- stunnel-users - stunnel.org

Stunnel - TLS error unexpected eof while reading
by rick.gregson＠gmail.com 19 May '22

19 May '22

Hi All, I have recently configured stunnel on a Windows Server, it has been configured using a certificate from our internal CA and appears to be functioning ok. However we have a load balancer that is doing a health check against the service and is polling S-Tunnel availability every 5 seconds each time a poll occurs I am seeing the error posted below in the logs. 2022.05.12 10:22:55 LOG3[4113]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.05.12 10:22:55 LOG5[4113]: Connection reset: 217 byte(s) sent to TLS, 49 byte(s) sent to socket Can I please have some advice on how to stop this error? Thank you Rick

2 3

Getting error "CERT: Pre-verification error: self signed certificate"
by Christopher Schultz 14 May '22

14 May '22

All, I'm running stunnel 4.56 as a server on Linux, as I have been doing for a while. I require clients to connect using their own client certs and yesterday one of them expired. The client generated a new certificate and sent it to me to install, and I'm getting the error in the subject. Version details: $ sudo stunnel -help stunnel 4.56 on x86_64-koji-linux-gnu platform Compiled/running with OpenSSL 1.0.2k-fips 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP I have set verify=4 because I expect to place the exact certificate for every client into my CAFile. This has been working for years, and when I connect using openssl s_client, I can see which client certificates the server advertises it will allow to connect, and they reflect what I expect. The server certificate is also self-signed, so I copied that into the CAFile and I'm able to connect with openssl s_client using that certificate. So I think the problem can't be that the client's certificate is self-signed. So, to recap: 1. stunnel in server mode 2. CAFile points to a collection of PEM certs 3. verify=4 4. I can connect with my own valid, trusted, self-signed certificate 5. Client cannot connect with their valid, trusted, self-signed cert Any ideas? (Note: the client DOES appear to be using their new certificate, though I can only see the subject text which could be the same, yet with a different actual certificate.) Here is the debug(7) output from an attempted connection: : Starting certificate verification: depth=0, [subject] : CERT: Pre-verification error: self signed certificate : Certificate check failed: depth=0, [subject] : SSL alert (write): fatal: unknown CA : SSL_accept: 14089086: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed : Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Thanks, -chris

1 1

Is stunnel really compliant with RFC 2487 / RFC 3207 ?
by Javier 13 May '22

13 May '22

Hi, first of all, I still use a 32-bit release (the latest, I think), so maybe things have changed on Stunnel since. But the statement that the protocol smtp option for a service is compliant with RFC 2487, should be 3207 (it is from 2002!), has been in the docs for ages, even in the latest version, 5.64: *** smtp Based on RFC 2487 - SMTP Service Extension for Secure SMTP over TLS *** Long ago I tested the protocol=smtp options as both, clients and server service, and I noticed that, and I think I told here to the list confirming it (maybe for some user using it on client mode), the option implied STARTTLS. Back then I didn't pay much attention to it. BUT the other day I was re-testing for a server service (own mail server sometimes I run) and... I said to my self that this shouldn't be like it was and well, I read the RFC and what tells is the following: *** A publicly-referenced SMTP server MUST NOT require use of the STARTTLS extension in order to deliver mail locally. This rule prevents the STARTTLS extension from damaging the interoperability of the Internet's SMTP infrastructure. A publicly-referenced SMTP server is an SMTP server which runs on port 25 of an Internet host listed in the MX record (or A record if an MX record is not present) for the domain name on the right hand side of an Internet mail address. *** https://datatracker.ietf.org/doc/html/rfc3207#section-4 So, if we use Stunnel to provide THE OPTION of secure TLS connections to other MTAs (MTA to MTA, or server to server) we are against the RFC itself as every connection to port 25 must be encrypted, or nothing, because, as Stunnel is the door to the port and only accepts the STARTTLS command, without redirecting any data to the mail server, no traffic on plain text reaches the server. Acting as a MSA (users - servers) there is no problem because, even if it hadn't/hasn't been widely supported, there are two ports 587 for plain text and 465 for TLS. So Stunnel could be set up to listen on 465 port only, directly accepting TLS sessions or after STARTTLS command (rejecting, in this case, those that don't want a secure channel). We have told several times, specially to newcomers (asking for http proxy, basically), that Stunnel isn't proxy, and it isn't, but in the case of a mail server it should act as is if we use it for a MTA mail server. It acts as is sending the welcome message from the mail server to the other MTA, but once the other MTA doesn't send a STARTTLS command, it closes the connection when, actually, what should do is pass all the dialog between MTAs. I think that is what Stunnel should do. And when just passing messages from mail server to the other MTA, just disable the logging for that connection. After all, the mail severs have already their own logs and there is no reason to log it on Stunnel, nor on the log screen/Stunnel window. Maybe just a line like "redirecting connection to the mail server". Said all the above, do latest versions behave differently? Do you think is a change that should be made to Stunnel to comply with the RFC, if on latest versions don't do yet, or am I wrong somewhere in my statement? Regards. P.S.: MTA: Mail Transfer Agent MSA: Mail Submission Agent MUA: Mail User Agent

3 5

GMail and OAuth 2.0
by Colin Knight 12 May '22

12 May '22

I’ve received an email from Google advising that it will no longer be able to login to Gmail with older third party apps using just username/password. Minimum login security requirements for software are now OAuth 2.0 or similar. I’m using an iPhone to post this which won’t be affected but my laptop uses POP3 collection via Foxmail and Stunnel. I must have continued access to mail on my laptop so will I have to dump Gmail or does Stunnel use OAuth 2.0 (it’s not in my config file.) Advice appreciated.

2 1

stunnel 5.64 released
by Michał Trojnara 06 May '22

06 May '22

Dear Users, I have released version 5.64 of stunnel. This release only includes Windows fixes and improvements. ### Version 5.64, 2022.05.06, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.0.3. * New features - Updated the pkcs11 engine for Windows. * Bugfixes - Removed the SERVICE_INTERACTIVE_PROCESS flag in "stunnel -install". Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: eebe53ed116ba43b2e786762b0c2b91511e7b74857ad4765824e7199e6faf883 stunnel-5.64.tar.gz 600e76b52a86b21f97a1af13734fdd2226c26646bb77f5f9f074ba3d5755f024 stunnel-5.64-win64-installer.exe 391db6166b22a6648fd1f1df584c13ade61c93f620e46b12ebb30b643e61d2d3 stunnel-5.64-android.zip Best regards, Mike

1 0

Handling AUTH LOGIN for SMTP
by reaperunknown＠live.com 22 Apr '22

22 Apr '22

Hello everyone. Perhaps I'm a little new with Stunnel but, I've successfully used it to get an old EarthLink MailStation compatible with GMail SMTP and POP mail. Kind of neat. That said, I wish to use Outlook, but going through the SMTP process manually via Telnet, I've found that the SMTP requires you issue "AUTH LOGIN" command, and give the username and password in Base64. If I do this manually, I can send SMTP mail all day. However, this unit is old enough that I don't think it knows how to do anything with SMTP auth. It also looks like Outlook doesn't turn SMTP auth off for Outlook.com personal accounts. Is there any way that I've missed to have Stunnel handle the AUTH LOGIN part of the SMTP process, so that device that can't, doesn't have to? Thanks!

2 1

Force PSK Authentication
by gerhard＠ats.hacktic.nl 19 Apr '22

19 Apr '22

Hi stunnel-users, Is there a way to force PSK Authentication? Current behavior is that if the client has no PSK Authentication configured, no authentication is performed and the connection proceeds even when the server has this configured: ciphers = PSK PSKsecrets = mypsk.txt Is this expected behavior? Is there a way to enforce PSK, in other words block clients without PSK Authentication? Thanks

2 1

Windows service won't start. ""The Stunnel TLS wrapper service is marked as an interactive service."
by robert.croteau＠quest.com 15 Apr '22

15 Apr '22

Window 10 LTCS (1089): "The Stunnel TLS wrapper service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly." looks like starting with version 5.61, this above error appears in the System Event log. I've given a quick glance at the changes from 5.60 to 5.61 and there a lot of them. From the release notes, seems that windows services code might have been affected: New features for the Windows platform - Added client mode allowing authenticated users to view logs, reconfigure and terminate running stunnel services. - Added support for multiple GUI and service instances distinguised by the location of stunnel.conf. On GitHub, I also noticed that in the source code for src/ui_win_gui.c the service is created as follows: service=CreateService(scm, SERVICE_NAME, SERVICE_DISPLAY_NAME, SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS, SERVICE_AUTO_START, SERVICE_ERROR_NORMAL, service_path, NULL, NULL, TEXT("TCPIP\0"), NULL, NULL);ui_win_gui.c at around line 1622 the SERVICE_INTERACTIVE_PROCESS flag is set Is this flag necessary? I guess that would be the culprit. my reason to upgrade is because of the CVE-2022-0778 OpenSSL vulnerability anyone has a workaround for this? Microsoft has fully disabled Interactive Service Detection starting with Windows 10 Build 1803 and Windows Server 2016 and 2019. So, it looks like that that Interactive services are no longer allowed and this can't be circumvented by changing some registry setting like it seems it was possible before. thank you

3 5

issue with vendor trying to use proxy for tls
by Daniel Trickett 14 Apr '22

14 Apr '22

Hi stunnelers, We have a supplier which we are attempting punchout to ecommerce site. We use the url http://local-val.dc-clic.com:8899/punchout/request/0fd1ef2b-d09a-441d-b161-… to initiate punchout. The host local-val.dc.clic.com routes to our local host, where stunnel is listening on port 8899. Our config file contains the following below. accept = local-val.dc-clic.com:8899 connect = val.dc-clic.com:443 The application fails to connect and is trying to connect using the incorrect url. Error Code: 202 Supplier Site Does Not Respond Unable to send the Login Request XML. Supplier Login URL: http://local-val.dc-clic.com:8899/punchout/request/0fd1ef2b-d09a-441d-b161-… We use stunnel as tls proxy for various suppliers and have been encountering more issues lately. I am feeling that the long string after the request is causing an issue for stunnel, but unclear to us. Our understanding is stunnel will open the connection to https:// val.dc-clic.com:443/punchout/request/0fd1ef2b-d09a-441d-b161-5ada0e226b80. Stunnel log indicates that a connection is opened to val.dc-clic.com. Any help appreciated! Thanks and best regards Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here: merckgroup.com/privacy-statement-countries<https://www.merckgroup.com/en/privacy-statement/privacy-statement-countries…>

1 0

stunnel log message
by Daniel Trickett 01 Apr '22

01 Apr '22

Hello all, Happy Friday! Hope I can get some clarification on this entry from the stunnel log. The below shows up in our log, our input to stunnel is SSLv3. Is that all this is referring to? TLS state (connect): SSLv3 Thanks for your reply! Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here: merckgroup.com/privacy-statement-countries<https://www.merckgroup.com/en/privacy-statement/privacy-statement-countries…>

1 0

Stunnel version 5.63 and openssl 3.0.2 CA signature digest algorithm too weak
by c t browne 30 Mar '22

30 Mar '22

I upgraded to version 5.63 on openssl 3.02 and received a CA signature digest algorithm too week error. I tried setting the securityLevel to 2 and also to 1 and the error did not go away. I have no way to change the certificate on the remove system. Is there an way around this problem? Thanks, Carter

2 2

Can parent proxy see what's going through stunnel
by mingheng wang 28 Mar '22

28 Mar '22

Hi community, I'm using stunnel behind my company proxy like this: protocol=connect connect=proxy.ourcompany.com:3128 protocolHost=myownproxy.net:443 Since I notice that our company seems to be intercepting HTTPS because my web browser sometimes sees our company's certificate instead of the real websites'. So I want to make sure if the company proxy can see what's going through stunnel. Thanks in advance.

1 0

Stunnel aborted the workflow silently in half way
by ygaochn＠amazon.com 25 Mar '22

25 Mar '22

Hey stunnel-users, We are using stunnel as the encryption transit between our NFS client and server. Recently we detected that the stunnel aborted the workflow silently in half way for unknown reason. We'd like to understand what could be the potential reason that cause the issue. Stunnel version: 4.56/5.56, below logs are for 4.56, 5.56 is from customer report without detail log Occurance #1: 2022.03.17 02:19:58 LOG7[1105:139990955783936]: connect_blocking: s_poll_wait IP:PORT: waiting 10 seconds # -> There should be a `TIMEOUTconnect exceeded` failure if the connection failed, but there is no info about how is the waiting going on, there is no log further 2022.03.17 02:56:09 LOG7[1105:139990955789440]: Dispatching signals from the signal pipe Occurance #2: 2022.03.23 16:10:49 LOG6[19003:140551554406144]: CERT: Host name "**" matched with "**" # Aborted again, this is the handshake phase 2022.03.23 16:56:09 LOG7[19003:140551554411648]: Dispatching signals from the signal pipe From the PCAP of the #2 occurance, there is no client side cert and key send to server side, so we can rule out the network issue. 8510 2022-03-23 16:09:47.660910 A B TLSv1.2 5507 Server Hello, Certificate[Packet size limited during capture] 8511 2022-03-23 16:09:47.660919 B A TCP 68 38390 → 2049 [ACK] Seq=340 Ack=5440 Win=57472 Len=0 TSval=698509941 TSecr=1821371384 ... No other client side packet send to server side afterwards, server side are waiting Does anyone encounter this before? I searched the archive but there is no similar issue. What could cause stunnel swallow all the subsequent workflow? Thanks.

1 0

Fix the expansion of @sysconfdir@ in the sample config file
by Peter Pentchev 19 Mar '22

19 Mar '22

Hi, Thanks a lot for writing and maintaining stunnel over the years! What do you think about the attached trivial patch that makes sure @sysconfdir@ is expanded correctly in the sample config file? If something should go wrong with the attachment, it is also available at: https://salsa.debian.org/debian/stunnel/-/blob/master/debian/patches/05-sam… Thanks in advance, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)debian.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

the stunnel stops showing the ssl after a few hours of operation
by Daniel Cordero Gonzalez 18 Mar '22

18 Mar '22

I send an image of the error presented by the stunnel

1 0

the stunnel stops showing the ssl after a few hours of operation
by daniel＠hostingtico.com 18 Mar '22

18 Mar '22

hello, thank you very much for the opportunity to humbly ask for help, I had a server with centos 6 for approximately 3 years and the stunnel never gave me any problem, I recently changed my server with centos 7 but now after a few hours of being active it stops showing the ssl in the ports that I have configured to show shoutcast when viewing the stunnel status: service stunnel status after a few hours it shows most of the result in red and there it does not show the shoutcast in ssl, after giving restart: service stunnel restart everything returns to normal but before 6 hours the problem returns, Could someone give me a light to solve this problem, I'm running the latest version of stunnel my stunnel.conf: client=no [Orto] accept=7000 connect=208.77.20.179:8006 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [radio] accept=7002 connect=208.77.20.179:9942 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [Metro] accept=7004 connect=208.77.20.179:8014 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [arrge] accept=7006 connect=208.77.20.179:8016 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [radio2] accept=7008 connect=208.77.20.179:9932 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [Radiored] accept=7010 connect=208.77.20.179:8023 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2

1 0

stunnel error message
by Stephen McQuaid 18 Mar '22

18 Mar '22

Hello, I am getting the following error message in stunnel 2022.03.18 14:27:01 LOG3[0]: SSL_read (s_ssl_read_eof): Operation would block (WSAEWOULDBLOCK) (10035) 2022.03.18 14:27:01 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket But when I send a second email immediately after the first one, it goes through ok, does anyone know how to resolve this please?? Regards, Stephen McQuaid Local I.T. Office, Dublin, Ireland Henkel dx - creating the next [Ein Bild, das Schild, Ende, sitzend, Front enth?lt. Automatisch generierte Beschreibung] Office : +353-1-4046338 Mobile: +353-87-2470012 stephen.mcquaid(a)henkel.com<mailto:stephen.mcquaid@henkel.com> www.henkeldx.com<http://www.henkeldx.com/> Have a question visit Digital Business Norden<https://henkelgroup.sharepoint.com/teams/IBSNITInfoPortal/SitePages/IBS-Nor…>

1 0

stunnel 5.63 released
by Michał Trojnara 15 Mar '22

15 Mar '22

Dear Users, I have released version 5.63 of stunnel. ### Version 5.63, 2022.03.15, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.2. * New features - Updated stunnel.spec to support bash completion. * Bugfixes - Fixed a PRNG initialization crash (thx to Gleydson Soares). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c74c4e15144a3ae34b8b890bb31c909207301490bd1e51bfaaa5ffeb0a994617 stunnel-5.63.tar.gz 723f54c28073f17b1ac095a2ab9922735c69f73fba6144a5c68cc160dc673b10 stunnel-5.63-win64-installer.exe c77850c39dfb42f95d26d4f5830a261a95c3785d8c39bdd9f28764ba43ee1d7d stunnel-5.63-android.zip Best regards, Mike

1 0

src/ssl.c:319 - RAND_get_rand_method() may return NULL
by Gleydson Soares 03 Mar '22

03 Mar '22

Hello, The following patch avoids crashess. In src/ssl.c:prng_init(), the RAND_get_rand_method() may return NULL so strict the check to skip PRNG initialization. Diff inline below, against 5.62 gsoares --- ssl.c.orig Thu Mar 3 16:10:39 2022 +++ ssl.c Thu Mar 3 16:13:17 2022 @@ -354,7 +354,7 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *global) { const RAND_METHOD *meth=RAND_get_rand_method(); /* skip PRNG initialization when no seeding methods are available */ - if(meth->status==NULL || meth->add==NULL) { + if(meth==NULL || meth->status==NULL || meth->add==NULL) { s_log(LOG_DEBUG, "No PRNG seeding methods"); return 0; /* success */ }

1 0

Error -63 when connecting to Office 365 to retrieve emails
by sedick＠logicore.co.za 01 Mar '22

01 Mar '22

Hi All, A problem started recently with error -63 when connecting to office 365 server to retrieve emails. The code I am using are as follows: * variables ChannelNo = 0 Pop3Server = 'outlook.office365.com' Pop3User = UserName Pop3Pass = Password Pop3Port = '995' ProxYServer = '127.0.0.1' ProxyPort = '110' ProxyDir = 'C:\see4OI\SSL\' ProxyExe = 'stunnel.exe' ProxyCert = 'stunnel.pem' * retreives mail in MIME format Gosub GET_EMAILS return Mail_Rec * ----------------------------------------------------------------------------------------- GET_EMAILS: * close previous session If it wasnt closed properly Code = seeClose(ChannelNo) Code = seeRelease() * attach key code Code = seeAttach(1, KeyCode) if Code < 0 then RetFlag = 1 return end * start stunnel Code = seeSetProxySSL(0, 1, ProxyDir, ProxyCert, ProxyExe) If Code < 0 Then RETURN end * connect to email server Code = seePop3ConnectSSL(ChannelNo, ProxyPort, Pop3Port, Pop3Server, Pop3User, Pop3Pass, ProxyServer) If Code < 0 Then RETURN End Help urgently required please. Stunnel version 5.42 with a special exception for OpenSSL Kind Regards, Sedick

1 0

SmtpConnectSSL question
by sportman7＠netzero.com 28 Feb '22

28 Feb '22

When I use SmtpConectSSL I establish the SSL connection but Stunnel opens a Stunnel window. I would like the connection to run without this window. Anyone know how I can stop the window from opening? Is there a setting in .conf or a parameter for SmtpConnectSSL I need?

1 0

Re: tunnel for IMAP/SMTP
by Eberhard 13 Feb '22

13 Feb '22

Just saying -- if something is deprecated it does not mean you MUST stop using it. Use an older version of the software. You can of course have both -- put the older version in one place and the newer one in another. Configure your system to use whichever version you need. The habit of always updating "just because" is sometimes not good for you 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com https://www.facebook.com/groups/286143052248115 -----Original Message----- From: Germano Massullo <germano.massullo(a)gmail.com> On Behalf Of Caterpillar Sent: Saturday, February 12, 2022 7:18 AM To: Josealf.rm <josealf(a)rocketmail.com> Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: tunnel for IMAP/SMTP Il 10/02/22 01:56, Josealf.rm ha scritto: > OK, I see you’re using stunnel only on your client and it looks you’re > connecting using TLS 1.0 which is deprecated. > > My proposed solution runs stunnel on your server and aims to implement > a front end proxy to the imap/smtp product. This can give you the > support for new TLS versions and no need to run stunnel on your clients. No, I don't have access to the mail server machine. I just installed stunnel on a localhost VM, then lowered the VM minimum accepted TLS to 1.0, and then run Thunderbird from host machine. The latter will connect to the stunnel running in the VM _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org

1 0

tunnel for IMAP/SMTP
by Caterpillar 12 Feb '22

12 Feb '22

Good day. I need to be able to use Thunderbird to connect to a mail server (IMAP/SMTP) that has an obsolete TLS version (1.1) and I don't want to low the TLS minimum version on my computers. For this need I would like to use stunnel between Thunderbid clients and the mail server. I tried to use tutorial [1] plus "sslVersion = all" option, but I think the guide is quite incomplete. Do you have any other guide/tutoral that is more complete? Thank you [1]: https://petermolnar.com/secure-smtp-and-imap-sessions-with-stunnel/

3 4

stunnel (5.62 and 5.59) causing high load...
by erik＠baigar.de 06 Feb '22

06 Feb '22

Hi there, I was running stunnel successfully for many years (4.26 with older openssl) wrapping http and imap and upgraded for security reasons to openssl 1.1.1 with stunnel 5.59. The platform is somewhat exotic: SPARC Solaris 10 using gcc 3.4.6. The stunnel works for imap and https without problems for some time but after heavy load conditions it starts consuming 100% CPU load although it still works. In this case it is not the DH computation as no ciphers depending on that one are used: 2022.02.06 11:56:33 LOG6[ui]: DH initialization skipped: no DH ciphersuites On the life machine it happens e.g. after some script based port scan attacks and in a way to trigger the phenomenon I found, that running a cipher enumberate for example triggers the "high-load" state. Running nmap 7.80 the command doing the job is nmap --script ssl-enum-ciphers -p PORT SERVER-IP Checking the log-file (level 7) the end of the logfile after such a burst of acitity with the stunnel ennding up at 100% CPU load looks like that: 2022.02.06 14:23:17 LOG7[39]: Deallocating application specific data for session connect address 2022.02.06 14:23:17 LOG7[39]: linger (local): Invalid argument (22) 2022.02.06 14:23:17 LOG7[39]: Local descriptor (FD=22) closed 2022.02.06 14:23:17 LOG7[39]: Service [imaps] finished (6 left) 2022.02.06 14:23:14 LOG7[main]: FD=4 events=0x1 revents=0x1 2022.02.06 14:23:17 LOG7[main]: FD=11 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=12 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=13 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=14 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: Dispatching a signal from the signal pipe 2022.02.06 14:23:17 LOG7[main]: Processing SIGCHLD 2022.02.06 14:23:17 LOG7[main]: Retrieving pid statuses with waitpid() 2022.02.06 14:23:17 LOG7[main]: Retrieving pid statuses with waitpid() - DONE Remarkable is that some imaps (we named the IMAP service to be wrapped imaps) still seem to remain active (6 left). The last entry always is the one with the waitpid() and to be sure that it is not the while loop in that one (stunnel.c) I added an additional log entry "DONE" in the source whenever the routine is left - so it is not that easy. The workaround currently is a script monitoring the CPU usage of stunnel and killing/restarting it if >80% for extended period of time is observed, but that can just be a temporary solution. Any ideas what to try/debug locating the reason for the problem? Thanks, Erik. P.S. Experimenting with the timeouts does not alter the phenomenon. P.P.S. Here the active lines of the config file (deleted comments and unused lines to remove clutter): cert = /usr/local/etc/stunnel/stunnel.pem sslVersion = all chroot = /var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [imaps] accept = 14310 connect = 143 local = 127.0.0.1

1 0

Re: stunnel 5-15 minute outages
by Eberhard 05 Feb '22

05 Feb '22

I a hate to sound like a broken record – why not at least try inetd mode for a few days? If nothing else it will tell you if it is stunnel (either server issues or problems with continuing running programs) with little cost to you to try it. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com> Sent: Saturday, February 5, 2022 3:01 AM To: john.robertson.arnold(a)gmail.com Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: stunnel 5-15 minute outages We haven't taken any actions yet. We have so far believed that it was a network side issue, so we have been looking hard at the network devices and getting vendor cases open. We have been looking at packet captures to see if we can figure it out. We haven't found anything that points to the network, but still looking at that. Do you happen to have any load balancers in front of stunnel? I plan to recommend some changes to stunnel suggested in this thread. Thanks, and sorry you are facing this same issue. On Fri, Feb 4, 2022 at 11:36 PM <john.robertson.arnold(a)gmail.com <mailto:john.robertson.arnold@gmail.com> > wrote: I second your problem! We are experiencing what sounds like the same issue. We have had 8 outages since November. They come in pairs, roughly 48 hours apart. Each outage is between 10-12 minutes, then self resolves. I literally just came to this thread tonight while troubleshooting the latest outage. Did the suggestion in the thread work for you? _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org <mailto:stunnel-users-leave@stunnel.org> -- Steve Clement steve3279(a)gmail.com <mailto:steve3279@gmail.com> 614-632-7380

1 0

Re: stunnel 5-15 minute outages
by Eberhard 05 Feb '22

05 Feb '22

Which is why my advice is “strange.” We support so many Unix versions with thousands of users of various capabilities. I don’t want to have to learn secret tricks – especially as they change with versions of the O/S. So I use inetd – all the same on every O/S and always works. I see no reason not to do this unless you have a belief that there is a performance issue with it, which is possible I suppose but I suspect completely unlikely in modern computers. Further, inetd is running anyway so the server part is hardly affected by stunnel whereas if you use stunnel in server mode it has overhead … so a real picky person would do performance analysis and it still may be more efficient to use inetd depending on server overhead. Which is like different by O/S and computer hardware and … I worry about performance only when it actually matters. I’d rather concern myself with reliable with less maintenance on my part. My primary O/S is AIX which is stone reliable and requires little fussing with – hence using AIX to do the server part (inetd) makes my life easier. And probably 95% of the people here will disagree with me and that is fine because there is no “right” answer, just choices. I just think some people dismiss inetd out of hand because they were told a decade or two ago (I am old 😊 ) that performance was an issue and that remains the legend. And, I have helped several people overcome issues by changing to inetd, especially those with little experience in server management and/or O/S settings like Danny did (good job!). So please don’t flame me people – this is just explaining why one might consider using inetd mode, not making a case to always use it. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Danny Clowes <danny0809881(a)gmail.com> Sent: Friday, February 4, 2022 1:21 PM To: Eric Eberhard <flash(a)vicsmba.com> Cc: Steve Clement <steve3279(a)gmail.com>; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re: stunnel 5-15 minute outages Hi, Ive been using stunnel on number of servers for very long time over all experience has been very good not had any issues or concerns with the stunnel they never crash always online. Ive just tested stunnel on debian 11 it's working brilliant. The Linux system do have limitations in place and the client will only allow so many connections before it will close down say can't take anymore connections however I edited the Linux server remove limitation in place. These where teething issues when started to use stunnel. If anyone interested I would provide hidden scrects how make stunnel work like dream. On Fri, 4 Feb 2022, 19:04 Eberhard, <flash(a)vicsmba.com <mailto:flash@vicsmba.com> > wrote: I will give you strange advice assuming you are on Unix of some flavor. Use inetd. It always works or the O/S does not work 😊 It then becomes the actual server and a new instance of stunnel is fired for every connection. I use it because it is the most reliable way and takes no server software management. There is an old argument against this – it is in theory has less performance when a correction is created. I say theoretical as modern computers are so fast that creating a process millions of times does not stress a machine. I run 100s of millions of connections daily on a single computer and have zero performance issues. I also have zero issues like you described and I always had them before. Even if you do have an issue it would only affect one connection. Because each connection is unique. From your description it is the server process having an issue or perhaps some of the children not getting “clean” as they keep them running in a loop. With inetd it does it’s business and ends. There are no cross-connection or server issues. I give this advice several times a year and may ¼ take it and thank me. The rest mock the idea citing the theoretical performance difference (without even trying it) and continue to struggle. This is not just an issue with this version. Many versions have had trouble with running in a loop like that – memory management, variables not cleared, etc. And remember openssl is tied to this as well. The other thing I would recommend (also weird) is using static links. That way an install of say a new openssl (where your encryption issue appears to be now) won’t affect you. There is no way anyone is testing the software with every version of every O/S with every version of openssl. If you do a static link and have a working version, no need to change. Until a new TLS comes out or something but you can control that well when you have a static link. And that, BTW, theoretically loads faster. The program is much bigger but in need not load dynamic libraries from all over the place when it is fired up. Let me know what you find out and do 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com <mailto:steve3279@gmail.com> > Sent: Friday, February 4, 2022 4:52 AM To: stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Subject: [stunnel-users] stunnel 5-15 minute outages Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com <mailto:steve3279@gmail.com> 614-632-7380 _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org <mailto:stunnel-users-leave@stunnel.org>

3 2

stunnel 5-15 minute outages
by Steve Clement 05 Feb '22

05 Feb '22

Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com 614-632-7380

2 2

Re: stunnel 5-15 minute outages
by Eberhard 04 Feb '22

04 Feb '22

I will give you strange advice assuming you are on Unix of some flavor. Use inetd. It always works or the O/S does not work 😊 It then becomes the actual server and a new instance of stunnel is fired for every connection. I use it because it is the most reliable way and takes no server software management. There is an old argument against this – it is in theory has less performance when a correction is created. I say theoretical as modern computers are so fast that creating a process millions of times does not stress a machine. I run 100s of millions of connections daily on a single computer and have zero performance issues. I also have zero issues like you described and I always had them before. Even if you do have an issue it would only affect one connection. Because each connection is unique. From your description it is the server process having an issue or perhaps some of the children not getting “clean” as they keep them running in a loop. With inetd it does it’s business and ends. There are no cross-connection or server issues. I give this advice several times a year and may ¼ take it and thank me. The rest mock the idea citing the theoretical performance difference (without even trying it) and continue to struggle. This is not just an issue with this version. Many versions have had trouble with running in a loop like that – memory management, variables not cleared, etc. And remember openssl is tied to this as well. The other thing I would recommend (also weird) is using static links. That way an install of say a new openssl (where your encryption issue appears to be now) won’t affect you. There is no way anyone is testing the software with every version of every O/S with every version of openssl. If you do a static link and have a working version, no need to change. Until a new TLS comes out or something but you can control that well when you have a static link. And that, BTW, theoretically loads faster. The program is much bigger but in need not load dynamic libraries from all over the place when it is fired up. Let me know what you find out and do 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com> Sent: Friday, February 4, 2022 4:52 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel 5-15 minute outages Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com <mailto:steve3279@gmail.com> 614-632-7380

2 1

Use Stunnel with CMD
by gilaguigui＠gmail.com 02 Feb '22

02 Feb '22

Hi, I am trying to use stunnel with CMD (as a service) I get pop up message for each command (service installed \ service stopped etc.) the command in CMD: stunnel.exe -install\ -uninstall.... how can I disable it? run stunnel with no pop up? thanks GG.

