- stunnel-users - stunnel.org

Help with connectivity issue
by Rob Allen 15 Sep '17

15 Sep '17

I’ve installed stunnel on an Amazon EC2 instance: stunnel 4.56 on x86_64-redhat-linux-gnu platform Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP Global options: debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none I’ve created the stunnel.conf file: [smtp-tls-wrapper] accept = 2525 client = yes connect = email-smtp.us-west-2.amazonaws.com:465 protocol=smtp delay = yes I’ve tested the connection to SES (successfully) via openssl: [ec2-user@ip-172-31-4-68 ~]$ openssl s_client -quiet -crlf -connect email-smtp.us-west-2.amazonaws.com:465 depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5 verify return:1 depth=1 C = US, O = Symantec Corporation, OU = Symantec Trust Network, CN = Symantec Class 3 Secure Server CA - G4 verify return:1 depth=0 C = US, ST = Washington, L = Seattle, O = "Amazon.com, Inc.", CN = email-smtp.us-west-2.amazonaws.com verify return:1 220 email-smtp.amazonaws.com ESMTP SimpleEmailService-2370111491 wa7VtNk9b7c4TX0jNpdG But when I try to access through stunnel via localhost with telnet, I get this: [ec2-user@ip-172-31-4-68 ~]$ telnet localhost 2525 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. I’ve tried everything I can think of; I’ve read all the blogs and pages related to connecting from ec2 to SES via stunnel and I just can’t get it to work. Does anyone have any suggestions for other things I could try? Thanks in advance, Rob Allen, CPO Software Engineer | Eyefinity NOTICE: This message is intended only for the individual to whom it is addressed and may contain information that is confidential or privileged. If you are not the intended recipient, or the employee or person responsible for delivering it to the intended recipient, you are hereby notified that any dissemination, distribution, copying or use is strictly prohibited. If you have received this communication in error, please notify the sender and destroy or delete this communication immediately.

2 2

Stunnel Config Error
by Jay Jenney 21 Aug '17

21 Aug '17

Trying to see why Stunnel like this config file (attached) for an office365 email account [cid:image001.jpg@01D31A6F.5FD0FC60] Harriscomputer Register today<http://www.harriscomputer.com/en/conference/> for HCTC2017 - Early Bird deadline is August 31! Jay Jenney Support Specialist P: 800-274-2911 x64272 F: E: jjenney(a)caliberpublicsafety.com [cid:Caliber_PS_left_CMYK_247aef3c-9961-4e6c-a9f4-053e52f0093f.jpg] , Iowa www.caliberpublicsafety.com<http://www.caliberpublicsafety.com> This message has been sent on behalf of a company that is part of the Harris Operating Group of Constellation Software Inc. These companies are listed at the following link: http://subscribe.harriscomputer.com Unsubscribe Option: If you do not wish to receive any future email, please unsubscribe by clicking on the following link:http://subscribe.harriscomputer.com This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.

1 0

stunnel w & w/o data compression
by Daniele Basaldella 18 Aug '17

18 Aug '17

Dear all, I use stunnel in clinet configuration to get data feeds from several sources. Until now none of them requested data compression, so the configuration was easy. Now I need to connect to a new data feeder that requires zlib compression. I found the compression method is a global setting, so it will be not compatible with current setup. The server runs Ubuntu 16.04LTS, ker 4.4.0.92.lowlatency, stunnel 5.30, openssl 1.0.2.g. I looked for a solution on internet but seems no one have my issue. Someone could suggest how to get both compressed/uncompressed data feed connections on same system. Thank you Best Regards Daniele

2 1

Timeout issue I think
by Ben Bazian 16 Aug '17

16 Aug '17

I have a legacy server that uses IMAP but does not support TLS. I am using stunnel and since implementation I am getting errors when an email has a larger attachment. My application process these attachments and when done (sometimes can take 5-10 minutes) it marks the message for deletion. When all messages are completed it purges the emails from the box. My app is throwing an error when it tries to delete the message (see below). I think it may be due to stunnel closing the connection to the server? Not quite sure. javax.mail.FolderClosedException at com.sun.mail.imap.IMAPMessage.getProtocol(IMAPMessage.java:105) at com.sun.mail.imap.IMAPMessage.loadEnvelope(IMAPMessage.java:941) at com.sun.mail.imap.IMAPMessage.getSubject(IMAPMessage.java:238) at com.softlinx.docurouter.source.email.EmailSourceConnector.processMess ages(EmailSourceConnector.java:1213) at com.softlinx.docurouter.source.email.EmailSourceConnector.process(Ema ilSourceConnector.java:1455) at com.softlinx.docurouter.source.email.EmailSourceConnector.main(EmailS ourceConnector.java:1622) My configuration is pretty simple. I saw somewhere that I could put a timeoutidle on the connector but that does not seem to help. Any ideas are appreciated. Here is the config. # Stunnel configuration file for Office 365 SMTP and POP3 # Author: MessageOps, www.messageops.com<http://www.messageops.com> # GLOBAL OPTIONS client = yes output = /etc/stunnel/stunnel-log.txt debug=3 # taskbar=yes # SERVICE-LEVEL OPTIONS [POP3 Incoming] accept = 110 connect = outlook.office365.com:995 timeoutidle = 14400 [SMTP Outgoing] protocol = smtp accept = 25 connect = outlook.office365.com:587 [IMAP] accept = 143 connect = outlook.office365.com:993 timeoutidle = 14400 Here is a printout of the global options. Global options: debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -Ben

