- stunnel-users - stunnel.org

Re: [stunnel-users] (no subject)
by flash＠vicsmba.com 06 Mar '20

06 Mar '20

This can be O/S dependent – some O/S have limits on file descriptors, pipes, etc. I would check that. Second, broken pipes happen when one side closes when there is still action. In Unix C it is easy to do – if you use a piped open but you only want to get the first line of data so your read from the pipe and close … you get a broken pipe every time. This is harmless if that is what you want. Death if not. You might check your Oracle code for premature closing as I doubt it is stunnel. Can you trap the error and resume and see if it works? It well could. Essentially what I am saying is this is not directly a stunnel problem, more likely it is an implementation error. Which could be in the Oracle code as I have had problems with it in the past. More information on the O/S and the Oracle code would help. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Jose Alf. Sent: Wednesday, March 4, 2020 11:09 AM To: stunnel-users(a)stunnel.org; simona vittori <svittori(a)gmail.com> Subject: Re: [stunnel-users] (no subject) Simona, You are not giving enough information for anyone in this list to help you. Please review and apply How To Ask Questions The Smart Way <http://catb.org/~esr/faqs/smart-questions.html> How To Ask Questions The Smart Way and/or How to Report Bugs Effectively <https://www.chiark.greenend.org.uk/~sgtatham/bugs.html> How to Report Bugs Effectively Regards, Jose On Wednesday, March 4, 2020, 4:22:26 AM GMT-5, simona vittori <svittori(a)gmail.com <mailto:svittori@gmail.com> > wrote: Hello, I have an encrypted connection through stunnel between client and db server, but in connection I have the following errors: "IO Error: Broken pipe (Write failed) at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:874)" Could you help me, please? Thank you in advance Simona _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 188, Issue 1
by Brent Kimberley 05 Mar '20

05 Mar '20

You might need to review the documentation for your thin driver. https://www.oracle.com/database/technologies/appdev/jdbc-ucp-19c-downloads.… On Wednesday, March 4, 2020, 6:00:07 a.m. EST, stunnel-users-request(a)stunnel.org <stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. (no subject) (simona vittori) ---------------------------------------------------------------------- Message: 1 Date: Wed, 4 Mar 2020 10:21:56 +0100 From: simona vittori <svittori(a)gmail.com> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] (no subject) Message-ID: <CAMt_Qybr5aASRw-NokkhiQhe0dALW8kPEV+zCjU_dB7tz=FcYA(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, I have an encrypted connection through stunnel between client and db server, but in connection I have the following errors: "IO Error: Broken pipe (Write failed) at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:874)" Could you help me, please? Thank you in advance Simona

1 0

(no subject)
by simona vittori 04 Mar '20

04 Mar '20

Hello, I have an encrypted connection through stunnel between client and db server, but in connection I have the following errors: "IO Error: Broken pipe (Write failed) at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:874)" Could you help me, please? Thank you in advance Simona

3 2

Windows Server 2003 issues with stunnel, TLS 1.2 on website(s)
by Sean Kelley 27 Feb '20

27 Feb '20

*Issue:* Old Windows Server cannot be upgraded, but needs TLS 1.2 encryption. Stunnel looks like a solution, but I'm having issues configuring it to work (It is "running" successfully with a pem file and port 442). In IIS Manager btw, the website SSL Port is set to 443. I've tried searching (i.e. google "site: https://www.stunnel.org/pipermail/stunnel-users/ server 2003") and have found a few leads, but nothing that addresses my issues in a way I understand. My ignorance I'm sure. *Server details:* * Windows Server 2003, Standard Edition, Service Pack 2 * IIS web server running 3 websites (ASP, PHP mix) * Valid Certificates from Lets Encrypt in Certificate Store * stunnel 5.49 (latest version I could find that works on 32bit OS's) sorry it's not the latest :( *Working Log with Port 442:* 2020.02.24 15:24:37 LOG7[main]: Running on Windows 5.2 2020.02.24 15:24:37 LOG7[main]: No limit detected for the number of clients 2020.02.24 15:24:37 LOG5[main]: stunnel 5.49 on x86-pc-msvc-1500 platform 2020.02.24 15:24:37 LOG5[main]: Compiled/running with OpenSSL 1.0.2p-fips 14 Aug 2018 2020.02.24 15:24:37 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2020.02.24 15:24:37 LOG7[main]: errno: (*_errno()) 2020.02.24 15:24:37 LOG7[ui]: GUI message loop initialized 2020.02.24 15:24:37 LOG7[main]: Running on Windows 5.2 2020.02.24 15:24:37 LOG5[main]: Reading configuration from file stunnel.conf 2020.02.24 15:24:37 LOG5[main]: UTF-8 byte order mark detected 2020.02.24 15:24:37 LOG5[main]: FIPS mode disabled 2020.02.24 15:24:37 LOG7[main]: Compression disabled 2020.02.24 15:24:37 LOG7[main]: No PRNG seeding was required 2020.02.24 15:24:37 LOG6[main]: Initializing service [https] 2020.02.24 15:24:37 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.02.24 15:24:37 LOG7[main]: TLS options: 0x03004004 (+0x00004000, -0x00000000) 2020.02.24 15:24:37 LOG6[main]: Loading certificate from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Certificate loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Loading private key from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Private key loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG7[main]: Private key check succeeded 2020.02.24 15:24:37 LOG7[main]: ECDH initialization 2020.02.24 15:24:37 LOG7[main]: ECDH initialized with curve prime256v1 2020.02.24 15:24:37 LOG6[main]: Initializing service [domain] 2020.02.24 15:24:37 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.02.24 15:24:37 LOG7[main]: TLS options: 0x03014004 (+0x00014000, -0x00000000) 2020.02.24 15:24:37 LOG6[main]: Loading certificate from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Certificate loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Loading private key from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Private key loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG7[main]: Private key check succeeded 2020.02.24 15:24:37 LOG7[main]: ECDH initialization 2020.02.24 15:24:37 LOG7[main]: ECDH initialized with curve prime256v1 2020.02.24 15:24:37 LOG5[main]: Configuration successful 2020.02.24 15:24:37 LOG7[main]: Binding service [https] 2020.02.24 15:24:37 LOG7[main]: Listening file descriptor created (FD=292) 2020.02.24 15:24:38 LOG7[main]: Setting accept socket options (FD=292) 2020.02.24 15:24:38 LOG6[main]: Service [https] (FD=292) bound to 10.0.1.11:442 2020.02.24 15:24:38 LOG7[main]: Skipped SNI slave service [domain] 2020.02.24 15:24:38 LOG7[cron]: Cron thread initialized 2020.02.24 15:25:38 LOG6[cron]: Executing cron jobs 2020.02.24 15:25:38 LOG6[cron]: Cron jobs completed in 0 seconds 2020.02.24 15:25:38 LOG7[cron]: Waiting 86400 seconds *Log Error with port 443:* Binding service [https] to 10.0.1.11:443: Permission denied (WSAEACCES) (10013)* * *Conf:* ; Debugging stuff (may be useful for troubleshooting) debug = 7 ;output = stunnel.log ; TLS front-end to a web server [https] ; doesn't work with 443 below, works with 442 accept = 10.0.1.11:442 connect = 80 cert = C:\Program Files\stunnel\config\mywebsite.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks TIMEOUTclose = 0 [domain] sni = https:mywebsite.com sni = https:www.mywebsite.com cert = C:\Program Files\stunnel\config\mywebsite.pem ; connect = 80 connect = localhost:80 client = no sslVersion = TLSv1.2 -------------- Thanks, Sean

3 3

TLS connection not successful
by maktoob bareed 25 Feb '20

25 Feb '20

Hi I am trying to make TLS connection with a server that supports TLSv1.2. but each time I receive the following error: SSL_connect: ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number Here is my service configuration: sslVersion = TLSv1.2 options = NO_SSLv2 options = -NO_SSLv3 accept = 5512 connect = XXXXXXXXX client = yes

1 0

How to use SNI
by Paul Coshott 17 Feb '20

17 Feb '20

Hi Everyone, I have a single domain on my internet server, but it has 3 sub-domains. A separate web app runs off each one, but I need all 3 to be secured with https. I have the ssl certificates I need, but I don't know how to format the SNI section for all 3 sub-domains. The 3 domains and ports I need are : app1.pcapps.one:449 -> 127.0.0.1:8080 app2.pcapps.one:450 -> 127.0.0.1:81 app3.pcapps.one:451 -> 127.0.0.1:82 each domain has a certificate such as : cert = C:\httpscert\app1.pcapps.one.pfx Can anyone tell me how to write out the SNI section to get this working? Thanks, Paul

2 1

HTTP 404 if I don't add 127.0.0.1 in my /etc/hosts
by Masih Tavassoli 16 Feb '20

16 Feb '20

Hi Experts: I am trying to do http->https proxy for one site only: [example-proxy] client = yes accept = 127.0.0.1:5000 sni =integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com checkHost = integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com verifyPeer = yes verifyChain = yes connect = 147.154.19.235:443 CAfile = C:\Program Files (x86)\stunnel\config\ca-certs.pem If I add the following in /etc/hosts all works ok 127.0.0.1 integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com And then I have to use http://integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com… However, I just want this address to work: http://10.0.0.33:5000/ic/ws/integration/v1/flows/soap/SM_INT10_CREAT_EBS_GT… : isn’t the whole point of setting SNI to send servername on your behalf: 2020.02.15 00:46:59 LOG6[46]: SNI: sending servername: integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com 2020.02.15 00:46:59 LOG6[46]: Peer certificate required 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): before SSL initialization 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write client hello 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write client hello 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS read server hello 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS read change cipher spec 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS read finished 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write change cipher spec 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write finished 2020.02.15 00:46:59 LOG7[46]: 3 client connect(s) requested 2020.02.15 00:46:59 LOG7[46]: 3 client connect(s) succeeded 2020.02.15 00:46:59 LOG7[46]: 0 client renegotiation(s) requested 2020.02.15 00:46:59 LOG7[46]: 2 session reuse(s) 2020.02.15 00:46:59 LOG6[46]: TLS connected: previous session reused 2020.02.15 00:46:59 LOG6[46]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2020.02.15 00:46:59 LOG7[46]: Compression: null, expansion: null 2020.02.15 00:46:59 LOG6[46]: Session id: E003BBF100FA809D616B2F69E08BAF0119EA856FCEE6AD209BE95F7C5815380B 2020.02.15 00:48:05 LOG7[46]: TLS alert (read): warning: close notify 2020.02.15 00:48:05 LOG6[46]: TLS closed (SSL_read) What am I missing? Thanks Masi

1 0

How to pass URL parameters in connect to
by Shashank Shekhar 14 Feb '20

14 Feb '20

Hi, I am evaluating stunnel for a project. I want to translate a HTTP call to HTTPS. When I specify the URL to send to in the config file, I get error ""Unknown TCP service "443/api/path""". My config is as below: [https] client = yes accept = 4433 connect = myurl.com:443/api/path When I try the same thing without the sub-paths "/api/path" the connection works, but of course it doesn't hit the URL I want to hit. How do I achieve this? I tried going through the documentation, but couldn't figure it out. Any help will be greatly appreciated. Thank you, Shashank

2 1

Start stunnel services on Solaris
by Erick Alejandro Tovar Rebollo 10 Feb '20

10 Feb '20

Hi. I'm new on stunnel, and I don't know how I can start stunnel on Solaris 11 , with the stunnel version 5.56, I really need help. Thanks. Regards.

1 1

Error Stunnel 5.56 Solaris
by Erick Alejandro Tovar Rebollo 06 Feb '20

06 Feb '20

Hi. I'm trying to install stunnel on a Solaris 11, but when I put the *make install* command, send me the next message. gjgom@t51ldm02:~/tmp/stunnel-5.56$ make install Making install in src /usr/bin/gmkdir -p '/usr/local/bin' /bin/sh ../libtool --mode=install /usr/bin/ginstall -c stunnel '/usr/local/bin' libtool: install: /usr/bin/ginstall -c stunnel /usr/local/bin/stunnel /usr/bin/ginstall: cannot create regular file '/usr/local/bin/stunnel': Permission denied *** Error code 1 The following command caused the error: list='stunnel'; test -n "/usr/local/bin" || list=; \ if test -n "$list"; then \ echo " /usr/bin/gmkdir -p '/usr/local/bin'"; \ /usr/bin/gmkdir -p "/usr/local/bin" || exit 1; \ fi; \ for p in $list; do echo "$p $p"; done | \ sed 's/$//' | \ while read p p1; do if test -f $p \ || test -f $p1 \ ; then echo "$p"; echo "$p"; else :; fi; \ done | \ sed -e 'p;s,.*/,,;n;h' \ -e 's|.*|.|' \ -e 'p;x;s,.*/,,;s/$//;s,x,x,;s/$//' | \ sed 'N;N;N;s,\n, ,g' | \ gawk 'BEGIN { files["."] = ""; dirs["."] = 1 } \ { d=$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \ if ($2 == $4) files[d] = files[d] " " $1; \ else { print "f", $3 "/" $4, $1; } } \ END { for (d in files) print "f", d, files[d] }' | \ while read type dir files; do \ if test "$dir" = .; then dir=; else dir=/$dir; fi; \ test -z "$files" || { \ echo " /bin/sh ../libtool --mode=install /usr/bin/ginstall -c $files '/usr/local/bin$dir'"; \ /bin/sh ../libtool --mode=install /usr/bin/ginstall -c $files "/usr/local/bin$dir" || exit $?; \ } \ ; done make: Fatal error: Command failed for target `install-binPROGRAMS' Current working directory /export/home/gjgom/tmp/stunnel-5.56/src *** Error code 1 The following command caused the error: make install-exec-am install-data-am make: Fatal error: Command failed for target `install-am' Current working directory /export/home/gjgom/tmp/stunnel-5.56/src *** Error code 1 The following command caused the error: fail=; \ if (target_option=k; case ${target_option-} in ?) ;; *) echo "am__make_running_with_option: internal error: invalid" "target option '${target_option-}' specified" >&2; exit 1;; esac; has_opt=no; sane_makeflags=$MAKEFLAGS; if { if test -z ''; then false; elif test -n ''; then true; elif test -n '' && test -n ''; then true; else false; fi; }; then sane_makeflags=$MFLAGS; else case $MAKEFLAGS in *\\[\ \ ]*) bs=\\; sane_makeflags=`printf '%s\n' "$MAKEFLAGS" | sed "s/$bs$bs[$bs $bs ]*//g"`;; esac; fi; skip_next=no; strip_trailopt () { flg=`printf '%s\n' "$flg" | sed "s/$1.*$//"`; }; for flg in $sane_makeflags; do test $skip_next = yes && { skip_next=no; continue; }; case $flg in *=*|--*) continue;; -*I) strip_trailopt 'I'; skip_next=yes;; -*I?*) strip_trailopt 'I';; -*O) strip_trailopt 'O'; skip_next=yes;; -*O?*) strip_trailopt 'O';; -*l) strip_trailopt 'l'; skip_next=yes;; -*l?*) strip_trailopt 'l';; -[dEDm]) skip_next=yes;; -[JT]) skip_next=yes;; esac; case $flg in *$target_option*) has_opt=yes; break;; esac; done; test $has_opt = yes); then \ failcom='fail=yes'; \ else \ failcom='exit 1'; \ fi; \ dot_seen=no; \ target=`echo install-recursive | sed s/-recursive//`; \ case "install-recursive" in \ distclean-* | maintainer-clean-*) list='src doc tools tests' ;; \ *) list='src doc tools tests' ;; \ esac; \ for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `install-recursive' gjgom@t51ldm02:~/tmp/stunnel-5.56$ Can you help me? Note: I´m install stunnel with a user no root, It affects? Regards

1 0

VerifyPeer = yes not working.
by Thomas Eifert 04 Feb '20

04 Feb '20

I'm running Stunnel 5.56 under Windows 10 v1909 x64. I have uncovered a case in which VerifyPeer = yes is not working. What's happening is that the locally installed certificate is old and expired, and does not match the current, up-to-date server certificate, yet Stunnel is letting it pass and verifying okay. I've pasted the certificates, config, and log below, and clearly the certificates are different. Regards, Thomas From my config file: debug = 7 delay = yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_LINGER=1:60 socket = r:SO_LINGER=1:60 [ircs.3] client = yes sslVersionMin = TLSv1.2 cafile = peer-ircs.3.pem verifyPeer = yes accept = 127.0.0.1:8909 connect = halcyon.il.us.dal.net:6697 From the Stunnel log: 2020.02.04 12:41:50 LOG5[9]: Service [ircs.3] connected remote server from 104.231.234.35:62290 2020.02.04 12:41:50 LOG7[9]: Setting remote socket options (FD=1012) 2020.02.04 12:41:50 LOG7[9]: Option SO_LINGER set on remote socket 2020.02.04 12:41:50 LOG7[9]: Option TCP_NODELAY set on remote socket 2020.02.04 12:41:50 LOG7[9]: Remote descriptor (FD=1012) initialized 2020.02.04 12:41:50 LOG6[9]: SNI: sending servername: halcyon.il.us.dal.net 2020.02.04 12:41:50 LOG6[9]: Peer certificate required 2020.02.04 12:41:50 LOG7[9]: TLS state (connect): before SSL initialization 2020.02.04 12:41:50 LOG7[9]: TLS state (connect): SSLv3/TLS write client hello 2020.02.04 12:41:50 LOG7[9]: TLS state (connect): SSLv3/TLS write client hello 2020.02.04 12:41:50 LOG7[9]: TLS state (connect): SSLv3/TLS read server hello 2020.02.04 12:41:50 LOG7[9]: TLS state (connect): TLSv1.3 read encrypted extensions 2020.02.04 12:41:50 LOG7[9]: Verification started at depth=1: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3 2020.02.04 12:41:50 LOG6[9]: CERT: Pre-verification error ignored: unable to get issuer certificate 2020.02.04 12:41:50 LOG6[9]: Certificate accepted at depth=1: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3 2020.02.04 12:41:50 LOG7[9]: Verification started at depth=0: CN=*.dal.net 2020.02.04 12:41:50 LOG7[9]: CERT: Pre-verification succeeded 2020.02.04 12:41:50 LOG6[9]: CERT: No subject checks configured 2020.02.04 12:41:50 LOG6[9]: CERT: Locally installed certificate matched 2020.02.04 12:41:50 LOG5[9]: Certificate accepted at depth=0: CN=*.dal.net Here is the locally installed certificate: -----BEGIN CERTIFICATE----- MIIFeDCCBGCgAwIBAgISA4aqIgapILZTQatLgMyS1gJ7MA0GCSqGSIb3DQEBCwUA MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xOTA2MDEwNDEzMjlaFw0x OTA4MzAwNDEzMjlaMBQxEjAQBgNVBAMMCSouZGFsLm5ldDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAKk+ZRY6Kr4GUS9hU+AUvgUrRzffLS4ScDNvk88F HXKe6Yx3oJnMJEGC9a5I9nJATcItOa+Xk6NKFIsGQZhFOTkV9xvbaEw2KZ14SIKK NsffEqZeQ/TUdMaHTeDXJxj1gfa+W9FK6uO1TzKrYQamdegXAv55F6KLeIPTjZj3 77AkdWuddimY3rp0gK/R1e2tkFtP/0ZeWuu1M736b6dtjXFIhzw3G8wurbGfBgfO TebZL3Kw0X5qOlyMQyOyXXUyRZMqgW7PMloGtGQ/PJKoTzqNmyWO93QB28PGHDm8 WgnSdwgXlTmVrL9Vwnzb5FIfcM1ba5nzqDGeg7tG5RcQEGkCAwEAAaOCAowwggKI MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw DAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUpVm+qZ/cdM/H1vr7emXvf14+/0AwHwYD VR0jBBgwFoAUqEpqYwR93brm0Tm3pkVl7/Oo7KEwbwYIKwYBBQUHAQEEYzBhMC4G CCsGAQUFBzABhiJodHRwOi8vb2NzcC5pbnQteDMubGV0c2VuY3J5cHQub3JnMC8G CCsGAQUFBzAChiNodHRwOi8vY2VydC5pbnQteDMubGV0c2VuY3J5cHQub3JnLzBD BgNVHREEPDA6ggkqLmRhbC5uZXSCDyouaWwudXMuZGFsLm5ldIIOKi5pcHY2LmRh bC5uZXSCDCoudXMuZGFsLm5ldDBMBgNVHSAERTBDMAgGBmeBDAECATA3BgsrBgEE AYLfEwEBATAoMCYGCCsGAQUFBwIBFhpodHRwOi8vY3BzLmxldHNlbmNyeXB0Lm9y ZzCCAQMGCisGAQQB1nkCBAIEgfQEgfEA7wB2AOJpS64m6OlACeiGG7Y7g9Q+5/50 iPukjyiTAZ3d8dv+AAABaxF1ApUAAAQDAEcwRQIgGvt1P3YI9iDIkicmKnWtdA4J vwiZqB6GoGQEBnFLQuECIQDUzbe30Y4kfobQTA0qLZ85jvNFDtRzbRd9wCPXwcqO uwB1ACk8UZZUyDlluqpQ/FgH1Ldvv1h6KXLcpMMM9OVFR/R4AAABaxF1ArgAAAQD AEYwRAIgQ/jYKgNmSMGEmyVgrVBClbEawnND/kPXIZx82My6ovYCIGctTKC5u6bJ J+zCRH5QrSKMF1lOtXDeNMgYlLx7JOKLMA0GCSqGSIb3DQEBCwUAA4IBAQAcxj0r mrqFY5KluKfki7LzlXLnYGDEnaTCX3WC4trR/zDsKwLT2z/ywWjQ5O/zKk/N1+ad 0Pk9DMe0jc/AmvYPgzII7rOYIv7FF/J8z4UKF0uuxjvwvAhXr/JDKvNMkOn3Rtrw agf0eu3xyXwUty6Iip0WfrSYHcy19OrXzwaSLdMdJ5hz9CY6D+7tLk0g2+xI7XnT D+gU1J+g291HfNJet2hzmJn/I7gUJdareqSI9HtXuHw1f+LcQflAhxaTPRGgm65F XpnF9tQvtRMJFWiIO9YSrKjq9gJaW3YlN7CTDzNqtjnA3+I8gT7jCqFHYAH3ZLMu 6fJy+BkrQctqjWWp -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8 SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0 Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj /PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/ wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6 KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg== -----END CERTIFICATE----- Here is the remote server certificate: -----BEGIN CERTIFICATE----- MIIFeTCCBGGgAwIBAgISBMC6zEv90htsFIzCbGOKGCpvMA0GCSqGSIb3DQEBCwUA MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0yMDAxMjgwNTIzMjFaFw0y MDA0MjcwNTIzMjFaMBQxEjAQBgNVBAMMCSouZGFsLm5ldDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAKk+ZRY6Kr4GUS9hU+AUvgUrRzffLS4ScDNvk88F HXKe6Yx3oJnMJEGC9a5I9nJATcItOa+Xk6NKFIsGQZhFOTkV9xvbaEw2KZ14SIKK NsffEqZeQ/TUdMaHTeDXJxj1gfa+W9FK6uO1TzKrYQamdegXAv55F6KLeIPTjZj3 77AkdWuddimY3rp0gK/R1e2tkFtP/0ZeWuu1M736b6dtjXFIhzw3G8wurbGfBgfO TebZL3Kw0X5qOlyMQyOyXXUyRZMqgW7PMloGtGQ/PJKoTzqNmyWO93QB28PGHDm8 WgnSdwgXlTmVrL9Vwnzb5FIfcM1ba5nzqDGeg7tG5RcQEGkCAwEAAaOCAo0wggKJ MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw DAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUpVm+qZ/cdM/H1vr7emXvf14+/0AwHwYD VR0jBBgwFoAUqEpqYwR93brm0Tm3pkVl7/Oo7KEwbwYIKwYBBQUHAQEEYzBhMC4G CCsGAQUFBzABhiJodHRwOi8vb2NzcC5pbnQteDMubGV0c2VuY3J5cHQub3JnMC8G CCsGAQUFBzAChiNodHRwOi8vY2VydC5pbnQteDMubGV0c2VuY3J5cHQub3JnLzBD BgNVHREEPDA6ggkqLmRhbC5uZXSCDyouaWwudXMuZGFsLm5ldIIOKi5pcHY2LmRh bC5uZXSCDCoudXMuZGFsLm5ldDBMBgNVHSAERTBDMAgGBmeBDAECATA3BgsrBgEE AYLfEwEBATAoMCYGCCsGAQUFBwIBFhpodHRwOi8vY3BzLmxldHNlbmNyeXB0Lm9y ZzCCAQQGCisGAQQB1nkCBAIEgfUEgfIA8AB3ALIeBcyLos2KIE6HZvkruYolIGdr 2vpw57JJUy3vi5BeAAABb+rRlmkAAAQDAEgwRgIhAOG8C3vcxqEvj3TSqe7Y7peQ OInmtrkR0eQ9OFLVUIeUAiEAp0ONBILMiR2i0dVimSXFJv9NJDa3wi3tt3bRF5OO eDMAdQBvU3asMfAxGdiZAKRRFf93FRwR2QLBACkGjbIImjfZEwAAAW/q0ZafAAAE AwBGMEQCIBxS2C2cCPWFKKzof8BduUN6UFiWnyoRqAGAMG36IgylAiBjFDiXnuJs bVorvhguH6J9+YcPC36yFohKBCh+V7M0nzANBgkqhkiG9w0BAQsFAAOCAQEAnDE3 p/uxes7SKdspdwIhsC4Jwn3ulm4sGcbhJVBRWyYxp7ucGJdy/PxcEfb/CD5sszbw 9hsM56B7gno8ts/yNGvpceIoGEa7oK4AycEeWfapp5M9s11HyE06HwDfTA7wc1Kv g+PkHmbqZkLziN+UdPIlRm8dSljusvsNY1cMGRt5fszMJ5+gOaC3gj2AB6+aGIeN cwwNX3BlX10v88I3OUAkDWNlmPERA5BXo88ucZ75SwRZg7H8s66wdMYFi2LvbTHV GsXyDPVKnyViBtGCNI14UEmTDjUiHmqtzjqK2BTpSzNGYXjuPe1Zz0VIZDERPWin YxseV8k6nrZgr51Eag== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8 SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0 Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj /PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/ wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6 KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg== -----END CERTIFICATE----- -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

performance check list
by Howard, William 23 Jan '20

23 Jan '20

Is there a check list for implementation of stunnel on RHEL 7

1 0

stunnel AIX lastest version
by Erick Alejandro Tovar Rebollo 23 Jan '20

23 Jan '20

Hi. I need to download the latest version of stunnel for AIX, but I can´t find that I have the 7.1 AIX version Can you help me? Regards.

1 0

Connection reset: (maybe the wrong forum)
by Per Gunnarsson 15 Jan '20

15 Jan '20

Hello! I have tried to stream to an icecast server through stunnel usung liquidsoap. Somewhere the stream gets stuck. I want to where. Maybe I should have posted this on the Tor mailing list first, since the traffic is forwarded through Tor. But before the stream went to Tor, it went through stunnel. The liquidsoap snippet which tries to stream (password,mount name, stream description and stream name modified: output.external(id="Tor", fallible=true, reopen_delay=3.0, %vorbis(quality=0.4 , samplerate=48000, channels=2), "/usr/bin/oggfwd -n streamname -d 'stream description' localhost 9887 password /mount", mksafe(buffer(full))) I had a script which was supposed to pick up this stream and forward it on a cloud server (passwords etc. modified): #!/bin/bash /usr/bin/curl -V http://localhost:9887/mount | \ /usr/bin/torsocks /usr/bin/oggfwd -n streamname -d 'stream description' superdupersecret.onion 8000 password /mount #/usr/bin/curl -T - -s --socks5 localhost:9050 http://superdupersecret.onion/mount exec "/home/per/bin/test.sh" stunnel.conf on cloud: setuid = stunnel4 setgid = stunnel4 ; PID file is created inside the chroot jail (if enabled) pid = /var/run/stunnel4/stunnel.pid ; Debugging stuff (may be useful for troubleshooting) ;foreground = yes debug = info output = /var/log/stunnel4/stunnel.log [liquidsoap-client] client = yes accept = localhost:8081 connect = mustafejen.se:9998 PSKsecrets = /etc/stunnel/secrets.txt [hequidtor-client] connect = localhost:9050 accept = 95.216.184.255:9888 PSKsecrets = /etc/stunnel/secrets.txt [Deep Web Radio In] client = yes accept = 95.216.184.255:9887 connect = localhost:9050 PSKsecrets = /etc/stunnel/secrets.txt stunnel.conf in my living room: setuid = stunnel4 setgid = stunnel4 ; PID file is created inside the chroot jail (if enabled) pid = /var/run/stunnel4/stunnel.pid ; Debugging stuff (may be useful for troubleshooting) ;foreground = yes debug = info output = /var/log/stunnel4/stunnel.log [liquidsoap-server] ;client = yes connect = mustafejen.se:8081 accept = mustafejen.se:9998 PSKsecrets = /etc/stunnel/secrets.txt [hequidtor-server] client = yes accept = localhost:9888 connect = 95.216.184.255:9888 PSKsecrets = /etc/stunnel/secrets.txt [Deep Web Radio Out] accept = localhost:9887 connect = 95.216.184.255:9887 PSKsecrets = /etc/stunnel/secrets.txt Log file from cloud: 2020.01.15 06:25:01 LOG5[main]: Log file reopened 2020.01.15 10:29:22 LOG5[main]: Terminated 2020.01.15 10:29:22 LOG5[ui]: stunnel 5.44 on x86_64-pc-linux-gnu platform 2020.01.15 10:29:22 LOG5[ui]: Compiled with OpenSSL 1.1.0g 2 Nov 2017 2020.01.15 10:29:22 LOG5[ui]: Running with OpenSSL 1.1.1 11 Sep 2018 2020.01.15 10:29:22 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2020.01.15 10:29:22 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2020.01.15 10:29:22 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2020.01.15 10:29:22 LOG5[ui]: UTF-8 byte order mark detected 2020.01.15 10:29:22 LOG5[ui]: FIPS mode disabled 2020.01.15 10:29:22 LOG6[ui]: Initializing service [liquidsoap-client] 2020.01.15 10:29:23 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:29:23 LOG6[ui]: Initializing service [hequidtor-client] 2020.01.15 10:29:23 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:29:23 LOG6[ui]: Using dynamic DH parameters 2020.01.15 10:29:23 LOG6[ui]: Initializing service [Deep Web Radio In] 2020.01.15 10:29:23 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:29:23 LOG5[ui]: Configuration successful Log file from my living room: 2020.01.15 10:20:13 LOG5[ui]: stunnel 5.56 on x86_64-pc-linux-gnu platform 2020.01.15 10:20:13 LOG5[ui]: Compiled/running with OpenSSL 1.1.1d 10 Sep 2019 2020.01.15 10:20:13 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2020.01.15 10:20:13 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2020.01.15 10:20:13 LOG5[ui]: UTF-8 byte order mark detected 2020.01.15 10:20:13 LOG5[ui]: FIPS mode disabled 2020.01.15 10:20:13 LOG6[ui]: PSKsecrets line 1: 40-byte ASCII key configured for identity "per" 2020.01.15 10:20:13 LOG6[ui]: Initializing service [liquidsoap-server] 2020.01.15 10:20:13 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:20:13 LOG6[ui]: DH initialization not needed 2020.01.15 10:20:13 LOG6[ui]: PSKsecrets line 1: 40-byte ASCII key configured for identity "per" 2020.01.15 10:20:13 LOG6[ui]: Initializing service [hequidtor-server] 2020.01.15 10:20:13 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:20:13 LOG6[ui]: PSKsecrets line 1: 40-byte ASCII key configured for identity "per" 2020.01.15 10:20:13 LOG6[ui]: Initializing service [Deep Web Radio Out] 2020.01.15 10:20:13 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:20:13 LOG6[ui]: DH initialization not needed 2020.01.15 10:20:13 LOG5[ui]: Configuration successful 2020.01.15 10:20:13 LOG6[ui]: Service [liquidsoap-server] (FD=9) bound to 10.0.0.6:9998 2020.01.15 10:20:13 LOG6[ui]: Service [hequidtor-server] (FD=10) bound to ::1:9888 2020.01.15 10:20:13 LOG6[ui]: Service [hequidtor-server] (FD=11) bound to 127.0.0.1:9888 2020.01.15 10:20:13 LOG6[ui]: Service [Deep Web Radio Out] (FD=12) bound to ::1:9887 2020.01.15 10:20:13 LOG6[ui]: Service [Deep Web Radio Out] (FD=13) bound to 127.0.0.1:9887 2020.01.15 10:20:13 LOG6[cron]: Executing cron jobs 2020.01.15 10:20:13 LOG6[cron]: Cron jobs completed in 0 seconds 2020.01.15 10:32:56 LOG5[0]: Service [Deep Web Radio Out] accepted connection from ::1:44732 2020.01.15 10:32:56 LOG6[0]: Peer certificate not required 2020.01.15 10:32:56 LOG3[0]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 10:32:56 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:32:56 LOG5[1]: Service [Deep Web Radio Out] accepted connection from ::1:44734 2020.01.15 10:32:56 LOG6[1]: Peer certificate not required 2020.01.15 10:32:56 LOG3[1]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 10:32:56 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:32:56 LOG5[2]: Service [Deep Web Radio Out] accepted connection from ::1:44736 2020.01.15 10:32:56 LOG6[2]: Peer certificate not required 2020.01.15 10:32:56 LOG3[2]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 10:32:56 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:33:44 LOG5[3]: Service [Deep Web Radio Out] accepted connection from ::1:44760 2020.01.15 10:33:44 LOG6[3]: Peer certificate not required 2020.01.15 10:33:44 LOG3[3]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 10:33:44 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:33:44 LOG5[4]: Service [Deep Web Radio Out] accepted connection from ::1:44762 2020.01.15 10:33:44 LOG6[4]: Peer certificate not required 2020.01.15 10:33:44 LOG3[4]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 10:33:44 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:33:44 LOG5[5]: Service [Deep Web Radio Out] accepted connection from ::1:44764 2020.01.15 10:33:44 LOG6[5]: Peer certificate not required 2020.01.15 10:33:44 LOG3[5]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 10:33:44 LOG5[5]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:34:50 LOG5[6]: Service [Deep Web Radio Out] accepted connection from ::1:44788 2020.01.15 10:34:50 LOG6[6]: Peer certificate not required 2020.01.15 10:34:50 LOG3[6]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 10:34:50 LOG5[6]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:34:50 LOG5[7]: Service [Deep Web Radio Out] accepted connection from ::1:44790 2020.01.15 10:34:50 LOG6[7]: Peer certificate not required 2020.01.15 10:34:50 LOG3[7]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 10:34:50 LOG5[7]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:34:50 LOG5[8]: Service [Deep Web Radio Out] accepted connection from ::1:44792 2020.01.15 10:34:50 LOG6[8]: Peer certificate not required 2020.01.15 10:34:50 LOG3[8]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 10:34:50 LOG5[8]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:48:17 LOG5[9]: Service [Deep Web Radio Out] accepted connection from ::1:44854 2020.01.15 10:48:17 LOG6[9]: Peer certificate not required 2020.01.15 10:48:17 LOG3[9]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:48:17 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:48:17 LOG5[10]: Service [Deep Web Radio Out] accepted connection from ::1:44856 2020.01.15 10:48:17 LOG6[10]: Peer certificate not required 2020.01.15 10:48:17 LOG3[10]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:48:17 LOG5[10]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:48:32 LOG5[11]: Service [Deep Web Radio Out] accepted connection from ::1:44858 2020.01.15 10:48:32 LOG6[11]: Peer certificate not required 2020.01.15 10:48:32 LOG3[11]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:48:32 LOG5[11]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:48:32 LOG5[12]: Service [Deep Web Radio Out] accepted connection from ::1:44860 2020.01.15 10:48:32 LOG6[12]: Peer certificate not required 2020.01.15 10:48:32 LOG3[12]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:48:32 LOG5[12]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:49:01 LOG5[13]: Service [Deep Web Radio Out] accepted connection from ::1:44864 2020.01.15 10:49:01 LOG6[13]: Peer certificate not required 2020.01.15 10:49:01 LOG3[13]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:49:01 LOG5[13]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:49:01 LOG5[14]: Service [Deep Web Radio Out] accepted connection from ::1:44866 2020.01.15 10:49:01 LOG6[14]: Peer certificate not required 2020.01.15 10:49:01 LOG3[14]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:49:01 LOG5[14]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:57:28 LOG5[15]: Service [Deep Web Radio Out] accepted connection from ::1:44914 2020.01.15 10:57:28 LOG6[15]: Peer certificate not required 2020.01.15 10:57:28 LOG3[15]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 10:57:28 LOG5[15]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:57:28 LOG5[16]: Service [Deep Web Radio Out] accepted connection from ::1:44916 2020.01.15 10:57:28 LOG6[16]: Peer certificate not required 2020.01.15 10:57:28 LOG3[16]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 10:57:28 LOG5[16]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:57:28 LOG5[17]: Service [Deep Web Radio Out] accepted connection from ::1:44918 2020.01.15 10:57:28 LOG6[17]: Peer certificate not required 2020.01.15 10:57:28 LOG3[17]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 10:57:28 LOG5[17]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:24:24 LOG5[18]: Service [Deep Web Radio Out] accepted connection from ::1:45012 2020.01.15 11:24:24 LOG6[18]: Peer certificate not required 2020.01.15 11:24:24 LOG3[18]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:24:24 LOG5[18]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:24:24 LOG5[19]: Service [Deep Web Radio Out] accepted connection from ::1:45014 2020.01.15 11:24:24 LOG6[19]: Peer certificate not required 2020.01.15 11:24:24 LOG3[19]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:24:24 LOG5[19]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:24:24 LOG5[20]: Service [Deep Web Radio Out] accepted connection from ::1:45016 2020.01.15 11:24:24 LOG6[20]: Peer certificate not required 2020.01.15 11:24:24 LOG3[20]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:24:24 LOG5[20]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:25:16 LOG5[21]: Service [Deep Web Radio Out] accepted connection from ::1:45038 2020.01.15 11:25:16 LOG6[21]: Peer certificate not required 2020.01.15 11:25:16 LOG3[21]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:25:16 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:25:16 LOG5[22]: Service [Deep Web Radio Out] accepted connection from ::1:45040 2020.01.15 11:25:16 LOG6[22]: Peer certificate not required 2020.01.15 11:25:16 LOG3[22]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:25:16 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:25:16 LOG5[23]: Service [Deep Web Radio Out] accepted connection from ::1:45042 2020.01.15 11:25:16 LOG6[23]: Peer certificate not required 2020.01.15 11:25:16 LOG3[23]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:25:16 LOG5[23]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:28:38 LOG5[24]: Service [Deep Web Radio Out] accepted connection from ::1:45070 2020.01.15 11:28:38 LOG6[24]: Peer certificate not required 2020.01.15 11:28:38 LOG3[24]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:28:38 LOG5[24]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:28:38 LOG5[25]: Service [Deep Web Radio Out] accepted connection from ::1:45072 2020.01.15 11:28:38 LOG6[25]: Peer certificate not required 2020.01.15 11:28:38 LOG3[25]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:28:38 LOG5[25]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:28:38 LOG5[26]: Service [Deep Web Radio Out] accepted connection from ::1:45074 2020.01.15 11:28:38 LOG6[26]: Peer certificate not required 2020.01.15 11:28:38 LOG3[26]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:28:38 LOG5[26]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:30:06 LOG5[27]: Service [Deep Web Radio Out] accepted connection from ::1:45096 2020.01.15 11:30:06 LOG6[27]: Peer certificate not required 2020.01.15 11:30:06 LOG3[27]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:30:06 LOG5[27]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:30:06 LOG5[28]: Service [Deep Web Radio Out] accepted connection from ::1:45098 2020.01.15 11:30:06 LOG6[28]: Peer certificate not required 2020.01.15 11:30:06 LOG3[28]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:30:06 LOG5[28]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:30:06 LOG5[29]: Service [Deep Web Radio Out] accepted connection from ::1:45100 2020.01.15 11:30:06 LOG6[29]: Peer certificate not required 2020.01.15 11:30:06 LOG3[29]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:30:06 LOG5[29]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:32:34 LOG5[30]: Service [Deep Web Radio Out] accepted connection from ::1:45136 2020.01.15 11:32:34 LOG6[30]: Peer certificate not required 2020.01.15 11:32:34 LOG3[30]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:32:34 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:32:34 LOG5[31]: Service [Deep Web Radio Out] accepted connection from ::1:45138 2020.01.15 11:32:34 LOG6[31]: Peer certificate not required 2020.01.15 11:32:34 LOG3[31]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:32:34 LOG5[31]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:32:34 LOG5[32]: Service [Deep Web Radio Out] accepted connection from ::1:45140 2020.01.15 11:32:34 LOG6[32]: Peer certificate not required 2020.01.15 11:32:34 LOG3[32]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:32:34 LOG5[32]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

1 0

stunnel5 to stunnel4 not work
by Tu, Robin 15 Jan '20

15 Jan '20

I'm working on openvpn over stunnel. My configuration can work with windows and linux. both are stunnel4. But it never work out in android. I have ubuntu18.04 and set as stunnel4 server side. I try to get connected with android stunnel: SSLSocks<https://github.com/comp500/SSLSocks/releases/tag/0.0.17-beta>, which should be compiled with stunnel5. It simply not work. I got "NETWORK_EOF_ERROR" time to time. If I remove stunnel tunnel, it will just work. So I think it's stunnel5 to stunnel4 issue. But how to avaoid such issue? Best Regards Robin

1 0

How to start stunnel4 service directly after installation, without reboot
by Tu, Robin 15 Jan '20

15 Jan '20

I'm testing openvpn over stunnel4 and I found a weird issue: I have to restart my Ubuntu 18.04 to be able to start the stunnel service. Don't know why I couldn't start the service dicrectly by : Systemctl start stunnel4 OS: Ubuntu 18.04 #>apt install stunnel4 and generate a conf like this: cert=/etc/stunnel/server.crt key=/etc/stunnel/server.key [openvpn-localhost] accept = 8443 connect = 127.0.0.1:11000 Now start the service: #>systemctl start stunnel4 #>systemctl status stunnel4 stunnel4.service - LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons) Loaded: loaded (/etc/init.d/stunnel4; generated) Active: active (exited) since Wed 2020-01-15 14:40:11 CST; 10min ago Docs: man:systemd-sysv-generator(8) Tasks: 0 (limit: 4915) CGroup: /system.slice/stunnel4.service Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ systemd[1]: Starting LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)... Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ stunnel4[3583]: TLS tunnels disabled, see /etc/default/stunnel4 Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ systemd[1]: Started LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons). Why it exited? But after reboot, same command will just work. Is it a bug? I want to find a way to start it directly after installation. Please help! Best Regards Robin

1 0

Cannot stop pcs cluster service when stunnel server process start
by d500man 09 Jan '20

09 Jan '20

Dear Support, For captioned, I adopted stunnel server and client socket protection in pcs cluster. I want to stop pacemaker cluster service by command "pcs cluster stop --all" and stop master node in master node servet but the down process is hang up when stunnel server process started, could you help to tell me what's problem and how to fix this problem? Best regards Tony

1 0

stunnel4-5.50 start failed
by Hanhan lee 27 Dec '19

27 Dec '19

I compiled stunnel4-5.50 with openssl 1.1.1d. When I run stunnel, it will print some messages and stop: [ ] Clients allowed=500 [.] stunnel 5.50 on arm-none-linux-gnueabi platform [.] Compiled/running with OpenSSL 1.1.1d 10 Sep 2019 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /conf/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [adviserd] [ ] Ciphers: AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM [ ] TLS options: 0x02104004 (+0x00004000, -0x00000000) [ ] Loading certificate from file: /conf/certs/server.pem [ ] Certificate loaded from file: /conf/certs/server.pem [ ] Loading private key from file: /conf/certs/privkey.pem [:] Insecure file permissions on /conf/certs/privkey.pem [ ] Private key loaded from file: /conf/certs/privkey.pem [ ] Private key check succeeded [ ] DH initialization needed for DHE-PSK-CHACHA20-POLY1305 [ ] DH initialization [ ] Could not load DH parameters from /conf/certs/server.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [.] Configuration successful [ ] Binding service [adviserd] [ ] Listening file descriptor created (FD=8) [ ] Setting accept socket options (FD=8) [ ] Option SO_REUSEADDR set on accept socket [ ] Option TCP_NODELAY set on accept socket [ ] Service [adviserd] (FD=8) bound to :::7582 [!] Cannot open log file: /var/log/stunnel.log [ ] Deallocating section defaults [ ] Unbinding service [adviserd] [ ] Service [adviserd] closed (FD=8) [ ] Service [adviserd] closed [ ] Deallocating section [adviserd] I have no idea what's wrong with this, help! Many thanks

3 2

Re: [stunnel-users] My home ISP blocking ssh protocol
by Eric Eberhard 13 Dec '19

13 Dec '19

Ditto. Eric -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Mike Sent: Thursday, December 12, 2019 9:08 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] My home ISP blocking ssh protocol On 12/11/2019 5:53 PM, Matt Thomas wrote: > Hello:) > >[snip > > All i am trying to do is have a SFTP server that i can access my dang >files from while i am at school, work, friends house, library or >wherever. >[snip] I run a ssh server on my home network. I configure it to use a port other than port 22. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel-5.55 client close TLS socket before it could read more bytes
by Ming Lu 13 Dec '19

