- stunnel-users - stunnel.org

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > Here's my stunnel.conf, with blank lines and comments removed: > client = yes > output = C:\temp\stunnel-log.txt > taskbar = yes > debug = 7 > [POP3 Incoming] > protocol = pop3 > accept = 127.0.0.1:1110 > connect = pop.cox.net:995 > protocol = smtp > accept = 127.0.0.1:25 > connect = smtp.cox.net:465 Here it worked for POP3 immediately. Not needed for SMTP. https://en.wikibooks.org/wiki/Oberon/Oberon#Receiving_and_Sending_Email Before using 1110, check. netstat -tulpn | grep 1110 Correct id, passwd and port are in the MUA? Separate configurations for POP3 and SMTP. Troubleshoot one at a time. "protocol" shouldn't be necessary. Try this. [POP3] client = yes output = C:\temp\stunnel-log.txt accept = localhost:1110 connect = pop.cox.net:995 Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Cox has been warning us that as of next week, we need to use encrypted POP and SMTP. I have two reasons to use stunnel now: 1) I use the K9 Bayesian email proxy for spam filtering, and it doesn't do TLS 2) My wife still uses Eudora and doesn't want to switch, and while Eudora allegedly supports TLS, it's not trivial to make it work (and Cox certainly won't help) Thus stunnel looks like an ideal solution. But after tinkering for a few hours on two machines, I'm stumped. While I can type an SMTP or POP transaction in my sleep, I'm not so good at typing a TLS handshake, so I'm using Outlook 2013 as my test platform (and that's what I'll be using myself later anyway). I setup a new account, point to the right ports on 127.0.0.1, and the test times out, with: Log onto incoming mail server (POP3): The operation timed out waiting for a response from the receiving (POP) server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP). Send test e-mail message: The operation timed out waiting for a response from the sending (SMTP) server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP). Here's my stunnel.conf, with blank lines and comments removed: client = yes output = C:\temp\stunnel-log.txt taskbar = yes debug = 7 [POP3 Incoming] protocol = pop3 accept = 127.0.0.1:1110 connect = pop.cox.net:995 protocol = smtp accept = 127.0.0.1:25 connect = smtp.cox.net:465 Yes, that's port 1110, since K9 is using 110. Shouldn't matter, right? (As long as I point the client at 1110, obviously!) Yes, I have protocol = pop3 and protocol = smtp; I've tried commenting them out individually, no change that I can see. Yes, I'm running stunnel explicitly, not as a service-I found threads suggesting that it just doesn't work as a service on Windows 7 for some reason (and in fact beat my head against that wall for a while first). And here's the stunnel log: 2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1 2018.01.17 21:29:24 LOG7[main]: No limit detected for the number of clients 2018.01.17 21:29:24 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.01.17 21:29:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.01.17 21:29:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.01.17 21:29:24 LOG7[main]: errno: (*_errno()) 2018.01.17 21:29:24 LOG7[ui]: GUI message loop initialized 2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1 2018.01.17 21:29:24 LOG5[main]: Reading configuration from file stunnel.conf 2018.01.17 21:29:24 LOG5[main]: UTF-8 byte order mark not detected 2018.01.17 21:29:24 LOG5[main]: FIPS mode disabled 2018.01.17 21:29:24 LOG7[main]: Compression disabled 2018.01.17 21:29:24 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2018.01.17 21:29:24 LOG7[main]: Wrote 0 new random bytes to C:/.rnd 2018.01.17 21:29:24 LOG7[main]: PRNG seeded successfully 2018.01.17 21:29:24 LOG6[main]: Initializing service [POP3 Incoming] 2018.01.17 21:29:24 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.01.17 21:29:24 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2018.01.17 21:29:24 LOG7[main]: No certificate or private key specified 2018.01.17 21:29:24 LOG4[main]: Service [POP3 Incoming] needs authentication to prevent MITM attacks 2018.01.17 21:29:24 LOG5[main]: Configuration successful 2018.01.17 21:29:24 