1 0

New to stunnel! Need help connecting to a REST API
by Tim Townsend 18 Jan '22

18 Jan '22

Hello! I need help! We have an integration from an ERP package to a REST API (Avatax) that will soon be requiring TLS 1.2 connections. Our tech platform does not have built-in support for TLS 1.2, so I'm hoping to be able to use stunnel to make that happen. Where do I start? What would the conf file section look like for this? I don't see this directly discussed in the documentation. Any help appreciated! [cid:image001.jpg@01D80C02.6F1F2690] Tim Townsend Programmer Earnest & Associates * Profitability Improvement Specialists Voice: 410.766.6076<tel:+14107666076> ext 210 Email: tim.townsend(a)earnestassoc.com<mailto:tim.townsend@earnestassoc.com> * Web: earnestassoc.com<http://www.earnestassoc.com/>

1 0

stunnel 5.62 released
by Michał Trojnara 17 Jan '22

17 Jan '22

Dear Users, I have released version 5.62 of stunnel. ### Version 5.62, 2022.01.17, urgency: MEDIUM * New features - Added a bash completion script. * Bugfixes - Fixed a transfer() loop bug. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 9cf5bb949022aa66c736c1326554cca27d0641605a6370274edc4951eb5bd339 stunnel-5.62.tar.gz fbfcc5759344bcafff9ff3bc6cf56c7fb75cb1244b76d4934c5d9a3eb7eee32d stunnel-5.62-win64-installer.exe 4b52ed6e4bb8293fdefb10ee8c271400a8c1749254a11b674ff690eae00b3c5e stunnel-5.62-android.zip Best regards, Mike

1 0

Re: stunnel 5.61transfer() loop executes not transferring any data Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket inetd mode
by Roberto CORRADO 17 Jan '22

17 Jan '22

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Mike, Good job! Stunnel 5.62 beta 1 work fine! """ 2022.01.16 22:08:47 LOG6[ui]: Initializing inetd mode configuration 2022.01.16 22:08:47 LOG5[ui]: stunnel 5.62 on i586-slackware-linux-gnu platform 2022.01.16 22:08:47 LOG5[ui]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2022.01.16 22:08:47 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2022.01.16 22:08:47 LOG6[ui]: Initializing inetd mode configuration 2022.01.16 22:08:47 LOG5[ui]: Reading configuration from file /etc/stunnel/imaps.conf 2022.01.16 22:08:47 LOG5[ui]: UTF-8 byte order mark not detected 2022.01.16 22:08:47 LOG5[ui]: FIPS mode disabled 2022.01.16 22:08:47 LOG6[ui]: Compression enabled: 0 methods 2022.01.16 22:08:47 LOG6[ui]: stunnel default security level set: 2 2022.01.16 22:08:47 LOG6[ui]: Session resumption enabled 2022.01.16 22:08:47 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: DH initialization needed for DHE-RSA-AES256-GCM-SHA384 2022.01.16 22:08:47 LOG6[ui]: 4096-bit DH parameters loaded 2022.01.16 22:08:47 LOG5[ui]: Configuration successful 2022.01.16 22:08:47 LOG5[0]: Service [stunnel] accepted connection from 10.19.79.235:41136 2022.01.16 22:08:47 LOG6[0]: Peer certificate not required 2022.01.16 22:08:47 LOG6[0]: No peer certificate received 2022.01.16 22:08:47 LOG6[0]: Session id: 65640462303D0DA1CD16CAB4977F22B04FFB74693150104FC69AB9FBDC48AED9 2022.01.16 22:08:47 LOG6[0]: No peer certificate received 2022.01.16 22:08:47 LOG6[0]: Session id: B9505D917FA6F2E9C8A0EF14D6E4B01C3ED54599271D93E325ED7412CA2AC5F3 2022.01.16 22:08:47 LOG6[0]: TLS accepted: new session negotiated 2022.01.16 22:08:47 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.01.16 22:08:47 LOG6[0]: Peer temporary key: X25519, 253 bits 2022.01.16 22:08:47 LOG6[0]: Local mode child started (PID=16984) 2022.01.16 22:08:47 LOG6[0]: TLS closed (SSL_read) 2022.01.16 22:08:47 LOG6[0]: Read socket closed (readsocket) 2022.01.16 22:08:47 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2022.01.16 22:08:47 LOG5[0]: Connection closed: 979 byte(s) sent to TLS, 128 byte(s) sent to socket """ Thanks a lot! - -Roberto -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAmHkjDoACgkQWVOoL214ZeGntwCbBtV1G/J2uThR06ftFC+F2XTP KeQAnjnCTOrk26zzcsNsCOQoWg54MWhD =alm2 -----END PGP SIGNATURE----- ----- Original Message ----- Sent: Sunday, January 16, 2022 9:52 PM Michał Trojnara wrote: > Hi Roberto, > > Could you try https://www.stunnel.org/downloads/beta/stunnel-5.62b1.tar.gz ? > > Best regards, > Mike

2 1

I NEED A HELP TO SETUP THE SSL/TLS EMAILS SUPPORT
by Muj 01 Jan '22

01 Jan '22

HI TECHNICAL SUPPORT, FIRSTLY, I AM APOLOGIZING TO YOU FOR WRITING WITH LARGE CAPS ONLY, IT IS BECAUSE RECENTLY I GOT A BRAIN STROKE AND AM NOT RECOVERED YET. AS FOR MY ISSUE, TO UNDERSTAND IT BETTER, THE FOLLOWING IS MY INFO. - I HAVE AN OLD WINDOWS-XP 32BIT OS. - I AM USING TERABYTE 2.99 TO BACKUP AND RESTORE MY OS, BUT LOOSING MANY EMAILS BECAUSE TERABYTE IS NO LONGER SUPPORTING 2.99 VERSION. THEY SUPPORT RESTORING ALL EMAILS BEGINNING FROM 3 VERSION. THEREFORE, THEY HAVE RECOMMENDED ME TO CONTACT YOU DIRECTLY. NOW WHAT I DID SO FAR. - I DOWNLOADED AND INSTALLED YOUR STUNNEL 4.53 - AFTER AUTOMATIC SETTING, EDITING STUNNEL.CONF FILE, MAKING SOME CHANGES IN IT AND SAVING IT, THE SERVER WENT DOWN. ATTACHED PLEASE FIND STUNNEL.CONF TXT FILE. - BECAUSE THE SERVER WENT DOWN, I TRIED TO DOWNLOAD AND INSTALL STUNNEL AGAIN, BUT ALWAYS GOT THE SAME ERROR MESSAGE.PLEASE CAN YOU HELP ME WITH THIS ISSUE? - I HAVE 3 POP3 EMAIL ACCOUNTS AND 1 IMAP. ALL REQUIRE A CONNECTION SECURITY SSL/TLS. *PLEASE, I NEED TO KNOW HOW **TO COMPLETELY REMOVE THE CURRENT STUNNEL PROGRAM AND AFTER THAT, WHAT STUNNEL VERSION I SHOULD **DOWNLOAD AGAIN **TO BE ABLE TO SET IT UP*. AFTER A SUCCESSFUL NEW INSTALLATION I WOULD GIVE YOU MORE NEEDED INFO FOR SETTING UP MY EMAILS. PLEASE LET ME KNOW IN YOUR BEST CONVENIENCE AND HAVE A BEAUTIFUL NEW YEAR 2022. KIND REGARDS, MARTIN

1 0

stunnel 5.61transfer() loop executes not transferring any data Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket inetd mode
by Roberto CORRADO 29 Dec '21

29 Dec '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 """ 2021.12.28 14:03:40 LOG6[ui]: Initializing inetd mode configuration 2021.12.28 14:03:40 LOG5[ui]: stunnel 5.61 on i586-slackware-linux-gnu platform 2021.12.28 14:03:40 LOG5[ui]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2021.12.28 14:03:40 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.12.28 14:03:40 LOG6[ui]: Initializing inetd mode configuration 2021.12.28 14:03:40 LOG5[ui]: Reading configuration from file /etc/stunnel/imaps.conf 2021.12.28 14:03:40 LOG5[ui]: UTF-8 byte order mark not detected 2021.12.28 14:03:40 LOG5[ui]: FIPS mode disabled 2021.12.28 14:03:40 LOG6[ui]: Compression enabled: 0 methods 2021.12.28 14:03:40 LOG6[ui]: stunnel default security level set: 2 2021.12.28 14:03:40 LOG6[ui]: Session resumption enabled 2021.12.28 14:03:40 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: DH initialization skipped: no DH ciphersuites 2021.12.28 14:03:40 LOG5[ui]: Configuration successful 2021.12.28 14:03:40 LOG5[0]: Service [stunnel] accepted connection from 127.0.0.1:40876 2021.12.28 14:03:40 LOG6[0]: Peer certificate not required 2021.12.28 14:03:40 LOG6[0]: No peer certificate received 2021.12.28 14:03:40 LOG6[0]: Session id: 0E092C2715D12901219C3E0F54DFA029F7C50040C7EC8F8C88211BA6883B9D1F 2021.12.28 14:03:40 LOG6[0]: No peer certificate received 2021.12.28 14:03:40 LOG6[0]: Session id: 26CFB9D13C499CE27C4ED1575FDF3FB2604C616418BA6068849B49EF75AF2162 2021.12.28 14:03:40 LOG6[0]: TLS accepted: new session negotiated 2021.12.28 14:03:40 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2021.12.28 14:03:40 LOG6[0]: Peer temporary key: X25519, 253 bits 2021.12.28 14:03:40 LOG6[0]: Local mode child started (PID=4997) 2021.12.28 14:03:40 LOG3[0]: transfer() loop executes not transferring any data 2021.12.28 14:03:40 LOG3[0]: please report the problem to Michal.Trojnara(a)stunnel.org 2021.12.28 14:03:40 LOG3[0]: stunnel 5.61 on i586-slackware-linux-gnu platform 2021.12.28 14:03:40 LOG3[0]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2021.12.28 14:03:40 LOG3[0]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.12.28 14:03:40 LOG3[0]: protocol=TLSv1.3, SSL_pending=0, SSL_has_pending=0 2021.12.28 14:03:40 LOG3[0]: sock_open_rd=Y, sock_open_wr=Y 2021.12.28 14:03:40 LOG3[0]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2021.12.28 14:03:40 LOG3[0]: sock_can_rd=n, sock_can_wr=n 2021.12.28 14:03:40 LOG3[0]: ssl_can_rd=n, ssl_can_wr=n 2021.12.28 14:03:40 LOG3[0]: read_wants_read=Y, read_wants_write=n 2021.12.28 14:03:40 LOG3[0]: write_wants_read=n, write_wants_write=Y 2021.12.28 14:03:40 LOG3[0]: shutdown_wants_read=n, shutdown_wants_write=n 2021.12.28 14:03:40 LOG3[0]: socket input buffer: 154 byte(s), TLS input buffer: 0 byte(s) 2021.12.28 14:03:40 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket """ """ debug = info output = /var/log/stunnel-imaps.log cert = /etc/stunnel/stunnel.pem exec = /usr/sbin/imapd execargs = imapd sslVersion = all options = NO_SSLv2 options = NO_SSLv3 """ -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAmHLE48ACgkQWVOoL214ZeFpYwCfe+qv09KWSfjNixhhcb5MJbr2 yAkAoKOyXZJwnKddSXYzIhbi7k1yPkoU =oGR+ -----END PGP SIGNATURE-----

1 0

Config to only listen when connect port is up
by roartysa＠gmail.com 23 Dec '21

23 Dec '21

Is there a config flag that can be set in the conf file that will tell stunnel to listen on the https accept port only when the connect port is up and listening? The issue i am trying to address is when a load balancer talks to a server, I need to make sure the port that stunnel redirects to is healthy. Right now the load balancer will send traffic to the port all the time regardless of the health of the port that stunnel redirects the traffic to.

2 1

stunnel 5.61 released
by Michał Trojnara 22 Dec '21

22 Dec '21

Dear Users, I have released version 5.61 of stunnel. ### Version 5.61, 2021.12.22, urgency: LOW * New features sponsored by the University of Maryland - Added new "protocol = capwin" and "protocol = capwinctrl" configuration file options. * New features for the Windows platform - Added client mode allowing authenticated users to view logs, reconfigure and terminate running stunnel services. - Added support for multiple GUI and service instances distinguised by the location of stunnel.conf. - Improved log window scrolling. - Added a new 'Pause auto-scroll' GUI checkbox. - Double click on the icon tray replaced with single click. - OpenSSL DLLs updated to version 3.0.1. * Other new features - Rewritten the testing framework in python (thx to Peter Pentchev for inspiration and initial framework). - Added support for missing SSL_set_options() values. - Updated stunnel.spec to support RHEL8. * Bugfixes - Fixed OpenSSL 3.0 build. - Fixed reloading configuration with "systemctl reload stunnel.service". - Fixed incorrect messages logged for OpenSSL errors. - Fixed printing IPv6 socket option defaults on FreeBSD. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 91ea0ca6482d8f7e7d971ee64ab4f86a2817d038a372f0893e28315ef2015d7a stunnel-5.61.tar.gz 19c5ff1f4101af1e69585328303c14249db2ec9063542101ca31edb6f6cc502f stunnel-5.61-win64-installer.exe 928ec94690564498bf523228946b2cdc90c7e346d6f0baf1f71b76cbe769b96c stunnel-5.61-android.zip Best regards, Mike

1 0

Log4j Vulnerability
by Tracy Drake - IQGC-C 17 Dec '21

17 Dec '21

Hello! Can you please tell me if Stunnel uses log4j and/or if it is vulnerable to it? Your feedback would be greatly appreciated! Thanks in advance! -- *TRACY DRAKE | CSM URSA/Infoconnect Training and Support* GSA COMET Hale Bopp Contract Work Phone: 704-253-5193 | Email: tracy.drake(a)gsa.gov

2 1

issue with connection sending cxml out
by Daniel Trickett 08 Dec '21

08 Dec '21

Hi, We are trying to send a cxml message from an old app using ssl_v3 to a client server using tls 1.2. We negotiate a connection and then the below happens. Any thoughts? This is on our test server. 2021.12.08 14:26:55 LOG6[12]: TLS connected: new session negotiated 2021.12.08 14:26:55 LOG6[12]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2021.12.08 14:26:55 LOG7[12]: Compression: null, expansion: null 2021.12.08 14:26:55 LOG7[12]: TLS alert (read): warning: close notify <<< 2021.12.08 14:26:55 LOG6[12]: TLS closed (SSL_read) 2021.12.08 14:26:55 LOG7[12]: Sent socket write shutdown 2021.12.08 14:26:55 LOG6[12]: Read socket closed (readsocket) 2021.12.08 14:26:55 LOG7[12]: Sending close_notify alert 2021.12.08 14:26:55 LOG7[12]: TLS alert (write): warning: close notify 2021.12.08 14:26:55 LOG6[12]: SSL_shutdown successfully sent close_notify alert 2021.12.08 14:26:55 LOG5[12]: Connection closed: 10187 byte(s) sent to TLS, 561 byte(s) sent to socket Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here emdgroup.com/en/privacy-statement.html<https://www.emdgroup.com/en/privacy-statement.html>

1 0

Revert automatically to https
by cnocera＠hyhat.com 08 Dec '21

08 Dec '21

With stunnel, is there a way for the website to automatically revert to https by just typing in the url without https:// in front of it?

1 0

Insecure file permissions on /etc/ssl/private.key
by jose isaias cabrera 29 Nov '21

29 Nov '21

Greetings! I have duckduckgo'ed and I have not found an answer, but what should be the permissions for the private key since the stunnel is giving me a warning/error regarding that: ... [ ] Loading private key from file: /etc/ssl/private.key [:] Insecure file permissions on /etc/ssl/private.key [ ] Private key loaded from file: /etc/ssl/private.key ... this is that I have set: jic@web:~$ ls -l /etc/ssl/private.key -rw-r--r-- 1 root www-data 1702 Oct 13 02:54 /etc/ssl/private.key the www-data is the user that runs the website. All is running well, apparently, but, I would like to set the correct permission on the private.key file. Thanks for your support. josé -- What if eternity is real? Where will you spend it? Hmmmm...

4 6

Althttpd web server setup using ZeroSSL
by jose isaias cabrera 29 Nov '21

29 Nov '21

Greetings! I have the ssl files from ZeroSSL, and I am trying to set up https using stunnel4 on an ubuntu server. I am new to https, I would love some of your help setting this up. Here is what I have done so far: 1. Installed Althttpd and http is working fine on the home network and from the external network. 2. I have installed stunnel4 on the ubuntu server jcabrera@selva:~$ stunnel -v [ ] Clients allowed=500 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled with OpenSSL 1.1.1c 28 May 2019 [.] Running with OpenSSL 1.1.1f 31 Mar 2020 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [!] Invalid configuration file name "-v" [!] realpath: No such file or directory (2) [ ] Deallocating section defaults 3. I have placed the ZeroSSl ssl files on the ssl directory as per ZeroSSL instructions jcabrera@selva:~$ ls -l /etc/ssl/*.crt -rw-r--r-- 1 root root 2431 Oct 20 16:27 /etc/ssl/ca_bundle.crt -rw-r--r-- 1 root root 2354 Oct 20 16:31 /etc/ssl/certificate.crt root@selva:/home/jcabrera# ls -l /etc/ssl/private/*.key -rw-r--r-- 1 root root 1702 Oct 20 16:33 /etc/ssl/private/private.key 4. Created the the /etc/stunnel/stunnel.conf file with these entries: root@selva:/home/jcabrera# cat /etc/stunnel/stunnel.conf cert = /etc/ssl/certificate.crt key = /etc/ssl/private/private.key \[https\] accept = :::443 TIMEOUTclose = 0 exec = /usr/bin/althttpd execargs = /usr/bin/althttpd -logfile ~/www/http.log -root ~/www -user www-data -https 1 And, I don't know what else to do. Any help would be greatly appreciated. Thanks. josé -- What if eternity is real? Where will you spend it? Hmmmm...

2 3

Office 365 connections stopped working
by Ben Bazian 26 Nov '21

26 Nov '21

This has been working for years and recently stopped. I am a novice here. Can someone look at this and please tell me what is happening? It is an old server that does not support TLS so we put Stunnel in front of it. I am sure the version of stunnel is pretty old. Maybe a TLS level issue? 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG6[21968:139797665822784]: Initializing service [SMTP Outgoing] 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG6[21968:139797665822784]: Initializing service [IMAP] 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG5[21968:139797665822784]: Configuration successful 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [POP3 Incoming] (FD=12) bound to 0.0.0.0:110 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [SMTP Outgoing] (FD=13) bound to 0.0.0.0:25 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [IMAP] (FD=14) bound to 0.0.0.0:143 2021.10.26 14:47:30 LOG7[21974:139797665822784]: Created pid file /var/run/stunnel.pid 2021.10.26 14:48:30 LOG7[21974:139797665822784]: Service [IMAP] accepted (FD=3) from 10.55.3.159:1852 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] started 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Waiting for a libwrap process 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Acquired libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Releasing libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Released libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] permitted by libwrap from 10.55.3.159:1852 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Service [IMAP] accepted connection from 10.55.3.159:1852 2021.10.26 14:48:30 LOG6[21974:139797665818368]: connect_blocking: connecting 52.96.87.226:993 2021.10.26 14:48:30 LOG7[21974:139797665818368]: connect_blocking: s_poll_wait 52.96.87.226:993: waiting 10 seconds 2021.10.26 14:48:30 LOG5[21974:139797665818368]: connect_blocking: connected 52.96.87.226:993 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Service [IMAP] connected remote server from 10.55.3.200:51358 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Remote socket (FD=16) initialized 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SNI: sending servername: outlook.office365.com 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SSL state (connect): before/connect initialization 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SSL state (connect): SSLv3 write client hello A 2021.10.26 14:48:30 LOG3[21974:139797665818368]: SSL_connect: Peer suddenly disconnected 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Remote socket (FD=16) closed 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Local socket (FD=3) closed 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] finished (0 left)

4 5

setting permissions on a unix socket
by David Mandelberg 03 Nov '21

03 Nov '21

Hi, Is there any way for stunnel to set permissions on a unix socket created with the `accept` option? I see setuid and setgid at https://www.stunnel.org/static/stunnel.html but nothing about a umask or permissions. P.S. The link on https://www.stunnel.org/lists.html to see the archive is broken. Apologies if this has come up before.

1 0

Stunnel connection to Akamai Cloud Servers (Hostheaders) with SNI
by Alan C. Bonnici 06 Oct '21

06 Oct '21

Hi, I am trying to use stunnel to exchange data with a service hosted on Akamai Servers. There is a need to implement SNI. In posts dated from 2016 which I found online, Stunnel did not support Host Headers. Is there a workaround, or has Stunnel implemented this functionality? I will be testing using postman. A sample config to get me going would really be appreciated. The URL is related to plivo. It is ak-api.plivo.com. Thank you in anticipation.

3 6

Is it possible to inhibit writing the stunnel logs to the / var / log / messages file?
by simona vittori 28 Sep '21

28 Sep '21

Hello, I ask you if it's possible to inhibit writing the stunnel logs to the / var / log / messages file. How do you it? Thank you in advance Bye Simona

2 1

Need a clean way to reject a client IP
by robin.kerdiles＠emanrisk.fr 28 Sep '21

28 Sep '21

Hello everyone, I'm doing a few tests on a dockerized service for stunnel under Alpine. stunnel -version stunnel 5.60 on x86_64-alpine-linux-musl platform Compiled with OpenSSL 1.1.1k 25 Mar 2021 Running with OpenSSL 1.1.1l 24 Aug 2021 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI If I set a wrong certificate on client side, my server logs get spammed with these lines : 2021.09.28 07:43:52 LOG5[66]: Service [***] accepted connection from *** 2021.09.28 07:43:52 LOG4[66]: CERT: Pre-verification error: unable to get local issuer certificate 2021.09.28 07:43:52 LOG4[66]: Rejected by CERT at depth=2: C=***, O=***, CN=*** 2021.09.28 07:43:52 LOG3[66]: SSL_accept: ssl/statem/statem_srvr.c:3711: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed 2021.09.28 07:43:52 LOG5[66]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket The cpu usage goes up to 35% and it seems there is no way to set a timeout before trying to reconnect on client side (which is not the perfect fix by the way). On server side, I don't know if we are supposed to be able to do something about that (for example rate limiting the requests ?). Even the fail2ban filter doesn't seem to support this case. And anyway it seems it requires manual patching on stunnel source code for the logs. Would it be possible to put on the same line the client IP and a message about the connection which has been rejected ? fail2ban filter : https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/stunnel.co… What would be appreciated -> a log line in this format : 2021.09.28 07:43:52 LOG4[66]: HOST has been rejected by CERT at depth=2: C=***, O=***, CN=*** Of course, I don't have in mind the other possible cases (missing cert, etc...). Thank you in advance, Robin KERDILES

2 1

Disguising HTTP 503 services unavailable
by Haruka Takagi 18 Sep '21

18 Sep '21

It is my understanding that; stunnel clients give up connecting servers because of HTTP 503 services unavailable, tunneling failure causes stunnel clients to notify original senders of errors, and original senders acknowledge communication failure and stop program. I would like stunnel clients to reconnecting servers in cases of 503 and not to notify original senders of failure, in order that original senders are unaware of failure and can continue program. If possible, I want to do this by writing stunnel.conf without modifying souce codes. Is this configuration possible?

4 5

protocol = proxy with redirect
by Rob Hoes 15 Sep '21

15 Sep '21

Hi, I am using client certificate verification with the redirect option, so that the connection gets transferred to a separate socket in case the certificate is not accepted (rather than dropping the connection). This works well, unless I add the option “protocol = proxy” in order to get the client’s TCP params passed on. In this case, the redirect option seems to be ignored. Are the “redirect” and “protocol = proxy” options incompatible with one another? Is there an alternative? Thanks, Rob

2 1

How to resolve DNS by stunnel?
by shiga＠smart-cast.co.jp 14 Sep '21

14 Sep '21

Hi, I'm facing DNS issues when connecting to a server using a dynamic IP address. I think stunnel refers to DNS at startup, so if the IP address changes in the middle, it will get a connection error. Can this be resolved with the "delay=on" option? I'm looking for a way to handle a dynamic IP address in stunnel. Thanks.

2 1

Session reuse problem
by Alen Loncaric 10 Sep '21

10 Sep '21

Hi guys, any reason my stunnel would not reuse sessions? 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): before SSL initialization 2021.09.09 13:14:00 LOG6[8]: writesocket: Socket is closed 2021.09.09 13:14:00 LOG7[9]: Initializing application specific data for session authenticated 2021.09.09 13:14:00 LOG5[8]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:00 LOG7[8]: Remote descriptor (FD=10) closed 2021.09.09 13:14:00 LOG7[8]: Local descriptor (FD=3) closed 2021.09.09 13:14:00 LOG7[8]: Service [squid] finished 2021.09.09 13:14:00 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:00 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:00 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:00 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:00 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:00 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:00 LOG6[ui]: Process 1933 finished with code 0 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server hello 2021.09.09 13:14:00 LOG6[9]: Certificate verification disabled 2021.09.09 13:14:00 LOG6[9]: Certificate verification disabled 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server certificate 2021.09.09 13:14:00 LOG6[9]: Client certificate not requested 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server done 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write client key exchange 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write change cipher spec 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server session ticket 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read change cipher spec 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read finished 2021.09.09 13:14:00 LOG7[9]: New session callback 2021.09.09 13:14:00 LOG7[9]: Peer certificate was cached (2037 bytes) 2021.09.09 13:14:00 LOG6[9]: Session id: DC783240F69C6910A2F8B9829504840EF619E30A14FEA982C944FBFB6828555F 2021.09.09 13:14:00 LOG7[9]: 1 client connect(s) requested 2021.09.09 13:14:00 LOG7[9]: 1 client connect(s) succeeded 2021.09.09 13:14:00 LOG7[9]: 0 client renegotiation(s) requested 2021.09.09 13:14:00 LOG7[9]: 0 session reuse(s) 2021.09.09 13:14:00 LOG6[9]: TLS connected: new session negotiated 2021.09.09 13:14:00 LOG6[9]: TLSv1.2 ciphersuite: AES128-GCM-SHA256 (128-bit encryption) 2021.09.09 13:14:00 LOG3[9]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2021.09.09 13:14:00 LOG7[9]: Compression: null, expansion: null 2021.09.09 13:14:01 LOG6[9]: Read socket closed (readsocket) 2021.09.09 13:14:01 LOG7[9]: Sending close_notify alert 2021.09.09 13:14:01 LOG6[9]: socket fd: Broken pipe (32) 2021.09.09 13:14:01 LOG7[9]: TLS alert (write): warning: close notify 2021.09.09 13:14:01 LOG6[9]: SSL_shutdown successfully sent close_notify alert 2021.09.09 13:14:01 LOG6[9]: writesocket: Socket is closed 2021.09.09 13:14:01 LOG5[9]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:01 LOG7[9]: Remote descriptor (FD=10) closed 2021.09.09 13:14:01 LOG7[9]: Local descriptor (FD=3) closed 2021.09.09 13:14:01 LOG7[9]: Service [squid] finished 2021.09.09 13:14:01 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:01 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:01 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:01 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:01 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:01 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:01 LOG6[ui]: Process 1934 finished with code 0 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: Service [squid] accepted (FD=3) from 127.0.0.1:49567 2021.09.09 13:14:03 LOG7[10]: Service [squid] started 2021.09.09 13:14:03 LOG7[10]: Setting local socket options (FD=3) 2021.09.09 13:14:03 LOG7[10]: Option TCP_NODELAY set on local socket 2021.09.09 13:14:03 LOG5[10]: Service [squid] accepted connection from 127.0.0.1:49567 2021.09.09 13:14:03 LOG6[10]: s_connect: connecting 44.44.44.44:522 2021.09.09 13:14:03 LOG7[10]: s_connect: s_poll_wait 44.44.44.44:522: waiting 10 seconds 2021.09.09 13:14:03 LOG7[10]: FD=6 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[10]: FD=10 events=0x5 revents=0x0 2021.09.09 13:14:03 LOG5[10]: s_connect: connected 44.44.44.44:522 2021.09.09 13:14:03 LOG5[10]: Service [squid] connected remote server from 10.1.3.57:42843 2021.09.09 13:14:03 LOG7[10]: Setting remote socket options (FD=10) 2021.09.09 13:14:03 LOG7[10]: Option TCP_NODELAY set on remote socket 2021.09.09 13:14:03 LOG7[10]: Remote descriptor (FD=10) initialized 2021.09.09 13:14:03 LOG6[10]: SNI: sending servername: 44.44.44.44 2021.09.09 13:14:03 LOG6[10]: Peer certificate not required 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): before SSL initialization 2021.09.09 13:14:03 LOG7[10]: Initializing application specific data for session authenticated 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server hello 2021.09.09 13:14:03 LOG6[10]: Certificate verification disabled 2021.09.09 13:14:03 LOG6[10]: Certificate verification disabled 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server certificate 2021.09.09 13:14:03 LOG6[10]: Client certificate not requested 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server done 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write client key exchange 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write change cipher spec 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server session ticket 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read change cipher spec 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read finished 2021.09.09 13:14:03 LOG7[10]: New session callback 2021.09.09 13:14:03 LOG7[10]: Peer certificate was cached (2037 bytes) 2021.09.09 13:14:03 LOG6[10]: Session id: 85FD50E2A9D57B12D315C834EBA949CF015B7776C6A18486B06CE53F4C52D689 2021.09.09 13:14:03 LOG7[10]: 1 client connect(s) requested 2021.09.09 13:14:03 LOG7[10]: 1 client connect(s) succeeded 2021.09.09 13:14:03 LOG7[10]: 0 client renegotiation(s) requested 2021.09.09 13:14:03 LOG7[10]: 0 session reuse(s) 2021.09.09 13:14:03 LOG6[10]: TLS connected: new session negotiated 2021.09.09 13:14:03 LOG6[10]: TLSv1.2 ciphersuite: AES128-GCM-SHA256 (128-bit encryption) 2021.09.09 13:14:03 LOG3[10]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2021.09.09 13:14:03 LOG7[10]: Compression: null, expansion: null 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: Service [squid] accepted (FD=3) from 127.0.0.1:49569 2021.09.09 13:14:03 LOG7[11]: Service [squid] started 2021.09.09 13:14:03 LOG7[11]: Setting local socket options (FD=3) 2021.09.09 13:14:03 LOG7[11]: Option TCP_NODELAY set on local socket 2021.09.09 13:14:03 LOG5[11]: Service [squid] accepted connection from 127.0.0.1:49569 2021.09.09 13:14:03 LOG6[11]: s_connect: connecting 44.44.44.44:522 2021.09.09 13:14:03 LOG7[11]: s_connect: s_poll_wait 44.44.44.44:522: waiting 10 seconds 2021.09.09 13:14:03 LOG7[11]: FD=6 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[11]: FD=10 events=0x5 revents=0x0 2021.09.09 13:14:03 LOG5[11]: s_connect: connected 44.44.44.44:522 2021.09.09 13:14:03 LOG5[11]: Service [squid] connected remote server from 10.1.3.57:42845 2021.09.09 13:14:03 LOG6[10]: Read socket closed (readsocket) 2021.09.09 13:14:03 LOG7[11]: Setting remote socket options (FD=10) 2021.09.09 13:14:03 LOG7[11]: Option TCP_NODELAY set on remote socket 2021.09.09 13:14:03 LOG7[11]: Remote descriptor (FD=10) initialized 2021.09.09 13:14:03 LOG7[10]: Sending close_notify alert 2021.09.09 13:14:03 LOG6[11]: SNI: sending servername: 44.44.44.44 2021.09.09 13:14:03 LOG6[10]: socket fd: Broken pipe (32) 2021.09.09 13:14:03 LOG6[11]: Peer certificate not required 2021.09.09 13:14:03 LOG7[10]: TLS alert (write): warning: close notify 2021.09.09 13:14:03 LOG6[10]: SSL_shutdown successfully sent close_notify alert 2021.09.09 13:14:03 LOG6[10]: writesocket: Socket is closed 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): before SSL initialization2021.09.09 13:14:03 LOG5[10]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:03 LOG7[11]: Initializing application specific data for session authenticated 2021.09.09 13:14:03 LOG7[10]: Remote descriptor (FD=10) closed 2021.09.09 13:14:03 LOG7[10]: Local descriptor (FD=3) closed 2021.09.09 13:14:03 LOG7[10]: Service [squid] finished 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:03 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:03 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:03 LOG6[ui]: Process 1937 finished with code 0 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server hello 2021.09.09 13:14:03 LOG6[11]: Certificate verification disabled 2021.09.09 13:14:03 LOG6[11]: Certificate verification disabled 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server certificate 2021.09.09 13:14:03 LOG6[11]: Client certificate not requested 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server done 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write client key exchange 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write change cipher spec 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server session ticket 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read change cipher spec 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read finished 2021.09.09 13:14:03 LOG7[11]: New session callback 2021.09.09 13:14:03 LOG7[11]: Peer certificate was cached (2037 bytes) 2021.09.09 13:14:03 LOG6[11]: Session id: B171BF0D4CDB808D50C3CE4CDAA6AE53F2396068A9BD947D8277294F91CCFBFE 2021.09.09 13:14:03 LOG7[11]: 1 client connect(s) requested 2021.09.09 13:14:03 LOG7[11]: 1 client connect(s) succeeded 2021.09.09 13:14:03 LOG7[11]: 0 client renegotiation(s) requested 2021.09.09 13:14:03 LOG7[11]: 0 session reuse(s) 2021.09.09 13:14:03 LOG6[11]: TLS connected: new session negotiated 2021.09.09 13:14:03 LOG6[11]: TLSv1.2 ciphersuite: AES128-GCM-SHA256 (128-bit encryption) 2021.09.09 13:14:03 LOG3[11]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2021.09.09 13:14:03 LOG7[11]: Compression: null, expansion: null 2021.09.09 13:14:03 LOG6[11]: Read socket closed (readsocket) 2021.09.09 13:14:03 LOG7[11]: Sending close_notify alert 2021.09.09 13:14:03 LOG6[11]: socket fd: Broken pipe (32) 2021.09.09 13:14:03 LOG7[11]: TLS alert (write): warning: close notify 2021.09.09 13:14:03 LOG6[11]: SSL_shutdown successfully sent close_notify alert 2021.09.09 13:14:03 LOG6[11]: writesocket: Socket is closed 2021.09.09 13:14:03 LOG5[11]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:03 LOG7[11]: Remote descriptor (FD=10) closed 2021.09.09 13:14:03 LOG7[11]: Local descriptor (FD=3) closed 2021.09.09 13:14:03 LOG7[11]: Service [squid] finished 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:03 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:03 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:03 LOG6[ui]: Process 1938 finished with code 0 If i test with s_client: openssl s_client -connect 44.44.44.44:522 -reconnect I see TLS reused every time. Thank you!

1 0

stunnel logfile and setuid/setgid
by Norbert Hanke 02 Sep '21

02 Sep '21

Hi, I'm new to this list and hope I don't raise a question that has been raised many times before. I searched the archive and couldn't find that discussed previously... I want to configure stunnel using setuid = nobody setgid = nobody while having it write its output to its own logfile, not using syslog, with output = /var/log/stunnel.log log = append syslog = no This works when user nobody has write-access to an existing logfile, or user nobody is allowed to create the file in the directory. Both is not a good idea: user nobody should not have write access there. I could limit potential damage by having a separate directory with such access to nobody, but that is still kind of wrong. Or I could create a separate user only for stunnel and give that user full access to a separate directory: that would be more secure, only a hijacked (hopefully not) stunnel could tamper with its own logfiles. Shouldn't stunnel create and/or open the logfile while it is still running as root, and only then switch to user nobody? Or is there an option that I did not see so far allowing for what I'm trying? Thanks for any help. Regards, Norbert

1 0

Stunnel 5.60 started via Stunnel TLS wrapper on Windows 10 machine doesn't seem to be working
by ling＠aliko.com 01 Sep '21

01 Sep '21

Hi, I am trying to get Stunnel 5.60 started automatically as a service. My stunnel.conf is stored under C:\Program Files (x86)\stunnel\config works fine if I run stunnel.exe manually from CMD or bring up the GUI and reload configuration. Now I would like it to start automatically after reboots. I tried running stunnel.exe -install which installs the Stunnel TLS wrapper service. Starting the service does not however do anything. The "Path to execute" it installs for the service is "C:\Program Files (x86)\stunnel\config" -service -install. I don't see anything in the log. I can see that the stunnel.exe process is running in task manager. But running netstat -ao shows that no port is being listened to by the PID. Tried removing my stunnel.conf file and the service will still starts but stunnel doesn't seem to be doing anything. What could be the problem?

