- stunnel-users - stunnel.org

Can I use stunnel to create a proxy chain?
by Eugene Bos 11 Jun '24

11 Jun '24

Hello. I have a proxy with http/socks5 support but this configuration doesnt work: client = yes [my-proxy] accept = 127.0.0.1:9666 connect = proxy.com:10000 protocol = connect protocolHost = username__cr.ua:password@proxy.com:10000 I wanted to proxy requests sent to 127.0.0.1:9666 to username__cr.ua:p assword@proxy.com:10000

1 0

help required with stunnel cipher set up
by Glick, Daniel 11 Jun '24

11 Jun '24

Classification: Restricted Dear All, Objective : We have been informed by Euroclear that we must use the following ciphers below with our stunnel connection to them TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 Server details : [cid:image001.png@01DABB28.6D132C70] The required cipher has been defined as being the first in the list. [cid:image002.png@01DABB28.6D132C70] Information security has confirmed that the cipher has been enabled [cid:image006.png@01DABB29.42BE4530] However after rebooting the server and starting stunnel – the old ciphers are still being used [cid:image003.png@01DABB28.6D132C70] Please can anyone point us in the right direction as to what we are doing wrong. Thank you Daniel Glick Application Specialist, Investment Management & Finance Platform Arbuthnot Latham & Co., Limited ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender and delete it from your system. Internet communications are not secure and therefore Arbuthnot Latham & Co., Limited does not accept legal responsibility for the contents of this message or any damage sustained as a result of this email or its attachments. Any views or opinions presented are solely those of the author and do not necessarily represent those of Arbuthnot Latham & Co., Limited or any of its affiliates. Please take some time to read our Privacy Notice, which provides information on what personal data we collect from you, what we do with it and who it might be shared with. *********************************************************************** Arbuthnot Latham & Co., Limited Authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. Arbuthnot Latham & Co., Limited, DIFC Branch, is regulated by the Dubai Financial Services Authority ("DFSA"). Registered in England and Wales 819519. Registered office: Arbuthnot House 7 Wilson Street London EC2M 2SN Tel : 020 7012 2500 Fax : 020 7012 2501 ************************************************************************

4 4

GRE over Stunnel
by marslogout＠gmail.com 17 May '24

17 May '24

Hello, is it possible to use GRE with Stunnel? I know that GRE is a protocol different from TCP, but I would like to hear your opinion on this matter. If GRE is not supported, would it be correct to replace it with PPTP without encryption?

1 0

Stunnel with no encryption
by Castro, Flavio 16 May '24

16 May '24

Hello, I am trying to configure Stunnel to use the insecure cipher PSK-NULL-SHA@SECLEVEL=0 but am encountering issues where a different cipher appears to be negotiated instead. My goal is to authenticate endpoints without encryption. Here are the details of my setup: Stunnel Version: 5.63 Operating System: Ubuntu Stunnel Configuration: ; Stunnel Configuration ; Global Options fips = no output = /var/log/stunnel.log ; Specify the pre-shared key file PSKsecrets = /etc/stunnel/psk.txt sslVersion = TLSv1.2 ; PSK Server Configuration [PSK server] accept = 192.168.20.11:5074 connect = 192.168.30.11:5074 ciphers = PSK-NULL-SHA ; In OpenSSL, I can achieve my goal using the following command, which works as expected: openssl s_client -port 5074 -cipher "PSK-NULL-SHA@SECLEVEL=0" -psk 4f8583bca4d311ee9fd6034d1fcbd7c3 -tls1 However, with Stunnel, it appears a different cipher is negotiated, and I do not see any error messages in the logs. I tcpdumped the connection and observed the traffic is being encrypt which was not the case when using openssl. In my usecase I need to authenticate endpoints without encryption, hence the use of PSK-NULL-SHA@SECLEVEL=0. Could you please advise on how to properly configure Stunnel to use the PSK-NULL-SHA@SECLEVEL=0 cipher, or if this is supported? Thank you for your assistance. Flavio Castro

