stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

stunnel logfile and setuid/setgid
by Norbert Hanke 02 Sep '21

02 Sep '21

Hi, I'm new to this list and hope I don't raise a question that has been raised many times before. I searched the archive and couldn't find that discussed previously... I want to configure stunnel using setuid = nobody setgid = nobody while having it write its output to its own logfile, not using syslog, with output = /var/log/stunnel.log log = append syslog = no This works when user nobody has write-access to an existing logfile, or user nobody is allowed to create the file in the directory. Both is not a good idea: user nobody should not have write access there. I could limit potential damage by having a separate directory with such access to nobody, but that is still kind of wrong. Or I could create a separate user only for stunnel and give that user full access to a separate directory: that would be more secure, only a hijacked (hopefully not) stunnel could tamper with its own logfiles. Shouldn't stunnel create and/or open the logfile while it is still running as root, and only then switch to user nobody? Or is there an option that I did not see so far allowing for what I'm trying? Thanks for any help. Regards, Norbert

1 0

Stunnel 5.60 started via Stunnel TLS wrapper on Windows 10 machine doesn't seem to be working
by ling＠aliko.com 01 Sep '21

01 Sep '21

Hi, I am trying to get Stunnel 5.60 started automatically as a service. My stunnel.conf is stored under C:\Program Files (x86)\stunnel\config works fine if I run stunnel.exe manually from CMD or bring up the GUI and reload configuration. Now I would like it to start automatically after reboots. I tried running stunnel.exe -install which installs the Stunnel TLS wrapper service. Starting the service does not however do anything. The "Path to execute" it installs for the service is "C:\Program Files (x86)\stunnel\config" -service -install. I don't see anything in the log. I can see that the stunnel.exe process is running in task manager. But running netstat -ao shows that no port is being listened to by the PID. Tried removing my stunnel.conf file and the service will still starts but stunnel doesn't seem to be doing anything. What could be the problem?

2 2

Minor bugfix: parameter type
by Peter Pentchev 19 Aug '21

19 Aug '21

Hi, Thanks a lot for the continued development of stunnel! While checking whether my Debian packages can be built with the upcoming GCC 11, I found (or rather, GCC reported) a minor discrepancy in the type of the "hash" parameter to the crypt_DES() function in protocol.c. What do you think about the attached patch? It is also available at: https://salsa.debian.org/debian/stunnel/-/blob/master/debian/patches/06-des… Thanks again, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)debian.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

stunnel 60 released
by Michał Trojnara 16 Aug '21

16 Aug '21

Dear Users, I have released version 5.60 of stunnel. ### Version 5.60, 2021.08.16, urgency: LOW * New features - New 'sessionResume' service-level option to allow or disallow session resumption - Added support for the new SSL_set_options() values. - Download fresh ca-certs.pem for each new release. * Bugfixes - Fixed 'redirect' with 'protocol'. This combination is not supported by 'smtp', 'pop3' and 'imap' protocols. - Enforced minimum WIN32 log window size. - Fixed support for password-protected private keys with OpenSSL 3.0 (thx to Dmitry Belyavskiy). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c45d765b1521861fea9b03b425b9dd7d48b3055128c0aec673bba5ef9b8f787d stunnel-5.60.tar.gz 190b79cb94a4f70f362e44c32d150edf8ae660734d3fa0cbd990c3821e8f3083 stunnel-5.60-win64-installer.exe bac9bb4503cc5091d78c9deb6aa013fc07e39d67db0dfcc073b098db52f54427 stunnel-5.60-android.zip Best regards, Mike

1 0

Is it possible to tunnel all tcp sessions of docker containers
by Yichun Ding 15 Aug '21

15 Aug '21

Hi, We are looking for the possibility to encrypt all the tcp sessions of containers between hosts with stunnel. So far I had no luck to come up with an iptables rule to route the packets to stunnel running on the host. We cannot change the container code as there are too many of them. Any advice would be appreciated! -yd