LOG7[main]: Binding service [POP3 Incoming] 2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=460) 2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=460) bound to 127.0.0.1:1110 2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=464) 2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=464) bound to 127.0.0.1:25 2018.01.17 21:29:24 LOG7[cron]: Cron thread initialized 2018.01.17 21:29:50 LOG7[main]: Found 1 ready file descriptor(s) 2018.01.17 21:29:50 LOG7[main]: FD=424 ifds=r-x ofds=--- 2018.01.17 21:29:50 LOG7[main]: FD=460 ifds=r-x ofds=r-- 2018.01.17 21:29:50 LOG7[main]: Service [POP3 Incoming] accepted (FD=488) from 127.0.0.1:54855 2018.01.17 21:29:50 LOG7[main]: Creating a new thread 2018.01.17 21:29:50 LOG7[main]: New thread created 2018.01.17 21:29:50 LOG7[0]: Service [POP3 Incoming] started 2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on local socket 2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] accepted connection from 127.0.0.1:54855 2018.01.17 21:29:50 LOG6[0]: failover: round-robin, starting at entry #1 2018.01.17 21:29:50 LOG6[0]: s_connect: connecting 68.6.19.8:465 2018.01.17 21:29:50 LOG7[0]: s_connect: s_poll_wait 68.6.19.8:465: waiting 10 seconds 2018.01.17 21:29:50 LOG5[0]: s_connect: connected 68.6.19.8:465 2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] connected remote server from 192.168.1.17:54856 2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.01.17 21:29:50 LOG7[0]: Remote descriptor (FD=508) initialized 2018.01.17 21:30:24 LOG6[cron]: Executing cron jobs 2018.01.17 21:30:24 LOG6[cron]: Cron jobs completed in 0 seconds 2018.01.17 21:30:24 LOG7[cron]: Waiting 86400 seconds 2018.01.17 21:31:05 LOG7[main]: Found 1 ready file descriptor(s) 2018.01.17 21:31:05 LOG7[main]: FD=424 ifds=r-x ofds=--- 2018.01.17 21:31:05 LOG7[main]: FD=460 ifds=r-x ofds=--- 2018.01.17 21:31:05 LOG7[main]: Service [POP3 Incoming] accepted (FD=528) from 127.0.0.1:54891 2018.01.17 21:31:05 LOG7[main]: Creating a new thread 2018.01.17 21:31:05 LOG7[main]: New thread created 2018.01.17 21:31:05 LOG7[1]: Service [POP3 Incoming] started 2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on local socket 2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] accepted connection from 127.0.0.1:54891 2018.01.17 21:31:05 LOG6[1]: failover: round-robin, starting at entry #0 2018.01.17 21:31:05 LOG6[1]: s_connect: connecting 146.20.147.245:995 2018.01.17 21:31:05 LOG7[1]: s_connect: s_poll_wait 146.20.147.245:995: waiting 10 seconds 2018.01.17 21:31:05 LOG5[1]: s_connect: connected 146.20.147.245:995 2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] connected remote server from 192.168.1.17:54892 2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on remote socket 2018.01.17 21:31:05 LOG7[1]: Remote descriptor (FD=336) initialized 2018.01.17 21:34:05 LOG3[1]: Unexpected socket close (s_read) 2018.01.17 21:34:05 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.01.17 21:34:05 LOG7[1]: Remote descriptor (FD=336) closed 2018.01.17 21:34:05 LOG7[1]: Local descriptor (FD=528) closed 2018.01.17 21:34:05 LOG7[1]: Service [POP3 Incoming] finished (1 left) 2018.01.17 21:34:05 LOG7[1]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2018.01.17 21:34:05 LOG7[1]: str_stats: 32 byte(s) at ..\src\network.c:680 2018.01.17 21:34:50 LOG6[0]: s_read: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2018.01.17 21:34:50 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.01.17 21:34:50 LOG7[0]: Remote descriptor (FD=508) closed 2018.01.17 21:34:50 LOG7[0]: Local descriptor (FD=488) closed 2018.01.17 21:34:50 LOG7[0]: Service [POP3 Incoming] finished (0 left) 2018.01.17 21:34:50 LOG7[0]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2018.01.17 21:34:50 LOG7[0]: str_stats: 32 byte(s) at ..\src\network.c:680 It looks like it connects, but then just sits there?! I see these: No certificate or private key specified Service [POP3 Incoming] needs authentication to prevent MITM attacks but that's during startup. Or are those significant? I feel like I'm one setting away from having this all work.! Thanks in advance for any suggestions. -- ...phsiii

