- stunnel-users - stunnel.org

Stunnel 5.51 Pop3 Problem?
by Colin 07 Apr '19

07 Apr '19

Hello, I'm new to this list and looking for advice/help with release 5.51 for Windows. I have three accounts, Yahoo, Aol and Gmx and I use Foxmail 5 with Stunnel. I use pop3 with all accounts and sometimes when retrieving mail I may decide to 'Not Fetch' any mail on the server that looks 'iffy' untill I've looked at it via the mail providers website. Now I've just upgraded to version 5.51 (over 5.50) and when checking any of the said accounts I can't see any mail that hasn't been fetched (the server looks empty.) But if I login to the mail website the unfetched mail is there to view for all accounts. I reverted to version 5.50 and now I can see the unfetched mail for all accounts in my 3rd party software. Therefore my question is: Is there a problem (bug??) with 5.51 which stops me from seeing unfetched pop3 mail or do I have to add something to the config file to make it work properly? Thanks...Colin

1 0

Re: [stunnel-users] V5.51 no support for OpenSSL 1.0.2 ?
by Peter Pentchev 05 Apr '19

05 Apr '19

On Fri, Apr 05, 2019 at 01:39:04PM +0000, Duncan Morris wrote: > Hi, > > The latest version of options.c, in the V5.51 source, uses a new function, which appears to only be present in OpenSSL 1.1.0 onwards. > > key_buf=OPENSSL_hexstr2buf(key_str, &key_len); > > Is it intentional that support for OpenSSL 1.0.2 has been dropped? But there is also this segment of code... #else /* OpenSSL older than 1.1.0 */ #define X509_STORE_CTX_get0_chain(x) X509_STORE_CTX_get_chain(x) #define OPENSSL_hexstr2buf string_to_hex #endif /* OpenSSL 1.1.0 or newer */ So it should build with OpenSSL 1.0.2, too. Have you actually experienced problems building it? G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Is there a Win32 installer that supports sslVersionMin = TLS1.2?
by kent loving 01 Apr '19

01 Apr '19

I need to run a client on Win XP that connects to a server using TLS 1.2 or higher. Jose Alf posted that he made a test build of 5.50 in a win32 installer but uses OpenSSL 1.0.2p. And it does not seem to be official. The changelog says version 5.49, which has a win32 installer, also uses OpenSSL 1.0.2p. I can't tell if it supports TLS1.2. The man page implies I need OpenSSL 1.1.1 to get the sslVersionMin option. And, OpenSSL says v1.0.2 support ends in 9 months. Any advice is appreciated. Thanks, Kent Loving

3 2

OpenVPN with stunnel
by Heikki Lavaste 25 Mar '19

25 Mar '19

Hi, To bypass the office firewall to access home server, I'm trying to run openvpn over port 443 with stunnel. I managed to get to this point: Log on client side 2019.03.22 22:15:13 LOG5[38]: Connection closed: 352 byte(s) sent to TLS, 2067 byte(s) sent to socket 2019.03.22 22:15:19 LOG5[39]: Service [openvpn] accepted connection from 127.0.0.1:51265 2019.03.22 22:15:19 LOG5[39]: s_connect: connected x.x.x.x:443 2019.03.22 22:15:19 LOG5[39]: Service [openvpn] connected remote server from x.x.x.x:51266 2019.03.22 22:15:19 LOG5[39]: Connection closed: 352 byte(s) sent to TLS, 2067 byte(s) sent to socket Log on server side: Mar 22 22:21:54 ssh-server-heikki stunnel[2797]: LOG5[2797:140127128753920]: connect_blocking: connected 127.0.0.1:8443 Mar 22 22:21:54 ssh-server-heikki stunnel[2797]: LOG5[2797:140127128753920]: Service [openvpn] connected remote server from 127.0.0.1:49366 Mar 22 22:21:54 ssh-server-heikki stunnel[2797]: LOG5[2797:140127128753920]: Connection closed: 2067 byte(s) sent to SSL, 352 byte(s) sent to socket Config: Client [openvpn] client = yes accept = localhost:1337 connect = x.x.x.xg:443 cert = C:\Users\heikki_lavaste\Documents\stunnel\stunnel.pem verifyChain = yes verify = 2 CAfile = C:\Users\heikki_lavaste\Documents\stunnel\ca-cert.pem checkHost = stunnel.heikki-lab.local sslVersion = TLSv1 Server chroot = /var/run/stunnel sslVersion = TLSv1 pid = /stunnel.pid setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = /etc/stunnel/stunnel.pem [openvpn] accept = 443 connect = localhost:8443 cert = /etc/stunnel/stunnel.pem The issue is probably nothing to do with stunnel but if somebody can help me figure this out, that'd be appreciated. Kind Regards Heikki

