- stunnel-users - stunnel.org

Connection reset: (maybe the wrong forum)
by Per Gunnarsson 15 Jan '20

15 Jan '20

Hello! I have tried to stream to an icecast server through stunnel usung liquidsoap. Somewhere the stream gets stuck. I want to where. Maybe I should have posted this on the Tor mailing list first, since the traffic is forwarded through Tor. But before the stream went to Tor, it went through stunnel. The liquidsoap snippet which tries to stream (password,mount name, stream description and stream name modified: output.external(id="Tor", fallible=true, reopen_delay=3.0, %vorbis(quality=0.4 , samplerate=48000, channels=2), "/usr/bin/oggfwd -n streamname -d 'stream description' localhost 9887 password /mount", mksafe(buffer(full))) I had a script which was supposed to pick up this stream and forward it on a cloud server (passwords etc. modified): #!/bin/bash /usr/bin/curl -V http://localhost:9887/mount | \ /usr/bin/torsocks /usr/bin/oggfwd -n streamname -d 'stream description' superdupersecret.onion 8000 password /mount #/usr/bin/curl -T - -s --socks5 localhost:9050 http://superdupersecret.onion/mount exec "/home/per/bin/test.sh" stunnel.conf on cloud: setuid = stunnel4 setgid = stunnel4 ; PID file is created inside the chroot jail (if enabled) pid = /var/run/stunnel4/stunnel.pid ; Debugging stuff (may be useful for troubleshooting) ;foreground = yes debug = info output = /var/log/stunnel4/stunnel.log [liquidsoap-client] client = yes accept = localhost:8081 connect = mustafejen.se:9998 PSKsecrets = /etc/stunnel/secrets.txt [hequidtor-client] connect = localhost:9050 accept = 95.216.184.255:9888 PSKsecrets = /etc/stunnel/secrets.txt [Deep Web Radio In] client = yes accept = 95.216.184.255:9887 connect = localhost:9050 PSKsecrets = /etc/stunnel/secrets.txt stunnel.conf in my living room: setuid = stunnel4 setgid = stunnel4 ; PID file is created inside the chroot jail (if enabled) pid = /var/run/stunnel4/stunnel.pid ; Debugging stuff (may be useful for troubleshooting) ;foreground = yes debug = info output = /var/log/stunnel4/stunnel.log [liquidsoap-server] ;client = yes connect = mustafejen.se:8081 accept = mustafejen.se:9998 PSKsecrets = /etc/stunnel/secrets.txt [hequidtor-server] client = yes accept = localhost:9888 connect = 95.216.184.255:9888 PSKsecrets = /etc/stunnel/secrets.txt [Deep Web Radio Out] accept = localhost:9887 connect = 95.216.184.255:9887 PSKsecrets = /etc/stunnel/secrets.txt Log file from cloud: 2020.01.15 06:25:01 LOG5[main]: Log file reopened 2020.01.15 10:29:22 LOG5[main]: Terminated 2020.01.15 10:29:22 LOG5[ui]: stunnel 5.44 on x86_64-pc-linux-gnu platform 2020.01.15 10:29:22 LOG5[ui]: Compiled with OpenSSL 1.1.0g 2 Nov 2017 2020.01.15 10:29:22 LOG5[ui]: Running with OpenSSL 1.1.1 11 Sep 2018 2020.01.15 10:29:22 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2020.01.15 10:29:22 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2020.01.15 10:29:22 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2020.01.15 10:29:22 LOG5[ui]: UTF-8 byte order mark detected 2020.01.15 10:29:22 LOG5[ui]: FIPS mode disabled 2020.01.15 10:29:22 LOG6[ui]: Initializing service [liquidsoap-client] 2020.01.15 10:29:23 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:29:23 LOG6[ui]: Initializing service [hequidtor-client] 2020.01.15 10:29:23 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:29:23 LOG6[ui]: Using dynamic DH parameters 2020.01.15 10:29:23 LOG6[ui]: Initializing service [Deep Web Radio In] 2020.01.15 10:29:23 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:29:23 LOG5[ui]: Configuration successful Log file from my living room: 2020.01.15 10:20:13 LOG5[ui]: stunnel 5.56 on x86_64-pc-linux-gnu platform 2020.01.15 10:20:13 LOG5[ui]: Compiled/running with OpenSSL 1.1.1d 10 Sep 2019 2020.01.15 10:20:13 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2020.01.15 10:20:13 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2020.01.15 10:20:13 LOG5[ui]: UTF-8 byte order mark detected 2020.01.15 10:20:13 LOG5[ui]: FIPS mode disabled 2020.01.15 10:20:13 LOG6[ui]: PSKsecrets line 1: 40-byte ASCII key configured for identity "per" 2020.01.15 10:20:13 LOG6[ui]: Initializing service [liquidsoap-server] 2020.01.15 10:20:13 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:20:13 LOG6[ui]: DH initialization not needed 2020.01.15 10:20:13 LOG6[ui]: PSKsecrets line 1: 40-byte ASCII key configured for identity "per" 2020.01.15 10:20:13 LOG6[ui]: Initializing service [hequidtor-server] 2020.01.15 10:20:13 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:20:13 LOG6[ui]: PSKsecrets line 1: 40-byte ASCII key configured for identity "per" 2020.01.15 10:20:13 LOG6[ui]: Initializing service [Deep Web Radio Out] 2020.01.15 10:20:13 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:20:13 LOG6[ui]: DH initialization not needed 2020.01.15 10:20:13 LOG5[ui]: Configuration successful 2020.01.15 10:20:13 LOG6[ui]: Service [liquidsoap-server] (FD=9) bound to 10.0.0.6:9998 