<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yiv8063601402"><div id="yui_3_16_0_ym18_1_1459389880750_6184"><div dir="ltr" id="yiv8063601402yui_3_16_0_ym18_1_1459352693473_2952"><div id="yiv8063601402yui_3_16_0_ym18_1_1459352693473_2814"><br clear="none"></div><div>Ivan,</div><div id="yui_3_16_0_ym18_1_1459389880750_6682"><br clear="none"><span></span></div><div id="yui_3_16_0_ym18_1_1459389880750_6372" dir="ltr">I checked the references. It looks like Avira works more or less as Ludolf thinks. Somehow, it intercepts connections to SMTP, POP3 and IMAP servers. The scan should be transparent to both mail client and server. If the traffic is encrypted between client and server, it can't scan it. </div><div id="yui_3_16_0_ym18_1_1459389880750_6680" dir="ltr"><br></div><div id="yui_3_16_0_ym18_1_1459389880750_6572" dir="ltr">Now, a connection can start in the standard (non-encrypted) ports and it can be upgraded to a secure one. If this happens, Avira blocks the connection. To avoid this, you must ensure your mail client communicates only in clear text. This is the crucial part. No SSL/TLS/STARTTLS allowed.</div><div id="yui_3_16_0_ym18_1_1459389880750_7009" dir="ltr"><br></div><div id="yui_3_16_0_ym18_1_1459389880750_8687" dir="ltr"><a id="yui_3_16_0_ym18_1_1459389880750_8686" class="" href="https://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/935">https://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/935</a><br></div><div id="yui_3_16_0_ym18_1_1459389880750_8694"><br></div><div id="yui_3_16_0_ym18_1_1459389880750_8716"><br></div><div id="yui_3_16_0_ym18_1_1459389880750_8681" dir="ltr"><br></div><div id="yui_3_16_0_ym18_1_1459389880750_7008" dir="ltr">So, I think your workaround configuration should work. Set your accepts to 127.0.0.1:port (where port=25,110,143). This blocks connections from other machines to your stunnel service.</div><div id="yui_3_16_0_ym18_1_1459389880750_7729" dir="ltr"><br></div><div id="yui_3_16_0_ym18_1_1459389880750_7770" dir="ltr">Configure your e-mail client to send mail via 127.0.0.1:25 and fetch POP3 and IMAP Mail from 127.0.0.1:110 and 127.0.0.1:143 only with no encryption. Note: your mail client is NOT listening on those ports (stunnel is or will be listening). Your mail client connects to those ports.<br></div><div id="yui_3_16_0_ym18_1_1459389880750_7210" dir="ltr"><br></div><div id="yui_3_16_0_ym18_1_1459389880750_7211" dir="ltr">Test as follows:</div><div id="yui_3_16_0_ym18_1_1459389880750_7256" dir="ltr"><br></div><div id="yui_3_16_0_ym18_1_1459389880750_7277" dir="ltr">1. Disable Avira.</div><div id="yui_3_16_0_ym18_1_1459389880750_7368" dir="ltr">2. If you have stunnel in service mode, make sure it is stopped.<br></div><div id="yui_3_16_0_ym18_1_1459389880750_7299" dir="ltr">2. Start stunnel in application mode. Make sure there are no errors. The log should tell you it is listening on ports 25,110,143. You can also use tcpview utility from sysinternals (now Microsoft) to verify this.<br></div><div id="yui_3_16_0_ym18_1_1459389880750_7365" dir="ltr">3. Try sending/receiving e-mail.</div><div id="yui_3_16_0_ym18_1_1459389880750_7833" dir="ltr">4. If this works, enable Avira and test again.</div><div id="yui_3_16_0_ym18_1_1459389880750_7832" dir="ltr">5. Report results.