2 2

Minor bugfix: parameter type
by Peter Pentchev 19 Aug '21

19 Aug '21

Hi, Thanks a lot for the continued development of stunnel! While checking whether my Debian packages can be built with the upcoming GCC 11, I found (or rather, GCC reported) a minor discrepancy in the type of the "hash" parameter to the crypt_DES() function in protocol.c. What do you think about the attached patch? It is also available at: https://salsa.debian.org/debian/stunnel/-/blob/master/debian/patches/06-des… Thanks again, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)debian.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

stunnel 60 released
by Michał Trojnara 16 Aug '21

16 Aug '21

Dear Users, I have released version 5.60 of stunnel. ### Version 5.60, 2021.08.16, urgency: LOW * New features - New 'sessionResume' service-level option to allow or disallow session resumption - Added support for the new SSL_set_options() values. - Download fresh ca-certs.pem for each new release. * Bugfixes - Fixed 'redirect' with 'protocol'. This combination is not supported by 'smtp', 'pop3' and 'imap' protocols. - Enforced minimum WIN32 log window size. - Fixed support for password-protected private keys with OpenSSL 3.0 (thx to Dmitry Belyavskiy). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c45d765b1521861fea9b03b425b9dd7d48b3055128c0aec673bba5ef9b8f787d stunnel-5.60.tar.gz 190b79cb94a4f70f362e44c32d150edf8ae660734d3fa0cbd990c3821e8f3083 stunnel-5.60-win64-installer.exe bac9bb4503cc5091d78c9deb6aa013fc07e39d67db0dfcc073b098db52f54427 stunnel-5.60-android.zip Best regards, Mike

1 0

Is it possible to tunnel all tcp sessions of docker containers
by Yichun Ding 15 Aug '21

15 Aug '21

Hi, We are looking for the possibility to encrypt all the tcp sessions of containers between hosts with stunnel. So far I had no luck to come up with an iptables rule to route the packets to stunnel running on the host. We cannot change the container code as there are too many of them. Any advice would be appreciated! -yd

1 0

stunnel ignores chroot /etc/hosts
by kmx1818＠gmail.com 10 Aug '21

10 Aug '21

Hello all! On my localhost I've got a java 1.4 tls1.0 app/service running, which is hard-coded to http-call a soap service (tls1.0 level too) running on a remote host, say, svchost. Host resolution is "files" only (ie /etc/hosts) - no dns. The aim is to make this java client tls1.2-compliant. My solution is: 1/ configure svchost to be (an alias of) localhost - in global /etc/hosts 127.0.0.1 localhost svchost 2/ configure a chroot env for stunell with its own /etc/hosts 1.2.3.4 svchost (needless to say that to make it work I had to copy /etc's nsswitch.conf resolv.conf, a bunch of libraries, esp libnsl and nsl_files etc, and create another lot of /dev entries) I've tested it with the native getent command: $ getent hosts svchost 127.0.0.1 $ chroot /var/run/stunnel/chroot getent hosts svchost 1.2.3.4 3/ run stunnel in chroot mode: # /opt/csw/bin/stunnel -version stunnel 5.59 on sparc-sun-solaris2.10 platform Compiled/running with OpenSSL 1.0.2u 20 Dec 2019 ; for tls1 clients client = yes sslVersion = TLSv1.2 delay = yes chroot = /var/run/stunnel/chroot [tls12] accept = localhost:80 connect = svchost:443 ; Alas, stunnel still resolves svchost from the global /etc/hosts - not from chroot's!: $ curl -kL http://svchost/service curl: (52) Empty reply from server ...and in /var/adm/messages: …LOG[4]: Service [tls12] accepted connection from 127.0.0.1:47944 …LOG[4]: s_connect: connecting 127.0.0.1:443 …LOG[4]: s_connect: s_poll_wait 127.0.0.1:443: waiting 10 seconds …LOG[4]: s_connect: connect 127.0.0.1:443: Connection refused (146) …LOG[4]: No more addresses to connect I've tried foreground yes/no, truss/strace - nothing useful... What am I missing!? Thank you in advance!

2 2

Unexpected socket close while sending mail
by zfefm＠gmx.de 27 Jul '21

27 Jul '21

Hi, since several days I try to get stunnel working to add TLS1.2 or higher support to my outdated email client program (Applemail 4.6) as my service provider will stop supporting the old protocols soon. The protocol of stunnel looks as if the connection gets established well. But as soon I want to send a mail my mail program tries for 10-15s to send an then gives up. In the stunnel protocol (time stamp 16:54:22) the server seems to accept the connection, but about 10-15s later I get: Unexpected socket close (s_read) Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Any ideas what could be the problem? Thanks. conf and protocol attached. conf: setuid = nobody setgid = nogroup foreground = yes debug = 7 output = /usr/local/etc/stunnel/stunnel.log [strato-pop3] client = yes verifyChain = yes accept = 127.0.0.1:110 connect = pop3.strato.de:995 CApath = /usr/local/etc/stunnel/ cert = /usr/local/etc/stunnel/stunnel.pem checkHost = pop3.strato.de protocol = pop3 [strato-smtp] client = yes verifyChain = yes accept = 127.0.0.1:25 connect = smtp.strato.de:465 checkHost = smtp.strato.de CApath = /usr/local/etc/stunnel/ cert = /usr/local/etc/stunnel/stunnel.pem protocol = smtp protocol : 2021.07.22 16:53:49 LOG6[ui]: Initializing inetd mode configuration 2021.07.22 16:53:49 LOG7[ui]: Clients allowed=125 2021.07.22 16:53:49 LOG5[ui]: stunnel 5.59 on x86_64-apple-darwin10.8.0 platform 2021.07.22 16:53:49 LOG5[ui]: Compiled/running with OpenSSL 1.1.1k 25 Mar 2021 2021.07.22 16:53:49 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.07.22 16:53:49 LOG7[ui]: errno: (*__error()) 2021.07.22 16:53:49 LOG6[ui]: Initializing inetd mode configuration 2021.07.22 16:53:49 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2021.07.22 16:53:49 LOG5[ui]: UTF-8 byte order mark detected 2021.07.22 16:53:49 LOG5[ui]: FIPS mode disabled 2021.07.22 16:53:49 LOG6[ui]: Compression enabled: 0 methods 2021.07.22 16:53:49 LOG7[ui]: No PRNG seeding was required 2021.07.22 16:53:49 LOG6[ui]: Initializing service [strato-pop3] 2021.07.22 16:53:49 LOG6[ui]: stunnel default security level set: 2 2021.07.22 16:53:49 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2021.07.22 16:53:49 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2021.07.22 16:53:49 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2021.07.22 16:53:49 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG7[ui]: Private key check succeeded 2021.07.22 16:53:49 LOG6[ui]: DH initialization skipped: client section 2021.07.22 16:53:49 LOG7[ui]: ECDH initialization 2021.07.22 16:53:49 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2021.07.22 16:53:49 LOG6[ui]: Initializing service [strato-smtp] 2021.07.22 16:53:50 LOG6[ui]: stunnel default security level set: 2 2021.07.22 16:53:50 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2021.07.22 16:53:50 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2021.07.22 16:53:50 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2021.07.22 16:53:50 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG7[ui]: Private key check succeeded 2021.07.22 16:53:50 LOG6[ui]: DH initialization skipped: client section 2021.07.22 16:53:50 LOG7[ui]: ECDH initialization 2021.07.22 16:53:50 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2021.07.22 16:53:50 LOG5[ui]: Configuration successful 2021.07.22 16:53:50 LOG7[ui]: Deallocating deployed section defaults 2021.07.22 16:53:50 LOG7[ui]: Binding service [strato-pop3] 2021.07.22 16:53:50 LOG7[ui]: Listening file descriptor created (FD=8) 2021.07.22 16:53:50 LOG7[ui]: Setting accept socket options (FD=8) 2021.07.22 16:53:50 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2021.07.22 16:53:50 LOG6[ui]: Service [strato-pop3] (FD=8) bound to 127.0.0.1:110 2021.07.22 16:53:50 LOG7[ui]: Binding service [strato-smtp] 2021.07.22 16:53:50 LOG7[ui]: Listening file descriptor created (FD=10) 2021.07.22 16:53:50 LOG7[ui]: Setting accept socket options (FD=10) 2021.07.22 16:53:50 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2021.07.22 16:53:50 LOG6[ui]: Service [strato-smtp] (FD=10) bound to 127.0.0.1:25 2021.07.22 16:53:50 LOG7[ui]: No pid file being created 2021.07.22 16:53:50 LOG7[cron]: Cron thread initialized 2021.07.22 16:53:50 LOG6[cron]: Executing cron jobs 2021.07.22 16:53:50 LOG6[cron]: Cron jobs completed in 0 seconds 2021.07.22 16:53:50 LOG7[cron]: Waiting 86400 seconds 2021.07.22 16:54:22 LOG7[ui]: Found 1 ready file descriptor(s) 2021.07.22 16:54:22 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[ui]: FD=8 events=0x1 revents=0x1 2021.07.22 16:54:22 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[ui]: Service [strato-pop3] accepted (FD=3) from 127.0.0.1:49864 2021.07.22 16:54:22 LOG7[0]: Service [strato-pop3] started 2021.07.22 16:54:22 LOG7[0]: Setting local socket options (FD=3) 2021.07.22 16:54:22 LOG7[0]: Option TCP_NODELAY set on local socket 2021.07.22 16:54:22 LOG5[0]: Service [strato-pop3] accepted connection from 127.0.0.1:49864 2021.07.22 16:54:22 LOG6[0]: s_connect: connecting 81.169.145.131:995 2021.07.22 16:54:22 LOG7[0]: s_connect: s_poll_wait 81.169.145.131:995: waiting 10 seconds 2021.07.22 16:54:22 LOG7[0]: FD=6 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[0]: FD=13 events=0x5 revents=0x0 2021.07.22 16:54:22 LOG5[0]: s_connect: connected 81.169.145.131:995 2021.07.22 16:54:22 LOG5[0]: Service [strato-pop3] connected remote server from 192.168.17.130:49865 2021.07.22 16:54:22 LOG7[0]: Setting remote socket options (FD=13) 2021.07.22 16:54:22 LOG7[0]: Option TCP_NODELAY set on remote socket 2021.07.22 16:54:22 LOG7[0]: Remote descriptor (FD=13) initialized 2021.07.22 16:55:22 LOG3[0]: Unexpected socket close (s_read) 2021.07.22 16:55:22 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2021.07.22 16:55:22 LOG7[0]: Remote descriptor (FD=13) closed 2021.07.22 16:55:22 LOG7[0]: Local descriptor (FD=3) closed 2021.07.22 16:55:22 LOG7[0]: Service [strato-pop3] finished (0 left) 2021.07.22 16:55:22 LOG7[0]: str_stats: 1 block(s), 32 data byte(s), 90 control byte(s) 2021.07.22 16:55:22 LOG7[0]: str_stats: 32 byte(s) at network.c:735

2 3

Equivalence of verify=2
by Yann RESCOURIO 22 Jul '21

22 Jul '21

Hello I would like to authenticate a server with only its CA file. What is the equivalence of verify=2 ? requireCert = yes verifyChain = no verifyPeer = yes Regards Yann

3 5

idea: linux stunnel mini-GUI
by Dmitry Bakshaev 13 Jul '21

13 Jul '21

we need start stunnel on linux desktop by ordinary user (like on windows): 1 click stunnel icon on system menu 2 enter user certificate password 3 use opened tunnels with users applications 4 on desktop session ends close all tunnels make XDG menu entry file: [Desktop Entry] Type=Application Name=stunnel Categories=Network; GenericName=TLS/SSL - Port Wrapper Comment[ru_RU]=Секретный туннель Icon=stunnel Exec=/usr/bin/stunnel Terminal=true X-KeepTerminal=true but only problem is how stunnel react on signals: HUP is daemon's "reload config". in X-session HUP signal is "session end" and stunnel is not exited on closing terminal or logout. attached patch change this behavior: if "foreground=yes" specified in stunnel.conf HUP signal is treated as TERM and stunnel exited. foreground=yes is "debug" or "desktop" mode of stunnel. XDG-desktop file and icon file may be included in default stunnel distributions.

1 0

Difficulty to select exact Cipher
by Sachin Deshmukh 12 Jul '21

12 Jul '21

Hello Together, I had been trying to use a stunnel to set PSK encrypted TLS. Below is my conf file. [client] client = yes accept = 127.0.0.1:8888 connect = 192.168.1.100:443 ciphers = PSK-AES128-CBC-SHA256 PSKsecrets = /data/dummy.txt I can see communication, but client e.g. Stunnel from Client side offer several other cipher in addition to exact one which is expected as per conf. I wish PSK-AES128-CBC-SHA256 (0x00ae) But I see the list below in actual communication. [image: image.png] Please let me know 1 .how we can inform stunnel to use exact and only 1 cipher provided in the conf file. Or 2. How can we state hex id instead of string. If I see a cipher list, with the same keyword as a part or whole there are more than 1 ciphers, I suppose this causes stunnel to take a list as per string match. ECDHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA256 RSA-PSK-AES128-CBC-SHA256 TLSv1 Kx=RSAPSK Au=RSA Enc=AES(128) Mac=SHA256 DHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=DHEPSK Au=PSK Enc=AES(128) Mac=SHA256 *PSK-AES128-CBC-SHA256 * TLSv1 Kx=PSK Au=PSK Enc=AES(128) Mac=SHA256 Can we make a stunnel to select only one exact cipher?

1 0

curl 7.61 exit status 8 from stunnel service of tls1
by kmx1818＠gmail.com 09 Jul '21

09 Jul '21

Hello all, For a remote tls1 web service : $ # openssl s_client -connect myremote:7002 -tls1 CONNECTED(00000004) depth=0 CN = xxx, OU = xxx, O = xxx, C = xxx verify error:num=18:self signed certificate verify return:1 depth=0 CN = xxx, OU = xxx, O = xxx, C = xxx verify return:1 --- Certificate chain ... --- Server certificate -----BEGIN CERTIFICATE----- MIIC8zCCAdsCBGCvjhEwDQYJKoZIhvcNAQEFBQAwPjEOMAwGA1UEAxMFRUZXRUIx ... QG9sNNhQW65rRVmdqy/g0cBbLKRKhmRCS+ajRIzBcO9ZmMe42TES -----END CERTIFICATE----- subject=XXX issuer=XXX --- No client certificate CA names sent --- SSL handshake has read 889 bytes and written 509 bytes --- New, TLSv1/SSLv3, Cipher is RC4-MD5 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1 Cipher : RC4-MD5 Session-ID: 2D9F8D8833A459C16C1D01F0C92F8EB7 Session-ID-ctx: Master-Key: 1BF68D1AAEEC291A60252ECD63C374661FBBE028FB39A75DDA29E4E3FB6FE34CFC80F875F9E16F9D7C840F185757F583 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1625842735 Timeout : 7200 (sec) Verify return code: 18 (self signed certificate) --- closed $ I can test it alright with an "old" curl $ curl --version curl 7.15.4 (sparc-sun-solaris2.9) libcurl/7.15.4 OpenSSL/0.9.7g zlib/1.2.3 Protocols: tftp ftp telnet dict ldap http file https ftps Features: IPv6 Largefile NTLM SSL libz ...like this $ curl -skL https://myremote:7002/MyWebService?WSDL <?xml version="1.0" encoding="UTF-8"?> ... </soap:address> </port> </service> </definitions> I want to tls1.2-enable myremote:7002 with stunnel, and run a tls1.2 curl instead. My stunnel installation $ /opt/csw/bin/stunnel -version Initializing inetd mode configuration stunnel 5.59 on sparc-sun-solaris2.10 platform Compiled with OpenSSL 1.0.2u 20 Dec 2019 Running with OpenSSL 1.0.2o 27 Mar 2018 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP Global options: RNDbytes = 1024 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK curves = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 I start it with this service config: [my12] client = no accept = 7002 connect = myremote:7002 cert = /etc/opt/csw/stunnel/stunnel.crt key = /etc/opt/csw/stunnel/stunnel.key sslVersion = TLSv1.2 debug = 7 and test it with a fairly recent curl $ /opt/csw/bin/curl --version curl 7.61.0 (sparc-sun-solaris2.10) libcurl/7.61.0 OpenSSL/1.0.2o zlib/1.2.8 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) Release-Date: 2018-07-11 Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp Features: AsynchDNS IDN IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP UnixSockets HTTPS-proxy PSL Metalink Alas, the recent curl call $ /opt/csw/bin/curl -skL https://myremote:7002/MyWebService?WSDL ...fails with exit status 23 In verbose mode we get * Trying 127.0.0.1... * TCP_NODELAY set * Failed to set TCP_KEEPALIVE on fd 4 * Connected to localhost (127.0.0.1) port 7002 (#0) * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: none CApath: /etc/opt/csw/ssl/certs * TLSv1.2 (OUT), TLS header, Certificate Status (22): * TLSv1.2 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Client hello (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS change cipher, Client hello (1): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server did not agree to a protocol * Server certificate: * subject: C=TS; ST=Westfarthing; L=Hobbiton; O=Thorin and Company; OU=Burglars; CN=ahost.theshire.net; emailAddress=bilbo(a)theshire.net * start date: Jun 30 09:24:25 2021 GMT * expire date: Jun 30 09:24:25 2022 GMT * issuer: C=TS; ST=Westfarthing; L=Hobbiton; O=Thorin and Company; OU=Burglars; CN=ahost.theshire.net; emailAddress=bilbo(a)theshire.net * SSL certificate verify result: self signed certificate (18), continuing anyway. > GET /MyWebService?WSDL HTTP/1.1 > Host: localhost:7002 > User-Agent: curl/7.61.0 > Accept: */* > Warning: Binary output can mess up your terminal. Use "--output -" to tell Warning: curl to output it to your terminal anyway, or consider "--output Warning: <FILE>" to save to a file. * Failed writing body (0 != 7) * Closing connection 0 * TLSv1.2 (OUT), TLS alert, Client hello (1): $ I tried various curl flags - nothing works. In the meantime stunnel logs no errors Jul 9 16:16:45 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: Service [my12] accepted connection from 127.0.0.1:39165 Jul 9 16:16:45 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: s_connect: connected 10.240.28.69:7002 Jul 9 16:16:45 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: Service [my12] connected remote server from xxx.yyy.zzz.www:39166 Jul 9 16:17:10 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: Connection closed: 7 byte(s) sent to TLS, 116 byte(s) sent to socket What am i doing wrong!? Thanks in advance!

1 0

stunnel and rsyslog
by Yann RESCOURIO 28 Jun '21

28 Jun '21

Hello I use stunnel for rsyslog. And on the client equipment, I use also rsyslog queues for buffering in case of disconnection. But in case of reboot: * without stunnel, the buffered log messages are received on the rsyslog server * with stunnel, no buffered log messages are received on the rsyslog server On the client equipment, is it possible to refuse the local stunnel connections as long as the remote stunnel connection is down ? Regards Yann Rescourio

3 2

FIPS 140-2 & Ubuntu Pro
by Patrick Kaeding 23 Jun '21

23 Jun '21

Hi I am trying to set up stunnel with FIPS 140-2 compliance. I found some discussion of this on this mailing list from many years ago, but I'm not sure how much of that is still relevant today. I am running Ubuntu Pro 18.04, with FIPS mode (including the userspace modules: https://security-certs.docs.ubuntu.com/en/fips). If I simply `apt-get install stunnel4`, I can create a config with `fips = yes`, and when I start it up, I see this line logged: 2021.06.23 15:45:24 LOG5[ui]: FIPS mode enabled Does this mean I am all set, without needing to compile anything from source? In this message (from almost a decade ago), it sounds like this might be the validation I need: > BTW: "fips" option is only available when stunnel is built with FIPS support. FIPS mode is also clearly logged on startup https://www.stunnel.org/pipermail/stunnel-users/2012-November/003963.html Or do I need to build stunnel from scratch, using my local openssl distribution? Thanks! -- Patrick Kaeding pkaeding(a)launchdarkly.com

1 0

Number of tunnels open in Stunnel
by Moti Berger 21 Jun '21

21 Jun '21

Hi Is there a command I can run to get the current number of opened tunnels? I'm running Stunnel version 5.57. Thanks, Moti

1 0

Help needed for email client
by Ian Huysman 15 Jun '21

15 Jun '21

Hi, I just tried to configure stunnel as proxy between an email client (Outlook Express) and the email server (SMTP and IMAP). The problem is that the connection times out in the client while synchronising the IMAP folders. But I can send emails from the client. This is my relatively basic configuration: [SMTP] client = yes accept = 25 connect = smtp.office365.com:587 protocol = smtp [IMAP] client = yes accept = 143 connect = outlook.office365.com:993 protocol = imap Any help would be greatly appreciated! Regards, Ian.

3 2

SFTP over stunnel
by sameer_rm90＠hotmail.com 13 Jun '21

13 Jun '21

Hi, Is SFTP works over stunnel? If yes, how can configure it ?

2 1

connect with hostname obtains incorrect IP address
by stunnel＠dsbconsulting.com 11 Jun '21

11 Jun '21

Hello everyone. I'm trying to use stunnel to forward smtp traffic from an old webcam to an smtp server that requires TLS. Everything works fine if I put the IP address of the smtp server in the connect= line, but if I put the hostname there, stunnel tries to connect to a seemingly random IP address. This happens using stunnel on Windows 10 and also on my router with OpenWrt (linux) Here is the config file: [smtp] client = yes accept = 192.0.0.1:25 ;connect = 199.193.7.228:465 connect = smtp.privateemil.com:465 And here is the failing part of the stunnel log file: 2021.06.11 18:24:54 LOG5[0]: Service [smtp] accepted connection from 192.0.0.111:49334 2021.06.11 18:24:54 LOG6[0]: s_connect: connecting 47.91.170.222:465 2021.06.11 18:24:54 LOG7[0]: s_connect: s_poll_wait 47.91.170.222:465: waiting 10 seconds 2021.06.11 18:24:54 LOG7[0]: FD=6 events=0x2001 revents=0x0 2021.06.11 18:24:54 LOG7[0]: FD=10 events=0x2005 revents=0x0 2021.06.11 18:25:04 LOG3[0]: s_connect: s_poll_wait 47.91.170.222:465: TIMEOUTconnect exceeded Here is the result of ping for the smtp server: PING smtp.privateemail.com (199.193.7.228): 56 data bytes 64 bytes from 199.193.7.228: seq=0 ttl=237 time=103.059 ms

2 1

encrypted connection between application server and db server drops exactly after 300
by simona vittori 09 Jun '21

09 Jun '21

Hello, the encrypted connection between application server and db server drops exactly after 300 seconds. why? without stunnel this does not happen. we cannot understand why Thank a lot Simona

1 0

How to get high-precision timestamps in the stunnel logs
by jori.gielis＠telenetgroup.be 27 May '21

27 May '21

Hi, I want to use more accurate timestamps in the logs of stunnel. It would be nice to have milliseconds. Current format: 2021.05.27 19:00:59 LOG7[3]: Remote descriptor (FD=70) closed Needed format: 2021.05.27 19:00:59,718 LOG7[3]: Remote descriptor (FD=70) closed Is it possible to accomplish this in stunnel version 5.56? Thanks! Best regards

1 0

stunnel.pem Failure
by waynesmith philosophical-vistas.net 27 May '21

27 May '21

I preface this message to alert the reader that I remain a novice both in use of STunnel and Linux. I am trying to generate an SSL/TLS certificate for use w/ my various e-mail clients. I downloaded and extracted STunnel 5.59 on my Linux Mint Debian box. After perusing the files I issued the following command sudo ./configure --enable-fips Without repeating all the verbiage, it seemed to run properly. I then issued the following command make cert It returned the usual information requests (though it didn't ask for an e-mail address) but returned the following: /usr/bin/install -c -b -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem /usr/bin/install: cannot create regular file ‘/usr/local/etc/stunnel/stunnel.pem’: No such file or directory Makefile:549: recipe for target 'cert' failed make[1]: *** [cert] Error 1 make[1]: Leaving directory '/home/was/stunnel-5.59/tools' Makefile:883: recipe for target 'cert' failed make: *** [cert] Error 2 I negotiated through </usr/local/etc> and ascertained there was no </stunnel> folder. Unfortunately the permissions prevent me from creating this folder. I am thus stumped. Suggestions?

2 2

fixes for Solaris
by Pavel Heimlich 25 May '21

25 May '21

Hi, please find attached two patches that make stunnel 5.59 work better with Oracle Solaris. The first one fixes a few issues with the tests* - it removes unnecessary warning/error messages and adjusts the calls to netcat and ifconfig to what works on Solaris. The second one adds the location of 64 bit shared libraries for linking OpenSSL, similar to what has been added for Fedora. best regards P. * test result: test 010_require_cert ok test 011_verify_peer ok test 012_verify_chain ok test 013_CRL_file ok test 014_PSK_secrets ok test 015_p12_cert ok test 020_IPv6 ok test 021_FIPS skipped test 022_bind ok test 028_redirect_chain ok test 029_no_redirect_chain ok test 030_simple_execute ok test 031_redirect ok test 032_no_redirect ok test 033_redirect_exec ok test 034_no_redirect_exec ok test 035_SNI ok test 036_no_SNI ok test 037_failover_prio1 ok test 038_failover_prio2 ok test 039_failover_rr ok test 040_reload ok test 041_exec_connect ok test 042_inetd ok test 043_session_delay ok test 044_session_nodelay ok test 045_include ok test 046_resume_PSK ok test 047_resume_redirect ok test 048_resume_noredirect ok test 049_redirect_nocert ok test 050_ticket_secrets ok test 051_resume_cache_old skipped test 052_resume_cache ok test 053_resume_ticket ok test 054_resume_TLSv1_3 ok test 055_socket_close ok test 110_failure_require_cert ok test 111_failure_verify_peer ok test 112_failure_verify_chain ok test 113_failure_CRL_file ok test 114_failure_PSK_secrets ok test 115_failure_wrong_config ok test 121_failure_FIPS_ciphers skipped test 122_failure_FIPS_curves skipped summary: success 41, skip 4, fail 0 -- Pavel Heimlich | SW Developer Security Compliance & Globalization Oracle Czech s. r. o., U Trezorky 921/2, 158 00 Praha 5, Czech Republic

1 0

Stunnel stopped working..
by Alastair ＠ Expert Geeks 23 May '21

23 May '21

Hi all, I've been happily using stunnel for the same purpose and the same config for over year but it's suddenly stopped working. I was using it to wrap http shoutcast (port 8000) to https (port 8444). I'm using a letsencrypt cert. config: client = no [shoutcast] accept = 8444 connect = 127.0.0.1:8000 cert = /etc/letsencrypt/live/*server name*/fullchain.pem key = /etc/letsencrypt/live/*server name*/privkey.pem This keeps getting repeated in the log: 2021.05.22 22:18:27 LOG7[main]: Found 1 ready file descriptor(s) 2021.05.22 22:18:27 LOG7[main]: FD=4 events=0x2001 revents=0x0 2021.05.22 22:18:27 LOG7[main]: FD=9 events=0x2001 revents=0x1 2021.05.22 22:18:27 LOG7[main]: Service [shoutcast] accepted (FD=3) from *server ip*:40506 2021.05.22 22:18:27 LOG7[4]: Service [shoutcast] started 2021.05.22 22:18:27 LOG7[4]: Setting local socket options (FD=3) 2021.05.22 22:18:27 LOG7[4]: Option TCP_NODELAY set on local socket 2021.05.22 22:18:27 LOG5[4]: Service [shoutcast] accepted connection from *server ip*:40506 2021.05.22 22:18:27 LOG6[4]: Peer certificate not required 2021.05.22 22:18:27 LOG7[4]: TLS state (accept): before SSL initialization 2021.05.22 22:18:27 LOG3[4]: SSL_accept: ../ssl/record/ssl3_record.c:322: error:1408F09C:SSL routines:ssl3_get_record:http request 2021.05.22 22:18:27 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2021.05.22 22:18:27 LOG7[4]: Local descriptor (FD=3) closed 2021.05.22 22:18:27 LOG7[4]: Service [shoutcast] finished (0 left) (server ip & server name removed) Suggestions and recommendations gratefully received! Thanks.

2 1

Re: stunnel in Citrix Environment
by Eberhard 21 May '21

21 May '21

It is pretty much impossible for users to hijack each other. The connections are persistent and if a user drops it is gone. It won’t hijack or share. Having said that, if your app works like a Web browser (not persistent) then of course they will interleave and of course you need to use the same technique as browsers – cookies, hidden fields, whatever. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Bruce Liptak <bliptakjr(a)gmail.com> Sent: Friday, May 21, 2021 10:35 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel in Citrix Environment Hello stunnel-users, Currently we have an application using stunnel being presented by a Citrix presentation server. The first user authenticates over stunnel with a PKI cert and every user thereafter creates a prompt for the first user again and again for each user that also tries to get into the app. Is there a way for stunnel to be separated based on something that pertains to the user trying to get access? We are using a PKI solution based on certificates. It's like every new user is hijacking the first users' stunnel session. Any help would be appreciated! Thank you, Bruce Liptak <mailto:bliptakjr@gmail.com> bliptakjr(a)gmail.com CCNA R&S | VCA-DCV | Linux+ | Security+ | Network+

1 0

stunnel in Citrix Environment
by Bruce Liptak 21 May '21

21 May '21

Hello stunnel-users, Currently we have an application using stunnel being presented by a Citrix presentation server. The first user authenticates over stunnel with a PKI cert and every user thereafter creates a prompt for the first user again and again for each user that also tries to get into the app. Is there a way for stunnel to be separated based on something that pertains to the user trying to get access? We are using a PKI solution based on certificates. It's like every new user is hijacking the first users' stunnel session. Any help would be appreciated! Thank you, Bruce Liptak bliptakjr(a)gmail.com CCNA R&S | VCA-DCV | Linux+ | Security+ | Network+

1 0

Unable to connect after upgrade of server
by Christopher Schultz 13 May '21

13 May '21

All, I upgraded one of my servers from Debian stretch to Debian buster yesterday and I've been unable to establish stunnel connections to it since then. When I connect, I get this log message on the server end: LOG5[0]: Service [svn-name] accepted connection from [client ip]:45382 LOG5[0]: Certificate accepted at depth=0: [cert dn] LOG3[0]: SSL_accept: 1414D17A: error:1414D17A:SSL routines:tls12_check_peer_sigalg:wrong curve LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket We are using EC certs and it's complaining about a curve. So, probably curve-related :) Our private key on the client side is using the secp256k1 curve. The client is using OpenSSL 1.0.2. The server is running OpenSSL 1.1.1. Both client and server support secp256k1. I tried specifying: curves = secp256k1 On the server side, but stunnel won't start, telling me that the configuration option isn't valid. I tried it in the global scope, and also in the service-scope and got the same error. Am I missing something? Minting new certificates (e.g. using prime256v1/secp256r1) is definitely an option, as my client openssl says it supports the NIST P-256 curve. $ openssl ecparam -list_curves secp256k1 : SECG curve over a 256 bit prime field secp384r1 : NIST/SECG curve over a 384 bit prime field secp521r1 : NIST/SECG curve over a 521 bit prime field prime256v1: X9.62/SECG curve over a 256 bit prime field That last one is NIST P-256. Is my best bet to mint a new certificate? Or is it possible to configure the server to allow this secp256k1 curve? -chris

1 0

Stunnel static compile with open ssl error while running make command
by snainwar＠rediffmail.com 30 Apr '21

30 Apr '21

I am running RHEL release v 7.9 and have successfully compiled OpenSSL version 1.1.1k using the following configuration: ##> ./config --prefix=/usr/src/openssl-1.1.1 --openssldir=/etc/openssl The following paths are shown when I run command whereis openssl # whereis openssl openssl: /usr/lib64/openssl /usr/local/bin/openssl /usr/include/openssl /opt/openssl/bin/openssl /usr/src/openssl-1.1.1k/openssl.pc ]# I have download and prepared Stunnel version 5.59 from https://www.stunnel.org/ I am using the following configuration: ##> ./configure --with-ssl=/opt/openssl --enable-static When I compile Stunnel I get the following error message when we run Make install make[2]: Nothing to be done for `install-exec-am'. /bin/mkdir -p '/usr/local/share/doc/stunnel' /bin/install -c -m 644 README.md TODO.md COPYING.md AUTHORS.md NEWS.md PORTS.md BUGS.md COPYRIGHT.md CREDITS.md INSTALL.W32.md INSTALL.WCE.md INSTALL.FIPS.md '/usr/local/share/doc/stunnel' make install-data-hook make[3]: Entering directory `/usr/src/stunnel-5.59' ********************************************************* * Type 'make cert' to also install a sample certificate * ********************************************************* make[3]: Leaving directory `/usr/src/stunnel-5.59' make[2]: Leaving directory `/usr/src/stunnel-5.59' make[1]: Leaving directory `/usr/src/stunnel-5.59' [root@tvdcltmp001 stunnel-5.59]# Looks like Stunnel cannot link (probably because it can’t find the library) Does anyone know what the error might be? What changes do I need to make to configure for compilation.

