April 2018 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Stunnel & Gmail security
by BOXI31 TEST 16 Oct '20

16 Oct '20

Hi all, To make "Stunnel 5.31" work with Gmail, I have to go in security settings of Gmail and "allow less secure apps to access my account". Is it mandatory ? Is it possible to set Stunnel to access Gmail without lowering it security level ? How ? I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider it as a "less secure app." ! Regards, Steve

2 1

stunnel with client-auth via proxy-server
by jack.reacher＠gmx.de 16 May '18

16 May '18

2 1

SMTP Authentication failed
by Ian Coetzee 15 May '18

15 May '18

Hi List, I have just joined the stunnel community. I am in the process of migrating our mailserver's public facing ports to stunnel for PCI compliance reasons. So far i have managed to get working: - imap (143/tcp) with starttls - imaps (993/tcp) - pop3 (110/tcp) with starttls - pop3s (995/tcp) My trouble is with smtp(25/tcp,587/tcp) with starttls. I have now tried a couple different mail clients and everyone of them tells me that the server does not support the authentication protocols. I have installed stunnel 5.44. Tee relevant parts in my config: [mail2-imap] protocol = imap accept = 143 connect = <mail-fqdn>:143 [mail2-imaps] accept = 993 connect = <mail-fqdn>:143 [mail2-pop3] protocol = pop3 accept = 110 connect = <mail-fqdn>:110 [mail2-pop3s] accept = 995 connect = <mail-fqdn>:110 [mail2-smtp] protocol = smtp accept = 25 connect = <mail-fqdn>:25 [mail2-smtps] accept = 465 connect = <mail-fqdn>:465 [mail2-smtps-submission] debug = 7 protocol = smtp accept = 587 connect = <mail-fqdn>:587 In the logfile I have the following entries upon connecting 2018.04.30 09:20:50 LOG7[5]: Service [mail2-smtps-submission] started 2018.04.30 09:20:50 LOG7[5]: Option TCP_NODELAY set on local socket 2018.04.30 09:20:50 LOG5[5]: Service [mail2-smtps-submission] accepted connection from 41.13.8.49:56890 2018.04.30 09:20:50 LOG6[5]: s_connect: connecting 10.10.11.2:587 2018.04.30 09:20:50 LOG7[5]: s_connect: s_poll_wait 10.10.11.2:587: waiting 10 seconds 2018.04.30 09:20:50 LOG5[5]: s_connect: connected 10.10.11.2:587 2018.04.30 09:20:50 LOG5[5]: Service [mail2-smtps-submission] connected remote server from 10.10.11.11:42466 2018.04.30 09:20:50 LOG7[5]: Option TCP_NODELAY set on remote socket 2018.04.30 09:20:50 LOG7[5]: Remote descriptor (FD=23) initialized 2018.04.30 09:20:50 LOG7[5]: RFC 2487 detected 2018.04.30 09:20:50 LOG7[5]: <- 220 <mail-fqdn> ESMTP Postfix 2018.04.30 09:20:50 LOG7[5]: -> 220 <mail-fqdn> stunnel for ESMTP Postfix 2018.04.30 09:20:51 LOG7[5]: <- EHLO [100.125.153.220] 2018.04.30 09:20:51 LOG7[5]: -> 250-<mail-fqdn> 2018.04.30 09:20:51 LOG7[5]: -> 250 STARTTLS 2018.04.30 09:20:51 LOG7[5]: <- STARTTLS 2018.04.30 09:20:51 LOG7[5]: -> 220 Go ahead 2018.04.30 09:20:51 LOG6[5]: Peer certificate not required 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): before/accept initialization 2018.04.30 09:20:51 LOG7[5]: SNI: no virtual services defined 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 read client hello A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write server hello A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write certificate A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write key exchange A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write server done A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 flush data 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 read client certificate A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read client key exchange A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read certificate verify A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read finished A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 write change cipher spec A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 write finished A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 flush data 2018.04.30 09:20:52 LOG7[5]: New session callback 2018.04.30 09:20:52 LOG7[5]: 2 server accept(s) requested 2018.04.30 09:20:52 LOG7[5]: 2 server accept(s) succeeded 2018.04.30 09:20:52 LOG7[5]: 0 server renegotiation(s) requested 2018.04.30 09:20:52 LOG7[5]: 0 session reuse(s) 2018.04.30 09:20:52 LOG7[5]: 2 internal session cache item(s) 2018.04.30 09:20:52 LOG7[5]: 0 internal session cache fill-up(s) 2018.04.30 09:20:52 LOG7[5]: 0 internal session cache miss(es) 2018.04.30 09:20:52 LOG7[5]: 0 external session cache hit(s) 2018.04.30 09:20:52 LOG7[5]: 0 expired session(s) retrieved 2018.04.30 09:20:52 LOG6[5]: TLS accepted: new session negotiated 2018.04.30 09:20:52 LOG6[5]: No peer certificate received 2018.04.30 09:20:52 LOG6[5]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2018.04.30 09:20:52 LOG7[5]: Compression: null, expansion: null 2018.04.30 09:20:52 LOG6[5]: Read socket closed (read hangup) 2018.04.30 09:20:52 LOG7[5]: Sending close_notify alert 2018.04.30 09:20:52 LOG7[5]: TLS alert (write): warning: close notify 2018.04.30 09:20:52 LOG6[5]: SSL_shutdown successfully sent close_notify alert 2018.04.30 09:20:52 LOG6[5]: TLS fd: Connection reset by peer (104) 2018.04.30 09:20:52 LOG6[5]: TLS socket closed (SSL_read) 2018.04.30 09:20:52 LOG7[5]: Sent socket write shutdown 2018.04.30 09:20:52 LOG5[5]: Connection closed: 156 byte(s) sent to TLS, 30 byte(s) sent to socket 2018.04.30 09:20:52 LOG7[5]: Remote descriptor (FD=23) closed 2018.04.30 09:20:52 LOG7[5]: Local descriptor (FD=22) closed 2018.04.30 09:20:52 LOG7[5]: Service [mail2-smtps-submission] finished (4 left) This is the error I am getting from K9-Mail The google mail app just tells me: Alpine (linux commandline smtp client) Any advise from the gurus? Kind regards Ian

