stunnel-users January 2018

stunnel-users@stunnel.org

13 participants
24 discussions

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

2 1

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Well, I'm stunned (pun intended): while the output= wasn't accepted (it said it wasn't valid there), changing 127.0.0.1 to localhost seems to have fixed it! -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 12:20 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > Here's my stunnel.conf, with blank lines and comments removed: > client = yes > output = C:\temp\stunnel-log.txt > taskbar = yes > debug = 7 > [POP3 Incoming] > protocol = pop3 > accept = 127.0.0.1:1110 > connect = pop.cox.net:995 > protocol = smtp > accept = 127.0.0.1:25 > connect = smtp.cox.net:465 Here it worked for POP3 immediately. Not needed for SMTP. https://en.wikibooks.org/wiki/Oberon/Oberon#Receiving_and_Sending_Email Before using 1110, check. netstat -tulpn | grep 1110 Correct id, passwd and port are in the MUA? Separate configurations for POP3 and SMTP. Troubleshoot one at a time. "protocol" shouldn't be necessary. Try this. [POP3] client = yes output = C:\temp\stunnel-log.txt accept = localhost:1110 connect = pop.cox.net:995 Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: Andrew Culver <aculver(a)uwo.ca> Date: Thu, 18 Jan 2018 11:39:20 -0500 > Some protocols use a protocol-specific command to begin TLS negotiation > (STARTTLS for SMTP and POP3), so stunnel needs to know how (and be told) to > use that command. Phil, General troubleshooting rule, always try for a most elementary, ordinary case before resorting to a special case. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

P.s. From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > protocol = pop3 The stunnel(8) manual has this. "protocol = PROTO application protocol to negotiate TLS This option enables initial, protocol-specific negotiation of the TLS encryption." Is there any need for protocol-specific negotiation? Why? Stunnel provides a tunnel and POP3 works inside. That's all. Try the configuration without the protocol option. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