1 0

TLS socket closed (SSL_write) with unsent byte(s)
by Cotswold Group - Stephen Murray 16 Jan '18

16 Jan '18

Hi All, We use stunnel to send emails from our scanners to our hosted mail provider (that now only accept TLS connections). This has been working well for a number of years, but just recently the scanners (all Lexmark) have sporadically been giving errors of 'connection failed'. If I check the stunnel logs, the failed send has an extra line in of TLS socket closed (SSL_write) with 418 unsent byte(s) Below are 2 examples, 59 was sent successfully, 60 was not. 2018.01.16 14:37:24 LOG5[59]: Service [fasthosts-smtp] accepted connection from 10.226.174.95:11473 2018.01.16 14:37:24 LOG5[59]: s_connect: connected 213.171.216.50:465 2018.01.16 14:37:24 LOG5[59]: Service [fasthosts-smtp] connected remote server from 10.226.150.9:52577 2018.01.16 14:37:24 LOG5[59]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.01.16 14:37:24 LOG5[59]: s_connect: connected 23.55.155.27:80 2018.01.16 14:37:24 LOG5[59]: OCSP: Certificate accepted 2018.01.16 14:37:24 LOG5[59]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.01.16 14:37:25 LOG5[59]: s_connect: connected 23.55.155.27:80 2018.01.16 14:37:25 LOG5[59]: OCSP: Certificate accepted 2018.01.16 14:37:25 LOG5[59]: Certificate accepted at depth=0: C=GB, ST=Gloucestershire, L=Gloucester, O=Fasthosts Internet Limited, OU=NOC, CN=smtp.livemail.co.uk 2018.01.16 14:37:29 LOG5[59]: Connection closed: 167106 byte(s) sent to TLS, 376 byte(s) sent to socket 2018.01.16 14:38:19 LOG5[60]: Service [fasthosts-smtp] accepted connection from 10.226.174.95:11483 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 213.171.216.50:465 2018.01.16 14:38:19 LOG5[60]: Service [fasthosts-smtp] connected remote server from 10.226.150.9:52620 2018.01.16 14:38:19 LOG5[60]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 23.55.155.27:80 2018.01.16 14:38:19 LOG5[60]: OCSP: Certificate accepted 2018.01.16 14:38:19 LOG5[60]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 23.55.155.27:80 2018.01.16 14:38:19 LOG5[60]: OCSP: Certificate accepted 2018.01.16 14:38:19 LOG5[60]: Certificate accepted at depth=0: C=GB, ST=Gloucestershire, L=Gloucester, O=Fasthosts Internet Limited, OU=NOC, CN=smtp.livemail.co.uk 2018.01.16 14:38:24 LOG3[60]: TLS socket closed (SSL_write) with 418 unsent byte(s) 2018.01.16 14:38:24 LOG5[60]: Connection reset: 964 byte(s) sent to TLS, 392 byte(s) sent to socket Has anyone come across this before? Our mail provider has send limits in place of 50 every 10 minutes, but I am confident we are not reaching those amounts. Any help appreciated. Regards, Stephen

1 0

Connecting a HTTP browser to a HTTPS server.
by peter＠easthope.ca 12 Jan '18

12 Jan '18

Hello, I'm interested to configure stunnel to allow my local non-TLS Web browser to receive pages from a remote server providing only HTTPS. This section of https://www.stunnel.org/static/stunnel.html appears relevant. transparent = none | source | destination | both (Unix only) enable transparent proxy support on selected platforms ... destination The original destination is used instead of the connect option. A service section for transparent destination may look like this: [transparent] client = yes accept = <stunnel_port> transparent = destination This configuration requires iptables setup to work, possibly in /etc/rc.local or equivalent file. ... For a connect target installed on a remote host: /sbin/iptables -I INPUT -i eth0 -p tcp --dport <stunnel_port> -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport <redirected_port> \ -i eth0 -j DNAT --to-destination <local_ip>:<stunnel_port> The transparent destination option is currently only supported on Linux. ==================================== Substitution of parameters for my context gives these configurations.. [transparent] client = yes accept = 127.0.0.1:954 transparent = destination /sbin/iptables -I INPUT -i eth0 -p tcp --dport 954 -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport 443 \ -i eth0 -j DNAT --to-destination 127.0.0.1:954 The non-TLS browser would address http://www.stunnel.org:954/ and receive the page from https://www.stunnel.org:443/. According to Wikipedia, 954 is not assigned. The browser would continue to receive the page http://www.website.org/ without involvement of stunnel or iptables. Plausible? Thanks, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Versions
by Editor 04 Jan '18