2 1

ERR_SSL_VERSION_INTERFERENCE on Google Chrome v 73.0.3683.86 and stunnel v5.51b1
by Kolan Koala 25 Mar '19

25 Mar '19

I cannot get TLS 1.3 to work with Chrome. TLS 1.3 works fine in firefox quantum v 66.0.1 over the same hardware, so this is not caused by middleboxes. It is a fault with stunnel or Chrome. ERR_SSL_VERSION_INTERFERENCE error occurs in Chrome and will not connect. For now the solution is to turn off TLS v1.3 in stunnel configuration and force TLS v1.2, but this is not a long term solution. Does anyone have a solution to use TLS 1.3 with chrome and stunnel together? Kolan

1 0

No more Win32 stunnel?
by John Hall 21 Mar '19

21 Mar '19

I've only just discovered that stunnel is seemingly no longer being updated for Win32; at any rate there has been no version 5.50 released for Win32. It would have been nice if there had been an announcement to that effect, as until now I was only subscribed to the announcements mailing list and had thus been in blissful ignorance. (For some reason I never saw ANY announcement for 5.50 - in fact I still seem to be on 5.47.) Given that there are a number of ports to different OSs by various people, is there any chance that someone might supply a Win32 port for future versions? (Sadly I lack the knowledge to do that myself.) -- John Hall

3 4

Verify peer immediately
by Phillip Hellewell 21 Mar '19

21 Mar '19

Hi, I have verifyPeer = yes in my client stunnel.conf. Is there any way to make it verify the peer right away instead of waiting until a connection is made (to the accept port)? I run stunnel with foreground = yes and would like it to exit right away if the peer doesn't have the appropriate cert/key. Thanks, Phillip