2020.01.15 10:20:13 LOG6[ui]: Service [hequidtor-server] (FD=10) bound to ::1:9888 2020.01.15 10:20:13 LOG6[ui]: Service [hequidtor-server] (FD=11) bound to 127.0.0.1:9888 2020.01.15 10:20:13 LOG6[ui]: Service [Deep Web Radio Out] (FD=12) bound to ::1:9887 2020.01.15 10:20:13 LOG6[ui]: Service [Deep Web Radio Out] (FD=13) bound to 127.0.0.1:9887 2020.01.15 10:20:13 LOG6[cron]: Executing cron jobs 2020.01.15 10:20:13 LOG6[cron]: Cron jobs completed in 0 seconds 2020.01.15 10:32:56 LOG5[0]: Service [Deep Web Radio Out] accepted connection from ::1:44732 2020.01.15 10:32:56 LOG6[0]: Peer certificate not required 2020.01.15 10:32:56 LOG3[0]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 10:32:56 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:32:56 LOG5[1]: Service [Deep Web Radio Out] accepted connection from ::1:44734 2020.01.15 10:32:56 LOG6[1]: Peer certificate not required 2020.01.15 10:32:56 LOG3[1]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 10:32:56 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:32:56 LOG5[2]: Service [Deep Web Radio Out] accepted connection from ::1:44736 2020.01.15 10:32:56 LOG6[2]: Peer certificate not required 2020.01.15 10:32:56 LOG3[2]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 10:32:56 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:33:44 LOG5[3]: Service [Deep Web Radio Out] accepted connection from ::1:44760 2020.01.15 10:33:44 LOG6[3]: Peer certificate not required 2020.01.15 10:33:44 LOG3[3]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 10:33:44 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:33:44 LOG5[4]: Service [Deep Web Radio Out] accepted connection from ::1:44762 2020.01.15 10:33:44 LOG6[4]: Peer certificate not required 2020.01.15 10:33:44 LOG3[4]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 10:33:44 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:33:44 LOG5[5]: Service [Deep Web Radio Out] accepted connection from ::1:44764 2020.01.15 10:33:44 LOG6[5]: Peer certificate not required 2020.01.15 10:33:44 LOG3[5]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 10:33:44 LOG5[5]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:34:50 LOG5[6]: Service [Deep Web Radio Out] accepted connection from ::1:44788 2020.01.15 10:34:50 LOG6[6]: Peer certificate not required 2020.01.15 10:34:50 LOG3[6]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 10:34:50 LOG5[6]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:34:50 LOG5[7]: Service [Deep Web Radio Out] accepted connection from ::1:44790 2020.01.15 10:34:50 LOG6[7]: Peer certificate not required 2020.01.15 10:34:50 LOG3[7]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 10:34:50 LOG5[7]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:34:50 LOG5[8]: Service [Deep Web Radio Out] accepted connection from ::1:44792 2020.01.15 10:34:50 LOG6[8]: Peer certificate not required 2020.01.15 10:34:50 LOG3[8]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 10:34:50 LOG5[8]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:48:17 LOG5[9]: Service [Deep Web Radio Out] accepted connection from ::1:44854 2020.01.15 10:48:17 LOG6[9]: Peer certificate not required 2020.01.15 10:48:17 LOG3[9]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:48:17 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:48:17 LOG5[10]: Service [Deep Web Radio Out] accepted connection from ::1:44856 2020.01.15 10:48:17 LOG6[10]: Peer certificate not required 2020.01.15 10:48:17 LOG3[10]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:48:17 LOG5[10]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:48:32 LOG5[11]: Service [Deep Web Radio Out] accepted connection from ::1:44858 2020.01.15 10:48:32 LOG6[11]: Peer certificate not required 2020.01.15 10:48:32 LOG3[11]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:48:32 LOG5[11]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:48:32 LOG5[12]: Service [Deep Web Radio Out] accepted connection from ::1:44860 2020.01.15 10:48:32 LOG6[12]: Peer certificate not required 2020.01.15 10:48:32 LOG3[12]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:48:32 LOG5[12]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:49:01 LOG5[13]: Service [Deep Web Radio Out] accepted connection from ::1:44864 2020.01.15 10:49:01 LOG6[13]: Peer certificate not required 2020.01.15 10:49:01 LOG3[13]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:49:01 LOG5[13]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:49:01 LOG5[14]: Service [Deep Web Radio Out] accepted connection from ::1:44866 2020.01.15 10:49:01 LOG6[14]: Peer certificate not required 2020.01.15 10:49:01 LOG3[14]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:49:01 LOG5[14]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:57:28 LOG5[15]: Service [Deep Web Radio Out] accepted connection from ::1:44914 2020.01.15 10:57:28 LOG6[15]: Peer certificate not required 2020.01.15 10:57:28 LOG3[15]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 