stunnel-users

3306 discussions

Having strange issue with newer kernels? 6.8.
by Michael D. Setzer II 18 Apr '24

18 Apr '24

Having issues with stunnel not working with this settings that have work with previous kernels? [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 connect = smtp1.guam.net:465 debug = 7 verifyChain = yes CApath = /etc/ssl/certs checkHost = mail.guam.net OCSPaia = yes But now changing to [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 connect = smtp1.guam.net:465 debug = 7 Seems to work. systemctl status stunnel. stunnel.service - TLS tunnel for network daemons Loaded: loaded (/usr/lib/systemd/system/stunnel.service; enabled; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: active (running) since Thu 2024-04-18 14:48:15 ChST; 5s ago Process: 15349 ExecStart=/usr/bin/stunnel (code=exited, status=0/SUCCESS) Main PID: 15352 (stunnel) Tasks: 3 (limit: 18938) Memory: 3.6M CPU: 1.618s CGroup: /system.slice/stunnel.service └─15352 /usr/bin/stunnel Apr 18 14:48:14 setzconote.dyndns.org systemd[1]: Starting stunnel.service - TLS tunnel for network daemons... Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: stunnel 5.72 on x86_64-redhat-linux-gnu platform Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,> Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.co> Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: UTF-8 byte order mark not detected Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: FIPS mode disabled Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Configuration successful Apr 18 14:48:15 setzconote.dyndns.org systemd[1]: Started stunnel.service - TLS tunnel for network daemons. Using the longer one gives this after attempting to sent smtp. stunnel.service - TLS tunnel for network daemons Loaded: loaded (/usr/lib/systemd/system/stunnel.service; enabled; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: active (running) since Thu 2024-04-18 14:57:22 ChST; 1min 15s ago Process: 15616 ExecStart=/usr/bin/stunnel (code=exited, status=0/SUCCESS) Main PID: 15619 (stunnel) Tasks: 3 (limit: 18938) Memory: 4.0M CPU: 1.639s CGroup: /system.slice/stunnel.service └─15619 /usr/bin/stunnel Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG4[3]: CERT: Pre-verification error: unable to get local issuer> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG4[3]: Rejected by CERT at depth=0: CN=*.guam.net Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: TLS alert (write): fatal: unknown CA Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG3[3]: SSL_connect: ssl/statem/statem_clnt.c:1889: error:0A0000> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG5[3]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Deallocating application specific data for session conne> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Remote descriptor (FD=16) closed Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: local_rfd/local_wfd reset (FD=3) Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Local descriptor (FD=3) closed Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Service [guamsmtp] finished (0 left) lines 1-23/23 (END) Was using the Fedora stunnel the is 5.71, but downloaded the latest 5.72, but seem to get same results. Had some issues with nvidia drives that work fine with 6.7.11 kernels, but fail with the 6.8.x drivers, so not sure if it is linked to that? +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:[email protected] mailto:[email protected] mailto:[email protected] Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

1 0

stunnel doesn't allow two client certificates with the same Subject DN?
by Christopher Schultz 16 Apr '24

16 Apr '24

Hello, I was recently rotating a certificate for a service and I went through my usual procedure: 1. Generate a new client key+cert; don't place them into service, yet 2. Distribute the new certificate to all my stunnel servers that need to trust it by placing it at the end of each of my servers' CAFile files 3. Restart all stunnel services 4. Swap the old key+cert for the client with the new key+cert 5. Test that all is well I've found that if the Distinguished Name of both the old and new certificate are the same, stunnel will only trust the one that is mentioned /first/ in the CAFile. For example, if the CAFile contains: -----BEGIN CERTIFICATE----- certificate A Serial Number: 12345678 Subject: C=US, OU=Testing, O=Example.com, CN=test -----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE----- certificate B Serial Number: 87654321 Subject: C=US, OU=Testing, O=Example.com, CN=test -----BEGIN CERTIFICATE----- Certificate A will be trusted but Certificate B will not be trusted. The error shown in the logs is: CERT: Pre-verification error: self signed certificate Apr 15 21:33:06 mirth-pcc.chadis.com stunnel[23421]: Certificate check failed: depth=0, /C=US/OU=Testing/O=Example.com/CN=test While the certificates are both self-signed, that should not cause an error. Removing the old certificate from the CAFile or moving it to the bottom of the file resolves the problem. (But of course then Certificate A is no longer trusted despite it appearing in the CAFile.) Is this expected behavior? It would be very helpful if stunnel could support two different certificates with the same Subject DN for these kinds of cert-rotation processes. The alternatives are to always use a new DN each time or to add/remove at the same time which makes rolling-back more difficult. Note that everything else about these certificates is different: serial number, fingerprint, generating-key, etc. It's only the Subject DN that is the same. This is stunnel 4.56 on x86_64-koji-linux-gnu platform, on Amazon Linux 2. Thanks! -chris

