- stunnel-users - stunnel.org

stunnel log shows SSLv3 protocol level even when TLSv1 was negotiated
by christian.tenvenne＠lhsystems.com 03 Feb '15

03 Feb '15

I'm running stunnel in server-mode with options "NO_SSLV2" and "NO_SSLV3" and sslVersion=all. My client also explicitly disables SSLv2 and SSLv3. My client's ssl-log (-Djavax.net.debug=ssl) confirms that, during handshake and for application data, the highest TLS protocol version is being used. How come, stunnel log still shows "SSLv3" ? 2015.02.03 14:42:46 LOG5[8415:140561397376768]: ldaps-in accepted connection from X.X.X.X:65158 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): before/accept initialization 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 read client hello A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write server hello A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write certificate A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write server done A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 flush data 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 read client key exchange A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 read finished A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write change cipher spec A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write finished A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 flush data 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 9 items in the session cache 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 client connects (SSL_connect()) 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 client connects that finished 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 client renegotiations requested 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 12 server connects (SSL_accept()) 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 9 server connects that finished 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 server renegotiations requested 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 session cache hits 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 external session cache hits 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 session cache misses 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 session cache timeouts 2015.02.03 14:42:46 LOG6[8415:140561397376768]: SSL accepted: new session negotiated 2015.02.03 14:42:46 LOG6[8415:140561397376768]: Negotiated ciphers: AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 Is my client's ssl-log wrong? Or stunnel's? Kind regards, Christian Tenvenne

2 1

issue with stunnel forwarding
by David 03 Feb '15

03 Feb '15

I am trying to configure stunnel on a bridge server which needs to use ssl to talk to 3 others servers. below is my conf file: ; ***************************************** Example SSL server mode services [ xyz ] accept=10.10.10.74:9908 connect= 127.0.0.10:1040 transparent = source[ hp ] accept=10.10.10.218:9904 connect=127.0.0.10:1041 transparent = source[ sql] accept=10.10.10.214:59053 connect=127.0.0.10:1042 transparent = source when I run the stunnel GUI start I get following message: [ ] No limit detected for the number of clients [.] stunnel 5.10 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.1l 15 Jan 2015 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [.] Reading configuration from file stunnel.conf [ ] GUI message loop initialized [.] UTF-8 byte order mark detected [ ] Enabling support for engine "capi" [ ] Initializing engine #1 (capi) [ ] Engine #1 (capi) initialized [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [!] Line 62: "transparent = source": Specified option name is not valid here[!] Server is down what am I missing here? thanks! nazja2015

2 1

stunnel-5.10, FreeBsd Package building, missing openssl and perl packages and config menue for Stunnel is missing ssl port
by mugetsu shinde 03 Feb '15

03 Feb '15

so ive noticed in the previous stunnel 5.07 i was able to select SSL_PORT when making the config for Stunnel , well now after downloading stunnel 5.10 with FreeBsd 10.1 over portsnap fetch extract , Stunnel is missing the option: SSL_PORT why , whats going on ? btw ive noticed openssl and perl arent downloaded from the portsnap server either apparently , help please , i need this for my pfsense 2.2 release vm to work with Stunnel again

2 1

Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3
by Sebastian Ochsenkühn 29 Jan '15

29 Jan '15

Hi Mike, thanks for your fast response, but I think there is a big issue. The latest version that is available in the CENTOS 6 Base Repo is "stunnel-4.29-3.el6_6.1.x86_64" - In this version the SSLv3 is disabled by default, but there is not option to enable it. I hope you understand my situation :-) ________________________________ Von: stunnel-users <stunnel-users-bounces(a)stunnel.org> im Auftrag von Michal Trojnara <Michal.Trojnara(a)mirt.net> Gesendet: Donnerstag, 29. Januar 2015 11:44 An: stunnel-users(a)stunnel.org Betreff: Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3 Hi Sebastian, My documentation describes the latest version of stunnel. For an old version please refer to the appropriate manual page distributed with the specific version you're using. Mike On 29.01.2015 11:40, Sebastian Ochsenkühn wrote: Hi, I have a big problem with the new stunnel version on CentOS 6.6 (stunnel-4.29-3.el6_6.1.x86_64) that is available in the CentOS base repository. You describe in your documentation that SSLv3 is disabled by default. -> OK for me, but I need SSLv3 and the option with -NO_SSLv3 is not working?! PS: this is also not working with -NO_SSLv2 option. options = -NO_SSLv3 = NOT Working option = NO_SSLv3 = Working. Currently i have installed an older version, where the SSLv3 protocoll is not disabled by default. Is there anything that I'm doing wrong? Thanks and Regards, Sebastian. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3
by Sebastian Ochsenkühn 29 Jan '15