04 Jan '18

Hi: On the various repo sites for Redhat-CentOS-Oracle Linux, etc., they are only providing version 4.29 of stunnel. Is there anyway to push them an updated version? I normally use these repo providers: Oracle Linux repo EPEL 6 Repo rpmforce Repo In the end, I tried to compile the latest version on Linux but I get this somewhat cryptic message about a TLS installation directory. I never had this issue before but to be honest, I normally used Solaris (8-9-10) in the past. "Could not find your TLS library installation dir Use --with-ssl option to fix this problem" I tried pointing it at /usr/bin/openssl and also at /usr/lib64/openssl without any luck. Sorry for bothering the list if this has been answered in the past. Thanks. Kevin

2 1

Re: [stunnel-users] outgoing mail solution?
by Parker Brooks 02 Jan '18

02 Jan '18

Douglas, it worked! Thank you! I had not turned on gmail's allow less secure apps, so my first try netted this 2018.01.02 09:00:27 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.01.02 09:00:27 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.01.02 09:00:27 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.01.02 09:00:27 LOG5[main]: Reading configuration from file stunnel.conf 2018.01.02 09:00:27 LOG5[main]: UTF-8 byte order mark not detected 2018.01.02 09:00:27 LOG5[main]: FIPS mode disabled 2018.01.02 09:00:27 LOG5[main]: Configuration successful 2018.01.02 09:03:09 LOG5[0]: Service [gmail-smtp] accepted connection from 127.0.0.1:1046 2018.01.02 09:03:09 LOG5[0]: s_connect: connected 173.194.78.108:587 2018.01.02 09:03:09 LOG5[0]: Service [gmail-smtp] connected remote server from 192.168.1.103:1047 2018.01.02 09:03:09 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/gsr2" 2018.01.02 09:03:10 LOG5[0]: s_connect: connected 172.217.12.78:80 2018.01.02 09:03:10 LOG5[0]: OCSP: Certificate accepted 2018.01.02 09:03:10 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/GTSGIAG3" 2018.01.02 09:03:10 LOG5[0]: s_connect: connected 172.217.12.78:80 2018.01.02 09:03:10 LOG5[0]: OCSP: Certificate accepted 2018.01.02 09:03:10 LOG5[0]: Certificate accepted at depth=0: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com 2018.01.02 09:03:10 LOG3[0]: PLAIN Authentication Failed 2018.01.02 09:03:10 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket my monitoring s/w showed To = xxxxxx(a)gmail.com Connecting to mail server... 127.0.0.1 E-mail Failed. Error: 25058 / [10057] Socket is not connected 1/2/2018 9:03:10 AM there was a security alert from gmail with the instructions to enabling the less secure apps. turned it on and tried again... 2018.01.02 09:17:45 LOG5[1]: Service [gmail-smtp] accepted connection from 127.0.0.1:1050 2018.01.02 09:17:45 LOG5[1]: s_connect: connected 173.194.78.109:587 2018.01.02 09:17:45 LOG5[1]: Service [gmail-smtp] connected remote server from 192.168.1.103:1051 2018.01.02 09:17:47 LOG5[1]: Connection closed: 306 byte(s) sent to TLS, 508 byte(s) sent to socket again, thank you! On Tue, Jan 2, 2018 at 7:35 AM, Harris, Douglas (SSC/SPC) < douglas.harris(a)canada.ca> wrote: > Try this… > > > > [gmail-smtp] > > client = yes > > accept = 127.0.0.1:25 > > connect = smtp.gmail.com:587 <http://smtp.gmail.com:465> > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = smtp.gmail.com > > OCSPaia = yes > > protocol = smtp > > protocolUsername = [your gmail userid] > > protocolPassword = [your gmail password] > > > > > > > > > > *From:* stunnel-users [mailto:stunnel-users-bounces@stunnel.org] *On > Behalf Of *Parker Brooks > *Sent:* January 2, 2018 12:34 AM > *To:* stunnel-users(a)stunnel.org > *Subject:* [stunnel-users] outgoing mail solution? > > > > hello and happy new year! > > > > it seemed