2 1

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Right, I had done that: >Yes, I have protocol = pop3 and protocol = smtp; I’ve tried >commenting them out individually, no change that I can see. The doc really isn't clear about why you'd want/need these, by the way. But your earlier suggestion (localhost instead of 127.0.0.1) seems to have worked. Still a mystery. I'll be tinkering on machine2 tonight, and then will try on the wife's machine! -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 9:51 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7 P.s. From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > protocol = pop3 The stunnel(8) manual has this. "protocol = PROTO application protocol to negotiate TLS This option enables initial, protocol-specific negotiation of the TLS encryption." Is there any need for protocol-specific negotiation? Why? Stunnel provides a tunnel and POP3 works inside. That's all. Try the configuration without the protocol option. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > Here's my stunnel.conf, with blank lines and comments removed: > client = yes > output = C:\temp\stunnel-log.txt > taskbar = yes > debug = 7 > [POP3 Incoming] > protocol = pop3 > accept = 127.0.0.1:1110 > connect = pop.cox.net:995 > protocol = smtp > accept = 127.0.0.1:25 > connect = smtp.cox.net:465 Here it worked for POP3 immediately. Not needed for SMTP. https://en.wikibooks.org/wiki/Oberon/Oberon#Receiving_and_Sending_Email Before using 1110, check. netstat -tulpn | grep 1110 Correct id, passwd and port are in the MUA? Separate configurations for POP3 and SMTP. Troubleshoot one at a time. "protocol" shouldn't be necessary. Try this. [POP3] client = yes output = C:\temp\stunnel-log.txt accept = localhost:1110 connect = pop.cox.net:995 Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Cox has been warning us that as of next week, we need to use encrypted POP and SMTP. I have two reasons to use stunnel now: 1) I use the K9 Bayesian email proxy for spam filtering, and it doesn't do TLS 2) My wife still uses Eudora and doesn't want to switch, and while Eudora allegedly supports TLS, it's not trivial to make it work (and Cox certainly won't help) Thus stunnel looks like an ideal solution. But after tinkering for a few hours on two machines, I'm stumped. While I can type an SMTP or POP transaction in my sleep, I'm not so good at typing a TLS handshake, so I'm using Outlook 2013 as my test platform (and that's what I'll be using myself later anyway). I setup a new account, point to the right ports on 127.0.0.1, and the test times out, with: Log onto incoming mail server (POP3): The operation timed out waiting for a response from the receiving (POP) server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP). Send test e-mail message: The operation timed out waiting for a response from the sending (SMTP) server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP). Here's my stunnel.conf, with blank lines and comments removed: client = yes output = C:\temp\stunnel-log.txt taskbar = yes debug = 7 [POP3 Incoming] protocol = pop3 accept = 127.0.0.1:1110 connect = pop.cox.net:995 protocol = smtp accept = 127.0.0.1:25 connect = smtp.cox.net:465 Yes, that's port 1110, since K9 is using 110. Shouldn't matter, right? (As long as I point the client at 1110, obviously!) Yes, I have protocol = pop3 and protocol = smtp; I've tried commenting them out individually, no change that I can see. Yes, I'm running stunnel explicitly, not as a service-I found threads suggesting that it just doesn't work as a service on Windows 7 for some reason (and in fact beat my head against that wall for a while first). And here's the stunnel log: 2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1 2018.01.17 21:29:24 LOG7[main]: No limit detected for the number of clients 2018.01.17 21:29:24 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.01.17 21:29:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.01.17 21:29:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.01.17 21:29:24 LOG7[main]: errno: (*_errno()) 2018.01.17 21:29:24 LOG7[ui]: GUI message loop initialized 2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1 2018.01.17 21:29:24 LOG5[main]: Reading configuration from file stunnel.conf 2018.01.17 21:29:24 LOG5[main]: UTF-8 byte order mark not detected 2018.01.17 21:29:24 LOG5[main]: FIPS mode disabled 2018.01.17 21:29:24 LOG7[main]: Compression disabled 2018.01.17 21:29:24 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2018.01.17 21:29:24 LOG7[main]: Wrote 0 new random bytes to C:/.rnd 2018.01.17 21:29:24 LOG7[main]: PRNG seeded