10:57:28 LOG5[15]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:57:28 LOG5[16]: Service [Deep Web Radio Out] accepted connection from ::1:44916 2020.01.15 10:57:28 LOG6[16]: Peer certificate not required 2020.01.15 10:57:28 LOG3[16]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 10:57:28 LOG5[16]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:57:28 LOG5[17]: Service [Deep Web Radio Out] accepted connection from ::1:44918 2020.01.15 10:57:28 LOG6[17]: Peer certificate not required 2020.01.15 10:57:28 LOG3[17]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 10:57:28 LOG5[17]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:24:24 LOG5[18]: Service [Deep Web Radio Out] accepted connection from ::1:45012 2020.01.15 11:24:24 LOG6[18]: Peer certificate not required 2020.01.15 11:24:24 LOG3[18]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:24:24 LOG5[18]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:24:24 LOG5[19]: Service [Deep Web Radio Out] accepted connection from ::1:45014 2020.01.15 11:24:24 LOG6[19]: Peer certificate not required 2020.01.15 11:24:24 LOG3[19]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:24:24 LOG5[19]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:24:24 LOG5[20]: Service [Deep Web Radio Out] accepted connection from ::1:45016 2020.01.15 11:24:24 LOG6[20]: Peer certificate not required 2020.01.15 11:24:24 LOG3[20]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:24:24 LOG5[20]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:25:16 LOG5[21]: Service [Deep Web Radio Out] accepted connection from ::1:45038 2020.01.15 11:25:16 LOG6[21]: Peer certificate not required 2020.01.15 11:25:16 LOG3[21]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:25:16 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:25:16 LOG5[22]: Service [Deep Web Radio Out] accepted connection from ::1:45040 2020.01.15 11:25:16 LOG6[22]: Peer certificate not required 2020.01.15 11:25:16 LOG3[22]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:25:16 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:25:16 LOG5[23]: Service [Deep Web Radio Out] accepted connection from ::1:45042 2020.01.15 11:25:16 LOG6[23]: Peer certificate not required 2020.01.15 11:25:16 LOG3[23]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:25:16 LOG5[23]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:28:38 LOG5[24]: Service [Deep Web Radio Out] accepted connection from ::1:45070 2020.01.15 11:28:38 LOG6[24]: Peer certificate not required 2020.01.15 11:28:38 LOG3[24]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:28:38 LOG5[24]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:28:38 LOG5[25]: Service [Deep Web Radio Out] accepted connection from ::1:45072 2020.01.15 11:28:38 LOG6[25]: Peer certificate not required 2020.01.15 11:28:38 LOG3[25]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:28:38 LOG5[25]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:28:38 LOG5[26]: Service [Deep Web Radio Out] accepted connection from ::1:45074 2020.01.15 11:28:38 LOG6[26]: Peer certificate not required 2020.01.15 11:28:38 LOG3[26]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:28:38 LOG5[26]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:30:06 LOG5[27]: Service [Deep Web Radio Out] accepted connection from ::1:45096 2020.01.15 11:30:06 LOG6[27]: Peer certificate not required 2020.01.15 11:30:06 LOG3[27]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:30:06 LOG5[27]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:30:06 LOG5[28]: Service [Deep Web Radio Out] accepted connection from ::1:45098 2020.01.15 11:30:06 LOG6[28]: Peer certificate not required 2020.01.15 11:30:06 LOG3[28]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:30:06 LOG5[28]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:30:06 LOG5[29]: Service [Deep Web Radio Out] accepted connection from ::1:45100 2020.01.15 11:30:06 LOG6[29]: Peer certificate not required 2020.01.15 11:30:06 LOG3[29]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:30:06 LOG5[29]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:32:34 LOG5[30]: Service [Deep Web Radio Out] accepted connection from ::1:45136 2020.01.15 11:32:34 LOG6[30]: Peer certificate not required 2020.01.15 11:32:34 LOG3[30]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:32:34 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:32:34 LOG5[31]: Service [Deep Web Radio Out] accepted connection from ::1:45138 2020.01.15 11:32:34 LOG6[31]: Peer certificate not required 2020.01.15 11:32:34 LOG3[31]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:32:34 LOG5[31]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:32:34 LOG5[32]: Service [Deep Web Radio Out] accepted connection from ::1:45140 2020.01.15 11:32:34 LOG6[32]: Peer certificate not required 2020.01.15 11:32:34 LOG3[32]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:32:34 LOG5[32]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