this question has been asked before in various ways, however > with the frequent version updates i'm still unclear if stunnel is meant as > a fix to my issue. > > > > i have a outdated home monitoring program running on a winxp box. when an > error occurs it sends an email. it's setup screen (besides the destination > email field) only have a) smtp server, b) undeliverable email address and > c) port # fields to configure. > > > > my workaround for several years (when port 25 became blocked or needed > authetication) has been to use LOApost but they've recently ceased. that > program, also running in the background, and if i understand correctly > acted as a local host. i configured the monitoring program's smtp for > 127.0.0.1 and LOApost did the rest > > > > other searches suggest cloud solutions like sendgrid and authsmtp. but > those sites need a login/ password with the outgoing message. perhaps this > is where i'm getting confused between the differences of SSL and smtp > authentication? > > > > i have gotten gsuite's restricted smtp server to work, but i hoped stunnel > would provide a better solution (ability to send besides gmail/ gsuite > addresses). > > > > below are my conf and log files of my attempt. again, i can't tell if i've > missed a step, or if this is not intended to work. > > > > PS: i've also tried to understand if this feature is on the todo list? > > tia, > > parker > > > > stunnel.conf > > > > [gmail-pop3] > > client = yes > > accept = 127.0.0.1:110 > > connect = pop.gmail.com:995 > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = pop.gmail.com > > OCSPaia = yes > > > > [gmail-imap] > > client = yes > > accept = 127.0.0.1:143 > > connect = imap.gmail.com:993 > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = imap.gmail.com > > OCSPaia = yes > > > > [gmail-smtp] > > client = yes > > accept = 127.0.0.1:25 > > connect = smtp.gmail.com:465 > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = smtp.gmail.com > > OCSPaia = yes > > > > log file > > > > 2017.12.31 16:22:45 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform > > 2017.12.31 16:22:45 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips > 2 Nov 2017 > > 2017.12.31 16:22:45 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 > TLS:ENGINE,FIPS,OCSP,PSK,SNI > > 2017.12.31 16:22:45 LOG5[main]: Reading configuration from file > stunnel.conf > > 2017.12.31 16:22:45 LOG5[main]: UTF-8 byte order mark not detected > > 2017.12.31 16:22:45 LOG5[main]: FIPS mode disabled > > 2017.12.31 16:22:45 LOG5[main]: Configuration successful > > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] accepted connection from > 127.0.0.1:1141 > > 2017.12.31 16:25:03 LOG5[0]: s_connect: connected 173.194.67.108:465 > > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] connected remote server > from 192.168.1.103:1142 > > 2017.12.31 16:25:03 LOG5[0]: OCSP: Connecting the AIA responder " > http://ocsp.pki.goog/gsr2" > > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > > 2017.12.31 16:25:04 LOG5[0]: OCSP: Connecting the AIA responder " > http://ocsp.pki.goog/GTSGIAG3" > > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > > 2017.12.31 16:25:04 LOG5[0]: Certificate accepted at depth=0: C=US, > ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com > > 2017.12.31 16:25:04 LOG5[0]: Connection closed: 55 byte(s) sent to TLS, > 514 byte(s) sent to socket > > > > > > and this is what shows up on my monitoring program log file... > > > > To = xxxxxx(a)gmail.com > > Connecting to mail server... 127.0.0.1 > > Sending message... > > E-mail Failed. Error: 20162 / 530 5.5.1 https://support.google.com/ > mail/?p=WantAuthError 51sm9558225oti.10 - gsmtp > > 12/31/2017 4:25:04 PM >