1 1

stunnel-5.44 fails cross compile due to wrong include path in Gentoo....fix available
by Joe Harvell 14 May '18

14 May '18

The src/Makefile.am hardcodes -I/usr/kerberos/include. When cross compiling it should be including -I$(SYSROOT)//usr/kerberos/include. I patched configure.ac and Makefile.am, taking advantage of the existing --with-sysroot configure option. The Gentoo bug report: https://bugs.gentoo.org/654374 The patch to configure.ac and Makefile.am: https://654374.bugs.gentoo.org/attachment.cgi?id=528968 I was unable to find a bug reporting system for stunnel. So I guess this is it. Please source this fix. --- Joe Harvell

1 1

How to configure stunnel client on Mac
by Mark Foley 04 May '18

04 May '18

I've successfully set up stunnel for Windows and Linux clients. Now to set up for Mac. I've gone to the website http://macappstore.org/stunnel/ and followed the instructions there which are: 1. Press Command+Space and type Terminal and press enter/return key. 2. Run in Terminal app: ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" < /dev/null 2> /dev/null and press enter/return key. 3. Run: brew install stunnel And then it says, "Done! You can now use stunnel." Well, not exactly. Where do I put my stunnel.conf and certificate.pem? How do I make stunnel run automatically at boot time? The web instructions aren't very complete. Need additional assistance. THX --Mark

1 1

Stunnel in Windows Failover cluster
by Tobias Gillstöm 27 Apr '18

27 Apr '18

Hi, I'm currently using stunnel in a windows fail over cluster: My problem is that when a fail over occurs stunnel switches too the other node and says that stunnel is running and everything is fine. But when I check the logs for stunnel and the program that uses stunnel, it does not appear to be running or sending any data. In the screenshot you can see my stunnel configuration, in the startup parameters section it says "-service -install" my question is if it shouldn't say "-service -start" instead, has anyone else encountered this problem? And if this is the problem why does the stunnel service install with these parameters?

1 0

Ubuntu 16.04.4 LTS SSLv3 and SSlv2 running stunnel 5.44
by Joe Phillips 25 Apr '18

25 Apr '18

I am running stunnel 5.44 on Ubuntu 16.04.4 LTS with all updates. I cannot get devices to connect using sslv2 or 3. My conf file Options line as seen below : ;Enable support for inecure SSLv3 protocol Options = -NO_SSLv3 Options = -NO_SSLv2 I continuously get error 1408A10B SSL routines: ssl3_get_client_hello:wrong version number Do I not have SSL3 and 2 correctly defined in my conf file? I realize 2 and 3 are no longer secure, but I need to support them while I transition to TLS 1.2 thanks [cid:image001.png@01D3DC17.D1AFBC30]

2 1