1 0

logging real client IP in Apache
by Stoyan Stoyanov 07 Jul '17

07 Jul '17

I have an Apache server serving only HTTP requests on port 80 and an stunnel daemon on the same server listening on port 443 and tunneling HTTPS requests to Apache. Is there a way for the client IP to be passed on to Apache so that I can capture and log that instead of the IP of stunnel, which in this case is 127.0.0.1? Ability to add a variable to the HTTP header would be perfect, but any other suggestions to solve this problem are welcome. Thanks! Stoyan

2 2

Error on startup of Stunnel
by Shelstone Lorde 30 Jun '17

30 Jun '17

I installed version 5.41, the latest version, on a Windows 10 Pro machine. I placed a link to the Stunnel.exe file in the Startup folder. I am getting the error "The ordinal 3253 could not be located in the dynamic link library c:\Users\...Programs\Startup\stunnel.exe". May be there has been a previous posting concerning this error but I have not been able to find it. Any help or suggestion will be appreciated. Thanks.

1 0

Re: [stunnel-users] Stunnel Connectivity Issue
by Ludolf Holzheid 13 Jun '17

13 Jun '17

On Tue, 2017-06-13 22:51:27 +0530, Dheeraj Gautam wrote: > Hi Browne, > > > > I am not understand like what config I have to do in stunnel config file. > > > > As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port. > Dheeraj, I'm afraid you confused the directions: In you configuration file, you told Stunnel to accept connections on localhost, port 9233 ("accept = 127.0.0.1:9233"). Then, you told Stunnel, if such a connection is accepted, to connect to a remote server at port 8228 ("connect = 69.191.198.34:8228"). As long as both connections are established, Stunnel will forward data from localhost to 69.191.198.34 and vice versa, while encrypting the data in the localhost -> 69.191.198.34 direction and decrypting the data in the opposite direction (69.191.198.34 -> localhost). With this setup, a client program (such as Thunderbird) sends and receives plain-text data to/from a Stunnel instance on the same machine, while a server program on a remote machine (such as the Google mail server) sends and receives encrypted data to/from Stunnel. Is this about the setup you have in mind? Is your application server or client? Does it send and receive plain-text data or encrypted data? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:lholzheid@bihl-wiedemann.de http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Configuring stunnel and openssl on Windows to support TLS 1.2
by Liz Turi 13 Jun '17

13 Jun '17

Good morning, I'm hoping you can help point me in the right direction. The problem I'm trying to solve is enabling TLS 1.2 connections on a Windows (environment has both Windows 2008 and Windows 10 environments) platform. Currently, my private keys are managed by the Windows certificate store, using the capi engineId within stunnel (v 5.41), which uses OpenSSL 1.0.1. Because of this, stunnel can only negotiate a TLS 1.1 connection. I've tried compiling OpenSSL 1.1.0f and stunnel 5.41, but no luck either cross compiling under CentOS, nor under Windows using either MSYS2/MINGW32 or Cygwin. What I'm looking for is any one of the following 1) solid current cross-compiling examples or references 2) solid current Windows compiling examples or references using extant versions 3) a way to manage the pfx/p12 (private key) in stunnel without resorting to the Windows certificate store. Option 3 is preferred. I see how to manage pkcs11, but not pkcs12. Thank you in advance! Liz Turi Sr. Consultant Massachusetts eHealth Collaborative 860 Winter Street, Waltham, MA 02451 (m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589 www.maehc.org<http://www.maehc.org> [fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=ty…>[tw_icon]<https://twitter.com/MAeHC_org> CONFIDENTIALITY NOTICE The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

1 1

Memleak sTunnel Win32 5.41 ?
by Dod 12 Jun '17

12 Jun '17

Hello, I just noticed that stunnel memory usage is growing slowly but surely using 5.41 on Win7 64 Bits. Using a few POP3 SSL tunnels. Now it is using 290MB memory I don't know if it is since 5.41 (didn't pay attention). Is there a way to trace/log something that could be useful ? (apart from the process memory usage curve that I guess will not help). regards.

1 0

TLS-SRP patch
by Kevin Sheldrake 06 Jun '17

06 Jun '17

Hello I recently produced a patch that permits use of TLS-SRP; it is based on the TLS-PSK code and this blog post: https://matthewarcus.wordpress.com/2014/05/10/srp-in-openssl/ It’s not the cleanest of code but it does work as a POC. The patch is available here: https://github.com/rtfcode/tls-srp The README.txt provides some info on testing the patch and how it might be used to help dev web browsers and servers that support TLS-SRP (for IoT work). There is a page on the forthcoming OWASP Summit ‘TLS for Local IoT’ workshop (for which it was developed) at: https://owaspsummit.org/Working-Sessions/IoT/TLS-for-Local-IoT.html In terms of using TLS-SRP support in stunnel as a proxy, it might be useful as a replacement for TLS-PSK where the credentials are user-memorable (pass phrase, for example) as TLS-SRP has lower entropy requirements than TLS-PSK. For example, the creds could be stored in the user’s head rather than in a file and be less open to compromise if a device was seized. I don’t know if that’s useful for anyone; it’s just a thought. Thanks Kev

1 0