- stunnel-users - stunnel.org

possibility to delay connect to host
by Paavo Sild 04 Dec '17

04 Dec '17

Hello! I am a bit new to stunnel and while I tried to search the message archive I did not find any possible reference to the issue I try to solve. I am running a bit older version of stunnel as a simple reverse proxy. It accepts incoming TLS connection and opens clear TCP connection to a host specified by "connect" parameter in config. I wander - it is possible to delay the opening of TCP connection to a host until the actual data is received from client? I haven't found any reference to such a possibility in stunnel but thought that it worth to ask from community. The issue is that due to the nature of traffic there are instances then client negotiates the SSL connection but there is no actual data to be sent by the client. By opening the connection to host only when actual data is present would filter out unnecessary connections towards the application. Anybody had such an issue to solve? -- rgds, Paavo Sild --------------------- paavo.sild(a)estcard.ee ---------------------

1 0

routines:ssl3_read_bytes:sslv3 alert certificate unknown
by Ziad Badawi 04 Dec '17

04 Dec '17

Greetings, I am trying to capture clear text pcaps from client (browser) - server (java appserver) traffic. The java appserver is jboss using https. I'm running jboss and stunnel on the same machine. # stunnel.conf debug = 3 foreground = yes [jboss] client = yes cert= stunnel.pem # generated using makecert.sh accept = 1234 connect = 127.0.0.1:443 Version: stunnel 5.44 on x86_64-pc-linux-gnu platform Compiled/running with OpenSSL 1.0.2k-fips 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:!DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none When I try to test it usng firefox by browsing to https://localhost:1234, FF returns "Secure Connection Failed" and stunnel spits 2017.12.01 20:35:10 LOG3[0]: SSL_connect: 14094416: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown What am I missing / doing wrong? Regards Z

2 2

Stunnel 5.43 problem
by Carter Browne 15 Nov '17

15 Nov '17

When running stunnel 5.43 on Linux 4.14 (arm), accept = port only listens on 127.0.0.1:port. I don't know if other operating systems are affected. Carter

1 0

Re: [stunnel-users] TLS "translation" & 2-way auth
by Igor Gatis 15 Nov '17

15 Nov '17

It would be nice to know whether it is actually possible to achieve this with stunnel. If not, is there any other tool I could use or combine? On Nov 13, 2017 08:58, "Igor Gatis" <igorgatis(a)gmail.com> wrote: Yep, that's exactly what I'm seeking for help here. If we can abstract the 2-way bit for a second, I'd call this a "certificate transcription" TLS tunnel. On Thu, Nov 9, 2017 at 5:19 PM, Vincent Deschenes <vdeschenes(a)stelvio.com> wrote: > Ho, > > But that does not account for the A ->[TLS] ->B part. > > I believe that my sample will listen for unencrypted connection only. > > > > > > *From:* stunnel-users [mailto:stunnel-users-bounces@stunnel.org] *On > Behalf Of *Vincent Deschenes > *Sent:* Thursday, 9 November 2017 3:16 PM > *To:* Igor Gatis <igorgatis(a)gmail.com>; stunnel-users(a)stunnel.org > *Subject:* Re: [stunnel-users] TLS "translation" & 2-way auth > > > > You need to have a section in your config file which listen for requests > but also have the “client = yes” option with a cert and key like this: > > > > [http_a_to_c] > > client = yes > > accept = port_number_to_listen_on_server_b > > connect = server_c_address:443 > > cert = certificate.crt > > key = private.key > > > > > > cert and key are the certificate and private key server B uses to identify > itself on server C. > > You could also add more options to specify a trustore to specify which > cert coming from server C server B will trust, otherwise server B will > simply allow the connection. > > > > Good Luck > > > > > > *From:* stunnel-users [mailto:stunnel-users-bounces@stunnel.org > <stunnel-users-bounces(a)stunnel.org>] *On Behalf Of *Igor Gatis > *Sent:* Thursday, 9 November 2017 1:14 PM > *To:* stunnel-users(a)stunnel.org > *Subject:* [stunnel-users] TLS "translation" & 2-way auth > > > > Consider scenario below: > > > > Server A ==TLS==> Server B ==TLS+2WayAuth==> Server C > > > > Server A needs to connect to Server C through Server B which runs Stunnel. > Server C requires 2-way authentication. I have full control over Server A > and Server B and Server C belongs to a third-party. > > > > What does Stunnel config should look like? > > >