1 0

stunnel ignores chroot /etc/hosts
by kmx1818＠gmail.com 10 Aug '21

10 Aug '21

Hello all! On my localhost I've got a java 1.4 tls1.0 app/service running, which is hard-coded to http-call a soap service (tls1.0 level too) running on a remote host, say, svchost. Host resolution is "files" only (ie /etc/hosts) - no dns. The aim is to make this java client tls1.2-compliant. My solution is: 1/ configure svchost to be (an alias of) localhost - in global /etc/hosts 127.0.0.1 localhost svchost 2/ configure a chroot env for stunell with its own /etc/hosts 1.2.3.4 svchost (needless to say that to make it work I had to copy /etc's nsswitch.conf resolv.conf, a bunch of libraries, esp libnsl and nsl_files etc, and create another lot of /dev entries) I've tested it with the native getent command: $ getent hosts svchost 127.0.0.1 $ chroot /var/run/stunnel/chroot getent hosts svchost 1.2.3.4 3/ run stunnel in chroot mode: # /opt/csw/bin/stunnel -version stunnel 5.59 on sparc-sun-solaris2.10 platform Compiled/running with OpenSSL 1.0.2u 20 Dec 2019 ; for tls1 clients client = yes sslVersion = TLSv1.2 delay = yes chroot = /var/run/stunnel/chroot [tls12] accept = localhost:80 connect = svchost:443 ; Alas, stunnel still resolves svchost from the global /etc/hosts - not from chroot's!: $ curl -kL http://svchost/service curl: (52) Empty reply from server ...and in /var/adm/messages: …LOG[4]: Service [tls12] accepted connection from 127.0.0.1:47944 …LOG[4]: s_connect: connecting 127.0.0.1:443 …LOG[4]: s_connect: s_poll_wait 127.0.0.1:443: waiting 10 seconds …LOG[4]: s_connect: connect 127.0.0.1:443: Connection refused (146) …LOG[4]: No more addresses to connect I've tried foreground yes/no, truss/strace - nothing useful... What am I missing!? Thank you in advance!