1 0

stunnel5 to stunnel4 not work
by Tu, Robin 15 Jan '20

15 Jan '20

I'm working on openvpn over stunnel. My configuration can work with windows and linux. both are stunnel4. But it never work out in android. I have ubuntu18.04 and set as stunnel4 server side. I try to get connected with android stunnel: SSLSocks<https://github.com/comp500/SSLSocks/releases/tag/0.0.17-beta>, which should be compiled with stunnel5. It simply not work. I got "NETWORK_EOF_ERROR" time to time. If I remove stunnel tunnel, it will just work. So I think it's stunnel5 to stunnel4 issue. But how to avaoid such issue? Best Regards Robin

1 0

How to start stunnel4 service directly after installation, without reboot
by Tu, Robin 15 Jan '20

15 Jan '20

I'm testing openvpn over stunnel4 and I found a weird issue: I have to restart my Ubuntu 18.04 to be able to start the stunnel service. Don't know why I couldn't start the service dicrectly by : Systemctl start stunnel4 OS: Ubuntu 18.04 #>apt install stunnel4 and generate a conf like this: cert=/etc/stunnel/server.crt key=/etc/stunnel/server.key [openvpn-localhost] accept = 8443 connect = 127.0.0.1:11000 Now start the service: #>systemctl start stunnel4 #>systemctl status stunnel4 stunnel4.service - LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons) Loaded: loaded (/etc/init.d/stunnel4; generated) Active: active (exited) since Wed 2020-01-15 14:40:11 CST; 10min ago Docs: man:systemd-sysv-generator(8) Tasks: 0 (limit: 4915) CGroup: /system.slice/stunnel4.service Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ systemd[1]: Starting LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)... Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ stunnel4[3583]: TLS tunnels disabled, see /etc/default/stunnel4 Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ systemd[1]: Started LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons). Why it exited? But after reboot, same command will just work. Is it a bug? I want to find a way to start it directly after installation. Please help! Best Regards Robin

1 0

Cannot stop pcs cluster service when stunnel server process start
by d500man 09 Jan '20

09 Jan '20

Dear Support, For captioned, I adopted stunnel server and client socket protection in pcs cluster. I want to stop pacemaker cluster service by command "pcs cluster stop --all" and stop master node in master node servet but the down process is hang up when stunnel server process started, could you help to tell me what's problem and how to fix this problem? Best regards Tony

