stunnel-users June 2023

stunnel-users@stunnel.org

6 participants
12 discussions

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net). But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net), make sure it's using http/1.1, etc?

4 3

Re: [stunnel-users] CPU 100%
by Eric Eberhard 06 Nov '24

06 Nov '24

Long ago I had a server with a bad network card. Every once in a while it would spew uncontrollable bytes onto the network. If you open a stunnel connection and it does that this could very well be the problem. If it cheap, try changing the network card. If not, you should be able to look in your firewall/router and it will tell you who is sending what bytes to whomever. See if that machine is indeed streaming the bytes in massive quantities. If not, I would suspect your stunnel is getting stuck in it's own loop. There are a million reasons this can happen (well a few less than a million) - such as maybe a bad library in the FreeBSD or a bad choice in the Makefile - such as doing threads or something in a way your O/S does not like (I use threads=fork or whatever it is, instead of actual threading). You might tinker with some of the options that make the stunnel build and try different ones. Especially if stunnel was compiled on a different version of the O/S - could be differences in bytes in things and who knows what. That is all I can suggest beyond setting the debug level to 7 (I think is highest) and then watching the log file. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 10:57 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 1

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

Config stunnel for outgoing mails to Ionos
by a.franken＠management-kommunikation.de 22 Aug '23

22 Aug '23

In these days, our provider Ionos/1&1 starts to accept only encrypted access to its mail server and at least TLS 1.2. There are no problems with incoming mails. In order to be on the safe side with our Win SBS Server 2008 (no comments please!) with outgoing mails, I now have interposed stunnel as recommended many times on the web. This works in principle. Unfortunate exception: In some cases - expecially if the mail recipient has a Microsoft address like @hotmail.de, @live.de, @outlook.com -, sending aborts with error 503 5.5.2 ("Need mail command"). Unfortunately, I'm quite innocent with SMTP, SSL and certificates, but worked hard to create the following stunnel configuration file: socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 client = yes output = C:\Program Files (x86)\stunnel\stunnel.log [smtpionos] accept = localhost:465 connect = smtp.ionos.de:465 verifyChain = yes verifyPeer = yes CAfile = C:\Program Files (x86)\stunnel\config\amakor2022.pem checkHost = remote.management-kommunikation.de protocolHost = smtp.ionos.de protocolAuthentication = login protocolUsername = OUR_USERNAME protocolPassword = OUR_PASSWORD sslVersionMin = TLSv1.2 sslVersionMax = TLSv1.2 delay = yes protocol = smtp amakor2022.pem is the "PositiveSSL" certificate that we acquired for our subdomain remote.management-kommunikation.de. "Our_Username" and "Our_Password" are of course our correct access data. After spending hours searching the web for a solution, does anyone have a tip what's wrong and what to do?