2 1

HELO handshake problem (?)
by Ducale Ducale 10 Apr '24

10 Apr '24

In a Windows 10 machine I'm using a tool (Netwrix Service Monitor) with a SMTP notification feature that doesn't support authentication, so I'm using Stunnel 5.72 as a local relay for SMTP2GO (smtp2go.com), with this configuration: [smtp2go] client = yes accept = 127.0.0.1:25 connect = mail.smtp2go.com:2525 protocol = smtp protocolAuthentication = plain protocolHost = cloud.mydomain.com protocolUsername = smtp2go(a)mydomain.com protocolPassword = P@ssw0rd debug = 7 I try both PLAIN and LOGIN as authentication mode, with this is error: LOGIN: " ... TLS connected: new session negotiated TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) Peer temporary key: X25519, 253 bits Compression: null, expansion: null -> HELO cloud.mydomain.com <- 250 mail.smtp2go.com Hello cloud.mydomain.com [x.x.x.x] -> AUTH LOGIN <- 503 AUTH command used when not advertised Remote server does not support LOGIN authentication ... " PLAIN: " ... TLS connected: new session negotiated TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) Peer temporary key: X25519, 253 bits Compression: null, expansion: null -> HELO cloud.mydomain.com <- 250 mail.smtp2go.com Hello cloud.mydomain.com [x.x.x.x] -> AUTH PLAIN ******************************************** <- 503 AUTH command used when not advertised PLAIN Authentication Failed Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Deallocating application specific data for session connect address ... " Can anyone help me solve this problem? Thanks!

3 3

help configuration for socks5 nordvpn requiring authentication
by Alberto P 10 Apr '24

10 Apr '24

Hello, I would like to use stunnel to use a socks5 server requiring user/pass authentication (nordvpn) with different clients that allow for a socks5 proxy but no authentication. Could someone help me with the configuration (linux or windows is good). In detail, I don't know how to provide user/pass to the configuration, and if it is actually feasible. Any help will be very appreciated !

1 1

Stunnel - Silent switch to change the install directory
by Meena Prabhakaran 27 Mar '24

27 Mar '24

Hi Team, We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. For more details, please have a look at Autonomous Patching for Every Third-Party Windows App (adaptiva.com) (https://adaptiva.com/products/autonomous-patch) We are willing to add the latest stable version of Stunnel product to our catalogue. Downloaded https://www.stunnel.org/downloads/stunnel-5.72-win64-installer.exe We are testing this app on Windows 10 64Bit VM. Please help us on below points: 1. Is there any switch/parameter which can be passed along with "stunnel-5.72-win64-installer.exe" for changing the "Install directory" silently? Tried these switches - /D, /DIR, /APPDIR, /INSTALLDIR, /TARGETDIR, /INSTALLLOCATION Thanks & Regards, Meena Prabhakaran Application Packager, Adaptiva M +91 9080759487 meena.prabhakaran(a)adaptiva.com<mailto:[email protected]> www.adaptiva.com<http://www.adaptiva.com/> Data Protection and Privacy: Your privacy is important to us. We are committed to protecting your personal information and handling it responsibly. For more information on how we process and protect your data, please review our Privacy Policy (https://adaptiva.com/privacy). Confidentiality Notice: Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of Adaptiva. The recipient should check for the presence of viruses, as Adaptiva accepts no liability for any virus transmitted by this email.

