- stunnel-users - stunnel.org

stunnel server communicating external client IP addresses through to a TCP server for logging purposes
by Simner, John 17 Oct '13

17 Oct '13

Hi, We have recently used stunnel on the phone as a server to encrypt the communication between an external client and a TCP server on the phone. There is a requirement for the phone to log every external client access. Is there any way for stunnel to include the IP address of the external client when setting up an new TCP connection to the local TCP server? Thank you for your assistance and I look forward to your responses. Thanks.. John John Simner BSc(Hons) MSc CEng. MIET Software Engineer Unify Enterprise Communications Ltd. Devices Development K Block, Technology Drive, Beeston, Nottingham, NG9 1LA Tel.: +44 (0) 19088 17378 Email: john.simner(a)unify.com <mailto:vorname.name@unify.com> www.unify.co.uk<http://www.unify.co.uk/> Follow us: [Social_media_icons] <http://www.unify.com/social-media> Unify Enterprise Communications Limited. Registered Office: Brickhill Street, Willen Lake, Milton Keynes, MK15 0DJ Registered No: 5903714, England. This email contains confidential information and is for the exclusive use of the addressee. If you are not the addressee then any distribution, copying, or use of this email is prohibited. If received in error, please advise the sender and delete immediately. We accept no liability for any loss or damage suffered by any person arising from use of this email.

2 1

How to get the remote mail server certificate before/at first connect?
by Ben Stover 17 Oct '13

17 Oct '13

When I connect from my local mail client (e.g. Thunderbird) the first time (!) with a remote mail server through STARTTLS for a SMTP session then at first a server certificate is delivered. On the Thunderbird email client side a popup appears which prompts me to confirm the remote server certificate. Only AFTER this confirmation I am able to send email through this STARTTLS SMTP connection. Ok. Now lets switch to another scenario where a non-default email client (=NOT Thunderbird) want to send emails through stunnel to the remote mail server. Everything is setup in stunnel.conf and propriatary email client. But how do I get the remote server certificate (for stunnel)? Is there an option in stunnel.conf to receive and auto-accept the delivered server certificate at first? Where is it stored? Can I extract certificate from Thunderbird and import it to stunnel? Ben

2 1

Re: [stunnel-users] EXTERNAL: How to setup stunnel für SMTP over STARTTL S (and not pure SSL)?
by Bucci, David G 16 Oct '13

16 Oct '13

The protocol directive determines what Stunnel does during the connection setup. "protocol = smtp" tells Stunnel to use STARTTLS semantics for the connection to the server, as described in RFC2487 (similarly to how "protocol = imap" tells it to use STARTTLS for IMAP, per RFC 2595). -----Original Message----- From: Ben Stover [mailto:bxstover@yahoo.co.uk] Sent: Wednesday, October 16, 2013 11:08 AM To: Stunnel Users Cc: Bucci, David G Subject: RE: EXTERNAL: How to setup stunnel für SMTP over STARTTL S (and not pure SSL)? Sorry, I went to the webpage with the link you mentioned. There I searched for STARTTLS but NO (!) occurence was found. What does protocol (here = smtp) to do with the security handshare type (here = STARTTLS). On Wed, 16 Oct 2013 13:10:29 +0000, Bucci, David G wrote: >Oh, meant to add - look at the "protocol" option, documented here: http://www.stunnel.org/static/stunnel.html >-----Original Message----- >From: Bucci, David G >Sent: Wednesday, October 16, 2013 8:54 AM >To: 'Ben Stover'; Stunnel Users >Subject: RE: EXTERNAL: How to setup stunnel für SMTP over STARTTLS (and not pure SSL)? >https://www.stunnel.org/pipermail/stunnel-users/2011-April/003060.html >Yes, it's supported. (you'll get a cert error on that connect, ironically) >-----Original Message----- >From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Ben Stover >Sent: Wednesday, October 16, 2013 5:56 AM >To: Stunnel Users >Subject: EXTERNAL: How to setup stunnel für SMTP over STARTTLS (and not pure SSL)? >Assume my mailbox provider offers only SMTP delivery over STARTTLS (and not pure SSL). >How do I have configure stunnel to cope with this protocol? >Lets say the remote smtp server would be >smtp.foobar.com:587 >How would a service section in conf file look like? >Thank you >Ben >_______________________________________________ >stunnel-users mailing list >stunnel-users(a)stunnel.org >https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] EXTERNAL: How to setup stunnel für SMTP over STARTTL S (and not pure SSL)?
by Michal Trojnara 16 Oct '13