1 0

stunnel become non-non responsive and very sluggish
by Joe Phillips 18 Mar '19

18 Mar '19

I have 5.30 running on Ubuntu workstation. It has become sluggish and almost non responsive at times. I captured this in the log the other day...no source, no destination address. Maybe got stuck in a loop? Have to restart Ubuntu to clear it up. stunnel2@stunnel2:~$ /etc/init.d/stunnel4 restart [....] Restarting stunnel4 (via systemctl): stunnel4.serviceFailed to restart stunnel4.service: Access denied See system logs and 'systemctl status stunnel4.service' for details. failed! stunnel2@stunnel2:~$ sudo tail -f -n 100 /var/log/stunnel.log sudo: unable to resolve host stunnel2: Connection timed out [sudo] password for stunnel2: 2019.03.13 04:06:14 LOG5[1149140]: Connection reset: 34440 byte(s) sent to SSL, 4886 byte(s) sent to socket 2019.03.13 04:38:56 LOG5[1142702]: Connection reset: 2362 byte(s) sent to SSL, 1225 byte(s) sent to socket 2019.03.13 05:09:32 LOG5[1137283]: Connection reset: 23006 byte(s) sent to SSL, 3977 byte(s) sent to socket 2019.03.13 05:51:57 LOG5[1109534]: Connection reset: 33953 byte(s) sent to SSL, 16755 byte(s) sent to socket 2019.03.13 05:58:36 LOG5[1139715]: Connection reset: 25039 byte(s) sent to SSL, 3944 byte(s) sent to socket 2019.03.13 06:25:12 LOG5[1137757]: Connection reset: 2863 byte(s) sent to SSL, 1329 byte(s) sent to socket 2019.03.13 06:49:19 LOG5[1137393]: Connection reset: 26536 byte(s) sent to SSL, 14839 byte(s) sent to socket 2019.03.13 06:51:35 LOG5[1137344]: Connection reset: 28968 byte(s) sent to SSL, 12986 byte(s) sent to socket 2019.03.13 07:10:28 LOG5[1137343]: Connection reset: 28655 byte(s) sent to SSL, 7632 byte(s) sent to socket 2019.03.13 07:30:52 LOG5[1136403]: Connection reset: 25466 byte(s) sent to SSL, 6767 byte(s) sent to socket 2019.03.13 07:35:33 LOG5[1141675]: Connection reset: 28637 byte(s) sent to SSL, 15044 byte(s) sent to socket 2019.03.13 07:39:21 LOG5[1121823]: Connection reset: 47442 byte(s) sent to SSL, 67336 byte(s) sent to socket 2019.03.13 07:39:58 LOG5[1148822]: Connection reset: 25003 byte(s) sent to SSL, 9295 byte(s) sent to socket 2019.03.13 07:40:29 LOG5[1127468]: Connection reset: 57030 byte(s) sent to SSL, 73806 byte(s) sent to socket 2019.03.13 07:46:08 LOG5[1107655]: Connection reset: 84608 byte(s) sent to SSL, 125726 byte(s) sent to socket 2019.03.13 07:49:49 LOG5[1140561]: Connection reset: 27344 byte(s) sent to SSL, 11112 byte(s) sent to socket 2019.03.13 07:59:23 LOG5[1106646]: Connection reset: 9970 byte(s) sent to SSL, 5355 byte(s) sent to socket 2019.03.13 08:01:27 LOG5[1143613]: Connection reset: 26733 byte(s) sent to SSL, 8993 byte(s) sent to socket 2019.03.13 08:02:28 LOG5[1141251]: Connection reset: 49897 byte(s) sent to SSL, 62187 byte(s) sent to socket 2019.03.13 08:03:11 LOG5[1139045]: Connection reset: 24669 byte(s) sent to SSL, 4580 byte(s) sent to socket 2019.03.13 08:05:13 LOG5[1137322]: Connection reset: 39408 byte(s) sent to SSL, 33428 byte(s) sent to socket 2019.03.13 08:07:56 LOG5[1151696]: Connection reset: 23577 byte(s) sent to SSL, 5415 byte(s) sent to socket 2019.03.13 08:11:12 LOG5[1136170]: Connection reset: 64684 byte(s) sent to SSL, 36839 byte(s) sent to socket 2019.03.13 08:11:55 LOG5[1141693]: Connection reset: 22826 byte(s) sent to SSL, 5186 byte(s) sent to socket 2019.03.13 08:15:30 LOG5[1140377]: Connection reset: 42452 byte(s) sent to SSL, 39471 byte(s) sent to socket 2019.03.13 08:18:29 LOG5[1154893]: Connection reset: 21190 byte(s) sent to SSL, 3096 byte(s) sent to socket 2019.03.13 08:22:14 LOG5[1153488]: Connection reset: 23506 byte(s) sent to SSL, 5081 byte(s) sent to socket 2019.03.13 08:24:34 LOG5[1153167]: Connection reset: 46285 byte(s) sent to SSL, 8378 byte(s) sent to socket 2019.03.13 08:26:25 LOG5[1145557]: Connection reset: 26015 byte(s) sent to SSL, 6055 byte(s) sent to socket 2019.03.13 08:29:34 LOG5[1030096]: Connection reset: 89657 byte(s) sent to SSL, 120807 byte(s) sent to socket 2019.03.13 08:30:36 LOG5[1081623]: Connection reset: 51409 byte(s) sent to SSL, 50378 byte(s) sent to socket 2019.03.13 08:32:23 LOG5[1149449]: Connection reset: 28329 byte(s) sent to SSL, 12655 byte(s) sent to socket 2019.03.13 08:32:33 LOG5[1106312]: Connection reset: 52138 byte(s) sent to SSL, 58239 byte(s) sent to socket 2019.03.13 08:33:46 LOG5[1137325]: Connection reset: 36900 byte(s) sent to SSL, 29750 byte(s) sent to socket 2019.03.13 08:36:35 LOG5[1145147]: Connection reset: 31740 byte(s) sent to SSL, 21114 byte(s) sent to socket 2019.03.13 08:38:59 LOG5[1133239]: Connection reset: 44816 byte(s) sent to SSL, 18743 byte(s) sent to socket 2019.03.13 08:41:04 LOG5[1148129]: Connection reset: 32191 byte(s) sent to SSL, 20525 byte(s) sent to socket 2019.03.13 08:43:55 LOG5[1150567]: Connection reset: 27989 byte(s) sent to SSL, 12627 byte(s) sent to socket 2019.03.13 08:47:21 LOG5[1146666]: Connection reset: 29242 byte(s) sent to SSL, 13836 byte(s) sent to socket 2019.03.13 08:49:26 LOG5[main]: Terminated 2019.03.13 08:58:32 LOG5[ui]: stunnel 5.30 on x86_64-pc-linux-gnu platform 2019.03.13 08:58:32 LOG5[ui]: Compiled/running with OpenSSL 1.0.2g 1 Mar 2016 2019.03.13 08:58:32 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2019.03.13 08:58:32 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2019.03.13 08:58:32 LOG5[ui]: UTF-8 byte order mark detected 2019.03.13 08:58:32 LOG5[ui]: FIPS mode disabled 2019.03.13 08:58:36 LOG5[ui]: Configuration successful [UMC Color Logo - small]<http://www.universalmoney.com/> Joe Phillips SVP-IT 15301 W. 87th Street Parkway, Suite 215 Lenexa, KS 66219 Corp Office 913.831.2055 Direct via Cell 913.927.5691 www.universalmoney.com