3 3

Received trusted client CA list not found
by allmail 16 Mar '24

16 Mar '24

I see this message in the Stunnel (client) logs during SSL handshake with the server The server requires a client certificate which has been configured in the stunnel configuration. The handshake is working fine but I was wondering what exactly does this line mean. From what I found so far, seems like there is a way for the server to specify which CA's it will accept for the client certificate and it can specify them in the ClientCertificate request that it sends This server doesnt send anything like that, so I am guessing that is the reason for this log line? Can someone please confirm? Btw, I see this line only when using TLSv1.3. When I restrict the client to TLSv1.2, I dont see this line. thanks LOG Peer certificate required TLS state (connect): before SSL initialization Initializing application specific data for session authenticated TLS state (connect): SSLv3/TLS write client hello TLS state (connect): SSLv3/TLS write client hello TLS state (connect): SSLv3/TLS read server hello TLS state (connect): TLSv1.3 read encrypted extensions Received trusted client CA list not found TLS state (connect): SSLv3/TLS read server certificate request

1 0

Windows service won't start. ""The Stunnel TLS wrapper service is marked as an interactive service."
by docfxit＠theoffice.la 12 Mar '24

12 Mar '24

This is my log: [code] stunnel 5.72 on x64-pc-mingw32-gnu platform 2024.03.10 10:19:49 LOG5[main]: Compiled/running with OpenSSL 3.2.1 30 Jan 2024 2024.03.10 10:19:49 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2024.03.10 10:19:49 LOG7[main]: errno: (*_errno()) 2024.03.10 10:19:49 LOG6[main]: Initializing inetd mode configuration 2024.03.10 10:19:49 LOG7[main]: Running on Windows 6.2 Windows 10 2024.03.10 10:19:49 LOG5[main]: Reading configuration from file C:\Programs\stunnel\config\stunnel.conf 2024.03.10 10:19:49 LOG5[main]: UTF-8 byte order mark not detected 2024.03.10 10:19:49 LOG5[main]: FIPS mode disabled 2024.03.10 10:19:49 LOG6[main]: Compression disabled 2024.03.10 10:19:49 LOG7[main]: No PRNG seeding was required 2024.03.10 10:19:49 LOG6[main]: Initializing service [pop3_DocfxitGmail] 2024.03.10 10:19:49 LOG7[main]: Initializing context [pop3_DocfxitGmail] 2024.03.10 10:19:49 LOG6[main]: OpenSSL security level is used: 2 2024.03.10 10:19:49 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2024.03.10 10:19:49 LOG7[main]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2024.03.10 10:19:49 LOG7[main]: TLS options: 0x2100000 (+0x0, -0x0) 2024.03.10 10:19:49 LOG6[main]: Session resumption enabled 2024.03.10 10:19:49 LOG7[main]: No certificate or private key specified 2024.03.10 10:19:49 LOG6[main]: No trusted certificates found [/code] I copied a working config from Windows 7 64bit. Running stunnel 5.50