successfully 2018.01.17 21:29:24 LOG6[main]: Initializing service [POP3 Incoming] 2018.01.17 21:29:24 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.01.17 21:29:24 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2018.01.17 21:29:24 LOG7[main]: No certificate or private key specified 2018.01.17 21:29:24 LOG4[main]: Service [POP3 Incoming] needs authentication to prevent MITM attacks 2018.01.17 21:29:24 LOG5[main]: Configuration successful 2018.01.17 21:29:24 LOG7[main]: Binding service [POP3 Incoming] 2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=460) 2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=460) bound to 127.0.0.1:1110 2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=464) 2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=464) bound to 127.0.0.1:25 2018.01.17 21:29:24 LOG7[cron]: Cron thread initialized 2018.01.17 21:29:50 LOG7[main]: Found 1 ready file descriptor(s) 2018.01.17 21:29:50 LOG7[main]: FD=424 ifds=r-x ofds=--- 2018.01.17 21:29:50 LOG7[main]: FD=460 ifds=r-x ofds=r-- 2018.01.17 21:29:50 LOG7[main]: Service [POP3 Incoming] accepted (FD=488) from 127.0.0.1:54855 2018.01.17 21:29:50 LOG7[main]: Creating a new thread 2018.01.17 21:29:50 LOG7[main]: New thread created 2018.01.17 21:29:50 LOG7[0]: Service [POP3 Incoming] started 2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on local socket 2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] accepted connection from 127.0.0.1:54855 2018.01.17 21:29:50 LOG6[0]: failover: round-robin, starting at entry #1 2018.01.17 21:29:50 LOG6[0]: s_connect: connecting 68.6.19.8:465 2018.01.17 21:29:50 LOG7[0]: s_connect: s_poll_wait 68.6.19.8:465: waiting 10 seconds 2018.01.17 21:29:50 LOG5[0]: s_connect: connected 68.6.19.8:465 2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] connected remote server from 192.168.1.17:54856 2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.01.17 21:29:50 LOG7[0]: Remote descriptor (FD=508) initialized 2018.01.17 21:30:24 LOG6[cron]: Executing cron jobs 2018.01.17 21:30:24 LOG6[cron]: Cron jobs completed in 0 seconds 2018.01.17 21:30:24 LOG7[cron]: Waiting 86400 seconds 2018.01.17 21:31:05 LOG7[main]: Found 1 ready file descriptor(s) 2018.01.17 21:31:05 LOG7[main]: FD=424 ifds=r-x ofds=--- 2018.01.17 21:31:05 LOG7[main]: FD=460 ifds=r-x ofds=--- 2018.01.17 21:31:05 LOG7[main]: Service [POP3 Incoming] accepted (FD=528) from 127.0.0.1:54891 2018.01.17 21:31:05 LOG7[main]: Creating a new thread 2018.01.17 21:31:05 LOG7[main]: New thread created 2018.01.17 21:31:05 LOG7[1]: Service [POP3 Incoming] started 2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on local socket 2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] accepted connection from 127.0.0.1:54891 2018.01.17 21:31:05 LOG6[1]: failover: round-robin, starting at entry #0 2018.01.17 21:31:05 LOG6[1]: s_connect: connecting 146.20.147.245:995 2018.01.17 21:31:05 LOG7[1]: s_connect: s_poll_wait 146.20.147.245:995: waiting 10 seconds 2018.01.17 21:31:05 LOG5[1]: s_connect: connected 146.20.147.245:995 2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] connected remote server from 192.168.1.17:54892 2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on remote socket 2018.01.17 21:31:05 LOG7[1]: Remote descriptor (FD=336) initialized 2018.01.17 21:34:05 LOG3[1]: Unexpected socket close (s_read) 2018.01.17 21:34:05 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.01.17 21:34:05 LOG7[1]: Remote descriptor (FD=336) closed 2018.01.17 21:34:05 LOG7[1]: Local descriptor (FD=528) closed 2018.01.17 21:34:05 LOG7[1]: Service [POP3 Incoming] finished (1 left) 2018.01.17 21:34:05 LOG7[1]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2018.01.17 21:34:05 LOG7[1]: str_stats: 32 byte(s) at ..\src\network.c:680 2018.01.17 21:34:50 LOG6[0]: s_read: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2018.01.17 21:34:50 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.01.17 21:34:50 LOG7[0]: Remote descriptor (FD=508) closed 2018.01.17 21:34:50 LOG7[0]: Local descriptor (FD=488) closed 2018.01.17 21:34:50 LOG7[0]: Service [POP3 Incoming] finished (0 left) 2018.01.17 21:34:50 LOG7[0]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2018.01.17 21:34:50 LOG7[0]: str_stats: 32 byte(s) at ..\src\network.c:680 It looks like it connects, but then just sits there?! I see these: No certificate or private key specified Service [POP3 Incoming] needs authentication to prevent MITM attacks but that's during startup. Or are those significant? I feel like I'm one setting away from having this all work.! Thanks in advance for any suggestions. -- ...phsiii