29 Jan '15

Hi Mike, yes your correct, but I have forced the installation with "stunnel-4.29-3.el6_4.x86_64" ( all other packages openssl, etc. updated) and SSLv3 is working again. So, for my understanding there must be a bug or they have disabled SSLv3 in version "stunnel-4.29-3.el6_6.1.x86_64". Regards, Sebastian. ________________________________ Von: stunnel-users <stunnel-users-bounces(a)stunnel.org> im Auftrag von Michal Trojnara <Michal.Trojnara(a)mirt.net> Gesendet: Donnerstag, 29. Januar 2015 12:12 An: stunnel-users(a)stunnel.org Betreff: Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3 Hi Sebastian, The ChangeLog does not say anything about disabling SSLv3: http://rpmfind.net/linux/RPM/centos/updates/6.6/x86_64/Packages/stunnel-4.2… I guess it may be disabled in the OpenSSL rather than in stunnel. Anyway, if you connect stunnel with some software that's so old that it doesn't support TLS, the software is almost certainly no longer supported, and most likely vulnerable to attacks. This is a serious risk! Mike On 29.01.2015 11:58, Sebastian Ochsenkühn wrote: Hi Mike, thanks for your fast response, but I think there is a big issue. The latest version that is available in the CENTOS 6 Base Repo is "stunnel-4.29-3.el6_6.1.x86_64" - In this version the SSLv3 is disabled by default, but there is not option to enable it. I hope you understand my situation :-) ________________________________ Von: stunnel-users <stunnel-users-bounces(a)stunnel.org><mailto:stunnel-users-bounces@stunnel.org> im Auftrag von Michal Trojnara <Michal.Trojnara(a)mirt.net><mailto:Michal.Trojnara@mirt.net> Gesendet: Donnerstag, 29. Januar 2015 11:44 An: stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org> Betreff: Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3 Hi Sebastian, My documentation describes the latest version of stunnel. For an old version please refer to the appropriate manual page distributed with the specific version you're using. Mike On 29.01.2015 11:40, Sebastian Ochsenkühn wrote: Hi, I have a big problem with the new stunnel version on CentOS 6.6 (stunnel-4.29-3.el6_6.1.x86_64) that is available in the CentOS base repository. You describe in your documentation that SSLv3 is disabled by default. -> OK for me, but I need SSLv3 and the option with -NO_SSLv3 is not working?! PS: this is also not working with -NO_SSLv2 option. options = -NO_SSLv3 = NOT Working option = NO_SSLv3 = Working. Currently i have installed an older version, where the SSLv3 protocoll is not disabled by default. Is there anything that I'm doing wrong? Thanks and Regards, Sebastian. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3
by Sebastian Ochsenkühn 29 Jan '15

29 Jan '15

Hi, I have a big problem with the new stunnel version on CentOS 6.6 (stunnel-4.29-3.el6_6.1.x86_64) that is available in the CentOS base repository. You describe in your documentation that SSLv3 is disabled by default. -> OK for me, but I need SSLv3 and the option with -NO_SSLv3 is not working?! PS: this is also not working with -NO_SSLv2 option. options = -NO_SSLv3 = NOT Working option = NO_SSLv3 = Working. Currently i have installed an older version, where the SSLv3 protocoll is not disabled by default. Is there anything that I'm doing wrong? Thanks and Regards, Sebastian.

1 0

Blue Iris
by Patrick wickline 23 Jan '15

23 Jan '15

I have stunnel set up on my machine. It works locally and lets me connect to my Blue Iris server with https. However, I am unable to do this remotely. I have forwarded the port in my router to stunnel, from stunnel to blue iris, but still doesn't work. Below is part of my conf file [Blue Iris] accept = 8344 (forwarded this in the router to my static IP of my machine) connect = 127.0.0.1:8081 (8081 is my blue iris web server) I hope someone is able to give some advice

2 1

stunnel 5.10 released
by Michal Trojnara 22 Jan '15

22 Jan '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.10 of stunnel. The ChangeLog entry: Version 5.10, 2015.01.22, urgency: LOW: * New features - OCSP AIA (Authority Information Access) support. This feature can be enabled with the new service-level option "OCSPaia". - Additional security features of the linker are enabled: "-z relro", "-z now", "-z noexecstack". * Bugfixes - OpenSSL DLLs updated to version 1.0.1l. https://www.openssl.org/news/secadv_20150108.txt - FIPS canister updated to version 2.0.9 in the Win32 binary build. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 032bfc1854f8a0b9e452343c36ec6b52c7e0daef0863423c6b13a61a7c92eb23 stunnel-5.10.tar.gz 7c29753b6488f37b29f365e9c4a6060c3da8a89000af1cd29eab7c37d419d148 stunnel-5.10-installer.exe 93cd0941580eaa7815ed62ec88a111cb449e9bad97cd1a35d7524867a8238234 stunnel-5.10-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlTBMTsACgkQ/NU+nXTHMtE+uQCg9N0butSpAQ2mM1M5ySe7T18i oe8AoOAHKJ9F7jMlUfHnmuzBtIPbbghN =e9ed -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] No DNS lookup?
by Colin van der Zanden 21 Jan '15

21 Jan '15

Ludolf, Thanks for your quick response. I have no clue on how to respond on the stunnel users list, so i'll try it this way. The support on the host we are trying to reach states to following: It really sounds like the stunnel is not connecting to "something.host.com" but perhaps to the IP address behind it? The use of the hostname something.host.com is however an requirement. Is there anyway we can force the stunnel to connect to the hostname instead of resolving it as an IP adress? Met vriendelijke groeten, H.N. Post en Zonen Colin van der Zanden c.vanderzanden(a)duurzaam-transport.com c.vanderzanden(a)hnpostenzonen.nl <dm.post(a)hnpostenzonen.nl> ---------------------------------------------- Dit e-mailbericht is uitsluitend bestemd voor de geadresseerde(n). Wilt u direct contact met ons opnemen indien deze e-mail bij vergissing bij u terecht is gekomen? Wij verzoeken u in dat geval de e-mail te vernietigen, de inhoud ervan niet te gebruiken en niet onder derden te verspreiden, omdat het bericht vertrouwelijke informatie kan bevatten, beschermd door een beroepsgeheim.

5 5

No DNS lookup?
by Colin vd Zanden 20 Jan '15

20 Jan '15

Hi, We've got a bit of a problem working with Stunnel. We are trying to connect to a domain, but the stunnel is somehow translating it to a IP adres. (We didn't know, we saw it in the log file). This is causing our connection to fail. Is there any way to prevent stunnel from translating the domain into a IP, and just connect to the domain name?

2 1