1 2

help
by Seray Tokadli 26 Jun '23

26 Jun '23

Hello, I am trying to configure stunnel on windows (version 5.69) I am using the capi engine with below conf. I am sending the logs to logstash and not sure if it is working or not. My questions are: 1) I dont see anything in the log after initializing the service. When it sends the logs through stunnel, should i see an entry in the logs? 2) When using capi engine, should i limit the ssl version still ? in your website i see that the tls version supposed to be limited but is it an old info? 3) in your website again it mentions that i should specify the security level to zero for capi engine, is it also a valid info? if yes, do i need to set it in global section or service level? https://www.stunnel.org/config_windows.html fips = yes taskbar = yes engine = capi output = C:\Logs\stunnel\stunnel.log debug = debug [logging_service_for_filebeat] engineId = capi client = yes accept = {{ stunnel_logging_port_filebeat }} delay = yes connect = {{ logstash_vip }}:{{ stunnel_logging_port_filebeat }} ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256 sessionCacheSize = 5000 sessionCacheTimeout = 300 socket = l:TCP_NODELAY=1 # the only FIPS 140-2 compliant protocol sslVersion = TLSv1.2 CApath = <ca path> verifyChain = yes checkHost = <ca host> verify = 2 Log: 023.06.26 14:37:39 LOG6[service]: Initializing inetd mode configuration 2023.06.26 14:37:39 LOG7[service]: Running on Windows 6.2 2023.06.26 14:37:39 LOG7[service]: No limit detected for the number of clients 2023.06.26 14:37:39 LOG5[service]: stunnel 5.69 on x64-pc-mingw32-gnu platform 2023.06.26 14:37:39 LOG5[service]: Compiled/running with OpenSSL 3.0.8 7 Feb 2023 2023.06.26 14:37:39 LOG5[service]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2023.06.26 14:37:39 LOG7[service]: errno: (*_errno()) 2023.06.26 14:37:39 LOG6[service]: Initializing inetd mode configuration 2023.06.26 14:37:39 LOG7[service]: Running on Windows 6.2 2023.06.26 14:37:39 LOG5[service]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2023.06.26 14:37:39 LOG5[service]: UTF-8 byte order mark not detected 2023.06.26 14:37:39 LOG7[service]: Enabling support for engine "capi" 2023.06.26 14:37:39 LOG6[service]: Logging not supported by engine #1 (capi) 2023.06.26 14:37:39 LOG6[service]: UI not supported by engine #1 (capi) 2023.06.26 14:37:39 LOG7[service]: Initializing engine #1 (capi) 2023.06.26 14:37:39 LOG6[service]: Engine #1 (capi) initialized 2023.06.26 14:37:39 LOG5[service]: FIPS provider enabled 2023.06.26 14:37:39 LOG5[service]: FIPS mode enabled 2023.06.26 14:37:39 LOG6[service]: Compression disabled 2023.06.26 14:37:39 LOG7[service]: No PRNG seeding was required 2023.06.26 14:37:39 LOG6[service]: Initializing service [logging_service_for_filebeat] 2023.06.26 14:37:39 LOG6[service]: stunnel default security level set: 2 2023.06.26 14:37:39 LOG7[service]: Ciphers: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256 2023.06.26 14:37:39 LOG7[service]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.06.26 14:37:39 LOG7[service]: TLS options: 0x2100000 (+0x0, -0x0) 2023.06.26 14:37:39 LOG6[service]: Session resumption enabled 2023.06.26 14:37:39 LOG6[service]: Client certificate engine (capi) enabled 2023.06.26 14:37:39 LOG7[service]: No certificate or private key specified 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA:xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA:xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: DH initialization skipped: client section 2023.06.26 14:37:39 LOG7[service]: ECDH initialization 2023.06.26 14:37:39 LOG7[service]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.06.26 14:37:39 LOG6[service]: Initializing service [logging_service_for_winlogbeat] 2023.06.26 14:37:39 LOG6[service]: stunnel default security level set: 2 2023.06.26 14:37:39 LOG7[service]: Ciphers: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256 2023.06.26 14:37:39 LOG7[service]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.06.26 14:37:39 LOG7[service]: TLS options: 0x2100000 (+0x0, -0x0) 2023.06.26 14:37:39 LOG6[service]: Session resumption enabled 2023.06.26 14:37:39 LOG6[service]: Client certificate engine (capi) enabled 2023.06.26 14:37:39 LOG7[service]: No certificate or private key specified 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: DH initialization skipped: client section 2023.06.26 14:37:39 LOG7[service]: ECDH initialization 2023.06.26 14:37:39 LOG7[service]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.06.26 14:37:39 LOG5[service]: Configuration successful 2023.06.26 14:37:39 LOG7[service]: Deallocating deployed section defaults 2023.06.26 14:37:39 LOG7[service]: Binding service [logging_service_for_filebeat] 2023.06.26 14:37:39 LOG7[service]: Listening file descriptor created (FD=632) 2023.06.26 14:37:39 LOG7[service]: Setting accept socket options (FD=632) 2023.06.26 14:37:39 LOG7[service]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.06.26 14:37:39 LOG6[service]: Service [logging_service_for_filebeat] (FD=632) bound to 0.0.0.0:10300 2023.06.26 14:37:39 LOG7[service]: Binding service [logging_service_for_winlogbeat] 2023.06.26 14:37:39 LOG7[service]: Listening file descriptor created (FD=648) 2023.06.26 14:37:39 LOG7[service]: Setting accept socket options (FD=648) 2023.06.26 14:37:39 LOG7[service]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.06.26 14:37:39 LOG6[service]: Service [logging_service_for_winlogbeat] (FD=648) bound to 0.0.0.0:10301 2023.06.26 14:37:39 LOG6[service]: Accepting new connections 2023.06.26 14:37:39 LOG7[per-second]: Per-second thread initialized 2023.06.26 14:37:39 LOG7[per-day]: Per-day thread initialized 2023.06.26 14:37:39 LOG6[per-day]: Executing per-day jobs 2023.06.26 14:37:39 LOG6[per-day]: Per-day jobs completed in 0 seconds 2023.06.26 14:37:39 LOG7[per-day]: Waiting 86400 seconds -- Seray TOKADLI KILIÇ +420778116052

1 0

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 21 Jun '23

21 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

2 7

help configuring stunnel with ssl ceritificate
by Andrei 20 Jun '23

20 Jun '23

Hello! I'm trying to configure stunnel with an ssl certificate. I have the certificate (.p12 format) from the site owners, installed it in the Personal folder of the current user and local machine. Before installing stunnel I had to select the certificate in the browser when accessing the site. With this configuration [sts] client = yes accept = 127.0.0.1:42354 connect = y7m2zq.its:443 key = E:\!Work\ cert_.pem CAfile = E:\!Work\ cert_.pem verify=0 the stunnel starts but I get a `No required SSL certificate was sent`when accessing from the browser. If I use this config [sts] client = yes accept = 127.0.0.1:42354 connect = y7m2zq.its:443 cert = E:\!Work\cert_.p12 key = E:\!Work\cert_.pem CAfile = E:\!Work\cert_.pem verify=0 the stunnel will not start PKCS12_parse: crypto/evp/evp_fetch.c:373: error:0308010C:digital envelope routines::unsupported LOG3[main]: Service [sts]: Failed to initialize TLS context Please help. I would like to be able to open the site without choosing the certificate. Thank you!

2 1

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 20 Jun '23

20 Jun '23

1 0

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 20 Jun '23

20 Jun '23

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users June 2023