1 0

5.59 on win64
by Joe Phillips 29 Apr '21

29 Apr '21

I'm running win64 version 5.59. Installed service and it is started and running (set to automatic). But when I try to open the stunnel allUsers I get the error : stunnel server is down sue to an error, you need to exit and correct the problem. Click ok to see the error log. Shouldn't I be able to open the log window if the service is running? Also when the service is running there is no stunnel icon in the system tray. Please advise. Thanks [cid:image001.png@01D73CD5.3C81D040]

1 0

Load Balancing
by Ramin Malekgahsemi 28 Apr '21

28 Apr '21

Hi Dear friend If have one stunnel client and have three Stunnel server My question IS How by RR user three server For client ? Forward and handle connection on three server (Client and access Port is once) thanks

1 0

Stunnel static compile error while running Make command
by snainwar＠rediffmail.com 28 Apr '21

28 Apr '21

We are trying to static compile stunnel 5.59 with open ssl 1.1.1 on RHEl 6 and RHEL7 we are getting below error running command Make on the server /stunnel-5.59/src/cron.c:239: undefined reference to `BN_GENCB_new' /stunnel-5.59/src/cron.c:244: undefined reference to `BN_GENCB_set' stunnel-cron.o: In function `cron_dh_param': /stunnel-5.59/src/cron.c:219: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/cron.c:222: undefined reference to `CRYPTO_THREAD_unlock' /stunnel-5.59/src/cron.c:225: undefined reference to `CRYPTO_THREAD_read_lock' /stunnel-5.59/src/cron.c:229: undefined reference to `CRYPTO_THREAD_unlock' stunnel-cron.o: In function `cron_init': /stunnel-5.59/src/cron.c:78: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/cron.c:81: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `main_cleanup': /stunnel-5.59/src/stunnel.c:249: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/stunnel.c:263: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `process_connections': /stunnel-5.59/src/stunnel.c:889: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/stunnel.c:898: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `stunnel_info': /stunnel-5.59/src/stunnel.c:1034: undefined reference to `OpenSSL_version' /stunnel-5.59/src/stunnel.c:1036: undefined reference to `OpenSSL_version' /stunnel-5.59/src/stunnel.c:1041: undefined reference to `OpenSSL_version_num' collect2: error: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/stunnel-5.59/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/stunnel-5.59/src' make: *** [all-recursive] Error 1 [root@tvdcltmp001 stunnel-5.59]#

1 0

Stunnel static compile error while running Make command
by snainwar＠rediffmail.com 28 Apr '21

28 Apr '21

We are trying to static compile stunnel 5.59 with open ssl 1.1.1 on RHEl 6 and RHEL7 we are getting below error running command Make on the server /stunnel-5.59/src/cron.c:239: undefined reference to `BN_GENCB_new' /stunnel-5.59/src/cron.c:244: undefined reference to `BN_GENCB_set' stunnel-cron.o: In function `cron_dh_param': /stunnel-5.59/src/cron.c:219: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/cron.c:222: undefined reference to `CRYPTO_THREAD_unlock' /stunnel-5.59/src/cron.c:225: undefined reference to `CRYPTO_THREAD_read_lock' /stunnel-5.59/src/cron.c:229: undefined reference to `CRYPTO_THREAD_unlock' stunnel-cron.o: In function `cron_init': /stunnel-5.59/src/cron.c:78: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/cron.c:81: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `main_cleanup': /stunnel-5.59/src/stunnel.c:249: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/stunnel.c:263: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `process_connections': /stunnel-5.59/src/stunnel.c:889: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/stunnel.c:898: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `stunnel_info': /stunnel-5.59/src/stunnel.c:1034: undefined reference to `OpenSSL_version' /stunnel-5.59/src/stunnel.c:1036: undefined reference to `OpenSSL_version' /stunnel-5.59/src/stunnel.c:1041: undefined reference to `OpenSSL_version_num' collect2: error: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/stunnel-5.59/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/stunnel-5.59/src' make: *** [all-recursive] Error 1 [root@tvdcltmp001 stunnel-5.59]#

1 0

Unable to reload Stunnel in Linux
by gorf＠hyperfunk.club 27 Apr '21

27 Apr '21

Hi, Normally, I would call "kill -HUP" with Stunnel's process ID to make it reload the configuration in Linux. I was very surprised when I tried that and the process stopped. Why would HUP cause it to exit, rather than reload the config? It doesn't do that on every machine. Thanks.

2 4

Questions about two host connection using stunnel
by yfmao＠seas.upenn.edu 24 Apr '21

24 Apr '21

I am using stunnel4 to build a secure connection between two ubuntu hosts. One of the hosts (sender) will send "hello world" to another host (receiver). When I am using tcpdump in receiver to capture the packets sending from sender, I find out that one of the packets contains "hello world" in plaintext. From my understanding, stunnel will encrypt the content of "hello world" if everything is correct, so I shouldn't be able to see "hello world" in plaintext among any incoming packets. Any ideas about what is going wrong here? Here I will put my stunnel.config for your reference: cert = /home/ubuntu/client_server/stunnel.pem key = /home/ubuntu/client_server/stunnel.key debug = 7 output = /home/ubuntu/client_server/stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 options = ALL [services] accept = 6667 connect = some_ip_address:6666 TIMEOUTclose = 0

4 6

Paid work
by David Rose (dsr) 24 Apr '21

24 Apr '21

I need an Stunnel config that will allow my Windows app that only can send SMTP without any authentication or encryption to be able to send email via Gmail or Office 365. Is this something that someone would be able to write for me and if so, what would you charge ? Thanks David --

3 2

Does stunnel support OCSP stapling?
by koalabearguo＠gmail.com 24 Apr '21

24 Apr '21

Will it plan to support in the future? Thanks.

3 2

Re: Fwd: Re: Local socket keeps listening
by Eberhard 16 Apr '21

16 Apr '21

I’ll toss in an unpopular opinion here. I have used stunnel since day one. I had over the years problems with it not answering or the parent process dying altogether and other issues. I finally decided to run it from inetd rather than as a service. It is logical that this is a little slower but with modern machines I don’t notice it. inetd always is running. Always. If it is not you pretty much cannot use the machine. It has been a service program forever and is dead reliable. What you get is total reliability for an unnoticeable loss of speed. I suppose a heavily loaded machine running at capacity might not like this – my answer is throw hardware at it. I need reliable more than anything else. I’d at least try it! E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Jorge Redondo Flames <jorge.redondo(a)gmail.com> Sent: Wednesday, April 14, 2021 11:49 AM To: Peter Pentchev <roam(a)ringlet.net> Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: Fwd: Re: Local socket keeps listening Got it. Thank you very much! On Wed, 14 Apr 2021 at 20:41, Peter Pentchev <roam(a)ringlet.net <mailto:roam@ringlet.net> > wrote: On Wed, Apr 14, 2021 at 08:24:51PM +0200, Jorge Redondo Flames wrote: > On Wed, 14 Apr 2021 at 20:19, Jochen Bern <Jochen.Bern(a)binect.de <mailto:Jochen.Bern@binect.de> > wrote: > > On 14.04.21 19:58, Jorge Redondo Flames wrote: > > > Stunnel could listen on its local port *only* when the peer server is > > > listening on its corresponding server socket. So if there is no serve on > > > the other side, there should not be local listening socket. Does not that > > > make sense? > > > > No. > > > > In the general situation (server *not* being on the same machine as > > stunnel), stunnel CANNOT know whether the server's listening short of > > trying to connect to it - which it will only do on behalf of an incoming > > client request, which would never happen if stunnel weren't listening. > > > > Even if server and stunnel run on the same machine/OS, finding out about > > the server's state would require a bunch of special-purpose code. > > > > Assuming that they *are* on a common Linux (or at least unixoid) system, > > however, it would be rather trivial to write a root cron job that checks > > the output of "ss"/"netstat" for the server's LISTEN and simply > > terminates stunnel if it isn't found. > > > > Or even better, have the server *restarted* automatically whenever it > > croaks ... > > Understood. Although it still seems to me that the code doing more or less > what the cron job would do might worth. So, three points here. 1. There are some services (some servers) that do not react very nicely to somebody connecting to them and disconnecting immediately. Some of them do some work at the moment of the connection (e.g. resolve the client's IP address, check it against firewall rules, or even do some actual, service-specific, work, e.g. allocate buffers, prepare some kind of data...). Some of them are configured in such ways as to avoid portscanners or denial of service attacks or spam or flood or... many other things. In general, unless you *know* that it is safe to connect and immediately disconnect from the remote service, it is very unwise to try to do that. In your particular case, you know that, but in general, it is not a good idea. 2. Even if stunnel would try to connect to the remote service, what happens if the connection fails? OK, you say stunnel should close its local listening socket, but what then - will it never open it again? And if here's the part when you say "it can try to connect to the remote server again and start listening again" - okay, how much time passes between these connection attempts? Even something like a second may be bad if a real client chooses exactly this second to try to connect to stunnel and... stunnel is not listening... even though the remote server has started listening immediately after stunnel's last unsuccessful attempt. So... whatever interval you pick, closing the local listening socket *will* result in real, live clients failing to connect. 3. A more general point: if you really want to check whether a service is operational, only checking whether it will accept a connection is not enough. I've seen *many* failure modes over the years: from an overloaded machine where the OS kernel will accept the connection, but none of the actual server processes will react, through an overloaded service process that accepts the connection but spends too much time processing other requests to pay any attention to it, to a firewall host gone crazy that will pass connection packets, but will then refuse to pass the actual payload (yes, I've seen that happen for at least three different reasons). So an actual service check would be to connect and then send some kind of simple request to the server that you know will not take it too much time and resources to process, but will give you some measure of confidence that the server is actually serving requests and data. But in short, it is impossible for stunnel to know whether a remote server is listening for a connection without trying to connect, it may not be "polite" for it to try to connect too often, and trying to connect not-too-often *will* result in real clients being unable to connect in the intermediate intervals. G'luck, Peter -- Peter Pentchev roam(a)ringlet.net <mailto:roam@ringlet.net> roam(a)debian.org <mailto:roam@debian.org> pp(a)storpool.com <mailto:pp@storpool.com> PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

2 3

Fwd: Re: Local socket keeps listening
by Jorge Redondo Flames 14 Apr '21

14 Apr '21

---------- Forwarded message --------- From: Jorge Redondo Flames <jorge.redondo(a)gmail.com> Date: Wed, 14 Apr 2021 at 19:45 Subject: Re: [stunnel-users] Re: Local socket keeps listening To: Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> Stunnel could listen on its local port *only* when the peer server is listening on its corresponding server socket. So if there is no serve on the other side, there should not be local listening socket. Does not that make sense? On Wed, 14 Apr 2021 at 19:38, Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> wrote: > On Wed, 2021-04-14 19:13:03 +0200, Jorge Redondo Flames wrote: > > [..] > > > > Is there a way to configure Stunnel to *close* the local socket (not > > listening anymore) whenever the peer process (i.e. the server) has closed > > its socket? > > Stunnel listens for connection request from the client(s) and connects > to the server on behalf of the client(s). How will a client ever be > able to connect through Stunnel again if Stunnel closes the listening > socket? > > Ludolf > > -- > > Ludolf Holzheid > > Bihl+Wiedemann GmbH > Floßwörthstraße 41 > 68199 Mannheim, Germany > > Tel: +49 621 33996-0 > Fax: +49 621 3392239 > > mailto:lholzheid@bihl-wiedemann.de > https://www.bihl-wiedemann.de > > Sitz der Gesellschaft: Mannheim > Geschäftsführer: Jochen Bihl, Bernhard Wiedemann > Amtsgericht Mannheim, HRB 5796 > > Datenschutzerklärung: https://www.bihl-wiedemann.de/de/meta/datenschutz > _______________________________________________ > stunnel-users mailing list -- stunnel-users(a)stunnel.org > To unsubscribe send an email to stunnel-users-leave(a)stunnel.org >

3 4

Re: Local socket keeps listening
by Ludolf Holzheid 14 Apr '21

14 Apr '21

On Wed, 2021-04-14 19:45:06 +0200, Jorge Redondo Flames wrote: > Stunnel could listen on its local port *only* when the peer server is > listening on its corresponding server socket. So if there is no serve on > the other side, there should not be local listening socket. Does not that > make sense? Stunnel connects to the server only when a client connects to Stunnel. If Stunnel is not listening for clients, it does not try to connect to the server. If it does not try to connect to the server, it does not know if the server is listening. Ludolf > On Wed, 14 Apr 2021 at 19:38, Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> > wrote: > > > On Wed, 2021-04-14 19:13:03 +0200, Jorge Redondo Flames wrote: > > > [..] > > > > > > Is there a way to configure Stunnel to *close* the local socket (not > > > listening anymore) whenever the peer process (i.e. the server) has closed > > > its socket? > > > > Stunnel listens for connection request from the client(s) and connects > > to the server on behalf of the client(s). How will a client ever be > > able to connect through Stunnel again if Stunnel closes the listening > > socket? > > > > Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:lholzheid@bihl-wiedemann.de https://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796 Datenschutzerklärung: https://www.bihl-wiedemann.de/de/meta/datenschutz

2 1

Local socket keeps listening
by Jorge Redondo Flames 14 Apr '21

14 Apr '21

Hey there, thanks for being there. I have a Client/Server services originally communicating over TCP. The client periodically monitors the socket connection by reading from the socket and, in the case the connection has been lost, the client retries the connection a given amount of times, after which it realizes that the server is definitely down. Now I have implemented secure communication using Stunnel and everything works fine except for the fact that, whenever the server process crashes (which is eventually expected), the client is no longer able to successfully monitor the connection as expected since, no matter what happens to the server process, the local Stunnel daemon keeps listening on its local socket. So, when the client retries connection, it successfully connects to the local socket. Although it soon receives connection reset, this successful connection attempt happening even when the server process is actually down completely breaks the client logic. I could change this logic but I really would like to avoid that path. So here is my question: Is there a way to configure Stunnel to *close* the local socket (not listening anymore) whenever the peer process (i.e. the server) has closed its socket? Thank you very much in advance.

2 1

Connection stops after 20 minutes
by erik.delanghe＠outlook.com 07 Apr '21

07 Apr '21

We use Stunnel between a windows server server and a windows client. Everything is working fine exept, after 20 minutes the connection is broken. (Cannot reach the server)

1 1

stunnel 5.59 released
by Michał Trojnara 05 Apr '21

05 Apr '21

Dear Users, I have released version 5.59 of stunnel. ### Version 5.59, 2021.04.05, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.1.1k. * New features - Client-side "protocol = ldap" support (thx to Bart Dopheide and Seth Grover). * Bugfixes - The test suite fixed not to require external connectivity. - Fixed paths in generated manuals (thx to Tatsuki Makino). - Fixed configuration reload when compression is used. - Fixed compilation with early releases of OpenSSL 1.1.1. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 137776df6be8f1701f1cd590b7779932e123479fb91e5192171c16798815ce9f stunnel-5.59.tar.gz c45fa3f70ecf0628d1f5985f2c11fedfc989bbc64db857def82ca7ee602fd8e0 stunnel-5.59-win64-installer.exe b56d91493631ff2b18e3e596fbb491892847f5671335c3f5e2307e174742ae44 stunnel-5.59-android.zip Best regards, Mike

1 0

Vulnerabilities cve-2021-3449 and cve-2021-3450
by erik.soudant＠pinkroccade.nl 31 Mar '21

31 Mar '21

Hi, Is there any chance that there will be a new stunnel version (windows) using openssl 1.1.1 k in order to be protected from at least vulnarability cve-2021-3449. And if so when can that be expected? Issue 3450 only concerns1.1.1 H-J so that is not a risk at this moment because the most recent Stunnel version is compiled against 1.1.1c.

2 1

SSL_get_peer_tmp_key fail
by stunnel＠paapnet.nl 28 Mar '21

28 Mar '21

Hai, I just tried compiling stunnel 5.58 but it bails out: CC stunnel-client.o client.c: In function 'print_tmp_key': client.c:670:10: warning: implicit declaration of function 'SSL_get_peer_tmp_key'; did you mean 'SSL_get_server_tmp_key'? [-Wimplicit-function-declaration] if (!SSL_get_peer_tmp_key(s, &key)) { ^~~~~~~~~~~~~~~~~~~~ SSL_get_server_tmp_key CCLD stunnel stunnel-client.o: In function `print_tmp_key': /try/stunnel-5.58/src/client.c:670: undefined reference to `SSL_get_peer_tmp_key' Running Ubuntu Ubuntu 18.04.5 LTS gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04) OpenSSL 1.1.1 11 Sep 2018 Version 5.49 compiles ok no issues there Am I missing something here ? Changing it into 'SSL_get_server_tmp_key works' or remming it out probably causes issues... bt it compiles well. Would be great if someone can point me in the right direction. Cheers...

1 0

cross compile for armv7 error, show cannot find ssp_nonshared and ssp
by 583301743＠qq.com 27 Mar '21

27 Mar '21

stunnel.c:306:14: warning: unused variable ‘status’ [-Wunused-variable] 306 | int pid, status; | ^~~~~~ stunnel.c:306:9: warning: unused variable ‘pid’ [-Wunused-variable] 306 | int pid, status; | ^~~ CC stunnel-pty.o CC stunnel-libwrap.o CC stunnel-ui_unix.o CCLD stunnel /mnt/armv5-eabi--uclibc--bleeding-edge-2020.08-1/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/10.2.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: cannot find -lssp_nonshared /mnt/armv5-eabi--uclibc--bleeding-edge-2020.08-1/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/10.2.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: cannot find -lssp when I comment -fstack-protector running error EchoLife_WAP ~ # stunnel -help /mnt/jffs2/app/bin/stunnel: symbol '__ctype_b_loc': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_key_create': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_attr_setstacksize': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_sigmask': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_getspecific': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_create': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'openpty': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_detach': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_setspecific': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_join': can't resolve symbol

2 4

when reload configure，there is a err (win32)
by koalabearguo＠gmail.com 24 Mar '21

24 Mar '21

hi,I am using the latest version(stunnel5.58) on windows10; compiled openssl 1.1.1j with option zlib enabled; the stunnel.conf file: add option "securityLevel = 0" to enable compression add option "compression = zlib" to enable compression when stunnel start,it work well.but when i reload configuration in the menu configuration，it give me this: SSL_COMP_add_compression_method: ssl\ssl_ciph.c:1997: error:140A5135:SSL routines:SSL_COMP_add_compression_method:duplicate compression id Global options: Failed to initialize TLS Then i search the source code,i found when reload config,the SSL_COMP_add_compression_method(0xe0,mesh) function will add compression id again(duplicate) i hope this can be fixed,thanks.

1 0

Windows Mobile Compiling
by ssj92＠att.net 23 Mar '21

23 Mar '21

Hello, I've been trying to compile latest version of stunnel for wce (WM6) and just cannot get it to work. I have 0 programming experience and have been trying to follow old guides. I was hoping if someone can compile or already has compiled a newer stunnel version for WCE (WM6) other than 5.02. Thanks

1 0

FIXED cross-compile stunnel lastest version with tls 1.3 suppport base on uclibc
by 583301743＠qq.com 22 Mar '21

22 Mar '21

Thank you for repy I have fix it using --with-threads=fork like CC=arm-linux-gcc CFLAGS="-fno-stack-protector" ./configure --prefix=/mnt/dists/stunnel --with-ssl=/mnt/dists/openssl-v1.1.1j --host=arm-linux --disable-fips --with-random=/dev/urandom --with-threads=fork --disable-libwrap --disable-systemd --disable-ipv6 (you maybe delete stack-protector in configure for cannot find libssp error) and commit #include <ctype.h> in common.c for fix __ctype_b_loc can't resolve symbol and delete all realize code int pty_allocate(int *ptyfd, int *ttyfd, char *namebuf) in pty.c for fix symbol 'openpty': can't resolve symbol like this int pty_allocate(int *ptyfd, int *ttyfd, char *namebuf) { return -1; } and compile openssl with no-threads options CC=arm-linux-gcc ./Configure --prefix=/mnt/dists/openssl-v1.1.1j linux-armv4 no-threads enable-tls1_3 no-asm no-async now running successfully EchoLife_WAP /tmp # ./stunnel -help Initializing inetd mode configuration stunnel 5.58 on arm-unknown-linux-gnu platform Compiled/running with OpenSSL 1.1.1j 16 Feb 2021 Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,OCSP,PSK,SNI cross-compile stunnel latest version with tls1.3 support is so diffcult. It spend my 2 days to fix problem. I do not why no any guide for cross compile for armv7 not andriod I use cross compile tools-chain is here https://toolchains.bootlin.com/downloads/releases/toolchains/armv5-eabi/tar…

1 1

Possible memory leak in stunnel4 3:5.44-1ubuntu3?
by hkdb 21 Mar '21

21 Mar '21

Hi all, I am currently implementing stunnels on an Ubuntu 18.04 container running Magento 2 connecting to AWS Elasiticache (Redis) with the following configuration: Master: fips = no setuid = nobody setgid = nogroup pid = /home/agent/pids/redis-master.pid debug = 1 delay = yes [redis-cli] client = yes accept = 127.0.0.1:8000 connect = master.awsurl:6379 and the exact same config for the read replica with different "connect" and "accept" values of course. Everything works great except that the container host becomes unresponsive after a few days. Doing a screenshot of the console shows that the host is out of memory and mentions stunnel4 in the same error message. Upon further digging, I found that running the tunnels progressively eats away at RAM over time. Look at the logs when setting debug to 7 shows the following suspect error message: Possible memory leak at ../crypto/asn1/asn1_lib.c:295: 28363 allocations Does anyone have any thoughts on this? Is it a usage/configurations issue or did I discover a memory leak here? If it is in fact a memory leak, does running a later version fix this? Is there a recommended version that I should try to run that's known to work well with Ubuntu 18.04? Thanks a lot in advance for any help on this issue! Regards, Jeremy 3DF Open Source Initiative *Mail: *hkdb(a)3df.io *Web: *https://osi.3df.io

1 0

when reload configure，there is a err (win32)
by koalabearguo＠gmail.com 17 Mar '21

17 Mar '21

hi,I am using the latest version(stunnel5.58) on windows10; compiled openssl 1.1.1j with option zlib enabled; the stunnel.conf file: add option "securityLevel = 0" to enable compression add option "compression = zlib" to enable compression when stunnel start,it work well.but when i reload configuration in the menu configuration，it give me this: SSL_COMP_add_compression_method: ssl\ssl_ciph.c:1997: error:140A5135:SSL routines:SSL_COMP_add_compression_method:duplicate compression id Global options: Failed to initialize TLS Then i search the source code,i found when reload config,the SSL_COMP_add_compression_method(0xe0,mesh) function will add compression id again(duplicate) i think this can be fixed,thanks.

1 0

TLS alert (read): warning: close notify
by Daniel Trickett 08 Mar '21

08 Mar '21

Hi folks, Receiving the message "TLS alert (read): warning: close notify" when initiating connection to another site. I checked logs and we do not get this on any other site we use stunnel to connect to. Is this a message an acknowledgement that stunnel received a close notify message from the external site? 2021.02.25 11:11:17 LOG6[106453]: TLS connected: new session negotiated 2021.02.25 11:11:17 LOG7[106453]: Deallocating application specific data for session connect address 2021.02.25 11:11:17 LOG6[106453]: Negotiated TLSv1.2 ciphersuite ECDHE-ECDSA-AES256-GCM-SHA384 (256-bit encryption) 2021.02.25 11:11:17 LOG7[106453]: Compression: null, expansion: null 021.02.25 11:11:17 LOG7[106453]: TLS alert (read): warning: close notify 2021.02.25 11:11:17 LOG6[106453]: TLS closed (SSL_read) 2021.02.25 11:11:17 LOG7[106453]: Sent socket write shutdown 2021.02.25 11:11:17 LOG6[106453]: Read socket closed (readsocket) 2021.02.25 11:11:17 LOG7[106453]: Sending close_notify alert 2021.02.25 11:11:17 LOG7[106453]: TLS alert (write): warning: close notify 2021.02.25 11:11:17 LOG6[106453]: SSL_shutdown successfully sent close_notify alert 2021.02.25 11:11:17 LOG5[106453]: Connection closed: 9951 byte(s) sent to TLS, 419 byte(s) sent to socket 2021.02.25 11:11:17 LOG7[106453]: Remote descriptor (FD=16) closed 2021.02.25 11:11:17 LOG7[106453]: Local descriptor (FD=15) closed 2021.02.25 11:11:17 LOG7[106453]: Service [xxxx-https] finished (0 left) Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.merckgroup.com/disclaimer to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

Win32 client cron_thread in main_cleanup() lock daemon_thread()
by jony202＠gmail.com 07 Mar '21

07 Mar '21

in main_cleanup() this code blocks because cron_thread has no exit #ifdef USE_WIN32 if(WaitForSingleObject(thread_list[i], INFINITE)==WAIT_FAILED) ioerror("WaitForSingleObject"); if(!CloseHandle(thread_list[i])) ioerror("CloseHandle"); #endif

1 0

Error Stunnel TLS alert (write): fatal: bad record mac
by Alexandre Afonso Vaz 02 Mar '21

02 Mar '21

Hello everyone I apologize in advance because my English is not the best I'm experiencing a problem with stunnel: On the server I'm running a current version [.] stunnel 5.56 on x86_64-pc-linux-gnu platform Compiled / running with OpenSSL 1.1.1d 10 Sep 2019 And on the client an old version [.] stunnel 5.39 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.1.0c 10 Nov 2016 The case is that I am having an error in the server log as shown below: SSL_accept: ../ssl/record/ssl3_record.c:677: error: 1408F119: SSL routines: ssl3_get_record: decryption failed or bad record mac I did the test by updating the client to the same version and everything works, the question I have is whether there is really an incompatibility between the versions (be it the stunnel or the openssl). Does anyone know how to confirm me if this is real? Thanks Vaz

1 0

How to insert 2 stunnel.service on redhat 7
by simona vittori 02 Mar '21

02 Mar '21

Hello, I have 2 stunnel instance on a server and I have to insert all 2 in systemd. How to do that? Is it possible to create 2 stunnel.service naming different, for example stunnel.service and stunnel1.service where insert the script to start at boot of the machine? Thanks a lot for you help, Bye Simona

2 2

TLS alert (read): warning: close notify
by Daniel Trickett 01 Mar '21

01 Mar '21

Hi folks, Receiving the message "TLS alert (read): warning: close notify" when initiating connection to another site. I checked logs and we do not get this on any other site we use stunnel to connect to. Is this a message an acknowledgement that stunnel received a close notify message from the external site? 2021.02.25 11:11:17 LOG6[106453]: TLS connected: new session negotiated 2021.02.25 11:11:17 LOG7[106453]: Deallocating application specific data for session connect address 2021.02.25 11:11:17 LOG6[106453]: Negotiated TLSv1.2 ciphersuite ECDHE-ECDSA-AES256-GCM-SHA384 (256-bit encryption) 2021.02.25 11:11:17 LOG7[106453]: Compression: null, expansion: null 021.02.25 11:11:17 LOG7[106453]: TLS alert (read): warning: close notify 2021.02.25 11:11:17 LOG6[106453]: TLS closed (SSL_read) 2021.02.25 11:11:17 LOG7[106453]: Sent socket write shutdown 2021.02.25 11:11:17 LOG6[106453]: Read socket closed (readsocket) 2021.02.25 11:11:17 LOG7[106453]: Sending close_notify alert 2021.02.25 11:11:17 LOG7[106453]: TLS alert (write): warning: close notify 2021.02.25 11:11:17 LOG6[106453]: SSL_shutdown successfully sent close_notify alert 2021.02.25 11:11:17 LOG5[106453]: Connection closed: 9951 byte(s) sent to TLS, 419 byte(s) sent to socket 2021.02.25 11:11:17 LOG7[106453]: Remote descriptor (FD=16) closed 2021.02.25 11:11:17 LOG7[106453]: Local descriptor (FD=15) closed 2021.02.25 11:11:17 LOG7[106453]: Service [xxxx-https] finished (0 left) This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.merckgroup.com/disclaimer to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

New User
by David Rose (dsr) 24 Feb '21

24 Feb '21

Hi I have a Windows app that sends email via SMTP without any authentication (port can be set). I want to use it with Office365 SMTP service which requires TLS. Will stunnel allow me to do this without affecting any other application sending email ? If it does, what terms should I be looking for in the help info ? Many thanks Regards David --

1 0

Windows Server 2012 R2 - localhost:25 stops listening
by Frank Warnke 23 Feb '21

23 Feb '21

Hi, I have noticed that when I install stunnel (stunnel-5.57-win64-installer.exe or today stunnel-5.58-win64-installer.exe) that running "netstat -ano" comes back with; TCP 127.0.0.1:25 0.0.0.0:0 LISTENING 2700 and the application we are using can send email via Gmail SMTP using the default stunnel.config. When I log out the user and go back in, the application can no longer send email via Gmail SMTP and "netstat -ano" no longer sees anything listening on port 25. I have verified that the stunnel service is running and have even stopped and started the stunnel service, but I am not able to get port 25 to be listened to unless I uninstall and install stunnel over again. It seems like something is setup or started during the stunnel install process that stops or gets killed after a user log outs. Any suggestions would be appreciated. Thanks, Frank

2 2

Unable to connect to server using Stunnel with TLS1.2
by jing_pan＠kindermorgan.com 02 Feb '21

02 Feb '21

We failed to using stunnel to connect to remote server which only accept TLS1.2. So we configured the stunnel on our side with below stunnel.conf. We have another program listening to localhost:3500 and process the response from server. I would appreciate any suggestion. 1. Stunnel version: 2021.02.02 10:35:27 LOG5[main]: stunnel 5.58 on x64-pc-mingw32-gnu platform 2021.02.02 10:35:27 LOG5[main]: Compiled/running with OpenSSL 1.1.1h 22 Sep 2020 2021.02.02 10:35:27 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2021.02.02 10:35:27 LOG5[main]: Reading configuration from file stunnel.conf 2021.02.02 10:35:27 LOG5[main]: UTF-8 byte order mark not detected 2021.02.02 10:35:27 LOG4[main]: Service [FIXSERVER] needs authentication to prevent MITM attacks 2021.02.02 10:35:27 LOG5[main]: Configuration successful 2. stunnel.conf [FIXSERVER] cert = stunnel.pem client = yes fips = no accept = 127.0.0.1:3000 connect = 63.247.***.***:443 sslVersion = TLSv1.2 3. error returned: An existing connection was forcibly closed by the remote host 4. openssl s_client -connect 63.247.***.***:443 --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 2814 bytes and written 419 bytes Verification error: self signed certificate in certificate chain --- New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE

1 0

Seeing Message in Plain Text in Wireshark
by David Brower 28 Jan '21

28 Jan '21

First time user of Stunnel and I just wanted to check what I'm doing wrong. I have two processes running: a TCP Listener that listens on port 13000 and a TCP client that sends it a message. I'm running Stunnel on Windows 10 with the following config: [myapp] client = yes accept = 13001 connect = 13000 cert = stunnel.pem TIMEOUTclose=0 I updated the TCP client to send the message to port 13001 but when I check Wireshark I can still see the contents of the message in plaintext. Shouldn't I no longer be able to see the unencrypted contents of this message? Here are the relevant logs: 2021.01.27 20:57:26 LOG7[main]: Found 1 ready file descriptor(s) 2021.01.27 20:57:26 LOG7[main]: FD=588 ifds=r-x ofds=r-- 2021.01.27 20:57:26 LOG7[main]: FD=596 ifds=r-x ofds=--- 2021.01.27 20:57:26 LOG7[main]: Service [myapp] accepted (FD=924) from 127.0.0.1:9322 2021.01.27 20:57:26 LOG7[main]: Creating a new thread 2021.01.27 20:57:26 LOG7[main]: New thread created 2021.01.27 20:57:26 LOG7[2]: Service [myapp] started 2021.01.27 20:57:26 LOG7[2]: Setting local socket options (FD=924) 2021.01.27 20:57:26 LOG7[2]: Option TCP_NODELAY set on local socket 2021.01.27 20:57:26 LOG5[2]: Service [myapp] accepted connection from 127.0.0.1:9322 2021.01.27 20:57:26 LOG6[2]: s_connect: connecting 127.0.0.1:13000 2021.01.27 20:57:26 LOG7[2]: s_connect: s_poll_wait 127.0.0.1:13000: waiting 10 seconds 2021.01.27 20:57:26 LOG7[2]: FD=940 ifds=rwx ofds=--- 2021.01.27 20:57:26 LOG5[2]: s_connect: connected 127.0.0.1:13000 2021.01.27 20:57:26 LOG5[2]: Service [myapp] connected remote server from 127.0.0.1:9323 2021.01.27 20:57:26 LOG7[2]: Setting remote socket options (FD=940) 2021.01.27 20:57:26 LOG7[2]: Option TCP_NODELAY set on remote socket 2021.01.27 20:57:26 LOG7[2]: Remote descriptor (FD=940) initialized 2021.01.27 20:57:26 LOG6[2]: SNI: sending servername: localhost 2021.01.27 20:57:26 LOG6[2]: Peer certificate not required 2021.01.27 20:57:26 LOG7[2]: TLS state (connect): before SSL initialization 2021.01.27 20:57:26 LOG7[2]: Initializing application specific data for session authenticated 2021.01.27 20:57:26 LOG7[2]: TLS state (connect): SSLv3/TLS write client hello

3 2

Stunnel intercept and modify payload
by Sealside - 26 Jan '21

26 Jan '21

Hi! I'm wondering if it is possible to modify payload before it is encrypted? I have a stunnel config which intercepts TLS. I have the following config: [server] client = no cert= /etc/stunnel/stunnel.pem accept = 127.0.0.1:11010 connect = 127.0.0.1:12220 [client] client = yes accept = 127.0.0.1:12220 connect = remoteserver_ip:12222 So when posting TLS messages on port 11010 from my TLS-client on the same server, I can connect to port 12220 using tcp-dump and read the payload unencrypted. Is it possible to alter the payload before it is sent? In that case any pointers would be appreciated , I have tried searching but it does not seem to be a common use case. Would be great if I could tunnel it somewhere else and back (external python program). Thanks in advance, S