2 1

A conclusive Manual for Web Nursing Classes
by silir10174＠mcuma.com 07 Mar '24

07 Mar '24

[b]A conclusive Manual for Web Nursing Classes[/b] Show (150 words): In the rapidly creating circumstance of preparing, electronic learning has changed into an establishment for overwhelmingly most certain clinical directors searching for flexibility and responsiveness. This wide aide, "Rx for Progress: An unequivocal [url=https://tutorsacademy.co/nurs-fpx-4050-assessment-2-ethical-and-policy-factors-in-care-coordination/]4050 assessment 2[/url] Manual for Electronic Nursing Classes," bounces into the universe of web nursing bearing, offering boundless encounters and strong signs to explore this imperative learning environment. From picking the right program to winning in virtual study corridors, this guide means to empower specific specialists with the data and resources expected to prosper in the online nursing preparing space. I. The Move of Web Nursing Coaching The key piece investigates the making obviousness of electronic nursing programs, uncovering data into the parts that have added to their standing. Look at the flexibility these undertakings offer, the rising interest for remote learning, and such progress in movement that [url=https://tutorsacademy.co/nurs-fpx-4040-assessment-1-nursing-informatics-in-health-care/]nurs 4040 assessment 1[/url] make electronic arranging more open than later in consistent memory. II. Picking the Right Web Nursing Undertaking This part gives an every little push toward turn guide on picking the ideal electronic nursing program. It covers fundamental evaluations like declaration, program reputation, labor force endorsements, and the availability of clinical approaches. Furthermore, it offers tips on researching and standing separated different undertakings from ensure a remarkably arranged fit for individual necessities and goals. III. Investigating Virtual Homerooms Truly analyzing the virtual homeroom is genuine for web nursing students. This part offers significant empowering on utilizing time, as a matter of fact, convincing correspondence with instructors and mates, and utilizing on the web resources. It also addresses typical challenges looked by online students and gives systems to beat them. IV. Controlling Clinical Experiences Clinical experiences are a crucial piece of nursing tutoring. This part examines how web nursing programs coordinate clinical circumstances, orchestrating the meaning of dynamic experience and offering heading on finding fitting entryways locally. It likewise discusses the control of reenactment movement in beating any hindrance among speculation and practice. V. Instruments and Movements for Online Accomplishment To win in electronic nursing classes, students ought to be have a lot of involvement in various contraptions and levels of progress. This part approaches basic programming, stages, and resources that can moreover cultivate the shocking an open door for development. From virtual labs to crafty outline materials, this guide ensures students are outstanding for progress. VI. Vanquishing Challenges and Remaining Invigorated Web learning goes with its own course of action of troubles. This part pays special attention to normal blocks like detachment, time use difficulties, and movement issues. It gives essential clues on extra moved, searching for help, and saving solid areas for an among fun and serious exercises. End Considering everything, "Rx for Progress: A persuading Manual for Electronic Nursing Classes" fills in as a total partner without a doubt clinical managers leaving on their online training experience. By resolving focal issues of view from program decision to overwhelming virtual homerooms, this guide partners with students to thrive in the dynamic and repaying field of electronic nursing training. Outfitted with data and sensible designs, perusers are all set to embrace the doorways and burdens of electronic getting, making game plans for a valuable nursing business.

1 0

Stunnel HA Options
by caspernetherlands＠gmail.com 07 Mar '24

07 Mar '24

Hello folks, I have seen a couple of other posts concerning this question but I am still unclear and wanted to see if there are any new options for 2024. What would the recommended setup for Stunnel look like for HA (high-availability)? All I need is basically to have two servers, one active and another one stand by and be able to fail over to the standby server when the active one becomes unavailable due to hardware failure, bad vmotion etc. Extra point if this setup offers automatic failover to DR as well, meaning failover to a third server that's also on standby in case of catastrophic failures on the first two. This almost looks like a load-balancing solution but not really. I say this because I tried to leverage F5 to accomplish this HA scenario and wasn't successful at it because of the way that the F5 performs active checks so often and how noisy that can be for network perimeter security setups. My main request is the local HA though, I can come up with a solution for DR later on. Any recommendation is appreciated. Thank you in advance!

4 5

possible typo in manpage imap example
by alisonatwork＠outlook.com 05 Mar '24

05 Mar '24

Hi, It's possible that I am missing something obvious, but I was reading the manpage today and it seems like the example suggesting how to configure an email client for tunneled imap is incorrect. It suggests that the user configure their client to connect to port 119, but then the example stunnel config shows accept = 143. If this is indeed incorrect, I think the following files need to be modified to change 119 to 143: doc/stunnel.8.in doc/stunnel.html.in doc/stunnel.pl.8.in doc/stunnel.pl.html.in doc/stunnel.pl.pod.in doc/stunnel.pod.in Regards, Alison

1 0

← Newer
1
...
4
5
6
7
8
9
10
...
331
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users