stunnel-users

stunnel-users@stunnel.org

5 participants
3293 discussions

Long time to tear off the certificate
by nizdiminov＠itopcase.ru 02 Feb '23

02 Feb '23

Good afternoon, I observe a problem in the operation of the stunnel. There are 5 active connections. I get an error **** Server unexpectedly disconnected Error performing handshake Before that, there is a pattern, it takes a very long time to tear off the certificate 5 мин. 2023.01.31 17:13:37 LOG7[15674:140480621389568]: open file /etc/stunnel/cert/eis/dit.cer with certificate 2023.01.31 17:18:25 LOG3[15674:140480621389568]: Credentials complete /opt/cprocsp/sbin/amd64/stunnel_thread -version stunnel 4.18 on x86_64-pc-linux-gnu Threading:PTHREAD Sockets:POLL,IPv6 Auth:LIBWRAP

1 0

Monitoring stunnel
by nizdiminov＠itopcase.ru 01 Feb '23

01 Feb '23

Good afternoon, tell me how best to monitor the stunnel? I use zabbix monitoring 5.4 , in my stunnel 5 connections 3 server 2 clients, all with certificate verification. It is necessary to monitor each connection separately. Maybe there is a template for zabbix monitoring 5.4 ?

1 0

help
by Gurjit Singh Jhutti 27 Jan '23

27 Jan '23

Is it possible to configure username and password for SMTP connection on Windows Server, did try this with any success in stunnel.conf [client] username = user password = password error: LOG6[main]: Initializing service [client] LOG3[main]: ....\stunnel.conf:73: "username = user": Specified option name is not valid here LOG3[main]: Configuration failed

1 0

Odd stunnel problem
by Phil Smith III 26 Jan '23

26 Jan '23

Well, odd to me. I use K9, a free Bayesian spam proxy I've used for ~20 years. It doesn't do TLS. So I have: Outlook <-> K9 <-> stunnel <-> Internet for email connections. This morning I wasn't getting anything on my dozen or so POP connections that go through that (Exchange email was fine). Restarted Outlook (making sure it had really closed), no joy. Then I noticed that while doing a mail check, K9 was throbbing for long periods. There's not much to do with K9, so next I looked at stunnel, whose log was full of: 2023.01.26 09:39:26 LOG3[18110]: No more addresses to connect 2023.01.26 09:39:36 LOG3[18111]: s_connect: s_poll_wait 146.20.147.244:995: TIMEOUTconnect exceeded Reloaded stunnel config and all is well. So, not a big deal, but.any guesses what was going on here? stunnel 5.57, Windows 10.