1 0

Poss Memory Leak
by Danny Clowes 25 Jan '21

25 Jan '21

Hi, Using the latest build of S'tunnel getting this error when do systemctl status stunnel4 can anyone shed some light on this please using Debian 9 as unable to get Debian 10 work with Stunnel. Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508179]: Possible memory leak at ../ssl/packet_locl.h:385: 1021646 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508091]: Possible memory leak at ../ssl/packet_locl.h:385: 1021646 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508179]: Possible memory leak at ../crypto/threads_pthread.c:21: 526301 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508091]: Possible memory leak at ../crypto/threads_pthread.c:21: 526301 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508170]: Possible memory leak at ../crypto/stack/stack.c:108: 1026780 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508170]: Possible memory leak at ../ssl/packet_locl.h:385: 1021646 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508170]: Possible memory

1 0

installation v run ad-hoc
by Andrew Zenz 21 Jan '21

21 Jan '21

Hi there, a bit of background to start. We are using SEE4C (from marshallsoft.com) for sending email from our application, and have been for some time. We call various functions from their see32.dll. It has been sitting on the back-burner for some time, but now we must implement TLS/SSL for outgoing mail. MarshallSoft don't do TLS/SSL themselves, instead passing that responsibility on to stunnel by way of an internal function I have been reading MarshallSoft's doco and find that I have to 'install' stunnel and have it running in the background either as a services or starting it when the user logs on (in the Startup group). I also read in their doco regarding mapped drives: MAPPED DRIVES Beginning with Windows 10 update 1803, all executables (such as SEE application programs, SEE32.DLL/SEE64.DLL, and Stunnel) must be loaded from a local drive, not a mapped drive. Unfortunately the requirement to install stunnel and inability to run it from a mapped drive doesn't suit many of our clients installation base. Many of them run our application from a mapped drive. I also don't want the overhead of installing stunnel on each workstation that needs to send email or distribute and maintain configuration files. I have enough work to do. Can stunnel be called (started) on an ad-hoc basis and stopped again, only when email is being sent? I don't mean to whine, what options do I have, do our clients have? Cheers, Andrew

1 0

Why the version of Client Hello is always TLS 1.0 ?
by liuyongjiao＠synqnc.com 13 Jan '21

13 Jan '21

Hi, Why the TLS version is always 1.0 ? Please help to check. Frame 11: 1721 bytes on wire (13768 bits), 1721 bytes captured (13768 bits) Ethernet II, Src: fa:16:3e:53:dc:2f (fa:16:3e:53:dc:2f), Dst: IETF-VRRP-VRID_02 (00:00:5e:00:01:02) Internet Protocol Version 4, Src: 10.160.8.11, Dst: 10.160.130.34 Transmission Control Protocol, Src Port: 50692, Dst Port: 9002, Seq: 1, Ack: 1, Len: 1655 Transport Layer Security TLSv1 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 1650 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 1646 Version: TLS 1.2 (0x0303) Random: fd7cbf2da8172c362ebd3120b2dcd3886f3015eabfb5f167… Session ID Length: 32 Session ID: 4ea202f00bd35c102c97e8621f68e33dd59ad8ee95a58a2f… Cipher Suites Length: 170 Cipher Suites (85 suites) Compression Methods Length: 1 Compression Methods (1 method) Extensions Length: 1403 Extension: server_name (len=18) Extension: ec_point_formats (len=4) Extension: supported_groups (len=28) Extension: session_ticket (len=1296) Extension: signature_algorithms (len=32) Extension: heartbeat (len=1) Following are the config file: ;************************************************************************** ; * Global options * ; ************************************************************************** ; It is recommended to drop root privileges if stunnel is started by root ;setuid = stunnel4 ;setgid = stunnel4 ; PID file is created inside the chroot jail (if enabled) pid = /home/stunnelnew.pid ; Debugging stuff (may be useful for troubleshooting) ;foreground = yes ;debug = info debug = debug output = /home/log/stunnelnew.log ;options = NO_SSLv2 ;options = NO_SSLv3 ;options = NO_TLSv1 ;options = NO_TLSv1.1 ;sslVersionMax = TLSv1.2 ;sslVersionMin = TLSv1.2 ; ************************************************************************** ; * Service definitions (remove all services for inetd mode) * ; ************************************************************************** [xxxxxxxxxxxx] ;socket = a:SO_REUSEADDR=no retry = yes ;options = NO_SSLv2 ;options = NO_SSLv3 ;options = NO_TLSv1 ;options = NO_TLSv1.1 sslVersion = TLSv1.2 ;socket = l:SO_LINGER=1:13 ;sslVersionMin = TLSv1.2 cert = /home/x/ssltest/x/server.cer key = /home/x/ssltest/x/server_key.pem CAfile = /home/x/ssltest/x/trust.cer client = yes accept = 31115 connect = 10.160.1.11:9113 liuyongjiao(a)synqnc.com

1 0

stunnel to gmail didn't work
by wangweihsiang1109＠gmail.com 09 Jan '21

09 Jan '21

Hello,I have set up a website,and I want to send email by gmail,so I used stunnel,but my gmail didn't send anything. 2021.01.08 15:01:58 LOG5[14]: Service [gmail-smtp] accepted connection from 127.0.0.1:59920 2021.01.08 15:01:58 LOG5[14]: s_connect: connected 2404:6800:4008:c06::6d:587 2021.01.08 15:01:58 LOG5[14]: Service [gmail-smtp] connected remote server from 2001:b011:e:3358:b5b1:fa68:8b3:883c:59921 2021.01.08 15:01:59 LOG5[14]: Connection closed: 22 byte(s) sent to TLS, 154 byte(s) sent to socket conf look like this: [gmail-smtp] client = yes accept = 127.0.0.1:35 connect = smtp.gmail.com:587 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes protocol = smtp protocolUsername = *****(a)gmail.com protocolPassword = *****

1 0

report
by Danny Clowes 03 Jan '21

03 Jan '21

sudo find / -name openssl ive checked some locations but im very lost since learning ssl and stunnel i would be happy if you could forward me to the right location & i'll send information back.. Thank you ------------------- /etc/apparmor.d/abstractions/openssl /usr/include/x86_64-linux-gnu/openssl /usr/include/openssl /usr/bin/openssl /usr/share/lintian/overrides/openssl /usr/share/doc/openssl /usr/share/bash-completion/completions/openssl /root/openssl-master/test/ossl_shim/include/openssl /root/openssl-master/include/openssl /snap/core/10577/etc/apparmor.d/abstractions/openssl /snap/core/10577/usr/bin/openssl /snap/core/10577/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl /snap/core/10577/usr/lib/python3/dist-packages/cryptography/hazmat/bindings/openssl /snap/core/10577/usr/share/bash-completion/completions/openssl /snap/core/10577/usr/share/doc/openssl root@debian:/usr/local/include#

1 0

report
by Danny Clowes 28 Dec '20

28 Dec '20

Hi, I'm using 5.7 stunnel for Debian. I have clients connecting to the server we are getting the following error message. I would be grateful if able to help? * Unable to use the beta version as the R-limit don't work and gives me error messages. Dec 28 08:44:33 debian stunnel: LOG4[129248]: Possible memory leak at ../ssl/packet_locl.h:385: 241533 allocations Dec 28 08:44:33 debian stunnel: LOG4[128031]: Possible memory leak at ../crypto/stack/stack.c:108: 243008 allocations Dec 28 08:44:33 debian stunnel: LOG4[129238]: Possible memory leak at ../crypto/stack/stack.c:108: 243008 allocations Dec 28 08:44:33 debian stunnel: LOG4[128031]: Possible memory leak at ../ssl/packet_locl.h:385: 241533 allocations Dec 28 08:44:33 debian stunnel: LOG4[129140]: Possible memory leak at ../crypto/stack/stack.c:108: 243008 allocations Dec 28 08:44:33 debian stunnel: LOG4[129140]: Possible memory leak at ../ssl/packet_locl.h:385: 241533 allocations Dec 28 08:44:33 debian stunnel: LOG4[129238]: Possible memory leak at ../ssl/packet_locl.h:385: 241533 allocations Dec 28 08:44:33 debian stunnel: LOG4[129206]: Possible memory leak at ../crypto/stack/stack.c:108: 243008 allocations Dec 28 08:44:33 debian stunnel: LOG4[129206]: Possible memory leak at ../ssl/packet_locl.h:385: 241533 allocations Dec 28 08:44:33 debian stunnel: LOG4[128166]: Possible memory leak at ../crypto/stack/stack.c:108: 243008 allocations Dec 28 08:44:33 debian stunnel: LOG4[128166]: Possible memory leak at ../ssl/packet_locl.h:385: 241533 allocations Thanks.

1 0

stunnel is stuck for 30 seconds
by dittyadler＠gmail.com 23 Dec '20

23 Dec '20

Hi, I'm running stunnel version 5.58 on Windows, everything works perfectly besides that sometimes stunnel gets stuck for 30 seconds - Nothing special in stunnel log, except for the 30 seconds delay: 2020.12.21 14:48:36 LOG6[8]: TLS connected: previous session reused 2020.12.21 14:48:36 LOG6[8]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2020.12.21 14:48:36 LOG6[8]: Peer temporary key: X25519, 253 bits 2020.12.21 14:48:36 LOG7[8]: Compression: null, expansion: null 2020.12.21 14:48:36 LOG6[8]: Session id: 8E62D0D8EB6359FEA7370E64AA7CC58EF9DB68059A5E01417E7038B773CE60D3 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:48:36 LOG7[8]: Initializing application specific data for session authenticated 2020.12.21 14:48:36 LOG7[8]: New session callback 2020.12.21 14:48:36 LOG7[8]: Deallocating application specific data for session connect address 2020.12.21 14:48:36 LOG6[8]: Session id: AF8ED185555C6734403C71B514A3F6B75F8484A5AC4EAE6058CFF4D35D929B36 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSLv3/TLS read server session ticket 30 sec delay 2020.12.21 14:49:06 LOG6[8]: Read socket closed (readsocket) 2020.12.21 14:49:06 LOG7[8]: Sending close_notify alert 2020.12.21 14:49:06 LOG7[8]: TLS alert (write): warning: close notify 2020.12.21 14:49:06 LOG6[8]: SSL_shutdown successfully sent close_notify alert 2020.12.21 14:49:06 LOG3[8]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2020.12.21 14:49:06 LOG7[8]: FD=4540 ifds=--x ofds=--- 2020.12.21 14:49:06 LOG7[8]: FD=4792 ifds=r-x ofds=--- 2020.12.21 14:49:06 LOG5[8]: Connection closed: 64 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.12.21 14:49:06 LOG7[8]: Remote descriptor (FD=4792) closed 2020.12.21 14:49:06 LOG7[8]: Local descriptor (FD=4540) closed 2020.12.21 14:49:06 LOG7[8]: Service [SLNP pem file] finished (0 left) log example when stunnel doesn't get stuck: 2020.12.21 14:49:06 LOG6[9]: TLS connected: previous session reused 2020.12.21 14:49:06 LOG6[9]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2020.12.21 14:49:06 LOG6[9]: Peer temporary key: X25519, 253 bits 2020.12.21 14:49:06 LOG7[9]: Compression: null, expansion: null 2020.12.21 14:49:06 LOG6[9]: Session id: AF8ED185555C6734403C71B514A3F6B75F8484A5AC4EAE6058CFF4D35D929B36 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:49:06 LOG7[9]: Initializing application specific data for session authenticated 2020.12.21 14:49:06 LOG7[9]: New session callback 2020.12.21 14:49:06 LOG7[9]: Deallocating application specific data for session connect address 2020.12.21 14:49:06 LOG6[9]: Session id: 44E9010787EFDBC0FCA92724415AD30EF9EDB626D734D894061606C79CD26402 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSLv3/TLS read server session ticket 2020.12.21 14:49:06 LOG6[9]: Read socket closed (readsocket) 2020.12.21 14:49:06 LOG7[9]: Sending close_notify alert 2020.12.21 14:49:06 LOG7[9]: TLS alert (write): warning: close notify 2020.12.21 14:49:06 LOG6[9]: SSL_shutdown successfully sent close_notify alert 2020.12.21 14:49:06 LOG3[9]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2020.12.21 14:49:06 LOG7[9]: FD=2464 ifds=r-x ofds=--- 2020.12.21 14:49:06 LOG7[9]: FD=2788 ifds=--x ofds=--- 2020.12.21 14:49:06 LOG5[9]: Connection closed: 64 byte(s) sent to TLS, 108 byte(s) sent to socket 2020.12.21 14:49:06 LOG7[9]: Remote descriptor (FD=2464) closed 2020.12.21 14:49:06 LOG7[9]: Local descriptor (FD=2788) closed 2020.12.21 14:49:06 LOG7[9]: Service [SLNP pem file] finished (0 left) My stunnel conf: debug = 7 output = stunnel.log fips = no options = NO_SSLv2 [SLNP pem file] key = SLNP_urmsand01_new.pem cert = SLNP_urmsand01_new.pem client = yes accept = 8003 connect = host:6443 TIMEOUTbusy = 30 TIMEOUTclose = 0 TIMEOUTconnect = 60 TIMEOUTidle = 86400 With the old stunnel(5.14) it doesn’t happen. Thanks, Ditty.

3 3

stunnel is stuck for 30 seconds
by Brent Kimberley 23 Dec '20

23 Dec '20

Chris/Ditty. Have you tried optimizing your config - on both sides? For example, please search for TIMEOUTbusy in https://github.com/mtrojnar/stunnel/tree/stunnel-5.58 &/| https://github.com/mtrojnar/stunnel/tree/stunnel-5.57 On 12/21/20 13:09, dittyadler(a)gmail.com wrote: > Hi, > > I'm running stunnel version 5.58 on Windows, > everything works perfectly besides that sometimes stunnel gets stuck for 30 seconds - > Nothing special in stunnel log, except for the 30 seconds delay: >

1 0

stunnel is stuck for 30 seconds
by dittyadler＠gmail.com 21 Dec '20

21 Dec '20

Hi, I'm running stunnel version 5.58 on Windows, everything works perfectly besides that sometimes stunnel gets stuck for 30 seconds - Nothing special in stunnel log, except for the 30 seconds delay: 2020.12.21 14:48:36 LOG6[8]: TLS connected: previous session reused 2020.12.21 14:48:36 LOG6[8]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2020.12.21 14:48:36 LOG6[8]: Peer temporary key: X25519, 253 bits 2020.12.21 14:48:36 LOG7[8]: Compression: null, expansion: null 2020.12.21 14:48:36 LOG6[8]: Session id: 8E62D0D8EB6359FEA7370E64AA7CC58EF9DB68059A5E01417E7038B773CE60D3 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:48:36 LOG7[8]: Initializing application specific data for session authenticated 2020.12.21 14:48:36 LOG7[8]: New session callback 2020.12.21 14:48:36 LOG7[8]: Deallocating application specific data for session connect address 2020.12.21 14:48:36 LOG6[8]: Session id: AF8ED185555C6734403C71B514A3F6B75F8484A5AC4EAE6058CFF4D35D929B36 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSLv3/TLS read server session ticket 30 sec delay 2020.12.21 14:49:06 LOG6[8]: Read socket closed (readsocket) 2020.12.21 14:49:06 LOG7[8]: Sending close_notify alert 2020.12.21 14:49:06 LOG7[8]: TLS alert (write): warning: close notify 2020.12.21 14:49:06 LOG6[8]: SSL_shutdown successfully sent close_notify alert 2020.12.21 14:49:06 LOG3[8]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2020.12.21 14:49:06 LOG7[8]: FD=4540 ifds=--x ofds=--- 2020.12.21 14:49:06 LOG7[8]: FD=4792 ifds=r-x ofds=--- 2020.12.21 14:49:06 LOG5[8]: Connection closed: 64 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.12.21 14:49:06 LOG7[8]: Remote descriptor (FD=4792) closed 2020.12.21 14:49:06 LOG7[8]: Local descriptor (FD=4540) closed 2020.12.21 14:49:06 LOG7[8]: Service [SLNP pem file] finished (0 left) log example when stunnel doesn't get stuck: 2020.12.21 14:49:06 LOG6[9]: TLS connected: previous session reused 2020.12.21 14:49:06 LOG6[9]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2020.12.21 14:49:06 LOG6[9]: Peer temporary key: X25519, 253 bits 2020.12.21 14:49:06 LOG7[9]: Compression: null, expansion: null 2020.12.21 14:49:06 LOG6[9]: Session id: AF8ED185555C6734403C71B514A3F6B75F8484A5AC4EAE6058CFF4D35D929B36 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:49:06 LOG7[9]: Initializing application specific data for session authenticated 2020.12.21 14:49:06 LOG7[9]: New session callback 2020.12.21 14:49:06 LOG7[9]: Deallocating application specific data for session connect address 2020.12.21 14:49:06 LOG6[9]: Session id: 44E9010787EFDBC0FCA92724415AD30EF9EDB626D734D894061606C79CD26402 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSLv3/TLS read server session ticket 2020.12.21 14:49:06 LOG6[9]: Read socket closed (readsocket) 2020.12.21 14:49:06 LOG7[9]: Sending close_notify alert 2020.12.21 14:49:06 LOG7[9]: TLS alert (write): warning: close notify 2020.12.21 14:49:06 LOG6[9]: SSL_shutdown successfully sent close_notify alert 2020.12.21 14:49:06 LOG3[9]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2020.12.21 14:49:06 LOG7[9]: FD=2464 ifds=r-x ofds=--- 2020.12.21 14:49:06 LOG7[9]: FD=2788 ifds=--x ofds=--- 2020.12.21 14:49:06 LOG5[9]: Connection closed: 64 byte(s) sent to TLS, 108 byte(s) sent to socket 2020.12.21 14:49:06 LOG7[9]: Remote descriptor (FD=2464) closed 2020.12.21 14:49:06 LOG7[9]: Local descriptor (FD=2788) closed 2020.12.21 14:49:06 LOG7[9]: Service [SLNP pem file] finished (0 left) My stunnel conf: debug = 7 output = stunnel.log fips = no options = NO_SSLv2 [SLNP pem file] key = SLNP_urmsand01_new.pem cert = SLNP_urmsand01_new.pem client = yes accept = 8003 connect = host:6443 TIMEOUTbusy = 30 TIMEOUTclose = 0 TIMEOUTconnect = 60 TIMEOUTidle = 86400 With the old stunnel(5.14) it doesn’t happen. Thanks, Ditty.

1 0

stunnel is stuck for 30 seconds
by DITTY ADLER 21 Dec '20

21 Dec '20

Hi, I'm running stunnel version 5.58 on Windows, everything works perfectly besides that sometimes stunnel gets stuck for 30 seconds - Nothing special in stunnel log, except for the 30 seconds delay: 2020.12.21 14:48:36 LOG6[8]: TLS connected: previous session reused 2020.12.21 14:48:36 LOG6[8]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2020.12.21 14:48:36 LOG6[8]: Peer temporary key: X25519, 253 bits 2020.12.21 14:48:36 LOG7[8]: Compression: null, expansion: null 2020.12.21 14:48:36 LOG6[8]: Session id: 8E62D0D8EB6359FEA7370E64AA7CC58EF9DB68059A5E01417E7038B773CE60D3 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:48:36 LOG7[8]: Initializing application specific data for session authenticated 2020.12.21 14:48:36 LOG7[8]: New session callback 2020.12.21 14:48:36 LOG7[8]: Deallocating application specific data for session connect address 2020.12.21 14:48:36 LOG6[8]: Session id: AF8ED185555C6734403C71B514A3F6B75F8484A5AC4EAE6058CFF4D35D929B36 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSLv3/TLS read server session ticket 30 sec delay 2020.12.21 14:49:06 LOG6[8]: Read socket closed (readsocket) 2020.12.21 14:49:06 LOG7[8]: Sending close_notify alert 2020.12.21 14:49:06 LOG7[8]: TLS alert (write): warning: close notify 2020.12.21 14:49:06 LOG6[8]: SSL_shutdown successfully sent close_notify alert 2020.12.21 14:49:06 LOG3[8]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2020.12.21 14:49:06 LOG7[8]: FD=4540 ifds=--x ofds=--- 2020.12.21 14:49:06 LOG7[8]: FD=4792 ifds=r-x ofds=--- 2020.12.21 14:49:06 LOG5[8]: Connection closed: 64 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.12.21 14:49:06 LOG7[8]: Remote descriptor (FD=4792) closed 2020.12.21 14:49:06 LOG7[8]: Local descriptor (FD=4540) closed 2020.12.21 14:49:06 LOG7[8]: Service [SLNP pem file] finished (0 left) log example when stunnel doesn't get stuck: 2020.12.21 14:49:06 LOG6[9]: TLS connected: previous session reused 2020.12.21 14:49:06 LOG6[9]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2020.12.21 14:49:06 LOG6[9]: Peer temporary key: X25519, 253 bits 2020.12.21 14:49:06 LOG7[9]: Compression: null, expansion: null 2020.12.21 14:49:06 LOG6[9]: Session id: AF8ED185555C6734403C71B514A3F6B75F8484A5AC4EAE6058CFF4D35D929B36 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:49:06 LOG7[9]: Initializing application specific data for session authenticated 2020.12.21 14:49:06 LOG7[9]: New session callback 2020.12.21 14:49:06 LOG7[9]: Deallocating application specific data for session connect address 2020.12.21 14:49:06 LOG6[9]: Session id: 44E9010787EFDBC0FCA92724415AD30EF9EDB626D734D894061606C79CD26402 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSLv3/TLS read server session ticket 2020.12.21 14:49:06 LOG6[9]: Read socket closed (readsocket) 2020.12.21 14:49:06 LOG7[9]: Sending close_notify alert 2020.12.21 14:49:06 LOG7[9]: TLS alert (write): warning: close notify 2020.12.21 14:49:06 LOG6[9]: SSL_shutdown successfully sent close_notify alert 2020.12.21 14:49:06 LOG3[9]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2020.12.21 14:49:06 LOG7[9]: FD=2464 ifds=r-x ofds=--- 2020.12.21 14:49:06 LOG7[9]: FD=2788 ifds=--x ofds=--- 2020.12.21 14:49:06 LOG5[9]: Connection closed: 64 byte(s) sent to TLS, 108 byte(s) sent to socket 2020.12.21 14:49:06 LOG7[9]: Remote descriptor (FD=2464) closed 2020.12.21 14:49:06 LOG7[9]: Local descriptor (FD=2788) closed 2020.12.21 14:49:06 LOG7[9]: Service [SLNP pem file] finished (0 left) My stunnel conf: debug = 7 output = stunnel.log fips = no options = NO_SSLv2 [SLNP pem file] key = SLNP_urmsand01_new.pem cert = SLNP_urmsand01_new.pem client = yes accept = 8003 connect = host:6443 TIMEOUTbusy = 30 TIMEOUTclose = 0 TIMEOUTconnect = 60 TIMEOUTidle = 86400 With the old stunnel(5.14) it doesn’t happen. Thanks, Ditty.

1 0

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

EHLO localhost causing problem in smtp-relay.gmail.com
by sreyas-n＠hcl.com 11 Dec '20

11 Dec '20

We note that always EHLO command sent by sTunnel to SMTP server always been populated as "localhost". Note some well know SMTP server (or) SMTP relay servers such as smtp-relay.gmail.com, etc reject further communication with SMTP clients (as here sTunnel), if they receive initial handshake EHLO request itself as LOCALHOST. Please refer this link on why SMTP servers/ relay servers reject EHLO command with LOCALHOST - https://support.google.com/a/answer/2956491. Note because of this reason, we could use sTunnel as our encryption channel to communicate with SMTP server/relay server. Is there any specific reason behind in hardcoding the EHLO command with LOCALHOST always even in latest version of sTunnel - 5.57 version..? Always what would be in sTunnel functionality, if we change the EHLO command to populate as hostname (or) FQDN instead.

1 0

EHLO localhost
by sreyas-n＠hcl.com 11 Dec '20

11 Dec '20

We note that always EHLO command sent by sTunnel to SMTP server always been populated as "localhost". Note some well know SMTP server (or) SMTP relay servers such as smtp-relay.gmail.com, etc reject further communication with SMTP clients (as here sTunnel), if they receive initial handshake EHLO request itself as LOCALHOST. Please refer this link on why SMTP servers/ relay servers reject EHLO command with LOCALHOST - https://support.google.com/a/answer/2956491. Note because of this reason, we could use sTunnel as our encryption channel to communicate with SMTP server/relay server. Is there any specific reason behind in hardcoding the EHLO command with LOCALHOST always even in latest version of sTunnel - 5.57 version..? Always what would be in sTunnel functionality, if we change the EHLO command to populate as hostname (or) FQDN instead.

1 0

Segmentation fault on the stunnel 5.57 running on RHEL7
by paulrbk＠gmail.com 11 Dec '20

11 Dec '20

Hi All we have a segmentation fault on the stunnel 5.57 running on RHEL7 Dec 10 16:54:32 prod001 kernel: stunnel[1572]: segfault at 278 ip 00007f3fdca229c2 sp 00007f3fd9011a28 error 6 in libssl.so.1.0.2k[7f3fdc9da000+67000] $ uname -a Linux prod001 3.10.0-1160.2.1.el7.x86_64 #1 SMP Mon Sep 21 21:00:09 EDT 2020 x86_64 x86_64 x86_64 GNU/Linux $ rpm -qa|grep openssl openssl-devel-1.0.2k-19.el7.x86_64 xmlsec1-openssl-1.2.20-7.el7_4.x86_64 openssl-1.0.2k-19.el7.x86_64 openssl-libs-1.0.2k-19.el7.x86_64 below is the configuration =================================== pid = /home/admin/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 #debug = 2 debug = 7 output = /home/admin/log/stunnel.log ######################################################## ### ### INSTANCE 1: program1 ### ### Tunnel for remote connection (Server_aaS) ### [program1-remote-to-local] cert = /home/admin/config/certs/prod001.crt key = /home/admin/config/certs/prod001.key accept = 192.168.1.33:7011 connect = 192.168.1.33:7001 ### Tunnel for local connection ### [program1-local-to-local] client = yes CAfile = /home/admin/config/certs/prod001.crt accept = 127.0.0.1:7011 connect = 192.168.1.33:7011 ### Tunnel to connect remote Tunnel ### SERVER-02 192.168.1.34:7021 ### [program1-01-to-02] client = yes CAfile = /home/admin/config/certs/prod002.crt accept = 192.168.1.33:7021 connect = 192.168.1.34:7021 ========================================== $ ./stunnel -help Initializing inetd mode configuration stunnel 5.57 on x86_64-pc-linux-gnu platform Compiled/running with OpenSSL 1.0.2k-fips 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: chroot = directory to chroot stunnel process compression = compression type EGD = path to Entropy Gathering Daemon socket engine = auto|engine_id engineCtrl = cmd[:arg] engineDefault = TASK_LIST fips = yes|no FIPS 140-2 mode foreground = yes|quiet|no foreground mode (don't fork, log to stderr) log = append|overwrite log file output = file to append log messages pid = pid file RNDbytes = bytes to read from random seed files RNDfile = path to file with random seed data RNDoverwrite = yes|no overwrite seed datafiles with new random data syslog = yes|no send logging messages to syslog Service-level options: accept = [host:]port accept connections on specified host:port CApath = CA certificate directory for 'verify' option CAfile = CA certificate file for 'verify' option cert = certificate chain checkEmail = peer certificate email address checkHost = peer certificate host name pattern checkIP = peer certificate IP address ciphers = permitted ciphers for TLS 1.2 or older client = yes|no client mode (remote service uses TLS) config = command[:parameter] to execute connect = [host:]port to connect CRLpath = CRL directory CRLfile = CRL file curves = ECDH curve names debug = [facility].level (e.g. daemon.info) delay = yes|no delay DNS lookup for 'connect' option engineId = ID of engine to read the key from engineNum = number of engine to read the key from exec = file execute local inetd-type program execArgs = arguments for 'exec' (including $0) failover = rr|prio failover strategy ident = username for IDENT (RFC 1413) checking include = directory with configuration file snippets key = certificate private key local = IP address to be used as source for remote connections logId = connection identifier type OCSP = OCSP responder URL OCSPaia = yes|no check the AIA responders from certificates OCSPflag = OCSP responder flags OCSPnonce = yes|no send and verify the OCSP nonce extension options = TLS option to set/reset protocol = protocol to negotiate before TLS initialization currently supported: cifs, connect, imap, nntp, pgsql, pop3, proxy, smtp, socks protocolAuthentication = authentication type for protocol negotiations protocolDomain = domain for protocol negotiations protocolHost = host:port for protocol negotiations protocolPassword = password for protocol negotiations protocolUsername = username for protocol negotiations PSKidentity = identity for PSK authentication PSKsecrets = secrets for PSK authentication pty = yes|no allocate pseudo terminal for 'exec' option redirect = [host:]port to redirect on authentication failures renegotiation = yes|no support renegotiation requireCert = yes|no require client certificate reset = yes|no send TCP RST on error retry = yes|no retry connect+exec section service = service name setgid = groupname for setgid() setuid = username for setuid() sessionCacheSize = session cache size sessionCacheTimeout = session cache timeout (in seconds) sessiond = [host:]port use sessiond at host:port sni = master_service:host_name for an SNI virtual service socket = a|l|r:option=value[:value] set an option on accept/local/remote socket sslVersion = all|SSLv2|SSLv3|TLSv1|TLSv1.1|TLSv1.2 TLS method stack = thread stack size (in bytes) ticketKeySecret = secret key for encryption/decryption TLSv1.3 tickets ticketMacSecret = key for HMAC operations on TLSv1.3 tickets TIMEOUTbusy = seconds to wait for expected data TIMEOUTclose = seconds to wait for close_notify TIMEOUTconnect = seconds to connect remote host TIMEOUTidle = seconds to keep an idle connection transparent = none|source|destination|both transparent proxy mode verify = level of peer certificate verification verifyChain = yes|no verify certificate chain verifyPeer = yes|no verify peer certificate

1 0

Stunnel and CAPI engine: Issues after OpenSSL upgrade on server side
by Brent Kimberley 10 Dec '20

10 Dec '20

It looks like IBM might have been able to get MS CAPI to work with TLS1.2. That said, I think it would make more sense to switch to CNG API.

2 2

Cannot connect using PKI
by Greg Sanders 09 Dec '20

09 Dec '20

Hello, we have been connecting to a test API site where we specified a PEM cert saved locally, and succeeded. I believe this is the 'certificate pinning' approach. Now we are transitioning to the production API, where the tech documentation says there is no certificate needed, "the certificate is sent during the handshake". So a PKI client connection, I guess. But we can't connect. Any suggestions would be appreciated. Our stunnel config is below. Thanks. STUNNEL CONFIG FILE: debug = 7 output = stunnel.log sslVersion = all options = NO_SSLv2 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM [ice_client] client = yes accept = 127.0.0.1:8080 connect = 63.nnn.nnn.207:443 checkHost = *.xxxxx.com CAfile = ca-certs.pem ; CAPath = certs verifyChain = yes -- Greg Sanders Database Architect Yes Energy

1 0

Stunnel and CAPI engine: Issues after OpenSSL upgrade on server side
by Christian Keck 07 Dec '20

07 Dec '20

Hi there, we just upgraded a system that is used as a TLS-proxy for incoming connections using client-ssl-handshake from an old CentOS 6 to a recent Ubuntu LTS. By doing so, the OpenSSL was updated from 1.0.1e to 1.1.1f. Right after installation, the new OpenSSL complained about "too weak ca cypher", so I had to add a line "CipherString = DEFAULT:@SECLEVEL=1" to the openssl.conf to make things work again. After applying the changes, connections via browsers do work again using TLS 1.3. (We will generate a new host-CA some day, but for now we need a running system) Before the upgrade, Stunnel in CAPI-mode worked wih TLS 1.2 encryption. Now after updating the server, it refused to connect at all. Using version 5.56 of Stunnel, I see the following lines in the log: error queue: ssl/statem/statem_lib.c:298: error:141F0006:SSL routines:tls_construct_cert_verify:EVP lib SSL_connect: engines/e_capi.c:814: error:8006F074:lib(128):capi_rsa_priv_enc:function not supported If I nail the protocol setting to TLS1.1 in the apache2-config, the connection is possible again with version 5.56. Any later versions of Stunnel completely refuse to work, I always get lines like: SSL_read: ssl/ssl_rsa.c:36: error:140C618E:SSL routines:SSL_use_certificate:ca md too weak I tried several things I found in the net regarding tweaking openssl.conf and/or stunnel.conf, but I can't get it running with version 5.57 or later. So my questions is: What can I do to get Stunnel working again with at least TLS1.2 (or even better TLS1.3 like I get in most browsers)? Re-generating the host-CA (and thus needing to re-create all client certs) is unfortunately no option for the moment. Many thanks in advance! Cheers, Christian Keck

3 4

Failed to initialize TLS
by Campbell, David 20 Nov '20

20 Nov '20

TLS is not initializing. This is the output. Is there something that I should be including in my conf that would produce this? Or is it just a generic error? [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [ ] stunnel 5.57 on x64-pc-mingw32-gnu platform [ ] Compiled/running with OpenSSL 1.1.1h 22 Sep 2020 [ ] Threading WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ . ] Reading configuration from file stunnel.conf [ . ] UTF-8 byte order mark not detected [ ! ] No compression method is available [ ! ] Global options: Failed to initialize TLS [ ! ] Configuration failed [ ] Deallocating temporary section defaults [ ! ] Server is down ________________________________ CONFIDENTIALITY NOTICE: This email constitutes an electronic communication within the meaning of the Electronic Communications Privacy Act, 18 U.S.C. 2510, and its disclosure is strictly limited to the named recipient(s) intended by the sender of this message. This email, and any attachments, may contain confidential and/or proprietary information of Scientific Research Corporation. If you are not a named recipient, any copying, using, disclosing or distributing to others the information in this email and attachments is STRICTLY PROHIBITED. If you have received this email in error, please notify the sender immediately and permanently delete the email, any attachments, and all copies thereof from any drives or storage media and destroy any printouts or hard copies of the email and attachments. EXPORT COMPLIANCE NOTICE: This email and any attachments may contain technical data subject to U.S export restrictions under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR). Export or transfer of this technical data and/or related information to any foreign person(s) or entity(ies), either within the U.S. or outside of the U.S., may require advance export authorization by the appropriate U.S. Government agency prior to export or transfer. In addition, technical data may not be exported or transferred to certain countries or specified designated nationals identified by U.S. embargo controls without prior export authorization. By accepting this email and any attachments, all recipients confirm that they understand and will comply with all applicable ITAR, EAR and embargo compliance requirements.