1 0

use openvpn service through socks
by Alberto P 27 Apr '24

27 Apr '24

Hi, I have a paying vpn service that offers a few connection modes but no socks or http proxy Is it possible to use stunnel to 1) connect to the vpn service via openvpn (I have server_name, user, pass, config file) 2) make this vpn available through a socks5 proxy on my local network or localhost ? Any help with config files would be greatly appreciated

1 0

Next release of stunnel
by Heyes, Chad (Coral Springs) 25 Apr '24

25 Apr '24

Hello, We have a number of clients currently using stunnel to communicate securely from emulator software to our Unisys host. We have been coordinating with them when stunnel need to be updated. Is there a plan to update stunnel version anytime soon? I understand that it may be a 'last minute' decision based on security vulnerabilities. However, any advance notice would be helpful. Thanks, Chad Heyes Software Architect, Advisory Product Development, Bank Solutions Fiserv www.fiserv.com<http://www.fiserv.com/> Fiserv<http://links.mkt030.com/ctt?kn=3&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | Join Our Team<http://links.mkt030.com/ctt?kn=7&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | Twitter<http://links.mkt030.com/ctt?kn=1&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | LinkedIn<http://links.mkt030.com/ctt?kn=5&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | Facebook<http://links.mkt030.com/ctt?kn=9&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> FORTUNE Magazine World's Most Admired Companies(r) 2014 | 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 (c) 2018 Fiserv Inc. or its affiliates. Fiserv is a registered trademark of Fiserv Inc. Privacy Policy

2 1

Re: TLSv1.0 and TLSv1.1 - unable to disable
by Josealf.rm 24 Apr '24

24 Apr '24

1 0

TLSv1.0 and TLSv1.1 - unable to disable
by Alan Flores 23 Apr '24

23 Apr '24

Hello: I have not been able to get STunnel to disable these protocols. In the STunnel.conf file I put in the line sslVersionMin = TLSv1.2 I have disabled these in windows 2019 via reg keys But this has not stopped scans from seeing TLSv1.0 and 1.1 Any help would be appreciated stunnel 5.72 on x64-pc-mingw32-gnu platform Windows server 2019 Compiled/running with OpenSSL 3.2.1 30 Jan 2024 Alan Flores Enterprise Support Specialist Enterprise Application Systems E: Alan.Flores(a)Valpo.edu <http://www.valpo.edu> 1700 Chapel Drive, Valparaiso, IN 46383

1 0

using a socks5 with user/name authentication
by Alberto P 21 Apr '24

21 Apr '24

Hello, I have a vpn service that provides a socks5 proxy using user/pass authentication. Using stunnel would allow me to use the service with other clients that allow for a socks5 proxy but normally no authentication. Could anybody tell me 1) is what I'd like feasible ? 2)How do I provide user/pass to the configuration file ? Your help would be very appreciated ! alberto

1 0

Wondering if process to create the g2.pem file is available?
by Michael D. Setzer II 19 Apr '24

19 Apr '24

Was wondering if the process to create the g2.pem file you shared is available. It does work with changes to the stunnel.conf file for both the smtp1.guam.net and mail.guam.net [guampop] client=yes accept = 127.0.0.1:20996 connect = mail.guam.net:995 debug = 7 verifyChain = yes CApath = /etc/ssl/certs CAfile = /etc/stunnel/g2.pem checkHost = mail.guam.net OCSPaia = yes [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 debug = 7 verifyChain = yes CApath = /etc/ssl/certs CAfile = /etc/stunnel/g2.pem checkHost = smtp1.guam.net OCSPaia = yes Not sure the the g2.pem would work for all time, or has an expiration date. Thanks. +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:mikes@guam.net mailto:msetzerii@gmail.com mailto:msetzerii@gmx.com Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

1 0