1 0

stunnel4-5.50 start failed
by Hanhan lee 27 Dec '19

27 Dec '19

I compiled stunnel4-5.50 with openssl 1.1.1d. When I run stunnel, it will print some messages and stop: [ ] Clients allowed=500 [.] stunnel 5.50 on arm-none-linux-gnueabi platform [.] Compiled/running with OpenSSL 1.1.1d 10 Sep 2019 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /conf/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [adviserd] [ ] Ciphers: AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM [ ] TLS options: 0x02104004 (+0x00004000, -0x00000000) [ ] Loading certificate from file: /conf/certs/server.pem [ ] Certificate loaded from file: /conf/certs/server.pem [ ] Loading private key from file: /conf/certs/privkey.pem [:] Insecure file permissions on /conf/certs/privkey.pem [ ] Private key loaded from file: /conf/certs/privkey.pem [ ] Private key check succeeded [ ] DH initialization needed for DHE-PSK-CHACHA20-POLY1305 [ ] DH initialization [ ] Could not load DH parameters from /conf/certs/server.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [.] Configuration successful [ ] Binding service [adviserd] [ ] Listening file descriptor created (FD=8) [ ] Setting accept socket options (FD=8) [ ] Option SO_REUSEADDR set on accept socket [ ] Option TCP_NODELAY set on accept socket [ ] Service [adviserd] (FD=8) bound to :::7582 [!] Cannot open log file: /var/log/stunnel.log [ ] Deallocating section defaults [ ] Unbinding service [adviserd] [ ] Service [adviserd] closed (FD=8) [ ] Service [adviserd] closed [ ] Deallocating section [adviserd] I have no idea what's wrong with this, help! Many thanks

3 2

Re: [stunnel-users] My home ISP blocking ssh protocol
by Eric Eberhard 13 Dec '19

13 Dec '19

Ditto. Eric -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Mike Sent: Thursday, December 12, 2019 9:08 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] My home ISP blocking ssh protocol On 12/11/2019 5:53 PM, Matt Thomas wrote: > Hello:) > >[snip > > All i am trying to do is have a SFTP server that i can access my dang >files from while i am at school, work, friends house, library or >wherever. >[snip] I run a ssh server on my home network. I configure it to use a port other than port 22. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel-5.55 client close TLS socket before it could read more bytes
by Ming Lu 13 Dec '19

13 Dec '19

Hello, May I please have help on this issue? Thanks in advance! I had a stunnel server and client communicating with TLSv1.2 (both of them are stunnel 5.55 and OpenSSL-1.1.1d) on CentOS 7 based Linux (kernel was updated as 4.19.0). The case is that client sends a HTTP request to server, and then server responds a payload with more than 640KB size. Normally, the server will close the connection by sending an alert firstly. The issue is that sometimes (not 100% reproducible), stunnel client reported: "TLS socket closed (read hangup)". and then closed the TLS socket. So I could find an alert sent from client to server firstly from tcpdump. Consequently, this caused the application reported "unexpected end of input?" as there should be more data to be received. I added a few debug logic and I indeed found that: there were occurrences that if stunnel client did not close the TLS socket, it could read more data from TLS socket in next poll loop: -------------------- 03:59:46 localhost stunnel: LOG6[0]: MingL: POLLRDHUP: 8192 03:59:46 localhost stunnel: LOG6[0]: MingL: ioctlsocket: 0 03:59:46 localhost stunnel: LOG6[0]: MingL: bytes: 0 <== client didn't close the sock in my debug version. 03:59:46 localhost stunnel: LOG6[0]: MingL: after checking 03:59:46 localhost stunnel: LOG6[0]: MingL: s_poll_wait: return 1 03:59:46 localhost stunnel: LOG6[0]: MingL: sock_can_rd: n 03:59:46 localhost stunnel: LOG6[0]: MingL: sock_can_wr: Y 03:59:46 localhost stunnel: LOG6[0]: MingL: ssl_can_rd: n 03:59:46 localhost stunnel: LOG6[0]: MingL: ssl_can_wr: n 03:59:46 localhost stunnel: LOG6[0]: MingL: pending: 1 03:59:46 localhost stunnel: LOG6[0]: MingL: write to sock 18432 03:59:46 localhost stunnel: LOG6[0]: MingL: read_wants_read Y 03:59:46 localhost stunnel: LOG6[0]: MingL: write_wants_writen 03:59:46 localhost stunnel: LOG6[0]: MingL: read from TLS 10168 <== then I observed the further read from TLS. -------------------- Any help will be appreciated! Ming