16 Oct '13

On 10/16/2013 05:07 PM, Ben Stover wrote: > Sorry, I went to the webpage with the link you mentioned. > There I searched for STARTTLS but NO (!) occurence was found. This is because STARTTLS is not a separate protocol, but rather an option (usually an extension) of various protocols that can negotiate SSL/TLS encryption. http://en.wikipedia.org/wiki/STARTTLS Mike

2 1

Re: [stunnel-users] EXTERNAL: How to setup stunnel für SMTP over STARTTLS (and not pure SSL)?
by Bucci, David G 16 Oct '13

16 Oct '13

https://www.stunnel.org/pipermail/stunnel-users/2011-April/003060.html Yes, it's supported. (you'll get a cert error on that connect, ironically) -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Ben Stover Sent: Wednesday, October 16, 2013 5:56 AM To: Stunnel Users Subject: EXTERNAL: How to setup stunnel für SMTP over STARTTLS (and not pure SSL)? Assume my mailbox provider offers only SMTP delivery over STARTTLS (and not pure SSL). How do I have configure stunnel to cope with this protocol? Lets say the remote smtp server would be smtp.foobar.com:587 How would a service section in conf file look like? Thank you Ben _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 1

Disable support for insecure SSLv2 protocol but allow for ONE service
by Ben Stover 16 Oct '13

16 Oct '13

When I try to connect to one of my mailboxes I get a return: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket What does that mean? in stunnel.conf I set the global parameter: options = NO_SSLv2 This works in general. But for the mentioned email provider it could mean that he allows only SSLv2. Is this the reason? Where is described what is inscure at SSLv2? How can I allow for that particular email provider SSLv2 but disallow for all others? Ben

4 3

Writing "hello" to log window when entering a certain service section?
by Ben Stover 15 Oct '13

15 Oct '13

Assume an (unknown) client on my computer connects through stunnel to a remote server. As soon as this local client connects local stunnel the stunnel should write a user specified string line to the log window (if possible in bold letters). Can I define this with a syntax similar to: [gmail-pop3] client = yes output = "hello outgoing alert gmail port 1109" accept = 127.0.0.1:1109 connect = pop.gmail.com:995 Thank you Peter

2 1

An issue with chroot, mail.pem and OmniOS/illumos (SunOS)
by Olaf Marzocchi 13 Oct '13

13 Oct '13

Dear all, I have been trying to set up stunnel to encrypt a SMTP connection. The config of the encryption should be fine, I used it already on another OS, but I cannot get stunnel to start on my home server, based on OmniOS (kernel illumos), identified as "SunOS". This is my config: ---- chroot = /opt/omni/var/lib/stunnel/ ; Chroot jail can be escaped if setuid option is not used setuid = nobody setgid = nogroup ;pid = /opt/omni/var/lib/stunnel/stunnel.pid ; Certificate/key is needed in server mode and optional in client mode cert = /opt/omni/etc/stunnel/mail.pem ;key = /opt/omni/etc/stunnel/mail.pem [smtp-tls-wrapper] accept = localhost:11125 client = yes connect = ssl0.ovh.net:465 ;delay = yes ---- and the directories mentioned have the following permissions: ---- OmniOS-Xeon:~ $ ls -al /opt/omni/etc/stunnel/ total 28 drwxr-xr-x 2 root bin 5 Sep 24 23:26 . drwxr-xr-x 5 root bin 6 Sep 23 23:53 .. -rw------- 1 root bin 3050 Sep 24 23:25 mail.pem -rw-r--r-- 1 stunnel stunnel 3247 Oct 13 22:56 stunnel.conf -rw-r--r-- 1 root bin 2997 Sep 23 23:53 stunnel.conf-sample OmniOS-Xeon:~ $ ls -al /opt/omni/var/lib/ total 9 drwxr-xr-x 3 root bin 3 Sep 23 23:53 . drwxr-xr-x 4 root bin 4 Sep 23 23:53 .. drwx------ 2 stunnel stunnel 2 Sep 23 23:53 stunnel ---- The service is started from the SMF facility provided by Solaris/OmniOS/... that launches as root/root the following: /opt/omni/bin/stunnel /opt/omni/etc/stunnel/stunnel.conf On execution I get the following error message: … Initializing service section [smtp-tls-wrapper] Certificate: /opt/omni/etc/stunnel/mail.pem Error reading certificate file: /opt/omni/etc/stunnel/mail.pem error queue: 140DC002: error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib error queue: 20074002: error:20074002:BIO routines:FILE_CTRL:system lib SSL_CTX_use_certificate_chain_file: 200100D: error:0200100D:system library:fopen:Permission denied str_stats: 9 block(s), 1032 data byte(s), 522 control byte(s) … I must be overlooking something but I cannot see my mistake. Could you please help me? Thank you very much in advance! Olaf Marzocchi