1 0

Re: [stunnel-users] outgoing mail solution?
by Josealf.rm 02 Jan '18

02 Jan '18

Cool! I was not aware that stunnel fully supported SMTP authentication. Thanks Parker! Saludos Jose Alfredo Diaz > On Jan 2, 2018, at 8:35 AM, Harris, Douglas (SSC/SPC) <douglas.harris(a)canada.ca> wrote: > > Try this… > > [gmail-smtp] > client = yes > accept = 127.0.0.1:25 > connect = smtp.gmail.com:587 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = smtp.gmail.com > OCSPaia = yes > protocol = smtp > protocolUsername = [your gmail userid] > protocolPassword = [your gmail password] > > > > > From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Parker Brooks > Sent: January 2, 2018 12:34 AM > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] outgoing mail solution? > > hello and happy new year! > > it seemed this question has been asked before in various ways, however with the frequent version updates i'm still unclear if stunnel is meant as a fix to my issue. > > i have a outdated home monitoring program running on a winxp box. when an error occurs it sends an email. it's setup screen (besides the destination email field) only have a) smtp server, b) undeliverable email address and c) port # fields to configure. > > my workaround for several years (when port 25 became blocked or needed authetication) has been to use LOApost but they've recently ceased. that program, also running in the background, and if i understand correctly acted as a local host. i configured the monitoring program's smtp for 127.0.0.1 and LOApost did the rest > > other searches suggest cloud solutions like sendgrid and authsmtp. but those sites need a login/ password with the outgoing message. perhaps this is where i'm getting confused between the differences of SSL and smtp authentication? > > i have gotten gsuite's restricted smtp server to work, but i hoped stunnel would provide a better solution (ability to send besides gmail/ gsuite addresses). > > below are my conf and log files of my attempt. again, i can't tell if i've missed a step, or if this is not intended to work. > > PS: i've also tried to understand if this feature is on the todo list? > tia, > parker > > stunnel.conf > > [gmail-pop3] > client = yes > accept = 127.0.0.1:110 > connect = pop.gmail.com:995 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = pop.gmail.com > OCSPaia = yes > > [gmail-imap] > client = yes > accept = 127.0.0.1:143 > connect = imap.gmail.com:993 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = imap.gmail.com > OCSPaia = yes > > [gmail-smtp] > client = yes > accept = 127.0.0.1:25 > connect = smtp.gmail.com:465 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = smtp.gmail.com > OCSPaia = yes > > log file > > 2017.12.31 16:22:45 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform > 2017.12.31 16:22:45 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 > 2017.12.31 16:22:45 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI > 2017.12.31 16:22:45 LOG5[main]: Reading configuration from file stunnel.conf > 2017.12.31 16:22:45 LOG5[main]: UTF-8 byte order mark not detected > 2017.12.31 16:22:45 LOG5[main]: FIPS mode disabled > 2017.12.31 16:22:45 LOG5[main]: Configuration successful > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] accepted connection from 127.0.0.1:1141 > 2017.12.31 16:25:03 LOG5[0]: s_connect: connected 173.194.67.108:465 > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] connected remote server from 192.168.1.103:1142 > 2017.12.31 16:25:03 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gsr2" > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > 2017.12.31 16:25:04 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/GTSGIAG3" > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > 2017.12.31 16:25:04 LOG5[0]: Certificate accepted at depth=0: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com > 2017.12.31 16:25:04 LOG5[0]: Connection closed: 55 byte(s) sent to TLS, 514 byte(s) sent to socket > > > and this is what shows up on my monitoring program log file... > > To = xxxxxx(a)gmail.com > Connecting to mail server... 127.0.0.1 > Sending message... > E-mail Failed. Error: 20162 / 530 5.5.1 https://support.google.com/mail/?p=WantAuthError 51sm9558225oti.10 - gsmtp > 12/31/2017 4:25:04 PM > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