2 1

(no subject)
by Vijay Raghavan P 05 Mar '19

05 Mar '19

Hi, I have to create tunnel between server and client. Client have proxy configured in between. So i use below in /etc/stunnel/stunnel.config pid = /var/run/stunnel.pid cert = /home/client.crt key = /home/client.key options = NO_SSLv2 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes CAfile=/home/**chain.pem verify=2 [test] protocol = connect accept = 127.0.0.1:10000 protocolHost = server.xxxx.com:443 connect = <PROXYIP>:<PROXY port> protocolUsername = user1 protocolPassword = password protocolAuthentication = Basic then i bring up the service. With above configuration connection works file. Now i don't want proxy password to be clear text in this case. Any pointers plz Thanks, Vj

2 3

Re: [stunnel-users] stunnel-users Digest, Vol 176, Issue 3
by Andrew Smalley 04 Mar '19

04 Mar '19

FIPS in stunnel and OpenSSL The actual cause of the problem is OpenSSL v1.1.x does not support FIPS engine and as such, you can only use a FIPS Compliant cipher until FIPS is recertified as I understand it Andruw Smalley Loadbalancer.org Ltd. www.loadbalancer.org +1 888 867 9504 / +44 (0)330 380 1064 asmalley(a)loadbalancer.org Leave a Review | Deployment Guides | Blog Andruw Smalley Loadbalancer.org Ltd. www.loadbalancer.org +1 888 867 9504 / +44 (0)330 380 1064 asmalley(a)loadbalancer.org Leave a Review | Deployment Guides | Blog On Mon, 4 Mar 2019 at 16:20, <stunnel-users-request(a)stunnel.org> wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. FIPS mode not supported (Yan Renelt) > 2. Re: FIPS mode not supported (mlrx) > 3. Re: FIPS mode not supported (Flo Rance) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 4 Mar 2019 16:14:47 +0100 > From: Yan Renelt <reneltyan(a)gmail.com> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] FIPS mode not supported > Message-ID: <3F804E14-5218-42A5-9850-7AEBC0EF8F96(a)gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > > my config is > cert = stunnel.pem > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > debug = 7 > > fips = yes > > [Demo-Trading] > client = yes > accept = 127.0.0.1:40001 > connect = fix-order.london-demo.lmax.com:443 > sslVersion = TLSv1 > options = NO_SSLv2 > options = NO_SSLv3 > > [Demo ñ Market Data] > client = yes > accept = 127.0.0.1:40003 > connect = fix-marketdata.london-demo.lmax.com:443 > sslVersion = TLSv1 > options = NO_SSLv2 > options = NO_SSLv3 > > > and I still receiving this error. > > FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported > > Any suggestions? Fips = no is not an option for me. > > > Thanks > > Yan >

1 0