connect = pop.cox.net:995 CAfile = ca-certs.perm OCSPaia = yes [cox-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.cox.net:587 CAfile = ca-certs.perm OCSPaia = yes Now configure Outlook Express as follows: Set incoming mail(POP3) to 127.0.0.1 Set outgoing mail(SMTP) to 127.0.0.1 Have "Logon using secure password authentication" unchecked. Have "My server requires authentication" unchecked For POP3 set incoming mail (POP3) to port 110. For SMTP set outgoing mail (SMTP) to port 25. Have "This server requires a secure connection(SSL)" for POP3 unchecked. Have "This server requires a secure connection(SSL)" for SMTP unchecked. Everything works except I have the following error message in the Stunnel log: "Service [service name] needs authentication to prevent MITM attacks" Does anybody know how to prevent this from happening? I tried having the "My server requires authentication" checked but I still have the message when Stunnel starts. Thank you for any help.

2 1

openssl integration
by Brent Kimberley 27 Jun '19

27 Jun '19

Try the following: .\openssl engine -vvvv https://github.com/openssl/openssl/blob/OpenSSL_1_1_1-stable/README.ENGINE

2 1

Problem with pkcs11
by Heinsbroek, Peter 25 Jun '19

25 Jun '19

Hallo everybody. I’m running Stunnel 5.44 with pkcs11 on windows ,with the use of a HSM containing the private keys. That’s working fine. Now I want to upgrade to 5.55,so from 32 bit to 64 bit. I replaced the 32 bit cryptoki with a 64 bit cryptoki. But now it isn’t working. I looked with sysinternals ,and it seems the hsm login isn’t working. I also placed the 64bit ssleay32 & libeap32 in the windows\system32 folder. Did I forget something? If anyone can help ,it’s highly appreciated. Met vriendelijke groet, [Atos logo] Peter Heinsbroek ICT Specialist – IDM TTS BTN/NL-TEC-Generic-Infra-S2 T: +31 (0) 88 265 9869 M: +31 (0) 6 53753244 Burg. Rijnderslaan 30 – Nederland atos.net<https://atos.net/> [LinkedIn icon]<https://www.linkedin.com/in/peter-heinsbroek-10467b52/> This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

last version of stunnel that works on Windows XP
by David Yunker 25 Jun '19

25 Jun '19

What is the last version of stunnel that works on Windows XP? Thank you.

1 0

Latest Stunnel for Windows XP
by David Yunker 25 Jun '19

25 Jun '19

To whom it may concern, What was the last version of stunnel that worked on Windows XP? Thanks for the info.

2 1

SOLVED, I cannot get Outlook Express email to work after Cox changes
by David Yunker 22 Jun '19

22 Jun '19

To anybody interested, Here is how to configure Stunnel for Outlook Express v6 in Windows XP to work: Modify Stunnel configuration to this: [cox-pop3] client = yes accept = 127.0.0.1:110 connect = pop.cox.net:995 CAfile = ca-certs.perm OCSPaia = yes [cox-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.cox.net:587 CAfile = ca-certs.perm OCSPaia = yes Now configure Outlook Express as follows: Set incoming mail(POP3) to 127.0.0.1 Set outgoing mail(SMTP) to 127.0.0.1 Have "Logon using secure password authentication" unchecked. Have "My server requires authentication" unchecked For POP3 set incoming mail (POP3) to port 110. For SMTP set outgoing mail (SMTP) to port 25. Have "This server requires a secure connection(SSL)" for POP3 unchecked. Have "This server requires a secure connection(SSL)" for SMTP unchecked. Everything works except I have the following error message in the Stunnel log: "Service [service name] needs authentication to prevent MITM attacks" Does anybody know how to prevent this from happening? I tried having the "My server requires authentication" checked but I still have the message when Stunnel starts. Thank you for any help.

1 0

Help, I cannot get Outlook Express email to work after Cox changes
by David Yunker 21 Jun '19

21 Jun '19

To anybody who can help, I am currently using Stunnel version 5.24. I cannot update it to the latest version because I am using it on a Windows XP system. My problem is that I am currently using COX for my internet provider and COX recently change the email protocol from SSL to TSL. This is a problem since I am currently using Outlook Express v6 and it does not work with TSL. I recently discovered your Stunnel program and believe it will solve my problem. I tried changing the items in the configuration file to the following: fips = yes [cox-pop3] client = yes accept = 127.0.0.1:995 connect = pop.cox.net:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.cox.net OCSPaia = yes Stunnel shows no errors but my email still does not work. This is what happens when setting up the configuration for Outlook express: My POP account is pop.cox.net. My SMTP account is smtp.cox.net. If I set the POP port to 110 and leave the SMTP port to 25 and I have checked "logon using secure password authentication". But I do NOT have checked "this server requires a secure connection (SSL)". Then when I attempt to send/receive I get the following error: "Unable to logon to the server using secure password authentication account 'pop.cox.net server ...." If I do check "this server requires a secure connection (SSL)" and leave the POP port to 110 then when I attempt to send/receive I get the following error: "Your server has unexpectedly terminated the connection ..." If I change the POP port from 110 to 995 and remove the check mark for "this server require a secure connection (SSL)". Then when I attempt to send/receive I get a time out condition. If I check "this server requires a secure connection (SSL)" and attempt a send/receive I get this error: "Your server has unexpectedly terminated the connection.." No matter how I configure my Outlook Express I do not receive any email. I have a friend who has a Windows 7 system and a virtual windows xp installed in it that he uses for his email but is using Outlook in windows xp and this same configuration works fine for him. Except he has to have "verify = 2" removed from the configuration for Stunnel and his SMTP port is 587. For it to work. What am I doing wrong? Please help!

2 1