1 0

TLS socket closed (SSL_write) with unsent byte(s)
by Cotswold Group - Stephen Murray 16 Jan '18

16 Jan '18

Hi All, We use stunnel to send emails from our scanners to our hosted mail provider (that now only accept TLS connections). This has been working well for a number of years, but just recently the scanners (all Lexmark) have sporadically been giving errors of 'connection failed'. If I check the stunnel logs, the failed send has an extra line in of TLS socket closed (SSL_write) with 418 unsent byte(s) Below are 2 examples, 59 was sent successfully, 60 was not. 2018.01.16 14:37:24 LOG5[59]: Service [fasthosts-smtp] accepted connection from 10.226.174.95:11473 2018.01.16 14:37:24 LOG5[59]: s_connect: connected 213.171.216.50:465 2018.01.16 14:37:24 LOG5[59]: Service [fasthosts-smtp] connected remote server from 10.226.150.9:52577 2018.01.16 14:37:24 LOG5[59]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.01.16 14:37:24 LOG5[59]: s_connect: connected 23.55.155.27:80 2018.01.16 14:37:24 LOG5[59]: OCSP: Certificate accepted 2018.01.16 14:37:24 LOG5[59]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.01.16 14:37:25 LOG5[59]: s_connect: connected 23.55.155.27:80 2018.01.16 14:37:25 LOG5[59]: OCSP: Certificate accepted 2018.01.16 14:37:25 LOG5[59]: Certificate accepted at depth=0: C=GB, ST=Gloucestershire, L=Gloucester, O=Fasthosts Internet Limited, OU=NOC, CN=smtp.livemail.co.uk 2018.01.16 14:37:29 LOG5[59]: Connection closed: 167106 byte(s) sent to TLS, 376 byte(s) sent to socket 2018.01.16 14:38:19 LOG5[60]: Service [fasthosts-smtp] accepted connection from 10.226.174.95:11483 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 213.171.216.50:465 2018.01.16 14:38:19 LOG5[60]: Service [fasthosts-smtp] connected remote server from 10.226.150.9:52620 2018.01.16 14:38:19 LOG5[60]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 23.55.155.27:80 2018.01.16 14:38:19 LOG5[60]: OCSP: Certificate accepted 2018.01.16 14:38:19 LOG5[60]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 23.55.155.27:80 2018.01.16 14:38:19 LOG5[60]: OCSP: Certificate accepted 2018.01.16 14:38:19 LOG5[60]: Certificate accepted at depth=0: C=GB, ST=Gloucestershire, L=Gloucester, O=Fasthosts Internet Limited, OU=NOC, CN=smtp.livemail.co.uk 2018.01.16 14:38:24 LOG3[60]: TLS socket closed (SSL_write) with 418 unsent byte(s) 2018.01.16 14:38:24 LOG5[60]: Connection reset: 964 byte(s) sent to TLS, 392 byte(s) sent to socket Has anyone come across this before? Our mail provider has send limits in place of 50 every 10 minutes, but I am confident we are not reaching those amounts. Any help appreciated. Regards, Stephen

1 0

Connecting a HTTP browser to a HTTPS server.
by peter＠easthope.ca 12 Jan '18

12 Jan '18

Hello, I'm interested to configure stunnel to allow my local non-TLS Web browser to receive pages from a remote server providing only HTTPS. This section of https://www.stunnel.org/static/stunnel.html appears relevant. transparent = none | source | destination | both (Unix only) enable transparent proxy support on selected platforms ... destination The original destination is used instead of the connect option. A service section for transparent destination may look like this: [transparent] client = yes accept = <stunnel_port> transparent = destination This configuration requires iptables setup to work, possibly in /etc/rc.local or equivalent file. ... For a connect target installed on a remote host: /sbin/iptables -I INPUT -i eth0 -p tcp --dport <stunnel_port> -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport <redirected_port> \ -i eth0 -j DNAT --to-destination <local_ip>:<stunnel_port> The transparent destination option is currently only supported on Linux. ==================================== Substitution of parameters for my context gives these configurations.. [transparent] client = yes accept = 127.0.0.1:954 transparent = destination /sbin/iptables -I INPUT -i eth0 -p tcp --dport 954 -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport 443 \ -i eth0 -j DNAT --to-destination 127.0.0.1:954 The non-TLS browser would address http://www.stunnel.org:954/ and receive the page from https://www.stunnel.org:443/. According to Wikipedia, 954 is not assigned. The browser would continue to receive the page http://www.website.org/ without involvement of stunnel or iptables. Plausible? Thanks, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users January 2018