13 Dec '19

Hello, May I please have help on this issue? Thanks in advance! I had a stunnel server and client communicating with TLSv1.2 (both of them are stunnel 5.55 and OpenSSL-1.1.1d) on CentOS 7 based Linux (kernel was updated as 4.19.0). The case is that client sends a HTTP request to server, and then server responds a payload with more than 640KB size. Normally, the server will close the connection by sending an alert firstly. The issue is that sometimes (not 100% reproducible), stunnel client reported: "TLS socket closed (read hangup)". and then closed the TLS socket. So I could find an alert sent from client to server firstly from tcpdump. Consequently, this caused the application reported "unexpected end of input?" as there should be more data to be received. I added a few debug logic and I indeed found that: there were occurrences that if stunnel client did not close the TLS socket, it could read more data from TLS socket in next poll loop: -------------------- 03:59:46 localhost stunnel: LOG6[0]: MingL: POLLRDHUP: 8192 03:59:46 localhost stunnel: LOG6[0]: MingL: ioctlsocket: 0 03:59:46 localhost stunnel: LOG6[0]: MingL: bytes: 0 <== client didn't close the sock in my debug version. 03:59:46 localhost stunnel: LOG6[0]: MingL: after checking 03:59:46 localhost stunnel: LOG6[0]: MingL: s_poll_wait: return 1 03:59:46 localhost stunnel: LOG6[0]: MingL: sock_can_rd: n 03:59:46 localhost stunnel: LOG6[0]: MingL: sock_can_wr: Y 03:59:46 localhost stunnel: LOG6[0]: MingL: ssl_can_rd: n 03:59:46 localhost stunnel: LOG6[0]: MingL: ssl_can_wr: n 03:59:46 localhost stunnel: LOG6[0]: MingL: pending: 1 03:59:46 localhost stunnel: LOG6[0]: MingL: write to sock 18432 03:59:46 localhost stunnel: LOG6[0]: MingL: read_wants_read Y 03:59:46 localhost stunnel: LOG6[0]: MingL: write_wants_writen 03:59:46 localhost stunnel: LOG6[0]: MingL: read from TLS 10168 <== then I observed the further read from TLS. -------------------- Any help will be appreciated! Ming

1 0

Re: [stunnel-users] My home ISP blocking ssh protocol
by Christopher Schultz 12 Dec '19

12 Dec '19

Matt, On 12/12/19 13:43, Matt Thomas wrote: > Not sure if you have read the first post, or maybe i didnt add it, but i > have tried port 22,5022,8022, 25565, 47506 and 443 haha. It wasn't clear if you were changing the port number of the sshd service (on your server) or the port you had open on your firewall/router. I suspect that your ISP is blocking incoming connections to port 22. The port number you use for sshd on the server is not relevant. -chris > On Thu, Dec 12, 2019, 9:44 AM Christopher Schultz > <chris(a)christopherschultz.net <mailto:chris@christopherschultz.net>> wrote: > > Matt, > > On 12/12/19 11:01, Matt Thomas wrote: > > Server is 192.168.0.10 > > Router is 192.168.0.1 > > > > It works fine internally:) > > > > I add a port forward in the router for port 22 pointed at .0.10. > Routers > > firewall all ready is configured to accept ssh on port 22 from any > any. > > > > When ever anyone attempts to connect to the server, a pop up shows > on my > > screen. When i try to have my friends or co-workers try from there > house > > or i try from public place, no pop up or hits on the server log. Just > > times out. > > > > But if i put minecraft on port 22, it works. So certain traffic is > > making it through. Even hamachi vpn works fine BUT i cant install that > > on public PC's haha > > I was about to say "this is clearly an issue with the port number, pick > something other than 22" but if you say you can run Minecraft over port > 22, then that's ... strange. > > I wasn't aware that Minecraft servers could have their ports changed > like that. You can really set up your Minecraft server to listen on > localhost:22 and it doesn't use UPnP or anything like that to > reconfigure your firewall/router? > > My advice is to try configuring things like this: > > Router: 192.168.0.1 > Forward WAN connections to port e.g. 1022 -> 192.168.0.10:1022 > <http://192.168.0.10:1022> > > Server: 192.68.0.1 > Accept stunnel connections on port 1022 > accept=:1022 > connect=localhost:22 > > If that works, I might even try just changing the port number of your > ssh/sftp service from the "standard" port to something else and trying > again without stunnel in the mix. > > I've never encountered an ISP which does deep packet inspection to block > services. They usually just block ports. > > -chris > > > On Thu, Dec 12, 2019, 7:58 AM Christopher Schultz > > <chris(a)christopherschultz.net > <mailto:chris@christopherschultz.net> > <mailto:chris@christopherschultz.net > <mailto:chris@christopherschultz.net>>> wrote: > > > > Matt, > > > > On 12/11/19 17:53, Matt Thomas wrote: > > > I need to know if Stunnel is going to accomplish what i need > to do. My > > > home ISP blocks protocol HTTP and SSH from coming in so that > > people cant > > > run their own website from home without paying the ISP for a > > "Business" line > > > > > > All i am trying to do is have a SFTP server that i can > access my dang > > > files from while i am at school, work, friends house, library or > > > wherever. I have tried ssh on multiple random ports and made > sure all > > > firewall rules and port forward rules were correct in my home > > router. I > > > know they work because i even went as far as setting up a > minecraft > > > server to just test the port forward rules out and sure > enough, my > > > friend 200 miles away can connect just fine to my home minecraft > > > server.. But he can not connect to the ssh server. No logs > are ever > > > created on the server either because something is stoping > the packet > > > from even hitting my router, that something is my ISP > > > > > > Would stunnel allow me to make ssh traffic look like regular > https > > > traffic, thus allowing me to connect to my server at home so > i can > > do my > > > homework?? > > > > Those other servers probably use TLS or plaintext connections. > stunnel > > uses TLS, but ssh/sftp use a slightly different protocol that may > > possibly be distinguishable by a determined ISP. > > > > I would think that using stunnel to tunnel SFTP/SSH would be > possible, > > though not strictly necessary. I suspect some other problem is > > preventing you from succeeding. > > > > Can you be more specific about exactly what you did for > configuration? > > Port numbers, specific things you did, etc? You don't have to > disclose > > your public IP address, but perhaps give the local IPs of your > router > > and home server, etc? > > > > -chris > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> > <mailto:stunnel-users@stunnel.org <mailto:stunnel-users@stunnel.org>> > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

Re: [stunnel-users] My home ISP blocking ssh protocol
by Christopher Schultz 12 Dec '19

12 Dec '19

Matt, On 12/12/19 11:01, Matt Thomas wrote: > Server is 192.168.0.10 > Router is 192.168.0.1 > > It works fine internally:) > > I add a port forward in the router for port 22 pointed at .0.10. Routers > firewall all ready is configured to accept ssh on port 22 from any any. > > When ever anyone attempts to connect to the server, a pop up shows on my > screen. When i try to have my friends or co-workers try from there house > or i try from public place, no pop up or hits on the server log. Just > times out. > > But if i put minecraft on port 22, it works. So certain traffic is > making it through. Even hamachi vpn works fine BUT i cant install that > on public PC's haha I was about to say "this is clearly an issue with the port number, pick something other than 22" but if you say you can run Minecraft over port 22, then that's ... strange. I wasn't aware that Minecraft servers could have their ports changed like that. You can really set up your Minecraft server to listen on localhost:22 and it doesn't use UPnP or anything like that to reconfigure your firewall/router? My advice is to try configuring things like this: Router: 192.168.0.1 Forward WAN connections to port e.g. 1022 -> 192.168.0.10:1022 Server: 192.68.0.1 Accept stunnel connections on port 1022 accept=:1022 connect=localhost:22 If that works, I might even try just changing the port number of your ssh/sftp service from the "standard" port to something else and trying again without stunnel in the mix. I've never encountered an ISP which does deep packet inspection to block services. They usually just block ports. -chris > On Thu, Dec 12, 2019, 7:58 AM Christopher Schultz > <chris(a)christopherschultz.net <mailto:chris@christopherschultz.net>> wrote: > > Matt, > > On 12/11/19 17:53, Matt Thomas wrote: > > I need to know if Stunnel is going to accomplish what i need to do. My > > home ISP blocks protocol HTTP and SSH from coming in so that > people cant > > run their own website from home without paying the ISP for a > "Business" line > > > > All i am trying to do is have a SFTP server that i can access my dang > > files from while i am at school, work, friends house, library or > > wherever. I have tried ssh on multiple random ports and made sure all > > firewall rules and port forward rules were correct in my home > router. I > > know they work because i even went as far as setting up a minecraft > > server to just test the port forward rules out and sure enough, my > > friend 200 miles away can connect just fine to my home minecraft > > server.. But he can not connect to the ssh server. No logs are ever > > created on the server either because something is stoping the packet > > from even hitting my router, that something is my ISP > > > > Would stunnel allow me to make ssh traffic look like regular https > > traffic, thus allowing me to connect to my server at home so i can > do my > > homework?? > > Those other servers probably use TLS or plaintext connections. stunnel > uses TLS, but ssh/sftp use a slightly different protocol that may > possibly be distinguishable by a determined ISP. > > I would think that using stunnel to tunnel SFTP/SSH would be possible, > though not strictly necessary. I suspect some other problem is > preventing you from succeeding. > > Can you be more specific about exactly what you did for configuration? > Port numbers, specific things you did, etc? You don't have to disclose > your public IP address, but perhaps give the local IPs of your router > and home server, etc? > > -chris > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

My home ISP blocking ssh protocol
by Matt Thomas 12 Dec '19

12 Dec '19

Hello:) I need to know if Stunnel is going to accomplish what i need to do. My home ISP blocks protocol HTTP and SSH from coming in so that people cant run their own website from home without paying the ISP for a "Business" line All i am trying to do is have a SFTP server that i can access my dang files from while i am at school, work, friends house, library or wherever. I have tried ssh on multiple random ports and made sure all firewall rules and port forward rules were correct in my home router. I know they work because i even went as far as setting up a minecraft server to just test the port forward rules out and sure enough, my friend 200 miles away can connect just fine to my home minecraft server.. But he can not connect to the ssh server. No logs are ever created on the server either because something is stoping the packet from even hitting my router, that something is my ISP Would stunnel allow me to make ssh traffic look like regular https traffic, thus allowing me to connect to my server at home so i can do my homework?? thanks -- My history test question: Give the number of automobiles produced in America during the year of your choice. My answer? 1806: none Matt Thomas GrillofMyDreams.blogspot.com http://slcc.biz.tm

3 2

Re: [stunnel-users] My home ISP blocking ssh protocol
by pepak＠seznam.cz 12 Dec '19

12 Dec '19

Hi! > I need to know if Stunnel is going to accomplish what i need to do. My home > ISP blocks protocol HTTP and SSH from coming in so that people cant run > their own website from home without paying the ISP for a "Business" line [...] > Would stunnel allow me to make ssh traffic look like regular https traffic, > thus allowing me to connect to my server at home so i can do my homework?? Well, yes and no: Yes: Your SSH traffic will be wrapped in the standard TLS protocol, which would make it impossible for the ISP to determine what's inside. They wouldn't be able to determine the actual contents of the traffic, although they could make good guesses based on the packet metadata (direction, size, frequency, time between packets, etc.). But they won't be able to scan packet headers and determine that "hey, this is SSH, let's block it!". No: Part of the answer lies above: using statistical methods, it may be possible to distinguish SSH from something else. The other part lies in the fact that the ISP doesn't really have to do it - if they feel like it, they could e.g. block all incoming traffic unless it is a response to a prior outgoing traffic, or block all incoming traffic unless it can be determined that it is one of a selected few permitted protocols. Likely you won't run into the "No" part of the answer, and in that case Stunnel will serve nicely (I use it in this scenario, myself). But you might. In that case, you may want to use something like TCP/IP Gender Changer (which basically creates a tunnel with reverse directions), either alone or in combination with Stunnel. Pepak

1 0

updated patch for Start TLS for LDAP clients (RFC 2830)
by Seth Grover 10 Dec '19

10 Dec '19

Back in 2013 Bart Dopheide submitted a patch to the mailing list to add LDAP StartTLS (elevate connection to TLS after initial connection is initiated) support to the list of supported protocols in protocol.c ( https://www.stunnel.org/pipermail/stunnel-users/2013-November/004437.html). It doesn't look like this patch was ever accepted into stunnel. I've run into a similar requirement and have updated the patch to work against stunnel 5.56. In addition, there are a few other minor changes, the most significant being as follows. It would appear that Windows Active Directory servers do not implement the ldap extended response PDU in the same way as OpenLDAP (see this thread: https://www.openldap.org/lists/openldap-software/200401/msg00800.html). With this patch you can specify either "protocol = winldap" or "protocol = openldap" and have it work either way. I haven't modified the logic of Bart's original patch as far as OpenLDAP goes, but I have split the code path where applicable to handle the Windows case. I am testing this against a virtual Windows Server 2016 Active Directory instance with self-signed certificates with the following config: [stunnel.winldap] client = yes accept = localhost:3268 connect =mymachine.example.com:3268 protocol = winldap And the following ldapsearch command: LDAPTLS_REQCERT=never ldapsearch -Z -h localhost -p 3268 -D "nginx_bind_dn(a)localdomain.lan" -W -b "dc=localdomain,dc=lan" -s sub "objectClass=person" The ldapsearch output returns as expected and I can see in wireshark that the LDAP_START_TLS_OID request/response happens as it should. The patch is at the end of this message. -SG diff -Nurp a/src/protocol.c b/src/protocol.c --- a/src/protocol.c 2019-05-15 13:35:16.000000000 -0600 +++ b/src/protocol.c 2019-12-03 13:54:47.536940900 -0700 @@ -64,6 +64,8 @@ NOEXPORT char *pop3_server(CLI *, SERVIC NOEXPORT char *imap_client(CLI *, SERVICE_OPTIONS *, const PHASE); NOEXPORT char *imap_server(CLI *, SERVICE_OPTIONS *, const PHASE); NOEXPORT char *nntp_client(CLI *, SERVICE_OPTIONS *, const PHASE); +NOEXPORT char *openldap_client(CLI *, SERVICE_OPTIONS *, const PHASE); +NOEXPORT char *winldap_client(CLI *, SERVICE_OPTIONS *, const PHASE); NOEXPORT char *connect_server(CLI *, SERVICE_OPTIONS *, const PHASE); NOEXPORT char *connect_client(CLI *, SERVICE_OPTIONS *, const PHASE); #ifndef OPENSSL_NO_MD4 @@ -113,6 +115,14 @@ char *protocol(CLI *c, SERVICE_OPTIONS * return opt->option.client ? nntp_client(c, opt, phase) : "The 'nntp' protocol is not supported in the server mode"; + if(!strcasecmp(opt->protocol, "openldap")) + return opt->option.client ? + openldap_client(c, opt, phase) : + "The 'openldap' protocol is not supported in the server mode"; + if(!strcasecmp(opt->protocol, "winldap")) + return opt->option.client ? + winldap_client(c, opt, phase) : + "The 'winldap' protocol is not supported in the server mode"; if(!strcasecmp(opt->protocol, "connect")) return opt->option.client ? connect_client(c, opt, phase) : @@ -1119,6 +1129,182 @@ NOEXPORT char *nntp_client(CLI *c, SERVI return NULL; } +/**************************************** LDAP, RFC 2830 */ +uint8_t ldap_startssl_message[0x1d + 2] = +{ + 0x30, /* tag = UNIVERSAL SEQUENCE */ + 0x1d, /* len = 29 (the remaining number of bytes in this message) */ + 0x02, /* messageID */ + 0x01, /* len = 1 */ + 0x01, /* value = 1 (this is messageID 1) */ + /* --- */ + 0x77, /* protocolOp = APPLICATION (23) (=ExtendedRequest) + * 0b01xxxxxx => APPLICATION + * 0bxx1xxxxx => ? + * 0xxxx10111 => 23 + */ + 0x18, /* len = 24 */ + 0x80, /* type = requstName? */ + 0x16, /* len = 22 */ + /* OID: 1.3.6.1.4.1.1466.20037 (=LDAP_START_TLS_OID)*/ + '1', '.', + '3', '.', + '6', '.', + '1', '.', + '4', '.', + '1', '.', + '1', '4', '6', '6', '.', + '2', '0', '0', '3', '7' + /* No requestValue, as per RFC2830 (in 2.1: "The requestValue field is absent") */ +}; + +typedef enum { + LDAP_OPENLDAP, + LDAP_WINLDAP +} LDAP_MODE; + +#define LDAP_UNIVERSAL_SEQUENCE 0x30 +#define LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG 0x84 +#define LDAP_RESPONSE_MSG_ID_TYPE_INT 0x02 +#define LDAP_RESPONSE_EXPECTED_MSG_ID_LEN 0x01 +#define LDAP_RESPONSE_EXPECTED_MSG_ID 0x01 +#define LDAP_RESPONSE_EXT_RESP 0x0a +#define LDAP_RESPONSE_EXT_RESP_APPLICATION 0x78 +#define LDAP_RESPONSE_EXPECTED_ERR_LEN 0x01 +#define LDAP_RESPONSE_SUCCESS 0x00 + +NOEXPORT char *ldap_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase, const LDAP_MODE ldap_mode) { + + /* thanks to these threads for help with these PDUs + https://www.stunnel.org/pipermail/stunnel-users/2013-November/004437.html + https://www.openldap.org/lists/openldap-software/200401/msg00800.html */ + + uint8_t buffer_8[1]; + uint32_t buffer_32[1]; + uint32_t resp_len; + uint8_t ldap_response[256]; + uint8_t *resp_ptr; + + (void)opt; /* squash the unused parameter warning */ + + if(phase!=PROTOCOL_MIDDLE) + return NULL; + + /* send "Start TLS" request to AD server */ + s_log(LOG_DEBUG, "Requesting LDAP Start TLS"); + s_write(c, c->remote_fd.fd, ldap_startssl_message, (size_t)ldap_startssl_message[1] + 2); + + /* LDAP_UNIVERSAL_SEQUENCE (1 byte) */ + s_read(c, c->remote_fd.fd, buffer_8, 1); + if(buffer_8[0] != LDAP_UNIVERSAL_SEQUENCE) { + s_log(LOG_ERR, "start tag is not UNIVERSAL SEQUENCE"); + throw_exception(c, 1); + } + + if(ldap_mode == LDAP_OPENLDAP) { + /* OpenLDAP - response length (1 byte) */ + s_log(LOG_DEBUG, "Reading OpenLDAP message size (1 byte)"); + s_read(c, c->remote_fd.fd, buffer_8, 1); + resp_len = buffer_8; + + } else if(ldap_mode == LDAP_WINLDAP) { + + /* WinLDAP - "response length is 4 bytes" flag - LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG (1-byte) */ + s_read(c, c->remote_fd.fd, buffer_8, 1); + if(buffer_8[0] != LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG) { + s_log(LOG_ERR, "LDAP message length flag is an unexpected value"); + throw_exception(c, 1); + } + + /* WinLDAP - response length (4 bytes, network byte order) */ + s_log(LOG_DEBUG, "Reading WinLDAP message size (4 bytes)"); + s_read(c, c->remote_fd.fd, buffer_32, 4); + resp_len = ntohl(buffer_32[0]); + + } else { + s_log(LOG_ERR, "Unsupported LDAP mode"); + throw_exception(c, 1); + } + + /* LDAP response message */ + s_log(LOG_DEBUG, "Reading LDAP message (%u byte(s))", resp_len); + s_read(c, c->remote_fd.fd, ldap_response, resp_len); + + resp_ptr = &ldap_response[0]; + + /* LDAP_RESPONSE_MSG_ID_TYPE_INT - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_MSG_ID_TYPE_INT) { + s_log(LOG_ERR, "LDAP response has an incorrect message ID type"); + throw_exception(c, 1); + } + resp_ptr++; + + /* LDAP_RESPONSE_EXPECTED_MSG_ID_LEN - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXPECTED_MSG_ID_LEN) { + s_log(LOG_ERR, "LDAP response has an unexpected message ID length"); + throw_exception(c, 1); + } + resp_ptr++; + + /* LDAP_RESPONSE_EXPECTED_MSG_ID - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXPECTED_MSG_ID) { + s_log(LOG_ERR, "LDAP response has an unexpected message ID"); + throw_exception(c, 1); + } + resp_ptr++; + + /* LDAP_RESPONSE_EXT_RESP_APPLICATION - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXT_RESP_APPLICATION) { + s_log(LOG_ERR, "LDAP response protocolOp is not APPLICATION"); + throw_exception(c, 1); + } + resp_ptr++; + + if(ldap_mode == LDAP_WINLDAP) { + /* WinLDAP - "response length is 4 bytes" flag - LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG (1-byte) */ + if(*resp_ptr != LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG) { + s_log(LOG_ERR, "LDAP extendedResp length flag is an unexpected value"); + throw_exception(c, 1); + } + /* WinLDAP - extended response message length (4-bytes) */ + resp_ptr += 5; + + } else { + /* OpenLDAP - extended response message length (1-byte) */ + resp_ptr++; + } + + /* LDAP_RESPONSE_EXT_RESP - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXT_RESP) { + s_log(LOG_ERR, "LDAP response type is not EXT_RESP"); + throw_exception(c, 1); + } + resp_ptr++; + + /* LDAP_RESPONSE_EXT_RESP - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXPECTED_ERR_LEN) { + s_log(LOG_ERR, "LDAP response has an unexpected error code length"); + throw_exception(c, 1); + } + resp_ptr++; + + if(*resp_ptr != LDAP_RESPONSE_SUCCESS) { + s_log(LOG_ERR, "LDAP response has indicated an error (%u)", *resp_ptr); + throw_exception(c, 1); + } + + return NULL; +} + + +NOEXPORT char *openldap_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) { + return ldap_client(c, opt, phase, LDAP_OPENLDAP); +} + +NOEXPORT char *winldap_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) { + return ldap_client(c, opt, phase, LDAP_WINLDAP); +} + /**************************************** connect */ NOEXPORT char *connect_server(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {

1 1

Stunnel - supports static OpenSSL engines?
by pepak＠seznam.cz 10 Dec '19

10 Dec '19

Hi! Does Stunnel support static-linked engines for OpenSSL? From my experiments, my guess would be that it doesn't, but I may be overlooking something and would welcome a confirmation. Why I need it: During development of an urelated app, after many many failed attempts, I finally managed to get OpenSSL 1.1.x working with a CAPI engine - but the only functional setup involved CAPI built directly into libcrypto. Every other setup, in both Visual Studio and MinGW, led to some problem or another. I would love to extend this success to my Stunnel setup, where I am now forced to stick with version 5.49 because the newer versions use OpenSSL 1.1.x which simply doesn't seem to be able to function correctly with the dynamic CAPI engine. What I need from Stunnel, basically, is for it to try to use ENGINE_by_id('capi') first and only when that fails, attempt to load a dynamic engine using ENGINE_by_id('dynamic') and the necessary ENGINE_ctrl_cmd_string commands. I can build a functional static-built OpenSSL libraries myself. If Stunnel wanted to incorporate that, I am all for it, provided that there is some way of specifying whether a static engine or a dynamic engine is preferred. My Configure command is: perl Configure shared enable-static-engine enable-zlib --with-zlib-include=C:\Zlib --with-zlib-lib=C:\Zlib\zlib.lib VC-WIN64A Pepak

1 0

Re: [stunnel-users] stunnel 5.55 - - - SSL_connect: Peer suddenly disconnected
by Flo Rance 06 Dec '19

06 Dec '19

The full logs of both sides would still be useful. Regards, Flo On Fri, 6 Dec 2019 at 09:48, simona vittori <svittori(a)gmail.com> wrote: > Hi, > port 41521 is the port of stunnel server istance that then redirect > connection in clear on port 1521 of the listener. > > That's all > > Thanks > > Simona > > Il giorno ven 6 dic 2019 alle ore 09:37 Flo Rance <trourance(a)gmail.com> > ha scritto: > >> Hi, >> >> The full logs of the client would be useful. >> >> What are you trying to connect to (on port 41521) ? >> >> Regards, >> Flo >> >> On Thu, 5 Dec 2019 at 12:44, simona vittori <svittori(a)gmail.com> wrote: >> >>> Hello, >>> >>> I have stunnel v 5.55 on linux machine client e linux machine db server, >>> Red Hat Enterprise Linux Server release 6.6. I have noticed that there are >>> many many diconnections by side client (at the bottom of the page). Why >>> there is this behavior? >>> >>> This is the configuration file of client machine: >>> >>> cert = /opt/stunnel-5.55/etc/stunnel/stunnel.pem >>> verify = 3 >>> setuid = stunnel >>> >>> CAfile = /opt/stunnel-5.55/var/certs.pem >>> >>> pid = /opt/stunnel-5.55/var/lib/stunnel/stunnel_client.pid >>> >>> socket = l:TCP_NODELAY=1 >>> socket = r:TCP_NODELAY=1 >>> >>> sslVersion = TLSv1 >>> >>> TIMEOUTconnect = 30 >>> failover = rr >>> >>> ciphers = ECDH@STRENGTH:DH@STRENGTH:HIGH:!RC4:!MD5:!DES:!aNULL:!eNULL >>> >>> debug = 7 >>> output = /opt/stunnel-5.55/var/stunnel.log >>> >>> client = yes >>> >>> [connessione_a_EMPRMDB1-DB2] >>> accept=127.0.0.1:10001 >>> connect=10.56.213.70:41521 >>> connect=10.56.213.72:41521 >>> >>> >>> ####################################################################################### >>> >>> Dec 5 12:31:42 EMWBPAPP2b stunnel: []:LOG3[15001]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:31:52 EMWBPAPP2b stunnel: []:LOG3[15007]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15013]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15014]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:22 EMWBPAPP2b stunnel: []:LOG3[15019]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15021]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15023]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:24 EMWBPAPP2b stunnel: []:LOG3[15024]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:44 EMWBPAPP2b stunnel: []:LOG3[15033]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:45 EMWBPAPP2b stunnel: []:LOG3[15035]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:55 EMWBPAPP2b stunnel: []:LOG3[15041]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:04 EMWBPAPP2b stunnel: []:LOG3[15062]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:05 EMWBPAPP2b stunnel: []:LOG3[15063]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:06 EMWBPAPP2b stunnel: []:LOG3[15065]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:18 EMWBPAPP2b stunnel: []:LOG3[15069]: SSL_connect: Peer >>> suddenly disconnected >>> >>> #####################################################################à >>> >>> Thank for your help >>> >>> Simona >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >>

1 0

stunnel 5.55 - - - SSL_connect: Peer suddenly disconnected
by simona vittori 06 Dec '19

06 Dec '19

Hello, I have stunnel v 5.55 on linux machine client e linux machine db server, Red Hat Enterprise Linux Server release 6.6. I have noticed that there are many many diconnections by side client (at the bottom of the page). Why there is this behavior? This is the configuration file of client machine: cert = /opt/stunnel-5.55/etc/stunnel/stunnel.pem verify = 3 setuid = stunnel CAfile = /opt/stunnel-5.55/var/certs.pem pid = /opt/stunnel-5.55/var/lib/stunnel/stunnel_client.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 sslVersion = TLSv1 TIMEOUTconnect = 30 failover = rr ciphers = ECDH@STRENGTH:DH@STRENGTH:HIGH:!RC4:!MD5:!DES:!aNULL:!eNULL debug = 7 output = /opt/stunnel-5.55/var/stunnel.log client = yes [connessione_a_EMPRMDB1-DB2] accept=127.0.0.1:10001 connect=10.56.213.70:41521 connect=10.56.213.72:41521 ####################################################################################### Dec 5 12:31:42 EMWBPAPP2b stunnel: []:LOG3[15001]: SSL_connect: Peer suddenly disconnected Dec 5 12:31:52 EMWBPAPP2b stunnel: []:LOG3[15007]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15013]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15014]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:22 EMWBPAPP2b stunnel: []:LOG3[15019]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15021]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15023]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:24 EMWBPAPP2b stunnel: []:LOG3[15024]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:44 EMWBPAPP2b stunnel: []:LOG3[15033]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:45 EMWBPAPP2b stunnel: []:LOG3[15035]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:55 EMWBPAPP2b stunnel: []:LOG3[15041]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:04 EMWBPAPP2b stunnel: []:LOG3[15062]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:05 EMWBPAPP2b stunnel: []:LOG3[15063]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:06 EMWBPAPP2b stunnel: []:LOG3[15065]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:18 EMWBPAPP2b stunnel: []:LOG3[15069]: SSL_connect: Peer suddenly disconnected #####################################################################à Thank for your help Simona

2 1

Re: [stunnel-users] Help please.
by Christopher Schultz 03 Dec '19

03 Dec '19

Ajiq, On 12/3/19 09:13, Ajjq . wrote: > Hi Christopher: > > You are right. I needed > C:> TELNET LOCALHOST 80 and expect to be connected to sub.dominio.com:443 > > I modified stunnel.conf with client=yes. I am including stunnel.con and > log. > > I created the service Stunnel service, but when I start it, I get this > error message. > > [Stunnel server is down due to an error. You need to exit and correct the problem. Click OK to see the error log window.] The screenshot shows an error "bind: Address already in use". Do you have stunnel running twice at once? Please stop stunnel, delete your log file, then start it again. Post the resulting log file to the mailing list. -chris > > > stunnel.conf > > debug = 7 > output = stunnel3.log > > ; TLS front-end to a web server > [https] > client=yes > accept = 127.0.0.1:80 > connect = subd.dominio.com:443 > cert = stunnel.pem > TIMEOUTclose = 0 Is TIMEOPUTclose=0 actually on one line? That might be a syntax error. -chris

2 1

Help please.
by Ajjq . 02 Dec '19

02 Dec '19

Hi I need to enable a tunnel_out for UTL_HTTP from http:// to https:// I installed stunnel 5.34 win32 in a windows 2008 server. I am including my stunnel.conf y log file (debug=7) As you can see in the log file, I get this error: 2019.12.01 14:08:12 LOG3[7]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request Could you help me please? MY stunnel.conf--- debug = 7 output = stunnel.log [https] accept = 127.0.0.1:80 connect = sub.dominio.com:443 cert = stunnel.pem TIMEOUTclose = 0 This version has openssl[cid:b6de9085-07c4-43d0-b772-bb9beb37c2ac] MY LOG--- 2019.12.01 14:00:37 LOG7[cron]: Cron thread initialized 2019.12.01 14:00:37 LOG7[main]: No limit detected for the number of clients 2019.12.01 14:00:37 LOG5[main]: stunnel 5.34 on x86-pc-msvc-1500 platform 2019.12.01 14:00:37 LOG5[main]: Compiled/running with OpenSSL 1.0.2h-fips 3 May 2016 2019.12.01 14:00:37 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.12.01 14:00:37 LOG7[main]: errno: (*_errno()) 2019.12.01 14:00:37 LOG7[ui]: GUI message loop initialized 2019.12.01 14:00:37 LOG5[main]: Reading configuration from file stunnel.conf 2019.12.01 14:00:37 LOG5[main]: UTF-8 byte order mark detected 2019.12.01 14:00:37 LOG5[main]: FIPS mode disabled 2019.12.01 14:00:37 LOG7[main]: Compression disabled 2019.12.01 14:00:37 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2019.12.01 14:00:37 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2019.12.01 14:00:37 LOG7[main]: PRNG seeded successfully 2019.12.01 14:00:37 LOG6[main]: Initializing service [https] 2019.12.01 14:00:38 LOG6[main]: Loading certificate from file: stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Certificate loaded from file: stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Loading private key from file: stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Private key loaded from file: stunnel.pem 2019.12.01 14:00:38 LOG7[main]: Private key check succeeded 2019.12.01 14:00:38 LOG7[main]: DH initialization 2019.12.01 14:00:38 LOG7[main]: Could not load DH parameters from stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Using dynamic DH parameters 2019.12.01 14:00:38 LOG7[main]: ECDH initialization 2019.12.01 14:00:38 LOG7[main]: ECDH initialized with curve prime256v1 2019.12.01 14:00:38 LOG7[main]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2019.12.01 14:00:38 LOG5[main]: Configuration successful 2019.12.01 14:00:38 LOG7[main]: Listening file descriptor created (FD=352) 2019.12.01 14:00:38 LOG7[main]: Service [https] (FD=352) bound to 127.0.0.1:80 2019.12.01 14:00:59 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:00:59 LOG7[main]: FD=260 ifds=r-x ofds=r-- 2019.12.01 14:00:59 LOG7[main]: Dispatching signals from the signal pipe 2019.12.01 14:00:59 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2019.12.01 14:00:59 LOG5[main]: Reading configuration from file stunnel.conf 2019.12.01 14:00:59 LOG5[main]: UTF-8 byte order mark detected 2019.12.01 14:00:59 LOG5[main]: FIPS mode disabled 2019.12.01 14:00:59 LOG7[main]: Compression disabled 2019.12.01 14:00:59 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2019.12.01 14:00:59 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2019.12.01 14:00:59 LOG7[main]: PRNG seeded successfully 2019.12.01 14:00:59 LOG6[main]: Initializing service [https] 2019.12.01 14:00:59 LOG6[main]: Loading certificate from file: stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Certificate loaded from file: stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Loading private key from file: stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Private key loaded from file: stunnel.pem 2019.12.01 14:00:59 LOG7[main]: Private key check succeeded 2019.12.01 14:00:59 LOG7[main]: DH initialization 2019.12.01 14:00:59 LOG7[main]: Could not load DH parameters from stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Using dynamic DH parameters 2019.12.01 14:00:59 LOG7[main]: ECDH initialization 2019.12.01 14:00:59 LOG7[main]: ECDH initialized with curve prime256v1 2019.12.01 14:00:59 LOG7[main]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2019.12.01 14:00:59 LOG5[main]: Configuration successful 2019.12.01 14:00:59 LOG7[main]: Closing service [https] 2019.12.01 14:00:59 LOG7[main]: Service [https] closed (FD=352) 2019.12.01 14:00:59 LOG7[main]: Service [https] closed 2019.12.01 14:00:59 LOG7[main]: Listening file descriptor created (FD=352) 2019.12.01 14:00:59 LOG7[main]: Service [https] (FD=352) bound to 127.0.0.1:80 2019.12.01 14:00:59 LOG7[main]: Signal pipe is empty 2019.12.01 14:01:37 LOG6[cron]: Executing cron jobs 2019.12.01 14:01:37 LOG5[cron]: Updating DH parameters 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=420) from 127.0.0.1:56581 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[0]: Service [https] started 2019.12.01 14:01:37 LOG5[0]: Service [https] accepted connection from 127.0.0.1:56581 2019.12.01 14:01:37 LOG7[0]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=440) from 127.0.0.1:56582 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[1]: Service [https] started 2019.12.01 14:01:37 LOG5[1]: Service [https] accepted connection from 127.0.0.1:56582 2019.12.01 14:01:37 LOG7[1]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG3[0]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[0]: Local descriptor (FD=420) closed 2019.12.01 14:01:37 LOG7[0]: Service [https] finished (1 left) 2019.12.01 14:01:37 LOG3[1]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[1]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[1]: Local descriptor (FD=440) closed 2019.12.01 14:01:37 LOG7[1]: Service [https] finished (0 left) 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=448) from 127.0.0.1:56583 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[2]: Service [https] started 2019.12.01 14:01:37 LOG5[2]: Service [https] accepted connection from 127.0.0.1:56583 2019.12.01 14:01:37 LOG7[2]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG3[2]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[2]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[2]: Local descriptor (FD=448) closed 2019.12.01 14:01:37 LOG7[2]: Service [https] finished (0 left) 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=452) from 127.0.0.1:56584 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[3]: Service [https] started 2019.12.01 14:01:37 LOG5[3]: Service [https] accepted connection from 127.0.0.1:56584 2019.12.01 14:01:37 LOG7[3]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG3[3]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[3]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[3]: Local descriptor (FD=452) closed 2019.12.01 14:01:37 LOG7[3]: Service [https] finished (0 left) Thanks in advance.

2 1

SMTP out via Comcast stopped working
by Carlos Rodriguez 30 Nov '19

30 Nov '19

All: I have had this setup working fine since Comcast blocked port 25 and recently stopped working. This is a MS Small Business Server 2003 with Exchange, I know, old and obsolete but I would like to keep it working until I migrate to Linux. Anyway, right now I also have my desktop, Win10, using the same SMTP settings for the Acronis backup event results and it can send me emails just fine, just tested this. So it is not my firewall or Comcast. I'm missing something in the settings of stunnel. Below are my settings and log file. Any suggestions will be appreciated. Carlos taskbar = yes [SSLsmtp] client = yes accept = localhost:555 connect = smtp.comcast.net:587 protocol = smtp CAfile = ca-certs.pem protocolUsername = verifiedusername protocolPassword = verifiedpassword debug = 7 ================================================ 2019.11.29 16:31:24 LOG5[main]: stunnel 5.49 on x86-pc-msvc-1500 platform 2019.11.29 16:31:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2p-fips 14 Aug 2018 2019.11.29 16:31:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.11.29 16:31:24 LOG5[main]: Reading configuration from file stunnel.conf 2019.11.29 16:31:24 LOG5[main]: UTF-8 byte order mark detected 2019.11.29 16:31:24 LOG5[main]: FIPS mode disabled 2019.11.29 16:31:26 LOG4[main]: Service [SSLsmtp] needs authentication to prevent MITM attacks 2019.11.29 16:31:26 LOG5[main]: Configuration successful 2019.11.29 16:34:12 LOG7[0]: Service [SSLsmtp] started 2019.11.29 16:34:12 LOG7[0]: Setting local socket options (FD=264) 2019.11.29 16:34:12 LOG7[0]: Option TCP_NODELAY set on local socket 2019.11.29 16:34:12 LOG5[0]: Service [SSLsmtp] accepted connection from 127.0.0.1:1268 2019.11.29 16:34:12 LOG6[0]: s_connect: connecting 96.114.157.81:587 2019.11.29 16:34:12 LOG7[0]: s_connect: s_poll_wait 96.114.157.81:587: waiting 10 seconds 2019.11.29 16:34:12 LOG5[0]: s_connect: connected 96.114.157.81:587 2019.11.29 16:34:12 LOG5[0]: Service [SSLsmtp] connected remote server from 10.10.10.99:1269 2019.11.29 16:34:12 LOG7[0]: Setting remote socket options (FD=288) 2019.11.29 16:34:12 LOG7[0]: Option TCP_NODELAY set on remote socket 2019.11.29 16:34:12 LOG7[0]: Remote descriptor (FD=288) initialized 2019.11.29 16:34:12 LOG7[0]: <- 220 resomta-po-02v.sys.comcast.net resomta-po-02v.sys.comcast.net ESMTP server ready 2019.11.29 16:34:12 LOG7[0]: -> 220 resomta-po-02v.sys.comcast.net resomta-po-02v.sys.comcast.net ESMTP server ready 2019.11.29 16:34:12 LOG7[0]: -> EHLO localhost 2019.11.29 16:34:12 LOG7[0]: <- 250-resomta-po-02v.sys.comcast.net hello [71.206.38.109], pleased to meet you 2019.11.29 16:34:12 LOG7[0]: <- 250-HELP 2019.11.29 16:34:12 LOG7[0]: <- 250-SIZE 36700160 2019.11.29 16:34:12 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2019.11.29 16:34:12 LOG7[0]: <- 250-8BITMIME 2019.11.29 16:34:12 LOG7[0]: <- 250-STARTTLS 2019.11.29 16:34:12 LOG7[0]: <- 250 OK 2019.11.29 16:34:12 LOG7[0]: -> STARTTLS 2019.11.29 16:34:12 LOG7[0]: <- 220 2.0.0 Ready to start TLS 2019.11.29 16:34:12 LOG6[0]: SNI: sending servername: smtp.comcast.net 2019.11.29 16:34:12 LOG6[0]: Peer certificate not required 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): before/connect initialization 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server certificate A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server key exchange A 2019.11.29 16:34:12 LOG6[0]: Client certificate not requested 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server done A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 write finished A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 flush data 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server session ticket A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read finished A 2019.11.29 16:34:12 LOG7[0]: New session callback 2019.11.29 16:34:12 LOG7[0]: Peer certificate was cached (6814 bytes) 2019.11.29 16:34:12 LOG6[0]: Session id: 11C16B28FFB4A3A4EDC164CA65C3F20A896BF61C4D3B09F571E4285CFD0C82B3 2019.11.29 16:34:12 LOG7[0]: 1 client connect(s) requested 2019.11.29 16:34:12 LOG7[0]: 1 client connect(s) succeeded 2019.11.29 16:34:12 LOG7[0]: 0 client renegotiation(s) requested 2019.11.29 16:34:12 LOG7[0]: 0 session reuse(s) 2019.11.29 16:34:12 LOG6[0]: TLS connected: new session negotiated 2019.11.29 16:34:12 LOG6[0]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2019.11.29 16:34:12 LOG7[0]: Compression: null, expansion: null 2019.11.29 16:34:12 LOG7[0]: -> AUTH PLAIN AGNhcmxvc3JyQGNvbWNhc3QubmV0AFNveTFjYXJpZHVybw== 2019.11.29 16:34:12 LOG7[0]: <- 500 command unrecognized 2019.11.29 16:34:12 LOG3[0]: PLAIN Authentication Failed 2019.11.29 16:34:12 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2019.11.29 16:34:12 LOG7[0]: Remote descriptor (FD=288) closed 2019.11.29 16:34:12 LOG7[0]: Local descriptor (FD=264) closed 2019.11.29 16:34:12 LOG7[0]: Service [SSLsmtp] finished (0 left)

2 1

undefined reference to `CRYPTO_set_id_callback'
by Somchai Smythe 29 Nov '19

29 Nov '19

How do I fix this? gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/include -DLIBDIR='"/usr/lib/stunnel"' -DCONFDIR='"/etc/stunnel"' -O3 -m64 -march=x86-64 -mtune=generic -pipe -std=gnu17 -pthread -Wall -Wextra -Wpedantic -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations -fPIE -fstack-protector -D_FORTIFY_SOURCE=2 -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c sthreads.c: In function 'thread_id_init': sthreads.c:116:5: warning: implicit declaration of function 'CRYPTO_set_id_callback'; did you mean 'CRYPTO_set_locking_callback'? [-Wimplicit-function-declaration] 116 | CRYPTO_set_id_callback(stunnel_thread_id); | ^~~~~~~~~~~~~~~~~~~~~~ | CRYPTO_set_locking_callback ... libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) /usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: stunnel-sthreads.o: in function `sthreads_init': sthreads.c:(.text+0xb0): undefined reference to `CRYPTO_set_id_callback' /usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: stunnel-sthreads.o: in function `thread_id_init': sthreads.c:(.text+0x3a): undefined reference to `CRYPTO_set_id_callback' collect2: error: ld returned 1 exit status make[2]: *** [Makefile:550: stunnel] Error 1 I'm using openssl-1.1.1d if it matters.