1 0

PSK Configuration
by Giulio Regazzo 16 Nov '20

16 Nov '20

Hi, I'm new to stunnel. And I'm trying to configure a server that accepts TCP sockets connections only from clients that have a pre-shared certificate. Looking at the online documentation I found the verifyPeer option, but it is described to be used on client side. Trying to use it on server side I achieved my goal but only if the client has the whole certificate (private + public). My question is: Can I obtain in some way the same result sharing only the public part of the certificate? Currently I'm using a configuration like this one (skipping the accept and connect options): [Server] cert=wholeCert.pem verifyPeer=yes [Client] cert=wholeCert.pem verifyPeer=yes CAFile=wholeCert.pem and I'm looking for something like: [Server] cert=wholeCert.pem verifyPeer=yes [Client] verifyPeer=yes CAFile=publicCert.pem If I try this second option the server refuses the connection in handshake phase saying that the client didn't provide any certificate. Is there a way to achieve this? Thank you.

2 3

hi
by fieldengineer59＠yahoo.com 04 Nov '20

04 Nov '20

hi

1 0

hi
by fieldengineer59＠yahoo.com 04 Nov '20

04 Nov '20

hi

1 0

hi
by fieldengineer59＠yahoo.com 04 Nov '20

04 Nov '20

hi

1 0

hi
by fieldengineer59＠yahoo.com 04 Nov '20

04 Nov '20

hi

1 0

Stunnel failover
by Ray 02 Nov '20

02 Nov '20

Has anyone tested this scenario with a number of stunnel clients and servers chained in a row with failover capability. The problem is that Stunnel in server mode accepts a connection and performs the SSL handshake before it checks if the connect endpoint is reachable. This causes the downlink client peer wrongly assumes that the link is up and therefore would not try the alternative failover endpoint. You will only observe this problem if you cascade several nodes in a row Ex: Dummy TCP Client <-> Stunnel1 (client) <-> Stunnel2 (server) <-> Stunnel3 (client) <-> Dummy SSL Server In this scenario, dummy client connects to S1, S1 connects to S2 (SSL), S2 tries to connect to S3 but since Dummy SSL server is down, S3 rejects but this rejection is not bouncing back to Dummy Client because S2 has down the downlink handshake and therefore S1 assumes everything is OK. So, the ultimate question is how can we tell Stunnel to first try to connect to endpoints and then send a SYN-ACK back to downlink TCP connection request. This way, a client sends a SYN to Stunnel, Stunnel holds on 3-way handshake, tries to connect to the uplink and completes the downlink handshake only if the uplink connection is OK.

1 0

Stunnel - SSL socket error Connection timed out
by sravan kumar 22 Oct '20

22 Oct '20

Hi Team, Need help on one issue. We recently configured stunnel on our servers for securely establishing DB connections[certs exchanged on stunnel client and server]. Stunnel installed on client machine. Stunnel installed on server machine. Configurations are completed and publishing working for sometime like 1 hr. After that the stunnel on the destination server did not respond and we noticed "SSL socket error: Connection timed out (110)". We made updates to the stunnel.conf with below entries but they are not updating. TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 Any help would be greatly appreciated. Regards, Sravan

1 0

5.57 cb_new_auth
by duncan.morris＠cdl.co.uk 20 Oct '20

20 Oct '20

When compiling 5.57 against OpenSSL 1.0.2 I am getting compiler warnings for the cb_new_auth definition. ENGD20 is running V8.4 [840] on ALPHA Building with OpenSSL 1.0.2 Image : STUNNEL.HPE_ALPHA_EXE "session authenticated", cb_new_auth, NULL, NULL); .................................^ %CC-W-PTRMISMATCH, In this statement, the referenced type of the pointer value "cb_new_auth" is "function (pointer to void, pointer to void, pointer to struct crypto_ex_data_st, int, long, pointer to void) returning void", which is not compatible with "function (pointer to void, pointer to void, pointer to struct crypto_ex_data_st, int, long, pointer to void) returning int" . at line number 80 in file DISK$ORACLE:[STUNNEL_BUILDS.stunnel-557.src]ssl.c;1 This appears to be the result of OpenSSL 1.0.2 defining this as an integer function, whilst 1.1.1 defines it as a void function. Duncan

1 0

Changelog policy / watch out for 5.57 if you have 1024-bit keys in use
by ian.bamforth＠tracsis.com 20 Oct '20

20 Oct '20

Morning, [ ] Loading certificate from file: /opt/clients/certificate_2020-04-23.pem [!] SSL_CTX_use_certificate_chain_file: ssl/ssl_rsa.c:301: error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small [!] Service [RailCompanion]: Failed to initialize TLS context [!] Configuration failed We encountered a production outage yesterday when upgrading to 5.57, as it seems that a new securityLevel config has been added, a side-effect of which looks to have been the rejection of certificates of less than 2048 bits by default. We still had a 1024 bit cert in use. Obviously we should've had monitoring to check that stunnel was actually running (we will next time!) but it seems to me like this is a change that deserved more attention in the log, which only identifies it as a new feature, with no mention of breaking changes. Anyway, our problem is now solved, but if you encounter stunnel failing to start when you next upgrade then this might be a candidate to look at. Ian

1 0

Can't Connect To Gmail
by lrogersjunk＠gmail.com 17 Oct '20

17 Oct '20

Hello all - I have tried to set up stunnel to send emails through gmail from a legacy device that can only send to port 25. But I'm having no success. My config file seems correct, as it matches config files posted by others who appear able to send through gmail. This is what it looks like: output = stunnel-log.txt debug = 7 Taskbar = yes [gmail-imap] client = yes accept = 143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes I originally thought the problem was gmail's recent new security features, requiring app-passwords for apps that do not support gmail's latest security features. So I set up an app-password for use by stunnel but that didn't work, either. So I then turned on "allow less secure apps" in gmail and used the account's original password (not the app-password). But even that doesn't work. So I'm at a total loss and can't think of anything else to do. Can anyone assist? Many thanks.

4 3

Stunnel & Gmail security
by BOXI31 TEST 16 Oct '20

16 Oct '20

Hi all, To make "Stunnel 5.31" work with Gmail, I have to go in security settings of Gmail and "allow less secure apps to access my account". Is it mandatory ? Is it possible to set Stunnel to access Gmail without lowering it security level ? How ? I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider it as a "less secure app." ! Regards, Steve

2 1

clarification on Security BugFix released in version 5.57
by svitatissimo2004＠hotmail.com 15 Oct '20

15 Oct '20

looking the changelog of latest version of stunnle (version 5.57) I see the following statement: "The "redirect" option was fixed to properly handle "verifyChain = yes" (thx to Rob Hoes)." It is possible to have more information on the vulnerability fixed?

1 0

clarification on Security BugFix released in version 5.57
by svitatissimo2004＠hotmail.com 15 Oct '20

15 Oct '20

looking the changelog of latest version of stunnle (version 5.57) I see the following statement: "The "redirect" option was fixed to properly handle "verifyChain = yes" (thx to Rob Hoes)." It is possible to have more information on the vulnerability fixed?

1 0

CERT: Pre-verification error: unsupported certificate purpose
by Bob Bob 12 Oct '20

12 Oct '20

Hi, I just updated to version 5.57 and the config I used for ever does not work anymore. I regenerated the self certs using the "Build a Self-signed stunnel.pem" in Windows and made sure the CN was matching the hostname of the server machine. I understand there is an issue with the self signed certificate... ...but it was working fine under 5.56. Server configuration [Server_SyncThing] cert = stunnel.pem accept = 999 connect = 127.0.0.1:24596 ciphers = PSK PSKsecrets = psk.txt Client configuration [SyncThing] client = yes accept = 127.0.0.1:24596 connect = 192.168.0.102:999 verifyPeer = yes CAfile = stunnel.pem PSKsecrets = psk.txt Service [SyncThing] connected remote server from 192.168.1.44:5455 2020.10.12 14:25:06 LOG7[33]: Setting remote socket options (FD=1516) 2020.10.12 14:25:06 LOG7[33]: Option TCP_NODELAY set on remote socket 2020.10.12 14:25:06 LOG7[33]: Remote descriptor (FD=1516) initialized 2020.10.12 14:25:06 LOG6[33]: SNI: sending servername: 192.168.0.102 2020.10.12 14:25:06 LOG6[33]: Peer certificate required 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): before SSL initialization 2020.10.12 14:25:06 LOG7[33]: Initializing application specific data for session authenticated 2020.10.12 14:25:06 LOG6[33]: PSK client configured for identity "user1" 2020.10.12 14:25:06 LOG7[33]: Initializing application specific data for session authenticated 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): SSLv3/TLS write client hello 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): SSLv3/TLS write client hello 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): SSLv3/TLS read server hello 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): TLSv1.3 read encrypted extensions 2020.10.12 14:25:06 LOG7[33]: Verification started at depth=0: C=FR, ST=Centre, L=Marseilles, O=CA, OU=CA, CN= TRUCK-D98J8TY 2020.10.12 14:25:06 LOG4[33]: CERT: Pre-verification error: unsupported certificate purpose 2020.10.12 14:25:06 LOG4[33]: Rejected by CERT at depth=0: C=FR, ST=Centre, L=Marseilles, O=CA, OU=CA, CN= TRUCK-D98J8TY 2020.10.12 14:25:06 LOG7[33]: TLS alert (write): fatal: unsupported certificate 2020.10.12 14:25:06 LOG3[33]: SSL_connect: ssl/statem/statem_clnt.c:1913: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed 2020.10.12 14:25:06 LOG5[33]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.10.12 14:25:06 LOG7[33]: Deallocating application specific data for session connect address 2020.10.12 14:25:06 LOG7[33]: Deallocating application specific data for session connect address 2020.10.12 14:25:06 LOG7[33]: Remote descriptor (FD=1516) closed Any help would be welcome. Thanks.

2 1

Stunnel inetd Linux configuration
by Marco Marchi 30 Sep '20

30 Sep '20

Good morning, I'm trying to configure Stunnel on Linux (Slackware 14). Can anybody post an example of configuration file in order to run and manage Stunnel by means of inetd, keeping in mind that goal is to secure pop3 and imap? Openssl is already installed and running (version 1.1.1g, april 2020). Stunnel version downloaded and installed is 5.56. Certifcate has been generated by means of Openssl. Issues are related to the right syntax in stunnel.conf. Thank you in advance. Marco

1 0

sslVersion
by Ray 25 Sep '20

25 Sep '20

Hi Is sslVersion a global parameter that belongs to all segments or can it be inside a segment to only affect that segment? Example: output = /tmp/stunnel.log debug = emerg sslVersion = all # I assume it is applied to all Stunnel connection definitions [Stunnel_1] sslVersion = tls1_2 # How about this? I only want Stunnel_1 to be affected with sslVersion tls1_2 option. client = yes accept = 2222 connect = some_domain.com.au:8449 verify = 2 CAfile = /etc/stunnel/certs/root_digicert_ca.crt Thanks Ray

1 0

Address already in use (98) error trying to run stunnel client in Ubuntu Docker container
by greg＠yesenergy.com 24 Sep '20

24 Sep '20

Hello all, I'm getting the following error when I try to connect to a remote server from inside a running Docker container: "Binding service [client] to 127.0.0.1:1589: Address already in use (98)". I don't think this port is actually in use, and I've tried other ports with the same results. I know that this configuration works in my Windows dev machine, from which I have consistently connected to the remote server, no problem. I suspect this might be related to Docker's internal networking schema and port-forwarding, but I thought I would ask this group if anyone knows how to overcome this hurdle. Thanks for listening! Here is the config: [client] client = yes accept = 127.0.0.1:1589 connect = nn.nnn.nnn.nnn:443 checkHost = xxxxxxxxx.com sslVersion = TLSv1.2 CAfile = /usr/local/etc/stunnel/my_pemfile.pem verifyPeer = yes Here is the log trace: [ ] Clients allowed=512000 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled/running with OpenSSL 1.1.1d 10 Sep 2019 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /usr/local/etc/stunnel/stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [client] [ ] Ciphers: DES-CBC3-SHA:IDEA-CBC-MD5-DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA [ ] TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 [ ] TLS options: 0x02100004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [.] Configuration successful [ ] Binding service [client] [ ] Listening file descriptor created (FD=8) [ ] Setting accept socket options (FD=8) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [client] to 127.0.0.1:1589: Address already in use (98) [ ] Listening file descriptor created (FD=8) [ ] Setting accept socket options (FD=8) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [client] to 127.0.0.1:1589: Address already in use (98) [!] Binding service [client] failed [ ] Deallocating section defaults [ ] Unbinding service [client] [ ] Service [client] closed [ ] Deallocating section [client]

1 0

Stunnel to smtp-relay.gmail.com
by Anton Palmgård 22 Sep '20

22 Sep '20

Hi, a few days ago up to a week my stunnel connection to smtp-gmail.gmail.com. stopped working with the error: ep 21 17:25:57 stunnel LOG50: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Sep 21 17:25:57 stunnel LOG30: Remote server is not RFC 1425 compliant Sep 21 17:25:57 stunnel LOG50: Service [to_gmail] connected remote server from xxx.xxx.xxx.xxx:29662 Tried from 2 different Locations / sites (i.e companies) same error. The relay work fine without client settings but that leaves TLS to the endpoint.. Office 365 relay works fine with TLS. Contacted Google support but the claimed nothing have been changed. I assume somehting with the TLS version/ CIPHERS is wrong ? Conf simply looks like this: cert = /usr/local/etc/stunnel/stunnel.pem chroot = /var/tmp/stunnel setuid = stunnel setgid = stunnel [to_gmail] client = yes accept = 0.0.0.0:587 connect = smtp-relay.gmail.com:587 debug = 7 TIMEOUTclose = 0 protocol = smtp BR, Anton.

2 4

Stunnel failover
by Ray 16 Sep '20

16 Sep '20

Stunnel's failover option with prio settings works fine but the application first tries 3 syn to connect to the first endpoint and if failed then it tries the second endpoint. Is there any way to configure stunnel to try only once and failover to the second connection endpoint?

1 0

using Android Keystore with stunnel
by blacksun＠directbox.com 09 Sep '20

09 Sep '20

Hello, i am using stunnel 5.56 on Android 7.0. It is a non-rooted device. Android stores keys and certs in the android keystore. I am using a Let's Encrypt Cert on serverside, and on clients the options veryChain and chechHost. How can i use the System-integrated CA-Certs of Android for verifying the server-cert issued by Let's Encrypt? When i am searching the net, there are infos saying that the certs and keys are not accessible by filestructure, but there would be apis to access the keystore. The keystore would be protected with the PIN of the device. Thanks.

1 0

How to configure stunnel as HTTP proxy on Windows?
by Jason Long 08 Sep '20

08 Sep '20

Hello, I want to use stunnel on Windows as HTTP proxy, I changed the configuration as below: ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store [example-proxy] client = yes accept = 127.0.0.1:8080 connect = google.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token [example-pkcs11] client = yes accept = 127.0.0.1:8080 connect = google.com:8443 ;engineId = pkcs11 cert = pkcs11:token=MyToken;object=MyCert key = pkcs11:token=MyToken;object=MyKey But, it show me configuration error. How can I solve it? Thank you.

1 0

Stunnel - how to block IPs?
by Brent Kimberley 04 Sep '20

04 Sep '20

Hi James.To the best of my knowledge, your options include Darwin firewall and HAProxy - geoip. >>Just wondering if there is a way to have Stunnel not accept connection from certain IPs? stunnel -version stunnel 5.56 on x86_64-apple-darwin18.7.0 platform Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI

1 0

Stunnel - how to block IPs?
by James Brown 03 Sep '20

03 Sep '20

Just wondering if there is a way to have Stunnel not accept connection from certain IPs? stunnel -version stunnel 5.56 on x86_64-apple-darwin18.7.0 platform Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Thanks, James.

1 0

TLS1.0 fallback when only TLS1.2 allowed
by Wojciech Machula 31 Aug '20

31 Aug '20

So I've configured my stunnel to only use TLS1.2 and usually works ok. However when client gets some bad L7 response it send a TCP RST, after which all subsequent stunnel TLS Client Hellos are some hybrid of TLS1.0/TLS1.2, as can be seen in tshark output below. Once I restart the whole stunnel process subsequent TLS handshakes work fine using TLS1.2, until the next client RST is received. $ stunnel -version stunnel 4.56 on x86_64-redhat-linux-gnu platform $ cat /etc/centos-release CentOS Linux release 7.8.2003 (Core) $cat /etc/stunnel/dsr2rtcg-stunnel.conf output = /var/log/stunnel pid = /etc/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [poc] cert = /etc/pki/tls/certs/stunnel/aaa.crt key = /etc/pki/tls/private/stunnel/aaa.key CAfile = /etc/pki/tls/certs/stunnel/bbb.crt client = yes sslVersion = TLSv1.2 options = NO_TLSv1 accept = 172.18.180.78:45154 connect = 10.74.0.196:45154 ciphers = TLSv1.2+HIGH:!aNULL $ tshark -nn -V -d tcp.port==45154,ssl -r 20200729_09:42:44-port45154.pcap -2R "ssl.handshake" -c 1 | grep -i tls -B3 Secure Sockets Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) -- Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 1610 Version: TLS 1.2 (0x0303)

6 14

Sslkeylog
by Brent Kimberley 22 Aug '20

22 Aug '20

>>Any suggestions on sslkeylog via stunnel application Call SSL_CTX_set_keylog_callback() !? On Thu, Aug 13, 2020, 16:44 tayyib ahmed <tayyib76(a)gmail.com> wrote: > Hi Guys > > Is there any option to set sslkeylog to get ssl session id for stunnel > session? > > Br xx >

2 2

How to archive DNS load balance in stunnel client?
by Peter Zhao 22 Aug '20

22 Aug '20

Hi, We are trying to use DNS load balance in a stunnel client with round-robin algorithm. service.example.com is mapping to two ips. But when we update DNS to remove one of ips for service.example.com stunnel client still forward requests to both ips. How to make stunnel client to resolve domain name and refresh its cache? Here is stunnel configuration. sslVersion=TLSv1.2 cert = /etc/stunnel/stunnel.pem output=/var/log/stunnel.log [service-client] client = yes accept = localhost:4680 connect = service.example.com:4680 [service-server] client = no accept = 10.10.0.16:4680 connect = loclhost:80 Here is the resolving result for service.example.com. ;; ANSWER SECTION: service.example.com. 5 IN A 10.10.0.16 service.example.com. 5 IN A 10.10.0.8

3 3

Sslkeylog
by tayyib ahmed 16 Aug '20

16 Aug '20

Hi Guys Is there any option to set sslkeylog to get ssl session id for stunnel session? Br xx

1 1

Stunnel 5.56 Windows 10 Service - Not functioning after Reboot
by Rod Marr 16 Aug '20

16 Aug '20

Hi all, I have installed Stunnel 5.56 win64 on a fully updated Windows 10 machine to work with Blue Iris. Stunnel operates well when I manually start it however I cannot get it to work automatically after a reboot. I have run the run the “stunnel Service Install” and “stunnel Service Start” shortcuts supplied, and in the first instance the service installs and starts. I can then connect through Stunnel to my Blue Iris server. I have found that after I reboot, the Stunnel service appears to start automatically but it is not functional. I cannot connect through it to Blue Iris. Stunnel is visible and Running in the Windows 10 Services list (from services.msc) and the Windows Task Manager shows a Process and Service active. To rectify this I can manually issue the “stunnel Service Stop”, followed by the “stunnel Service Start” shortcuts and the service becomes functional again. I have tried turning on debug info and the stunnel log file in stunnel.conf and see that log entries only begin after I have done the stop/start manual process. Thanks for any insight to what I’m sure I am missing here. Rod Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10

2 2

Sslkeylog
by Brent Kimberley 14 Aug '20

14 Aug '20

No sign of SSL_CTX_set_keylog_callback()... Date: Thu, 13 Aug 2020 16:44:22 +0100 From: tayyib ahmed <tayyib76(a)gmail.com> To: stunnel-users(a)stunnel.org Subject:Hi Guys Is there any option to set sslkeylog to get ssl session id for stunnel session? Br xx

1 0

Timeout issues
by gorf＠hyperfunk.club 05 Aug '20

05 Aug '20

Hi, I'm using stunnel v5.56 on FreeBSD to proxy connections to a web server (running Apache), for a small number of users. Users connecting to the service keep running into issues with timeouts. I see timeout errors in the stunnel log messages: services stunnel[7510]: LOG3[188]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing I tried changing stunnel to use the proxy protocol and enabled it on Apache, too. I don't know if that will help but at least then the web server gets the correct, remote IP address. Can anyone offer ideas/suggestions to fix this problem? Is there anything I can test or check to help diagnose the issue? The configuration is very basic: [apache] accept = 20888 protocol = proxy connect = 192.168.0.10:8000 PSKsecrets = /usr/local/etc/psksecrets.txt

1 0

Getting incoming Exchange online (Office 365) emails to go to port 110 and not 995
by Brent Kimberley 23 Jul '20

23 Jul '20

Office365 IMAP4S + POP3S is dropping legacy authentication in favour of OAUTH2.0 authentication -- effective October 2020. (Some may have longer.) How do you you plan to migrate to authentication? Do you plan to upgrade your client(s) or inject an OAUTH2.0 transparent proxy ? ---------------------------------------------------------------------- Message: 1 Date: Thu, 23 Jul 2020 01:22:06 +0000 From: Mel Gilbert <m.gilbert(a)baymedicalgroup.com.au> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Getting incoming Exchange online (Office 365) emails to go to port 110 and not 995 Message-ID: <SY4P282MB074766F32238B92A3D951499C1760(a)SY4P282MB0747.AUSP282.PROD.OUTLOOK.COM> Content-Type: text/plain; charset="us-ascii" Hi Trying to get an application with inbuilt email to receive emails using POP and port 110. However we use Office 365 and I have tried below config but it is not working. I want people to send email to an Exchange Online Account port 995 and it gets forwarded on to the email app on port 110 client = yes output = stunnel-log.txt debug=7 taskbar=yes [POP3 Incoming] accept = 110 connect = Outlook.office365.com:995 cert = stunnel.pem [SMTP Outgoing] protocol = smtp accept = 25 connect = smtp.office365.com:587 cert = stunnel.pem The outgoing email works fine using SMTP relay that I've set up on Office 365 but cant get the incoming emails to work. Any help would be appreciated Thanks Mel

1 0

Re: [stunnel-users] Getting incoming Exchange online (Office 365) emails to go to port 110 and not 995
by Mel Gilbert 23 Jul '20

23 Jul '20

Hi Trying to get an application with inbuilt email to receive emails using POP and port 110. However we use Office 365 and I have tried below config but it is not working. I want people to send email to an Exchange Online Account port 995 and it gets forwarded on to the email app on port 110 client = yes output = stunnel-log.txt debug=7 taskbar=yes [POP3 Incoming] accept = 110 connect = Outlook.office365.com:995 cert = stunnel.pem [SMTP Outgoing] protocol = smtp accept = 25 connect = smtp.office365.com:587 cert = stunnel.pem The outgoing email works fine using SMTP relay that I've set up on Office 365 but cant get the incoming emails to work. Any help would be appreciated Thanks Mel

1 0

Transparent Proxy help.
by Steven Relf 21 Jul '20

21 Jul '20

Hello List, I am working on a small project where I need to encrypt nfs traffic, and Stunnel looks to be ideal, the only issue I'm having is getting the transparent part to work I have a client machine, running stunnel config below #GLOBAL####################################################### sslVersion = TLSv1.2 TIMEOUTidle = 600 renegotiation = no FIPS = no options = NO_SSLv2 options = NO_SSLv3 options = SINGLE_DH_USE options = SINGLE_ECDH_USE options = CIPHER_SERVER_PREFERENCE syslog = yes debug = 7 ;chroot = /var/empty/stunnel libwrap = yes service = 3d-nfsd curve = secp521r1 #CREDENTIALS################################################## verify = 4 CAfile = /etc/stunnel/nfs-tls.pem cert = /etc/stunnel/nfs-tls.pem #ROLE######################################################### client = yes connect = fqdn:2363 and the client which is running ontop of the nfs-ganesha server config below #GLOBAL####################################################### TIMEOUTidle = 600 renegotiation = no FIPS = no options = NO_SSLv2 options = NO_SSLv3 options = SINGLE_DH_USE options = SINGLE_ECDH_USE options = CIPHER_SERVER_PREFERENCE syslog = yes debug = 7 setuid = nobody setgid = nobody chroot = /var/empty/stunnel libwrap = yes service = MC-nfsd ; cd /var/empty; mkdir -p stunnel/etc; cd stunnel/etc; ; echo 'MC-nfsd: ALL EXCEPT 5.6.7.8' >> hosts.deny; ; chcon -t stunnel_etc_t hosts.deny curve = secp521r1 #CREDENTIALS################################################## verify = 4 CAfile = /etc/stunnel/nfs-tls.pem cert = /etc/stunnel/nfs-tls.pem #ROLE######################################################### connect = 127.0.0.1:2049 I have had a look through the documentation and I believe I need to set transparent = source on the client side, and then set some ip tables firewall rules. Does anyone have a guide, or some advice on how to get this to work. Generally what happens if I set the firewall rules, on the client, and set the transparent to source I just get connection closed by remote host. I never actually see the traffic leave the client host. To confirm, when not using transparent everything works correctly, accept the server side sees the connection coming from 127.0.0.1 Thanks Rgds Steve. The future has already arrived. It's just not evenly distributed yet - William Gibson Steven Relf - Technical Authority: Cloud Native Infrastructure srelf(a)ukcloud.com +44 1252 936019 / +44 7500 085 864 www.ukcloud.com A8, Cody Technology Park, Ively Road, Farnborough, GU14 0LX Notice: This message contains information that may be privileged or confidential and is the property of UKCloud Ltd. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorised to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message. UKCloud reserves the right to monitor all e-mail communications through its networks. UKCloud Ltd is registered in England and Wales: Company No: 07619797. Registered office: Hartham Park, Hartham, Corsham, Wiltshire SN13 0RP.

1 0

Used Multi Service
by Ramin Malekgahsemi 09 Jul '20

09 Jul '20

Hi Dear Friends I used Stunnel 5.49 32 bit For server This Config cert = C:\Program Files\stunnel\config\stunnel.pem fips = no [socks] accept = 443 connect = 1010 If define New Service For example cert = C:\Program Files\stunnel\config\stunnel.pem fips = no [s1] accept = 443 connect = 1010 [s2] accept = 445 connect = 1020 Service Not work How Solve This Problem THX

1 0

Re: [stunnel-users] winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D)
by flash＠vicsmba.com 29 Jun '20

29 Jun '20

It will never be entirely random. Some range more than likely. You may be able to restrict the range. You could certainly set stunnel up for each “random” port. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Brent Kimberley Sent: Friday, June 26, 2020 4:11 PM To: Thomas Ward <teward(a)thomas-ward.net>; stunnel-users(a)stunnel.org; Coviello, Paul <pcoviello(a)ccsusa.com> Subject: Re: [stunnel-users] winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D) What are you trying to accomplish? I.e. Is TLS the best wrapper for the job? (i.e. TCP over TCP.) On Thursday, June 25, 2020, 11:44:38 a.m. EDT, Coviello, Paul <pcoviello(a)ccsusa.com <mailto:pcoviello@ccsusa.com> > wrote: Maybe, I also just found out that the port it goes out is not what I thought it was. It’s a random port. Not sure if it’s doable now. Thanks for your help

1 0

winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D)
by Brent Kimberley 26 Jun '20

26 Jun '20

Hi Paul. With respect to your winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D), did you open the port in your firewall and authorize communication via anti-virus? > Hi I have a windows 10 machine that I?ve got this running on, and the > screen shot below is what I keep getting and I am unable to find the issue, > > Can someone please shed some light as to what is wrong? And what else you may need.

3 4

server is down message
by Coviello, Paul 24 Jun '20

24 Jun '20

Hi I have a windows 10 machine that I've got this running on, and the screen shot below is what I keep getting and I am unable to find the issue, Can someone please shed some light as to what is wrong? And what else you may need. Thanks Paul [cid:image001.png@01D6495F.3B2D17A0]

3 4

Fwd: Update Stunnel 5.44 - Ubuntu 18.04
by Juan Amores 19 Jun '20

19 Jun '20

---------- Forwarded message --------- De: Juan Amores <canalamores(a)gmail.com> Date: jue., 18 jun. 2020 a las 20:03 Subject: *Update Stunnel 5.44 - Ubuntu 18.04* I installed Stunnel4 via apt-get install command. The version you installed for me is old (5.44), I have tried updating it via apt-get update but there are no updated packages in Ubuntu 18.04. Is there a way to update it and keep it working as a service like before? Attached screenshot with linux, stunnel and openssl versions. Any other additional data you need to provide just ask me. [image: stunnel.png] Greetings, Juan Amores

2 2

Fw: How to configure STunnel so that new log file is automatically created after a certain threshold
by Muhammad Muneeb Hashmi 17 Jun '20

17 Jun '20

Hi STunnel Team, Is there a way where a new STunnel log file is automatically generated when the current log file reaches a certain threshold in Windows. Any help will be highly appreciated. Regards,Muneeb

1 0

CAPI_GET_KEY:cryptacquirecontext error
by Michael S. Chusovitin 04 Jun '20

04 Jun '20

Dear stunnel users, whereas Stunnel itself looks fine for me, it seems to have some troubles with CAPI engine. The one I cannot manage still is *"CAPI_GET_KEY:cryptacquirecontext error"* logged when attempting to export the client's key. I tried to add *"engineCtrl = csp_name:Microsoft Enhanced RSA and AES Cryptographic Provider"* to stunnel.conf, and then *"CAPI_**CTX_SET_PROVNAME:**cryptacquirecontext error"* was logged instead of the above one. The same certificate is used happily with no-capi configuration. I suppose the problem is somehow related to sha256 signature in the certificate. Are there any chances to workaround? Stunnel version is 5.48 with OpenSSL 1.0.2o-fips. (in this very case I need to use 32bit version, so no possibility to upgrade). Thanks!

2 5

Re: [stunnel-users] Need help connecting Eudora to mail servers
by Phil Smith III 28 May '20

28 May '20

I'm still tinkering here, trying to get Yahoo+stunnel working to help out Joe Slaven. I still can't get it to work. Yahoo userid is y_phsiii. I manually logged into Yahoo and verified that I have the right password. The config section: -- [Yahoo] client = yes accept = localhost:1234 connect = pop.mail.yahoo.com:995 sslVersion = TLSv1.2 -- Eudora has -- POPPort=1234 -- for that personality. Log: -- 2020.05.27 11:36:48 LOG5[29]: Service [Yahoo] accepted connection from 127.0.0.1:50287 2020.05.27 11:36:48 LOG6[29]: failover: priority, starting at entry #0 2020.05.27 11:36:48 LOG6[29]: s_connect: connecting 98.137.157.46:995 2020.05.27 11:36:48 LOG5[29]: s_connect: connected 98.137.157.46:995 2020.05.27 11:36:48 LOG5[29]: Service [Yahoo] connected remote server from 192.168.1.4:50288 2020.05.27 11:36:48 LOG6[29]: SNI: sending servername: pop.mail.yahoo.com 2020.05.27 11:36:48 LOG6[29]: Peer certificate not required 2020.05.27 11:36:48 LOG6[29]: Certificate verification disabled 2020.05.27 11:36:48 LOG6[29]: Certificate verification disabled 2020.05.27 11:36:48 LOG6[29]: Client certificate not requested 2020.05.27 11:36:48 LOG6[29]: Session id: F26CEF81143B96B8BD0D2C504CBB534082242BF337D3D29DE911CD5AC05B6DE0 2020.05.27 11:36:48 LOG6[29]: TLS connected: new session negotiated 2020.05.27 11:36:48 LOG6[29]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2020.05.27 11:37:48 LOG6[29]: TLS socket closed (SSL_read) 2020.05.27 11:37:48 LOG5[29]: Connection closed: 38 byte(s) sent to TLS, 130 byte(s) sent to socket -- Eudora error (Personality is named just "y" since it's just a test): -- y, Logging into POP Server, PASS [11:33:29 AM] There has been an error transferring your mail. I said: PASS <shhhh! Don't tell anyone.> and then the POP server (y_phsiii(a)127.0.0.1) said: ERR [SYS/TEMP] Server error - Please try again later. --

3 3

blackhole problem - please help to tune stunnel
by Michael S. Chusovitin 28 May '20

28 May '20

Dear stunnel users, please advise how to solve the following: - an Application connects to stunnel-client (installed at the same machine); - stunnel-client tries to connect to stunnel-server (remote), fails and sends RST to the App; - but the App has already sent some datagrams to stunnel-client during TIMEOUTconnect period and they aren't transferred to stunnel-server. Is there any way to make stunnel-client delay its ACK to the App until the connection to stunnel-server is established? Thanks!