1 0

Stunnel activity issue
by Денис Голубятников 26 Jan '23

26 Jan '23

I have problems with stunnel on OS Windows. After a successful connection with stunnel, the connection drops after approximately 9 minutes of inactivity. On Linux, this problem was solved by changing this parametrs: net.ipv4.tcp_keepalive_time = 60 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 20 I don't have access to the server side router, so I can't change anything. Stunnel log: 2023.01.25 17:18:10 LOG7[1]: Service [test] started 2023.01.25 17:18:10 LOG7[1]: Setting local socket options (FD=964) 2023.01.25 17:18:10 LOG7[1]: Option TCP_NODELAY set on local socket 2023.01.25 17:18:10 LOG5[1]: Service [test] accepted connection from 127.0.0.1:50145 2023.01.25 17:18:10 LOG6[1]: s_connect: connecting 225.179.85.93:18572 2023.01.25 17:18:10 LOG7[1]: s_connect: s_poll_wait 225.179.85.93:18572: waiting 10 seconds 2023.01.25 17:18:10 LOG7[1]: FD=716 ifds=rwx ofds=--- 2023.01.25 17:18:10 LOG5[1]: s_connect: connected 225.179.85.93:18572 2023.01.25 17:18:10 LOG5[1]: Service [onegomed] connected remote server from 192.168.1.84:50146 2023.01.25 17:18:10 LOG7[1]: Setting remote socket options (FD=716) 2023.01.25 17:18:10 LOG7[1]: Option TCP_NODELAY set on remote socket 2023.01.25 17:18:10 LOG7[1]: Remote descriptor (FD=716) initialized 2023.01.25 17:18:10 LOG6[1]: SNI: sending servername: 225.179.85.93 2023.01.25 17:18:10 LOG6[1]: Peer certificate not required 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): before SSL initialization 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write client hello 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write client hello 2023.01.25 17:18:10 LOG7[1]: Initializing application specific data for session authenticated 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server hello 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): TLSv1.3 read encrypted extensions 2023.01.25 17:18:10 LOG6[1]: Certificate verification disabled 2023.01.25 17:18:10 LOG6[1]: Certificate verification disabled 2023.01.25 17:18:10 LOG6[1]: Certificate verification disabled 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server certificate 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): TLSv1.3 read server certificate verify 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read finished 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write change cipher spec 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write finished 2023.01.25 17:18:10 LOG7[1]: 2 client connect(s) requested 2023.01.25 17:18:10 LOG7[1]: 2 client connect(s) succeeded 2023.01.25 17:18:10 LOG7[1]: 0 client renegotiation(s) requested 2023.01.25 17:18:10 LOG7[1]: 0 session reuse(s) 2023.01.25 17:18:10 LOG6[1]: TLS connected: new session negotiated 2023.01.25 17:18:10 LOG6[1]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2023.01.25 17:18:10 LOG6[1]: Peer temporary key: X25519, 253 bits 2023.01.25 17:18:10 LOG7[1]: Compression: null, expansion: null 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: Initializing application specific data for session authenticated 2023.01.25 17:18:10 LOG7[1]: Deallocating application specific data for session connect address 2023.01.25 17:18:10 LOG7[1]: New session callback 2023.01.25 17:18:10 LOG7[1]: Deallocating application specific data for session connect address 2023.01.25 17:18:10 LOG6[1]: Session id: 8E91DBE369D9E16221CCA288A7C1F652AB045BAE96C19B4240B1B7F710069CCE 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server session ticket 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: Initializing application specific data for session authenticated 2023.01.25 17:18:10 LOG7[1]: New session callback 2023.01.25 17:18:10 LOG7[1]: Deallocating application specific data for session connect address 2023.01.25 17:18:10 LOG6[1]: Session id: 6UIA254BF9D027B3D4BE5F966BDE9DE2058CF167C4EF0CD5A460958B698DF322 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server session ticket 2023.01.25 17:33:25 LOG3[1]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2023.01.25 17:33:25 LOG5[1]: Connection reset: 5184 byte(s) sent to TLS, 10344 byte(s) sent to socket 2023.01.25 17:33:25 LOG7[1]: Remote descriptor (FD=716) closed 2023.01.25 17:33:25 LOG7[1]: Local descriptor (FD=964) closed 2023.01.25 17:33:25 LOG7[1]: Service [test] finished (0 left)` I tried: * changing the windows registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveTime HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveInterval HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxDataRetransmissions HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TdxPrematureConnectIndDisabled HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSetting\KeepAliveTimeout HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSetting\ServerInfoTimeout * changing stunnel config on client side: socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 * changing parametrs on linux server side: net.ipv4.tcp_keepalive_time = 60 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 20 * add server cert on stunnel client config; * downgrade and update stunnel. -- Gordon Stevenson Отправлено из Почты Mail.ru

1 0

forward all UDP port
by Ahmad Kiamanesh 23 Jan '23

23 Jan '23

Hi how can forward all inner UDP ports from one server to another server?