1 0

Re: [stunnel-users] My home ISP blocking ssh protocol
by Christopher Schultz 12 Dec '19

12 Dec '19

Matt, On 12/12/19 13:43, Matt Thomas wrote: > Not sure if you have read the first post, or maybe i didnt add it, but i > have tried port 22,5022,8022, 25565, 47506 and 443 haha. It wasn't clear if you were changing the port number of the sshd service (on your server) or the port you had open on your firewall/router. I suspect that your ISP is blocking incoming connections to port 22. The port number you use for sshd on the server is not relevant. -chris > On Thu, Dec 12, 2019, 9:44 AM Christopher Schultz > <chris(a)christopherschultz.net <mailto:chris@christopherschultz.net>> wrote: > > Matt, > > On 12/12/19 11:01, Matt Thomas wrote: > > Server is 192.168.0.10 > > Router is 192.168.0.1 > > > > It works fine internally:) > > > > I add a port forward in the router for port 22 pointed at .0.10. > Routers > > firewall all ready is configured to accept ssh on port 22 from any > any. > > > > When ever anyone attempts to connect to the server, a pop up shows > on my > > screen. When i try to have my friends or co-workers try from there > house > > or i try from public place, no pop up or hits on the server log. Just > > times out. > > > > But if i put minecraft on port 22, it works. So certain traffic is > > making it through. Even hamachi vpn works fine BUT i cant install that > > on public PC's haha > > I was about to say "this is clearly an issue with the port number, pick > something other than 22" but if you say you can run Minecraft over port > 22, then that's ... strange. > > I wasn't aware that Minecraft servers could have their ports changed > like that. You can really set up your Minecraft server to listen on > localhost:22 and it doesn't use UPnP or anything like that to > reconfigure your firewall/router? > > My advice is to try configuring things like this: > > Router: 192.168.0.1 > Forward WAN connections to port e.g. 1022 -> 192.168.0.10:1022 > <http://192.168.0.10:1022> > > Server: 192.68.0.1 > Accept stunnel connections on port 1022 > accept=:1022 > connect=localhost:22 > > If that works, I might even try just changing the port number of your > ssh/sftp service from the "standard" port to something else and trying > again without stunnel in the mix. > > I've never encountered an ISP which does deep packet inspection to block > services. They usually just block ports. > > -chris > > > On Thu, Dec 12, 2019, 7:58 AM Christopher Schultz > > <chris(a)christopherschultz.net > <mailto:chris@christopherschultz.net> > <mailto:chris@christopherschultz.net > <mailto:chris@christopherschultz.net>>> wrote: > > > > Matt, > > > > On 12/11/19 17:53, Matt Thomas wrote: > > > I need to know if Stunnel is going to accomplish what i need > to do. My > > > home ISP blocks protocol HTTP and SSH from coming in so that > > people cant > > > run their own website from home without paying the ISP for a > > "Business" line > > > > > > All i am trying to do is have a SFTP server that i can > access my dang > > > files from while i am at school, work, friends house, library or > > > wherever. I have tried ssh on multiple random ports and made > sure all > > > firewall rules and port forward rules were correct in my home > > router. I > > > know they work because i even went as far as setting up a > minecraft > > > server to just test the port forward rules out and sure > enough, my > > > friend 200 miles away can connect just fine to my home minecraft > > > server.. But he can not connect to the ssh server. No logs > are ever > > > created on the server either because something is stoping > the packet > > > from even hitting my router, that something is my ISP > > > > > > Would stunnel allow me to make ssh traffic look like regular > https > > > traffic, thus allowing me to connect to my server at home so > i can > > do my > > > homework?? > > > > Those other servers probably use TLS or plaintext connections. > stunnel > > uses TLS, but ssh/sftp use a slightly different protocol that may > > possibly be distinguishable by a determined ISP. > > > > I would think that using stunnel to tunnel SFTP/SSH would be > possible, > > though not strictly necessary. I suspect some other problem is > > preventing you from succeeding. > > > > Can you be more specific about exactly what you did for > configuration? > > Port numbers, specific things you did, etc? You don't have to > disclose > > your public IP address, but perhaps give the local IPs of your > router > > and home server, etc? > > > > -chris > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> > <mailto:stunnel-users@stunnel.org <mailto:stunnel-users@stunnel.org>> > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