2 4

"Address already in use" error
by Phil Smith III 25 Nov '19

25 Nov '19

Rebooted (Windows 7, fully patched) today and stunnel wouldn't start, said "Address already in use". Hmm.nothing much has changed. Rebooted again, same. Tinkered a bit, didn't see anything that looked meaningful. Went to look at deleted digests of this list, saw new version out, installed that, now it's happy. So.a mystery, at least to me; posting in case it helps someone else! .phsiii

1 0

segfault with v5.55
by Francois Robinette 22 Nov '19

22 Nov '19

I've seen other having the same issue without resolution so far... But we do have the same issue: stunnel[7886]: segfault at 21 ip 00007f70aa1efcea sp 00007f6fa7797978 error 6 in libpthread-2.12.so[7f70aa1e5000+17000]

2 4

Windows 10 stunnel does not accept options
by Clodoaldo Neto 22 Nov '19

22 Nov '19

Any option I try in stunnel 5.55 results the same. Say: PS C:\Program Files (x86)\stunnel\bin> .\stunnel \path\to\config\file [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.55 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 1.1.1c 28 May 2019 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [ssh] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 [ ] TLS options: 0x02100004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [ssh] needs authentication to prevent MITM attacks [ ] Initializing service [gmail-imap] [!] Service [gmail-imap]: TLS server needs a certificate [ ] Deallocating section defaults [!] Server is down Same with PS C:\Program Files (x86)\stunnel\bin> .\stunnel nonexistent or PS C:\Program Files (x86)\stunnel\bin> .\stunnel -help Regards, Clodoaldo

1 0

Re: [stunnel-users] Stunnel traffic fails to go via proxy set in
by Andrew Krause 11 Nov '19

11 Nov '19

Hi Jai, If your proxy supports the HTTP CONNECT method, you can try revising your settings to this: [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = wproxy.qut.edu.au:3128 protocolHost = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 protocol = connect Only the connect protocol supports using the protocolHost option. If this isn't supported by your proxy, you can try using Privoxy or Polipo between stunnel and your proxy. Socat is another option as well. Andrew Krause Schaumburg Township District Library -----Original Message----- At QUT Library we use Stunnel to encrypt SIP2 (ie. book borrowing) traffic from the self-checkout machines through to the Alma library services platform (as per https://developers.exlibrisgroup.com/alma/integrations/stunnel/ ) Our self-checkout machines run Windows 10 and are allowed limited internet access to two hosts (cloud.fetechgroup.com and ap01.alma.exlibrisgroup.com) via our institution's Squid proxy and I have our current WinHTTP proxy settings: Proxy Server(s) : wproxy.qut.edu.au:3128 Bypass List : *.qut.edu.au The proxy server settings are set for all protocols (HTTP, HTTPS, secure and FTP) and I've confirmed that web browser and the FE Technologies software is routing via wproxy.qut.edu.au. However Stunnel is still trying to connect to Alma directly. Our stunnel.conf is as follows (just FYI, the FE Tech software points to 127.0.0.1:5001 as our library services platform address): [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 Is there a way to force Stunnel to either respect the WinHTTP settings or configure it to route traffic to wproxy.qut.edu.au:3128 before initiating the connect = hostname:port? I did try protocolHost as follows, but I'm probably misunderstanding how it works https://www.stunnel.org/static/stunnel.html#SERVICE-LEVEL-OPTIONS [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = wproxy.qut.edu.au:3128 protocolHost = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 Any advice or assistance gratefully accepted, and apologies if this is a silly question - I'm just a librarian trying to make this thing work. Thanks, Jai Parker | Information Access Librarian QUT Library | Division of Administrative Services QUT | Kelvin Grove | D Block, Level 1 | Victoria Park Rd Kelvin Grove QLD 4059 P: 07 3138 3381 | E: lib.infoaccess at qut.edu.au<mailto:lib.infoaccess at qut.edu.au> | www.qut.edu.au<http://www.qut.edu.au/> ABN: 83 791 724 622 | CRICOS No. 00213J

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 184, Issue 4
by Brent Kimberley 08 Nov '19

08 Nov '19

From: Mark Brookes <mark(a)loadbalancer.org> To: Francois Robinette <frobinette(a)hotmail.com> >> OpenSSL 1.1.0k x Stunnel interaction... See tag 5.56b1Thanks. Can't find the 5.56b1 tag. Is it on a fork?https://github.com/mtrojnar/stunnel/network/members BTW. I had difficulty linking stunnel-5.56 (static) with OpenSSL 1.1.1d (static) as well. >> The stunnel guys have worked tirelessly to get this resolved. Its an >> interaction of openssl 1.1.0k and Stunnel. I think essentially openssl >> is doing something strange. They came up with a fix and its currently>> in the https://www.stunnel.org/downloads/beta/stunnel-5.56b1.tar.gz >> beta. You should give it a try and see if its resolves your issue. On Thu, 7 Nov 2019 at 19:36, Francois Robinette <frobinette(a)hotmail.com> wrote: > > I've seen other having the same issue without resolution so far... > But we do have the same issue: > > stunnel[7886]: segfault at 21 ip 00007f70aa1efcea sp 00007f6fa7797978 error 6 in libpthread-2.12.so[7f70aa1e5000+17000] >

1 0

Stunnel traffic fails to go via proxy set in winhttp (Windows 10)
by Library Information Access Team 06 Nov '19

06 Nov '19

At QUT Library we use Stunnel to encrypt SIP2 (ie. book borrowing) traffic from the self-checkout machines through to the Alma library services platform (as per https://developers.exlibrisgroup.com/alma/integrations/stunnel/ ) Our self-checkout machines run Windows 10 and are allowed limited internet access to two hosts (cloud.fetechgroup.com and ap01.alma.exlibrisgroup.com) via our institution's Squid proxy and I have our current WinHTTP proxy settings: Proxy Server(s) : wproxy.qut.edu.au:3128 Bypass List : *.qut.edu.au The proxy server settings are set for all protocols (HTTP, HTTPS, secure and FTP) and I've confirmed that web browser and the FE Technologies software is routing via wproxy.qut.edu.au. However Stunnel is still trying to connect to Alma directly. Our stunnel.conf is as follows (just FYI, the FE Tech software points to 127.0.0.1:5001 as our library services platform address): [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 Is there a way to force Stunnel to either respect the WinHTTP settings or configure it to route traffic to wproxy.qut.edu.au:3128 before initiating the connect = hostname:port? I did try protocolHost as follows, but I'm probably misunderstanding how it works https://www.stunnel.org/static/stunnel.html#SERVICE-LEVEL-OPTIONS [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = wproxy.qut.edu.au:3128 protocolHost = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 Any advice or assistance gratefully accepted, and apologies if this is a silly question - I'm just a librarian trying to make this thing work. Thanks, Jai Parker | Information Access Librarian QUT Library | Division of Administrative Services QUT | Kelvin Grove | D Block, Level 1 | Victoria Park Rd Kelvin Grove QLD 4059 P: 07 3138 3381 | E: lib.infoaccess(a)qut.edu.au<mailto:lib.infoaccess@qut.edu.au> | www.qut.edu.au<http://www.qut.edu.au/> ABN: 83 791 724 622 | CRICOS No. 00213J

1 0

Re: [stunnel-users] Extensions when negotiating TLS
by Christopher Schultz 05 Nov '19

05 Nov '19

Tom, On 11/4/19 17:59, Tom (AST) Watson wrote: > Trying to make the applications want to talk http/1.1 isn't going to > be easy. Both sides (app#1 and app#2) want to talk http2 (*SIGH*). Understood. > I was just hoping stunnel might work. Presently it looks like it > won't so I am looking at alternatives. Part of the object is to look > at the various transactions over the wire (many!) and they are lots. > I assume that is why http2 is used, and I have no influence over > that decision. From the looks of it, making app#2 unencrypted is the > best path. Boo! > It is written in GO, and has little comments to describe things (such > is life!). I think I'm a bit closer to a solution, but if stunnel > can be made to work (ALPN support) it would be nice. Looks like I'll > have to wait. Why isn't it an option to enable encryption directly on the service? It seems like using stunnel should be your last resort. -chris > -----Original Message----- > From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Christopher Schultz > > Tom, > > On 11/4/19 17:16, Tom (AST) Watson wrote: >> Yes, I understand about ALPN. Sorry I described in detail. >> Unfortunately application #2 wants encrypted http2 (it is a go >> program). Application #1 wants to talk in http2 (I can't change >> that!) and it doesn't encrypt "naturally" (and I want to see what is >> going on [Wireshark] as well) In looking further I might be able to >> get application #2 to go plaintext (I found a pointer). Yes, it seems >> that stunnel doesn't support ALPN, wishful thinking on my part >> >> Back to the salt mines. (*SIGH*) > > How difficult would it be to enable HTTP/1.1 on that application #1? > I've never seen an h2-only service before. h2 is more effective for web applications that make a lot of tiny requests (like small resources for pages, scripts, etc.). Most API-based services don't really get any benefit from using h2. > > -chris > >> -----Original Message----- From: stunnel-users >> <stunnel-users-bounces(a)stunnel.org> On Behalf Of Christopher Schultz >> Sent: Monday, November 4, 2019 13:59 To: stunnel-users(a)stunnel.org >> Subject: [External] Re: [stunnel-users] Extensions when negotiating >> TLS >> >> Tom, >> >> On 11/4/19 16:05, Tom (AST) Watson wrote: >>> Well, I thought it would be "easy", but maybe not. I have an >>> application (#1) that uses http2, and isn't encrypted. No problem >>> here. Now I have another application (#2) that insists on using >>> https to talk to application #1. So I gleefully setup stunnel to >>> connect the two. Well, application #2 starts talking to stunnel with >>> a "Client Hello" packet, and it includes an extension "Application >>> Layer Protocol Extension" of "h2". >> >> This is called ALPN, and is a requirement for h2s. >> >>> While not versed in the minutia, I take this that the client >>> (application #2) wants to talk "http2" to the server (application >>> #1). >> >> Yep, pretty much. >> >>> OK, that is what I want. The problem is that stunnel doesn't respond >>> with ANY "Application Layer Protocol Extension" indicating acceptance >>> of this request in its "server hello". This means that application >>> #2 fails in its negotiation. No joy! >>> >>> Now I know that application #1 will nicely talk http2, but how do I >>> get stunnel to communicate this to application #2 (as encrypted >>> http2). Am I missing something in my (pretty simple) configuration >>> file? >> >> I can't find any references to stunnel supporting ALPN. You may be >> (temporarily) out of luck, at least with stunnel. >> >> You mentioned that app #2 insists on encryption (great, usually). Is >> there a requirement that it use h2? Or can it be configured to use >> HTTP/1.1? >> >> -chris >> >

2 1

Re: [stunnel-users] Extensions when negotiating TLS
by Christopher Schultz 04 Nov '19

04 Nov '19

Tom, On 11/4/19 17:16, Tom (AST) Watson wrote: > Yes, I understand about ALPN. Sorry I described in detail. > Unfortunately application #2 wants encrypted http2 (it is a go > program). Application #1 wants to talk in http2 (I can't change > that!) and it doesn't encrypt "naturally" (and I want to see what is > going on [Wireshark] as well) In looking further I might be able to > get application #2 to go plaintext (I found a pointer). Yes, it seems > that stunnel doesn't support ALPN, wishful thinking on my part > > Back to the salt mines. (*SIGH*) How difficult would it be to enable HTTP/1.1 on that application #1? I've never seen an h2-only service before. h2 is more effective for web applications that make a lot of tiny requests (like small resources for pages, scripts, etc.). Most API-based services don't really get any benefit from using h2. -chris > -----Original Message----- From: stunnel-users > <stunnel-users-bounces(a)stunnel.org> On Behalf Of Christopher Schultz > Sent: Monday, November 4, 2019 13:59 To: stunnel-users(a)stunnel.org > Subject: [External] Re: [stunnel-users] Extensions when negotiating > TLS > > Tom, > > On 11/4/19 16:05, Tom (AST) Watson wrote: >> Well, I thought it would be "easy", but maybe not. I have an >> application (#1) that uses http2, and isn't encrypted. No problem >> here. Now I have another application (#2) that insists on using >> https to talk to application #1. So I gleefully setup stunnel to >> connect the two. Well, application #2 starts talking to stunnel >> with a "Client Hello" packet, and it includes an extension >> "Application Layer Protocol Extension" of "h2". > > This is called ALPN, and is a requirement for h2s. > >> While not versed in the minutia, I take this that the client >> (application #2) wants to talk "http2" to the server (application >> #1). > > Yep, pretty much. > >> OK, that is what I want. The problem is that stunnel doesn't >> respond with ANY "Application Layer Protocol Extension" indicating >> acceptance of this request in its "server hello". This means that >> application #2 fails in its negotiation. No joy! >> >> Now I know that application #1 will nicely talk http2, but how do I >> get stunnel to communicate this to application #2 (as encrypted >> http2). Am I missing something in my (pretty simple) configuration >> file? > > I can't find any references to stunnel supporting ALPN. You may be > (temporarily) out of luck, at least with stunnel. > > You mentioned that app #2 insists on encryption (great, usually). Is > there a requirement that it use h2? Or can it be configured to use > HTTP/1.1? > > -chris >

1 0

Extensions when negotiating TLS
by Tom (AST) Watson 04 Nov '19

04 Nov '19

Well, I thought it would be "easy", but maybe not. I have an application (#1) that uses http2, and isn't encrypted. No problem here. Now I have another application (#2) that insists on using https to talk to application #1. So I gleefully setup stunnel to connect the two. Well, application #2 starts talking to stunnel with a "Client Hello" packet, and it includes an extension "Application Layer Protocol Extension" of "h2". While not versed in the minutia, I take this that the client (application #2) wants to talk "http2" to the server (application #1). OK, that is what I want. The problem is that stunnel doesn't respond with ANY "Application Layer Protocol Extension" indicating acceptance of this request in its "server hello". This means that application #2 fails in its negotiation. No joy! Now I know that application #1 will nicely talk http2, but how do I get stunnel to communicate this to application #2 (as encrypted http2). Am I missing something in my (pretty simple) configuration file? Thanks. -- Tom Watson (I'm at work now) Thomas.3.watson(a)raytheon.com

2 1

Debian 9 static build
by Chris Maciejewski 01 Nov '19

01 Nov '19

Hello, I am trying to build stunnel 5.55 on Debian 9 x64 statistically against latest OpenSSL build from source. The system already has openssl and libssl ver. 1.1.1b installed via apt-get , but I want to build against OpenSSL 1.1.1d instead. What I do is: 1. Build and install OpenSSL: $ cd /usr/src/openssl-1.1.1d $ ./config -fPIC --prefix=/opt/openssl $ make depend && make && make install 2. Build and install Stunnel $ cd /usr/src/stunnel-5.55 $ ./configure --with-ssl=/opt/openssl --enable-static $ make && make install Both 1 and 2 completes OK with no errors, however when I run: $ /usr/local/bin/stunnel [.] Compiled with OpenSSL 1.1.1d 10 Sep 2019 [.] Running with OpenSSL 1.1.1b 26 Feb 2019 .... and indeed when I do: $ ldd /usr/local/bin/stunnel libssl.so.1.1 => /usr/lib/x86_64-linux-gnu/libssl.so.1.1 (0x00007f1083b4f000) libcrypto.so.1.1 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007f1083668000) above shows dynamic .so libs are used, rather than static libs libssl.a and libcrypto.a Any suggestions as to what is wrong with my process above and how to make static build of Stunnel to use non-system OpenSSL very much appreciated. Kind regards, Chris

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 183, Issue 4
by Brent Kimberley 26 Oct '19

26 Oct '19

Chris.Does this help? https://stackoverflow.com/questions/40454338/no-shared-cipher-at-ssl-accept… If you can rule out libraries like OpenSSL, then look at your config + initial setup exchange. Date: Fri, 25 Oct 2019 11:11:54 -0400 From: Christopher Schultz <chris(a)christopherschultz.net> Subject: Re: [stunnel-users] Strange connection failure in one environmentOn 10/25/19 10:09, Christopher Schultz wrote: > All, > > I've been using stunnel in two environments (dev, prod) for a long time > without any problems. Recently, my dev environment started acting funny > and I can't connect to it from outside the box. > > Can someone take a look and let me know if you have any suggestions for > where to look for a problem? > > Both environments have the following things in common: > > 1. Hosted in Amazon EC2, no load-balancer in the way > 2. Configuration requires client-certificate to connect > 3. All certificates are valid, self-signed, and properly-trusted by both > sides > 4. TLS configuration has been locked-down to TLSv1.2, selected cipher > suites, FIPS mode=off > 5. All versions are the same: stunnel 4.56 w/OpenSSL 1.0.2k-fips > > The production (working) environment happens to be i686 and the > development environment happens to be x86-86, but I don't believe that > is relevant. > > When I use e.g. "openssl s_client" to connect to the production > environment and I *do not* provide a client certificate, I am able to > perform the initial TLS handshake, get a cipher suite negotiated, etc. > and then the connection fails because I didn't provide the client > certificate, of course. I *can* see in the handshake the list of allowed > client certificates. > > When I do the same in development, I get a handshake failure. No allowed > client certificates are shown. No nothing. > > If I connect on localhost to the dev server, I get what I'm expecting: > allowed client certificates are listed, connection is closed because I'm > not using the client certificate. Connecting from another host gets my a > handshake failure. > > Again, there are no load-balancers or anything between the outside and > the EC2 instance. I'm connecting as directly as it's possible to > connect. The box definitely allows incoming connections on the port I'm > trying to use; the AWS security group is configured correctly. > > I have tried dropping ALL security configuration on the dev server's > stunnel.conf such as client-cert requirements, TLS protocols, cipher > suites, etc. and I get the same behavior every time. I'm starting to > think that it has nothing to do with my stunnel.conf configuration at > all, but I'm at a loss as to where to look, next. > > Any ideas? Some more information: 0. The error I get on the client is "handshake failure" and the stunnel server drops this log message: SSL_accept: 1408A0C1: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher Note that I have disabled all but TLSv1.2 on the server. Removing this restriction does not change the behavior. 1. I have multiple stunnel configuration files on this server. Actually, I have 4 of them. Connections to ports defined in 2 of these files are not connecting successfully. Connections to ports defined in the OTHER two files *are* connecting successfully. The configurations seem to follow a pattern: those using RSA certificates as the server-certificate are working as expected, while those with EC server-certificate are failing. When I say "working" versus "failing", I mean that this command will give me a cipher suite and master key, but still drop the connection because I'm not providing a client-certificate for these tests: $ openssl s_client -connect host:port 2. I have a Java-based service that *is* able to connect through this stunnel instance just fine. It's running on a recent version of Java 8. My CLI client (not OpenSSL) is also running the same version. My CLI client cannot connect. *weird* In both cases, I am using EC client certificates, but the certificates are different from each other. Both of these certificates are trusted by the server. 3. When using OpenSSL 1.0.2t, I *can* connect, get the list of acceptable client certificates, etc. even without providing a client certificate. When using OpenSSL 1.1.1d, I can *not* connect. So perhaps the inside/outside networking thing I was thinking the problem might be is incorrect. AFAIK, both versions of OpenSSL should be able to use EC certificates and cipher suites. Thanks, -chris

1 0

Strange connection failure in one environment
by Christopher Schultz 25 Oct '19

25 Oct '19

All, I've been using stunnel in two environments (dev, prod) for a long time without any problems. Recently, my dev environment started acting funny and I can't connect to it from outside the box. Can someone take a look and let me know if you have any suggestions for where to look for a problem? Both environments have the following things in common: 1. Hosted in Amazon EC2, no load-balancer in the way 2. Configuration requires client-certificate to connect 3. All certificates are valid, self-signed, and properly-trusted by both sides 4. TLS configuration has been locked-down to TLSv1.2, selected cipher suites, FIPS mode=off 5. All versions are the same: stunnel 4.56 w/OpenSSL 1.0.2k-fips The production (working) environment happens to be i686 and the development environment happens to be x86-86, but I don't believe that is relevant. When I use e.g. "openssl s_client" to connect to the production environment and I *do not* provide a client certificate, I am able to perform the initial TLS handshake, get a cipher suite negotiated, etc. and then the connection fails because I didn't provide the client certificate, of course. I *can* see in the handshake the list of allowed client certificates. When I do the same in development, I get a handshake failure. No allowed client certificates are shown. No nothing. If I connect on localhost to the dev server, I get what I'm expecting: allowed client certificates are listed, connection is closed because I'm not using the client certificate. Connecting from another host gets my a handshake failure. Again, there are no load-balancers or anything between the outside and the EC2 instance. I'm connecting as directly as it's possible to connect. The box definitely allows incoming connections on the port I'm trying to use; the AWS security group is configured correctly. I have tried dropping ALL security configuration on the dev server's stunnel.conf such as client-cert requirements, TLS protocols, cipher suites, etc. and I get the same behavior every time. I'm starting to think that it has nothing to do with my stunnel.conf configuration at all, but I'm at a loss as to where to look, next. Any ideas? -chris

1 1

ssl offloading with stunnel
by simona vittori 23 Oct '19

23 Oct '19

Hello,Is it possible to have the following architecture with stunnel? stunnel client --> balancer --> db server Balancer doesn't have stunnel product installed on it. It receives encrypted packages from stunnel client and redirect clear traffico to DB server. Is it possible to realize this configuration? Thank a lot. Regards Simona

1 0

stunnel : user identification in mutual auth
by Denis Polushin 22 Oct '19

22 Oct '19

Hi All, Haven't found the answer for this issue. The scheme is : TLS-client <==tls==> stunnel-server <==open==> App-server In user session stunnel-server perform authorization for client with its certificate (verify=2) and send request further to App-server. How does App-server can identify user in this session? To grand permissions. Ideally it would be good to know CN or EKU of user certificate. Is it possible? Thanks a lot!! Denis

1 0

segfault with v5.55
by Mark Brookes 30 Sep '19

30 Sep '19

We are currently experiencing a segfault with version 5.55 openssl version 1.1.0k and are trying to narrow down what the issue may be. The first 2 segfaults are about 10 mins apart. The below is from the stunnel log just before and then after the event. Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77582]: TLS state (accept): SSLv3/TLS write finished Sep 23 11:47:31 xxxx stunnel: LOG7[77582]: TLS state (accept): SSLv3/TLS read change cipher spec Sep 23 11:47:31 xxxx stunnel: LOG7[77582]: TLS state (accept): SSLv3/TLS read finished Sep 23 11:47:31 xxxx stunnel: LOG7[77580]: TLS state (accept): SSLv3/TLS write finished Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:52:58 xxxx stunnel: LOG7[ui]: Clients allowed=62937 Sep 23 11:52:58 xxxx stunnel: LOG5[ui]: stunnel 5.55 on x86_64-pc-linux-gnu platform Sep 23 11:52:58 xxxx stunnel: LOG5[ui]: Compiled/running with OpenSSL 1.1.0k 28 May 2019 Sep 23 11:52:58 xxxx stunnel: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Sep 23 11:52:58 xxxx stunnel: LOG7[ui]: errno: (*__errno_location ()) The following is from the kernel log. stunnel[31253]: segfault at 0 ip 00007f91214cacea sp 00007f91205ea9f8 error 6 in libpthread-2.12.so[7f91214c0000+17000] The kernel log after the second segfault- stunnel[1868]: segfault at 0 ip 00007f5b35398cea sp 00007f5b344c59f8 error 6 in libpthread-2.12.so[7f5b3538e000+17000] This is all the information we have at the moment. -- Mark Brookes Loadbalancer.org Ltd. www.loadbalancer.org +44 (0)330 380 1064 mark(a)loadbalancer.org

1 0

Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections
by Lynch, Andrew 27 Sep '19

27 Sep '19

I’ve been digging around the code and I am no longer sure whether stunnel is at fault or it is actually an issue in OpenSSL! load_key_engine() in ctx.c shoves the key into the SSL context – SSL_CTX_use_PrivateKey(section->ctx, pkey). So the key should be freed when that context is disposed of. The SIGHUP ends up in case SIGNAL_RELOAD_CONFIG of signal_pipe_dispatch(), which calls options_free() [stunnel.c line 830]. Eventually there is an SSL_CTX_free() call, but it looks like this does not actually free the private key. Ephemeral keys are freed and loads of other stuff, but not the private key associated with the certificate. I may try to build a hacked OpenSSL on Monday to see what happens if SSL_CTX_free also frees the private key… Regards, Andrew. From: Brent Kimberley [mailto:brent_kimberley@rogers.com] Sent: Friday, September 27, 2019 4:29 PM To: stunnel-users(a)stunnel.org; Lynch, Andrew Subject: Re: stunnel-users Digest, Vol 182, Issue 14 >> Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. >> Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. Where does the signal dispatcher free keys on SIG_HUP? https://github.com/mtrojnar/stunnel/blob/master/src/stunnel.c Date: Fri, 27 Sep 2019 07:23:29 +0000 From: "Lynch, Andrew" <andrew.lynch(a)atos.net<mailto:andrew.lynch@atos.net>> To: Eric Eberhard <flash(a)vicsmba.com<mailto:flash@vicsmba.com>> Cc: "stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org>" <stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org>> Subject: Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections Hi Eric, Thank you for your suggestion. It is certainly worth looking into, although I suspect it may be impractical in our environment. Now we have a single stunnel.conf with 70 services which would translate into 70 additional entries in inetd.conf. Each of those entries then needs to have its own reduced stunnel.conf so that it will only load the cert and key for its endpoint. The stunnel HOWTO recommends daemon mode over inetd mode due to the overhead for forking and SSL initialization. We would have additional overhead for engine init and HSM connection. Regards, Andrew. -----Original Message----- From: Eric Eberhard [mailto:flash@vicsmba.com<mailto:flash@vicsmba.com>] Sent: Thursday, September 26, 2019 7:20 PM To: Lynch, Andrew; stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org> Subject: RE: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Try running in inetd mode -- even if you don't like this you will learn something. Inetd will close connections as needed. E -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org<mailto:stunnel-users-bounces@stunnel.org>] On Behalf Of Lynch, Andrew Sent: Thursday, September 26, 2019 5:56 AM To: stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org> Subject: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 182, Issue 14 **********************************************

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 14
by Eric Eberhard 27 Sep '19

27 Sep '19

I don’t suggest it as a final solution – although for me it works great and we have customers exchanging 2-4 million XML documents per day with no performance issues – BUT no matter what it is a good debugging tool. Inetd gets all the initial connections and closes them when done. It might or might or might not be involved with the HSM at all. You might also look at the process table (some form of ps) and grep for stunnel and relatives and see if they are hanging around. In theory, if a process dies, it “should” close it’s connections. If it is floating in space it will not. Inetd will kill the process – at least on Centos and AIX and SCO – for sure and for certain. E From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Brent Kimberley Sent: Friday, September 27, 2019 7:29 AM To: stunnel-users(a)stunnel.org; andrew.lynch(a)atos.net Subject: Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 14 >> Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. >> Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. Where does the signal dispatcher free keys on SIG_HUP? https://github.com/mtrojnar/stunnel/blob/master/src/stunnel.c Date: Fri, 27 Sep 2019 07:23:29 +0000 From: "Lynch, Andrew" <andrew.lynch(a)atos.net <mailto:andrew.lynch@atos.net> > To: Eric Eberhard <flash(a)vicsmba.com <mailto:flash@vicsmba.com> > Cc: "stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> " <stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> > Subject: Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections Hi Eric, Thank you for your suggestion. It is certainly worth looking into, although I suspect it may be impractical in our environment. Now we have a single stunnel.conf with 70 services which would translate into 70 additional entries in inetd.conf. Each of those entries then needs to have its own reduced stunnel.conf so that it will only load the cert and key for its endpoint. The stunnel HOWTO recommends daemon mode over inetd mode due to the overhead for forking and SSL initialization. We would have additional overhead for engine init and HSM connection. Regards, Andrew. -----Original Message----- From: Eric Eberhard [mailto:flash@vicsmba.com <mailto:flash@vicsmba.com> ] Sent: Thursday, September 26, 2019 7:20 PM To: Lynch, Andrew; stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Subject: RE: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Try running in inetd mode -- even if you don't like this you will learn something. Inetd will close connections as needed. E -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org <mailto:stunnel-users-bounces@stunnel.org> ] On Behalf Of Lynch, Andrew Sent: Thursday, September 26, 2019 5:56 AM To: stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Subject: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 182, Issue 14 **********************************************

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 14
by Brent Kimberley 27 Sep '19

27 Sep '19

>> Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. >> Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. Where does the signal dispatcher free keys on SIG_HUP?https://github.com/mtrojnar/stunnel/blob/master/src/stunnel.c Date: Fri, 27 Sep 2019 07:23:29 +0000 From: "Lynch, Andrew" <andrew.lynch(a)atos.net> To: Eric Eberhard <flash(a)vicsmba.com> Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections Hi Eric, Thank you for your suggestion. It is certainly worth looking into, although I suspect it may be impractical in our environment. Now we have a single stunnel.conf with 70 services which would translate into 70 additional entries in inetd.conf. Each of those entries then needs to have its own reduced stunnel.conf so that it will only load the cert and key for its endpoint. The stunnel HOWTO recommends daemon mode over inetd mode due to the overhead for forking and SSL initialization. We would have additional overhead for engine init and HSM connection. Regards, Andrew. -----Original Message----- From: Eric Eberhard [mailto:flash@vicsmba.com] Sent: Thursday, September 26, 2019 7:20 PM To: Lynch, Andrew; stunnel-users(a)stunnel.org Subject: RE: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Try running in inetd mode -- even if you don't like this you will learn something. Inetd will close connections as needed. E -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Lynch, Andrew Sent: Thursday, September 26, 2019 5:56 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 182, Issue 14 **********************************************

1 0

Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections?
by Eric Eberhard 27 Sep '19

27 Sep '19

Try running in inetd mode -- even if you don't like this you will learn something. Inetd will close connections as needed. E -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Lynch, Andrew Sent: Thursday, September 26, 2019 5:56 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

stunnel with OpenSSL engine: reload leaks HSM connections?
by Lynch, Andrew 26 Sep '19

26 Sep '19

Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew.

1 0

Re: [stunnel-users] Problems when using PSK between a version of stunnel usingopenssl 1.0 and a version of stunnel using openssl 1.1.1 in stunnel-users Digest, Vol 182, Issue 7
by Koperberg, J. (Hannah) 25 Sep '19

25 Sep '19

Hi Brent Thank you for your suggestions. I installed stunnel version 5.55 on the client test side (where the openssl version OpenSSL 1.1.1c is). That has solved the problem. Kind regards and thanks again for your help, Hannah Koperberg, de Volksbank N.V., The Netherlands From: Brent Kimberley <brent_kimberley(a)rogers.com> Sent: woensdag 18 september 2019 18:30 To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 7 psk_find() and psk_server_callback() are marked NOEXPORT. You can try whitebox - decompile ctx.c:: psk_server_callback() and/or blackbox - breaking the problem into parts to see what works/fails. Decomposing the problem into parts : a) Two differing stunnel versions and a common openssl library. b) One common stunnel version and two differing openssl libraries. On Wednesday, September 18, 2019, 11:28:48 a.m. EDT, Brent Kimberley <brent_kimberley(a)rogers.com<mailto:brent_kimberley@rogers.com>> wrote: >> 2019.09.16 13:36:28 LOG6[3]: PSK identity not found (session resumption?) Try dumping the symbols for ctx.c::psk_find(), ssl_lib.c::SSL_get_ex_data(), and ctx.c:: psk_server_callback(). ________________________________ Dit e-mailbericht is alleen bestemd voor de geadresseerden. Indien dit bericht niet voor u is bedoeld, wordt u verzocht de afzender hiervan op de hoogte te stellen door het bericht te retourneren en de inhoud niet te gebruiken. This e-mail message is intended to be exclusively for the addressee. If you are not the intended recipient you are kindly requested not to make any use whatsoever of the contents and to notify the sender immediately by returning this e-mail message.

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 11
by Brent Kimberley 24 Sep '19

24 Sep '19

>>We are running stunnel-5.49-1.ppc on AIX 7100-05-03-1846. >>It will stay up awhile and our connection tests work, but it core dumps. Here’s the message in the log file. Thoughts? >>INTERNAL ERROR: Out of memory at s3_both.c, line 626 Hi Gerald. You may have found a memory leak. Try looking at: 1) line 626 of OpenSSL::s3_booth.c https://github.com/openssl/openssl/blob/OpenSSL_1_0_2-stable/ssl/s3_both.c 2) line 296 of stunnel::str.c ; and/or https://github.com/mtrojnar/stunnel/blob/stunnel-5.49/src/str.c 3) dbx, truss, or probevue - in an offline dev environment. http://archive.ibmsystemsmag.com/aix/administrator/performance/debugging-me…

1 0

AIX:stunnel core dumping
by Gerald Shaw 24 Sep '19

24 Sep '19

Hello, We are running stunnel-5.49-1.ppc on AIX 7100-05-03-1846. It will stay up awhile and our connection tests work, but it core dumps. Here’s the message in the log file. Thoughts? INTERNAL ERROR: Out of memory at s3_both.c, line 626 Best, Gerald Shaw

1 0

Cannot create .crt file
by John Khoo 24 Sep '19

24 Sep '19

Hi, I am new to STunnel. I come to know STunnel thru this link: http://www.ibphoenix.com/downloads/Secure_connections_to_Firebird_with_Stun… Based on the instruction, I tried create a certificate using this line below: openssl ca -config "C:\Program Files (x86)\stunnel\config\openssl.conf" -policy policy_anything -notext -in C:\CA\temp\vnc_server\server.req -out C:\CA\temp\vnc_server\server.crt However, no crt file is created and no error is prompted. I hope that someone can help me. Thanks.

1 0

Stunnel and Sophos UTM
by James Brown 20 Sep '19

20 Sep '19

Has anybody been able to use stunnel to update the Sophos UTM’s firewall? I know it has a Restful API , but do not know how to use this with stunnel. https://www.sophos.com/en-us/medialibrary/PDFs/documentation/UTMonAWS/Sopho… <https://www.sophos.com/en-us/medialibrary/PDFs/documentation/UTMonAWS/Sopho…> Any experiences or suggestions? Thanks, James.

2 1

Re: [stunnel-users] Stunnel help and guidance request
by Noonan, M.P. (Mike) 19 Sep '19

19 Sep '19

Hi Gerald, I assume you got stunnel from the oss4aix.org site. We don't use the freeware openssl, but instead the IBM one: [root@duist:/data/O01] lslpp -l | grep openssl openssl.base 1.0.2.1801 COMMITTED Open Secure Socket Layer openssl.license 1.0.2.1801 COMMITTED Open Secure Socket License openssl.man.en_US 1.0.2.1801 COMMITTED Open Secure Socket Layer openssl.base 1.0.2.1801 COMMITTED Open Secure Socket Layer I installed stunnel-5.29 on one of our lpars which I forced with -nodeps: rpm -Uhv --nodeps stunnel-5.29-1.aix5.2.ppc.rpm It picked up the IBM libs, but had the same problem... [root@duist:/data/O01] ldd /usr/bin/stunnel /usr/bin/stunnel needs: /usr/lib/threads/libc.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libpthreads.a(shr_xpg5.o) /usr/lib/libcrypto.a(libcrypto.so.1.0.2) /usr/lib/libssl.a(libssl.so.1.0.2) /unix /usr/lib/libcrypt.a(shr.o) [root@duist:/data/O01] /usr/bin/stunnel Could not load program /usr/bin/stunnel: Symbol resolution failed for stunnel because: Symbol strcmp (number 112) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol memmove (number 137) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol strncpy (number 142) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol strcpy (number 169) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol bcopy (number 245) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). I then downloaded and installed stunnel-5.49 from oss4aix.org and installed that version which worked fine.. [root@duist:/data/O01] /usr/bin/stunnel [ ] Clients allowed=31999 [.] stunnel 5.49 on powerpc-ibm-aix5.2.0.0 platform [.] Compiled with OpenSSL 1.0.2p 14 Aug 2018 [.] Running with OpenSSL 1.0.2r 26 Feb 2019 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_Errno()) [!] Invalid configuration file name "/opt/freeware/etc/stunnel/stunnel.conf" [!] realpath: No such file or directory (2) [ ] Deallocating section defaults I expect that if you upgrade your freeware openssl to at least 1,0,2r and upgrade stunnel to 5.49 your problem should be solved. Met vriendelijke groet, Mike Noonan From: stunnel-users <mailto:stunnel-users-bounces@stunnel.org> On Behalf Of Gerald Shaw Sent: Wednesday, September 18, 2019 11:18 PM To: mailto:stunnel-users@stunnel.org Subject: [stunnel-users] Stunnel help and guidance request Hello all, I'm new to the mailing list. I'm trying to run stunnel-5.29-1.ppc, and I'm having issues. I'd appreciate your help (or point me to the solution in the archives). OS - AIX 7100-05-03-1846 /home/shawg# rpm -qa|grep -i openssl openssl-1.0.2n-1.ppc /home/shawg# ldd `which stunnel` /usr/bin/stunnel needs: /usr/lib/libc.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libpthreads.a(shr_xpg5.o) /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2) /opt/freeware/lib/libssl.a(libssl.so.1.0.2) /unix /usr/lib/libcrypt.a(shr.o) ** ERROR MESSAGE_- /home/shawg# /usr/bin/stunnel exec(): 0509-036 Cannot load program /usr/bin/stunnel because of the following errors: 0509-130 Symbol resolution failed for stunnel because: 0509-136 Symbol strcmp (number 112) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol memmove (number 137) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strncpy (number 142) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strcpy (number 169) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol bcopy (number 245) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-192 Examine .loader section symbols with the 'dump -Tv' command. *** echo $LIBPATH /opt/freeware/lib:/usr/lib ________________________________ Dit e-mailbericht is alleen bestemd voor de geadresseerden. Indien dit bericht niet voor u is bedoeld, wordt u verzocht de afzender hiervan op de hoogte te stellen door het bericht te retourneren en de inhoud niet te gebruiken. This e-mail message is intended to be exclusively for the addressee. If you are not the intended recipient you are kindly requested not to make any use whatsoever of the contents and to notify the sender immediately by returning this e-mail message.

2 1

Stunnel help and guidance request
by Gerald Shaw 18 Sep '19

18 Sep '19

Hello all, I’m new to the mailing list. I’m trying to run stunnel-5.29-1.ppc, and I’m having issues. I’d appreciate your help (or point me to the solution in the archives). OS - AIX 7100-05-03-1846 /home/shawg# rpm -qa|grep -i openssl openssl-1.0.2n-1.ppc /home/shawg# ldd `which stunnel` /usr/bin/stunnel needs: /usr/lib/libc.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libpthreads.a(shr_xpg5.o) /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2) /opt/freeware/lib/libssl.a(libssl.so.1.0.2) /unix /usr/lib/libcrypt.a(shr.o) ** ERROR MESSAGE_- /home/shawg# /usr/bin/stunnel exec(): 0509-036 Cannot load program /usr/bin/stunnel because of the following errors: 0509-130 Symbol resolution failed for stunnel because: 0509-136 Symbol strcmp (number 112) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol memmove (number 137) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strncpy (number 142) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strcpy (number 169) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol bcopy (number 245) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-192 Examine .loader section symbols with the 'dump -Tv' command. *** echo $LIBPATH /opt/freeware/lib:/usr/lib ** I’d appreciate any help or guidance. Thanks in advance. R, G. Shaw

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 7
by Brent Kimberley 18 Sep '19

18 Sep '19

>> 2019.09.16 13:36:28 LOG6[3]: PSK identity not found (session resumption?)Try dumping the symbols for ctx.c::psk_find(), ssl_lib.c::SSL_get_ex_data(), and ctx.c:: psk_server_callback(). Date: Tue, 17 Sep 2019 18:18:13 +0200 From: Hannah Koperberg <hannah.koperberg(a)gmail.com> Subject: [stunnel-users] Problems when using PSK between a version of stunnel usingopenssl 1.0 and a version of stunnel using openssl 1.1.1 We encounter problems when using PSK between a version of stunnel using openssl 1.0 and a version of stunnel using openssl 1.1.1 The problem being the following: 2019.09.16 13:36:28 LOG6[3]: PSK identity not found (session resumption?) 2019.09.16 13:36:28 LOG7[3]: TLS alert (write): fatal: unknown PSK identity 2019.09.16 13:36:28 LOG3[3]: SSL_accept: s3_srvr.c:2845: error:1408B0DF:SSL routines:ssl3_get_client_key_exchange:psk identity not found No problems are encountered when using certificates or when the same versions of stunnel and openssl are used. In the latter case neither certificates nor PSK give any problems connecting. Kind regards, Hannah Koperberg, de Volksbank in the Netherlands

1 1

openssl inquiry
by Brent Kimberley 16 Sep '19

16 Sep '19

Can someone please walk me through how to replace 1.1.1c with 1.1.1d ? For example: 1. Download from SLP https://github.com/slproweb/opensslhashes/ 2. Extract & overwrite

1 0

TR: using sTunnel with Chrome (Pierre DUPONT)
by Brent Kimberley 06 Sep '19

06 Sep '19

Dump your stunnel.crt file. <stunnel_home>/bin/openssl x509 -in stunnel.crt -noout -text And, compare with * section 4 of https://tools.ietf.org/html/rfc5280 * Peer-reviewed public sites. https://www.ssllabs.com/ssltest/ Dump your stunnel.cnf file. And, compare with stunnel_home>/config/openssl.cnf file https://access.redhat.com/solutions/28965 https://www.openssl.org/docs/manmaster/man5/x509v3_config.html ---------------------------------------------------------------------- From: Pierre DUPONT <pierre.dupont(a)nedap.fr> De : Pierre DUPONT Envoy? : jeudi 5 septembre 2019 16:55 Cc : _sav.bibli <sav.bibli(a)nedap.fr>; Philippe ANQUETIN <philippe.anquetin(a)nedap.fr> Objet : using sTunnel with Chrome Good day to all. So far, I can't succeed to use Chrome with sTunnel. Here is my configuration for sTunnel.... However, I cannot connect on https I tried several things found browsing the list, like building a certificate with openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.crt -keyout stunnel.crt No result so the only solution I see now is to call you for some help... With kind regards, Cordiales salutations de Pierre Dupont Support S.A.V. & D?veloppement Biblioth?ques Courriel S.A.V. : sav.bibli(a)nedap.fr<mailto:sav.bibli@nedap.fr> 06 13 99 69 38 - 01.61.03.03 18 8/10 Chemin d'Andr?sy 95610 Eragny sur Oise NEDAP LOGO

1 0

TR: using sTunnel with Chrome
by Pierre DUPONT 06 Sep '19

06 Sep '19

De : Pierre DUPONT Envoyé : jeudi 5 septembre 2019 16:55 À : 'stunnel-users(a)stunnel.org' <stunnel-users(a)stunnel.org> Cc : _sav.bibli <sav.bibli(a)nedap.fr>; Philippe ANQUETIN <philippe.anquetin(a)nedap.fr> Objet : using sTunnel with Chrome Good day to all. So far, I can't succeed to use Chrome with sTunnel. I use these versions sTunnel : 5.55 (downloaded today...) Chrome is 76.0.3809 132 [cid:image002.png@01D5640A.99D102C0] Here is my configuration for sTunnel : ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2019 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) ;debug = info ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; e.g. softhsm2.dll or opensc-pkcs11.so ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server [https] accept = 443 connect = 81 cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini The 81 connect port is used by our local webservice : http://localhost:81/nedaprfidwebservice.asmx which runs OK [cid:image007.png@01D5640A.99D102C0] The problem is when I try to import the certificate. It looks OK giving these informations [cid:image008.png@01D5640A.99D102C0] [cid:image016.png@01D5640A.99D102C0] However, I cannot connect on https [cid:image017.png@01D5640A.99D102C0] I tried several things found browsing the list, like building a certificate with openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.crt -keyout stunnel.crt No result so the only solution I see now is to call you for some help... With kind regards, Cordiales salutations de Pierre Dupont Support S.A.V. & Développement Bibliothèques Courriel S.A.V. : sav.bibli(a)nedap.fr<mailto:sav.bibli@nedap.fr> Téléphone : 06 13 99 69 38 - 01.61.03.03 18 8/10 Chemin d'Andrésy 95610 Eragny sur Oise [NEDAP LOGO - INLINE - RGB]

1 0

High cpu usage 2016 server
by Cooper, Dave 02 Sep '19

02 Sep '19

Using latest version of stunnel. Running on 3 separate 2016 servers. On each server stunnel is consuming 40% of the cpu even though no end point is even connected. Sent from my iPhone ____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ ***MBS DISCLAIMER*** Multi-Bank Securities, Inc. (MBS) cannot be held responsible for errors regarding time and/or price on buy/sell requests via e-mail. Information provided in this email has been prepared from sources to be reliable, but is not guaranteed and is not a complete summary or statement of all data necessary for making an investment decision. This is for informational purposes only and does not constitute a recommendation, please confirm all information before investing. Securities discussed are subject to availability and change in price and yield. Changes to assumptions may have a material impact on returns. Past performance is not indicative of future returns. Additional information is available upon request. This email is intended only for the entity or person to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of this information by entities or persons other than the intended recipient is prohibited. If you receive this message in error, please contact the sender immediately and delete the material from your computer. If you no longer wish to receive e-mails from MBS, please forward this email to compliance(a)mbssecurities.com and place the word REMOVE in the subject line

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3
by Eric Eberhard 28 Aug '19

28 Aug '19

No. If it ain’t broke, don’t fix it! Old saying but still relevant. The continual updates in all modern software may fix something – and another broken. IMO. I know I am a minority on this this group but an old tried and true setup has great value. Experience, reduces updates and adds to stability. We don’t change our code unless we must. We think it is more stable. Don’t listen to me if you are the type that must have every update ASAP Listen to me if you don’t need the latest and greatest and your app works properly. Study the new version and make a plan to move forward when the time is right. We often move forward to the previous stable release. Often months or even a year later. If the improvements are for things you don’t use, put them off. Look at exactly what the release notes say to help you decide if the update is worth it, you might find it improves only functionality you don’t use. It saves time and money and does not introduce new bugs. We use a very unpopular method – we use inetd. This releases you from all the server management code which is very very very hard to make work on all systems as they work so differently. We are on IBM with AIX (Unix). I doubt a lot of people are testing that configuration. Stunnel is very good at not requiring you to update one step at a time! You can skip safely. Enough blather. I am sure there are a lot of people that disagree with me. And they are likely correct in certain situations. We suggest you look at your situation and and see if you can skip releases … All opinion, not fact. I am old-school so keep that in mind! Good Luck, Eric From: Brent Kimberley [mailto:brent_kimberley@rogers.com] Sent: Wednesday, August 28, 2019 8:16 AM To: stunnel-users(a)stunnel.org; Eric Eberhard <flash(a)vicsmba.com> Cc: daniel.trickett(a)milliporesigma.com Subject: Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3 Have you tried RFC8410? On Thursday, August 22, 2019, 04:00:43 p.m. EDT, Eric Eberhard <flash(a)vicsmba.com <mailto:flash@vicsmba.com> > wrote: <snip>We use similar logic with one stunnel and have millions of transactions daily... [4+10+1 mil XML+web calls]. <snip>R

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3
by Eric Eberhard 28 Aug '19