1 0

STunnel not passing traffic
by Gary Jackson 15 Jan '23

15 Jan '23

I have an application that sends XML encrypted traffic over TCP to Stunnel. Stunnel is supposed to unencrypt and send to backend application unencrypted, however no traffic is sent. I have used wireshark and I do see the client hello for tls1.2 and the server hello for tls 1.2 so the cipher negotiation is completed. Here is my config: sslVersionMax = TLSv1.2 options = -NO_SSLv3 [https] accept = 27015 connect = 27001 cert = cert.pem key = key.pem TIMEOUTclose = 0 STunnel Log in Debug 7 2023.01.13 14:03:42 LOG7[16572]: Service [https] started 2023.01.13 14:03:42 LOG7[16572]: Setting local socket options (FD=1888) 2023.01.13 14:03:42 LOG7[16572]: Option TCP_NODELAY set on local socket 2023.01.13 14:03:42 LOG5[16572]: Service [https] accepted connection from xx.xx.xx.xx:62478 2023.01.13 14:03:42 LOG6[16572]: Peer certificate not required 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): before SSL initialization 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): before SSL initialization 2023.01.13 14:03:42 LOG7[16572]: Decrypt session ticket callback 2023.01.13 14:03:42 LOG7[16572]: Initializing application specific data for session authenticated 2023.01.13 14:03:42 LOG7[16572]: SNI: no virtual services defined 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS read client hello 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write server hello 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write certificate 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write key exchange 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write server done 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write server done 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS read client key exchange 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS read change cipher spec 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS read finished 2023.01.13 14:03:42 LOG7[16572]: Generate session ticket callback 2023.01.13 14:03:42 LOG7[16572]: Initializing application specific data for session authenticated 2023.01.13 14:03:42 LOG7[16572]: Deallocating application specific data for session connect address 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write session ticket 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write change cipher spec 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write finished 2023.01.13 14:03:42 LOG7[16572]: 33 server accept(s) requested 2023.01.13 14:03:42 LOG7[16572]: 33 server accept(s) succeeded 2023.01.13 14:03:42 LOG7[16572]: 0 server renegotiation(s) requested 2023.01.13 14:03:42 LOG7[16572]: 0 session reuse(s) 2023.01.13 14:03:42 LOG7[16572]: 1 internal session cache item(s) 2023.01.13 14:03:42 LOG7[16572]: 0 internal session cache fill-up(s) 2023.01.13 14:03:42 LOG7[16572]: 0 internal session cache miss(es) 2023.01.13 14:03:42 LOG7[16572]: 0 external session cache hit(s) 2023.01.13 14:03:42 LOG7[16572]: 0 expired session(s) retrieved 2023.01.13 14:03:42 LOG6[16572]: TLS accepted: new session negotiated 2023.01.13 14:03:42 LOG6[16572]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2023.01.13 14:03:42 LOG3[16572]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2023.01.13 14:03:42 LOG7[16572]: Compression: null, expansion: null 2023.01.13 14:03:42 LOG7[16572]: Deallocating application specific data for session connect address 2023.01.13 14:03:42 LOG6[16572]: s_connect: connecting 127.0.0.1:27001 2023.01.13 14:03:42 LOG7[16572]: s_connect: s_poll_wait 127.0.0.1:27001: waiting 10 seconds 2023.01.13 14:03:42 LOG7[16572]: FD=1472 ifds=rwx ofds=--- 2023.01.13 14:03:42 LOG5[16572]: s_connect: connected 127.0.0.1:27001 2023.01.13 14:03:42 LOG6[16572]: persistence: 127.0.0.1:27001 cached 2023.01.13 14:03:42 LOG5[16572]: Service [https] connected remote server from 127.0.0.1:56732 2023.01.13 14:03:42 LOG7[16572]: Setting remote socket options (FD=1472) 2023.01.13 14:03:42 LOG7[16572]: Option TCP_NODELAY set on remote socket 2023.01.13 14:03:42 LOG7[16572]: Remote descriptor (FD=1472) initialized 2023.01.13 14:03:42 LOG6[16572]: SSL_read: Socket is closed 2023.01.13 14:03:42 LOG6[16572]: TLS socket closed (SSL_read) 2023.01.13 14:03:42 LOG7[16572]: Sent socket write shutdown 2023.01.13 14:03:42 LOG5[16572]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.01.13 14:03:42 LOG7[16572]: Remote descriptor (FD=1472) closed 2023.01.13 14:03:42 LOG7[16572]: Local descriptor (FD=1888) closed 2023.01.13 14:03:42 LOG7[16572]: Service [https] finished (1 left) Any assistance you can provide would be glorious! _________________________________ Gary Jackson

2 1

Setup and Installing stunnel on windows wsl2 Ubuntu
by adamsaltlake＠hotmail.com 25 Nov '22

25 Nov '22

I am new to stunnel and have been struggling for weeks to get it to work on windows wsl2 ubuntu; it keep failing with pid error "You should check that you have specified the pid= in you configuration file" any idea is welcome

1 0

Self signed certificate check
by Bob Bob 20 Nov '22

20 Nov '22

Hi, I have two Windows based stations with one hosting a specific service. Stunnel is used to create a secure connection. As stated on the auth page, I have implemented PSK to prevent MITM Attack but also as a way to authenticate connections and limit who can connect to the server. I would like to add an extra layer of security by having the Server only accept connections when the client submits a pre-agreed self cert. verifyPeer does not seem to work with self certificate. I would like to end up with PSK + certificate check. Is there a way to achieve that with self certificate on Stunnel? Thanks.

1 0

Windows 10 Pro - StartService: error 1053
by jason99si＠gmail.com 11 Nov '22

11 Nov '22

I'm installing stunnel for a second time. I'm using it for Blue Iris on a Windows 10 Pro machine. I'm using stunnel 5.67 on Win64. GUI shows "Configuration successful". I've tried uninstalling and reinstalling numerous times. When I run stunnel Service Start I receive a dialog box that says: stunnel 5.67 on Win64 (not configured) StartService: error 1053: The service did not respond to the start or control request in a timely fashion Can anyone help?

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users