</div><div id="yui_3_16_0_ym18_1_1459389880750_7906" dir="ltr"><br></div><div id="yui_3_16_0_ym18_1_1459389880750_8655" dir="ltr"><br></div><div dir="ltr"><br></div><div id="yui_3_16_0_ym18_1_1459389880750_7980" dir="ltr">Regards,</div><div id="yui_3_16_0_ym18_1_1459389880750_8565" dir="ltr">Jose<br></div><div id="yui_3_16_0_ym18_1_1459389880750_7822" dir="ltr"><br></div><font id="yiv8063601402yui_3_16_0_ym18_1_1459352693473_3308" face="Arial" size="2">On Wednesday, March 30, 2016 8:51 AM, Ivan De Masi <de_masi@blu-it.de> wrote:<div id="yui_3_16_0_ym18_1_1459389880750_8197" class="qtdSeparateBR"><br><br></div></font></div></div></div><div id="yui_3_16_0_ym18_1_1459389880750_8198" class=".yiv8063601402yahoo_quoted"><div id="yiv8063601402yui_3_16_0_ym18_1_1459352693473_2886" style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"><div id="yiv8063601402yui_3_16_0_ym18_1_1459352693473_2885" style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"><div class="qtdSeparateBR"><br><br></div><div class="yiv8063601402yqt9329662513" id="yiv8063601402yqtfd99070"> <br clear="none"><div class="yiv8063601402y_msg_container" id="yiv8063601402yui_3_16_0_ym18_1_1459352693473_2945">I just tell Avira e-mail scanner on which ports it has to listen (POP3: 110<br clear="none">/ IMAP: 143 / SMTP: 25).<br clear="none">I can't configure any IP - but this is not necessary, because as I mentioned<br clear="none">before: When configuring the e-mail client with an unencrypted and direct<br clear="none">connection to my mailprovider, Avira is able to scan the e-mails. So it<br clear="none">already listens on localhost.<br clear="none"><br clear="none">I found that workaround here:<br clear="none"><br clear="none"><a rel="nofollow" shape="rect" id="yiv8063601402yui_3_16_0_ym18_1_1459352693473_3307" target="_blank" href="https://answers.avira.com/de/question/avira-email-schutz-blockiert-ssltlssta">https://answers.avira.com/de/question/avira-email-schutz-blockiert-ssltlssta</a><br clear="none">rttlsverbindung-9253<br clear="none"><br clear="none">And Outlook & Thunderbird are listening on 127.0.0.1:110, 127.0.0.1:143,<br clear="none">127.0.0.1:25 ... it worked!!! --- WRONG<br clear="none"><br clear="none">I think from the moment I installed stunnel as a service problems started.<br clear="none">The servive-daemon also told me, that there is no config (?!).<br clear="none">So I switched back to the "GUI Start" and now it doesn't work any more :-/<br clear="none"><br clear="none">Well, this seem logical to me, but when I switch off the mail-scanner it<br clear="none">doesn't interrupt the fetching or sending, only when I stopt stunnel e-mails<br clear="none">can't be fetched or send any more. So it seems to me somehow the mail-client<br clear="none">connects directly to stunnel? <br clear="none"><br clear="none">> Only the connection stunnel-provider will be encrypted.<br clear="none"><br clear="none">Yes, that's right.<br clear="none"><br clear="none">Regards,<div class="yiv8063601402yqt7267761171" id="yiv8063601402yqtfd52062"><br clear="none">Ivan<br clear="none"><br clear="none">_______________________________________________<br clear="none">stunnel-users mailing list<br clear="none"><a rel="nofollow" shape="rect" ymailto="mailto:stunnel-users@stunnel.org" target="_blank" href="mailto:stunnel-users@stunnel.org">stunnel-users@stunnel.org</a><br clear="none"><a rel="nofollow" shape="rect" id="yiv8063601402yui_3_16_0_ym18_1_1459352693473_3122" target="_blank" href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a><br clear="none"></div><br clear="none"><br clear="none"></div> </div></div><div class="yiv8063601402yqt9329662513" id="yiv8063601402yqtfd39918"> </div></div><div class="yiv8063601402yqt9329662513" id="yiv8063601402yqtfd24523"> </div></div></div></body></html>