stunnel-users April 2024

stunnel-users@stunnel.org

12 participants
14 discussions

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net). But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net), make sure it's using http/1.1, etc?

4 3

Re: [stunnel-users] CPU 100%
by Eric Eberhard 06 Nov '24

06 Nov '24

Long ago I had a server with a bad network card. Every once in a while it would spew uncontrollable bytes onto the network. If you open a stunnel connection and it does that this could very well be the problem. If it cheap, try changing the network card. If not, you should be able to look in your firewall/router and it will tell you who is sending what bytes to whomever. See if that machine is indeed streaming the bytes in massive quantities. If not, I would suspect your stunnel is getting stuck in it's own loop. There are a million reasons this can happen (well a few less than a million) - such as maybe a bad library in the FreeBSD or a bad choice in the Makefile - such as doing threads or something in a way your O/S does not like (I use threads=fork or whatever it is, instead of actual threading). You might tinker with some of the options that make the stunnel build and try different ones. Especially if stunnel was compiled on a different version of the O/S - could be differences in bytes in things and who knows what. That is all I can suggest beyond setting the debug level to 7 (I think is highest) and then watching the log file. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 10:57 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 1

use openvpn service through socks
by Alberto P 27 Apr '24

27 Apr '24

Hi, I have a paying vpn service that offers a few connection modes but no socks or http proxy Is it possible to use stunnel to 1) connect to the vpn service via openvpn (I have server_name, user, pass, config file) 2) make this vpn available through a socks5 proxy on my local network or localhost ? Any help with config files would be greatly appreciated

1 0

Next release of stunnel
by Heyes, Chad (Coral Springs) 25 Apr '24

25 Apr '24

Hello, We have a number of clients currently using stunnel to communicate securely from emulator software to our Unisys host. We have been coordinating with them when stunnel need to be updated. Is there a plan to update stunnel version anytime soon? I understand that it may be a 'last minute' decision based on security vulnerabilities. However, any advance notice would be helpful. Thanks, Chad Heyes Software Architect, Advisory Product Development, Bank Solutions Fiserv www.fiserv.com<http://www.fiserv.com/> Fiserv<http://links.mkt030.com/ctt?kn=3&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | Join Our Team<http://links.mkt030.com/ctt?kn=7&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | Twitter<http://links.mkt030.com/ctt?kn=1&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | LinkedIn<http://links.mkt030.com/ctt?kn=5&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | Facebook<http://links.mkt030.com/ctt?kn=9&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> FORTUNE Magazine World's Most Admired Companies(r) 2014 | 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 (c) 2018 Fiserv Inc. or its affiliates. Fiserv is a registered trademark of Fiserv Inc. Privacy Policy

2 1

Re: TLSv1.0 and TLSv1.1 - unable to disable
by Josealf.rm 24 Apr '24

24 Apr '24

1 0

TLSv1.0 and TLSv1.1 - unable to disable
by Alan Flores 23 Apr '24

23 Apr '24

Hello: I have not been able to get STunnel to disable these protocols. In the STunnel.conf file I put in the line sslVersionMin = TLSv1.2 I have disabled these in windows 2019 via reg keys But this has not stopped scans from seeing TLSv1.0 and 1.1 Any help would be appreciated stunnel 5.72 on x64-pc-mingw32-gnu platform Windows server 2019 Compiled/running with OpenSSL 3.2.1 30 Jan 2024 Alan Flores Enterprise Support Specialist Enterprise Application Systems E: Alan.Flores(a)Valpo.edu <http://www.valpo.edu> 1700 Chapel Drive, Valparaiso, IN 46383

1 0

using a socks5 with user/name authentication
by Alberto P 21 Apr '24

21 Apr '24

Hello, I have a vpn service that provides a socks5 proxy using user/pass authentication. Using stunnel would allow me to use the service with other clients that allow for a socks5 proxy but normally no authentication. Could anybody tell me 1) is what I'd like feasible ? 2)How do I provide user/pass to the configuration file ? Your help would be very appreciated ! alberto

1 0

Wondering if process to create the g2.pem file is available?
by Michael D. Setzer II 19 Apr '24

19 Apr '24

Was wondering if the process to create the g2.pem file you shared is available. It does work with changes to the stunnel.conf file for both the smtp1.guam.net and mail.guam.net [guampop] client=yes accept = 127.0.0.1:20996 connect = mail.guam.net:995 debug = 7 verifyChain = yes CApath = /etc/ssl/certs CAfile = /etc/stunnel/g2.pem checkHost = mail.guam.net OCSPaia = yes [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 debug = 7 verifyChain = yes CApath = /etc/ssl/certs CAfile = /etc/stunnel/g2.pem checkHost = smtp1.guam.net OCSPaia = yes Not sure the the g2.pem would work for all time, or has an expiration date. Thanks. +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:mikes@guam.net mailto:msetzerii@gmail.com mailto:msetzerii@gmx.com Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

1 0

Having strange issue with newer kernels? 6.8.
by Michael D. Setzer II 19 Apr '24

19 Apr '24

3 2

unknow TCP service 11702
by tomoyalin＠yahoo.co.jp 18 Apr '24

18 Apr '24

how to solve problem from stunnel config file when using port is not 80 or 443. ( our config tcp service port is 11702)

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users April 2024