28 Aug '19

Thanks :) -- I think Daniel can solve his problem. If for some reason he cannot make the app server output clear text he has to do it as you laid out. If he can, he can do one stunnel with TLSv1.2 by making the app output clear text. Both will work and should be secure. I’d do the latter is possible – way less overhead doing encryption. We use similar logic with one stunnel and have millions of transactions daily (XML not cXML but that does not matter – ours are often fairly large as in 100s of MB). Encrypting clear to SSLv3 then back to clear to TLSv1.2 is three encryptions along that path instead of one by making the app output clear text. The app will also shrink if that matters as it won’t need encryption code. E From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Brent Kimberley Sent: Thursday, August 22, 2019 7:29 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3 >>there is no reason to connect to localhost with any security Should server/interface consolidation trigger functional/technical rework prior to go live? As per the diagram: the app server node x TLS engine node interface is wrapped in SSL the internal localhost x localhost interface is in the clear the TLS engine node x punchout-vendor node is wrapped in TLSv1.2 >> SNI flag (RFC 3546) Good catch. ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Aug 2019 08:01:08 -0700 From: "Eric Eberhard" <flash(a)vicsmba.com <mailto:flash@vicsmba.com> > To: "'Brent Kimberley'" <brent_kimberley(a)rogers.com <mailto:brent_kimberley@rogers.com> >, <stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> > Thank you -- what I had in mind but I am not that fancy with the setups as we use one. We go from our application in clear text to stunnel TLSv1.2 which is clearly easier. I did make this work for a short while a long time ago and did not save the files. Plus no may people's horror we use inetd. Of course we only transfer 4 million XML docs per day and handle 10 million Web calls and another million connections for credit cards, etc. I have been told that if I had serious volume inetd is slower -:) but I have not noticed enough of a slowdown to matter. And inetd (at least on an IBM AIX server) is dead reliable and easy. As a curiosity -- as I often see people coding unnecessarily -- there is no reason to connect to localhost with any security at all unless your app can only output SSLv3 which would imply a 3rd party vendor. The traffic never hits the network in any way -- not even the network card -- it goes directly to/from the TCP/IP stack which is why I mentioned just making the app send clear text to one stunnel that outputs TLSv1.2 ... if possible (may not be if it is something you don't have source to). Eric -----Original Message----- From: Brent Kimberley [mailto:brent_kimberley@rogers.com <mailto:brent_kimberley@rogers.com> ] Sent: Tuesday, August 20, 2019 6:42 AM To: stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Cc: daniel.trickett(a)milliporesigma.com <mailto:daniel.trickett@milliporesigma.com> ; flash(a)vicsmba.com <mailto:flash@vicsmba.com> Subject: Re: stunnel-users Digest, Vol 181, Issue 1 Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html <https://www.stunnel.org/static/stunnel.html%20> ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com <mailto:daniel.trickett@milliporesigma.com> > To: "stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> " <stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> > Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

3 2

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3
by Brent Kimberley 22 Aug '19

22 Aug '19

>>there is no reason to connect to localhost with any security Should server/interface consolidation trigger functional/technical rework prior to go live? As per the diagram: the app server node x TLS engine node interface is wrapped in SSL the internal localhost x localhost interface is in the clear the TLS engine node x punchout-vendor node is wrapped in TLSv1.2 >> SNI flag (RFC 3546)Good catch. ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Aug 2019 08:01:08 -0700 From: "Eric Eberhard" <flash(a)vicsmba.com> To: "'Brent Kimberley'" <brent_kimberley(a)rogers.com>, <stunnel-users(a)stunnel.org> Thank you -- what I had in mind but I am not that fancy with the setups as we use one. We go from our application in clear text to stunnel TLSv1.2 which is clearly easier. I did make this work for a short while a long time ago and did not save the files. Plus no may people's horror we use inetd. Of course we only transfer 4 million XML docs per day and handle 10 million Web calls and another million connections for credit cards, etc. I have been told that if I had serious volume inetd is slower -:) but I have not noticed enough of a slowdown to matter. And inetd (at least on an IBM AIX server) is dead reliable and easy. As a curiosity -- as I often see people coding unnecessarily -- there is no reason to connect to localhost with any security at all unless your app can only output SSLv3 which would imply a 3rd party vendor. The traffic never hits the network in any way -- not even the network card -- it goes directly to/from the TCP/IP stack which is why I mentioned just making the app send clear text to one stunnel that outputs TLSv1.2 ... if possible (may not be if it is something you don't have source to). Eric -----Original Message----- From: Brent Kimberley [mailto:brent_kimberley@rogers.com] Sent: Tuesday, August 20, 2019 6:42 AM To: stunnel-users(a)stunnel.org Cc: daniel.trickett(a)milliporesigma.com; flash(a)vicsmba.com Subject: Re: stunnel-users Digest, Vol 181, Issue 1 Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 1
by Eric Eberhard 21 Aug '19

21 Aug '19

Thank you -- what I had in mind but I am not that fancy with the setups as we use one. We go from our application in clear text to stunnel TLSv1.2 which is clearly easier. I did make this work for a short while a long time ago and did not save the files. Plus no may people's horror we use inetd. Of course we only transfer 4 million XML docs per day and handle 10 million Web calls and another million connections for credit cards, etc. I have been told that if I had serious volume inetd is slower -:) but I have not noticed enough of a slowdown to matter. And inetd (at least on an IBM AIX server) is dead reliable and easy. As a curiosity -- as I often see people coding unnecessarily -- there is no reason to connect to localhost with any security at all unless your app can only output SSLv3 which would imply a 3rd party vendor. The traffic never hits the network in any way -- not even the network card -- it goes directly to/from the TCP/IP stack which is why I mentioned just making the app send clear text to one stunnel that outputs TLSv1.2 ... if possible (may not be if it is something you don't have source to). Eric -----Original Message----- From: Brent Kimberley [mailto:brent_kimberley@rogers.com] Sent: Tuesday, August 20, 2019 6:42 AM To: stunnel-users(a)stunnel.org Cc: daniel.trickett(a)milliporesigma.com; flash(a)vicsmba.com Subject: Re: stunnel-users Digest, Vol 181, Issue 1 Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

Re: [stunnel-users] https to https proxy
by Eric Eberhard 20 Aug '19

20 Aug '19

I'll bite - probably missing something. Why not have your application output clear text to stunnel and set stunnel to TLSv1.2? In other words, drop the SSL from your application. If that won't work I think you can do it with two stunnels (I got it to work once before I did the above). One accepts SSLv3 and outputs clear text . it is the client=no option. The output goes to a stunnel that is client=yes and is set to TLSv1.2 . which outputs to your final destination. The output from the client=no would be to localhost on some port that fires the second stunnel. I suspect you have to use different port numbers. All guesses as I am not sure exactly what you are doing . but if it helps, great :) Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Daniel Trickett Sent: Monday, August 19, 2019 11:21 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 1
by Brent Kimberley 20 Aug '19

20 Aug '19

Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

https to https proxy
by Daniel Trickett 19 Aug '19

19 Aug '19

Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

Working OCSP example instructions?
by Mark Currie 24 Jul '19

24 Jul '19

Hi, Does anyone have a link to detailed instructions of a working example of Stunnel with OCSP? (including certificate creation if possible) I came across one some time back but can no longer find it. I would greatly appreciate any help with this. I wasn't able to get any replies to my earlier posting showing my problem: https://www.stunnel.org/pipermail/stunnel-users/2019-July/006451.html

1 0

Is there a latest version Debian stunnel package?
by Miranda Zhang 23 Jul '19

23 Jul '19

Hi everyone, I can only find stunnel4 Debian package: https://packages.debian.org/search?keywords=stunnel https://debian.pkgs.org/10/debian-main-amd64/stunnel4_5.50-3_amd64.deb.html ftp://ftp.stunnel.org/stunnel/archive/5.x/stunnel4_5.28-0ubuntu1_amd64.deb <ftp://ftp.stunnel.org/stunnel/archive/5.x/> Is there a 5.55 package? Thanks, Miranda

2 1

Multiple certificates with same hash
by Marco Göbel 23 Jul '19

23 Jul '19

Hi, we use c_rehash to upgrade client certificates and we have multiple certificates with the same hash (e.g. same subject but different start-/end validity) like: ee98f073.0 ee98f073.1 ee98f073.2 The man-page description for the CApath option seems to be correct what stunnel will do: >Note that the certificates in this directory should be named XXXXXXXX.0 >where XXXXXXXX is the hash value of the DER encoded subject of the cert. It seems only certificates with the ending .0 is used by stunnel and the others certificate hashes with higher numbers are never used/read. Can you confirm? Any idea how to use all certificates with stunnel? BTW. we tested with version 4.56 and latest 5.5 Regards, Marco

1 0

Multi-Mode-Stunnel
by MESSINGSCHLAGER Andreas 17 Jul '19

17 Jul '19

Is it possible to run stunnel in the server-mode und in the client-mode on the same server? ------------------------------------------------------ ADG Apotheken-Dienstleistungsgesellschaft mbH Salzachstrasse 15 D-68199 Mannheim ADG ist Gesamt-Sieger der "markt intern" Umfragen "Apotheken - Software 2009, 2011, 2013, 2016 & 2018". Sitz: Mannheim Registergericht: Amtsgericht Mannheim HRB 701436 USt.-IdNr.: DE132763561 Geschaeftsfuehrer: Joachim von Morstein, Bernd Hess, Dr. Max Schwesig Diese E-Mail und alle Anhaenge enthalten vertrauliche und rechtlich geschuetzte Informationen, die ausschliesslich fuer den Gebrauch des Adressaten bestimmt sind. Das unerlaubte Kopieren, die unbefugte Weitergabe oder sonstiger ungenehmigter Gebrauch der E-Mail nebst den Anhaengen sind nicht gestattet. Sollten Sie nicht der richtige Adressat sein oder die E-Mail irrtuemlich erhalten haben, informieren Sie bitte den Absender unverzueglich telefonisch oder per E-Mail und vernichten diese E-Mail und alle Anhaenge sowie etwaige Kopien und Sicherungskopien. Vielen Dank. This e-mail message and all attachments transmitted with it may contain legally privileged and confidential information intended solely for the use of the addressee. If you are not the intended recipient or have received this e-mail in error, you are hereby notified that any dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately by telephone or by electronic mail, and delete this message and all copies and backups thereof. Thank you. ------------------------------------------------------

3 2

feature ? authorizing only given certificates ?
by fmgre-dell＠yahoo.fr 15 Jul '19

15 Jul '19

Hello My european organization is using a certificate chain which signs tens of thousands of user certificates. My local organization counts 300 users ... and i only want these 300 to get in the IT system. I'd like to know if there is a way to restrict the connection to a subset of certificates ( for example based on a list of authorized emails which are written in the certificate ) Sincerely Fred

3 4

Possible to verify client certificate BUT ignore expiration-date?
by Brent Kimberley 11 Jul '19

11 Jul '19

Would libfaketime or run_as_date help? Date: Thu, 11 Jul 2019 10:48:39 -0400 From: Christopher Schultz <chris(a)christopherschultz.net> To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? Eric, (Coming back to this.) On 5/14/19 14:41, Eric Eberhard wrote: > Chris, > > There are "real" certificates you purchase from a certificate authority and pay an annual fee. If this is https you pretty much need that or the user gets errors. By private I meant "self signed." > > However, openssl has an option to create a certificate. You type the name, address, whatever, and it makes a certificate. It is JUST AS GOOD as a purchased certificate (except https or perhaps others that want certificate authority certificates). I use them for FTP and SSH and many things . > > openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 > > You can put your own expire date(days) when you make the cert. A screen will come up and ask 20 questions :-) If you cannot do it (don't have openssl installed) I can do it for you. It certainly will work as a stop-gap. We don't need it for https as it is Apache on a machine that is hosted. So... everything above is exactly what we do with this vendor. We don't have a problem getting a well-known-CA to sign the certificate. We have (had) a problem with the vendor just getting the damned work done. Yes, I know it is a 5-minute process but when you are dealing with a big company where you have to have 6 managers in multiple time zones call each other to confirm the problem, have a meeting about the solution, determine a course of action, allocate a resource to perform the work, QA the solution, then get an IT review of everything before placing something into production, that 5-minute fix can take days or weeks. I just wanted to say "I still trust this certificate, even though it has expired." Is that possible to do without recompiling stunnel? Thanks, -chris

1 0

Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date?
by Christopher Schultz 11 Jul '19

11 Jul '19

Eric, (Coming back to this.) On 5/14/19 14:41, Eric Eberhard wrote: > Chris, > > There are "real" certificates you purchase from a certificate authority and pay an annual fee. If this is https you pretty much need that or the user gets errors. By private I meant "self signed." > > However, openssl has an option to create a certificate. You type the name, address, whatever, and it makes a certificate. It is JUST AS GOOD as a purchased certificate (except https or perhaps others that want certificate authority certificates). I use them for FTP and SSH and many things . > > openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 > > You can put your own expire date(days) when you make the cert. A screen will come up and ask 20 questions :-) If you cannot do it (don't have openssl installed) I can do it for you. It certainly will work as a stop-gap. We don't need it for https as it is Apache on a machine that is hosted. So... everything above is exactly what we do with this vendor. We don't have a problem getting a well-known-CA to sign the certificate. We have (had) a problem with the vendor just getting the damned work done. Yes, I know it is a 5-minute process but when you are dealing with a big company where you have to have 6 managers in multiple time zones call each other to confirm the problem, have a meeting about the solution, determine a course of action, allocate a resource to perform the work, QA the solution, then get an IT review of everything before placing something into production, that 5-minute fix can take days or weeks. I just wanted to say "I still trust this certificate, even though it has expired." Is that possible to do without recompiling stunnel? Thanks, -chris > -----Original Message----- > From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Christopher Schultz > Sent: Tuesday, May 14, 2019 6:49 AM > To: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? > > Eric, > > On 5/13/19 18:06, Eric Eberhard wrote: >> Use openssl to make a private cert? > > What is a "private cert"? > > Also, I need to trust an existing certificate... If they can create a new certificate, then I can just trust the new one. I'm looking for a stop-gap measure, here. > > Thanks, > -chris > >> -----Original Message----- >> From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On >> Behalf Of Christopher Schultz >> Sent: Monday, May 13, 2019 2:28 PM >> To: stunnel-users(a)stunnel.org >> Subject: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? >> >> All, >> >> Does anyone know if it is possible to perform all other verification of a client certificate EXCEPT allow the certificate to have expired? >> >> We have a vendor whose certificate has expired, and we want to allow >> their old certificate to work while they chase their tails trying to >> figure out the best way to re-issue a new cert for us. *eyeroll* >> >> Is it possible? >> >> Thanks, >> -chris >> >> >> >> > > >

1 0

OCSP problem - wrong cert validated
by Mark Currie 11 Jul '19

11 Jul '19

Hi, I am having a problem using OCSP with Stunnel. client: stunnel-5.55, server: stunnel-5.49, both using openssl-1.0.2k-fips. When I use the openssl ocsp command it works fine e.g.: openssl ocsp -issuer idca-rootca.pem -CAfile idca-rootca.pem -cert server-cert.pem -url http://10.0.0.166:40040 Response verify OK server-cert.pem: good Wireshark: OCSP request contains the server cert serial number, and OCSP response returns "certStatus: good(0)". However, when I use Stunnel the OCSP lookup fails (Connection reset by peer), and in the Stunnel log I get: LOG3[0]: OCSP: OCSP_basic_verify: ocsp_vfy.c:166: error:27069070:OCSP routines:OCSP_basic_verify:root ca not trusted Wireshark: OCSP request now contains the issuer (idca) instead of the server cert serial number, and the OCSP response returns "certStatus: unknown (2)". I have tried various combinations of cert and CA pem files e.g. server cert on its own, then including idca, then including both idca and rootca. I have also tried all combinations of CA cert, even including all certs in it. I am testing Stunnel using SSH over TLS and here are the configs: Stunnel client config: [ssh] CAfile = idca-rootca.pem cert = client-cert.pem key = client-key.pem accept=40010 connect=10.0.0.166:40010 verifyPeer = yes OCSP = http://10.0.0.166:40040 Stunnel server config: [sshd] CAfile = idca-rootca.pem cert = server-cert.pem key = server-key.pem accept = 10.0.0.166:40010 connect = 22 Appreciate any help with this problem.

1 0

Academic doubt about firewall bypass
by Brent Kimberley 09 Jul '19

09 Jul '19

Which scenario did you have in mind? [HTTP CLIENT] -->[STUNNEL CLIENT]--><whatever>-->[STUNNEL SERVER]-->[HTTP Server] OR[HTTP Client] -->[Forward-proxy client]-> [STUNNEL CLIENT]--> <whatever>-->[STUNNEL SERVER]-->[REVERSE-PROXY server]--><whatever>--> [HTTP SERVER ] From: Hugo Marello <hugo.marello(a)gmail.com> To: stunnel-users(a)stunnel.org Hello guys, I'm new to using stunnel but I find it quite a powerful tool. I'm doing a POC on how we can bypass our firewall even with DPI, and chose to use stunnel for an extra layer of cryptography. You don't have to worry about access to any VM mentioned here. Here is my scenario: [CLIENT BROWSER] -->[STUNNEL CLIENT]-->[FIREWALL]-->[STUNNEL SERVER]-->[REVERSE PROXY]-->[FREE INTERNET] So far I succeeded in getting HTTP working using stunnel CONNECT protocol to the firewall and going all the way through. The problem is when I try to access HTTPS, the connection get set to the stunnel server but it keeps waiting for something. Double checked all the logs, firewall can't discern, stunnel server get the connection, reverse proxy also get the socket connection. My hypothesis is that stunnel client gets the CONNECT from the browser and discard it, it uses its own way to connect to the firewall, instead of encrypting the CONNECT all the way through. As it may seems, I need a way to send 2 CONNECT packages. Does anyone know how can I proceed? Follow my configs: client = yes output = /var/log/stunnel4/stunnel.log debug = 7 [bypassclient] accept = 4000 connect = firewall.example:3128 protocolHost = destination.com:443 protocol = connect requireCert = no verifyChain = no verifyPeer = no -------------------------------------------------------------------------------------------------------------------- [bypassserver] accept = 0.0.0.0:443 connect = reverseproxy.com:8888 cert = /etc/ssl/cert.pem key = /etc/ssl/key.pem ----------------------------------------------------------------------------------------------------------------------- Thank you all in advance, already digging throw the source code (quite lost tough), Hugo

1 1

Re: [stunnel-users] stunnel-users Digest, Vol 180, Issue 1
by Hugo Marello 09 Jul '19

09 Jul '19

I was thinking something more simple like the first scenario. [HTTP?CLIENT] -->[STUNNEL CLIENT]--><whatever>-->[STUNNEL SERVER]-->[HTTP Server] But the end would be an HTTPS server, which would require a CONNECT to get things going. So: [HTTP Client] -->[STUNNEL CLIENT]--> <whatever>-->[STUNNEL SERVER]-->[REVERSE-PROXY server]--> [HTTPS SERVER] Em ter, 9 de jul de 2019 às 07:00, <stunnel-users-request(a)stunnel.org> escreveu: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Academic doubt about firewall bypass (Brent Kimberley) > 2. How to turn off logging (David Yunker) > 3. Re: How to turn off logging (Thomas Eifert) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 8 Jul 2019 16:42:39 +0000 (UTC) > From: Brent Kimberley <brent_kimberley(a)rogers.com> > To: <stunnel-users(a)stunnel.org> > Cc: "hugo.marello(a)gmail.com" <hugo.marello(a)gmail.com> > Subject: [stunnel-users] Academic doubt about firewall bypass > Message-ID: <182803560.2815516.1562604159801(a)mail.yahoo.com> > Content-Type: text/plain; charset="utf-8" > > Which scenario did you have in mind? > [HTTP?CLIENT] -->[STUNNEL CLIENT]--><whatever>-->[STUNNEL SERVER]-->[HTTP > Server]?OR[HTTP Client] -->[Forward-proxy client]->?[STUNNEL CLIENT]--> > <whatever>-->[STUNNEL SERVER]-->[REVERSE-PROXY server]--><whatever>--> > [HTTP SERVER ] > > > > From: Hugo Marello <hugo.marello(a)gmail.com> > To: stunnel-users(a)stunnel.org > > Hello guys, > I'm new to using stunnel but I find it quite a powerful tool. I'm doing a > POC on how we can bypass our firewall even with DPI, and chose to use > stunnel for an extra layer of cryptography. You don't have to worry about > access to any VM mentioned here. Here is my scenario: > > [CLIENT BROWSER] -->[STUNNEL CLIENT]-->[FIREWALL]-->[STUNNEL > SERVER]-->[REVERSE PROXY]-->[FREE INTERNET] > > So far I succeeded in getting HTTP working using stunnel CONNECT protocol > to the firewall and going all the way through. The problem is when I try to > access HTTPS, the connection get set to the stunnel server but it keeps > waiting for something. Double checked all the logs, firewall can't discern, > stunnel server get the connection, reverse proxy also get the socket > connection. My hypothesis is that stunnel client gets the CONNECT from the > browser and discard it, it uses its own way to connect to the firewall, > instead of encrypting the CONNECT all the way through. As it may seems, I > need a way to send 2 CONNECT packages. Does anyone know how can I proceed? > > Follow my configs: > client = yes > output = /var/log/stunnel4/stunnel.log > debug = 7 > > [bypassclient] > accept = 4000 > connect = firewall.example:3128 > protocolHost = destination.com:443 > protocol = connect > requireCert = no > verifyChain = no > verifyPeer = no > > -------------------------------------------------------------------------------------------------------------------- > [bypassserver] > accept = 0.0.0.0:443 > connect = reverseproxy.com:8888 > cert = /etc/ssl/cert.pem > key = /etc/ssl/key.pem > > ----------------------------------------------------------------------------------------------------------------------- > > > Thank you all in advance, already digging throw the source code (quite lost > tough), > Hugo >

1 0

Re: [stunnel-users] Error during linking Stunnel 5.55
by Eric Eberhard 09 Jul '19

09 Jul '19

The whole 32 bit vs 64 bit thing is a pain. On Windows and Linux you have to load all kinds of unobvious things. On AIX it just works. Code from 1988 (when I lost source code for half a dozen programs) still works on current machines. Why the others make it SO HARD is beyond me. In AIX old code works. One flag – saying you want 64 bit – is all you need to add to the Makefile. Otherwise is just works as always. It took me MONTHS to figure out how to make Linuc work – had to yum 32 bit, 64 bit, a compat set, etc. Nightmare. Wish people would consider keeping things compatible like IBM does. Ditto on new features. Any new feature you merely need to add a flag, and all is good. Otherwise the old ones keep working. An example is POSIX. With IBM/AIX you could do things the old way, or set a flag for POSIX. Yes, we have had the same source (with updates, I did do the POSIX updates) since 1988. Never a problem. Partly, I think, because they don’t deprecate ANYTHING. Use the old routines if you like. Or not if you chose. Your problem is not having ALL of the required libraries! That is it. Finding what you need is the challenge. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Heinsbroek, Peter Sent: Tuesday, July 09, 2019 6:20 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Error during linking Stunnel 5.55 I tried to build stunnel from the sources. The compiling goes well ,but the linking gives an error When comping 32bit I get : sthreads.obj : error LNK2019: unresolved external symbol _CRYPTO_set_id_callback referenced in function _sthreads_init ..\bin\win32\stunnel.exe : fatal error LNK1120: 1 unresolved externals NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\VC\Tools\MSVC\14.16.27023\bin\HostX86\x86\link.EXE"' : return code '0x460' Stop. Anyone knows how to solve. Met vriendelijke groet, Peter Heinsbroek ICT Specialist – IDM TTS BTN/NL-TEC-Generic-Infra-S2 T: +31 (0) 88 265 9869 M: +31 (0) 6 53753244 Burg. Rijnderslaan 30 – Nederland <https://atos.net/> atos.net <https://www.linkedin.com/in/peter-heinsbroek-10467b52/> This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Re: [stunnel-users] How to turn off logging
by Eric Eberhard 09 Jul '19

09 Jul '19

Yes - just difficult :) We have our own logging in our application and we don't want stunnel's logging (or on screen error messages) to occur. We want them to go to our log files. So simply go to log.c and change the log_error() routines. I keep notes of any changes I make so that when I get new version I can repeat them. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of David Yunker Sent: Monday, July 08, 2019 2:47 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] How to turn off logging To whom it may concern, I would like to know if there is a way to disable logging or set a size limit or to have it overwrite the log file each time a new log is started? I am using the Windows version of Stunnel. Thank you for your help.

1 0

Error during linking Stunnel 5.55
by Heinsbroek, Peter 09 Jul '19

09 Jul '19

I tried to build stunnel from the sources. The compiling goes well ,but the linking gives an error When comping 32bit I get : sthreads.obj : error LNK2019: unresolved external symbol _CRYPTO_set_id_callback referenced in function _sthreads_init ..\bin\win32\stunnel.exe : fatal error LNK1120: 1 unresolved externals NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\VC\Tools\MSVC\14.16.27023\bin\HostX86\x86\link.EXE"' : return code '0x460' Stop. Anyone knows how to solve. Met vriendelijke groet, [Atos logo] Peter Heinsbroek ICT Specialist – IDM TTS BTN/NL-TEC-Generic-Infra-S2 T: +31 (0) 88 265 9869 M: +31 (0) 6 53753244 Burg. Rijnderslaan 30 – Nederland atos.net<https://atos.net/> [LinkedIn icon]<https://www.linkedin.com/in/peter-heinsbroek-10467b52/> This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

How to turn off logging
by David Yunker 08 Jul '19

08 Jul '19

To whom it may concern, I would like to know if there is a way to disable logging or set a size limit or to have it overwrite the log file each time a new log is started? I am using the Windows version of Stunnel. Thank you for your help.

2 1

Academic doubt about firewall bypass
by Hugo Marello 28 Jun '19

28 Jun '19

Hello guys, I'm new to using stunnel but I find it quite a powerful tool. I'm doing a POC on how we can bypass our firewall even with DPI, and chose to use stunnel for an extra layer of cryptography. You don't have to worry about access to any VM mentioned here. Here is my scenario: [CLIENT BROWSER] -->[STUNNEL CLIENT]-->[FIREWALL]-->[STUNNEL SERVER]-->[REVERSE PROXY]-->[FREE INTERNET] So far I succeeded in getting HTTP working using stunnel CONNECT protocol to the firewall and going all the way through. The problem is when I try to access HTTPS, the connection get set to the stunnel server but it keeps waiting for something. Double checked all the logs, firewall can't discern, stunnel server get the connection, reverse proxy also get the socket connection. My hypothesis is that stunnel client gets the CONNECT from the browser and discard it, it uses its own way to connect to the firewall, instead of encrypting the CONNECT all the way through. As it may seems, I need a way to send 2 CONNECT packages. Does anyone know how can I proceed? Follow my configs: client = yes output = /var/log/stunnel4/stunnel.log debug = 7 [bypassclient] accept = 4000 connect = firewall.example:3128 protocolHost = destination.com:443 protocol = connect requireCert = no verifyChain = no verifyPeer = no -------------------------------------------------------------------------------------------------------------------- [bypassserver] accept = 0.0.0.0:443 connect = reverseproxy.com:8888 cert = /etc/ssl/cert.pem key = /etc/ssl/key.pem ----------------------------------------------------------------------------------------------------------------------- Thank you all in advance, already digging throw the source code (quite lost tough), Hugo

1 0

SOLVED, I cannot get Outlook Express email to work after Cox changes
by Brent Kimberley 28 Jun '19

28 Jun '19

Thank you Brent, >> I found if I have Avast running with mail shield enabled I get this error in the Stunnel log window: >> SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol >> Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket. >> >> This results in no emails being abled to be sent by SMPT. >> >> If I disable Avast's mail shield the mail is sent with no errors. >> Is there a work around for to be able to use Stunnel without disabling Avast's mail shield? >> POP3 Connection >> CERT: Pre-verification error: self signed certificate in certificate chain >> Rejected by CERT at depth=1: OU=generated by Avast Antivirus for SSL/TLS scanning, O=Avast Web/Mail Shield, CN=Avast Web/Mail Shield Root >> SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed If you need avast, sign your stunnel leaf with a well known root CA, and exchange certificates accordingly. cox_mail : avast_dpi : stunnel_TLS_proxy : client https://support.postbox-inc.com/hc/en-us/articles/204602300-Invalid-Securit…

1 0

stunnel-users Digest, Vol 179, Issue 11
by David Yunker 28 Jun '19

28 Jun '19

Brent, Here is more log information that occurs when using Avast Mail shield. CERT: Pre-verification error: self signed certificate in certificate chain Rejected by CERT at depth=1: OU=generated by Avast Antivirus for SSL/TLS scanning, O=Avast Web/Mail Shield, CN=Avast Web/Mail Shield Root SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed This occurs in the POP3 connection. Hope this helps.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 179, Issue 11
by Brent Kimberley 28 Jun '19

28 Jun '19

>>Does anybody know how to prevent this from happening? Try adding the following: #verify the peer certificate chain starting from the root CA #pre-requisite #1: checkHost (OR checkIP) #pre-requisite #2: CAfile (OR CApath) verifyChain = yes checkHost = pop.cox.com #verify the peer certificate chain starting from the root CA #pre-requisite #1: checkHost (ORcheckIP) #pre-requisite #2: CAfile (OR CApath) verifyChain = yes checkHost = smtp.cox.net ref: https://www.stunnel.org/config_windows.html https://www.stunnel.org/static/stunnel.html From: David Yunker <davidyunker(a)hotmail.com> Subject: [stunnel-users] SOLVED, I cannot get Outlook Express email to work after Cox changes To anybody interested, Here is how to configure Stunnel for Outlook Express v6 in Windows XP to work: Modify Stunnel configuration to this: [cox-pop3] client = yes accept = 127.0.0.1:110 connect = pop.cox.net:995 CAfile = ca-certs.perm OCSPaia = yes [cox-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.cox.net:587 CAfile = ca-certs.perm OCSPaia = yes Now configure Outlook Express as follows: Set incoming mail(POP3) to 127.0.0.1 Set outgoing mail(SMTP) to 127.0.0.1 Have "Logon using secure password authentication" unchecked. Have "My server requires authentication" unchecked For POP3 set incoming mail (POP3) to port 110. For SMTP set outgoing mail (SMTP) to port 25. Have "This server requires a secure connection(SSL)" for POP3 unchecked. Have "This server requires a secure connection(SSL)" for SMTP unchecked. Everything works except I have the following error message in the Stunnel log: "Service [service name] needs authentication to prevent MITM attacks" Does anybody know how to prevent this from happening? I tried having the "My server requires authentication" checked but I still have the message when Stunnel starts. Thank you for any help.

2 1

openssl integration
by Brent Kimberley 27 Jun '19

27 Jun '19

Try the following: .\openssl engine -vvvv https://github.com/openssl/openssl/blob/OpenSSL_1_1_1-stable/README.ENGINE

2 1

Problem with pkcs11
by Heinsbroek, Peter 25 Jun '19

25 Jun '19

Hallo everybody. I’m running Stunnel 5.44 with pkcs11 on windows ,with the use of a HSM containing the private keys. That’s working fine. Now I want to upgrade to 5.55,so from 32 bit to 64 bit. I replaced the 32 bit cryptoki with a 64 bit cryptoki. But now it isn’t working. I looked with sysinternals ,and it seems the hsm login isn’t working. I also placed the 64bit ssleay32 & libeap32 in the windows\system32 folder. Did I forget something? If anyone can help ,it’s highly appreciated. Met vriendelijke groet, [Atos logo] Peter Heinsbroek ICT Specialist – IDM TTS BTN/NL-TEC-Generic-Infra-S2 T: +31 (0) 88 265 9869 M: +31 (0) 6 53753244 Burg. Rijnderslaan 30 – Nederland atos.net<https://atos.net/> [LinkedIn icon]<https://www.linkedin.com/in/peter-heinsbroek-10467b52/> This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

last version of stunnel that works on Windows XP
by David Yunker 25 Jun '19

25 Jun '19

What is the last version of stunnel that works on Windows XP? Thank you.

1 0

Latest Stunnel for Windows XP
by David Yunker 24 Jun '19

24 Jun '19

To whom it may concern, What was the last version of stunnel that worked on Windows XP? Thanks for the info.

2 1

SOLVED, I cannot get Outlook Express email to work after Cox changes
by David Yunker 22 Jun '19

22 Jun '19

To anybody interested, Here is how to configure Stunnel for Outlook Express v6 in Windows XP to work: Modify Stunnel configuration to this: [cox-pop3] client = yes accept = 127.0.0.1:110 connect = pop.cox.net:995 CAfile = ca-certs.perm OCSPaia = yes [cox-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.cox.net:587 CAfile = ca-certs.perm OCSPaia = yes Now configure Outlook Express as follows: Set incoming mail(POP3) to 127.0.0.1 Set outgoing mail(SMTP) to 127.0.0.1 Have "Logon using secure password authentication" unchecked. Have "My server requires authentication" unchecked For POP3 set incoming mail (POP3) to port 110. For SMTP set outgoing mail (SMTP) to port 25. Have "This server requires a secure connection(SSL)" for POP3 unchecked. Have "This server requires a secure connection(SSL)" for SMTP unchecked. Everything works except I have the following error message in the Stunnel log: "Service [service name] needs authentication to prevent MITM attacks" Does anybody know how to prevent this from happening? I tried having the "My server requires authentication" checked but I still have the message when Stunnel starts. Thank you for any help.

1 0

Help, I cannot get Outlook Express email to work after Cox changes
by David Yunker 21 Jun '19

21 Jun '19

To anybody who can help, I am currently using Stunnel version 5.24. I cannot update it to the latest version because I am using it on a Windows XP system. My problem is that I am currently using COX for my internet provider and COX recently change the email protocol from SSL to TSL. This is a problem since I am currently using Outlook Express v6 and it does not work with TSL. I recently discovered your Stunnel program and believe it will solve my problem. I tried changing the items in the configuration file to the following: fips = yes [cox-pop3] client = yes accept = 127.0.0.1:995 connect = pop.cox.net:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.cox.net OCSPaia = yes Stunnel shows no errors but my email still does not work. This is what happens when setting up the configuration for Outlook express: My POP account is pop.cox.net. My SMTP account is smtp.cox.net. If I set the POP port to 110 and leave the SMTP port to 25 and I have checked "logon using secure password authentication". But I do NOT have checked "this server requires a secure connection (SSL)". Then when I attempt to send/receive I get the following error: "Unable to logon to the server using secure password authentication account 'pop.cox.net server ...." If I do check "this server requires a secure connection (SSL)" and leave the POP port to 110 then when I attempt to send/receive I get the following error: "Your server has unexpectedly terminated the connection ..." If I change the POP port from 110 to 995 and remove the check mark for "this server require a secure connection (SSL)". Then when I attempt to send/receive I get a time out condition. If I check "this server requires a secure connection (SSL)" and attempt a send/receive I get this error: "Your server has unexpectedly terminated the connection.." No matter how I configure my Outlook Express I do not receive any email. I have a friend who has a Windows 7 system and a virtual windows xp installed in it that he uses for his email but is using Outlook in windows xp and this same configuration works fine for him. Except he has to have "verify = 2" removed from the configuration for Stunnel and his SMTP port is 587. For it to work. What am I doing wrong? Please help!

2 1

Re: [stunnel-users] stunnel client: accept on connect success
by Eric Eberhard 19 Jun '19

19 Jun '19

I'm a dummy so what I do is write a "wrapper" -- you connect to your wrapper and manage your problem. If all is good exec stunnel. If not send appropriate messages back. Dummy idea, Eric -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of mihertz(a)gmx.de Sent: Tuesday, June 18, 2019 11:19 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel client: accept on connect success Hi everyone, could use some help for a stunnel client-mode question. Found no corresponding config directives in the manpage, not sure i am searching with the correct terms... or going for the correct approach at all. So there is a scenario where the stunnel client plaintext side does the tcp-handshake (S/S./.) and directly terminates the connected client afterwards (R.). This is caused because the corresponding connect-target fails to establish a TCP/TLS connection with the server (rejected by target server for whatever reason). This could cause a first regular tcp-packet to be send and lost, before stunnel disconnects on the plaintext-side and the application becomes aware of that eventually. I wonder if there is a way to configure stunnel to behave in a similar way to haproxy /w acl? Where it denies all tcp connects unless at least 1 backend server is available. So that stunnel would like "delay" the accept-side TCP handshake while trying to connect to the connect-side via TLS. Based on TCP/TLS success/failure on the connect-side then continues the accept-side TCP handshake or quits its. This way the client would never have the short moment of "ok, i can start" I know that this behaviour is not optimal/desired with the majority of cases, just have the impression I have a use-case for this in my scenario. There is no way to modify the plaintext-side connected application in any way. Tx/Rx data is just a few bytes, so its always 1 packet for requests/answers. And relatively often that first packet sent goes out before the reset (R.) is received by the stunnel client-mode to the software connected on the accept-side. Would be happy for your input and ideas on how to work around that. Best Regards Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

stunnel client: accept on connect success
by mihertz＠gmx.de 19 Jun '19

19 Jun '19

Hi everyone, could use some help for a stunnel client-mode question. Found no corresponding config directives in the manpage, not sure i am searching with the correct terms... or going for the correct approach at all. So there is a scenario where the stunnel client plaintext side does the tcp-handshake (S/S./.) and directly terminates the connected client afterwards (R.). This is caused because the corresponding connect-target fails to establish a TCP/TLS connection with the server (rejected by target server for whatever reason). This could cause a first regular tcp-packet to be send and lost, before stunnel disconnects on the plaintext-side and the application becomes aware of that eventually. I wonder if there is a way to configure stunnel to behave in a similar way to haproxy /w acl? Where it denies all tcp connects unless at least 1 backend server is available. So that stunnel would like "delay" the accept-side TCP handshake while trying to connect to the connect-side via TLS. Based on TCP/TLS success/failure on the connect-side then continues the accept-side TCP handshake or quits its. This way the client would never have the short moment of "ok, i can start" I know that this behaviour is not optimal/desired with the majority of cases, just have the impression I have a use-case for this in my scenario. There is no way to modify the plaintext-side connected application in any way. Tx/Rx data is just a few bytes, so its always 1 packet for requests/answers. And relatively often that first packet sent goes out before the reset (R.) is received by the stunnel client-mode to the software connected on the accept-side. Would be happy for your input and ideas on how to work around that. Best Regards Michael

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 179, Issue 5
by Brent Kimberley 16 Jun '19

16 Jun '19

>> Is there something missing ? Can you please elaborate? https://www.stunnel.org/auth.html Subject: Using STunnel4 with both SSL/TLS proxy AND PSK authentication Hi, all. We've got a specific use case where we need to implement an stunnel4 'tunnel' in the following format: Client <---> client-side stunnel4 <---> server-side stunnel4 <---> server The specific case for this is because of a server that does NOT support SSL on the remote side nor client side, and we need to use two stunnel4 instances to establish the "secure" tunnel. We can get it working with straight SSL/TLS certificates for a secure connection between the two but can't seem to add authentication to this, we want to get the stunnel4 on the client side and the stunnel4 on the server side to have to have some kind of authentication/exchange between them. Whenever we add the PSK options or client certs to the thing, we immediately get SSL/TLS problems, as it doesn't seem to support SSL/TLS handshakes properly at that point. Is there something I'm missing within the STunnel4 documentation about establishing the SSL/TLS tunnel AND adding an authentication component, or is this not possible?? It doesn't currently seem possible based on my testing... Thomas

2 2

Stunnel 5.55 on Win 10 x64 GUI Mode
by Thomas Eifert 16 Jun '19

16 Jun '19

Tonight, I downloaded and installed Stunnel version 5.55 and installed it on Windows 10 x64 1903. If I run Stunnel as a service, everything works beautifully. No issues whatsoever. However, I just can't seem to get it to run in GUI mode. When I fire up the GUI, the configuration file loads fine with no errors. However, when attempting to establish any connection, the GUI simply crashes and the log file just terminates with nothing revealing: 2019.06.15 20:26:02 LOG7[main]: Service [ircs.3] accepted (FD=956) from 127.0.0.1:52874 2019.06.15 20:26:02 LOG7[main]: Creating a new thread 2019.06.15 20:26:02 LOG7[main]: New thread created 2019.06.15 20:26:02 LOG7[0]: Service [ircs.3] started 2019.06.15 20:26:02 LOG7[0]: Setting local socket options (FD=956) 2019.06.15 20:26:02 LOG7[0]: Option TCP_NODELAY set on local socket 2019.06.15 20:26:02 LOG5[0]: Service [ircs.3] accepted connection from 127.0.0.1:52874 2019.06.15 20:26:02 LOG6[0]: s_connect: connecting 154.35.138.250:6697 2019.06.15 20:26:02 LOG7[0]: s_connect: s_poll_wait 154.35.138.250:6697: waiting 10 seconds 2019.06.15 20:26:02 LOG7[0]: FD=1080 ifds=rwx ofds=--- (end of log) This is, of course, with the service stopped and de-installed. I've tried several remedies, including running Stunnel in compatibility modes, running it as an administrator, and I even tried to install it completely outside of the normal "program files (x86)" location. Also, the firewall is not the issue. Nothing seems to help. I can't figure out what on earth is occurring. Any insight/ideas would be appreciated. Thanks and regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 1

Using STunnel4 with both SSL/TLS proxy AND PSK authentication
by Thomas Ward 14 Jun '19

14 Jun '19

Hi, all. We've got a specific use case where we need to implement an stunnel4 'tunnel' in the following format: Client <---> client-side stunnel4 <---> server-side stunnel4 <---> server The specific case for this is because of a server that does NOT support SSL on the remote side nor client side, and we need to use two stunnel4 instances to establish the "secure" tunnel. We can get it working with straight SSL/TLS certificates for a secure connection between the two but can't seem to add authentication to this, we want to get the stunnel4 on the client side and the stunnel4 on the server side to have to have some kind of authentication/exchange between them. Whenever we add the PSK options or client certs to the thing, we immediately get SSL/TLS problems, as it doesn't seem to support SSL/TLS handshakes properly at that point. Is there something I'm missing within the STunnel4 documentation about establishing the SSL/TLS tunnel AND adding an authentication component, or is this not possible? It doesn't currently seem possible based on my testing... Thomas

1 0

HELP! SSLv3 to TLSv1.2
by Eric Eberhard 07 Jun '19

07 Jun '19

Everyone, It goes to show that even after having used stunnel forever there is more to learn. I have a weird problem. A remote site that has always used SSLv3 wants to use TLSv1.2 - normally that takes 5 seconds in the config file. However, the remote site supplied the software that sends to them . and does not supply a version we can use unless we upgrade O/S and JAVA and who knows what else for hundreds of customers. In four days. Normally stunnel takes in clear text and sends it out in whatever you like (TLSv1.2 in this case). And the reverse. Can it take in SSLv3 and convert to TLSv1.2? Of course conceptually this is easy and just a logical extension of stunnel - in practice, if not there, it would be a job. Which I might tackle - but I first wanted to get community input. And if anyone wants to get paid to do this for me, we can talk :) Thanks All, Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 Oh - help me out and please join this group. I need to get large numbers of members to take to the politicians. https://www.facebook.com/groups/286143052248115/ This might work to just join? <table border="0" width="100%" cellspacing="0" cellpadding="0" style="border-collapse:collapse;"><tr style=""><td height="28" style="line-height:28px;"> </td></tr><tr><td style=""><table border="0" width="280" cellspacing="0" cellpadding="0" style="border-collapse:separate;background-color:#ffffff;border:1px solid #dddfe2;border-radius:3px;font-family:Helvetica, Arial, sans-serif;margin:0px auto;"><tr style="padding-bottom: 8px;"><td style=""><img class="img" src="https://scontent.fhhr1-1.fna.fbcdn.net/v/t1.0-0/c0.0.584.305a/p320x320/ 50521766_10218655229077782_1167298564032823296_n.jpg?_nc_cat=101&_nc_ht= scontent.fhhr1-1.fna&oh=d725734d9126b706d402e635740dcd29&oe=5D00A5A4 " width="280" height="146" alt="" /></td></tr><tr><td style="font-size:14px;font-weight:bold;padding:8px 8px 0px 8px;text-align:center;">Save The Middle Verde</td></tr><tr><td style="color:#90949c;font-size:12px;font-weight:normal;text-align:center;">P ublic group . 228 members</td></tr><tr><td style="padding:8px 12px 12px 12px;"><table border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse;width:100%;"><tr><td style="background-color:#4267b2;border-radius:3px;text-align:center;"><a style="color:#3b5998;text-decoration:none;cursor:pointer;width:100%;" href="https://www.facebook.com/plugins/group/join/popup/?group_id=2861430522 48115&source=email_campaign_plugin" target="_blank" rel="noopener"><table border="0" cellspacing="0" cellpadding="3" align="center" style="border-collapse:collapse;"><tr><td style="border-bottom:3px solid #4267b2;border-top:3px solid #4267b2;color:#FFF;font-family:Helvetica, Arial, sans-serif;font-size:12px;font-weight:bold;">Join Group</td></tr></table></a></td></tr></table></td></tr><tr><td style="border-top:1px solid #dddfe2;font-size:12px;padding:8px 12px;">This group is to help preserve the Middle Verde River, the Middle Verde Character area as defined in the Town of Camp Verde's General Plan, the 260 co...</td></tr></table></td></tr><tr style=""><td height="28" style="line-height:28px;"> </td></tr></table>

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 179, Issue 1
by Larry Alba 03 Jun '19

03 Jun '19

Please Stop my subscription to the Stunnel list. Sent from Yahoo Mail on Android On Mon, Jun 3, 2019 at 3:00 AM, stunnel-users-request(a)stunnel.org<stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. latest stable version for Windows (Meike Stone) ---------------------------------------------------------------------- Message: 1 Date: Mon, 3 Jun 2019 11:07:33 +0200 From: Meike Stone <meike.stone(a)googlemail.com> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] latest stable version for Windows Message-ID: <CAFNHiA9=NRqkrBGjS+8sEbMjgQPYqvt4=XKuWxOz=pjYOw+FqA(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Hello dear list, I like to use stunnel under windows. I tried version stunnel-5.54 and it didn't work, it took a long time, until I've realized, that a bug was responsible for that. So two days after, I've seen the version 5.55b1, installed it and it works fine. But I don't see any comments in the change log on the website, in the mailing list "stunnel-announce", there was a note about that release, but now for the new release 5.55b12 not. What was changed there? I like to install a stable release on the server, so is there any recommendation which version I can or should use? Someone stated he will use version 5.49 until a new working version for windows is released .... Thanks Meike ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 179, Issue 1 *********************************************

1 0

latest stable version for Windows
by Meike Stone 03 Jun '19

03 Jun '19

Hello dear list, I like to use stunnel under windows. I tried version stunnel-5.54 and it didn't work, it took a long time, until I've realized, that a bug was responsible for that. So two days after, I've seen the version 5.55b1, installed it and it works fine. But I don't see any comments in the change log on the website, in the mailing list "stunnel-announce", there was a note about that release, but now for the new release 5.55b12 not. What was changed there? I like to install a stable release on the server, so is there any recommendation which version I can or should use? Someone stated he will use version 5.49 until a new working version for windows is released .... Thanks Meike

2 1

Re: [stunnel-users] RE stunnel process owner
by Eric Eberhard 30 May '19

30 May '19

We use it solely on 100s of our customer’s Unix computers. My suggestion (that not everyone agrees with) is to run it under inetd. Unix does not function without inetd (or related like xinetd). You don’t have to start or manage a server. It is dead reliable and when processes die it cleans it up and so forth. You connect to localhost on some port, have a configuration that directs it to the right place, off to the races. I am not sure what you mean by container hardening. When connecting to localhost it never touches the network – the TCP/IP goes directly to the TCP/IP stack on the local machine. I am really sure I don’t know what check out is :) If you give me more info I can probably be of more use. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Brent Kimberley Sent: Wednesday, May 29, 2019 11:53 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] RE stunnel process owner Hi Dan. >>Wondering what user people are running the stunnel process under on a unix server? Any suggestions re container hardening & check-out (a la SCAP)?

