[stunnel-users] Incoming port ignored

Thu Mar 31 19:46:36 CEST 2016

Hi Jose,

thanks for your effort!

What you describe is exact the way I already configued stunnel & the
mail-clients. Stopping Avira doesn't make any difference - e-mails still can
be send or recieved.
tcpview showed me the the listening ports as expected 25,110,143 PLUS two
ports above Port 8000 (e.g. 8248 & 8249): 

stunnel.exe 6992 TCP 127.0.0.1 25     0.0.0.0 0          LISTENING          
stunnel.exe 6992 TCP 127.0.0.1 110   0.0.0.0 0          LISTENING          
stunnel.exe 6992 TCP 127.0.0.1 143   0.0.0.0 0          LISTENING          
stunnel.exe 6992 TCP 127.0.0.1 8248 127.0.0.1 8249 ESTABLISHED          
stunnel.exe 6992 TCP 127.0.0.1 8249 127.0.0.1 8248 ESTABLISHED          

BUT what I tried again: Instead of setting 127.0.0.1:port (25,11,143) in the
mail-client config, I switched back to pop3.my-provider.net /
imap.my-provider.net / smtp.my-provider.net with no SSL/TLS/STARTTLS and
then Avira is able to scan the e-mails!!!
So my suspicion is, that when setting the mail-client config to
127.0.0.1:port, stunnel gets the e-mails BEFORE Avira and sends them across
the encrypted tunnel (and Avira is again not able to read the traffic inside
that tunnel). So the traffic flow with the 127.0.0.1:port settings is:
Client -> stunnel -> Avira (blind) -> provider

I still wonder how I ever got the setup running successful when the traffic
flow really is going that way.

Regards,
Ivan

  _____  

Von: Jose Alf. [mailto:josealf at rocketmail.com] 
Gesendet: Donnerstag, 31. März 2016 05:22
An: de_masi at blu-it.de; stunnel-users at stunnel.org
Betreff: Re: [stunnel-users] Incoming port ignored

Ivan,

I checked the references. It looks like Avira works more or less as Ludolf
thinks. Somehow, it intercepts connections to SMTP, POP3 and IMAP servers.
The scan should be transparent to both mail client and server. If the
traffic is encrypted between client and server, it can't scan it. 

Now, a connection can start in the standard (non-encrypted) ports and it can
be upgraded to a secure one. If this happens, Avira blocks the connection.
To avoid this, you must ensure your mail client communicates only in clear
text. This is the crucial part. No SSL/TLS/STARTTLS allowed.

https://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/935

So, I think your workaround configuration should work. Set your accepts to
127.0.0.1:port (where port=25,110,143). This blocks connections from other
machines to your stunnel service.

Configure your e-mail client to send mail via 127.0.0.1:25 and fetch POP3
and IMAP Mail from 127.0.0.1:110 and 127.0.0.1:143 only with no encryption.
Note: your mail client is NOT listening on those ports (stunnel is or will
be listening). Your mail client connects to those ports.

Test as follows:

1. Disable Avira.
2. If you have stunnel in service mode, make sure it is stopped.

2. Start stunnel in application mode. Make sure there are no errors. The log
should tell you it is listening on ports 25,110,143. You can also use
tcpview utility from sysinternals (now Microsoft) to verify this.

3. Try sending/receiving e-mail.
4. If this works, enable Avira and test again.
5. Report results.

Regards,
Jose

On Wednesday, March 30, 2016 8:51 AM, Ivan De Masi <de_masi at blu-it.de>
wrote: 

I just tell Avira e-mail scanner on which ports it has to listen (POP3: 110
/ IMAP: 143 / SMTP: 25).
I can't configure any IP - but this is not necessary, because as I mentioned
before: When configuring the e-mail client with an unencrypted and direct
connection to my mailprovider, Avira is able to scan the e-mails. So it
already listens on localhost.

I found that workaround here:

https://answers.avira.com/de/question/avira-email-schutz-blockiert-ssltlssta
rttlsverbindung-9253

And Outlook & Thunderbird are listening on 127.0.0.1:110, 127.0.0.1:143,
127.0.0.1:25 ... it worked!!!  --- WRONG

I think from the moment I installed stunnel as a service problems started.
The servive-daemon also told me, that there is no config (?!).
So I switched back to the "GUI Start" and now it doesn't work any more :-/

Well, this seem logical to me, but when I switch off the mail-scanner it
doesn't interrupt the fetching or sending, only when I stopt stunnel e-mails
can't be fetched or send any more. So it seems to me somehow the mail-client
connects directly to stunnel? 

> Only the connection stunnel-provider will be encrypted.

Yes, that's right.

Regards, 

Ivan

_______________________________________________
stunnel-users mailing list
stunnel-users at stunnel.org
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.stunnel.org/pipermail/stunnel-users/attachments/20160331/cf3fbc1c/attachment.html>