2 2

Unexpected socket close while sending mail
by zfefm＠gmx.de 27 Jul '21

27 Jul '21

Hi, since several days I try to get stunnel working to add TLS1.2 or higher support to my outdated email client program (Applemail 4.6) as my service provider will stop supporting the old protocols soon. The protocol of stunnel looks as if the connection gets established well. But as soon I want to send a mail my mail program tries for 10-15s to send an then gives up. In the stunnel protocol (time stamp 16:54:22) the server seems to accept the connection, but about 10-15s later I get: Unexpected socket close (s_read) Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Any ideas what could be the problem? Thanks. conf and protocol attached. conf: setuid = nobody setgid = nogroup foreground = yes debug = 7 output = /usr/local/etc/stunnel/stunnel.log [strato-pop3] client = yes verifyChain = yes accept = 127.0.0.1:110 connect = pop3.strato.de:995 CApath = /usr/local/etc/stunnel/ cert = /usr/local/etc/stunnel/stunnel.pem checkHost = pop3.strato.de protocol = pop3 [strato-smtp] client = yes verifyChain = yes accept = 127.0.0.1:25 connect = smtp.strato.de:465 checkHost = smtp.strato.de CApath = /usr/local/etc/stunnel/ cert = /usr/local/etc/stunnel/stunnel.pem protocol = smtp protocol : 2021.07.22 16:53:49 LOG6[ui]: Initializing inetd mode configuration 2021.07.22 16:53:49 LOG7[ui]: Clients allowed=125 2021.07.22 16:53:49 LOG5[ui]: stunnel 5.59 on x86_64-apple-darwin10.8.0 platform 2021.07.22 16:53:49 LOG5[ui]: Compiled/running with OpenSSL 1.1.1k 25 Mar 2021 2021.07.22 16:53:49 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.07.22 16:53:49 LOG7[ui]: errno: (*__error()) 2021.07.22 16:53:49 LOG6[ui]: Initializing inetd mode configuration 2021.07.22 16:53:49 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2021.07.22 16:53:49 LOG5[ui]: UTF-8 byte order mark detected 2021.07.22 16:53:49 LOG5[ui]: FIPS mode disabled 2021.07.22 16:53:49 LOG6[ui]: Compression enabled: 0 methods 2021.07.22 16:53:49 LOG7[ui]: No PRNG seeding was required 2021.07.22 16:53:49 LOG6[ui]: Initializing service [strato-pop3] 2021.07.22 16:53:49 LOG6[ui]: stunnel default security level set: 2 2021.07.22 16:53:49 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2021.07.22 16:53:49 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2021.07.22 16:53:49 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2021.07.22 16:53:49 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG7[ui]: Private key check succeeded 2021.07.22 16:53:49 LOG6[ui]: DH initialization skipped: client section 2021.07.22 16:53:49 LOG7[ui]: ECDH initialization 2021.07.22 16:53:49 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2021.07.22 16:53:49 LOG6[ui]: Initializing service [strato-smtp] 2021.07.22 16:53:50 LOG6[ui]: stunnel default security level set: 2 2021.07.22 16:53:50 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2021.07.22 16:53:50 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2021.07.22 16:53:50 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2021.07.22 16:53:50 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG7[ui]: Private key check succeeded 2021.07.22 16:53:50 LOG6[ui]: DH initialization skipped: client section 2021.07.22 16:53:50 LOG7[ui]: ECDH initialization 2021.07.22 16:53:50 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2021.07.22 16:53:50 LOG5[ui]: Configuration successful 2021.07.22 16:53:50 LOG7[ui]: Deallocating deployed section defaults 2021.07.22 16:53:50 LOG7[ui]: Binding service [strato-pop3] 2021.07.22 16:53:50 LOG7[ui]: Listening file descriptor created (FD=8) 2021.07.22 16:53:50 LOG7[ui]: Setting accept socket options (FD=8) 2021.07.22 16:53:50 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2021.07.22 16:53:50 LOG6[ui]: Service [strato-pop3] (FD=8) bound to 127.0.0.1:110 2021.07.22 16:53:50 LOG7[ui]: Binding service [strato-smtp] 2021.07.22 16:53:50 LOG7[ui]: Listening file descriptor created (FD=10) 2021.07.22 16:53:50 LOG7[ui]: Setting accept socket options (FD=10) 2021.07.22 16:53:50 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2021.07.22 16:53:50 LOG6[ui]: Service [strato-smtp] (FD=10) bound to 127.0.0.1:25 2021.07.22 16:53:50 LOG7[ui]: No pid file being created 2021.07.22 16:53:50 LOG7[cron]: Cron thread initialized 2021.07.22 16:53:50 LOG6[cron]: Executing cron jobs 2021.07.22 16:53:50 LOG6[cron]: Cron jobs completed in 0 seconds 2021.07.22 16:53:50 LOG7[cron]: Waiting 86400 seconds 2021.07.22 16:54:22 LOG7[ui]: Found 1 ready file descriptor(s) 2021.07.22 16:54:22 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[ui]: FD=8 events=0x1 revents=0x1 2021.07.22 16:54:22 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[ui]: Service [strato-pop3] accepted (FD=3) from 127.0.0.1:49864 2021.07.22 16:54:22 LOG7[0]: Service [strato-pop3] started 2021.07.22 16:54:22 LOG7[0]: Setting local socket options (FD=3) 2021.07.22 16:54:22 LOG7[0]: Option TCP_NODELAY set on local socket 2021.07.22 16:54:22 LOG5[0]: Service [strato-pop3] accepted connection from 127.0.0.1:49864 2021.07.22 16:54:22 LOG6[0]: s_connect: connecting 81.169.145.131:995 2021.07.22 16:54:22 LOG7[0]: s_connect: s_poll_wait 81.169.145.131:995: waiting 10 seconds 2021.07.22 16:54:22 LOG7[0]: FD=6 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[0]: FD=13 events=0x5 revents=0x0 2021.07.22 16:54:22 LOG5[0]: s_connect: connected 81.169.145.131:995 2021.07.22 16:54:22 LOG5[0]: Service [strato-pop3] connected remote server from 192.168.17.130:49865 2021.07.22 16:54:22 LOG7[0]: Setting remote socket options (FD=13) 2021.07.22 16:54:22 LOG7[0]: Option TCP_NODELAY set on remote socket 2021.07.22 16:54:22 LOG7[0]: Remote descriptor (FD=13) initialized 2021.07.22 16:55:22 LOG3[0]: Unexpected socket close (s_read) 2021.07.22 16:55:22 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2021.07.22 16:55:22 LOG7[0]: Remote descriptor (FD=13) closed 2021.07.22 16:55:22 LOG7[0]: Local descriptor (FD=3) closed 2021.07.22 16:55:22 LOG7[0]: Service [strato-pop3] finished (0 left) 2021.07.22 16:55:22 LOG7[0]: str_stats: 1 block(s), 32 data byte(s), 90 control byte(s) 2021.07.22 16:55:22 LOG7[0]: str_stats: 32 byte(s) at network.c:735