2 3

Re: [stunnel-users] stunnel process owner
by Daniel Trickett 29 May '19

29 May '19

I'm not running on a Windows server. We are running on unix servers. Get Outlook for Android<https://aka.ms/ghei36> ________________________________ From: Mario Ricciardi <spam(a)ocode.net> Sent: Wednesday, May 29, 2019 4:59:14 PM To: Daniel Trickett; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel process owner This runs on a Windows server. The inbound email process needs a win based jde server Sent from my Verizon, Samsung Galaxy smartphone -------- Original message -------- From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> Date: 5/29/19 11:58 AM (GMT-07:00) To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel process owner Hi, Wondering what user people are running the stunnel process under on a unix server? Best regards, Dan

1 1

stunnel process owner
by Daniel Trickett 29 May '19

29 May '19

Hi, Wondering what user people are running the stunnel process under on a unix server? Best regards, Dan

2 1

RE stunnel process owner
by Brent Kimberley 29 May '19

29 May '19

Hi Dan. >>Wondering what user people are running the stunnel process under on a unix server?Any suggestions re container hardening & check-out (a la SCAP)?

1 0

Questions/comments about the 64-bit installer.
by Thomas Eifert 25 May '19

25 May '19

I just upgraded to Windows 10 pro x64. I attempted to install Stunnel version 5.55b1. I made a couple of basic observations that I'd like to pass along. 1. The installer attempts to install Stunnel in the windows "Program Files (x86) directory. I thought Stunnel is now a 64-bit program. As such, why does it attempt to install in that directory? 2. The new version of Stunnel doesn't seem to want to run under Windows 10. If I attempt to run it as an app, the program terminates when I attempt to establish a connection and pass traffic through it. Running it as a service, it passes a few dozen bytes of traffic, then stalls. Changing compatibility modes had little effect. 3. Stunnel version 5.49 runs beautifully under Win 10. I'll continue to use it until i find a newer version that works. Has anyone else had similar experience trying to use Stunnel under Win 10? If so, I'd like to know if you were able to resolve these issues. Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

Re: [stunnel-users] stunnel 5.54 on x64-pc-mingw32-gnu platform
by Brent Kimberley 24 May '19

24 May '19

>> Stunnel v5.54 (local) halts during tunnel setup with stunnel v4.56 (remote) FYI. stunnel-5.55b1-win64-installer.exe does not halt during tunnel setup. Thanks! <Snip><Snip>[ ] Running on Windows 6.2[ ] No limit detected for the number of clients[.] stunnel 5.55 on x64-pc-mingw32-gnu platform[.] Compiled/running with OpenSSL 1.1.1b 26 Feb 2019[.] Reading configuration from file ...[.] UTF-8 byte order mark detected..[ ] Initializing service [..][ ] Ciphers: ..[ ] TLSv1.3 ...[ ] TLS options: ..[ ] Loading certificate from file: [ ] Certificate loaded from file: [ ] Loading private key from file: [ ] Private key loaded from file: [ ] Private key check succeeded[.] Configuration successful[ ] Binding service [ ] Listening file descriptor created [ ] Setting accept socket options [ ] Service bound to 2019.05.23 20:26:54 LOG6[cron]: Executing cron jobs2019.05.23 20:26:54 LOG6[cron]: Cron jobs completed in 0 seconds2019.05.23 20:27:09 LOG5[0]: Service accepted connection from 2019.05.23 20:27:09 LOG6[0]: s_connect: connecting 2019.05.23 20:27:09 LOG6[0]: CERT: 2019.05.23 20:27:09 LOG6[0]: CERT: 2019.05.23 20:27:09 LOG5[0]: Certificate accepted at 2019.05.23 20:27:09 LOG6[0]: Session id: 2019.05.23 20:27:09 LOG6[0]: TLS connected: new session negotiated2019.05.23 20:27:09 LOG6[0]: TLSv1.2 ciphersuite: 2019.05.23 20:27:16 LOG6[0]: Read socket closed 2019.05.23 20:27:16 LOG6[0]: SSL_shutdown successfully sent close_notify alert2019.05.23 20:27:16 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing2019.05.23 20:27:16 LOG5[0]: Connection closed: </Snip> On Friday, May 17, 2019, 9:18:41 a.m. EDT, Brent Kimberley <brent_kimberley(a)rogers.com> wrote: Hi.Stunnel v5.54 (local) halts during tunnel setup with stunnel v4.56 (remote) whereas stunnel v5.53 (local) successfully establishes tunnels with stunnel v4.56 (remote). Debug 7 (local) doesn't detect any issues. Does remote 4.56 need to be upgraded? Does local 5.54 need to be patched? Best Regards,BK v5.54 x v4.56[local]s_connect: s_poll_wait <someip>:443: waiting 10 secondshalt...[remote]2019.05.17 08:47:34 LOG5[13009:140578290554624]: Service [httpsx] accepted connection from 2019.05.17 08:52:35 LOG6[13009:140578290554624]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2019.05.17 08:52:35 LOG5[13009:140578290554624]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket v5.53 x v4.56[local] 2019.05.17 08:57:18 LOG7[0]: s_connect: s_poll_wait <someip>:443: waiting 10 seconds2019.05.17 08:57:18 LOG5[0]: s_connect: connected <someip>:443...[remote]2019.05.17 09:11:10 LOG5[13009:140578290333440]: Service [httpsx] accepted connection from 2019.05.17 09:11:10 LOG5[13009:140578290333440]: Certificate accepted: depth=....

1 0

Re: [stunnel-users] Connection never completes
by Joe Fitzgerald 22 May '19

22 May '19

I am observing the same behavior Mario is seeing with STunnel 5.54 on Windows Server 2012 R2 running as a client. In my case I am upgrading the client side from STunnel 5.01. The client and server connected without difficulty when both were at STunnel 5.01. >From the STunnel v 5.54 client log: 2019.05.22 16:58:19 LOG7[main]: Found 1 ready file descriptor(s) 2019.05.22 16:58:19 LOG7[main]: FD=332 ifds=r-x ofds=--- 2019.05.22 16:58:19 LOG7[main]: FD=352 ifds=r-x ofds=--- 2019.05.22 16:58:19 LOG7[main]: Service [EchoClient] accepted (FD=440) from 127.0.0.1:62387 2019.05.22 16:58:19 LOG7[main]: Creating a new thread 2019.05.22 16:58:19 LOG7[main]: New thread created 2019.05.22 16:58:19 LOG7[0]: Service [EchoClient] started 2019.05.22 16:58:19 LOG7[0]: Setting local socket options (FD=440) 2019.05.22 16:58:19 LOG7[0]: Option TCP_NODELAY set on local socket 2019.05.22 16:58:19 LOG5[0]: Service [EchoClient] accepted connection from 127.0.0.1:62387 2019.05.22 16:58:19 LOG6[0]: s_connect: connecting 192.168.128.162:40007 2019.05.22 16:58:19 LOG7[0]: s_connect: s_poll_wait 192.168.128.162:40007: waiting 10 seconds >From the STunnel v 5.01 server log: 2019.05.22 16:58:19 LOG7[5072]: Service [EchoServer] accepted (FD=572) from 192.168.128.104:62388 2019.05.22 16:58:19 LOG7[5072]: Creating a new thread 2019.05.22 16:58:19 LOG7[5072]: New thread created 2019.05.22 16:58:19 LOG7[3724]: Service [EchoServer] started 2019.05.22 16:58:19 LOG5[3724]: Service [EchoServer] accepted connection from 192.168.128.104:62388 2019.05.22 16:58:19 LOG7[3724]: SSL state (accept): before/accept initialization

1 1

Connection never completes
by Mario Ricciardi 22 May '19

22 May '19

I have Stunnel on two computers, both Win10 version 5.54. One works flawlessly on my home network, but the second will not complete the connection to POP3 Office365 on the work network. It gets to s_connect and freezes: 2019.05.21 22:50:19 LOG7[main]: Found 1 ready file descriptor(s) 2019.05.21 22:50:19 LOG7[main]: FD=220 ifds=r-x ofds=--- 2019.05.21 22:50:19 LOG7[main]: Service [POP3 Incoming] accepted (FD=780) from 127.0.0.1:51378 2019.05.21 22:50:19 LOG7[main]: Creating a new thread 2019.05.21 22:50:19 LOG7[main]: New thread created 2019.05.21 22:50:19 LOG7[2]: Service [POP3 Incoming] started 2019.05.21 22:50:19 LOG7[2]: Setting local socket options (FD=780) 2019.05.21 22:50:19 LOG7[2]: Option TCP_NODELAY set on local socket 2019.05.21 22:50:19 LOG5[2]: Service [POP3 Incoming] accepted connection from 127.0.0.1:51378 2019.05.21 22:50:19 LOG6[2]: failover: priority, starting at entry #0 2019.05.21 22:50:19 LOG6[2]: s_connect: connecting 52.96.24.210:995 2019.05.21 22:50:19 LOG7[2]: s_connect: s_poll_wait 52.96.24.210:995: waiting 10 seconds The sessions stay active, but this is as far as they get. I start stunnel GUI and attempt to connect to the active port and the above behavior is what I get. Using OpenSSL I can connect just fine, so there doesn't appear to be a firewall issue: +OK The Microsoft Exchange POP3 service is ready. [WQBRAFgAUABSADAAMQBDAEEAMAAwA DgANgAuAEMAQQBOAFAAUgBEADAAMQAuAFAAUgBPAEQALgBPAFUAVABMAE8ATwBLAC4AQwBPAE0A] user LoadAccept(a)example.com +OK pass LAxxxxxx +OK User successfully logged on. list +OK 4 356828 1 70284 2 70415 3 108104 4 108025 The stunnel config is super simple: ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ;Microsoft Outlook [POP3 Incoming] client = yes accept = 127.0.0.1:110 connect = outlook.office365.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = outlook.office365.com OCSPaia = yes I won't bother showing the log for the working machine, but it has the same config. I'm really hoping there is simply something missing from the Windows install. A coworker has the same problem on their fresh company provided Win10 install. My functioning Win10 pc is my personal machine. Thanks, Mario --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

hostapd & stunnel
by Johannes Eckhardt 20 May '19

20 May '19

Hi, I'm running stunnel 5.39 on a Raspberry Pi with Raspbian 9 (stretch). The Pi has two network interfaces (eth0, wlan0) and I'm running an access point with hostapd. What I want to do is to route all traffic from my wifi-clients (connected via wlan0) through stunnel/socks. working iptables configuration to access the internet from eth0/wlan0: iptables -A FORWARD -i eth0 -o wlan0 -m state --state \ RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT iptables -P OUTPUT ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; if add the following lines (from stunnel.org) local traffic on eth0 goes to the stunnel-server but my wireless clients can't access the internet anymore. I tried several configurations, but without success... # stunnel socks iptables -t nat -A OUTPUT -p tcp -d TARGET-SERVER --dport 9080 -j ACCEPT iptables -t nat -A OUTPUT -o lo -j ACCEPT iptables -t nat -A OUTPUT -p tcp --dport 9050 -j ACCEPT iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-ports 9051 iptables -t nat -A PREROUTING -p tcp --dport 9050 -j ACCEPT iptables -t nat -A PREROUTING -p tcp -j REDIRECT --to-ports 9051 # /etc/stunnel/stunnel.conf [SOCKS Client Direct] client = yes PSKsecrets = secrets.txt accept = :::9050 connect = TARGET-SERVER:9080 [SOCKS Client Transparent IPv4] client = yes PSKsecrets = secrets.txt accept = 127.0.0.1:9051 connect = TARGET-SERVER:9080 protocol = socks Has anyone a solution for that? Best regards, Johannes

1 0

Version 5.54 'make check' fails test 042_inetd
by James Brown 20 May '19

20 May '19

Sorry, posted with incorrect subject. > On 20 May 2019, at 3:29 pm, James Brown <jlbrown(a)bordo.com.au <mailto:jlbrown@bordo.com.au>> wrote: > > Having problems installing version 5.54 on macOS X with this configure command: > > ./configure --with-ssl=/usr/local/Cellar/openssl(a)1.1/1.1.1b > > Configure runs OK, as does make. > > But ‘make check’ ends with: > > $ make check > Making check in src > make[1]: Nothing to be done for `check'. > Making check in doc > make[1]: Nothing to be done for `check'. > Making check in tools > make[1]: Nothing to be done for `check'. > Making check in tests > Making check in certs > /Library/Developer/CommandLineTools/usr/bin/make check-local > ./maketestcert.sh > keys & certificates successfully generated > ./maketestcert.sh finished > /Library/Developer/CommandLineTools/usr/bin/make check-local > ./make_test > Mon 20 May 2019 15:21:58 AEST > stunnel 5.54 on x86_64-apple-darwin18.5.0 platform > Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 > Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI > > test 010_require_cert ok > test 011_verify_peer ok > test 012_verify_chain ok > test 013_CRL_file ok > test 014_PSK_secrets ok > test 015_p12_cert ok > test 020_IPv6 skipped > test 021_FIPS skipped > test 022_bind ok > test 030_simple_execute ok > test 031_redirect ok > test 032_no_redirect ok > test 033_redirect_exec ok > test 034_no_redirect_exec ok > test 035_SNI ok > test 036_no_SNI ok > test 037_failover_prio1 ok > test 038_failover_prio2 ok > test 039_failover_rr ok > test 040_reload ok > test 041_exec_connect ok > test 042_inetd failed > error logs logs/042_inetd.log > test 043_session_delay ok > test 044_session_nodelay ok > test 045_include ok > test 046_resume_PSK ok > test 047_resume_redirect ok > test 048_resume_noredirect ok > test 050_ticket_secrets ok > test 110_failure_require_cert ok > test 111_failure_verify_peer ok > test 112_failure_verify_chain ok > test 113_failure_CRL_file ok > test 114_failure_PSK_secrets ok > test 115_failure_wrong_config ok > summary: success 32, skip 2, fail 1 > ./make_test finished > make[3]: *** [check-local] Error 1 > make[2]: *** [check-am] Error 2 > make[1]: *** [check-recursive] Error 1 > make: *** [check-recursive] Error 1 > > How can I fix this 042_ inetd failure? > > Also, why did it skip the IPv6 test? > > Thanks, > > James. > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 2

5.54 fails - TLS directory not found
by James Brown 20 May '19

20 May '19

Having problems installing version 5.54 on macOS X with this configure command: ./configure --with-ssl=/usr/local/Cellar/openssl(a)1.1/1.1.1b Configure runs OK, as does make. But ‘make check’ ends with: $ make check Making check in src make[1]: Nothing to be done for `check'. Making check in doc make[1]: Nothing to be done for `check'. Making check in tools make[1]: Nothing to be done for `check'. Making check in tests Making check in certs /Library/Developer/CommandLineTools/usr/bin/make check-local ./maketestcert.sh keys & certificates successfully generated ./maketestcert.sh finished /Library/Developer/CommandLineTools/usr/bin/make check-local ./make_test Mon 20 May 2019 15:21:58 AEST stunnel 5.54 on x86_64-apple-darwin18.5.0 platform Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI test 010_require_cert ok test 011_verify_peer ok test 012_verify_chain ok test 013_CRL_file ok test 014_PSK_secrets ok test 015_p12_cert ok test 020_IPv6 skipped test 021_FIPS skipped test 022_bind ok test 030_simple_execute ok test 031_redirect ok test 032_no_redirect ok test 033_redirect_exec ok test 034_no_redirect_exec ok test 035_SNI ok test 036_no_SNI ok test 037_failover_prio1 ok test 038_failover_prio2 ok test 039_failover_rr ok test 040_reload ok test 041_exec_connect ok test 042_inetd failed error logs logs/042_inetd.log test 043_session_delay ok test 044_session_nodelay ok test 045_include ok test 046_resume_PSK ok test 047_resume_redirect ok test 048_resume_noredirect ok test 050_ticket_secrets ok test 110_failure_require_cert ok test 111_failure_verify_peer ok test 112_failure_verify_chain ok test 113_failure_CRL_file ok test 114_failure_PSK_secrets ok test 115_failure_wrong_config ok summary: success 32, skip 2, fail 1 ./make_test finished make[3]: *** [check-local] Error 1 make[2]: *** [check-am] Error 2 make[1]: *** [check-recursive] Error 1 make: *** [check-recursive] Error 1 How can I fix this 042_ inetd failure? Also, why did it skip the IPv6 test? Thanks, James.

1 0

stunnel 5.54 on x64-pc-mingw32-gnu platform vs 5.53
by Brent Kimberley 17 May '19

17 May '19

Hi.Stunnel v5.54 (local) halts during tunnel setup with stunnel v4.56 (remote) whereas stunnel v5.53 (local) successfully establishes tunnels with stunnel v4.56 (remote). Debug 7 (local) doesn't detect any issues. Does remote 4.56 need to be upgraded? Does local 5.54 need to be patched? Best Regards,BK v5.54 x v4.56[local]s_connect: s_poll_wait <someip>:443: waiting 10 secondshalt...[remote]2019.05.17 08:47:34 LOG5[13009:140578290554624]: Service [httpsx] accepted connection from 2019.05.17 08:52:35 LOG6[13009:140578290554624]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2019.05.17 08:52:35 LOG5[13009:140578290554624]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket v5.53 x v4.56[local] 2019.05.17 08:57:18 LOG7[0]: s_connect: s_poll_wait <someip>:443: waiting 10 seconds2019.05.17 08:57:18 LOG5[0]: s_connect: connected <someip>:443...[remote]2019.05.17 09:11:10 LOG5[13009:140578290333440]: Service [httpsx] accepted connection from 2019.05.17 09:11:10 LOG5[13009:140578290333440]: Certificate accepted: depth=....

1 0

Connection refused, then connects
by James Brown 17 May '19

17 May '19

Can anyone tell me why It tries ::1:25 first and fails before connecting to 127.0.0.1:25? 2019.05.17 13:48:34 LOG5[21]: Service [ssmtp465] accepted connection from ::ffff:192.168.1.76:49170 2019.05.17 13:48:34 LOG3[21]: s_connect: connect ::1:25: Connection refused (61) 2019.05.17 13:48:34 LOG5[21]: s_connect: connected 127.0.0.1:25 2019.05.17 13:48:34 LOG5[21]: Service [ssmtp465] connected remote server from 127.0.0.1:56701 /usr/local/etc/stunnel/stunnel.conf has: [ssmtp465] client = no accept = 465 connect = 25 options = NO_SSLv2 #transparent = source [ssmtp587] client = no accept = 587 connect = 127.0.0.1:25 options = NO_SSLv2 #transparent = source Not sure if this is relevant, but when I startup I get: 2019.05.17 12:45:27 LOG5[ui]: stunnel 5.53 on x86_64-apple-darwin18.5.0 platform 2019.05.17 12:45:27 LOG5[ui]: Compiled/running with OpenSSL 1.0.2r 26 Feb 2019 2019.05.17 12:45:27 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.17 12:45:27 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2019.05.17 12:45:27 LOG5[ui]: UTF-8 byte order mark detected 2019.05.17 12:45:27 LOG5[ui]: FIPS mode disabled 2019.05.17 12:45:27 LOG4[ui]: Insecure file permissions on /usr/local/etc/dovecot/mail.bordo.com.au.pem 2019.05.17 12:45:27 LOG4[ui]: Insecure file permissions on /usr/local/etc/dovecot/mail.bordo.com.au.pem 2019.05.17 12:45:27 LOG5[ui]: Configuration successful 2019.05.17 12:45:27 LOG5[ui]: Binding service [ssmtp465] to 0.0.0.0:465: Address already in use (48) 2019.05.17 12:45:27 LOG5[ui]: Binding service [ssmtp587] to 0.0.0.0:587: Address already in use (48) No idea what is already using those ports. Any suggestions? macOS 10.14.4 Thanks, James.

3 3

stunnel 5.54 released
by Michal Trojnara 15 May '19

15 May '19

Dear Users, I have released version 5.54 of stunnel. Version 5.54, 2019.05.15, urgency: LOW * New features - New "ticketKeySecret" and "ticketMacSecret" options to control confidentiality and integrity protection of the issued session tickets. These options allow for session resumption on other nodes in a cluster. - Added logging the list of active connections on SIGUSR2 or with Windows GUI. - Logging of the assigned bind address instead of the requested bind address. * Bugfixes - Service threads are terminated before OpenSSL cleanup to prevent occasional stunnel crashes at shutdown. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 5e8588a6c274b46b1d63e1b50f0725f4908dec736f6588eb48d1eb3d20c87902 stunnel-5.54.tar.gz ed8424731f7d6e0c9b11f4c7b597a072e558dae7979102d0b213759678079481 stunnel-5.54-win64-installer.exe 7659f605065e5155577a99abe1129dbc89523796196c8bf50d3fa9265ec34d93 stunnel-5.54-android.zip Best regards, Mike

1 0

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Eric Eberhard 15 May '19

15 May '19

Killing anything will change the PID. If the PID needs to be constant a zombie is bad news! Zombies stink! E -----Original Message----- From: Jochen Bern [mailto:Jochen.Bern@binect.de] Sent: Wednesday, May 15, 2019 1:42 AM To: stunnel-users(a)stunnel.org Cc: Florian Lohoff <f(a)zz.de>; Eric Eberhard <flash(a)vicsmba.com> Subject: Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug? On 05/15/2019 12:22 AM, Florian Lohoff wrote: > On Tue, May 14, 2019 at 11:30:29AM -0700, Eric Eberhard wrote: >> That is not a bad idea. I'd wrap it in a C program so I could check >> if the pppd is alive and not a zombie. > > pppd is a pretty solid piece of software. Never seen it hang as a > zombie. A zombie process is *terminated* and, basically, just a remaining entry in the kernel's process table. It's not hanging around because of something its own code did wrong, but because its parent process fails to "reap" its child (first and foremost, collect its exit code from the kernel). Killing the parent cleans up zombies because the zombies get re-parented to the init / systemd process (PID 1), which then does the reaping. Regards, -- Jochen Bern Systemingenieur

1 0

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Jochen Bern 15 May '19

15 May '19

On 05/15/2019 12:22 AM, Florian Lohoff wrote: > On Tue, May 14, 2019 at 11:30:29AM -0700, Eric Eberhard wrote: >> That is not a bad idea. I'd wrap it in a C program so I could check >> if the pppd is alive and not a zombie. > > pppd is a pretty solid piece of software. Never seen it hang as a > zombie. A zombie process is *terminated* and, basically, just a remaining entry in the kernel's process table. It's not hanging around because of something its own code did wrong, but because its parent process fails to "reap" its child (first and foremost, collect its exit code from the kernel). Killing the parent cleans up zombies because the zombies get re-parented to the init / systemd process (PID 1), which then does the reaping. Regards, -- Jochen Bern Systemingenieur

1 0

Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date?
by Eric Eberhard 14 May '19

14 May '19

Use openssl to make a private cert? E -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Christopher Schultz Sent: Monday, May 13, 2019 2:28 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? All, Does anyone know if it is possible to perform all other verification of a client certificate EXCEPT allow the certificate to have expired? We have a vendor whose certificate has expired, and we want to allow their old certificate to work while they chase their tails trying to figure out the best way to re-issue a new cert for us. *eyeroll* Is it possible? Thanks, -chris

2 1

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Eric Eberhard 14 May '19

14 May '19

Yes. Use inetd (or equivalent). Making an independent server work is difficult due to the problems like you are having. Inetd is in many O/S included and essential, others available. It always works. Always. Yes, there is a tiny amount of overhead for making connections. On an ancient AIX IBM I manage 2-4 million XML documents exchanged per day with no problems, all with inetd. Try it – save yourself some misery. Or maybe it won’t help at all except to add information :) E From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Martin Got Sent: Monday, May 13, 2019 9:08 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug? I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below. Stunnel client --connect--> Stunnel server pppd client --connect--> pppd server 10.0.1.2 <--data--> 10.0.1.1 OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started. So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection. Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this? Any suggestions highly appreciated. # ps -axu | grep pppd user 43231 0.0 0.0 476 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) user 39187 0.0 0.0 468 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) # tail -n 10 /var/log/daemon pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[43231] Using interface ppp1 pppd[43231] Connect: ppp0 <--> /dev/ttyp2 pppd[43231] Local IP address 10.0.1.1 pppd[43231] Remote IP address 10.0.1.2 pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[39187] Using interface ppp0 pppd[39187] Connect: ppp0 <--> /dev/ttyp5 pppd[39187] Couldn't set interface address: Address 10.0.1.1 or destination 10.0.1.2 already exists Stunnel configurations for server and client: 1. Server's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;socket = l:SO_LINGER=1:60 ; Session cache sessionCacheSize = 100 sessionCacheTimeout = 600 stack = 65536 TIMEOUTbusy = 600 TIMEOUTconnect = 10 TIMEOUTidle = 43200 TIMEOUTclose = 5 [ppp] accept = LOCAL-IP:PORT exec = /usr/sbin/pppd execargs = lock 10.0.1.1:10.0.1.2 local debug noauth ;execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth pty = yes CAfile = ca.crt cert = server.crt key = server.key verifyChain = yes 2. Stunnel client's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Session cache sessionCacheSize = 1 sessionCacheTimeout = 600 failover = rr [ppp] client = yes retry = yes connect = REMOTE-IP:PORT exec = /usr/sbin/pppd execargs = defaultroute persist lock passive 10.0.1.2:10.0.1.1 local debug noauth name ppp-client pty = yes CAfile = ca.crt cert = client.crt key = client.key verifyChain = yes checkHost = REMOTE-HOSTNAME ;checkIP = 1.2.3.4

2 1

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Eric Eberhard 13 May '19

13 May '19

Sounds good. The inetd will handle the dropping of connections just fine ... but the below sounds like it would help even more. E -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Peter Pentchev Sent: Monday, May 13, 2019 2:16 PM To: Martin Got <martingot(a)protonmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug? On Mon, May 13, 2019 at 04:07:57PM +0000, Martin Got wrote: > I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below. > > Stunnel client --connect--> Stunnel server > pppd client --connect--> pppd server > 10.0.1.2 <--data--> 10.0.1.1 > > OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started. > > So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection. > > Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this? Unfortunately, stunnel was not designed for your use case; it was designed to allow many different clients to make use of different instances of the same server program, one instance per client. You might try to do something else: if you really only have a single PPP client and you can really guarantee that anything that connects to stunnel must reuse the same connection, you could write a separate program that listens on a TCP port or on a local Unix socket, waits for the first connection, starts an instance of pppd, and then, from that point on, sends all the traffic from this instance to all the connections that it has received, even if a new connection appears before the old one has been torn down. Then you can point stunnel to the local Unix socket of that service, and anything that connects to stunnel will establish a new connection to your service, but it will not matter, since your service will be written in such a way as to send all the traffic to all the connections. So the service should do something like: 1. Create a local Unix socket and start listening on it. 2. Wait for the first connection. 3. Start an instance of pppd (at most one instance shall be running at any point in time) 4. Keep waiting for new connections; accept any and treat them all in the same way. 5. If any data comes from a remote connection, send it to pppd. 6. If any data comes from pppd, send it to *all* the remote connections. 7. If any of the remote connections is closed, well, so be it, good riddance, another one will come along presently (or maybe another one has already come along and has started talking to pppd through this service). 8. If the pppd child process dies, close all the remote connections and go back to step 2. Then you shall only have a problem if there are two "real" connections from different places at the same time - but if I understand your setup correctly, this should not really happen, since it is only you (your laptop or something like that) that connects to the PPP server. If you want, I could try to whip up some simple implementation of such a pseudo-multiplexer. G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Possible to verify client certificate BUT ignore expiration-date?
by Christopher Schultz 13 May '19

13 May '19

All, Does anyone know if it is possible to perform all other verification of a client certificate EXCEPT allow the certificate to have expired? We have a vendor whose certificate has expired, and we want to allow their old certificate to work while they chase their tails trying to figure out the best way to re-issue a new cert for us. *eyeroll* Is it possible? Thanks, -chris

1 0

Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Martin Got 13 May '19

13 May '19

I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below. Stunnel client --connect--> Stunnel server pppd client --connect--> pppd server 10.0.1.2 <--data--> 10.0.1.1 OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started. So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection. Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this? Any suggestions highly appreciated. # ps -axu | grep pppd user 43231 0.0 0.0 476 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) user 39187 0.0 0.0 468 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) # tail -n 10 /var/log/daemon pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[43231] Using interface ppp1 pppd[43231] Connect: ppp0 <--> /dev/ttyp2 pppd[43231] Local IP address 10.0.1.1 pppd[43231] Remote IP address 10.0.1.2 pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[39187] Using interface ppp0 pppd[39187] Connect: ppp0 <--> /dev/ttyp5 pppd[39187] Couldn't set interface address: Address 10.0.1.1 or destination 10.0.1.2 already exists Stunnel configurations for server and client: 1. Server's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;socket = l:SO_LINGER=1:60 ; Session cache sessionCacheSize = 100 sessionCacheTimeout = 600 stack = 65536 TIMEOUTbusy = 600 TIMEOUTconnect = 10 TIMEOUTidle = 43200 TIMEOUTclose = 5 [ppp] accept = LOCAL-IP:PORT exec = /usr/sbin/pppd execargs = lock 10.0.1.1:10.0.1.2 local debug noauth ;execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth pty = yes CAfile = ca.crt cert = server.crt key = server.key verifyChain = yes 2. Stunnel client's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Session cache sessionCacheSize = 1 sessionCacheTimeout = 600 failover = rr [ppp] client = yes retry = yes connect = REMOTE-IP:PORT exec = /usr/sbin/pppd execargs = defaultroute persist lock passive 10.0.1.2:10.0.1.1 local debug noauth name ppp-client pty = yes CAfile = ca.crt cert = client.crt key = client.key verifyChain = yes checkHost = REMOTE-HOSTNAME ;checkIP = 1.2.3.4

2 1

Stunnel for O365 Sending Some Reports but not Others
by David Schmidt 10 May '19

10 May '19

Hello, We needed to reconfigure Stunnel for the SAP Business Objects server that sent email reports from G Suite over to a configuration that sends from an O365 account. The problem is that some of the reports work fine after the reconfiguration, while others always fail and I can't find out why and nothing has changed other than the mail settings. Microsoft doesn't even see the failed reports hitting their servers but when I look at Stunnel it seems like the TLS connection is being established correctly and I can see the connection being established from our firewall logs. I've attached the current O365 config as well as the old GSuite conifg, as well as logs of the debug output I see when I run a report that succeeds versus a report that fails. Can anyone give me an idea as to why Stunnel seems to be working to send out some reports but not others? Thank you, David Schmidt | Administrateur TI / IT Administrator | MTYGroup.com<http://mtygroup.com/> T+1 514-336-8885 Ext 8236 | C+1 514-708-7299 | 8210, route Transcanadienne, St. Laurent, QC, H4S 1M5 [http://mtygroup.com/signature/gif/use_this_left.gif]<http://mtygroup.com> [http://mtygroup.com/signature/gif/use_this_right.gif] <http://mtygroup.com> AVERTISSEMENT CONCERNANT LA CONFIDENTIALIT? / WARNING CONCERNING CONFIDENTIALITY Ce message peut contenir des informations confidentielles, privil?gi?es, et seulement pour ses destinataires. Si vous avez re?u ce message par erreur, veuillez en informer imm?diatement l'exp?diteur par retour de courriel et supprimer cette communication de votre syst?me. This email message may contain information that is confidential, privileged, and for communication only to its intended recipient or recipients. If you have received this message in error, please immediately notify the sender and delete the original message without making a copy.

1 0

Problem with stunnel 5.51
by Carter Browne 08 May '19

08 May '19

I received the following error trying to connect to a Windows host using RDP. I use stunnel as a connection point with secure messages coming in and then forwarded as secure messages going the desired end point. Stunnel is running on all three systems, the originator, the relay, and the destination. I have been using stunnel in this role for many years. As an additional point, 5.51 did work properly in the same role for secure telnet. The part of the log showing the failure is below. Thanks, Carter Before 2019.05.03 15:44:02 LOG5[ui]: stunnel 5.50 on armv7l-unknown-linux-gnueabihf platform 2019.05.03 15:44:02 LOG5[ui]: Compiled with OpenSSL 1.1.1a 20 Nov 2018 2019.05.03 15:44:02 LOG5[ui]: Running with OpenSSL 1.1.1b 26 Feb 2019 2019.05.03 15:44:02 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.03 15:44:02 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2019.05.03 15:44:02 LOG5[ui]: UTF-8 byte order mark not detected 2019.05.03 15:44:02 LOG5[ui]: FIPS mode disabled 2019.05.03 15:44:52 LOG5[ui]: Configuration successful 2019.05.03 15:44:52 LOG5[ui]: Switched to chroot directory: /var/run/stunnel/ ... 2019.05.08 08:26:08 LOG5[980]: Service [c13alt-rdp] accepted connection from 192.168.179.22:63218 2019.05.08 08:26:09 LOG5[980]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-39, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 08:26:09 LOG5[981]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49180 2019.05.08 08:26:09 LOG5[980]: s_connect: connected 127.0.1.127:3389 2019.05.08 08:26:09 LOG5[981]: s_connect: connected 10.251.129.118:8001 2019.05.08 08:26:09 LOG5[981]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44796 2019.05.08 08:26:09 LOG5[980]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49180 2019.05.08 08:26:09 LOG5[981]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-13.cbcsnet.local, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 08:26:23 LOG5[980]: Connection closed: 1615 byte(s) sent to TLS, 1061 byte(s) sent to socket 2019.05.08 08:26:23 LOG5[981]: Connection closed: 1061 byte(s) sent to TLS, 1615 byte(s) sent to socket 2019.05.08 08:26:23 LOG5[982]: Service [c13alt-rdp] accepted connection from 192.168.179.22:63243 2019.05.08 08:26:23 LOG5[983]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49184 2019.05.08 08:26:23 LOG5[982]: s_connect: connected 127.0.1.127:3389 2019.05.08 08:26:23 LOG5[982]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49184 2019.05.08 08:26:23 LOG5[983]: s_connect: connected 10.251.129.118:8001 2019.05.08 08:26:23 LOG5[983]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44800 After 2019.05.08 12:50:18 LOG5[ui]: stunnel 5.51 on armv7l-unknown-linux-gnueabihf platform 2019.05.08 12:50:18 LOG5[ui]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 2019.05.08 12:50:18 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.08 12:50:18 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2019.05.08 12:50:18 LOG5[ui]: UTF-8 byte order mark not detected 2019.05.08 12:50:18 LOG5[ui]: FIPS mode disabled 2019.05.08 12:50:42 LOG5[ui]: Configuration successful 2019.05.08 12:51:01 LOG5[2]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64139 2019.05.08 12:51:02 LOG5[2]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-39, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 12:51:02 LOG5[3]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49330 2019.05.08 12:51:02 LOG5[2]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:51:02 LOG5[2]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49330 2019.05.08 12:51:02 LOG5[3]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:51:02 LOG5[3]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44946 2019.05.08 12:51:02 LOG5[3]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-13.cbcsnet.local, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 12:51:15 LOG5[2]: Connection closed: 1615 byte(s) sent to TLS, 1061 byte(s) sent to socket 2019.05.08 12:51:15 LOG5[3]: Connection closed: 1061 byte(s) sent to TLS, 1615 byte(s) sent to socket 2019.05.08 12:51:15 LOG5[4]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64141 2019.05.08 12:51:15 LOG5[5]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49334 2019.05.08 12:51:15 LOG5[4]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:51:15 LOG5[4]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49334 2019.05.08 12:51:15 LOG5[5]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:51:15 LOG5[5]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44950 2019.05.08 12:51:18 LOG3[4]: transfer() loop executes not transferring any data 2019.05.08 12:51:18 LOG3[4]: please report the problem to Michal.Trojnara(a)stunnel.org 2019.05.08 12:51:18 LOG3[4]: stunnel 5.51 on armv7l-unknown-linux-gnueabihf platform 2019.05.08 12:51:18 LOG3[4]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 2019.05.08 12:51:18 LOG3[4]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.08 12:51:18 LOG3[4]: protocol=TLSv1.2, SSL_pending=0 2019.05.08 12:51:18 LOG3[4]: sock_open_rd=Y, sock_open_wr=Y 2019.05.08 12:51:18 LOG3[4]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2019.05.08 12:51:18 LOG3[4]: sock_can_rd=n, sock_can_wr=n 2019.05.08 12:51:18 LOG3[4]: ssl_can_rd=n, ssl_can_wr=n 2019.05.08 12:51:18 LOG3[4]: read_wants_read=Y, read_wants_write=n 2019.05.08 12:51:18 LOG3[4]: write_wants_read=n, write_wants_write=n 2019.05.08 12:51:18 LOG3[4]: shutdown_wants_read=n, shutdown_wants_write=n 2019.05.08 12:51:18 LOG3[4]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) 2019.05.08 12:51:18 LOG5[4]: Connection reset: 2786 byte(s) sent to TLS, 5077 byte(s) sent to socket 2019.05.08 12:51:18 LOG5[5]: Connection closed: 5077 byte(s) sent to TLS, 2989 byte(s) sent to socket 2019.05.08 12:52:03 LOG5[6]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64144 2019.05.08 12:52:03 LOG5[6]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:52:03 LOG5[6]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49340 2019.05.08 12:52:03 LOG5[7]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49340 2019.05.08 12:52:03 LOG5[7]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:52:03 LOG5[7]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44956 2019.05.08 12:52:14 LOG5[6]: Connection closed: 1615 byte(s) sent to TLS, 1061 byte(s) sent to socket 2019.05.08 12:52:14 LOG5[7]: Connection closed: 1061 byte(s) sent to TLS, 1615 byte(s) sent to socket 2019.05.08 12:52:14 LOG5[8]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64147 2019.05.08 12:52:14 LOG5[9]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49344 2019.05.08 12:52:14 LOG5[9]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:52:14 LOG5[9]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44960 2019.05.08 12:52:14 LOG5[8]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:52:14 LOG5[8]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49344 2019.05.08 12:52:16 LOG3[8]: transfer() loop executes not transferring any data 2019.05.08 12:52:16 LOG3[8]: please report the problem to Michal.Trojnara(a)stunnel.org

2 2

Automatic stunnel-client reconnect and keep initial session
by Martin Got 01 May '19

01 May '19

Which commands to stunnel can perform keeping session ID in case of stunnel-client reconnection? Do I add commands to both stunnel-client and stunnel-server to keep the initial session?

1 0

Keep initial session-ID when stunnel-client reconnect to a stunnel-server
by Martin Got 01 May '19

01 May '19

Trying to establish link using pppd connection overlapped into stunnel 5.44. Server runs on OpenBSD 6.4, client uses the same stunnel and OS versions. From the client's side I have to reconnect to stunnel-server in case of Internet link is dropped. And expecting that pppd session is kept by stunnel over reconnections possible. But stunnel-server runs another pppd instance when stunnel-client reconnects. After reconnection in system processes I see two pppd processes (as shows below), and pppd link has no pings after it. # ps -aux | grep pppd user 45359 0.0 0.0 440 1672 ?? I Tue11PM 0:00.01 lock passive 10.0.1.1:10.0.1.2 local debug noauth (pppd) user 1156 0.0 0.0 321 1210 ?? I Tue12PM 0:00.01 lock passive 10.0.1.1:10.0.1.2 local debug noauth (pppd) 1. The question is how to keep initial session established by stunnel-client and do not run second pppd process by stunnel-server? 2. May I keep session by cache-ID on the client's side only or do I need to do it on both client and server? Can it help not to run another pppd process? Both server config and client config parts are below: # cat /etc/stunnel/stunnel-server.conf ... [ppp] ;SERVER accept 1.2.3.4:443 exec = /usr/sbin/pppd execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth pty = yes CAfile = ca.crt cert = server.crt key = server.key verifyChain = yes TIMEOUTclose = 0 ... # cat /etc/stunnel/stunnel-client.conf ... [ppp] ;CLIENT client = yes retry = yes connect = 1.2.3.4:443 exec = /usr/sbin/pppd execargs = persist lock 10.0.1.2:10.0.1.1 local debug noauth name ppp-client pty = yes CAfile = ca.crt cert = client.crt key = client.key verifyChain = yes checkHost = hostname ;checkIP = 1.2.3.4 ... Thank you for answer in advance.

1 0

Re: [stunnel-users] illegal instruction crash 5.50 Debian/Stretch
by Michal Trojnara 29 Apr '19

29 Apr '19

On 24.04.2019 16:06, Florian Lohoff wrote: > with the stunnel4 in Debian/Stretch i am experiencing pretty regular > crashes with illegal instruction. Version is 5.50. > In Bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=880659 > you can see the drill down to a Lock beeing unlocked although > not locked. When i look at the code its some usage of openssl > primitives. (Unlock happens in openssl code) > I had a quick look at the changelog and this: > "Service threads are terminated before OpenSSL cleanup to prevent occasional stunnel crashes at shutdown." > sounds a bit like the issue i am experiencing. > Can you confirm this? Yes, I do confirm this is the issue described in the Debian bug #880659. It wasn't a simple coding error, but rather a design flaw introduced in version 3.0 that took 20 years to identify and fix. Before version 5.18, released almost 4 years ago, the shutdown race condition mostly manifested itself while terminating stunnel under extremely heavy load, such as stress testing. The probability has increased with the introduction of periodic DH parameter regeneration in version 5.18. I didn't test it, but I suspect some changes in the OpenSSL internals may have also cause the crashes to only surface fairly recently, and not 20 years ago. The fix itself involves a major redesign of the stunnel threading subsystem, so I made a beta version and I'd appreciate your help with testing it: https://www.stunnel.org/downloads/beta/stunnel-5.54b2.tar.gz Best regards, Mike

2 1

Either "verifyChain" or "verifyPeer" has to be enabled
by kovacs janos 23 Apr '19

23 Apr '19

sorry to bother, again this is probably something simple, but i couldn't find anything about it. i'm trying to make stunnel NOT verify the certificate of the address it connects to. specifically because the certificate date will give an error, and i know its safe to connect there. whenever i put 'verify = 0' or 'verifyChain = no' or 'verifyPeer = no' in the configuration, i get an error saying 'Either "verifyChain" or "verifyPeer" has to be enabled', and so the configuration can't be applied. and i found nothing about this anywhere. or this could only be set on server Services? and there is no way to not verify if 'client = yes'?