1 0

Need help connecting Eudora to mail servers
by Joe Slaven 26 May '20

26 May '20

Below are the contents of my config file: Question 1. Is the output statement correct? I cannot find the log file. I expected it to be in the stunnel folder in the Program (x86) folders Question 2. Is it permissable to install code for all three email servers, using the same ports and settings in Eudora? Question 3. All three have error messages in Eudora ie none of them work via stunnel. Can anyone please show me where I am going wrong? I have listed the error message for Gmail below. There is no log file that I can find. Bigpond error message: There has been an error transferring your mail POP server [JoeS4814(a)127.0.0.1 ] said ERR[AUTH] Username and Password not accepted thanks for helping out, Joe ;*************************************************************** ; STUNNEL LOG output = stunnel.log ; ;***************************************************************** ;******************************************************* ;Yahoo connection ;******************************************************* [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes ; ;******************************************************* ;Bigpond connection ;***************************************************** [bigpond-pop3] client = yes accept = 127.0.0.1:110 connect = pop.bigpond.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.bigpond.com OCSPaia = yes [bigpond-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.bigpond.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.bigpond.com OCSPaia = yes ;************************************* ;Gmail connection ;******************************************** [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes

3 7

[PATCH] Use libcap to keep CAP_NET_RAW so that IP_TRANSPARENT works after setuid
by Simon Arlott 26 May '20

26 May '20

Use libcap to keep CAP_NET_RAW so that IP_TRANSPARENT works after setuid I'd like to be able to use "transparent = source" and "setuid" to drop full root privileges. It is possible to do this by keeping either the CAP_NET_ADMIN or CAP_NET_RAW capability. This is based on https://github.com/dlundquist/sniproxy/commit/0ab83f8f45f73ba18ea5f84ccccd9… The capability will not be inherited if "exec" is used: Name: stunnel Uid: 996 996 996 996 Gid: 988 988 988 988 ... CapInh: 0000000000000000 CapPrm: 0000000000002000 CapEff: 0000000000002000 --- It would be possible to keep CAP_NET_BIND_SERVICE too, to allow reloading a configuration that binds to ports below 1024. I don't think stunnel should keep this capability unless a service needs it at startup. CREDITS.md | 25 ++++++++++ configure.ac | 33 ++++++++++++++ doc/stunnel.8.in | 2 +- doc/stunnel.html.in | 2 +- doc/stunnel.pod.in | 2 +- src/stunnel.c | 109 ++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 170 insertions(+), 3 deletions(-) diff --git a/CREDITS.md b/CREDITS.md index 6567392..5f12f92 100644 --- a/CREDITS.md +++ b/CREDITS.md @@ -27,6 +27,31 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +libcap usage in version 5.57 (from sniproxy): +Copyright 2017 Dustin Lundquist <dustin(a)null-ptr.net> +Copyright 2020 Simon Arlott + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE HOLDERS OR +CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, +EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR +PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF +LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + Several bugfixes and improvements mostly in versions 3.xx: * Brian Hatch <bri(a)stunnel.org> diff --git a/configure.ac b/configure.ac index 9c2b2b6..f454710 100644 --- a/configure.ac +++ b/configure.ac @@ -352,6 +352,39 @@ AC_ARG_ENABLE(systemd, ] ) +# Disable POSIX capabilities support +AC_MSG_CHECKING([whether to enable POSIX capabilities support]) +AC_ARG_ENABLE(libcap, +[ --disable-libcap disable POSIX capabilities support], + [ + case "$enableval" in + yes) AC_MSG_RESULT([yes]) + AC_SEARCH_LIBS([cap_get_proc], [cap]) + AC_DEFINE([USE_LIBCAP], [1], + [Define to 1 to enable POSIX capabilities]) + ;; + no) AC_MSG_RESULT([no]) + ;; + *) AC_MSG_RESULT([error]) + AC_MSG_ERROR([Bad value \"${enableval}\"]) + ;; + esac + ], + [ + AC_MSG_RESULT([autodetecting]) + AC_SEARCH_LIBS([cap_get_proc], [cap], + [ AC_CHECK_HEADERS([sys/capability.h], [ + AC_DEFINE([USE_LIBCAP], [1], + [Define to 1 to enable POSIX capabilities]) + AC_MSG_NOTICE([libcap support enabled]) + ], [ + AC_MSG_NOTICE([libcap header not found]) + ]) ], [ + AC_MSG_NOTICE([libcap library not found]) + ]) + ] +) + # Disable use of libwrap (TCP wrappers) # it should be the last check! AC_MSG_CHECKING([whether to enable TCP wrappers support]) diff --git a/doc/stunnel.8.in b/doc/stunnel.8.in index b3df016..4b121bc 100644 --- a/doc/stunnel.8.in +++ b/doc/stunnel.8.in @@ -1251,7 +1251,7 @@ setuid .RS 4 .Sp The use of the 'setuid' option will also prevent \fBstunnel\fR from binding to privileged -(<1024) ports during configuration reloading. +(<1024) ports during configuration reloading or enabling of 'transparent = source'. .Sp When the 'chroot' option is used, \fBstunnel\fR will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot diff --git a/doc/stunnel.html.in b/doc/stunnel.html.in index ee9e5d9..95a1b51 100644 --- a/doc/stunnel.html.in +++ b/doc/stunnel.html.in @@ -1506,7 +1506,7 @@ </li> </ul> -The use of the 'setuid' option will also prevent stunnel from binding to privileged (<1024) ports during configuration reloading. +The use of the 'setuid' option will also prevent stunnel from binding to privileged (<1024) ports during configuration reloading or enabling of 'transparent = source'. When the 'chroot' option is used, stunnel will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot jail. diff --git a/doc/stunnel.pod.in b/doc/stunnel.pod.in index e9abd4f..8f14fd9 100644 --- a/doc/stunnel.pod.in +++ b/doc/stunnel.pod.in @@ -1360,7 +1360,7 @@ setuid =back The use of the 'setuid' option will also prevent B<stunnel> from binding to privileged -(<1024) ports during configuration reloading. +(<1024) ports during configuration reloading or enabling of 'transparent = source'. When the 'chroot' option is used, B<stunnel> will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot diff --git a/src/stunnel.c b/src/stunnel.c index 8121e0c..b84ce72 100644 --- a/src/stunnel.c +++ b/src/stunnel.c @@ -58,6 +58,11 @@ #endif /* USE_WIN32 */ +#ifdef USE_LIBCAP +#include <sys/prctl.h> +#include <sys/capability.h> +#endif + /**************************************** prototypes */ #ifdef __INNOTEK_LIBC__ @@ -191,6 +196,59 @@ int drop_privileges(int critical) { #ifdef HAVE_SETGROUPS gid_t gr_list[1]; #endif +#ifdef USE_LIBCAP + SERVICE_OPTIONS *opt; + int need_caps = 0; + cap_t caps; + cap_value_t cap_list[1]; + int keepcaps = 0; +#endif + +#ifdef USE_LIBCAP + for (opt = service_options.next; opt; opt = opt->next) { + if (opt->option.transparent_src) { /* transparent_src is enabled for this service */ + need_caps = 1; + break; + } + } + + /* add permitted flag to capability needed for IP_TRANSPARENT */ + if (CAP_IS_SUPPORTED(CAP_NET_RAW) && need_caps) { + const char *cap_failed = NULL; + + caps = cap_get_proc(); + if (caps != NULL) { + cap_list[0] = CAP_NET_RAW; + if (cap_set_flag(caps, CAP_PERMITTED, 1, cap_list, CAP_SET) == -1) { + cap_failed = "cap_set_flags[before]"; + goto cap_cleanup_before; + } + + if (cap_set_proc(caps) == -1) { + cap_failed = "cap_set_proc[before]"; + goto cap_cleanup_before; + } + + /* keep capabilities after setuid */ + if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) { + cap_failed = "prctl[before]"; + goto cap_cleanup_before; + } else { + keepcaps = 1; + } + +cap_cleanup_before: + cap_free(caps); + if (cap_failed != NULL && critical) { + sockerror(cap_failed); + return 1; + } + } else if (critical) { + sockerror("cap_get_proc[before]"); + return 1; + } + } +#endif /* set uid and gid */ if(service_options.gid) { @@ -212,6 +270,57 @@ int drop_privileges(int critical) { return 1; } } + +#ifdef USE_LIBCAP + /* enable capability needed for IP_TRANSPARENT */ + if (CAP_IS_SUPPORTED(CAP_NET_RAW) && need_caps) { + const char *cap_failed = NULL; + + caps = cap_get_proc(); + if (caps != NULL) { + /* remove every capability from the list */ + cap_clear(caps); + cap_list[0] = CAP_NET_RAW; + + /* take back capability */ + if (cap_set_flag(caps, CAP_PERMITTED, 1, cap_list, CAP_SET) == -1) { + cap_failed = "cap_set_flag[after]"; + goto cap_cleanup_after; + } + + if (cap_set_flag(caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET) == -1) { + cap_failed = "cap_set_flag[after]"; + goto cap_cleanup_after; + } + + if (cap_set_proc(caps) == -1) { + cap_failed = "cap_set_proc[after]"; + goto cap_cleanup_after; + } + /* from now on it the new capability list is active, + * no other capabilities may be enabled */ + +cap_cleanup_after: + cap_free(caps); + if (cap_failed != NULL && critical) { + sockerror(cap_failed); + return 1; + } + } else if (critical) { + sockerror("cap_get_proc[after]"); + return 1; + } + } + + /* disable keeping capabilities across setuid */ + if (keepcaps && prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) == -1) { + if (critical) { + sockerror("prctl"); + return 1; + } + } +#endif + #endif /* standard Unix */ return 0; } -- 2.17.1 -- Simon Arlott

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 190, Issue 13
by Brent Kimberley 24 May '20

24 May '20

Try: * Verifying the openssl version(s) * Verifying the 192.168.1.96:51400 port (nmap, netstat, etc.) * Verifying connection (openssl s_client -connect 192.168.1.96:51400) * Verifying the ciphersuite * Verifying the certificate >>Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second? Not sure. TIMEOUTclose? On Sunday, May 24, 2020, 6:00:07 a.m. EDT, stunnel-users-request(a)stunnel.org <stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. /var/log/syslog is filling up with stunnel errors (digitek) 2. Re: /var/log/syslog is filling up with stunnel errors (Thomas Ward) ---------------------------------------------------------------------- Message: 1 Date: Sat, 23 May 2020 18:17:49 -0500 From: digitek <digitek(a)charter.net> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] /var/log/syslog is filling up with stunnel errors Message-ID: <434e3153-d94c-bb71-fc51-1716db588290(a)charter.net> Content-Type: text/plain; charset=windows-1252; format=flowed Hi, I've been running stunnel for years to shuttle my syslogs off to a syslog server. It's performed flawlessly up until a few weeks ago. Recently, rebooting my syslog server results in the clients filling up /var/log/syslog with messages like below[1]. I'm not certain where the issue is. We've gone through some Ubuntu 16.04 > 18.04 upgrades on some hosts, as well as the syslog server. Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second? My config from a client is here[2] Last time this happened (few weeks ago) I googled around and found the TIMEOUTconnect parameter to try and get stunnel to at least wait 10 seconds before attempting another connect, but guess it doesn't work that way. Any thoughts? The stunnel client is on Ubuntu 18.04. I'd rather not compile out-of-band for the latest stunnel version unless I must. I"m assuming this is a config issue on my end. The version I'm stuck with right now is stunnel 5.44 on x86_64-pc-linux-gnu platform Thanks! [1] May 23 17:42:04 shuriken stunnel: LOG5[44922183]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55440 May 23 17:42:04 shuriken stunnel: LOG3[44922184]: s_connect: connect 192.168.1.96:51400: Connection refused (111) May 23 17:42:04 shuriken stunnel: LOG3[44922184]: No more addresses to connect May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 23 17:42:04 shuriken stunnel: LOG5[44922185]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55444 May 23 17:42:04 shuriken stunnel: LOG3[44922185]: s_connect: connect 192.168.1.96:51400: Connection refused (111) May 23 17:42:04 shuriken stunnel: LOG3[44922185]: No more addresses to connect [2] client = yes cert = /etc/stunnel/shared/stunnel.pem pid = /var/run/stunnel4/syslog_stunnel.pid [syslog_tunnel] accept = 127.0.0.1:5140 connect = 192.168.1.96:51400 TIMEOUTconnect = 10 ------------------------------ Message: 2 Date: Sat, 23 May 2020 20:09:48 -0400 From: Thomas Ward <teward(a)thomas-ward.net> To: digitek <digitek(a)charter.net>, stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] /var/log/syslog is filling up with stunnel errors Message-ID: <49V0wH16GWz2QGD(a)mail.syn-ack.link> Content-Type: text/plain; charset="utf-8" This is indicative of the remote server not running on the right ports normally or actively blocking you, given the "Connection Refused" errors.? Verify your system stunnel is on actually can connect to the specified IP and port combo independently of stunnel to start with.Sent from my Sprint Samsung Galaxy Note10+. -------- Original message --------From: digitek <digitek(a)charter.net> Date: 5/23/20 19:18 (GMT-05:00) To: stunnel-users(a)stunnel.org Subject: [stunnel-users] /var/log/syslog is filling up with stunnel errors Hi,I've been running stunnel for years to shuttle my syslogs off to a syslog server. It's performed flawlessly up until a few weeks ago. Recently, rebooting my syslog server results in the clients filling up /var/log/syslog with messages like below[1].I'm not certain where the issue is. We've gone through some Ubuntu 16.04 > 18.04 upgrades on some hosts, as well as the syslog server. Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second?? My config from a client is here[2]Last time this happened (few weeks ago) I googled around and found the TIMEOUTconnect parameter to try and get stunnel to at least wait 10 seconds before attempting another connect, but guess it doesn't work that way.Any thoughts? The stu nnel client is on Ubuntu 18.04. I'd rather not compile out-of-band for the latest stunnel version unless I must. I"m assuming this is a config issue on my end.? The version I'm stuck with right now is stunnel 5.44 on x86_64-pc-linux-gnu platformThanks![1]May 23 17:42:04 shuriken stunnel: LOG5[44922183]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socketMay 23 17:42:04 shuriken stunnel: LOG5[44922184]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55440May 23 17:42:04 shuriken stunnel: LOG3[44922184]: s_connect: connect 192.168.1.96:51400: Connection refused (111)May 23 17:42:04 shuriken stunnel: LOG3[44922184]: No more addresses to connectMay 23 17:42:04 shuriken stunnel: LOG5[44922184]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socketMay 23 17:42:04 shuriken stunnel: LOG5[44922185]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55444May 23 17:42:04 shuriken stunnel: LOG3[44922185]: s_connect: connect 192.168.1.96:51400: Conn ection refused (111)May 23 17:42:04 shuriken stunnel: LOG3[44922185]: No more addresses to connect[2]client?? = yescert???? = /etc/stunnel/shared/stunnel.pempid????? = /var/run/stunnel4/syslog_stunnel.pid[syslog_tunnel]accept?? = 127.0.0.1:5140connect? = 192.168.1.96:51400TIMEOUTconnect = 10_______________________________________________stunnel-users mailing liststunnel-users@stunnel.orghttps://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

/var/log/syslog is filling up with stunnel errors
by digitek 24 May '20

24 May '20

Hi, I've been running stunnel for years to shuttle my syslogs off to a syslog server. It's performed flawlessly up until a few weeks ago. Recently, rebooting my syslog server results in the clients filling up /var/log/syslog with messages like below[1]. I'm not certain where the issue is. We've gone through some Ubuntu 16.04 > 18.04 upgrades on some hosts, as well as the syslog server. Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second? My config from a client is here[2] Last time this happened (few weeks ago) I googled around and found the TIMEOUTconnect parameter to try and get stunnel to at least wait 10 seconds before attempting another connect, but guess it doesn't work that way. Any thoughts? The stunnel client is on Ubuntu 18.04. I'd rather not compile out-of-band for the latest stunnel version unless I must. I"m assuming this is a config issue on my end. The version I'm stuck with right now is stunnel 5.44 on x86_64-pc-linux-gnu platform Thanks! [1] May 23 17:42:04 shuriken stunnel: LOG5[44922183]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55440 May 23 17:42:04 shuriken stunnel: LOG3[44922184]: s_connect: connect 192.168.1.96:51400: Connection refused (111) May 23 17:42:04 shuriken stunnel: LOG3[44922184]: No more addresses to connect May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 23 17:42:04 shuriken stunnel: LOG5[44922185]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55444 May 23 17:42:04 shuriken stunnel: LOG3[44922185]: s_connect: connect 192.168.1.96:51400: Connection refused (111) May 23 17:42:04 shuriken stunnel: LOG3[44922185]: No more addresses to connect [2] client = yes cert = /etc/stunnel/shared/stunnel.pem pid = /var/run/stunnel4/syslog_stunnel.pid [syslog_tunnel] accept = 127.0.0.1:5140 connect = 192.168.1.96:51400 TIMEOUTconnect = 10

2 3

Re: [stunnel-users] Eudora -> Yahoo problems
by phs3stuff＠cox.net 20 May '20

20 May '20

Have you looked at the stunnel log? FWIW, I use stunnel to cox.net with Eudora (well, my wife does--I get to make it work) and just have the protocol, accept, and connect statements and it works. You might try commenting those out and see, but the log is probably more interesting. -----Original Message----- From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Joe Slaven Sent: Tuesday, May 19, 2020 8:48 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Eudora -> Yahoo problems Hello, new to stunnel, my first attempt is connecting Eudora to Yahoo Mail. My Yahoo Mail password and username are not being recognised when it is trying to access server 127.0.0.1 Can anyone suggest why this will not work? regards, Joe ******************************************************************************************************** ERROR MESSAGE There has been an error transferring your mail. POP Server [joeslaven(a)127.0.0.1] said ERR [AUTH] Username and password not accepted STUNNEL CONFIG FILE SETTINGS [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes EUDORA SETTINGS Checking Mail->Mail POP Server: 127.0.0.1 Sending Mail->SMTP Server: 127.0.0.1 Use submission port (587) is UNchecked Secure Sockets when Sending or Receiving : Never Default port settings : SMPT Port (25) POP Port (110) _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Eudora -> Yahoo problems
by Joe Slaven 20 May '20

20 May '20

Hello, new to stunnel, my first attempt is connecting Eudora to Yahoo Mail. My Yahoo Mail password and username are not being recognised when it is trying to access server 127.0.0.1 Can anyone suggest why this will not work? regards, Joe ******************************************************************************************************** ERROR MESSAGE There has been an error transferring your mail. POP Server [joeslaven(a)127.0.0.1] said ERR [AUTH] Username and password not accepted STUNNEL CONFIG FILE SETTINGS [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes EUDORA SETTINGS Checking Mail->Mail POP Server: 127.0.0.1 Sending Mail->SMTP Server: 127.0.0.1 Use submission port (587) is UNchecked Secure Sockets when Sending or Receiving : Never Default port settings : SMPT Port (25) POP Port (110)

1 0

Eudora -> Yahoo problems
by Joe Slaven 20 May '20

20 May '20

Hello, new to stunnel, my first attempt is connecting Eudora to Yahoo Mail. My Yahoo Mail password and username are not being recognised when it is trying to access server 127.0.0.1 Can anyone suggest why this will not work? regards, Joe ******************************************************************************************************** ERROR MESSAGE There has been an error transferring your mail. POP Server [joeslaven(a)127.0.0.1] said ERR [AUTH] Username and password not accepted STUNNEL CONFIG FILE SETTINGS [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes EUDORA SETTINGS Checking Mail->Mail POP Server: 127.0.0.1 Sending Mail->SMTP Server: 127.0.0.1 Use submission port (587) is UNchecked Secure Sockets when Sending or Receiving : Never Default port settings : SMPT Port (25) POP Port (110)

1 0

Eudora to Yahoo Mail -amended
by Joe Slaven 19 May '20

19 May '20

Hello, totally new to stunnel. Can anyone please point me in the direction of example config code to connect Eudora to POP Yahoo mail? Also what do I put in Eudora ? many thanks, Joe

1 0

Lost password
by Joe Slaven 19 May '20

19 May '20

Hello, I forgot to record my password used to subscribe to the list. Can anyone please tell me how I can reset it? Many thanks, joe

1 0

Eudora to Yahoo Mail
by Joe Slaven 19 May '20

19 May '20

Hello, totally new to stunnel. Can anyone please point me in the direction of example config code to connect Eudora to POP Yahoo mail? many thanks, Joe

1 0

newer version for VMS
by Coviello, Paul 19 May '20

19 May '20

Has anyone put together a package for OpenVMS particularly 8.4-1h1 from VSI? And if not is there a way to use an updated version of SSL in the current version I have? Which I believe is 4.20 FACS1>stunnel -version stunnel undefined on vax-OpenVMS with OpenSSL 0.9.8h 28 May 2008 Threading:PTHREAD Sockets:POLL,IPv4 Global options debug = 5 pid = SYS$LOGIN:STUNNEL.PID RNDbytes = 64 RNDoverwrite = yes Service-level options cert = stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

Windows tray icon
by Phil Smith III 19 May '20

19 May '20

If you hover on the stunnel tray icon, it just says "Server is idle". Right-clicking shows various options; none of those say "stunnel". Yes, they can go to "About", but it would be nice if the hover said "Stunnel server is idle" (and, perhaps, the "Exit" option said "Exit stunnel"). My user (my wife!) keeps forgetting what it is, hovering, and then still asking me what it is. Just a WIBNI. stunnel has been a lifesaver: she's wedded to Eudora, which doesn't support modern TLS, so when our ISP went all-TLS we had a problem. I also use it: I have a Bayesian mail proxy (K9) that doesn't support TLS, so my connections go MUA==>K9==>stunnel==>ISP. Any chance of this happening next rev? ...phsiii

1 0

Stunnel 5.57b2 OpenSSL 1.1.1g
by Olaf Brandt 19 May '20

19 May '20

Hi, I have an issue with stunnel since OpenSSL was updated to 1.1.1g. Stunnel has been build from scratch after the update and gives those errors: [ ] Clients allowed=500 [.] stunnel 5.57 on x86_64-pc-linux-gnu platform [.] Compiled/running with OpenSSL 1.1.1g 21 Apr 2020 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [dns_local] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x02100004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [!] error queue: crypto/x509/by_file.c:205: error:0B084009:x509 certificate routines:X509_load_cert_crl_file:PEM lib [!] error queue: crypto/pem/pem_info.c:196: error:0907400D:PEM routines:PEM_X509_INFO_read_bio:ASN1 lib [!] error queue: crypto/asn1/tasn_dec.c:290: error:0D07803A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error [!] error queue: crypto/asn1/tasn_dec.c:1118: error:0D068066:asn1 encoding routines:asn1_check_tlen:bad object header [!] SSL_CTX_load_verify_locations: crypto/asn1/asn1_lib.c:91: error:0D07209B:asn1 encoding routines:ASN1_get_object:too long [!] Service [dns_local]: Failed to initialize TLS context [ ] Deallocating section defaults [ ] Deallocating section [dns_local] [ ] Deallocating section defaults Config: chroot=/var/lib/stunnel pid=/var/run/stunnel.pid debug = debug [dns_local] sslVersion = TLSv1.3 client = yes accept = localhost:1053 connect = 185.95.218.42:853 checkHost = dns.digitale-gesellschaft.ch verifyPeer = yes CAfile = /etc/stunnel/cf.crt [dns_local_fallback] sslVersion = TLSv1.3 client = yes accept = localhost:1054 connect = 185.95.218.43:853 checkHost = dns.digitale-gesellschaft.ch verifyPeer = yes CAfile = /etc/stunnel/cf43.crt OpenSSL check of the cert files seems OK: openssl x509 -text -noout -in /etc/stunnel/cf.crt Certificate: Data: Version: 3 (0x2) Serial Number: 03:16:19:87:62:ac:be:ec:92:7b:6e:75:b8:a3:2e:ba:ea:28 Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 Validity Not Before: May 17 21:00:22 2020 GMT Not After : Aug 15 21:00:22 2020 GMT Subject: CN = dns.digitale-gesellschaft.ch Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:c0:01:03:42:24:5b:07:7e:46:06:fc:e0:21:56: 93:c4:6a:3c:88:c8:df:be:91:d6:d8:7a:b7:fc:3f: 8c:f1:b9:74:ec:c1:3b:2b:02:fe:27:93:1e:d6:d3: a1:95:31:ed:c7:06:26:28:74:60:7e:70:53:39:4b: e5:43:c2:81:dc:50:f3:d7:9e:0b:87:5b:2c:e8:a8: eb:71:bc:7b:04:92:d5:be:66:ba:0e:d8:9f:27:28: 77:9f:7c:68:2f:2f:64:2d:8a:86:f7:cf:c6:3a:c1: 1b:d4:e9:95:d6:c0:f3:77:f3:cd:79:16:40:86:ce: d5:dc:be:b2:c6:5b:7c:fe:e3:68:8d:25:61:41:a8: 99:b3:f4:62:60:19:bf:96:32:46:ef:e4:6a:c2:3d: 00:f6:44:b9:63:94:50:0e:fb:a0:e1:88:eb:79:cf: b7:a5:d1:29:0c:d6:bf:ee:ad:1b:9b:8e:7c:94:4f: f8:5a:0e:a7:5e:62:e7:67:61:9e:83:cb:a0:f7:56: f6:bc:ec:df:4d:60:6a:fe:08:fa:1c:ae:17:05:54: 0f:b0:f8:1f:6c:78:ca:a0:99:ec:4b:06:b3:79:97: 88:d1:7e:c8:93:cf:15:6b:9d:ea:d2:ef:88:da:1b: e8:2b:dd:0d:6e:f2:7e:f3:75:60:03:6a:87:64:79: e6:1f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Key Identifier: 9C:E3:0E:F4:F1:60:60:EC:21:7D:D8:D6:5F:0E:7B:FF:90:DB:68:01 X509v3 Authority Key Identifier: keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1 Authority Information Access: OCSP - URI:http://ocsp.int-x3.letsencrypt.org CA Issuers - URI:http://cert.int-x3.letsencrypt.org/ X509v3 Subject Alternative Name: DNS:dns.digitale-gesellschaft.ch, DNS:dns1.digitale-gesellschaft.ch, DNS:dns2.digitale-gesellschaft.ch X509v3 Certificate Policies: Policy: 2.23.140.1.2.1 Policy: 1.3.6.1.4.1.44947.1.1.1 CPS: http://cps.letsencrypt.org CT Precertificate SCTs: Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 07:B7:5C:1B:E5:7D:68:FF:F1:B0:C6:1D:23:15:C7:BA: E6:57:7C:57:94:B7:6A:EE:BC:61:3A:1A:69:D3:A2:1C Timestamp : May 17 22:00:22.318 2020 GMT Extensions: none Signature : ecdsa-with-SHA256 30:45:02:20:3D:7F:5A:57:E3:CE:42:A0:2A:16:FD:59: AE:7A:11:19:AE:BE:BE:AA:5A:4A:B0:1E:66:8E:D6:21: A8:35:F8:CB:02:21:00:DB:06:63:54:26:03:76:28:CD: 05:BF:08:8B:1B:95:2B:D2:A1:B3:AC:63:6A:DD:84:E7: 84:3A:70:A6:54:31:2B Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 6F:53:76:AC:31:F0:31:19:D8:99:00:A4:51:15:FF:77: 15:1C:11:D9:02:C1:00:29:06:8D:B2:08:9A:37:D9:13 Timestamp : May 17 22:00:22.412 2020 GMT Extensions: none Signature : ecdsa-with-SHA256 30:45:02:21:00:EA:BC:2D:B6:B1:71:0B:CE:75:A7:15: 86:D2:C0:05:49:08:38:CC:B9:EF:DA:1F:23:53:1A:5F: BD:31:19:A5:0A:02:20:21:2F:94:08:61:D0:A8:CA:3F: 71:D3:54:4D:E3:56:50:91:51:A6:01:16:77:9E:AE:31: 2E:43:E1:68:C0:CE:F2 Signature Algorithm: sha256WithRSAEncryption 9b:b8:24:f8:30:fc:77:5d:67:91:40:c7:bf:58:cf:64:67:7f: 87:33:8e:04:19:93:98:bb:35:cb:4e:b3:78:c0:04:5c:48:f4: 74:38:f2:57:02:38:3b:84:19:aa:9b:39:08:1d:f9:62:f4:c7: af:e4:17:40:02:99:7a:c5:24:fc:ee:b1:d5:95:b0:a2:58:f0: db:44:0f:50:3c:92:81:e8:8f:81:4d:e1:eb:e4:86:5d:d0:c8: 31:d2:30:07:7f:56:48:65:bd:a0:01:38:19:81:e4:80:38:21: 1f:ae:13:96:54:cd:9f:b1:cb:b2:47:00:f0:8b:d4:0d:61:29: 99:cb:71:ee:f6:53:ab:27:45:33:7b:0c:f4:e4:85:58:a7:8e: 58:8e:88:04:0d:e8:03:18:41:e6:8f:b5:c1:c1:9d:da:57:0a: 85:d7:19:05:4f:f9:8f:8c:b5:60:3f:67:f0:d8:fd:10:98:ad: de:25:88:7b:67:0f:bd:e1:7c:21:fb:35:8c:b2:26:78:de:b1: 54:a4:e9:9f:e0:48:d6:1a:0e:60:a6:f6:21:8c:b3:df:21:a1: 0c:16:d4:ab:93:3a:5d:94:22:34:40:5b:7e:ef:ea:f8:a1:15: d6:8d:69:aa:40:fe:ae:6f:79:dd:49:49:1a:88:0f:15:61:19: 00:f8:41:6c openssl x509 -text -noout -in /etc/stunnel/cf43.crt Certificate: Data: Version: 3 (0x2) Serial Number: 03:2b:84:39:5e:99:3d:2d:85:52:63:3a:d2:fa:bc:2e:60:4b Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 Validity Not Before: Mar 16 22:01:15 2020 GMT Not After : Jun 14 22:01:15 2020 GMT Subject: CN = dns.digitale-gesellschaft.ch Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:bc:0e:73:84:9c:89:7c:f8:2a:db:79:5f:78:ac: 39:a8:c5:25:b4:86:5b:9e:1c:3c:14:a6:17:ae:67: f1:02:17:0b:dc:36:ea:a1:9c:57:91:5b:5a:91:6b: df:7b:4c:74:7e:6c:e2:eb:5f:a5:95:02:25:43:c1: 3e:f0:67:5d:80:27:6f:37:72:0e:1f:b7:c3:13:e2: 3a:a5:13:b6:41:d0:01:aa:d0:7f:68:d4:5e:10:95: ee:17:bb:8d:8b:77:a3:7e:c8:9e:7a:8a:35:8a:09: 00:82:80:67:70:34:ac:f5:bc:24:4a:b9:c4:df:1f: 1e:e4:48:66:a8:76:60:d8:a3:d5:64:3b:9d:7e:7b: 18:99:f7:31:a5:28:4e:a4:47:24:25:af:18:32:d5: f9:98:67:21:f7:49:23:c2:72:00:73:e5:25:ca:af: a5:ae:df:00:62:d8:f2:5e:1e:8a:26:5a:63:5b:22: e1:eb:2d:b4:e9:57:de:16:8c:a0:72:db:ff:82:46: b8:d8:55:ad:55:84:e5:65:b5:86:8b:47:00:ea:85: 0d:74:c6:9d:9f:95:e4:3a:19:fe:3d:8f:5f:4b:f8: ed:a5:93:3f:ea:31:fd:41:74:7e:6b:ae:bf:98:9a: 70:85:d8:9f:51:85:fc:5e:11:eb:b9:60:6a:c3:bf: 81:f7 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Key Identifier: DE:64:78:2F:E4:81:84:C3:C9:3F:5C:01:DB:D0:42:E2:0D:CB:48:B8 X509v3 Authority Key Identifier: keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1 Authority Information Access: OCSP - URI:http://ocsp.int-x3.letsencrypt.org CA Issuers - URI:http://cert.int-x3.letsencrypt.org/ X509v3 Subject Alternative Name: DNS:dns.digitale-gesellschaft.ch, DNS:dns1.digitale-gesellschaft.ch, DNS:dns2.digitale-gesellschaft.ch X509v3 Certificate Policies: Policy: 2.23.140.1.2.1 Policy: 1.3.6.1.4.1.44947.1.1.1 CPS: http://cps.letsencrypt.org CT Precertificate SCTs: Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 5E:A7:73:F9:DF:56:C0:E7:B5:36:48:7D:D0:49:E0:32: 7A:91:9A:0C:84:A1:12:12:84:18:75:96:81:71:45:58 Timestamp : Mar 16 23:01:15.249 2020 GMT Extensions: none Signature : ecdsa-with-SHA256 30:44:02:20:04:32:96:55:70:AB:40:41:3B:E2:6C:E3: 8E:78:1E:82:F7:84:57:6A:76:2C:11:2B:24:A6:BB:72: 59:F1:F9:8A:02:20:67:12:DB:64:C1:D8:15:5D:3F:ED: 8B:8F:01:68:B8:A1:D2:B0:20:2B:32:54:11:14:82:72: 06:B8:E6:1C:1C:69 Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 07:B7:5C:1B:E5:7D:68:FF:F1:B0:C6:1D:23:15:C7:BA: E6:57:7C:57:94:B7:6A:EE:BC:61:3A:1A:69:D3:A2:1C Timestamp : Mar 16 23:01:15.303 2020 GMT Extensions: none Signature : ecdsa-with-SHA256 30:44:02:20:1B:C7:5B:F2:A9:04:12:6A:62:E8:33:F9: BD:08:39:1D:0F:F3:39:8D:F2:F8:37:E3:C8:05:CC:1B: E7:31:F7:83:02:20:12:47:02:D3:E3:93:48:9A:F3:5A: B9:F4:12:85:87:0F:D4:F2:B7:79:F5:8C:DD:77:D4:5E: BE:D0:95:27:83:9C Signature Algorithm: sha256WithRSAEncryption 82:30:ea:0a:6f:45:53:e7:f8:a0:80:69:47:a4:7d:ee:6a:78: a3:34:00:f1:bb:0d:c8:3a:1f:37:8e:25:f9:9d:cc:a5:e0:15: 03:a5:da:2a:28:af:89:97:f9:d6:20:61:ae:1e:16:80:f4:1a: 2c:08:ac:74:f3:80:2f:ae:17:f7:f4:b4:1c:b7:f1:59:f9:73: fd:12:cb:e3:48:36:bd:fe:99:38:69:44:7f:3b:dc:38:98:54: 75:f5:00:d0:de:93:eb:5a:4d:5e:65:d0:99:9e:64:75:8f:cd: e4:6f:1e:22:d5:8f:cb:4d:78:ef:0e:70:38:b7:f0:af:4d:30: 7b:9a:ea:1d:6c:b7:cb:18:2b:de:5a:18:d2:4b:bb:e6:79:b2: 45:8b:01:dc:d1:15:45:cc:cc:f0:5d:a6:98:10:90:72:d2:da: ef:7a:3c:1c:af:42:f0:7f:85:5b:49:53:e8:b3:51:11:e4:93: fc:b3:8a:dc:bc:5c:40:8d:bb:36:be:36:87:09:de:23:19:29: 1d:f3:7e:70:5b:43:43:ad:6e:a4:b4:55:ac:9e:f5:10:05:31: a7:a5:00:66:8a:e7:67:4e:02:2a:2d:40:d4:2c:e8:f1:bb:35: 8d:b7:cf:52:b0:71:04:72:d0:ab:fb:e6:f6:c7:45:33:db:88: d5:90:f0:32 Any suggestions? Thanks.