outgoing mail solution?
by Parker Brooks 02 Jan '18

02 Jan '18

hello and happy new year! it seemed this question has been asked before in various ways, however with the frequent version updates i'm still unclear if stunnel is meant as a fix to my issue. i have a outdated home monitoring program running on a winxp box. when an error occurs it sends an email. it's setup screen (besides the destination email field) only have a) smtp server, b) undeliverable email address and c) port # fields to configure. my workaround for several years (when port 25 became blocked or needed authetication) has been to use LOApost but they've recently ceased. that program, also running in the background, and if i understand correctly acted as a local host. i configured the monitoring program's smtp for 127.0.0.1 and LOApost did the rest other searches suggest cloud solutions like sendgrid and authsmtp. but those sites need a login/ password with the outgoing message. perhaps this is where i'm getting confused between the differences of SSL and smtp authentication? i have gotten gsuite's restricted smtp server to work, but i hoped stunnel would provide a better solution (ability to send besides gmail/ gsuite addresses). below are my conf and log files of my attempt. again, i can't tell if i've missed a step, or if this is not intended to work. PS: i've also tried to understand if this feature is on the todo list? tia, parker stunnel.conf [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes log file 2017.12.31 16:22:45 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2017.12.31 16:22:45 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2017.12.31 16:22:45 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.12.31 16:22:45 LOG5[main]: Reading configuration from file stunnel.conf 2017.12.31 16:22:45 LOG5[main]: UTF-8 byte order mark not detected 2017.12.31 16:22:45 LOG5[main]: FIPS mode disabled 2017.12.31 16:22:45 LOG5[main]: Configuration successful 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] accepted connection from 127.0.0.1:1141 2017.12.31 16:25:03 LOG5[0]: s_connect: connected 173.194.67.108:465 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] connected remote server from 192.168.1.103:1142 2017.12.31 16:25:03 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/gsr2" 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted 2017.12.31 16:25:04 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/GTSGIAG3" 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted 2017.12.31 16:25:04 LOG5[0]: Certificate accepted at depth=0: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com 2017.12.31 16:25:04 LOG5[0]: Connection closed: 55 byte(s) sent to TLS, 514 byte(s) sent to socket and this is what shows up on my monitoring program log file... To = xxxxxx(a)gmail.com Connecting to mail server... 127.0.0.1 Sending message... E-mail Failed. Error: 20162 / 530 5.5.1 https://support.google.com/ mail/?p=WantAuthError 51sm9558225oti.10 - gsmtp 12/31/2017 4:25:04 PM

3 2

Updating stunnel 5.43 to 5.44 fails on Win7prof(32)
by tagtraeumer 15 Dec '17

15 Dec '17

Hello, removing compression = zlib did fix the starting issue for v5.44, update worked, thanks. Is 'deflate' affected too? Is compression recommended at this stage of mail processing? Thanks once more, regards! > Hello, > The compression is not recommended with TLS because of the CRIME or > BREACH attacks. > From stunnel v 5.44 in Windows the zlib compression is not supported. > So you should remove the option: > compression = zlib > > If you want to use this compression, please place the file zlib1.dll > (from the previous version) in the stunnel / bin directory. > > Best regards, > Malgorzata

1 0

Updating stunnel 5.43 to 5.44 fails on Win7prof(32)
by tagtraeumer 14 Dec '17

14 Dec '17

Hello, I did try updating stunnel 5.43 to 5.44 on a Win7prof (32bit) system, but it fails... Log before update (v5.43): 2017.12.14 20:46:39 LOG5[main]: stunnel 5.43 on x86-pc-msvc-1500 platform 2017.12.14 20:46:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2017.12.14 20:46:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.12.14 20:46:39 LOG5[main]: Reading configuration from file stunnel.conf 2017.12.14 20:46:39 LOG5[main]: UTF-8 byte order mark detected 2017.12.14 20:46:39 LOG6[main]: UI not supported by engine #1 (capi) 2017.12.14 20:46:39 LOG6[main]: Engine #1 (capi) initialized 2017.12.14 20:46:39 LOG5[main]: FIPS mode disabled 2017.12.14 20:46:39 LOG6[main]: Compression enabled: 2 method(s) 2017.12.14 20:46:39 LOG6[main]: Initializing service [HostEurope_SMTPs] 2017.12.14 20:46:39 LOG6[main]: Loading certificate from file: stunnel.pem 2017.12.14 20:46:39 LOG6[main]: Certificate loaded from file: stunnel.pem 2017.12.14 20:46:39 LOG6[main]: Loading private key from file: stunnel.pem 2017.12.14 20:46:39 LOG6[main]: Private key loaded from file: stunnel.pem 2017.12.14 20:46:39 LOG4[main]: Service [HostEurope_SMTPs] uses "verifyChain" without subject checks 2017.12.14 20:46:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2017.12.14 20:46:39 LOG5[main]: Configuration successful Log after 5.44 update: Pls refer to screenshot at: https://imgur.com/hCOKES7 "Invalid configuration file" errno: (*_errno()) stunnel.conf:65: ["name"]: Failed to initialize TLS How to solve this issue? Thx + regards!

1 0