1 0

Stunnel 5.44 client syntax to accept connections on pty?
by Martin Got 18 Apr '19

18 Apr '19

How to use 'stunnel' in client mode to accept connections on pty from local programs like 'ppp' instead of 'accept=IP:PORT'? 'pty = yes' seems work in server mode only, so when I removed 'accept = 127.0.0.1:1723' from 'stunnel' client config I'm getting the error: [!] Service [ppp]: Each service must define two endpoints on stunnel-5.44 I need to call 'stunnel' client from 'pppd' and communicate with 'stunnel' using pty if it was possible by using a command: pppd /dev/ptyp3 10.0.1.2: local debug noauth passive noccp novj novjccomp nopcomp noaccomp name ppp-client connect 'stunnel /etc/stunnel/stunnel-client.conf' Both 'pppd' and 'stunnel' started by executing the command above, but 'pppd' can't communicate to 'stunnel' server using pty. Please advice. [ppp] client = yes accept = [127.0.0.1:1723 ](http://127.0.0.1:1723) ^^^^^^^^^^^^^^^^^^^^^^^ connect = STUNNEL-SERVER-IP:723 CAfile = /etc/stunnel/ca.crt cert = /etc/stunnel/client.crt key = /etc/stunnel/client.key verifyChain = yes checkHost = hostna.me ;checkIP = 1.2.3.4

2 1

Sending original IP (proxy) for smtp
by James Brown 16 Apr '19

16 Apr '19

I’d like stunnel to pass the incoming IP along, not stunnel's IP. My traffic flow is: Stunnel (accept on port 465) -> ASSP (an smtp proxy) -> Postfix (accept on port 10026) I tried: [ssmtp] client = no accept = 465 connect = 25 protocol = proxy But ASSP had: Apr-15-19 18:50:22 [Worker_1] Connected: session:7FE104AA1870 127.0.0.1:58954 > 127.0.0.1:25 > 127.0.0.1:10026 Apr-15-19 18:50:23 [Worker_1] 127.0.0.1 warning: got reply '502 5.5.2 Error: command not recognized' from 127.0.0.1 Apr-15-19 18:50:23 id-18223-03317 [Worker_1] 127.0.0.1 info: sending EHLO instead of HELO to 127.0.0.1 Apr-15-19 18:50:23 id-18223-03317 [Worker_1] 127.0.0.1 disconnected: session:7FE104AA1870 127.0.0.1 - processing time 1 seconds And Postfix had: 2019-04-15 18:50:22.995042+1000 localhost smtpd[33360]: connect from localhost[127.0.0.1] 2019-04-15 18:50:23.108756+1000 localhost smtpd[33360]: improper command pipelining after EHLO from localhost[127.0.0.1]: RSET\r\n 2019-04-15 18:50:23.273664+1000 localhost smtpd[33360]: disconnect from localhost[127.0.0.1] ehlo=2 rset=1 quit=1 unknown=0/1 commands=4/5 So I take it protocol=proxy is not the way to do it. Sounds like this only works with haproxy which I do not have installed. Is there a way to do this? The problem I am trying to solve is ASSP has lines like: warning: SMTP authentication failed on 127.0.0.1 - obviously I don’t want fail2ban to ban 127.0.0.1. Stunnel log has: 2019.04.15 18:52:26 LOG5[23]: Service [ssmtp] accepted connection from ::ffff:185.222.209.66:53642 2019.04.15 18:52:27 LOG3[23]: s_connect: connect ::1:25: Connection refused (61) Any suggestions? Thanks, James.

2 3

Support for TLS 1.3 Early Data?
by hshh 13 Apr '19

13 Apr '19

Is it stunnel 5.54 support for TLS 1.3 Early Data? Stunnel 5.54, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384. I was tested by openssl s_client, return "Early data was not sent".

1 0

Possible memory leak at asn1_lib.c:412: 20417 allocations
by Marc Smith 12 Apr '19

12 Apr '19

Hi, I'm using stunnel version 5.44 with OpenSSL version 1.0.2r on Linux. I noticed if stunnel has been running for a while, we start observing these messages in the logs: Apr 12 19:12:11 localhost stunnel: LOG4[971]: Possible memory leak at asn1_lib.c:412: 20417 allocations Apr 12 19:12:11 localhost stunnel: LOG4[971]: Possible memory leak at tasn_new.c:180: 20416 allocations And indeed, the process is consuming memory at a steady rate, and continues to grow until stopped. I updated to the latest stunnel version (5.53) and I no longer see these "possible memory leak" messages in the logs, yet the process still appears to consume memory as before (until it gets very large and things stop working). Is this actually a bug in the OpenSSL library? I'm using the latest in that release series (1.0.2), but perhaps this is a "known" leak and resolved in OpenSSL 1.1.1? Any help would be greatly appreciated. Thanks, Marc

1 0

OCSP validation via AIA responders through a proxy
by Olops, Daniel 12 Apr '19

12 Apr '19

Hello, stunnel v5.53 ignores proxy settings when performing OCSP validation via AIA responders. An open issue for OpenSSL at their GitHub suggests that this is a feature request for them (https://github.com/openssl/openssl/issues/6965), thus not being a stunnel limitation itself, and I've asked for clarification in the openssl-users mainling list (https://mta.openssl.org/pipermail/openssl-users/2019-April/010285.html). In either case, I want do double-check it with you guys: is this really an OpenSSL limitation, or is this something that can be addressed in stunnel code? Regards, Daniel O. Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284 Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington Road, Dublin 4, Ireland, branch registration number 908705

1 0

stunnel 5.44 + pppd client side problem
by Martin Got 12 Apr '19

12 Apr '19

Trying to set up pppd link with stunnel wrapped between two OpenBSD 6.4amd64 machines. I use this reference article as an idea: http://bremford.org/tips/QuickStunnelVPN.html While connecting from client's side by command: /usr/sbin/pppd ptypA 10.0.1.2: local debug noauth passive noccp novj novjccomp nopcomp noaccomp name ppp-clnt connect 'stunnel /etc/stunnel/stunnel-client.conf stunnel-client starts, pppd starts on client's end according to stunnel-clnt.log, but has LCP timeouts: # tail stunnel-clnt.log stunnel: LOG5[ui]: Configuration successful pppd[5421]: Connect: ppp2 <--> /dev/ptypA pppd[5421]: LCP: timeout sending Config-Requests pppd[5421]: Connection terminated. pppd[5421]: Connect script failed It seems no pppd pty client connection to stunnel-local nor remote stunnel-server afterwards. But when I tried to connect to stunnel-client port 1723 using telnet: telnet localhost 1723 I received pppd advertisements from remote stunnel-server. It seems exec = /usr/sbin/pppd on stunnel-server is running when client's stunnel-client connection appeared. Can it be a problem with pppd and stunnel-client using pty? Please advice. # cat /etc/stunnel/stunnel-server.conf ;chroot = /var/stunnel # chroot is disabled for testing ;setuid = _stunnel # stunnel started by root for testing currently ;setgid = _stunnel ; PID file is created inside the chroot jail (if enabled) ;pid = /stunnel.pid foreground = yes debug = 7 ;output = log/stunnel.log # disabled sslVersion = TLSv1.2 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Enable support for the insecure SSLv3 protocol ;options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 ; Fix for Eudora "error reading network" can be useful for changing packet length options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; *** TLS server mode services [ppp] accept = 723 exec = /usr/sbin/pppd execargs = 10.0.1.1: local debug noauth pty = yes CAfile = /etc/stunnel/ca.crt cert = /etc/stunnel/srv.crt key = /etc/stunnel/private/srv.key verifyChain = yes TIMEOUTclose = 45 [default] ; HTTP connections ;ciphers = ALL ;options = CIPHER_SERVER_PREFERENCE accept = 1111 connect = 127.0.0.1:80 CAfile = /etc/stunnel/ca.crt cert = /etc/stunnel/srv.crt key = /etc/stunnel/private/srv.key verifyChain = yes TIMEOUTclose = 0 [ntp] connect = 127.0.0.1:123 sni = default:ntp CAfile = /etc/stunnel/ca.crt cert = /etc/stunnel/srv.crt key = /etc/stunnel/private/srv.key verifyChain = yes TIMEOUTclose = 0 -------------------- # cat /etc/stunnel/stunnel-client.conf chroot = /var/stunnel setuid = _stunnel setgid = _stunnel pid = /stunnel-clnt.pid foreground = yes debug = 7 ;output = log/stunnel-clnt.log sslVersion = TLSv1.2 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Enable support for the insecure SSLv3 protocol ;options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 ; Fix for Eudora "error reading network" can be useful for changing packet length options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE [ppp] client = yes accept = 127.0.0.1:1723 # 'accept' is absent in client's configuration http://bremford.org/tips/QuickStunnelVPN.htmlbut stunnel reports: [!] Service [ppp]: Each service must define two endpoints on stunnel-5.44 connect = STUNNEL-SERVER-IP:723 CAfile = /etc/stunnel/ca.crt cert = /etc/stunnel/client.crt key = /etc/stunnel/client.key verifyChain = yes checkHost = hostna.me ;checkIP = 1.2.3.4 --------------------

2 1

Stunnel 5.51 Pop3 Problem?
by Colin 10 Apr '19

10 Apr '19

Hello, I'm new to this list and looking for advice/help with release 5.51 for Windows. I have three accounts, Yahoo, Aol and Gmx and I use Foxmail 5 with Stunnel. I use pop3 with all accounts and sometimes when retrieving mail I may decide to 'Not Fetch' any mail on the server that looks 'iffy' untill I've looked at it via the mail providers website. Now I've just upgraded to version 5.51 (over 5.50) and when checking any of the said accounts I can't see any mail that hasn't been fetched (the server looks empty.) But if I login to the mail website the unfetched mail is there to view for all accounts. I reverted to version 5.50 and now I can see the unfetched mail for all accounts in my 3rd party software. Therefore my question is: Is there a problem (bug??) with 5.51 which stops me from seeing unfetched pop3 mail or do I have to add something to the config file to make it work properly? Thanks...Colin ============ The problem of mail not being seen on the server seems fixed in 5.52 but now another glitch has arisen. When trying to download mail from a server the programme keeps freezing at a certain point. Let's say if I have ten mails to download the programme will freeze at maybe the third one and won't download the rest. I can try it several times and everything freezes at the same point. Again I've gone back to 5.50 and all works perfectly. Any ideas on how to fix this or shall I stay with 5.50?

2 1

Connection issues after upgrading to 5.51 (macOS)
by Dennis Preiser 10 Apr '19

10 Apr '19

Hi, I have been using stunnel for quite a long time on macOS without any problems. Specifically, I use this to connect to an nntps server. This is the corresponding config section: | [nntp2] | client = yes | accept = 127.0.0.2:1119 | connect = news.individual.de:563 With 5.50 everything goes well: | 2019.04.06 10:48:05 LOG5[2]: Service [nntp2] accepted connection from 127.0.0.2:49366 | 2019.04.06 10:48:05 LOG5[2]: s_connect: connected 130.133.4.10:563 | 2019.04.06 10:48:05 LOG5[2]: Service [nntp2] connected remote server from 192.168.200.102:49367 I can read news without further log entries. After the upgrade to 5.51 I can not read any news anymore. As soon as I want to read an article the connection breaks down: | 2019.04.06 10:54:09 LOG5[0]: Service [nntp2] accepted connection from 127.0.0.2:49189 | 2019.04.06 10:54:09 LOG5[0]: s_connect: connected 130.133.4.10:563 | 2019.04.06 10:54:09 LOG5[0]: Service [nntp2] connected remote server from 192.168.200.102:49190 | 2019.04.06 10:54:19 LOG3[0]: transfer() loop executes not transferring any data | 2019.04.06 10:54:19 LOG3[0]: please report the problem to Michal.Trojnara(a)stunnel.org | 2019.04.06 10:54:19 LOG3[0]: stunnel 5.51 on x86_64-apple-darwin18.5.0 platform | 2019.04.06 10:54:19 LOG3[0]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 | 2019.04.06 10:54:19 LOG3[0]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI | 2019.04.06 10:54:19 LOG3[0]: protocol=TLSv1.2, SSL_pending=0 | 2019.04.06 10:54:19 LOG3[0]: sock_open_rd=Y, sock_open_wr=Y | 2019.04.06 10:54:19 LOG3[0]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n | 2019.04.06 10:54:19 LOG3[0]: sock_can_rd=n, sock_can_wr=n | 2019.04.06 10:54:19 LOG3[0]: ssl_can_rd=n, ssl_can_wr=n | 2019.04.06 10:54:19 LOG3[0]: read_wants_read=Y, read_wants_write=n | 2019.04.06 10:54:19 LOG3[0]: write_wants_read=n, write_wants_write=n | 2019.04.06 10:54:19 LOG3[0]: shutdown_wants_read=n, shutdown_wants_write=n | 2019.04.06 10:54:19 LOG3[0]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) | 2019.04.06 10:54:19 LOG5[0]: Connection reset: 2151 byte(s) sent to TLS, 3546 byte(s) sent to socket | 2019.04.06 10:54:21 LOG5[1]: Service [nntp2] accepted connection from 127.0.0.2:49191 | 2019.04.06 10:54:21 LOG5[1]: s_connect: connected 130.133.4.10:563 | 2019.04.06 10:54:21 LOG5[1]: Service [nntp2] connected remote server from 192.168.200.102:49192 | 2019.04.06 10:54:23 LOG3[1]: transfer() loop executes not transferring any data | 2019.04.06 10:54:23 LOG3[1]: please report the problem to Michal.Trojnara(a)stunnel.org | 2019.04.06 10:54:23 LOG3[1]: stunnel 5.51 on x86_64-apple-darwin18.5.0 platform | 2019.04.06 10:54:23 LOG3[1]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 | 2019.04.06 10:54:23 LOG3[1]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI | 2019.04.06 10:54:23 LOG3[1]: protocol=TLSv1.2, SSL_pending=0 | 2019.04.06 10:54:23 LOG3[1]: sock_open_rd=Y, sock_open_wr=Y | 2019.04.06 10:54:23 LOG3[1]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n | 2019.04.06 10:54:23 LOG3[1]: sock_can_rd=n, sock_can_wr=n | 2019.04.06 10:54:23 LOG3[1]: ssl_can_rd=n, ssl_can_wr=n | 2019.04.06 10:54:23 LOG3[1]: read_wants_read=Y, read_wants_write=n | 2019.04.06 10:54:23 LOG3[1]: write_wants_read=n, write_wants_write=n | 2019.04.06 10:54:23 LOG3[1]: shutdown_wants_read=n, shutdown_wants_write=n | 2019.04.06 10:54:23 LOG3[1]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) | 2019.04.06 10:54:23 LOG5[1]: Connection reset: 163 byte(s) sent to TLS, 435 byte(s) sent to socket Downgrading to 5.50 solves this issue for the time being. Are there any changes between 5.50 and 5.51 that could explain this behavior? Dennis

1 1

stunnel 5.53 released
by Michal Trojnara 10 Apr '19

10 Apr '19

Dear Users, I have released version 5.53 of stunnel. Version 5.53, 2019.04.10, urgency: HIGH * Bugfixes - Fixed data transfer stalls introduced in stunnel 5.51. * New features - Android binary updated to support Android 4.x. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 80439896ee14269eb70bc8bc669433c7d619018a62c9f9c5c760a24515302585 stunnel-5.53.tar.gz 4f2d24d08f547943b8a499d411425409a52973a349c9120c650ba77d3f29ef79 stunnel-5.53-win64-installer.exe e619880f4fc25a7a4869cace9f6e6f3f5940cfdb764ed9987d892d9e9b0ea35d stunnel-5.53-android.zip Best regards, Mike

1 0

stunnel 5.52 released
by Michal Trojnara 10 Apr '19

10 Apr '19

Dear Users, I have released version 5.52 of stunnel. Version 5.52, 2019.04.08, urgency: HIGH * Bugfixes - Fixed a transfer() loop bug introduced in stunnel 5.51. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 00b973aa0d48b0707dd722c4e0a20b8378fc9b0ba301fdb785ffb75341024e21 stunnel-5.52.tar.gz c9224c35cdd3a6de8fab7c2844ca0c185ebcc96fd9183a05407e2ba77cadc7c6 stunnel-5.52-win64-installer.exe d4ff581e1547c2e194abd586e9542bfe20399c1287f970eaa5ba1824e4567453 stunnel-5.52-android.zip Best regards, Mike

2 1

stunnel 5.51 released
by Michal Trojnara 10 Apr '19

10 Apr '19

Dear Users, I have released version 5.51 of stunnel. Version 5.51, 2019.04.04, urgency: MEDIUM * New features - Hexadecimal PSK keys are automatically converted to binary. - Session ticket support (requires OpenSSL 1.1.1 or later). "connect" address persistence is currently unsupported with session tickets. - SMTP HELO before authentication (thx to Jacopo Giudici). - New "curves" option to control the list of elliptic curves in OpenSSL 1.1.0 and later. - New "ciphersuites" option to control the list of permitted TLS 1.3 ciphersuites. - Include file name and line number in OpenSSL errors. - Compatibility with the current OpenSSL 3.0.0-dev branch. - Better performance with SSL_set_read_ahead()/SSL_pending(). * Bugfixes - Fixed PSKsecrets as a global option (thx to Teodor Robas). - Fixed a memory allocation bug (thx to matanfih). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 77437cdd1aef1a621824bb3607e966534642fe90c69f4d2279a9da9fa36c3253 stunnel-5.51.tar.gz a0e26fde3ba09d6545cfbb44cab06ebd4ddf9c4b536e7d8eb76615ab54b2339c stunnel-5.51-win64-installer.exe ee90bef40cb47617fe7372707dba119f5176cb0fd9eb1bc00cdd1e2c370041db stunnel-5.51-android.zip Best regards, Mike

2 1

Problems after compiling stunnel 5.16 with openssl 1.0.2k
by simona vittori 09 Apr '19

09 Apr '19

Hello, I have compiled stunnel 5.16 with openssl 1.0.2k on a linux 3.0.101-97-default. When I execute ./stunnel -version I receive the following error: ./stunnel: error while loading shared libraries: libssl.so.1.0.0: cannot open shared object file: No such file or directory Can anyone help me please? Thanks a lot bye bye Simona

2 1

Issues after upgrading stunnel to v5.51 on Windows
by stunnel＠alpiston.com 07 Apr '19

07 Apr '19

Hello, I've been using stunnel v5.50 (x64-pc-mingw32-gnu) to encrypt RTSP traffic between two Win10 Pro computers without any problems. However, after upgrading to stunnel v5.51 the RTSP traffic has started to stutter (as the framerate has dropped to almost nothing, from 20 fps to 0.01 fps to be precise), and the few frames that are actually transferred arrive visually corrupted. After enabling debugging at level 7, I get the following (some parts have been obfuscated for privacy reasons): 2019.04.08 00:53:51 LOG7[main]: Found 1 ready file descriptor(s) 2019.04.08 00:53:51 LOG7[main]: FD=528 ifds=r-x ofds=--- 2019.04.08 00:53:51 LOG7[main]: FD=536 ifds=r-x ofds=--- 2019.04.08 00:53:51 LOG7[main]: FD=544 ifds=r-x ofds=--- 2019.04.08 00:53:51 LOG7[main]: FD=648 ifds=r-x ofds=r-- 2019.04.08 00:53:51 LOG7[main]: FD=664 ifds=r-x ofds=--- 2019.04.08 00:53:51 LOG7[main]: FD=828 ifds=r-x ofds=--- 2019.04.08 00:53:51 LOG7[main]: Service [RTSP] accepted (FD=584) from A.B.C.D:E 2019.04.08 00:53:51 LOG7[main]: Creating a new thread 2019.04.08 00:53:51 LOG7[main]: New thread created 2019.04.08 00:53:51 LOG7[2]: Service [RTSP] started 2019.04.08 00:53:51 LOG7[2]: Setting local socket options (FD=584) 2019.04.08 00:53:51 LOG7[2]: Option TCP_NODELAY set on local socket 2019.04.08 00:53:51 LOG5[2]: Service [RTSP] accepted connection from A.B.C.D:E 2019.04.08 00:53:51 LOG6[2]: s_connect: connecting F.G.H.I:J 2019.04.08 00:53:51 LOG7[2]: s_connect: s_poll_wait F.G.H.I:J: waiting 10 seconds 2019.04.08 00:53:51 LOG5[2]: s_connect: connected F.G.H.I:J 2019.04.08 00:53:51 LOG5[2]: Service [RTSP] connected remote server from A.B.C.D:K 2019.04.08 00:53:51 LOG7[2]: Setting remote socket options (FD=900) 2019.04.08 00:53:51 LOG7[2]: Option TCP_NODELAY set on remote socket 2019.04.08 00:53:51 LOG7[2]: Remote descriptor (FD=900) initialized 2019.04.08 00:53:51 LOG6[2]: SNI: sending servername: LLLL 2019.04.08 00:53:51 LOG6[2]: Peer certificate required 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): before SSL initialization 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS write client hello 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS write client hello 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS read server hello 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): TLSv1.3 read encrypted extensions 2019.04.08 00:53:51 LOG7[2]: Verification started at depth=1: O=O, OU=OU, CN=CN 2019.04.08 00:53:51 LOG7[2]: CERT: Pre-verification succeeded 2019.04.08 00:53:51 LOG6[2]: Certificate accepted at depth=1: O=O, OU=OU, CN=CN 2019.04.08 00:53:51 LOG7[2]: Verification started at depth=0: O=O, OU=OU 2019.04.08 00:53:51 LOG7[2]: CERT: Pre-verification succeeded 2019.04.08 00:53:51 LOG6[2]: CERT: Host name "LLLL" matched with "LLLL" 2019.04.08 00:53:51 LOG5[2]: Certificate accepted at depth=0: O=O, OU=OU 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS read server certificate 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): TLSv1.3 read server certificate verify 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS read finished 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS write change cipher spec 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS write finished 2019.04.08 00:53:51 LOG7[2]: 1 client connect(s) requested 2019.04.08 00:53:51 LOG7[2]: 1 client connect(s) succeeded 2019.04.08 00:53:51 LOG7[2]: 0 client renegotiation(s) requested 2019.04.08 00:53:51 LOG7[2]: 0 session reuse(s) 2019.04.08 00:53:51 LOG6[2]: TLS connected: new session negotiated 2019.04.08 00:53:51 LOG6[2]: TLSv1.3 ciphersuite: TLS_CHACHA20_POLY1305_SHA256 (256-bit encryption) 2019.04.08 00:53:51 LOG7[2]: Compression: null, expansion: null 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSL negotiation finished successfully 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSL negotiation finished successfully 2019.04.08 00:53:51 LOG7[2]: Deallocating application specific data for session connect address 2019.04.08 00:53:51 LOG7[2]: New session callback 2019.04.08 00:53:51 LOG7[2]: Peer certificate was cached (1509 bytes) 2019.04.08 00:53:51 LOG6[2]: Session id: 08B6A892F03C33D29542A794B1C5B0A7646FB9160318EC39D3F294EEF7CAE4EB 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS read server session ticket 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSL negotiation finished successfully 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSL negotiation finished successfully 2019.04.08 00:53:51 LOG7[2]: New session callback 2019.04.08 00:53:51 LOG7[2]: Deallocating application specific data for session connect address 2019.04.08 00:53:51 LOG6[2]: Session id: 9A06F5437D7039A32E531DA4976EDE9F8CA44820025221D1CE36E237B71E9AD3 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS read server session ticket 2019.04.08 00:54:02 LOG6[2]: Read socket closed (readsocket) 2019.04.08 00:54:02 LOG7[2]: Sending close_notify alert 2019.04.08 00:54:02 LOG7[2]: TLS alert (write): warning: close notify 2019.04.08 00:54:02 LOG6[2]: SSL_shutdown successfully sent close_notify alert 2019.04.08 00:54:02 LOG7[main]: Found 1 ready file descriptor(s) 2019.04.08 00:54:02 LOG7[main]: FD=528 ifds=r-x ofds=--- 2019.04.08 00:54:02 LOG7[main]: FD=536 ifds=r-x ofds=--- 2019.04.08 00:54:02 LOG7[main]: FD=544 ifds=r-x ofds=--- 2019.04.08 00:54:02 LOG7[main]: FD=648 ifds=r-x ofds=r-- 2019.04.08 00:54:02 LOG7[main]: FD=664 ifds=r-x ofds=--- 2019.04.08 00:54:02 LOG7[main]: FD=828 ifds=r-x ofds=--- 2019.04.08 00:54:02 LOG7[main]: Service [RTSP] accepted (FD=908) from A.B.C.D:L 2019.04.08 00:54:02 LOG7[main]: Creating a new thread 2019.04.08 00:54:02 LOG7[main]: New thread created 2019.04.08 00:54:02 LOG7[3]: Service [RTSP] started 2019.04.08 00:54:02 LOG7[3]: Setting local socket options (FD=908) 2019.04.08 00:54:02 LOG7[3]: Option TCP_NODELAY set on local socket 2019.04.08 00:54:02 LOG5[3]: Service [RTSP] accepted connection from A.B.C.D:L 2019.04.08 00:54:02 LOG7[2]: TLS alert (read): warning: close notify 2019.04.08 00:54:02 LOG6[2]: TLS closed (SSL_read) 2019.04.08 00:54:02 LOG7[2]: Sent socket write shutdown 2019.04.08 00:54:02 LOG5[2]: Connection closed: 1374 byte(s) sent to TLS, 1782 byte(s) sent to socket 2019.04.08 00:54:02 LOG7[2]: Remote descriptor (FD=900) closed 2019.04.08 00:54:02 LOG7[2]: Local descriptor (FD=584) closed 2019.04.08 00:54:02 LOG7[2]: Service [RTSP] finished (1 left) 2019.04.08 00:54:02 LOG6[3]: s_connect: connecting F.G.H.I:J 2019.04.08 00:54:02 LOG7[3]: s_connect: s_poll_wait F.G.H.I:J: waiting 10 seconds 2019.04.08 00:54:02 LOG5[3]: s_connect: connected F.G.H.I:J 2019.04.08 00:54:02 LOG5[3]: Service [RTSP] connected remote server from A.B.C.D:M 2019.04.08 00:54:02 LOG7[3]: Setting remote socket options (FD=592) 2019.04.08 00:54:02 LOG7[3]: Option TCP_NODELAY set on remote socket 2019.04.08 00:54:02 LOG7[3]: Remote descriptor (FD=592) initialized 2019.04.08 00:54:02 LOG6[3]: SNI: sending servername: LLLL 2019.04.08 00:54:02 LOG6[3]: Peer certificate required 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): before SSL initialization 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS write client hello 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS write client hello 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS read server hello 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): TLSv1.3 read encrypted extensions 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS read finished 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS write change cipher spec 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS write finished 2019.04.08 00:54:02 LOG7[3]: Remove session callback 2019.04.08 00:54:02 LOG7[3]: 2 client connect(s) requested 2019.04.08 00:54:02 LOG7[3]: 2 client connect(s) succeeded 2019.04.08 00:54:02 LOG7[3]: 0 client renegotiation(s) requested 2019.04.08 00:54:02 LOG7[3]: 1 session reuse(s) 2019.04.08 00:54:02 LOG6[3]: TLS connected: previous session reused 2019.04.08 00:54:02 LOG6[3]: TLSv1.3 ciphersuite: TLS_CHACHA20_POLY1305_SHA256 (256-bit encryption) 2019.04.08 00:54:02 LOG7[3]: Compression: null, expansion: null 2019.04.08 00:54:02 LOG6[3]: Session id: 9A06F5437D7039A32E531DA4976EDE9F8CA44820025221D1CE36E237B71E9AD3 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSL negotiation finished successfully 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSL negotiation finished successfully 2019.04.08 00:54:02 LOG7[3]: New session callback 2019.04.08 00:54:02 LOG7[3]: Deallocating application specific data for session connect address 2019.04.08 00:54:02 LOG6[3]: Session id: C0F06C6E894812890045433304AD5880C6512D9FD3E61AA67285009143AFD645 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS read server session ticket 2019.04.08 00:54:05 LOG3[3]: transfer() loop executes not transferring any data 2019.04.08 00:54:05 LOG3[3]: please report the problem to Michal.Trojnara(a)stunnel.org 2019.04.08 00:54:05 LOG3[3]: stunnel 5.51 on x64-pc-mingw32-gnu platform 2019.04.08 00:54:05 LOG3[3]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 2019.04.08 00:54:05 LOG3[3]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2019.04.08 00:54:05 LOG7[3]: errno: (*_errno()) 2019.04.08 00:54:05 LOG3[3]: protocol=TLSv1.3, SSL_pending=0 2019.04.08 00:54:05 LOG3[3]: sock_open_rd=Y, sock_open_wr=Y 2019.04.08 00:54:05 LOG3[3]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2019.04.08 00:54:05 LOG3[3]: sock_can_rd=n, sock_can_wr=n 2019.04.08 00:54:05 LOG3[3]: ssl_can_rd=n, ssl_can_wr=n 2019.04.08 00:54:05 LOG3[3]: read_wants_read=Y, read_wants_write=n 2019.04.08 00:54:05 LOG3[3]: write_wants_read=n, write_wants_write=n 2019.04.08 00:54:05 LOG3[3]: shutdown_wants_read=n, shutdown_wants_write=n 2019.04.08 00:54:05 LOG3[3]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) 2019.04.08 00:54:05 LOG5[3]: Connection reset: 1169 byte(s) sent to TLS, 19088 byte(s) sent to socket 2019.04.08 00:54:05 LOG7[3]: Remote descriptor (FD=592) closed 2019.04.08 00:54:05 LOG7[3]: Local descriptor (FD=908) closed 2019.04.08 00:54:05 LOG7[3]: Service [RTSP] finished (0 left) As you can see, at 00:54:05 there's a log entry that says "transfer() loop executes not transferring any data". Any ideas about why is this happening on v5.51, and how could I solve it? By the way, should I e-mail this issue to Michal Trojnara as the logs suggests, or should I use this mailing list exclusively? Thank you, Ricardo.-- Best regards

1 0

Stunnel 5.51 Pop3 Problem?
by Colin 07 Apr '19

07 Apr '19

Hello, I'm new to this list and looking for advice/help with release 5.51 for Windows. I have three accounts, Yahoo, Aol and Gmx and I use Foxmail 5 with Stunnel. I use pop3 with all accounts and sometimes when retrieving mail I may decide to 'Not Fetch' any mail on the server that looks 'iffy' untill I've looked at it via the mail providers website. Now I've just upgraded to version 5.51 (over 5.50) and when checking any of the said accounts I can't see any mail that hasn't been fetched (the server looks empty.) But if I login to the mail website the unfetched mail is there to view for all accounts. I reverted to version 5.50 and now I can see the unfetched mail for all accounts in my 3rd party software. Therefore my question is: Is there a problem (bug??) with 5.51 which stops me from seeing unfetched pop3 mail or do I have to add something to the config file to make it work properly? Thanks...Colin

1 0

Re: [stunnel-users] V5.51 no support for OpenSSL 1.0.2 ?
by Peter Pentchev 05 Apr '19

05 Apr '19

On Fri, Apr 05, 2019 at 01:39:04PM +0000, Duncan Morris wrote: > Hi, > > The latest version of options.c, in the V5.51 source, uses a new function, which appears to only be present in OpenSSL 1.1.0 onwards. > > key_buf=OPENSSL_hexstr2buf(key_str, &key_len); > > Is it intentional that support for OpenSSL 1.0.2 has been dropped? But there is also this segment of code... #else /* OpenSSL older than 1.1.0 */ #define X509_STORE_CTX_get0_chain(x) X509_STORE_CTX_get_chain(x) #define OPENSSL_hexstr2buf string_to_hex #endif /* OpenSSL 1.1.0 or newer */ So it should build with OpenSSL 1.0.2, too. Have you actually experienced problems building it? G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Is there a Win32 installer that supports sslVersionMin = TLS1.2?
by kent loving 01 Apr '19

01 Apr '19

I need to run a client on Win XP that connects to a server using TLS 1.2 or higher. Jose Alf posted that he made a test build of 5.50 in a win32 installer but uses OpenSSL 1.0.2p. And it does not seem to be official. The changelog says version 5.49, which has a win32 installer, also uses OpenSSL 1.0.2p. I can't tell if it supports TLS1.2. The man page implies I need OpenSSL 1.1.1 to get the sslVersionMin option. And, OpenSSL says v1.0.2 support ends in 9 months. Any advice is appreciated. Thanks, Kent Loving

3 2

OpenVPN with stunnel
by Heikki Lavaste 25 Mar '19

25 Mar '19

Hi, To bypass the office firewall to access home server, I'm trying to run openvpn over port 443 with stunnel. I managed to get to this point: Log on client side 2019.03.22 22:15:13 LOG5[38]: Connection closed: 352 byte(s) sent to TLS, 2067 byte(s) sent to socket 2019.03.22 22:15:19 LOG5[39]: Service [openvpn] accepted connection from 127.0.0.1:51265 2019.03.22 22:15:19 LOG5[39]: s_connect: connected x.x.x.x:443 2019.03.22 22:15:19 LOG5[39]: Service [openvpn] connected remote server from x.x.x.x:51266 2019.03.22 22:15:19 LOG5[39]: Connection closed: 352 byte(s) sent to TLS, 2067 byte(s) sent to socket Log on server side: Mar 22 22:21:54 ssh-server-heikki stunnel[2797]: LOG5[2797:140127128753920]: connect_blocking: connected 127.0.0.1:8443 Mar 22 22:21:54 ssh-server-heikki stunnel[2797]: LOG5[2797:140127128753920]: Service [openvpn] connected remote server from 127.0.0.1:49366 Mar 22 22:21:54 ssh-server-heikki stunnel[2797]: LOG5[2797:140127128753920]: Connection closed: 2067 byte(s) sent to SSL, 352 byte(s) sent to socket Config: Client [openvpn] client = yes accept = localhost:1337 connect = x.x.x.xg:443 cert = C:\Users\heikki_lavaste\Documents\stunnel\stunnel.pem verifyChain = yes verify = 2 CAfile = C:\Users\heikki_lavaste\Documents\stunnel\ca-cert.pem checkHost = stunnel.heikki-lab.local sslVersion = TLSv1 Server chroot = /var/run/stunnel sslVersion = TLSv1 pid = /stunnel.pid setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = /etc/stunnel/stunnel.pem [openvpn] accept = 443 connect = localhost:8443 cert = /etc/stunnel/stunnel.pem The issue is probably nothing to do with stunnel but if somebody can help me figure this out, that'd be appreciated. Kind Regards Heikki

2 1

ERR_SSL_VERSION_INTERFERENCE on Google Chrome v 73.0.3683.86 and stunnel v5.51b1
by Kolan Koala 25 Mar '19

25 Mar '19

I cannot get TLS 1.3 to work with Chrome. TLS 1.3 works fine in firefox quantum v 66.0.1 over the same hardware, so this is not caused by middleboxes. It is a fault with stunnel or Chrome. ERR_SSL_VERSION_INTERFERENCE error occurs in Chrome and will not connect. For now the solution is to turn off TLS v1.3 in stunnel configuration and force TLS v1.2, but this is not a long term solution. Does anyone have a solution to use TLS 1.3 with chrome and stunnel together? Kolan

1 0

No more Win32 stunnel?
by John Hall 21 Mar '19

21 Mar '19

I've only just discovered that stunnel is seemingly no longer being updated for Win32; at any rate there has been no version 5.50 released for Win32. It would have been nice if there had been an announcement to that effect, as until now I was only subscribed to the announcements mailing list and had thus been in blissful ignorance. (For some reason I never saw ANY announcement for 5.50 - in fact I still seem to be on 5.47.) Given that there are a number of ports to different OSs by various people, is there any chance that someone might supply a Win32 port for future versions? (Sadly I lack the knowledge to do that myself.) -- John Hall

3 4

Verify peer immediately
by Phillip Hellewell 21 Mar '19

21 Mar '19

Hi, I have verifyPeer = yes in my client stunnel.conf. Is there any way to make it verify the peer right away instead of waiting until a connection is made (to the accept port)? I run stunnel with foreground = yes and would like it to exit right away if the peer doesn't have the appropriate cert/key. Thanks, Phillip

1 0

stunnel become non-non responsive and very sluggish
by Joe Phillips 18 Mar '19

18 Mar '19

I have 5.30 running on Ubuntu workstation. It has become sluggish and almost non responsive at times. I captured this in the log the other day...no source, no destination address. Maybe got stuck in a loop? Have to restart Ubuntu to clear it up. stunnel2@stunnel2:~$ /etc/init.d/stunnel4 restart [....] Restarting stunnel4 (via systemctl): stunnel4.serviceFailed to restart stunnel4.service: Access denied See system logs and 'systemctl status stunnel4.service' for details. failed! stunnel2@stunnel2:~$ sudo tail -f -n 100 /var/log/stunnel.log sudo: unable to resolve host stunnel2: Connection timed out [sudo] password for stunnel2: 2019.03.13 04:06:14 LOG5[1149140]: Connection reset: 34440 byte(s) sent to SSL, 4886 byte(s) sent to socket 2019.03.13 04:38:56 LOG5[1142702]: Connection reset: 2362 byte(s) sent to SSL, 1225 byte(s) sent to socket 2019.03.13 05:09:32 LOG5[1137283]: Connection reset: 23006 byte(s) sent to SSL, 3977 byte(s) sent to socket 2019.03.13 05:51:57 LOG5[1109534]: Connection reset: 33953 byte(s) sent to SSL, 16755 byte(s) sent to socket 2019.03.13 05:58:36 LOG5[1139715]: Connection reset: 25039 byte(s) sent to SSL, 3944 byte(s) sent to socket 2019.03.13 06:25:12 LOG5[1137757]: Connection reset: 2863 byte(s) sent to SSL, 1329 byte(s) sent to socket 2019.03.13 06:49:19 LOG5[1137393]: Connection reset: 26536 byte(s) sent to SSL, 14839 byte(s) sent to socket 2019.03.13 06:51:35 LOG5[1137344]: Connection reset: 28968 byte(s) sent to SSL, 12986 byte(s) sent to socket 2019.03.13 07:10:28 LOG5[1137343]: Connection reset: 28655 byte(s) sent to SSL, 7632 byte(s) sent to socket 2019.03.13 07:30:52 LOG5[1136403]: Connection reset: 25466 byte(s) sent to SSL, 6767 byte(s) sent to socket 2019.03.13 07:35:33 LOG5[1141675]: Connection reset: 28637 byte(s) sent to SSL, 15044 byte(s) sent to socket 2019.03.13 07:39:21 LOG5[1121823]: Connection reset: 47442 byte(s) sent to SSL, 67336 byte(s) sent to socket 2019.03.13 07:39:58 LOG5[1148822]: Connection reset: 25003 byte(s) sent to SSL, 9295 byte(s) sent to socket 2019.03.13 07:40:29 LOG5[1127468]: Connection reset: 57030 byte(s) sent to SSL, 73806 byte(s) sent to socket 2019.03.13 07:46:08 LOG5[1107655]: Connection reset: 84608 byte(s) sent to SSL, 125726 byte(s) sent to socket 2019.03.13 07:49:49 LOG5[1140561]: Connection reset: 27344 byte(s) sent to SSL, 11112 byte(s) sent to socket 2019.03.13 07:59:23 LOG5[1106646]: Connection reset: 9970 byte(s) sent to SSL, 5355 byte(s) sent to socket 2019.03.13 08:01:27 LOG5[1143613]: Connection reset: 26733 byte(s) sent to SSL, 8993 byte(s) sent to socket 2019.03.13 08:02:28 LOG5[1141251]: Connection reset: 49897 byte(s) sent to SSL, 62187 byte(s) sent to socket 2019.03.13 08:03:11 LOG5[1139045]: Connection reset: 24669 byte(s) sent to SSL, 4580 byte(s) sent to socket 2019.03.13 08:05:13 LOG5[1137322]: Connection reset: 39408 byte(s) sent to SSL, 33428 byte(s) sent to socket 2019.03.13 08:07:56 LOG5[1151696]: Connection reset: 23577 byte(s) sent to SSL, 5415 byte(s) sent to socket 2019.03.13 08:11:12 LOG5[1136170]: Connection reset: 64684 byte(s) sent to SSL, 36839 byte(s) sent to socket 2019.03.13 08:11:55 LOG5[1141693]: Connection reset: 22826 byte(s) sent to SSL, 5186 byte(s) sent to socket 2019.03.13 08:15:30 LOG5[1140377]: Connection reset: 42452 byte(s) sent to SSL, 39471 byte(s) sent to socket 2019.03.13 08:18:29 LOG5[1154893]: Connection reset: 21190 byte(s) sent to SSL, 3096 byte(s) sent to socket 2019.03.13 08:22:14 LOG5[1153488]: Connection reset: 23506 byte(s) sent to SSL, 5081 byte(s) sent to socket 2019.03.13 08:24:34 LOG5[1153167]: Connection reset: 46285 byte(s) sent to SSL, 8378 byte(s) sent to socket 2019.03.13 08:26:25 LOG5[1145557]: Connection reset: 26015 byte(s) sent to SSL, 6055 byte(s) sent to socket 2019.03.13 08:29:34 LOG5[1030096]: Connection reset: 89657 byte(s) sent to SSL, 120807 byte(s) sent to socket 2019.03.13 08:30:36 LOG5[1081623]: Connection reset: 51409 byte(s) sent to SSL, 50378 byte(s) sent to socket 2019.03.13 08:32:23 LOG5[1149449]: Connection reset: 28329 byte(s) sent to SSL, 12655 byte(s) sent to socket 2019.03.13 08:32:33 LOG5[1106312]: Connection reset: 52138 byte(s) sent to SSL, 58239 byte(s) sent to socket 2019.03.13 08:33:46 LOG5[1137325]: Connection reset: 36900 byte(s) sent to SSL, 29750 byte(s) sent to socket 2019.03.13 08:36:35 LOG5[1145147]: Connection reset: 31740 byte(s) sent to SSL, 21114 byte(s) sent to socket 2019.03.13 08:38:59 LOG5[1133239]: Connection reset: 44816 byte(s) sent to SSL, 18743 byte(s) sent to socket 2019.03.13 08:41:04 LOG5[1148129]: Connection reset: 32191 byte(s) sent to SSL, 20525 byte(s) sent to socket 2019.03.13 08:43:55 LOG5[1150567]: Connection reset: 27989 byte(s) sent to SSL, 12627 byte(s) sent to socket 2019.03.13 08:47:21 LOG5[1146666]: Connection reset: 29242 byte(s) sent to SSL, 13836 byte(s) sent to socket 2019.03.13 08:49:26 LOG5[main]: Terminated 2019.03.13 08:58:32 LOG5[ui]: stunnel 5.30 on x86_64-pc-linux-gnu platform 2019.03.13 08:58:32 LOG5[ui]: Compiled/running with OpenSSL 1.0.2g 1 Mar 2016 2019.03.13 08:58:32 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2019.03.13 08:58:32 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2019.03.13 08:58:32 LOG5[ui]: UTF-8 byte order mark detected 2019.03.13 08:58:32 LOG5[ui]: FIPS mode disabled 2019.03.13 08:58:36 LOG5[ui]: Configuration successful [UMC Color Logo - small]<http://www.universalmoney.com/> Joe Phillips SVP-IT 15301 W. 87th Street Parkway, Suite 215 Lenexa, KS 66219 Corp Office 913.831.2055 Direct via Cell 913.927.5691 www.universalmoney.com

2 1

(no subject)
by Vijay Raghavan P 05 Mar '19

05 Mar '19

Hi, I have to create tunnel between server and client. Client have proxy configured in between. So i use below in /etc/stunnel/stunnel.config pid = /var/run/stunnel.pid cert = /home/client.crt key = /home/client.key options = NO_SSLv2 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes CAfile=/home/**chain.pem verify=2 [test] protocol = connect accept = 127.0.0.1:10000 protocolHost = server.xxxx.com:443 connect = <PROXYIP>:<PROXY port> protocolUsername = user1 protocolPassword = password protocolAuthentication = Basic then i bring up the service. With above configuration connection works file. Now i don't want proxy password to be clear text in this case. Any pointers plz Thanks, Vj

2 3

Re: [stunnel-users] stunnel-users Digest, Vol 176, Issue 3
by Andrew Smalley 04 Mar '19

04 Mar '19

FIPS in stunnel and OpenSSL The actual cause of the problem is OpenSSL v1.1.x does not support FIPS engine and as such, you can only use a FIPS Compliant cipher until FIPS is recertified as I understand it Andruw Smalley Loadbalancer.org Ltd. www.loadbalancer.org +1 888 867 9504 / +44 (0)330 380 1064 asmalley(a)loadbalancer.org Leave a Review | Deployment Guides | Blog Andruw Smalley Loadbalancer.org Ltd. www.loadbalancer.org +1 888 867 9504 / +44 (0)330 380 1064 asmalley(a)loadbalancer.org Leave a Review | Deployment Guides | Blog On Mon, 4 Mar 2019 at 16:20, <stunnel-users-request(a)stunnel.org> wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. FIPS mode not supported (Yan Renelt) > 2. Re: FIPS mode not supported (mlrx) > 3. Re: FIPS mode not supported (Flo Rance) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 4 Mar 2019 16:14:47 +0100 > From: Yan Renelt <reneltyan(a)gmail.com> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] FIPS mode not supported > Message-ID: <3F804E14-5218-42A5-9850-7AEBC0EF8F96(a)gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > > my config is > cert = stunnel.pem > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > debug = 7 > > fips = yes > > [Demo-Trading] > client = yes > accept = 127.0.0.1:40001 > connect = fix-order.london-demo.lmax.com:443 > sslVersion = TLSv1 > options = NO_SSLv2 > options = NO_SSLv3 > > [Demo ñ Market Data] > client = yes > accept = 127.0.0.1:40003 > connect = fix-marketdata.london-demo.lmax.com:443 > sslVersion = TLSv1 > options = NO_SSLv2 > options = NO_SSLv3 > > > and I still receiving this error. > > FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported > > Any suggestions? Fips = no is not an option for me. > > > Thanks > > Yan >