1 0

stunnel behind http proxy server, only working for port 443
by Heng Su 09 Oct '13

09 Oct '13

Hi All, I try to connect to my stunnel server, however, only port 443 is working. For other ports are not working. Does it mean my company's proxy server is blocking SSL communication on all ports except 443? ( I am a newbie, just assuming stunnel always working with SSL even for 80 port, if I am wrong please point me out, thank you) Is there any other way to bypass the proxy server without SSL communication? Or internal proxy server can always detect tunnel actions if there is non-SSL protocol ? below is my configuration file for client side. /etc/stunnel/stunnel.conf ------------------START-------------------------- [https1] accept = 80 protocol = connect protocolAuthentication = basic protocolHost = myvpsserver-ip:80 protocolUsername = myname protocolPassword = p@ssw0rd connect = company-proxyserver:8080 [https2] accept = 443 protocol = connect protocolAuthentication = basic protocolHost = myvpsserver-ip:443 protocolUsername = myname protocolPassword = p@ssw0rd connect = company-proxyserver:8080 ----------------------------END--------------------------------------------- ---------------------------Tunnel PORT 80 ----------------------------- 2013.10.08 14:18:43 LOG7[10601:3078687600]: TCP_NODELAY option set on remote socket 2013.10.08 14:18:43 LOG5[10601:3078687600]: Negotiations for connect (client side) started 2013.10.08 14:18:43 LOG7[10601:3078687600]: -> CONNECT my-remote-server-ip:80 HTTP/1.1 2013.10.08 14:18:43 LOG7[10601:3078687600]: -> Host: my-remote-server-ip:80 2013.10.08 14:18:43 LOG7[10601:3078687600]: -> Proxy-Authorization: basic c3VoZW5nOlBAc3N3MHJk 2013.10.08 14:18:43 LOG7[10601:3078687600]: -> 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- HTTP/1.1 403 Forbidden 2013.10.08 14:18:43 LOG3[10601:3078687600]: CONNECT request rejected 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- Cache-Control: no-cache 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- Pragma: no-cache 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- Content-Type: text/html; charset=utf-8 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- Proxy-Connection: close 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- Connection: close 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- Content-Length: 725 2013.10.08 14:18:43 LOG7[10601:3078687600]: <- 2013.10.08 14:18:43 LOG5[10601:3078687600]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket ---------------------------Tunnel PORT 443 ----------------------------- 2013.10.08 14:42:00 LOG7[10601:3078687600]: TCP_NODELAY option set on remote socket 2013.10.08 14:42:00 LOG5[10601:3078687600]: Negotiations for connect (client side) started 2013.10.08 14:42:00 LOG7[10601:3078687600]: -> CONNECT my-remote-server-ip:443 HTTP/1.1 2013.10.08 14:42:00 LOG7[10601:3078687600]: -> Host: my-remote-server-ip:443 2013.10.08 14:42:00 LOG7[10601:3078687600]: -> Proxy-Authorization: basic c3VoZW5nOlBAc3N3MHJk 2013.10.08 14:42:00 LOG7[10601:3078687600]: -> 2013.10.08 14:42:00 LOG7[10601:3078687600]: <- HTTP/1.1 200 Connection established 2013.10.08 14:42:00 LOG6[10601:3078687600]: CONNECT request accepted 2013.10.08 14:42:00 LOG7[10601:3078687600]: <- 2013.10.08 14:42:00 LOG5[10601:3078687600]: Protocol negotiations succeeded -- Thanks & Best Regards, Su Heng

2 2

Stunnel North American FTP Down?
by Thomas Eifert 07 Oct '13

07 Oct '13

This evening, I'm unable to access the North American Stunnel FTP site. If I go in with Filezilla in passive mode, I can do a directory listing, but the directory is empty. If I use the browser by clicking on the FTP link on the stunnel web page, I get an error 550 Failed to change directory. I was able to access the European site, however. Enjoy the day. -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 2