2 3

Equivalence of verify=2
by Yann RESCOURIO 22 Jul '21

22 Jul '21

Hello I would like to authenticate a server with only its CA file. What is the equivalence of verify=2 ? requireCert = yes verifyChain = no verifyPeer = yes Regards Yann

3 5

idea: linux stunnel mini-GUI
by Dmitry Bakshaev 13 Jul '21

13 Jul '21

we need start stunnel on linux desktop by ordinary user (like on windows): 1 click stunnel icon on system menu 2 enter user certificate password 3 use opened tunnels with users applications 4 on desktop session ends close all tunnels make XDG menu entry file: [Desktop Entry] Type=Application Name=stunnel Categories=Network; GenericName=TLS/SSL - Port Wrapper Comment[ru_RU]=Секретный туннель Icon=stunnel Exec=/usr/bin/stunnel Terminal=true X-KeepTerminal=true but only problem is how stunnel react on signals: HUP is daemon's "reload config". in X-session HUP signal is "session end" and stunnel is not exited on closing terminal or logout. attached patch change this behavior: if "foreground=yes" specified in stunnel.conf HUP signal is treated as TERM and stunnel exited. foreground=yes is "debug" or "desktop" mode of stunnel. XDG-desktop file and icon file may be included in default stunnel distributions.

1 0

Difficulty to select exact Cipher
by Sachin Deshmukh 12 Jul '21

12 Jul '21

Hello Together, I had been trying to use a stunnel to set PSK encrypted TLS. Below is my conf file. [client] client = yes accept = 127.0.0.1:8888 connect = 192.168.1.100:443 ciphers = PSK-AES128-CBC-SHA256 PSKsecrets = /data/dummy.txt I can see communication, but client e.g. Stunnel from Client side offer several other cipher in addition to exact one which is expected as per conf. I wish PSK-AES128-CBC-SHA256 (0x00ae) But I see the list below in actual communication. [image: image.png] Please let me know 1 .how we can inform stunnel to use exact and only 1 cipher provided in the conf file. Or 2. How can we state hex id instead of string. If I see a cipher list, with the same keyword as a part or whole there are more than 1 ciphers, I suppose this causes stunnel to take a list as per string match. ECDHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA256 RSA-PSK-AES128-CBC-SHA256 TLSv1 Kx=RSAPSK Au=RSA Enc=AES(128) Mac=SHA256 DHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=DHEPSK Au=PSK Enc=AES(128) Mac=SHA256 *PSK-AES128-CBC-SHA256 * TLSv1 Kx=PSK Au=PSK Enc=AES(128) Mac=SHA256 Can we make a stunnel to select only one exact cipher?

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users