1 0

FIPS mode not supported
by Yan Renelt 04 Mar '19

04 Mar '19

Hi, my config is cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 fips = yes [Demo-Trading] client = yes accept = 127.0.0.1:40001 connect = fix-order.london-demo.lmax.com:443 sslVersion = TLSv1 options = NO_SSLv2 options = NO_SSLv3 [Demo ñ Market Data] client = yes accept = 127.0.0.1:40003 connect = fix-marketdata.london-demo.lmax.com:443 sslVersion = TLSv1 options = NO_SSLv2 options = NO_SSLv3 and I still receiving this error. FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported Any suggestions? Fips = no is not an option for me. Thanks Yan

3 2

dhparam and others
by mlrx 02 Mar '19

02 Mar '19

Hello, This is my first run with stunnel. I have unbound and stunnel on openBSD to do DNS-over-TLS and it works (fine). I want now to enforce TLS security so I added the following options: sslVersion = TLSv1.2 options = CIPHER_SERVER_PREFERENCE ciphers = [list] curve = [name] When it will be ready to production, I will add: verify = 3 CA* OCSP* For now, I don't find any information about using dhparam file. Something like SSLOpenSSLConfCmd DHParameters "/path/to/file.pem" in Apache. How can I do it possible? Could you point me some informations or the path to do it please? Could you confirm that I can't use TLS1.3 for now in stunnel? May be you could have some security advices ? Best regards, -- mlrx

1 0

Issue with NTLM authorisation
by Vijay Raghavan P 01 Mar '19

01 Mar '19

Hi, I have to create tunnel between server and client. Client have proxy configured in between. So i use below in /etc/stunnel/stunnel.config. User name and password is correct pid = /var/run/stunnel.pid cert = /home/client.crt key = /home/client.key options = NO_SSLv2 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes CAfile=/home/**chain.pem verify=2 [test] protocol = connect accept = 127.0.0.1:10000 protocolHost = host.vmj.com:443 connect = <PROXYIP>:<PROXY port> protocolUsername = vmj.com\user1 protocolPassword = VMJTEST!123 protocolAuthentication = NTLM In stunnel.log, i can see below error 2019.02.28 18:36:50 LOG6[2103:140737354032896]: Client-mode connect protocol negotiations started 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> CONNECT host.vmj.com:443 HTTP/1.1 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> Host: host.vmj.com:443 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> Proxy-Connection: keep-alive 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAA== 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- HTTP/1.1 407 Proxy Authentication Required 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Server: squid/3.3.8 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Mime-Version: 1.0 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Date: Thu, 28 Feb 2019 18:36:33 GMT 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Content-Type: text/html 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Content-Length: 3285 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Vary: Accept-Language 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Content-Language: en 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAAAAADgAAAACAgACueAMGSlaSZ0AAAAAAAAAAAAAAAA4AAAABgEAAAAAAA8= 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- X-Cache: MISS from squidproxy.vmj.com 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- X-Cache-Lookup: NONE from squidproxy.vmj.com:3128 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Via: 1.1 squidproxy.vmj.com (squid/3.3.8) 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Connection: keep-alive 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> CONNECT host.vmj.com:443 HTTP/1.1 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> Host: host.vmj.com:443 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> Proxy-Authorization: NTLM TlRMTVNTUAADAAAAAAAAAGcAAAAYABgAQAAAAAAAAABnAAAADwAPAFgAAAAAAAAAZwAAAAAAAABnAAAAAgIAAAGbqH5v5ML8msrfm3R1yDBsS+ai3ldihnZybmkuY29tXGJoYXJ0aQ== 2019.02.28 18:36:50 LOG7[2103:140737354032896]: -> 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- HTTP/1.1 407 Proxy Authentication Required 2019.02.28 18:36:50 LOG3[2103:140737354032896]: CONNECT request rejected 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Server: squid/3.3.8 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Mime-Version: 1.0 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Date: Thu, 28 Feb 2019 18:36:33 GMT 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Content-Type: text/html 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Content-Length: 3363 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Vary: Accept-Language 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Content-Language: en 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Proxy-Authenticate: NTLM 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- X-Cache: MISS from squidproxy.vmj.com 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- X-Cache-Lookup: NONE from squidproxy.vmj.com:3128 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Via: 1.1 squidproxy.vmj.com (squid/3.3.8) 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- Connection: keep-alive 2019.02.28 18:36:50 LOG7[2103:140737354032896]: <- 2019.02.28 18:36:50 LOG5[2103:140737354032896]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.02.28 18:36:50 LOG7[2103:140737354032896]: Remote socket (FD=14) closed 2019.02.28 18:36:50 LOG7[2103:140737354032896]: Local socket (FD=3) closed 2019.02.28 18:36:50 LOG7[2103:140737354032896]: Service [test] finished (0 left) If i try with basic authentication it works fine. Its urgent , can some one help me out. Thanks, Vj

2 1

Tunnel from win32 to Unix
by Eetu Pikkarainen 26 Feb '19

26 Feb '19

Hi, I am a totally newbie with this. We have intranet system in Windows Server (32bit) which reads a database (Oracle) situated in Unix machine via a tunnel made by Putty.exe. That works well except that the connection gets lost every now and then and it must be manually logged in every time. So I decided to try stunnel which we used earlier to read email from email server. However I cannot set the connection successfully. This is what I have tried now (among many other alternatives): [Kanto2] client = yes accept = 127.0.0.1:1501 connect = kanto2.oulu.fi:22 protocolUsername = <username> protocolPassword = <password> stunnel reads the configuration OK except this notification: [:] Service [Kanto2] needs authentication to prevent MITM attacks but when the database is tried to read happens this: 2019.02.18 13:32:30 LOG5[1]: Service [Kanto2] accepted connection from 127.0.0.1:64699 2019.02.18 13:32:30 LOG5[1]: s_connect: connected 130.231.240.100:22 2019.02.18 13:32:30 LOG5[1]: Service [Kanto2] connected remote server from 130.231.241.250:64700 2019.02.18 13:32:30 LOG3[1]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2019.02.18 13:32:30 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket I have tried different protocol alternatives with no help. What could be the problem? Is this kind of use even possible? thanks Eetu Pikkarainen PhD (Ed.), (Title of) Adjunct Prof., University Lecturer (in Education) Faculty of Education, University of Oulu, Finland Research Group: https://wiki.oulu.fi/display/theored Latest publications: Semiotic Theory of Learning: New Perspectives in the Philosophy of Education. By Andrew Stables, Winfried Nöth, Alin Olteanu, Sébastien Pesce and Eetu Pikkarainen https://www.taylorfrancis.com/books/e/9781351725170 Schools in Transition: Linking Past, Present, and Future in Educational Practice. Edited by Pauli Siljander, Kimmo Kontio and Eetu Pikkarainen https://www.sensepublishers.com/catalogs/bookseries/other-books/schools-in-…

2 1

Stunnel 3.50 Win - CAPI stopped working
by pepak＠seznam.cz 18 Feb '19

18 Feb '19

Hello, I have encountered a bug in Stunnel version 3.50. I have a setup with two computers (Server and Client) connected using Stunnel. The client is using a hardware token through the CAPI engine to authenticate itself to a server, using a config file: ----- fips = no taskbar = yes options = NO_SSLv2 options = NO_SSLv3 sslVersion = TLSv1.2 engine = capi [my-server] client = yes accept = 22 connect = my.server.com:1234 requireCert = yes verifyChain = yes verifyPeer = yes CAfile = my-cert-chain.pem engineId = capi ----- This setup works perfectly in Stunnel 3.49: When I try to connect to localhost:22, I receive a request to select a certificate and enter its PIN, and if successful, a connection to my server is established. In Stunnel 3.50, the connection fails to complete. The Stunnel log shows: LOG5[0]: Service [my-server] accepted connection from 127.0.0.1:49713 LOG5[0]: s_connect: connected 1.2.3.4:1234 LOG5[0]: Service [my-server] connected remote server from 10.11.12.13:49714 LOG5[0]: Certificate accepted at depth=0: CN=My server LOG3[0]: error queue: 141F0006: error:141F0006:SSL routines:tls_construct_cert_verify:EVP lib LOG3[0]: SSL_connect: 8006F074: error:8006F074:lib(128):capi_rsa_priv_enc:function not supported LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket However, if I change the engine to the default one and use a certificate in file, everything works fine. That suggests to me that the problem lies in the Stunnel's CAPI engine library. It is quite possible the problem is caused by the CAPI engine itself. I was experimenting with OpenSSL 1.1.1a some time back, trying to compile my own library files, and I just couldn't to get CAPI to work at all - the libraries themselves compiled OK and worked fine, but the CAPI engine just wouldn't work (while it was OK with OpenSSL 1.0.2q); the only way I could get CAPI to work with OpenSSL 1.1.1a was to use the 1.1.1a libraries and the 1.0.2q capi.dll. However, I am far from an expert on compiling OpenSSL, so I may have gotten it completely wrong. Could someone please verify that their CAPI engine is working with Stunnel? Also, it may be worth trying to compile a 64bit CAPI.dll from version 1.0.2q just to see if it might start working - in that case, a bug report to OpenSSL may be in order. Thanks. pepak

2 1

Timeout's issue / network stunnel on virtual apps
by Marian Andrei Olteanu 17 Feb '19

17 Feb '19

Hi all, I have a client - server application which works as following. The server is hosted in a linux machine and the clients are up in citrix(XEN) virtual machines. I have enable stunnel encry. in between this environments but i keep getting some connection issues from time to time. To be more clear the client application starts a session for you from the virtual machine (xen) so the stunnel.exe running there in the server is meant to encrypt traffic of around 100 users(from win AD who have access to use that resource in the server) , port configured in VM machine 1001 accept - linux.host:1002 connect with linux accept on 1002 - localhost:1000. the channel opened between the VM and Linux is used by many users simultaneous. Could please tell me what is happening here?Is this architecture able to work? thank you in advance. Marian

1 0

stunnel stopped working today, had to reboot server
by Christopher Schultz 14 Feb '19

14 Feb '19

Hello, I'm new to the list so I'm sorry if this isn't the right place to report this. I had a server stop responding to stunnel connections sometime yesterday and the resolution was ultimately to reboot the server and everything was okay. Restarting the stunnel service was not enough to get things working again. I isolated the problem to stunnel by checking that the underlying service (a Java web application) would respond from the localhost machine (it did) but an openssl s_client connection to localhost:stunnel-port would connect but not proceed past the CONNECTED(3) state. Ultimately, it would time-out. stunnel was not logging anything to syslog when these connections came in. Outgoing stunnel connections seemed to be okay. Looking through the log file, I could see that there were some odd messages coming from stunnel in the daemon.log file suggesting that there might be a memory leak. I won't post them here unless requested, as they may represent a potential security issue. My concern is that a service-restart for stunnel was not sufficient. This suggests a problem which goes deeper than the stunnel service. Is it possible for stunnel to break in such a way that it continues to be broken after a restart? I'm sorry, in retrospect, I was not 100% sure that the service did indeed stop and launch a new process when running /etc/init.d/stunnel restart, but there were no errors and the service-runner did report that the service was restarted. My (simplified) configuration and version information is posted below. Please let me know if there is any other information I might be able to provide in order to investigate this. Note that this is a package-managed version of stunnel, provided by the Debian package-maintainers. Thanks, -chris PS Thanks for a wonderful product. I've relied on stunnel for years to proxy these unencrypted AJP connections for me. Cheers for all your great work. Configuration: === CUT === cert = /etc/stunnel/stunnel.crt key = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4-ajp.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 4 CAfile = /etc/stunnel/stunnel-ajp-trusted.pem [now, a series of 4 services, all configured similarly] accept=public-port connect=localhost:private-port === CUT === Version: stunnel 5.39 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.1.0c 10 Nov 2016 Running with OpenSSL 1.1.0j 20 Nov 2018 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP Global options: debug = daemon.notice pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Linux kernel version: Linux [hostname] 4.9.0-8-amd64 #1 SMP Debian 4.9.130-2 (2018-10-27) x86_64 GNU/Linux This is running on a bare metal server.

2 5

Re: [stunnel-users] Problem with name resolving on Centos 7
by tom 13 Feb '19

13 Feb '19

Hello, > Are you sure 'foobar.remote.site' should resolve? > Does "ping foobar.remote.site" work? yes, the host is resolved on commandline and other services on this system can reach this host. > Do you have a /var/run/stunnel/etc/resolv.conf file? No at this time I dont have this file, but it doesnt change anything if I copy the original from /etc to this lokation. But this brings me to the point try to dissable chroot and in this case stunnel is working as expected. So far so good - there is something wrong in the chroot jail. I try to put it to /var/run/stunnel - no luck, but maybe there are other files missing as well? regards Tom

4 10

Problem with name resolving on Centos 7
by tom 12 Feb '19

12 Feb '19

Hello, I've installed stunnel-4.56-6.el7.x86_64 on my Centos 7. I can't establish a connection. Seems to be something wrong with the name resolution, because if I use the IP derect, the tunnel works. Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526436416]: Service [cs] accepted (FD=3) from 127.0.0.1:10866 Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Service [cs] started Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Waiting for a libwrap process Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Acquired libwrap process #0 Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Releasing libwrap process #0 Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Released libwrap process #0 Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Service [cs] permitted by libwrap from 127.0.0.1:10866 Feb 12 11:58:00 server stunnel[52445]: LOG5[52445:139984526432000]: Service [cs] accepted connection from 127.0.0.1:10866 Feb 12 11:58:00 server stunnel[52445]: LOG3[52445:139984526432000]: Error resolving 'foobar.remote.site': System error returned in errno (EAI_SYSTEM) Feb 12 11:58:00 server stunnel[52445]: LOG3[52445:139984526432000]: No host resolved Feb 12 11:58:00 server stunnel[52445]: LOG5[52445:139984526432000]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Local socket (FD=3) closed Feb 12 11:58:00 server stunnel[52445]: LOG7[52445:139984526432000]: Service [cs] finished (0 left) stunnel.conf: socket = r:TCP_NODELAY=1 socket = l:TCP_NODELAY=1 options = CIPHER_SERVER_PREFERENCE TIMEOUTclose = 0 sslVersion = TLSv1 options = NO_SSLv2 options = NO_SSLv3 client = yes options = DONT_INSERT_EMPTY_FRAGMENTS cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem debug = 7 chroot = /var/run/stunnel setuid = stunnel setgid = stunnel pid = /stunnel.pid fips = no [srvice] accept = 63123 connect = foobar.remote.site:63123 delay = yes Any suggestions are very welcome! Thanks in advance Tom

3 2

Stunnel 5.50 Transparent Both (Source+Destination)
by Luis Monteiro 01 Feb '19

01 Feb '19

Sirs. I´m trying to make Stunnel work in both source and destination transparent proxy and after looking every possibility I started to track the packet that is locally generated (Stunnel client sending to stunnel server). The packet goes out from process to raw table output chain. It deliveries to connect tracking that pass the packet to mangle output but it disappears before arriving in the nat table output chain. Stunnel Packet destination 7.0.0.2:80(Original destination)------raw/output-----connectTrack------mangle/output-------XXXX disappear With transparent destination off it works fine. Stunnel Packet destination 9.0.0.2:443(Stunnel Server IP)------raw/output-----connectTrack------mangle/output-------nat/output---- filter/output----interface The problem is probably regarding the tproxy/ip_transparent that stunnel use to control the connection and get the original src/dst to use. I tried 3 different distribution of linux with the same behavior. Does someone already use transparent=both and give me a setup that worked link linux distribution/version, stunnel version and so on? Thanks, Luis Monteiro

1 1

Re: [stunnel-users] How can stunnel use openssl HW cryptodev encryption
by Eric Eberhard 28 Jan '19

28 Jan '19

I'll give you two pieces of advice that almost everyone on the list won't agree with :) 1) Make a static openssl and static stunnel and locate them someplace apart from the standard locations (/usr/local/company_name/lib is what I use). This means if anyone messes with openssl or stunnel you won't be affected - and it will always work as it is static - and part of your application - the user does not even need your libraries. I have a personal distaste for dynamic linking . mostly because I have a lot of customers that update a lot of things (including openssl - a lot - and stunnel sometimes) . and then wonder why things stop working. A 10 year old openssl and stunnel - all static - will still run and work fine past all updates and user messing around. I choose when I want to update openssl and stunnel (meaning I look to see if there is something new I need or want). As a result I missed the keep alive and poodle bugs - I did not update until after both were fixed. 2) Forget hardware implementation - geez - modern computers are so darn fast that I cannot imagine you really need that level of "speed up" versus the grief you are handling. I have customers that exchange millions (4+) XML documents a day, all through stunnel, all through inetd (also not efficient supposedly - just reliable and always works and needs no management) - and have no problems. I am using IBM p Series (AIX) and these machines even at the low level are fast . but I also use some SCO and Linux and certainly with lesser volume they are fine as well. 3) OK - 3 is really - use inetd, so much easier and always works (assuming you have Unix). If inetd crashes Unix crashes so . see number 2 for reasons :) Of course, these ideas won't help much if you don't have a Unix variation or if you are really that tight on performance (although if you are I'd suggest hardware upgrades!). Good luck with your project, Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Tamar Pedersen Sent: Wednesday, January 16, 2019 1:06 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] How can stunnel use openssl HW cryptodev encryption Hello, I am evaluating stunnel, to see if it is a viable solution for providing encryption in a system that contains an Atmel processor which includes a HW accelerated encryption block. I am just ramping up on stunnel, and figured I should capture what I have done so far. My questions will come towards the end of my email. My research indicates that stunnel incorporates openssl. I have been able to use openssl independently, to access the cryptodev HW encryption engine, in the Linux kernel module located in /lib/modules/4.14.79/extra/cryptodev.ko. When openssl is run without accessing the cryptodev engine (cryptodev module not loaded), I get the pure SW encryption implementation provided by default in openssl. When I run bench mark speed tests using openssl, using SW encryption, I see the following results: # time -v openssl speed -evp aes-128-cbc Doing aes-128-cbc for 3s on 16 size blocks: 1689887 aes-128-cbc's in 2.95s Doing aes-128-cbc for 3s on 64 size blocks: 568389 aes-128-cbc's in 2.95s Doing aes-128-cbc for 3s on 256 size blocks: 151550 aes-128-cbc's in 2.96s Doing aes-128-cbc for 3s on 1024 size blocks: 38599 aes-128-cbc's in 2.96s Doing aes-128-cbc for 3s on 8192 size blocks: 4845 aes-128-cbc's in 2.95s OpenSSL 1.0.2p-fips 14 Aug 2018 built on: reproducible build, date unspecified options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr) compiler: arm-laird-linux-gnueabi-gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -I/home/sii/wb50n_space2_legacy_6.0.0.x/wb/buildroot/output/wb50n_space2_leg acy/host/arm-buildroot-linux-gnueabi/sysroot/usr/local/ssl/fips-2.0/include -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 9165.49k 12331.15k 13107.03k 13353.17k 13454.32k Command being timed: "openssl speed -evp aes-128-cbc" User time (seconds): 14.81 System time (seconds): 0.10 Percent of CPU this job got: 99% Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 15.06s Average shared text size (kbytes): 0 Average unshared data size (kbytes): 0 Average stack size (kbytes): 0 Average total size (kbytes): 0 Maximum resident set size (kbytes): 13376 Average resident set size (kbytes): 0 Major (requiring I/O) page faults: 0 Minor (reclaiming a frame) page faults: 145 Voluntary context switches: 0 Involuntary context switches: 721 Swaps: 0 File system inputs: 0 File system outputs: 0 Socket messages sent: 0 Socket messages received: 0 Signals delivered: 0 Page size (bytes): 4096 Exit status: 0 # When I load the cryptodev module, and take advantage of the accelerated hardware encryption the benchmark tests are significantly faster. Here is what those results look like. # modprobe cryptodev # time -v openssl speed -evp aes-128-cbc Doing aes-128-cbc for 3s on 16 size blocks: 44163 aes-128-cbc's in 0.12s Doing aes-128-cbc for 3s on 64 size blocks: 31345 aes-128-cbc's in 0.15s Doing aes-128-cbc for 3s on 256 size blocks: 18923 aes-128-cbc's in 0.11s Doing aes-128-cbc for 3s on 1024 size blocks: 13847 aes-128-cbc's in 0.13s Doing aes-128-cbc for 3s on 8192 size blocks: 8427 aes-128-cbc's in 0.06s OpenSSL 1.0.2p-fips 14 Aug 2018 built on: reproducible build, date unspecified options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr) compiler: arm-laird-linux-gnueabi-gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -I/home/sii/wb50n_space2_legacy_6.0.0.x/wb/buildroot/output/wb50n_space2_leg acy/host/arm-buildroot-linux-gnueabi/sysroot/usr/local/ssl/fips-2.0/include -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 5888.40k 13373.87k 44038.98k 109071.75k 1150566.40k Command being timed: "openssl speed -evp aes-128-cbc" User time (seconds): 0.59 System time (seconds): 8.72 Percent of CPU this job got: 61% Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 15.11s Average shared text size (kbytes): 0 Average unshared data size (kbytes): 0 Average stack size (kbytes): 0 Average total size (kbytes): 0 Maximum resident set size (kbytes): 13792 Average resident set size (kbytes): 0 Major (requiring I/O) page faults: 0 Minor (reclaiming a frame) page faults: 144 Voluntary context switches: 41154 Involuntary context switches: 3321 Swaps: 0 File system inputs: 0 File system outputs: 0 Socket messages sent: 0 Socket messages received: 0 Signals delivered: 0 Page size (bytes): 4096 Exit status: 0 # As can be seen in the results (hi-lighted in red), the average speed to do aes-128-cbc encryption jumped from around 2.95 s to 0.10 s. Also of interest is the context switches are significantly higher when running hardware encryption, because of interrupts and overhead to use the hardware engine. I can also look at /proc/interrupts and see significant increases in atmel-aes interrupt counts when using the cryptodev HW acceleration encryption engine. This gives a good indication that the cryptodev module is in use, and is doing encryption. I would like to try to figure out how to allow stunnel to take advantage of the cryptodev HW acceleration encryption engine available in openssl. I have made some attempts, but so far, I have not been able to determine if stunnel is successfully using the cryptodev engine. Here is what I have done with stunnel. I already have a client and server successfully communicating with each other using stunnel. To verify this I used the "nc" utility to send characters back and forth between two different machines. The stunnel.conf file, on the server, is out of the box. I'm interested in encrypting on the client side. Here is my current client.conf file, in /etc/stunnel: # cat client.conf debug = 7 output = /tmp/stunnel-server.log pid = /tmp/stunnel.pid engine = cryptodev [test] verify = 1 client = yes accept = 127.0.0.1:2000 connect = 192.168.0.220:30000 CAfile = /etc/stunnel/certificate.crt engineNum = 1 # I am attempting to set up the cryptodev to be the configured engine for the client. I am able to start stunnel, using client.conf, as follows: # stunnel /etc/stunnel/client.conf # If I do a "ps" command to display processes, I can see that stunnel is running in the background. At this point, I can use "nc" to send data, as follows: # nc 127.0.0.1 2000 < /tmp/long_file.txt I am able to see the text from long_file.txt on the server, which is also running nc. The problem is that I don't see interrupts increasing in /proc/interrupts, which leaves me wondering if I have not configured stunnel correctly to use the cryptodev engine. If I try to remove the cryptodev module as this point, while stunnel is running, I receive a message that it is in use, as follows: # modprobe -r cryptodev modprobe: FATAL: Module cryptodev is in use. # If I kill the stunnel process, I am able to successfully remove the cryptodev module, which seems to suggest stunnel is the process using the cryptodev module. Also, once I have removed the cryptodev module, I can't restart stunnel. Instead, I get the following errors back: # stunnel /etc/stunnel/client.conf [.] stunnel 5.44 on arm-buildroot-linux-gnueabi platform [.] Compiled/running with OpenSSL 1.0.2p-fips 14 Aug 2018 [.] Threading:FORK Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/client.conf [.] UTF-8 byte order mark not detected [ ] Enabling support for engine "cryptodev" [!] error queue: 2606A074: error:2606A074:engine routines:ENGINE_by_id:no such engine [!] error queue: 260B6084: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found [!] error queue: 25070067: error:25070067:DSO support routines:DSO_load:could not load the shared library [!] ENGINE_by_id: 25066067: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library [!] /etc/stunnel/client.conf:5: "engine = cryptodev": Failed to open the engine # Again, this suggests stunnel is trying to use cryptodev. I just don't know how to prove I am taking advantage of the HW encryption acceleration engine. I never see interrupts updating in /proc/interrupts when using nc, while stunnel is running. So, here are my questions: 1.) Does it look like I have things set up correctly in client.conf, to use the cryptodev engine? 2.) If client.conf is correct, how can I prove that stunnel is using the cryptodev engine, since I don't see the expected interrupts? One idea is that the cryptodev module might not support the type of encryption being requested by the certificate, so openssl falls back to the pure SW encryption implementation. I know the Atmel chip in question supports the following: # openssl engine -t -c (cryptodev) cryptodev engine [RSA, DSA, DH, DES-CBC, DES-EDE3-CBC, AES-128-CBC, AES-192-CBC, AES-256-CBC, MD5, SHA1, SHA256, SHA384, SHA512] [ available ] (dynamic) Dynamic engine loading support [ unavailable ] # I was able to decode the contents of the certificate, and it says it is sha256WithRSAEncryption. My engine supports SHA256 and RSA, but does it support combining, like SHA256WithRSA? I'm not sure. I'll keep chasing that one. Thanks for any guidance on how to use the cryptodev in stunnel. Regards, Tamar

2 2

Max Performance of Stunnel
by Luis Monteiro 21 Jan '19

21 Jan '19

I'm testing Stunnel with Ixia traffic generator (Breakingpoint Virtual Edition) and I got a limited performance of 3.5Gbps full duplex even with 6 or 9 cpu in the esxi vm. The processors are fully dedicated as well memory all reserved with passthrough od network cards intel x540 10Gbps, 2 ports. The 2 vm are similar with one running stunnel client and the other as stunnel server. The page performance of Stunnel of 5.5Gbps but doesn't inform if it's half or full since in the operation the stunnel has to deal with 2 flow coming and going. If it was 5.5Gbps total makes sense since I'm using 2 x Scalable Gold 6140 and gave me 7Gbps encryption + decryption with AES-NI I think since we are not a feasible solution to check on the fly only the overall performance. I'm using the same cipher suit of performance information of Stunnel. Does anyone know if the performance numbers is considering the total performance or full duplex? Does someone have any tip to improve the performance? Thanks, Luis Monteiro

1 0

Transparente destination
by Luis Monteiro 17 Jan '19

17 Jan '19

Sirs. I tested the stunnel client connect to a stunnel server to proxy transparent a http traffic. I used a traffic generator from Ixia (BPS), a tap to get the traffic between stunnel´s using ntop license pf_ring (Kernel bypass) with tcpdump accessing their libs and export pcaps from source and destination from Ixia. Transparent source worked flawless easily using the information on man page. Transparent destination didn´t worked. The instructions in the stunnel documentation for each are: /sbin/iptables -I INPUT -i client_interface -p tcp --dport 443 (I´m using default port os https) -j ACCEPT ----- It is filter INPUT that is executed after routing decision after nat to allow packets with destination port 443 /sbin/iptables -t nat -I PREROUTING -p tcp --dport 80 (Destination port of http in client_interface \ -i client_interface -j DNAT --to-destination 9.0.0.2:443 (connect destination on server Stunnel) The second input in iptables is executed before the routing decision and that is the problem. Looking the hit count of in iptables the nat table PREROUTING always have a hit but the filter table filter INPUT doesn´t. I set a policy routing to delivey packets to 9.0.0.2:443 to local process and the filter table filter INPUT started to receive the hit in the counters as well but stunnel didn´t worked. If I change the connect destination address to local interface 9.0.0.1:443 I do not need the pocily routing since it´s local but Stunnel did not worked too. The stunnel configuration for the client is bellow: #setgid = root #setuid = root debug = 7 log = overwrite syslog = no output = /root/stunnel.log ;engine = ENGINE_ID ;engineCtrl = COMMAND[:PARAMETER] ;engineDefault = TASK_LIST [http] client = yes accept = 6.0.0.1:80 ;connect = 9.0.0.2:443 ciphers = AES128-GCM-SHA256 requireCert = no sslVersion = TLSv1.2 transparent = destination At the end I´d like to use both source and destination but I´m testing separated. Does anyone know if there is a bug related or if there is a version working fine? Even with a lot o resource I don´t have more what to do about and any help would be appreciated. Luis Monteiro

1 0

How can stunnel use openssl HW cryptodev encryption
by Tamar Pedersen 16 Jan '19

16 Jan '19

Hello, I am evaluating stunnel, to see if it is a viable solution for providing encryption in a system that contains an Atmel processor which includes a HW accelerated encryption block. I am just ramping up on stunnel, and figured I should capture what I have done so far. My questions will come towards the end of my email. My research indicates that stunnel incorporates openssl. I have been able to use openssl independently, to access the cryptodev HW encryption engine, in the Linux kernel module located in /lib/modules/4.14.79/extra/cryptodev.ko. When openssl is run without accessing the cryptodev engine (cryptodev module not loaded), I get the pure SW encryption implementation provided by default in openssl. When I run bench mark speed tests using openssl, using SW encryption, I see the following results: # time -v openssl speed -evp aes-128-cbc Doing aes-128-cbc for 3s on 16 size blocks: 1689887 aes-128-cbc's in 2.95s Doing aes-128-cbc for 3s on 64 size blocks: 568389 aes-128-cbc's in 2.95s Doing aes-128-cbc for 3s on 256 size blocks: 151550 aes-128-cbc's in 2.96s Doing aes-128-cbc for 3s on 1024 size blocks: 38599 aes-128-cbc's in 2.96s Doing aes-128-cbc for 3s on 8192 size blocks: 4845 aes-128-cbc's in 2.95s OpenSSL 1.0.2p-fips 14 Aug 2018 built on: reproducible build, date unspecified options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr) compiler: arm-laird-linux-gnueabi-gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -I/home/sii/wb50n_space2_legacy_6.0.0.x/wb/buildroot/output/wb50n_space2_legacy/host/arm-buildroot-linux-gnueabi/sysroot/usr/local/ssl/fips-2.0/include -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 9165.49k 12331.15k 13107.03k 13353.17k 13454.32k Command being timed: "openssl speed -evp aes-128-cbc" User time (seconds): 14.81 System time (seconds): 0.10 Percent of CPU this job got: 99% Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 15.06s Average shared text size (kbytes): 0 Average unshared data size (kbytes): 0 Average stack size (kbytes): 0 Average total size (kbytes): 0 Maximum resident set size (kbytes): 13376 Average resident set size (kbytes): 0 Major (requiring I/O) page faults: 0 Minor (reclaiming a frame) page faults: 145 Voluntary context switches: 0 Involuntary context switches: 721 Swaps: 0 File system inputs: 0 File system outputs: 0 Socket messages sent: 0 Socket messages received: 0 Signals delivered: 0 Page size (bytes): 4096 Exit status: 0 # When I load the cryptodev module, and take advantage of the accelerated hardware encryption the benchmark tests are significantly faster. Here is what those results look like. # modprobe cryptodev # time -v openssl speed -evp aes-128-cbc Doing aes-128-cbc for 3s on 16 size blocks: 44163 aes-128-cbc's in 0.12s Doing aes-128-cbc for 3s on 64 size blocks: 31345 aes-128-cbc's in 0.15s Doing aes-128-cbc for 3s on 256 size blocks: 18923 aes-128-cbc's in 0.11s Doing aes-128-cbc for 3s on 1024 size blocks: 13847 aes-128-cbc's in 0.13s Doing aes-128-cbc for 3s on 8192 size blocks: 8427 aes-128-cbc's in 0.06s OpenSSL 1.0.2p-fips 14 Aug 2018 built on: reproducible build, date unspecified options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr) compiler: arm-laird-linux-gnueabi-gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -I/home/sii/wb50n_space2_legacy_6.0.0.x/wb/buildroot/output/wb50n_space2_legacy/host/arm-buildroot-linux-gnueabi/sysroot/usr/local/ssl/fips-2.0/include -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 5888.40k 13373.87k 44038.98k 109071.75k 1150566.40k Command being timed: "openssl speed -evp aes-128-cbc" User time (seconds): 0.59 System time (seconds): 8.72 Percent of CPU this job got: 61% Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 15.11s Average shared text size (kbytes): 0 Average unshared data size (kbytes): 0 Average stack size (kbytes): 0 Average total size (kbytes): 0 Maximum resident set size (kbytes): 13792 Average resident set size (kbytes): 0 Major (requiring I/O) page faults: 0 Minor (reclaiming a frame) page faults: 144 Voluntary context switches: 41154 Involuntary context switches: 3321 Swaps: 0 File system inputs: 0 File system outputs: 0 Socket messages sent: 0 Socket messages received: 0 Signals delivered: 0 Page size (bytes): 4096 Exit status: 0 # As can be seen in the results (hi-lighted in red), the average speed to do aes-128-cbc encryption jumped from around 2.95 s to 0.10 s. Also of interest is the context switches are significantly higher when running hardware encryption, because of interrupts and overhead to use the hardware engine. I can also look at /proc/interrupts and see significant increases in atmel-aes interrupt counts when using the cryptodev HW acceleration encryption engine. This gives a good indication that the cryptodev module is in use, and is doing encryption. I would like to try to figure out how to allow stunnel to take advantage of the cryptodev HW acceleration encryption engine available in openssl. I have made some attempts, but so far, I have not been able to determine if stunnel is successfully using the cryptodev engine. Here is what I have done with stunnel. I already have a client and server successfully communicating with each other using stunnel. To verify this I used the "nc" utility to send characters back and forth between two different machines. The stunnel.conf file, on the server, is out of the box. I'm interested in encrypting on the client side. Here is my current client.conf file, in /etc/stunnel: # cat client.conf debug = 7 output = /tmp/stunnel-server.log pid = /tmp/stunnel.pid engine = cryptodev [test] verify = 1 client = yes accept = 127.0.0.1:2000 connect = 192.168.0.220:30000 CAfile = /etc/stunnel/certificate.crt engineNum = 1 # I am attempting to set up the cryptodev to be the configured engine for the client. I am able to start stunnel, using client.conf, as follows: # stunnel /etc/stunnel/client.conf # If I do a "ps" command to display processes, I can see that stunnel is running in the background. At this point, I can use "nc" to send data, as follows: # nc 127.0.0.1 2000 < /tmp/long_file.txt I am able to see the text from long_file.txt on the server, which is also running nc. The problem is that I don't see interrupts increasing in /proc/interrupts, which leaves me wondering if I have not configured stunnel correctly to use the cryptodev engine. If I try to remove the cryptodev module as this point, while stunnel is running, I receive a message that it is in use, as follows: # modprobe -r cryptodev modprobe: FATAL: Module cryptodev is in use. # If I kill the stunnel process, I am able to successfully remove the cryptodev module, which seems to suggest stunnel is the process using the cryptodev module. Also, once I have removed the cryptodev module, I can't restart stunnel. Instead, I get the following errors back: # stunnel /etc/stunnel/client.conf [.] stunnel 5.44 on arm-buildroot-linux-gnueabi platform [.] Compiled/running with OpenSSL 1.0.2p-fips 14 Aug 2018 [.] Threading:FORK Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/client.conf [.] UTF-8 byte order mark not detected [ ] Enabling support for engine "cryptodev" [!] error queue: 2606A074: error:2606A074:engine routines:ENGINE_by_id:no such engine [!] error queue: 260B6084: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found [!] error queue: 25070067: error:25070067:DSO support routines:DSO_load:could not load the shared library [!] ENGINE_by_id: 25066067: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library [!] /etc/stunnel/client.conf:5: "engine = cryptodev": Failed to open the engine # Again, this suggests stunnel is trying to use cryptodev. I just don't know how to prove I am taking advantage of the HW encryption acceleration engine. I never see interrupts updating in /proc/interrupts when using nc, while stunnel is running. So, here are my questions: 1.) Does it look like I have things set up correctly in client.conf, to use the cryptodev engine? 2.) If client.conf is correct, how can I prove that stunnel is using the cryptodev engine, since I don't see the expected interrupts? One idea is that the cryptodev module might not support the type of encryption being requested by the certificate, so openssl falls back to the pure SW encryption implementation. I know the Atmel chip in question supports the following: # openssl engine -t -c (cryptodev) cryptodev engine [RSA, DSA, DH, DES-CBC, DES-EDE3-CBC, AES-128-CBC, AES-192-CBC, AES-256-CBC, MD5, SHA1, SHA256, SHA384, SHA512] [ available ] (dynamic) Dynamic engine loading support [ unavailable ] # I was able to decode the contents of the certificate, and it says it is sha256WithRSAEncryption. My engine supports SHA256 and RSA, but does it support combining, like SHA256WithRSA? I'm not sure. I'll keep chasing that one. Thanks for any guidance on how to use the cryptodev in stunnel. Regards, Tamar

1 0

Stunnel in transparent mode
by Luis Monteiro 15 Jan '19

15 Jan '19

Hi fellows. I´m from Brazil and I´m trying to use Stunnel as a TLS proxy in a bed test environment. I´m using a traffic generator from Ixia (Breakingpoint). The bed test is: |-------------------| 6.0.0.1 |-------------------|9.0.0.1 9.0.0.2|--------------------|7.0.0.2 |--------------------| | Client 6.0.0.2 |>>>>>>>>>>>>| Stunnel Client|>>>>>>>>>>>>>>>>>>| Stunnel Server|>>>>>>>>>>>>>>>>>> | Server 7.0.0.2 | |-------------------| ens224 |-------------------|ens192 ens224|--------------------|ens192 |--------------------| I´m capturing the packets in all 3 points so I can see exactly what is happening. I tested without transparent proxy and worked fine. I test with transparent = source with the additional conf bellow in both Stunnel and worked fine as well. iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 0 >/proc/sys/net/ipv4/conf/lo/rp_filter iptables -t nat -A PREROUTING -i ens224 -p tcp --dport 80 -j DNAT --to-destination 6.0.0.1:8080 I tested transparent = destination with several modification from the config bellow without success. No conf delivery packets with 7.0.0.2:443 on the Stunnel Client ens192 via 9.0.0.1 to be accept on Stunnel server 9.0.0.2:443. /sbin/iptables -I INPUT -i ens192 -p tcp --dport 8080 -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport 443 \ -i ens192 -j DNAT --to-destination 9.0.0.1:443 Any help to show me what is wrong would be appreciated. Thanks in advanced, Luis Monteiro

1 0

Re: [stunnel-users] No more addresses to connect
by Eric Eberhard 14 Jan '19

14 Jan '19

Could be the versions of communication are different – from SSLv3 to TLS1.3 … Having said that, there is NO REASON to use stunnel and a VPN – both encrypt data. You only need to encrypt it once … so I’d change your software to behave differently via VPN or not. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Ben Habel Sent: Monday, January 07, 2019 7:32 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] No more addresses to connect I am trying to implement an openvpn + stunnel vpn with a Linux host server and a windows client, i have everything connecting when alone but when I connect openvpn over Stunnel i get and error that says: 2019.01.07 21:18:50 LOG5[0]: Service [openvpn] accepted connection from 127.0.0.1:49343 <http://127.0.0.1:49343> 2019.01.07 21:19:15 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2019.01.07 21:19:20 LOG5[2]: Service [openvpn] accepted connection from 127.0.0.1:49380 <http://127.0.0.1:49380> 2019.01.07 21:19:30 LOG3[2]: s_connect: s_poll_wait 74.215.118.189:1194 <http://74.215.118.189:1194> : TIMEOUTconnect exceeded 2019.01.07 21:19:30 LOG3[2]: No more addresses to connect And this error will loop until I disable the openvpn connection. Any help would be appreciated. Thanks

2 1

Re: [stunnel-users] older browsers, stunnel and privoxy
by Eric Eberhard 14 Jan '19

14 Jan '19

Sure it can. Inetd is simply a "server" and stunnel works in inetd mode or server mode. When not using inetd, stunnel does the server work. When using inetd then inetd does the server work. In both cases the actual "instance" of stunnel is the same. And inetd always works (or essentially Unix does not). It is milliseconds slower in inetd (and unless you are doing millions of connections nobody will notice) but way more reliable in my experience. Eric -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Peter Pentchev Sent: Friday, January 04, 2019 8:06 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy On Thu, Jan 03, 2019 at 02:45:30PM -0700, Eric Eberhard wrote: > Observation: you accept on port 80 ... the log says 4121 ... any > chance you have some sort of port forwarding/NAT/firewall/router issue? Just for the record (I already answered the question in another message), the log says that the client - the program that was talking to stunnel, presumably some kind of web browser - connected *to* stunnel *from* the (ephemeral) port 4121. > Second -- if you are on Unix why not just use inetd? Easy, reliable, > simple, always works (if inetd goes down you have no Unix). And you > have nothing to manage -- just logs to look at. The inetd and stunnel tools serve different purposes - inetd cannot, by itself, proxy between a plaintext and a TLS/SSL connection. > Happy New Year > > Eric Same! G'luck, Peter > -----Original Message----- > From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On > Behalf Of kovacs janos > Sent: Saturday, December 29, 2018 7:37 PM > To: Javier <jamilist.stn(a)gmx.es> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] older browsers, stunnel and privoxy > > it still doesnt seem to work. i tried it with deviantart.com again. > configuration: > client = yes > accept = 127.0.0.1:80 > connect = 52.85.220.247:443 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = *.deviantart.com > > the name after checkHost is the "Common Name" displayed when viewing the site's certificate in a browser(lock icon, view certificate). i also saved the certificate in case i would need to try the "certificate pinning" method. the connect IP is what 'get-site-ip.com' > says the IP of the website is. > > these are the logs: > Service [fbsd-www] accepted connection from 127.0.0.1:4121 > s_connect: connected 52.85.220.247:443 Service [fbsd-www] connected > remote server from 192.168.0.3:4122 > SSL_connect: 14077410: error:14077410:SSL > routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure > Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket > > i know i pestered everyone long enough, but i still havent been able > to connect to anything. without any verification its the same > > On 12/21/18, Javier <jamilist.stn(a)gmx.es> wrote: > > On Fri, 21 Dec 2018 13:58:35 +0200 > > Peter Pentchev <roam(a)ringlet.net> wrote: > > > >> Hm, there's no reason why stunnel would not work like that for a > >> predetermined set of hosts with known addresses. > > > > Hi, > > > > I'm just trying to avoid encouraging him on keep with his first idea > > of browsing through Stunnel, with, or without privoxy. > > > > Of course one site, one connection would work, if we forget about > > secondary issues and..., nevermind... > > > > I give up :D > > > > Regards. > > > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users -- -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Could stunnel encryption be responsible for rendering the year as "4019" instead of "2019"?
by Al Birchall 09 Jan '19

09 Jan '19

Hi All, This may be stupid question, but I'll pose it anyway! We use stunnel to encrypt communications between library self-service kiosks and a cloud-based library system. Since switching to this cloud-based library system, the self-service kiosks have been rendering the year in item due dates as "4019" instead of "2019" printed and emailed patron library account statements. Items will actually have been checked out to the correct due date in library system, with the year displayed correctly, which library staff and patrons can see is so when they access the system directly. We have fixed the problem with a work-around by configuring the kiosk software to only display the last two digits of the year. So could it be the stunnel encryption algorithms that are causing "2019" to display as "4019"? Many thanks! Alex Alex Birchall Library Systems Manager The Sheppard Library Middlesex University London NW4 4BT UK Tel: +44 (0)20 8411 5235 Mob: 07765 237 570

2 1

Internal Errors
by _ Ånüßås _ 08 Jan '19

08 Jan '19

Hello, I would like to report two bugs. I recently upgraded to stunnel 5.50 on FreeBSD 12.0 and noticed that the stunnel server service now crashes periodically. When checking the logs after a crash, I see the following error: INTERNAL ERROR: Dead canary at /usr/src/crypto/openssl/ssl/statem/extensions_sr The stunnel server service only ever talks to a stunnel client service, also running version 5.50 on FreeBSD 12.0. The server configuration is as follows. Anything in {} brackets has been redacted. I have seen this issue on multiple servers configured the same way. <config> client = no setuid = stunnel setgid = stunnel pid = {/path/to/file} output = {/path/to/file} debug = 4 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [server] accept = {ip}:{port} connect = {ip}:{port} ciphers = PSK PSKsecrets = {/path/to/file} </config> Additionally, I have noticed another error in the logs. Although it appears far more frequently than the error above, it does not seem to cause the server service to crash. INTERNAL ERROR: Double free attempt: ptr=0x802119050 alloc=/usr/src/crypto/openssl/crypto/stack/stack.c:198 free#1=/usr/src/crypto/openssl/crypto/stack/stack.c:376 free#2=/usr/src/crypto/openssl/ssl/ssl_sess.c:814 Please let me know if additional information is needed to fix these bugs. Thank you.