1 0

client with two source IPs and one destination
by Daniele Basaldella 12 May '20

12 May '20

Dear group, I've to configure a couple of tunneled connections (call them TC1 and TC2), client side, on a linux system. The target of both such connections is the same (destination ip and port are the same, call it DST). At source side (my server) I have a two IP addresses (call them IP1 and IP2) assigned and currently working to its unique NIC. I normally use iptables SNAT to split the traffic between IP1 and IP2 depending on destination addresses but in this case I've to distinguish it at application level (TC1 and TC2). I'd like to get TC1 to set the outgoing traffic with source address IP1 and TC2 to set outgoing traffic with source address IP2. Tunnel Tunnel Client Server TC1: IP1 --\ >--> DST TC2: IP2 --/ I'm thinking to set one entry in stunnel.conf for each TC1 and TC2 and use *transparent* = source clause to set the source address but it seems my case is not so common and I didn't find documentation. Please could you suggest a solution. Thanks

3 3

iOS 13.4.1 Blue Iris now working
by John McClymont 12 May '20

12 May '20

After more research, stunnel and blue iris now working on IOS 13.4.1 sslVersion = TLSv1.2 <--- added this to stunnel.conf [BlueIris] accept=1440 connect=192.168.0.2:8080 <---- tried 8080 failed, tried 127.0.0.1 failed cert = stunnel.pem Like I said not an expert,

1 0

client with two source IPs and one destination
by Brent Kimberley 11 May '20

11 May '20

Hi Daniele.I haven't looked at exact scenario. Have you considered stunnel+HAproxy? Dear group, I've to configure a couple of tunneled connections (call them TC1 and TC2), client side, on a linux system. The target of both such connections is the same (destination ip and port are the same, call it DST). At source side (my server) I have a two IP addresses (call them IP1 and IP2) assigned and currently working to its unique NIC. I normally use iptables SNAT to split the traffic between IP1 and IP2 depending on destination addresses but in this case I've to distinguish it at application level (TC1 and TC2). I'd like to get TC1 to set the outgoing traffic with source address IP1 and TC2 to set outgoing traffic with source address IP2. Tunnel Tunnel Client Server TC1: IP1 --\ >--> DST TC2: IP2 --/ I'm thinking to set one entry in stunnel.conf for each TC1 and TC2 and use *transparent* = source clause to set the source address but it seems my case is not so common and I didn't find documentation. Please could you suggest a solution. Thanks

1 0

iOS 13.4.1 Blue Iris
by John McClymont 11 May '20

11 May '20

Hi I have been using stunnel or a number of years to create a secure connect to CCTV recording software. Today after upgrading to IOS 13.4.1 I can no longer connect I ran generate self signed certificate, still fails. Searching I found others with similar problem, some have created a cert using other providers. I would prefer to generate from stunnel as I have always done config [BlueIris] accept=1440 connect=8080 cert = stunnel.pem I am no expert, basically followed a simple setup read few comments that it maybe due to IOS no longer supporting certain version of ssl Hopefully you can help Log 2020.05.11 22:59:04 LOG5[main]: stunnel 5.56 on x64-pc-mingw32-gnu platform 2020.05.11 22:59:04 LOG5[main]: Compiled/running with OpenSSL 1.1.1c 28 May 2019 2020.05.11 22:59:04 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2020.05.11 22:59:04 LOG5[main]: Reading configuration from file stunnel.conf 2020.05.11 22:59:04 LOG5[main]: UTF-8 byte order mark detected 2020.05.11 22:59:04 LOG6[main]: Initializing service [BlueIris] 2020.05.11 22:59:04 LOG6[main]: Loading certificate from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Certificate loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Loading private key from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Private key loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: DH initialization not needed 2020.05.11 22:59:04 LOG6[main]: Initializing service [gmail-pop3] 2020.05.11 22:59:04 LOG6[main]: Initializing service [gmail-imap] 2020.05.11 22:59:04 LOG6[main]: Initializing service [gmail-smtp] 2020.05.11 22:59:04 LOG6[main]: Initializing service [meinberg-smtp] 2020.05.11 22:59:04 LOG6[main]: Loading certificate from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Certificate loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Loading private key from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Private key loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG4[main]: Service [meinberg-smtp] needs authentication to prevent MITM attacks 2020.05.11 22:59:04 LOG5[main]: Configuration successful 2020.05.11 22:59:04 LOG6[main]: Service [BlueIris] (FD=564) bound to 0.0.0.0:1440 2020.05.11 22:59:04 LOG6[main]: Service [gmail-pop3] (FD=728) bound to 127.0.0.1:110 2020.05.11 22:59:04 LOG6[main]: Service [gmail-imap] (FD=732) bound to 127.0.0.1:143 2020.05.11 22:59:04 LOG6[main]: Service [gmail-smtp] (FD=736) bound to 0.0.0.0:25 2020.05.11 22:59:04 LOG6[main]: Service [meinberg-smtp] (FD=740) bound to 192.168.0.2:2525 2020.05.11 22:59:04 LOG6[cron]: Executing cron jobs 2020.05.11 22:59:04 LOG6[cron]: Cron jobs completed in 0 seconds 2020.05.11 22:59:55 LOG5[0]: Service [BlueIris] accepted connection from 192.168.0.142:58797 2020.05.11 22:59:55 LOG6[0]: Peer certificate not required 2020.05.11 22:59:55 LOG3[0]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[1]: Service [BlueIris] accepted connection from 192.168.0.142:58798 2020.05.11 22:59:55 LOG6[1]: Peer certificate not required 2020.05.11 22:59:55 LOG3[1]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[2]: Service [BlueIris] accepted connection from 192.168.0.142:58799 2020.05.11 22:59:55 LOG6[2]: Peer certificate not required 2020.05.11 22:59:55 LOG3[2]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[3]: Service [BlueIris] accepted connection from 192.168.0.142:58800 2020.05.11 22:59:55 LOG6[3]: Peer certificate not required 2020.05.11 22:59:55 LOG3[3]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[4]: Service [BlueIris] accepted connection from 192.168.0.142:58801 2020.05.11 22:59:55 LOG6[4]: Peer certificate not required 2020.05.11 22:59:55 LOG3[4]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[5]: Service [BlueIris] accepted connection from 192.168.0.142:58802 2020.05.11 22:59:55 LOG6[5]: Peer certificate not required 2020.05.11 22:59:55 LOG3[5]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[5]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[6]: Service [BlueIris] accepted connection from 192.168.0.142:58803 2020.05.11 22:59:55 LOG6[6]: Peer certificate not required 2020.05.11 22:59:55 LOG3[6]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[6]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[7]: Service [BlueIris] accepted connection from 192.168.0.142:58804 2020.05.11 22:59:55 LOG6[7]: Peer certificate not required 2020.05.11 22:59:55 LOG3[7]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[7]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[8]: Service [BlueIris] accepted connection from 192.168.0.142:58805 2020.05.11 22:59:55 LOG6[8]: Peer certificate not required 2020.05.11 22:59:55 LOG3[8]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[8]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[9]: Service [BlueIris] accepted connection from 192.168.0.142:58806 2020.05.11 22:59:55 LOG6[9]: Peer certificate not required 2020.05.11 22:59:55 LOG3[9]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[10]: Service [BlueIris] accepted connection from 192.168.0.142:58807 2020.05.11 22:59:55 LOG6[10]: Peer certificate not required 2020.05.11 22:59:55 LOG3[10]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[10]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[11]: Service [BlueIris] accepted connection from 192.168.0.142:58808 2020.05.11 22:59:55 LOG6[11]: Peer certificate not required 2020.05.11 22:59:55 LOG3[11]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[11]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[12]: Service [BlueIris] accepted connection from 192.168.0.142:58809 2020.05.11 22:59:55 LOG6[12]: Peer certificate not required 2020.05.11 22:59:55 LOG3[12]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[12]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[13]: Service [BlueIris] accepted connection from 192.168.0.142:58810 2020.05.11 22:59:55 LOG6[13]: Peer certificate not required 2020.05.11 22:59:55 LOG3[13]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[13]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[14]: Service [BlueIris] accepted connection from 192.168.0.142:58811 2020.05.11 22:59:55 LOG6[14]: Peer certificate not required 2020.05.11 22:59:55 LOG3[14]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[14]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:56 LOG5[15]: Service [BlueIris] accepted connection from 192.168.0.142:58812 2020.05.11 22:59:56 LOG6[15]: Peer certificate not required 2020.05.11 22:59:56 LOG3[15]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:56 LOG5[15]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:56 LOG5[16]: Service [BlueIris] accepted connection from 192.168.0.142:58813 2020.05.11 22:59:56 LOG6[16]: Peer certificate not required 2020.05.11 22:59:56 LOG3[16]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:56 LOG5[16]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:56 LOG5[17]: Service [BlueIris] accepted connection from 192.168.0.142:58814 2020.05.11 22:59:56 LOG6[17]: Peer certificate not required 2020.05.11 22:59:56 LOG3[17]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:56 LOG5[17]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[18]: Service [BlueIris] accepted connection from 192.168.0.142:58815 2020.05.11 23:00:04 LOG6[18]: Peer certificate not required 2020.05.11 23:00:04 LOG3[18]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[18]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[19]: Service [BlueIris] accepted connection from 192.168.0.142:58816 2020.05.11 23:00:04 LOG6[19]: Peer certificate not required 2020.05.11 23:00:04 LOG3[19]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[19]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[20]: Service [BlueIris] accepted connection from 192.168.0.142:58817 2020.05.11 23:00:04 LOG6[20]: Peer certificate not required 2020.05.11 23:00:04 LOG3[20]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[20]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[21]: Service [BlueIris] accepted connection from 192.168.0.142:58818 2020.05.11 23:00:04 LOG6[21]: Peer certificate not required 2020.05.11 23:00:04 LOG3[21]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[22]: Service [BlueIris] accepted connection from 192.168.0.142:58819 2020.05.11 23:00:04 LOG6[22]: Peer certificate not required 2020.05.11 23:00:04 LOG3[22]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[23]: Service [BlueIris] accepted connection from 192.168.0.142:58820 2020.05.11 23:00:04 LOG6[23]: Peer certificate not required 2020.05.11 23:00:04 LOG3[23]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[23]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[24]: Service [BlueIris] accepted connection from 192.168.0.142:58821 2020.05.11 23:00:04 LOG6[24]: Peer certificate not required 2020.05.11 23:00:04 LOG3[24]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[24]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[25]: Service [BlueIris] accepted connection from 192.168.0.142:58822 2020.05.11 23:00:04 LOG6[25]: Peer certificate not required 2020.05.11 23:00:04 LOG3[25]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[25]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[26]: Service [BlueIris] accepted connection from 192.168.0.142:58823 2020.05.11 23:00:04 LOG6[26]: Peer certificate not required 2020.05.11 23:00:04 LOG3[26]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[26]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[27]: Service [BlueIris] accepted connection from 192.168.0.142:58824 2020.05.11 23:00:04 LOG6[27]: Peer certificate not required 2020.05.11 23:00:04 LOG3[27]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[27]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[28]: Service [BlueIris] accepted connection from 192.168.0.142:58825 2020.05.11 23:00:04 LOG6[28]: Peer certificate not required 2020.05.11 23:00:04 LOG3[28]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[28]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[29]: Service [BlueIris] accepted connection from 192.168.0.142:58826 2020.05.11 23:00:04 LOG6[29]: Peer certificate not required 2020.05.11 23:00:04 LOG3[29]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[29]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[30]: Service [BlueIris] accepted connection from 192.168.0.142:58827 2020.05.11 23:00:04 LOG6[30]: Peer certificate not required 2020.05.11 23:00:04 LOG3[30]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[31]: Service [BlueIris] accepted connection from 192.168.0.142:58828 2020.05.11 23:00:04 LOG6[31]: Peer certificate not required 2020.05.11 23:00:04 LOG3[31]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[31]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[32]: Service [BlueIris] accepted connection from 192.168.0.142:58829 2020.05.11 23:00:04 LOG6[32]: Peer certificate not required 2020.05.11 23:00:04 LOG3[32]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[32]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[33]: Service [BlueIris] accepted connection from 192.168.0.142:58830 2020.05.11 23:00:04 LOG6[33]: Peer certificate not required 2020.05.11 23:00:04 LOG3[33]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[33]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[34]: Service [BlueIris] accepted connection from 192.168.0.142:58831 2020.05.11 23:00:04 LOG6[34]: Peer certificate not required 2020.05.11 23:00:04 LOG3[34]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[34]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[35]: Service [BlueIris] accepted connection from 192.168.0.142:58832 2020.05.11 23:00:04 LOG6[35]: Peer certificate not required 2020.05.11 23:00:04 LOG3[35]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[35]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

1 0

Solution: REDIR not Working in Chrome, Edge (new), Opera
by Joe Sterk 08 May '20

08 May '20

I found the solution to the REDIR issue posted in April. You can find more information at https://support.google.com/chrome/forum/AAAAP1KN0B02tttvx4VCDQ/?hl=en&gpf=%…. The issue is going from https --> http or https. Our software company added an additional CRLR at the end so it looks like this now: "HTTP/1.1 301 Moved Permanently\r\n" + "Location: https://www.abc.com<https://www.abc.com/>" + http.req.url.path_and_query.http_url_safe + "\r\n\r\n". Joe Sterk

1 0

Stunnel 4 with Shoutcast 2.6
by Ali 02 May '20

02 May '20

I am trying to add ssl to my shoutcast stream. I get the messages below when I try to start or restart shoutcast. I have purchased an ssl cert and key for this and it did not work via the shoutcast config, so I gave this a shot. The key and certs with combined into the stunnel.pem. See below and thanks for the help. I also added the stunnel config below. client=no [shoutcast] accept=8002 (I also tried 443) connect=localhost:8000 cert = /etc/stunnel/stunnel.pem pid=/etc/stunnel/stunnel.pid -permissions are set to chmod 600 Stunnel Dir root@kwaxstreamserver:/etc/stunnel# l cert.pem key.pem README stunnel.conf stunnel.pem Stunnel on START Clients allowed=500 stunnel 4.53 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1f 6 Jan 2014 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 Reading configuration from file stunnel.conf Compression not enabled Snagged 64 random bytes from /root/.rnd Wrote 1024 new random bytes to /root/.rnd PRNG seeded successfully Line 6: "pid = /etc/stunnel/stunnel.pid": Specified option name is not valid here str_stats: 7 block(s), 1063 data byte(s), 406 control byte(s) Stunnel on RESTART root@kwaxstreamserver:/etc/stunnel# /etc/init.d/stunnel4 restart Restarting SSL tunnels: Clients allowed=500 stunnel 4.53 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1f 6 Jan 2014 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 Reading configuration from file /etc/stunnel/stunnel.conf Compression not enabled Snagged 64 random bytes from /root/.rnd Wrote 1024 new random bytes to /root/.rnd PRNG seeded successfully Line 6: "pid = /etc/stunnel/stunnel.pid": Specified option name is not valid here str_stats: 7 block(s), 1076 data byte(s), 406 control byte(s) [Failed: /etc/stunnel/stunnel.conf] You should check that you have specified the pid= in you configuration file

2 1

REDIR not Working in Chrome, Edge (new), Opera
by Joe Sterk 30 Apr '20

30 Apr '20

We are running stunnel on a windows 2019 server. When running Chrome/Opera/Edge(new), on our redirect we get the following: Hmmm... can't reach this page It looks like the webpage at https://xx.xxxxxxxx.com/xap/tqv000?NAME=&domain=xxxxxxxx might be having issues, or it may have moved permanently to a new web address. ERR_RESPONSE_HEADERS_TRUNCATED The code that is being called is: !************************************************************************ B$='REDIR https://' + STRIP(HOST$) + '/mainlobby.aspx' We even tried to redirect to www.google.com<http://www.google.com/appserve/mkt/p/AM7kBiVHeOrDhOeWlVMENmuUHTN9kHtm1C15sn…> and got the same error. Our log files shows the following: [04/23/20 14:25:39 409 ]Q.BUTTON1 = Ok [04/23/20 14:25:39 409 ]REDIR http://www.google.com [04/23/20 14:25:39 409 ]Result=+OK REDIR [04/23/20 14:25:42 ]GET /xap/tqv001 HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, */* The stunnel.conf file has the following connection information: sslVersion = all options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 ;header always set x-xss-protection "1; mode=block" ;ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA256-SHA ciphers = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ;options = CIPHER_SERVER_PREFERENCE TIMEOUTclose = 0 [https] accept = 443 connect = 8080 I don't see any error messages but the redirect is not working. It still works in IE and Firefox (for now). Joe Sterk CIO (Chief Information Officer) [Description: Description: cid:image004.jpg@01CD22BD.40F8C160] Insurance Services Corp. ? (972) 896-0384 (Mobile) * (707) 303-8105 (Work) * joes(a)QuieTrack.com<mailto:joes@QuieTrack.com>

1 0

Stunnel Cleanup on Uninstall
by Thomas Eifert 21 Apr '20

21 Apr '20

I've recently removed Stunnel 5.56 from several machines running Windows 10 x64. In every case, the uninstaller leaves behind the stunnel directory, bin subdirectory, and the file libssp-0.dll. Easy enough to remove manually, but I seem to recall in previous versions that the uninstaller managed to get everything. Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

port ? and password
by Coviello, Paul 21 Apr '20

21 Apr '20

It's been awhile since I've played with this and now there is a need to bring it back online. Can I designate any port numbers? I have an application that requires 'a' on the client and 'b' on the server Also is there a way to change the password in the startup of stunnell on VMS? Thanks Paul

1 0

stunnel ignoring config file for port binding
by Tim Turner 18 Apr '20

18 Apr '20

Config and logs below but redacted, this is running on 2016 server, if it matters I am starting it over an RDP session I find that the port is ignored in the config file and it always binds to ports in the 23*** range ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment ;cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /stunnel.log ; Use it for client mode client = yes ; Service-level configuration [Service Config] accept=127.0.0.1:40001 connect = redacted:443 log file 2020.04.18 10:08:18 LOG7[main]: Dispatching a signal from the signal pipe 2020.04.18 10:08:18 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2020.04.18 10:08:18 LOG7[main]: Running on Windows 6.2 2020.04.18 10:08:18 LOG5[main]: Reading configuration from file stunnel.conf 2020.04.18 10:08:18 LOG5[main]: UTF-8 byte order mark detected 2020.04.18 10:08:18 LOG7[main]: Compression disabled 2020.04.18 10:08:18 LOG7[main]: No PRNG seeding was required 2020.04.18 10:08:18 LOG6[main]: Initializing service [Service Config] 2020.04.18 10:08:18 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.04.18 10:08:18 LOG7[main]: TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 2020.04.18 10:08:18 LOG7[main]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2020.04.18 10:08:18 LOG7[main]: No certificate or private key specified 2020.04.18 10:08:18 LOG4[main]: Service [Digital-Prod-MTF-FIX-MD] needs authentication to prevent MITM attacks 2020.04.18 10:08:18 LOG5[main]: Configuration successful 2020.04.18 10:08:18 LOG7[main]: Deallocating section defaults 2020.04.18 10:08:18 LOG5[main]: Logging to C:\Users\turnert\AppData\Local\/stunnel.log 2020.04.18 10:08:18 LOG7[main]: Binding service [New Broker FIX Demo-Trading] 2020.04.18 10:08:18 LOG7[main]: Listening file descriptor created (FD=1296) 2020.04.18 10:08:18 LOG7[main]: Setting accept socket options (FD=1296) 2020.04.18 10:08:18 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2020.04.18 10:08:18 LOG6[main]: Service [New Broker FIX Demo-Trading] (FD=1296) bound to 127.0.0.1:23471 2020.04.18 10:08:18 LOG7[main]: Binding service [Service Config] This message and its attachments are confidential, may not be disclosed or used by any person other than the addressee and are intended only for the named recipient(s). If you are not the intended recipient, please notify the sender immediately and delete any copies of this message. LMAX Group is the holding company of LMAX Exchange, LMAX Global and LMAX Digital. Our registered address is Yellow Building, 1A Nicholas Road, London W11 4AN.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 189, Issue 3
by Brent Kimberley 10 Apr '20

10 Apr '20

Hi Andre. Can you please post your template? Salut, Brent Friday, April 10, 2020, 6:00:08 a.m. EDT, stunnel-users-request(a)stunnel.org <stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. CERT: Pre-verification error: unsupported certificate purpose (Andr? L?onard) ---------------------------------------------------------------------- Message: 1 Date: Fri, 10 Apr 2020 09:46:29 +0200 From: Andr? L?onard <andre.leonard(a)celotoise.com> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] CERT: Pre-verification error: unsupported certificate purpose Message-ID: <1a2bba7f82b899d6e208303bc3a8ad6d(a)celotoise.com> Content-Type: text/plain; charset="utf-8"; Format="flowed" Hi, I upgraded stunnel from version 5.44 to 5.56. But now I'm getting the following error : CERT: Pre-verification error: unsupported certificate purpose Rejected by CERT Setting verifiy to 0 slove temporary the issue but is not secure at all. As testing pupose, I recreated new certificate with the following command but ending with the same issue: openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem How to fix this ? Thanks for you help, Andr?.

1 0

CERT: Pre-verification error: unsupported certificate purpose
by André Léonard 10 Apr '20

10 Apr '20

Hi, I upgraded stunnel from version 5.44 to 5.56. But now I'm getting the following error : CERT: Pre-verification error: unsupported certificate purpose Rejected by CERT Setting verifiy to 0 slove temporary the issue but is not secure at all. As testing pupose, I recreated new certificate with the following command but ending with the same issue: openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem How to fix this ? Thanks for you help, André.

1 0

Stunnel to accept SSL and connect SSL
by Ray 08 Apr '20

08 Apr '20

Hi everyone, Simple question - How can I configure Stunnel to accept SSL from downlinks and connect to an SSL uplink? Thanks Ray

1 0

Stunnel API hooks
by Ray 31 Mar '20

31 Mar '20

Hi everyone, I want to do some processing over the incoming connection before forwarding the payload to the uplinks. ie. Listen <-> customized processing <-> connect Is there any API/hook structure to write my logic in a clean fashion? Or need to add/integrate my codes to the Stunnel codes? P.S I want this processing to be done in Stunnel and not by adding a 2nd application to achieve the job. Thanks Ray

1 0

Stunnel binary for macOS?
by Shrinidhi Rao 22 Mar '20

22 Mar '20

Greetings! I tried building stunnel in my mac and it was successful since I have all the developer tools installed. What about for those who do not have an 8GB size tool? Is there a way I can simply build a binary that can work in a wide range of macOS versions (including older ones)? Is there someone who has already done this? Any pointers in this regard would be greatly appreciated! -- Shrinidhi S Rao

2 1

stunnel squid proxy without client side stunnel
by claudiu vasadi 13 Mar '20

13 Mar '20

Hello list, I've successfully managed to setup the following: client -> stunnel (local on client) -> stunnel (on server) -> squid (same server) I was wondering however if it would be possible to NOT use stunnel on the client side and connect directly to the server side one. My current, working configs are below. simplified server side stunnel.conf: cert = /etc/stunnel/stunnel.pem debug = 7 output = /var/log/stunnel.log client = no [squid] accept = 3128 connect = 127.0.0.1:3129 client side config: cert = /etc/stunnel/stunnel.pem client = yes [squid] accept = 127.0.0.1:8080 connect = server:3128 On the server side, I've tried specifying: client = yes protocol = connect protocolHost = 127.0.0.1:3129 #SSL terminates on the stunnel server (still unsure about this) but because the proxy needs authentication (it used LDAP), I'm hitting what seems to be stunnel not returning the HTTP407 back to the client. 2020.03.13 20:18:34 LOG6[12306:140677061584640]: Client-mode connect protocol negotiations started 2020.03.13 20:18:34 LOG7[12306:140677061584640]: -> CONNECT 127.0.0.1:3129 HTTP/1.1 2020.03.13 20:18:34 LOG7[12306:140677061584640]: -> Host: 127.0.0.1:3129 2020.03.13 20:18:34 LOG7[12306:140677061584640]: -> 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- HTTP/1.1 407 Proxy Authentication Required 2020.03.13 20:18:34 LOG3[12306:140677061584640]: CONNECT request rejected 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Server: squid/3.5.20 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Mime-Version: 1.0 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Date: Fri, 13 Mar 2020 20:18:34 GMT 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Content-Type: text/html;charset=utf-8 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Content-Length: 3431 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Vary: Accept-Language 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Content-Language: en 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Proxy-Authenticate: Basic realm="myproxy" 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- X-Cache: MISS from myproxy 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- X-Cache-Lookup: NONE from myproxy:3129 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Via: 1.1 myproxy (squid/3.5.20) 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Connection: keep-alive 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- 2020.03.13 20:18:34 LOG5[12306:140677061584640]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket I'm testing with the following command from the client side: curl -U mysuer -x http://myproxy:3128 https://www.google.com Any help would be greatly appreciated.

1 0

S-tunnel will not send TLS
by Jan Falk 13 Mar '20

13 Mar '20

Hi. Can someone tell me why Stunnel stops at wating 10s? Log: 2020.03.12 09:43:36 LOG6[main]: Initializing service [x3_x4_DICOM_BFT_client] 2020.03.12 09:43:36 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.03.12 09:43:36 LOG7[main]: TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 2020.03.12 09:43:36 LOG7[main]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2020.03.12 09:43:36 LOG6[main]: Loading certificate from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG6[main]: Certificate loaded from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG6[main]: Loading private key from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG6[main]: Private key loaded from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG7[main]: Private key check succeeded 2020.03.12 09:43:36 LOG4[main]: Service [x3_x4_DICOM_BFT_client] uses "verifyChain" without subject checks 2020.03.12 09:43:36 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2020.03.12 09:43:36 LOG5[main]: Configuration successful 2020.03.12 09:43:36 LOG7[main]: Binding service [x3_x4_HL7_BFT_client] 2020.03.12 09:43:36 LOG7[main]: Listening file descriptor created (FD=380) 2020.03.12 09:43:36 LOG7[main]: Setting accept socket options (FD=380) 2020.03.12 09:43:36 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2020.03.12 09:43:36 LOG6[main]: Service [x3_x4_HL7_BFT_client] (FD=380) bound to 127.0.0.1:46161 2020.03.12 09:43:36 LOG7[main]: Binding service [x3_x4_DICOM_BFT_client] 2020.03.12 09:43:36 LOG7[main]: Listening file descriptor created (FD=492) 2020.03.12 09:43:36 LOG7[main]: Setting accept socket options (FD=492) 2020.03.12 09:43:36 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2020.03.12 09:43:36 LOG6[main]: Service [x3_x4_DICOM_BFT_client] (FD=492) bound to 127.0.0.1:46162 2020.03.12 09:43:36 LOG7[cron]: Cron thread initialized 2020.03.12 09:43:36 LOG6[cron]: Executing cron jobs 2020.03.12 09:43:36 LOG6[cron]: Cron jobs completed in 0 seconds 2020.03.12 09:43:36 LOG7[cron]: Waiting 86400 seconds 2020.03.12 09:44:37 LOG7[main]: Found 1 ready file descriptor(s) 2020.03.12 09:44:37 LOG7[main]: FD=380 ifds=r-x ofds=r-- 2020.03.12 09:44:37 LOG7[main]: FD=388 ifds=r-x ofds=--- 2020.03.12 09:44:37 LOG7[main]: Service [SOS_SYNGO_HL7_BFT_client] accepted (FD=508) from 127.0.0.1:50299 2020.03.12 09:44:37 LOG7[main]: Creating a new thread 2020.03.12 09:44:37 LOG7[main]: New thread created 2020.03.12 09:44:37 LOG7[0]: Service [x3_x4_HL7_BFT_client] started 2020.03.12 09:44:37 LOG7[0]: Setting local socket options (FD=508) 2020.03.12 09:44:37 LOG7[0]: Option TCP_NODELAY set on local socket 2020.03.12 09:44:37 LOG5[0]: Service [x3_x4_HL7_BFT_client] accepted connection from 127.0.0.1:50299 2020.03.12 09:44:37 LOG6[0]: s_connect: connecting 10.67.6.106:6161 2020.03.12 09:44:37 LOG7[0]: s_connect: s_poll_wait 10.67.6.106:6161: waiting 10 seconds Thanks in advance //Janne

2 5

Re: [stunnel-users] stunnel-users Digest, Vol 188, Issue 4
by Brent Kimberley 11 Mar '20

11 Mar '20

Hi Kelly. >>Connect = 127.0.0.1:1194? ?#<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work! Generic: The following layers maybe helpful: Cost / People / Process / Infrastructure / Application / Data / Interface ... Specific: Data layer (metadata &/| configuration): Can you please verify that 127.0.01:1194 is present? e.g. netstat -ano | egrep -e Proto -e Active -e 1194 Message: 1 Date: Tue, 10 Mar 2020 13:25:33 +0800 From: Kelly Trinh <kelly(a)trinhonline.com> To: "stunnel-users" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] behaviour when using 127.0.0.1 in the 'connect' field Message-ID: <170c2e7c29d.e9c53ed9127299.5279211261811289922(a)trinhonline.com> Content-Type: text/plain; charset="utf-8" Hi all - just want to report a problem I solved recently but wanted to get some insights on what was causing the problem. About me - learnt some unix at university (20 years ago) but nothing too serious.? Recently (1 month ago) acquired own domain name and now poking around the cloud computing / VPS thing. Project - hand-rolling my own VPN setup on a Ubuntu 18.04 VPS.? OpenVPN is easy since it is a git-clone thing and then just follow the openvpn-install script.? I wanted to add on the Stunnel wrapper because intended to use the VPN in China and apparently their firewall does deep packet inspection and can recognize (and block) openvpn traffic. Problem - when I set up my stunnel using 127.0.0.1 as the connect destination; it doesn't seem to work (I can see from openvpn window that things seem to pipe through stunnel but then immediately the connection is terminated).? If I replace the 127.0.0.1 with IP of the box I am using (say for example 1.2.3.4); everything works!? The FQDN is ok as well; as long as I don't use 127.0.0.1 Specifically the stunnel.conf: [OpenVPN] Accept = 443? # clients connect through 443 to further avoid potential blocking Connect = 127.0.0.1:1194? ?#<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work! Question - My problem is fixed but I am curious if there is any insights on why this is happening given that 1.2.3.4 and 127.0.0.1 are the same machine?

1 0

behaviour when using 127.0.0.1 in the 'connect' field
by Kelly Trinh 10 Mar '20

10 Mar '20

Hi all - just want to report a problem I solved recently but wanted to get some insights on what was causing the problem. About me - learnt some unix at university (20 years ago) but nothing too serious. Recently (1 month ago) acquired own domain name and now poking around the cloud computing / VPS thing. Project - hand-rolling my own VPN setup on a Ubuntu 18.04 VPS. OpenVPN is easy since it is a git-clone thing and then just follow the openvpn-install script. I wanted to add on the Stunnel wrapper because intended to use the VPN in China and apparently their firewall does deep packet inspection and can recognize (and block) openvpn traffic. Problem - when I set up my stunnel using 127.0.0.1 as the connect destination; it doesn't seem to work (I can see from openvpn window that things seem to pipe through stunnel but then immediately the connection is terminated). If I replace the 127.0.0.1 with IP of the box I am using (say for example 1.2.3.4); everything works! The FQDN is ok as well; as long as I don't use 127.0.0.1 Specifically the stunnel.conf: [OpenVPN] Accept = 443 # clients connect through 443 to further avoid potential blocking Connect = 127.0.0.1:1194 #<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work! Question - My problem is fixed but I am curious if there is any insights on why this is happening given that 1.2.3.4 and 127.0.0.1 are the same machine?

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users