3 2

Re: [stunnel-users] Possible stunnel 5.43 bug ?
by Bezspam 15 Nov '17

15 Nov '17

Hello, The patch fixed the problem. Thank you very much! Best regards, Bez Spam Sent with [ProtonMail](https://protonmail.com) Secure Email. > -------- Original Message -------- > Subject: Re: [stunnel-users] Possible stunnel 5.43 bug ? > Local Time: November 15, 2017 7:15 AM > UTC Time: November 15, 2017 7:15 AM > From: Michal.Trojnara(a)stunnel.org > To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> > > On 11/14/2017 01:33 PM, Bezspam wrote: > >> Is this a bug or expected behaviour? >> Best regards, >> Bez Spam >> >> Dear Bez, >> >> I confirm this is a bug. A patch that fixes it is: >> ftp://ftp.stunnel.org/stunnel/accept.patch >> >> There will be a bugfix release of stunnel later this week. >> >> Best regards, >> Mike > > --------------------------------------------------------------- > > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Ubuntu 16.04 problem
by Carter Browne 14 Nov '17

14 Nov '17

I have a very confusing problem with stunnel on Ubuntu. I have a configuration file that I have used in both Windows and Arch Linux. In the Arch version, I use a single file with all the certificates for the partner systems, in the Windows version I use a capath directory. I have tried both here and I always get the response "tlsv1 alert unknown ca". The beginning of the stunnel.conf file is below. Any hints would be appreciated. Carter cert = /etc/stunnel/xxxxxxx.pem key = /etc/stunnel/xxxxxxx.pem fips = no # Enable client mode client = yes ; Some security enhancements for UNIX systems - comment them out on Win32 #chroot = /var/run/stunnel/ #setuid = stunnel #setgid = stunnel ; PID is created inside chroot jail pid = /etc/stunnel/stunnel.pid ; Some performance tunings # Debug and Foreground are for testing socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Uncomment for debugging stunnel problems debug = 5 output = /etc/stunnel/stunnel.log ##foreground = yes ; NO SSLv2 options = NO_SSLv3 sslVersion = all Ciphers = ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA # # Uncomment and modify the CAFile to point to your ca.txt file #CAFile = /etc/stunnel/all.pem CAPath = /etc/stunnel/capath #CAPath = @sysconfdir/ssl/certs # Uncomment and modify the verify to enable CA validation # verifyChain = no VerifyPeer = yes

1 0

Possible stunnel 5.43 bug ?
by Bezspam 14 Nov '17

14 Nov '17

Hello, I use stunnel on FreeBSD 11.1. I install it from ports. Yesterday I updated to stunnel 5.43. However it stopped working. I investigated the problem and found the issue- instead on all network interfaces, "accept" listens on 127.0.0.1 : sockstat -4 USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS stunnel stunnel 43945 7 tcp4 127.0.0.1:2222 *:* stunnel stunnel 43945 8 tcp4 127.0.0.1:3128 *:* stunnel stunnel 43945 9 tcp4 127.0.0.1:8080 *:* stunnel stunnel 43945 10 tcp4 127.0.0.1:1616 *:* A workaround is to modify "accept = 0.0.0.0:3128" explicitly to listen on 0.0.0.0. Is this a bug or expected behaviour? Best regards, Bez Spam

2 1

TLS "translation" & 2-way auth
by Igor Gatis 13 Nov '17

13 Nov '17

Consider scenario below: Server A ==TLS==> Server B ==TLS+2WayAuth==> Server C Server A needs to connect to Server C through Server B which runs Stunnel. Server C requires 2-way authentication. I have full control over Server A and Server B and Server C belongs to a third-party. What does Stunnel config should look like?

2 3

Email Solution Needed
by Jon Kinne 11 Nov '17

11 Nov '17

I am running Windows 7, 32-bit and I have an email problem I'm trying to solve. I will describe what I need to do and hopefully someone can tell me if stunnel will solve it or if not, where else I might find a solution. I need to send emails out of a database program called Sage Act. It requires that the outgoing SMTP server be on port 25, and be named "smtp.xxx..." My ISP (Charter) blocks port 25, and their SMTP server is called "mobile.charter.net" on port 587. I need to have a way to enter an address like "SMTP.charter.net" (Port 25) in ACT, and when I send that email, it actually goes to "mobile.charter.net" or perhaps my gmail SMTP server on port 587 (Charter) or whatever port the gmail SMTP server requires. I'll certainly appreciate any help anyone can offer me. Thanks, Jon

1 0

Running Stunnel GUI as a service
by Stunnel User999 11 Nov '17

11 Nov '17

Hi, I'm running stunnel 5.43 on Windows 2012 R2 server and trying to run stunnel GUI as a service. Whenever I close my user session, it shuts down the GUI service. Installing the Stunnel TLS Wrapper Windows service does not seem to start the GUI service. How to run GUI in the background as a service? Any information is highly appreciated. Thanks, SN

1 0