Re: [stunnel-users] My home ISP blocking ssh protocol
by Christopher Schultz 12 Dec '19

12 Dec '19

Matt, On 12/12/19 11:01, Matt Thomas wrote: > Server is 192.168.0.10 > Router is 192.168.0.1 > > It works fine internally:) > > I add a port forward in the router for port 22 pointed at .0.10. Routers > firewall all ready is configured to accept ssh on port 22 from any any. > > When ever anyone attempts to connect to the server, a pop up shows on my > screen. When i try to have my friends or co-workers try from there house > or i try from public place, no pop up or hits on the server log. Just > times out. > > But if i put minecraft on port 22, it works. So certain traffic is > making it through. Even hamachi vpn works fine BUT i cant install that > on public PC's haha I was about to say "this is clearly an issue with the port number, pick something other than 22" but if you say you can run Minecraft over port 22, then that's ... strange. I wasn't aware that Minecraft servers could have their ports changed like that. You can really set up your Minecraft server to listen on localhost:22 and it doesn't use UPnP or anything like that to reconfigure your firewall/router? My advice is to try configuring things like this: Router: 192.168.0.1 Forward WAN connections to port e.g. 1022 -> 192.168.0.10:1022 Server: 192.68.0.1 Accept stunnel connections on port 1022 accept=:1022 connect=localhost:22 If that works, I might even try just changing the port number of your ssh/sftp service from the "standard" port to something else and trying again without stunnel in the mix. I've never encountered an ISP which does deep packet inspection to block services. They usually just block ports. -chris > On Thu, Dec 12, 2019, 7:58 AM Christopher Schultz > <chris(a)christopherschultz.net <mailto:chris@christopherschultz.net>> wrote: > > Matt, > > On 12/11/19 17:53, Matt Thomas wrote: > > I need to know if Stunnel is going to accomplish what i need to do. My > > home ISP blocks protocol HTTP and SSH from coming in so that > people cant > > run their own website from home without paying the ISP for a > "Business" line > > > > All i am trying to do is have a SFTP server that i can access my dang > > files from while i am at school, work, friends house, library or > > wherever. I have tried ssh on multiple random ports and made sure all > > firewall rules and port forward rules were correct in my home > router. I > > know they work because i even went as far as setting up a minecraft > > server to just test the port forward rules out and sure enough, my > > friend 200 miles away can connect just fine to my home minecraft > > server.. But he can not connect to the ssh server. No logs are ever > > created on the server either because something is stoping the packet > > from even hitting my router, that something is my ISP > > > > Would stunnel allow me to make ssh traffic look like regular https > > traffic, thus allowing me to connect to my server at home so i can > do my > > homework?? > > Those other servers probably use TLS or plaintext connections. stunnel > uses TLS, but ssh/sftp use a slightly different protocol that may > possibly be distinguishable by a determined ISP. > > I would think that using stunnel to tunnel SFTP/SSH would be possible, > though not strictly necessary. I suspect some other problem is > preventing you from succeeding. > > Can you be more specific about exactly what you did for configuration? > Port numbers, specific things you did, etc? You don't have to disclose > your public IP address, but perhaps give the local IPs of your router > and home server, etc? > > -chris > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

My home ISP blocking ssh protocol
by Matt Thomas 12 Dec '19

12 Dec '19

Hello:) I need to know if Stunnel is going to accomplish what i need to do. My home ISP blocks protocol HTTP and SSH from coming in so that people cant run their own website from home without paying the ISP for a "Business" line All i am trying to do is have a SFTP server that i can access my dang files from while i am at school, work, friends house, library or wherever. I have tried ssh on multiple random ports and made sure all firewall rules and port forward rules were correct in my home router. I know they work because i even went as far as setting up a minecraft server to just test the port forward rules out and sure enough, my friend 200 miles away can connect just fine to my home minecraft server.. But he can not connect to the ssh server. No logs are ever created on the server either because something is stoping the packet from even hitting my router, that something is my ISP Would stunnel allow me to make ssh traffic look like regular https traffic, thus allowing me to connect to my server at home so i can do my homework?? thanks -- My history test question: Give the number of automobiles produced in America during the year of your choice. My answer? 1806: none Matt Thomas GrillofMyDreams.blogspot.com http://slcc.biz.tm

3 2