1 0

No more addresses to connect
by Ben Habel 08 Jan '19

08 Jan '19

I am trying to implement an openvpn + stunnel vpn with a Linux host server and a windows client, i have everything connecting when alone but when I connect openvpn over Stunnel i get and error that says: 2019.01.07 21:18:50 LOG5[0]: Service [openvpn] accepted connection from 127.0.0.1:49343 2019.01.07 21:19:15 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2019.01.07 21:19:20 LOG5[2]: Service [openvpn] accepted connection from 127.0.0.1:49380 2019.01.07 21:19:30 LOG3[2]: s_connect: s_poll_wait xx.xxx.xxx.xxx:1194: TIMEOUTconnect exceeded 2019.01.07 21:19:30 LOG3[2]: No more addresses to connect And this error will loop until I disable the openvpn connection. Any help would be appreciated. Thanks

2 1

Need help to confi Stunnel
by Larry Alba 08 Jan '19

08 Jan '19

I need help to configure Stunnel to work again for my Secure Email being sent by my NoteSmith software thru Aplus.net mail server. I am: larryalba(a)yahoo.com Sent from Yahoo Mail on Android

1 0

ssl3_get_record:wrong version number
by Moellers 07 Jan '19

07 Jan '19

Hello, what I´m trying to accomplish is to build a secure RDP Connection between my Laptop and a Server, which are in the same Network but as RDP in itself is not secure enough I need the stunnel encryption. As of now I can establish a connection but as soon as I try to start an RDP Connection I get the following message: SSL_accept: 1408F10B: error:1408F10B:SSL routines:ssl3_get_record:wrong version number I tried serveral things for example: sslVersion = all options = NO_SSLv2 Sadly this doesn´t work either as I get a different error after that. This is pretty much the config for both Server and Client. ; R.B. Konfiguration HMailServer InvNr. 4522 RDP Zugriff mit STunnel-Verschlüsselung [RDP-SSL] CAfile = certs.pem accept = 9000 connect = 3389 ;verify = 4 verifyPeer = yes verifyChain = no sslVersion = all cert = stunnel.pem I exchanged the certificates between the Server and the Laptop but can´t establish a connection to get a RDP Session going. Hope someone can help me. Kind regards. F.Moellers Mit freundlichen Grüßen IT-Abteilung Jugendhilfe Köln e.V. Christianstr. 82 50825 Köln Tel. (0221) 54600-177 <mailto:it@jugendhilfe-koeln.de> it(a)jugendhilfe-koeln.de <http://www.jugendhilfe-koeln.de> www.jugendhilfe-koeln.de Geschäftsführerin: Almut Gross - Amtsgericht Köln VR 7348 Vorstandsvorsitzende: Dr. Agnes Klein

2 1

Re: [stunnel-users] older browsers, stunnel and privoxy
by Eric Eberhard 04 Jan '19

04 Jan '19

Observation: you accept on port 80 ... the log says 4121 ... any chance you have some sort of port forwarding/NAT/firewall/router issue? Second -- if you are on Unix why not just use inetd? Easy, reliable, simple, always works (if inetd goes down you have no Unix). And you have nothing to manage -- just logs to look at. Happy New Year Eric -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of kovacs janos Sent: Saturday, December 29, 2018 7:37 PM To: Javier <jamilist.stn(a)gmx.es> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy it still doesnt seem to work. i tried it with deviantart.com again. configuration: client = yes accept = 127.0.0.1:80 connect = 52.85.220.247:443 verifyChain = yes CAfile = ca-certs.pem checkHost = *.deviantart.com the name after checkHost is the "Common Name" displayed when viewing the site's certificate in a browser(lock icon, view certificate). i also saved the certificate in case i would need to try the "certificate pinning" method. the connect IP is what 'get-site-ip.com' says the IP of the website is. these are the logs: Service [fbsd-www] accepted connection from 127.0.0.1:4121 s_connect: connected 52.85.220.247:443 Service [fbsd-www] connected remote server from 192.168.0.3:4122 SSL_connect: 14077410: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket i know i pestered everyone long enough, but i still havent been able to connect to anything. without any verification its the same On 12/21/18, Javier <jamilist.stn(a)gmx.es> wrote: > On Fri, 21 Dec 2018 13:58:35 +0200 > Peter Pentchev <roam(a)ringlet.net> wrote: > >> Hm, there's no reason why stunnel would not work like that for a >> predetermined set of hosts with known addresses. > > Hi, > > I'm just trying to avoid encouraging him on keep with his first idea > of browsing through Stunnel, with, or without privoxy. > > Of course one site, one connection would work, if we forget about > secondary issues and..., nevermind... > > I give up :D > > Regards. > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

stunnel not working properly on Redhat linux (fresh install)
by Klaus Kloeser 04 Jan '19

04 Jan '19

Hi, I have set up Stunnel as SSL Wrapper for googlemail on a Redhat Enterprise Linux 7.2 installation. The stunnel.conf: output = /var/log/stunnel.log cert = /etc/pki/tls/certs/2019stunnel.pem client = yes sslVersion = TLSv1 ;fips=no [ssmtp] accept = 1925 connect=smtp.googlemail.com:587 lets me start stunned well. I have created the file 2019stunnel.pem following the Instructions on Redhat: make 2019stunnel.pem in the correct directory (certs) now I tried to telnet localhost 1925; I get a “connected”, but nothing more. telnet smtp.googlemail 587 runs very well, I get connected, so I assume it is not a firewall issue. I checked the options sslVersion = TLSv1 and sslVersion = all alternatively, which led to different errors in stunnel.log: Service [ssmtp] accepted connection from 127.0.0.1:49723 2019.01.04 14:45:01 LOG3[4500:140416608397056]: connect_blocking: connect 2a00:1450:400c:c0c::10:587: Network is unreachable (101) 2019.01.04 14:45:01 LOG5[4500:140416608397056]: connect_blocking: connected 74.125.140.16:587 2019.01.04 14:45:01 LOG5[4500:140416608397056]: Service [ssmtp] connected remote server from 192.168.178.57:44246 2019.01.04 14:45:01 LOG3[4500:140416608397056]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2019.01.04 14:45:01 LOG5[4500:140416608397056]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.01.04 14:54:24 LOG5[4500:140416608249920]: Terminated or Service [ssmtp] accepted connection from 192.168.178.57:57612 2019.01.04 14:54:36 LOG5[7437:139957105055488]: connect_blocking: connected 173.194.76.16:587 2019.01.04 14:54:36 LOG5[7437:139957105055488]: Service [ssmtp] connected remote server from 192.168.178.57:52192 2019.01.04 14:54:36 LOG3[7437:139957105055488]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2019.01.04 14:54:36 LOG5[7437:139957105055488]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Now Open SSL: Openssl output: openssl s_client -connect localhost:1925 CONNECTED(00000003) write:errno=104 no peer certificate available No client certificate CA names sent SSL handshake has read 0 bytes and written 289 bytes New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1546610402 Timeout : 300 (sec) Verify return code: 0 (ok) What do I miss here; what is running wrong ? Mit freundlichen Grüßen/ best regards Klaus Klöser

2 1

(no subject)
by Guido 30 Dec '18

30 Dec '18

Gesendet von Mail für Windows 10

1 0

(no subject)
by Guido 30 Dec '18

30 Dec '18

Gesendet von Mail für Windows 10

1 0

sslv3 alert bad certificate
by marko 26 Dec '18

26 Dec '18

Hello all, I'm using xmas for something useful - i.e. to configure a new server. After an install of stunnel 5.50 and generating the .pem and .key files with: openssl req -new -x509 -nodes -out /usr/local/etc/stunnel/nw_stunnel.pem -keyout /usr/local/etc/stunnel/nw_stunnel.key -days 1825 using this settings in the stunnel.conf: cert = /usr/local/etc/stunnel/nw_stunnel.pem key = /usr/local/etc/stunnel/nw_stunnel.key options = -NO_SSLv3 sslVersion = all I got LOG5[0]: Service [imaps] accepted connection from 192.168.1.3:64233 Dec LOG3[0]: SSL_accept: 14094412: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Just wondering: this is a self issued CA-Cert. Does the bad certificate error refer to the unsafe ssl3-standard or is it a placeholder for the certificate being self-generated as well? I'm currentlty on [.] stunnel 5.50 on amd64-portbld-freebsd12.0 platform [.] Compiled/running with OpenSSL 1.1.1a-freebsd 20 Nov 2018 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI This configuration works with the same install procedure: [.] stunnel 5.49 on i386-portbld-freebsd11.2 platform [.] Compiled/running with OpenSSL 1.0.2o-freebsd 27 Mar 2018 [.] Threading:PTHREAD Sockets:POLL,IPv4 TLS:ENGINE,OCSP,PSK,SNI Any insights into this matter are highly welcome. Cheers, and merry youknowwhat, Marko

1 0

win32 support
by Vida Bence 20 Dec '18

20 Dec '18

Hi Everyone! Is there any option to use s-tunnel on win32? I can see only win64 download links on the front page. Sorry if this is a blatant question, I am a totally new user. Thank you for the replies! All the best Bence

3 2

stunnel log size
by Joe Phillips 13 Dec '18

13 Dec '18

My stunnel log continues to grow. Will it truncate automatically? How do I restrict its size?

2 1

How to configure STunnel to use cert. from certificate store
by Chicoine, Jonathan 12 Dec '18

12 Dec '18

How in the word you specify the certificate to use from the windows certificate store (for example, on Windows 10 or Windows Server 2012)? The documentation obviously says to use the "cert" config option to specify a file (and the "key" config option for the private key) ... but to use a cert from the windows certificate store, shouldn't it be the certs "common name" field or thumbprint ... or something. Am new to this whole thing and have been googling for the answer for days. Any help would be greatly appreciated. -jonathan

2 1

stunnel 5.50 on Solaris 10
by Udo Erdelhoff 12 Dec '18

12 Dec '18

Hi, quick heads-up to anybody building/using stunnel 5.50 on Solaris 10 and wondering where the "Invalid configuration file name" errors are coming from: The problem is the call to realpath in line 334 of options.c, it uses NULL as second argument as a request to have the realpath function allocate the memory buffer for the sanitized string. This variant of realpath is not supported on Solaris 10, and leads to EINVAL (error code 22). Quickest fix is to run configure and then manually change src/config.h to have /* #undef HAVE_REALPATH */ instead of #define HAVE_REALPATH 1 -- "Treason is a charge invented by winners as an excuse for hanging the losers." - Benjamin Franklin, ca. 1776

1 0

Support for multiple root CAs
by Tom Bentley 07 Dec '18

07 Dec '18

Hi, I'm using stunnel to secure communication between nodes in a cluster, using a self-signed CA to sign the server certs and the `verify = 2` config parameter. This works great. What I want to be able to do is replace the CA key and certificate without breaking the cluster. How I thought this should work would be: 1. Configure the stunnels to trust both the old and new CA certificates while the nodes continued to use server certificates signed by the old CA key. 2. Switch to using using server certifcates signed by the new CA key. 3. Finally remove trust in the old CA certificate. I'd tried this by putting both CA certificates in a single file and using `CAfile` config parameter, and also by using the `CApath` config parameter with both root CA certificates in the configured directory, but I've not been able to get this to work while keeping `verify = 2`. It does work if I temporary use `verify = 0`, but obviously that means I've not got TLS authentication duration the duration of the process. Can anyone confirm whether stunnel supports this use case, and if so suggest where I might be going wrong? Many thanks, Tom

1 0

Re: [stunnel-users] older browsers, stunnel and privoxy (kovacs janos) - stunnel-users Digest, Vol 173, Issue 7
by Thomas GMX 07 Dec '18

07 Dec '18

Hi Janos, mail (SMTP / POP / IMAP) are other protocols as HTTPS. I was not able to connect via sTunnel to a server via HTTPS - and this was the reason to create and use my HTTPSProxy. HTTPSProxy is based on this code (local front- and rear proxy are connected directly without Proxomitron): https://prxbx.com/forums/showthread.php?tid=2172 https://prxbx.com/forums/showthread.php?tid=2191&pid=19252#pid19252 You can build your own release with python if you do not trust the versions offered by me or HeinoGanda on MSFN. Regards Thomas S. -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Friday, December 07, 2018 12:00 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 173, Issue 7 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: older browsers, stunnel and privoxy (kovacs janos) ---------------------------------------------------------------------- Message: 1 Date: Fri, 7 Dec 2018 01:30:21 +0100 From: kovacs janos <kovacsjanosfasz(a)gmail.com> To: Flo Rance <trourance(a)gmail.com> Cc: zizazit(a)protonmail.com, stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAOchpkp+5YDig_XpWPFVdP9zQ-L2UN10p8Wzsm9ggv2iuWpU8Q(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" now im really not sure, since the wikipedia page on stunnel also describes the program doing exactly what i need in the Example scenario section: https://en.wikipedia.org/wiki/Stunnel#Example_scenario "Network traffic from the client initially passes over SSL to the stunnel application, which transparently encrypts/decrypts traffic and forwards unsecured traffic to port 25 locally. The mail server sees a non-SSL mail client. " only difference is, i need it to forward "unsecured traffic" to my browser client, not a server. are you all sure its really not possible? On 12/5/18, kovacs janos <kovacsjanosfasz(a)gmail.com> wrote: > thank you for suggestions, but can someone tell me in what cases > stunnel can be used? > i can connect to http websites through it, but https doesnt work, even > if it would otherwise do. > i try to connect to 'https://via.hypothes.is/' like this, which i can > access in browser without any proxy: > [Tunnel_in] > client = yes > accept = 127.0.0.1:443 > connect = via.hypothes.is:443 > > i get these logs: > LOG5[1]: Service [Tunnel_in] accepted connection from 127.0.0.1:1788 > LOG5[1]: s_connect: connected 104.20.214.15:443 > LOG5[1]: Service [Tunnel_in] connected remote server from 192.168.0.3:1789 > LOG5[1]: Connection closed: 197 byte(s) sent to TLS, 332 byte(s) sent to > socket > > and the browser just shows a 'server not found' error. > with http sites its the same logs except the IP and bytes, and it > loads in the browser. > > On 12/5/18, Flo Rance <trourance(a)gmail.com> wrote: >> I would recommend to use squid which is able to do SSL bump. >> >> https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit >> >> Therefore, you'll be able to connect with TLS1.0 to squid and the proxy >> will establish a TLSv1.2 to the final destination. >> >> Regards, >> Flo >> >> On Tue, Dec 4, 2018 at 9:38 PM kovacs janos <kovacsjanosfasz(a)gmail.com> >> wrote: >> >>> well, what i meant is forwarding to the current address the browser >>> connects to, so basically browsing through stunnel. >>> >>> is it really that complicated to achieve that? if i configure stunnel >>> as a client, and make the browser send traffic to the accept address, >>> shouldnt stunnel encrypt the traffic with TLS and send forward to the >>> connect address? if thats true, shouldnt it also decrypt returning >>> traffic and send back to the browser? >>> when i configured stunnel as both client and server on the same >>> computer, it worked, but the browser still gave >>> 'ssl_error_no_cypher_overlap' errors. probably because the server side >>> decrypted it again before it reached the website's server? >>> >>> i dont necessarily need it to strip encryption, just use anything >>> below TLS 1.1. for example on 'https://via.hypothes.is/' i can visit >>> sites that would otherwise give cypher error, and they stay as https >>> >>> On 12/4/18, Zizhong Zhang <zizazit(a)protonmail.com> wrote: >>> > Hello, >>> > >>> >> im trying to make older browsers be able to display TLS 1.1 and TLS >>> >> 1.2 >>> >> sites. >>> >> i heard stunnel cant be configured to always forward to the current >>> >> site address dynamically, thats why i would use privoxy. >>> > >>> > If by "forward to the current site address dynamically" you meant >>> "forward >>> > to the current address of one specific domain" then stunnel can >>> > achieve >>> that >>> > by adding "delay = yes". >>> > >>> > However, if I understood correctly, you wanted to let stunnel strip >>> > or remove SSL for whatever sites you visit. Then no, I don't think you >>> can >>> > achieve that with privoxy and stunnel. If that's what you want, I >>> > would >>> > suggest you use nginx to remove SSL. The following example >>> > configuration >>> > will let nginx "upgrade" your HTTP request to HTTPS. >>> > >>> > events {} http { server { >>> > resolver 9.9.9.9; >>> > listen 80; >>> > location / { >>> > proxy_pass https://$host$request_uri; >>> > proxy_set_header Host $http_host; >>> > } >>> > }} >>> > >>> > You can then point any domain to the nginx server (for example, via >>> > the >>> > hosts file) and visit the site via HTTP. This will make HTTPS-oly >>> > servers >>> > happy. >>> > >>> > That won't strip third-party HTTPS:// URL resources like NewIPNow >>> > does, >>> but >>> > you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. >>> Also >>> > there are "security features" like "Content-Security-Policy" that >>> > prevent >>> > modern browsers from visiting your SSL-stripped sites, but I believe >>> > your >>> > out-dated browser will happily ignore those. >>> > >>> > --Zizhong >>> > >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >> > ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 173, Issue 7 *********************************************

1 0

Re: [stunnel-users] older browsers with modern HTTPS - stunnel-users Digest, Vol 173, Issue 4
by Thomas GMX 05 Dec '18

05 Dec '18

Hi Janos, you can use a local proxy to "translate" HTTPS TLS1.0 to TLS1.2 Look here: https://msfn.org/board/topic/176344-problems-accessing-certain-sites-https-… HTTPSProxy (and tools) manage the whole traffic locally (in- and outgoing HTTPS), but needs manually configuration as described in the help files. If you have questions please ask in this forum. Regards Thomas S. -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 05, 2018 10:12 AM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 173, Issue 4 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: older browsers, stunnel and privoxy (kovacs janos) 2. Re: older browsers, stunnel and privoxy (Zizhong Zhang) 3. Re: older browsers, stunnel and privoxy (kovacs janos) 4. Re: older browsers, stunnel and privoxy (Flo Rance) ---------------------------------------------------------------------- Message: 1 Date: Tue, 4 Dec 2018 19:27:15 +0100 From: kovacs janos <kovacsjanosfasz(a)gmail.com> To: Flo Rance <trourance(a)gmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAOchpkrOTmoAgCpv4fK19NhZeP-5-JgjX3EASFcfQbMVydR2yA(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" well yes, im pretty sure the same encryption is needed in requests and the returned page, otherwise it would probably get a no cypher overlap error. so i basically need stunnel to encrypt outgoing requests, and decrypt the returned things and only on the browser side of connection. there's a good reason why they are deprecated, but it would be better to add this functionality this way if possible, rather than change whole programs, especially when its the purpose of stunnel, according to the description On 12/4/18, Flo Rance <trourance(a)gmail.com> wrote: > This is not what I've understood from your first description. You would > like to bridge TLSv1 to TLSv1.1 or TLSv1.2 before sending requests to a web > proxy. > > This is why I don't think stunnel is intended for that. > > That said, if SSLV3 and TLSv1 have been deprecated, there's a good reason > and you should seriously think to update your tools. > > Regards, > Flo > > On Tue, Dec 4, 2018 at 3:18 PM kovacs janos <kovacsjanosfasz(a)gmail.com> > wrote: > >> well, it says this on the first line of the website: >> "Stunnel is a proxy designed to add TLS encryption functionality to >> existing clients and servers without any changes in the programs' >> code." >> >> i just want to add TLS functionality to client browsers which dont >> have it. i only need stunnel to decrypt TLS traffic going back to the >> browser. >> >> On 12/4/18, Flo Rance <trourance(a)gmail.com> wrote: >> > Sorry I didn't read it correctly. I don't think this is something >> > stunnel >> > can handle. >> > >> > Regards, >> > Flo >> > >> > On Mon, Dec 3, 2018 at 9:31 PM kovacs janos <kovacsjanosfasz(a)gmail.com> >> > wrote: >> > >> >> thank you for the reply, >> >> its the address and port where privoxy listens for requests. >> >> from the config file: >> >> "# 4.1. listen-address >> >> # ==================== >> >> # >> >> # Specifies: >> >> # >> >> # The IP address and TCP port on which Privoxy will listen for >> >> # client requests." >> >> and under it: >> >> >> >> listen-address 127.0.0.1:8118 >> >> >> >> On 12/3/18, Flo Rance <trourance(a)gmail.com> wrote: >> >> > Hi, >> >> > >> >> > It's not clear in your description what is running on 8118 local >> >> > port. >> >> > >> >> > Regards, >> >> > Flo >> >> > >> >> > On Mon, Dec 3, 2018 at 2:40 PM kovacs janos < >> kovacsjanosfasz(a)gmail.com> >> >> > wrote: >> >> > >> >> >> sorry to bother, >> >> >> im trying to make older browsers be able to display TLS 1.1 and TLS >> >> >> 1.2 >> >> >> sites. >> >> >> i heard stunnel cant be configured to always forward to the current >> >> >> site address dynamically, thats why i would use privoxy. >> >> >> the browser is configured to send to: >> >> >> 127.0.0.1 443 >> >> >> >> >> >> stunnel config has this at the end: >> >> >> [Tunnel_in] >> >> >> client = yes >> >> >> accept = 127.0.0.1:443 >> >> >> connect = 127.0.0.1:8118 >> >> >> verifyChain = yes >> >> >> CAfile = ca-certs.pem >> >> >> checkHost = localhost >> >> >> >> >> >> 127.0.0.1:8118 is the privoxy address. >> >> >> this is what stunnel writes: >> >> >> LOG5[main]: Configuration successful >> >> >> LOG5[0]: Service [Tunnel_in] accepted connection from >> >> >> 127.0.0.1:3261 >> >> >> LOG5[0]: s_connect: connected 127.0.0.1:8118 >> >> >> LOG5[0]: Service [Tunnel_in] connected remote server from >> >> 127.0.0.1:3262 >> >> >> >> >> >> and the browser infinitely loads, and never loads anything or >> >> >> leaves >> >> >> the >> >> >> page. >> >> >> if i remove the last 3 lines, its the same just with this line >> >> >> added: >> >> >> LOG4[main]: Service [Tunnel_in] needs authentication to prevent >> >> >> MITM >> >> >> attacks >> >> >> >> >> >> but it doesnt give an error or anything. >> >> >> >> >> >> with a configuration like: >> >> >> [Tunnel_out] >> >> >> client = no >> >> >> accept = 127.0.0.1:443 >> >> >> connect = 127.0.0.1:8118 >> >> >> cert = stunnel.pem >> >> >> >> >> >> this is what it gives: >> >> >> LOG5[3]: Service [Tunnel_out] accepted connection from >> 127.0.0.1:3294 >> >> >> LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL >> >> >> routines:SSL23_GET_CLIENT_HELLO:https proxy request >> >> >> LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to >> >> >> socket >> >> >> >> >> >> and browser gives a server not found error immediately. im not even >> >> >> sure if i should use client or server configuration in a case like >> >> >> this, but none of them works anyway. all i would need is for my >> >> >> browser to get the pages decrypted, or at least in less than >> >> >> TLS1.1. >> >> >> like how on newipnow.com i can access sites with any encryption, >> since >> >> >> they are sent to the browser without encryption. the browser just >> >> >> gives an "unencrypted tunnel" warning, which is how i found >> >> >> stunnel, >> >> >> and which is exactly what i need, just locally. >> >> >> _______________________________________________ >> >> >> stunnel-users mailing list >> >> >> stunnel-users(a)stunnel.org >> >> >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> >> >> >> > >> >> >> > >> > ------------------------------ Message: 2 Date: Tue, 04 Dec 2018 19:16:53 +0000 From: Zizhong Zhang <zizazit(a)protonmail.com> To: kovacs janos <kovacsjanosfasz(a)gmail.com> Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <mSx8WOjppmpWbvW5ETuPUXO048xh4PcPTtZPpOpzkrecueeSUtjQQx13FhtLO24lkyNXRPe_lNpMV8ko6RMEvowOx7mg6rl_1hwj43QAxWw=(a)protonmail.com> Content-Type: text/plain; charset=UTF-8 Hello, > im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. > i heard stunnel cant be configured to always forward to the current > site address dynamically, thats why i would use privoxy. If by "forward to the current site address dynamically" you meant "forward to the current address of one specific domain" then stunnel can achieve that by adding "delay = yes". However, if I understood correctly, you wanted to let stunnel strip or remove SSL for whatever sites you visit. Then no, I don't think you can achieve that with privoxy and stunnel. If that's what you want, I would suggest you use nginx to remove SSL. The following example configuration will let nginx "upgrade" your HTTP request to HTTPS. events {} http { server { resolver 9.9.9.9; listen 80; location / { proxy_pass https://$host$request_uri; proxy_set_header Host $http_host; } }} You can then point any domain to the nginx server (for example, via the hosts file) and visit the site via HTTP. This will make HTTPS-oly servers happy. That won't strip third-party HTTPS:// URL resources like NewIPNow does, but you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. Also there are "security features" like "Content-Security-Policy" that prevent modern browsers from visiting your SSL-stripped sites, but I believe your out-dated browser will happily ignore those. --Zizhong ------------------------------ Message: 3 Date: Tue, 4 Dec 2018 21:37:53 +0100 From: kovacs janos <kovacsjanosfasz(a)gmail.com> To: Zizhong Zhang <zizazit(a)protonmail.com> Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAOchpkq7vG8vHBCrbVn6d4Eh7M2rd6jEob_huhoG=ZefJnpHLw(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" well, what i meant is forwarding to the current address the browser connects to, so basically browsing through stunnel. is it really that complicated to achieve that? if i configure stunnel as a client, and make the browser send traffic to the accept address, shouldnt stunnel encrypt the traffic with TLS and send forward to the connect address? if thats true, shouldnt it also decrypt returning traffic and send back to the browser? when i configured stunnel as both client and server on the same computer, it worked, but the browser still gave 'ssl_error_no_cypher_overlap' errors. probably because the server side decrypted it again before it reached the website's server? i dont necessarily need it to strip encryption, just use anything below TLS 1.1. for example on 'https://via.hypothes.is/' i can visit sites that would otherwise give cypher error, and they stay as https On 12/4/18, Zizhong Zhang <zizazit(a)protonmail.com> wrote: > Hello, > >> im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 >> sites. >> i heard stunnel cant be configured to always forward to the current >> site address dynamically, thats why i would use privoxy. > > If by "forward to the current site address dynamically" you meant "forward > to the current address of one specific domain" then stunnel can achieve that > by adding "delay = yes". > > However, if I understood correctly, you wanted to let stunnel strip > or remove SSL for whatever sites you visit. Then no, I don't think you can > achieve that with privoxy and stunnel. If that's what you want, I would > suggest you use nginx to remove SSL. The following example configuration > will let nginx "upgrade" your HTTP request to HTTPS. > > events {} http { server { > resolver 9.9.9.9; > listen 80; > location / { > proxy_pass https://$host$request_uri; > proxy_set_header Host $http_host; > } > }} > > You can then point any domain to the nginx server (for example, via the > hosts file) and visit the site via HTTP. This will make HTTPS-oly servers > happy. > > That won't strip third-party HTTPS:// URL resources like NewIPNow does, but > you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. Also > there are "security features" like "Content-Security-Policy" that prevent > modern browsers from visiting your SSL-stripped sites, but I believe your > out-dated browser will happily ignore those. > > --Zizhong > ------------------------------ Message: 4 Date: Wed, 5 Dec 2018 10:12:06 +0100 From: Flo Rance <trourance(a)gmail.com> To: kovacsjanosfasz(a)gmail.com Cc: zizazit(a)protonmail.com, stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAHogYcV+ig2-2u8CWYbbqH_AnkiZNzqM9etx=jHj3N+nug-FpQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I would recommend to use squid which is able to do SSL bump. https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit Therefore, you'll be able to connect with TLS1.0 to squid and the proxy will establish a TLSv1.2 to the final destination. Regards, Flo On Tue, Dec 4, 2018 at 9:38 PM kovacs janos <kovacsjanosfasz(a)gmail.com> wrote: > well, what i meant is forwarding to the current address the browser > connects to, so basically browsing through stunnel. > > is it really that complicated to achieve that? if i configure stunnel > as a client, and make the browser send traffic to the accept address, > shouldnt stunnel encrypt the traffic with TLS and send forward to the > connect address? if thats true, shouldnt it also decrypt returning > traffic and send back to the browser? > when i configured stunnel as both client and server on the same > computer, it worked, but the browser still gave > 'ssl_error_no_cypher_overlap' errors. probably because the server side > decrypted it again before it reached the website's server? > > i dont necessarily need it to strip encryption, just use anything > below TLS 1.1. for example on 'https://via.hypothes.is/' i can visit > sites that would otherwise give cypher error, and they stay as https > > On 12/4/18, Zizhong Zhang <zizazit(a)protonmail.com> wrote: > > Hello, > > > >> im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 > >> sites. > >> i heard stunnel cant be configured to always forward to the current > >> site address dynamically, thats why i would use privoxy. > > > > If by "forward to the current site address dynamically" you meant > "forward > > to the current address of one specific domain" then stunnel can achieve > that > > by adding "delay = yes". > > > > However, if I understood correctly, you wanted to let stunnel strip > > or remove SSL for whatever sites you visit. Then no, I don't think you > can > > achieve that with privoxy and stunnel. If that's what you want, I would > > suggest you use nginx to remove SSL. The following example configuration > > will let nginx "upgrade" your HTTP request to HTTPS. > > > > events {} http { server { > > resolver 9.9.9.9; > > listen 80; > > location / { > > proxy_pass https://$host$request_uri; > > proxy_set_header Host $http_host; > > } > > }} > > > > You can then point any domain to the nginx server (for example, via the > > hosts file) and visit the site via HTTP. This will make HTTPS-oly servers > > happy. > > > > That won't strip third-party HTTPS:// URL resources like NewIPNow does, > but > > you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. > Also > > there are "security features" like "Content-Security-Policy" that prevent > > modern browsers from visiting your SSL-stripped sites, but I believe your > > out-dated browser will happily ignore those. > > > > --Zizhong > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

Web mail browsing over stunnel
by Osvald Brko 05 Dec '18

05 Dec '18

Hello, I would like to use stunnel for mail reading from www.hotmail.com . But there are plenty of redirections, to outlook.live.com, login.live.com, outlook.office365.com etc., moreover IP adresses of these servers are changing... Is there any configuration which allowed to use such web server over stunnel? Regards, Olda

1 0

stunnel 5.50 released
by Michal Trojnara 04 Dec '18

04 Dec '18

Dear Users, I have released version 5.50 of stunnel. Version 5.50, 2018.12.02, urgency: MEDIUM * New features - 32-bit Windows builds replaced with 64-bit builds. - OpenSSL DLLs updated to version 1.1.1. - Check whether "output" is not a relative file name. - Major code cleanup in the configuration file parser. - Added sslVersion, sslVersionMin and sslVersionMax for OpenSSL 1.1.0 and later. * Bugfixes - Fixed PSK session resumption with TLS 1.3. - Fixed a memory leak in WIN32 logging subsystem. - Allow for zero value (ignored) TLS options. - Partially refactored configuration file parsing and logging subsystems for clearer code and minor bugfixes. * Caveats - We removed FIPS support from our standard builds. FIPS will still be available with bespoke builds. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 951d92502908b852a297bd9308568f7c36598670b84286d3e05d4a3a550c0149 stunnel-5.50.tar.gz e855d58a05dca0943a5da8d030b5904630ee9cff47c3d747d326e151724f3bc8 stunnel-5.50-win64-installer.exe ad6c952cd26951c5a986efe8034b71af07c951e11d06e0b0ce73ef82594b1041 stunnel-5.50-android.zip Best regards, Mike

3 2

PSK mode does not work correctly with TLSv1.3
by Zizhong Zhang 21 Nov '18

21 Nov '18

Hello, In TLSv1.3, session resumption has been reworked to be the same way as PSK. The client attempts resumption by appending a ticket as PSK identity to the head of the list. With OpenSSL 1.1.1, the server side should use the new SSL_CTX_set_psk_find_session_callback() callback instead of SSL_CTX_set_psk_server_callback() which is used by stunnel now. Because stunnel only verifies against the first PSK identity, stunnel will fail for every other connections it makes. This impacts the default configuration when running with OpenSSL 1.1.1 because TLSv1.3 is enabled by default. It may be confusing because only half of the connections will fail as the client will try to resume the last successful session for every second connections. I purpose that stunnel should switch to SSL_CTX_set_psk_find_session_callback() for OpenSSL 1.1.1, and that it preferably should default to a maximum version of TLSv1.2 because it might be compiled with OpenSSL 1.0.x but runs with OpenSSL 1.1.1 which will enable TLSv1.3 automatically. With regards, --Zizhong

1 0

Installing stunnel as a Windows service with another service name?
by Al Birchall 16 Nov '18

16 Nov '18

Hi, Is it possible to install stunnel as a Windows service with another name? I want to have multiple instances of stunnel running on the same Windows 2008 server, if possible. Many thanks. Al

2 1

Server is down
by Paul Muller 12 Nov '18

12 Nov '18

I've installed Stunnel before with no issues. But now I'm getting the following: ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [SMTP Outgoing] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [SMTP Outgoing] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [SMTP Outgoing] [ ] Listening file descriptor created (FD=1388) [ ] Setting accept socket options (FD=1388) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [SMTP Outgoing] to 0.0.0.0:25: Address already in use (WSAEADDRINUSE) (10048) [!] Binding service [SMTP Outgoing] failed [ ] Deallocating section defaults [ ] Unbinding service [SMTP Outgoing] [ ] Service [SMTP Outgoing] closed [ ] Deallocating section [SMTP Outgoing] [!] Server is down Please let me know what I'm doing wrong here. Thank you, [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:paul.muller@earnestassoc.com> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

1 0

Issue with Office365 certificates
by milanimarco82＠libero.it 09 Nov '18

09 Nov '18

Hello, I'm encountering an issue while using sTunnel with an Office365 account. sTunnel worked properly for a few months, while it gived an error with certificates since yesterday, whilst didn't change anything in the configuration. This is our configuration: [pop3s] client = yes accept = 127.0.0.1:2001 connect = outlook.office365.com:995 CAfile = C:\Program Files (x86)\stunnel\config\ca-certs.pem checkHost = outlook.office365.com verifyChain = yes OCSPaia = yes This is what we get in the log: 2018.11.09 11:34:09 LOG7[main]: Found 1 ready file descriptor(s) 2018.11.09 11:34:09 LOG7[main]: FD=432 ifds=r-x ofds=--- 2018.11.09 11:34:09 LOG7[main]: Service [pop3s] accepted (FD=672) from 127.0.0.1:49619 2018.11.09 11:34:09 LOG7[main]: Creating a new thread 2018.11.09 11:34:09 LOG7[main]: New thread created 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] started 2018.11.09 11:34:09 LOG7[30]: Setting local socket options (FD=672) 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on local socket 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] accepted connection from 127.0.0.1:49619 2018.11.09 11:34:09 LOG6[30]: failover: priority, starting at entry #0 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 40.101.9.178:995 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 40.101.9.178:995: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 40.101.9.178:995 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] connected remote server from 172.31.20.23:49620 2018.11.09 11:34:09 LOG7[30]: Setting remote socket options (FD=668) 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on remote socket 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) initialized 2018.11.09 11:34:09 LOG6[30]: SNI: sending servername: outlook.office365.com 2018.11.09 11:34:09 LOG6[30]: Peer certificate required 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): before/connect initialization 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv2/v3 write client hello A 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv3 read server hello A 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=2: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG7[30]: OCSP: Ignoring root certificate 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=2: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocsp.digicert.com" 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocsp.digicert.com:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received 2018.11.09 11:34:09 LOG6[30]: OCSP: Status: good 2018.11.09 11:34:09 LOG6[30]: OCSP: This update: Nov 9 00:00:00 2018 GMT 2018.11.09 11:34:09 LOG6[30]: OCSP: Next update: Nov 16 00:00:00 2018 GMT 2018.11.09 11:34:09 LOG5[30]: OCSP: Certificate accepted 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG6[30]: CERT: Host name "outlook.office365.com" matched with "*.office365.com" 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocspx.digicert.com" 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocspx.digicert.com:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received 2018.11.09 11:34:09 LOG3[30]: OCSP: Responder error: 6: unauthorized 2018.11.09 11:34:09 LOG4[30]: Rejected by OCSP at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com 2018.11.09 11:34:09 LOG7[30]: TLS alert (write): fatal: handshake failure 2018.11.09 11:34:09 LOG3[30]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed 2018.11.09 11:34:09 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.11.09 11:34:09 LOG7[30]: Deallocating application specific data for session connect address 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) closed 2018.11.09 11:34:09 LOG7[30]: Local descriptor (FD=672) closed 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] finished (0 left) Can you please help me? Thanks in advance!

2 3

Please need urgent help
by Alix Janeth Jerez 09 Nov '18

09 Nov '18

Hi, I have installed the last stunnel version 5.4.9, i get this fatal error [cid:60207984-5796-4d47-986e-21551ff82966] The stunnel.conf is configured so: debug = 7 output = stunnel.log # GLOBAL OPTIONS client = yes taskbar=yes [SMTP Outgoing] protocol = smtp accept = 172.31.41.84:117 connect = smtp.outlook.com:587 checkHost = smtp.outlook.com verifyChain = yes CAfile = ca-certs.pem OCSPaia = yes cert = stunnel.pem I tried to enable this option ; Enable support for the insecure SSLv3 protocol options = -NO_SSLv3 But stunnel does't work. Thank you in advance for your help. Best regards,

2 3

Re: [stunnel-users] Multiple Instance of sTunnel on same machine
by Shah, Marmik 31 Oct '18

31 Oct '18

I would be connecting to different Vendors using sTunnel from my machine. I want to run multiple instance of sTunnel as hosted service on Window Server. How can I achieve that ? I can do that through Terminal but I want to install stunnel service per vendor (in Service Control Manager) so that I can manage them independently and stop or start based on Vendor's requirement. I can do this through Command Prompt. Thanks Marmik ............................................................................ For further important information about AllianceBernstein please click here http://www.alliancebernstein.com/disclaimer/email/disclaimer.html

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 171, Issue 16
by Johann Hörmann 25 Oct '18

25 Oct '18

Am 25.10.18 um 12:00 schrieb stunnel-users-request(a)stunnel.org: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian > jessie (Johann Hörmann) > 2. Re: stunnel 5.06 not yet linked against OpenSSL 1.0.1t on > debian jessie (Eric Eberhard) > 3. stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian > jessie (Jakob Hirsch) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 24 Oct 2018 17:29:18 +0200 > From: Johann Hörmann <support(a)hans-hoermann.de> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL > 1.0.1t on debian jessie > Message-ID: <f9fb3d42-c0f2-dffd-e0b1-249d8e068081(a)hans-hoermann.de> > Content-Type: text/plain; charset=utf-8 > > Hi, > > that's the log on a debian jessie, starting stunnel: > > 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform > 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 > 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 > 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel > > All debian packages are upgraded: > $ sudo apt-get update > ... > $ sudo apt-get upgrade > 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. > $ > > $ dpkg -l|egrep 'openssl|stunnel' > ... > ii openssl 1.0.1t-1+deb8u9 > ... > ii stunnel4 3:5.06-2+deb8u1 > $ > > Guess the log tells the current stunnel-package is not linked against > openssl 1.0.1t lib yet. > > No pinning is active: > $ ls -l /etc/apt/preferences > -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences > $ > > Is that - stunnel not being linked against the current openssl-lib - a > serious problem? > Will there soon be a stunnel-package being linked against openssl 1.0.1t? > > > Thanks in Advance > -- > Hans > > > ------------------------------ > > Message: 2 > Date: Wed, 24 Oct 2018 15:02:08 -0700 > From: "Eric Eberhard" <flash(a)vicsmba.com> > To: 'Johann Hörmann' <support(a)hans-hoermann.de>, > <stunnel-users(a)stunnel.org> > Subject: Re: [stunnel-users] stunnel 5.06 not yet linked against > OpenSSL 1.0.1t on debian jessie > Message-ID: <03bb01d46be5$40d264c0$c2772e40$(a)vicsmba.com> > Content-Type: text/plain; charset="utf-8" > > Static linking is much easier, especially when put in a non-standard place, such as /usr/local/customer-name/lib -- this means if somebody does an update of say openssl alone you won't have this problem. You can also do it non-static as long as it is in a non-standard place and be pretty safe. > > My versions have stunnel 5.44 and openssl 1.0.2 -- works fine. It is static and keeps on ticking. > > Eric > > -----Original Message----- > From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Johann Hörmann > Sent: Wednesday, October 24, 2018 8:29 AM > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie > > Hi, > > that's the log on a debian jessie, starting stunnel: > > 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform > 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 > 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 > 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel > > All debian packages are upgraded: > $ sudo apt-get update > ... > $ sudo apt-get upgrade > 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. > $ > > $ dpkg -l|egrep 'openssl|stunnel' > ... > ii openssl 1.0.1t-1+deb8u9 > ... > ii stunnel4 3:5.06-2+deb8u1 > $ > > Guess the log tells the current stunnel-package is not linked against openssl 1.0.1t lib yet. > > No pinning is active: > $ ls -l /etc/apt/preferences > -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences $ > > Is that - stunnel not being linked against the current openssl-lib - a serious problem? > Will there soon be a stunnel-package being linked against openssl 1.0.1t? > > > Thanks in Advance > -- > Hans > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > > ------------------------------ > > Message: 3 > Date: Thu, 25 Oct 2018 10:58:48 +0200 > From: Jakob Hirsch <jh(a)plonk.de> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL > 1.0.1t on debian jessie > Message-ID: <a518f51f-180d-b1a3-96e1-c3f976dd1e42(a)Message-ID.plonk.de> > Content-Type: text/plain; charset=utf-8 > > Hi, > > On 2018-10-24 17:29, Johann Hörmann wrote: >> Is that - stunnel not being linked against the current openssl-lib - a >> serious problem? > > It is usually not necessary to rebuild all packages using a specific lib > just because it got updated. > >> Will there soon be a stunnel-package being linked against openssl 1.0.1t? > > The debian people are doing that, so that would be something to ask > them, specifically the package maintainers (see > https://packages.debian.org/jessie/stunnel4). But since jessie support > ended last June and LTS won't rebuild , I would not hold my breath. > > Why do you care about this in the first place? You are using a stunnel > version that is 4 years old and got last patched more than 3 years ago. > If it's of any importance to you, you should really upgrade to stretch > (optionally with bpo) or at least use jessie-backports. > > > Regards > Jakob > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > ------------------------------ > > End of stunnel-users Digest, Vol 171, Issue 16 > ********************************************** > Thanks a lot for your valuable advices, Eric and Jakob! Being just a dumb user, i supposed the distribution should stay 'in harmony': Ok now i know for oldstable this can be solved by backports or compiling stunnel with a static openssl-lib. Upgrading to stretch is not yet a choice because i am using stunnel with 'verify=3' which results in checking the self-signed client-certs at the server: Can't tell why but my cacert file was generated with a CAFile value of FALSE, which worked until jessie but at stretch the request results in a reject by the openssl-lib because of the FALSE-value. So first i have to renew and deploy all my customers certs - about 80 - with a stretch-conform cacert performing with CAFile=true. Hans -- https://hoermann-solutions.com

1 0

stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie
by Johann Hörmann 25 Oct '18

25 Oct '18

Hi, that's the log on a debian jessie, starting stunnel: 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel All debian packages are upgraded: $ sudo apt-get update ... $ sudo apt-get upgrade 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. $ $ dpkg -l|egrep 'openssl|stunnel' ... ii openssl 1.0.1t-1+deb8u9 ... ii stunnel4 3:5.06-2+deb8u1 $ Guess the log tells the current stunnel-package is not linked against openssl 1.0.1t lib yet. No pinning is active: $ ls -l /etc/apt/preferences -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences $ Is that - stunnel not being linked against the current openssl-lib - a serious problem? Will there soon be a stunnel-package being linked against openssl 1.0.1t? Thanks in Advance -- Hans

2 1

Re: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie
by Eric Eberhard 24 Oct '18

24 Oct '18

Static linking is much easier, especially when put in a non-standard place, such as /usr/local/customer-name/lib -- this means if somebody does an update of say openssl alone you won't have this problem. You can also do it non-static as long as it is in a non-standard place and be pretty safe. My versions have stunnel 5.44 and openssl 1.0.2 -- works fine. It is static and keeps on ticking. Eric -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Johann Hörmann Sent: Wednesday, October 24, 2018 8:29 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie Hi, that's the log on a debian jessie, starting stunnel: 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel All debian packages are upgraded: $ sudo apt-get update ... $ sudo apt-get upgrade 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. $ $ dpkg -l|egrep 'openssl|stunnel' ... ii openssl 1.0.1t-1+deb8u9 ... ii stunnel4 3:5.06-2+deb8u1 $ Guess the log tells the current stunnel-package is not linked against openssl 1.0.1t lib yet. No pinning is active: $ ls -l /etc/apt/preferences -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences $ Is that - stunnel not being linked against the current openssl-lib - a serious problem? Will there soon be a stunnel-package being linked against openssl 1.0.1t? Thanks in Advance -- Hans _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] stunnel logging of OpenSSL error source file and line number?
by Eric Eberhard 19 Oct '18

19 Oct '18

Good idea and about as much fun as watching grass grow :) E From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Tom Hood Sent: Friday, October 19, 2018 7:09 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel logging of OpenSSL error source file and line number? Hi, Was it by design that stunnel's logging of OpenSSL errors does not include the OpenSSL source file and line number? If not, please consider switching from ERR_get_error to ERR_get_error_line <https://www.openssl.org/docs/man1.0.2/crypto/ERR_get_error_line.html> . Thanks, -- Tom

1 0

stunnel logging of OpenSSL error source file and line number?
by Tom Hood 19 Oct '18

19 Oct '18

Hi, Was it by design that stunnel's logging of OpenSSL errors does not include the OpenSSL source file and line number? If not, please consider switching from ERR_get_error to ERR_get_error_line <https://www.openssl.org/docs/man1.0.2/crypto/ERR_get_error_line.html>. Thanks, -- Tom

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users