stunnel-users

stunnel-users@stunnel.org

5 participants
3293 discussions

Java jdk.disabled.NamedCurves
by Randy Curry 27 Sep '23

27 Sep '23

Hello, We are making a Rest API to an endpoint that uses stunnel for their proxy. We recently upgraded our integration engine and it's running Java AdoptOpenJDK 11.0.15. Since we've upgraded we can only successfully make one or two POST API calls then we get an error: Caused by: java.io.IOException: Error writing to server I did some research and found this version of Java has disabled named curves, part of it's Elliptic-curve cryptography. Is there any known issues with stunnel and the version of Java that's being used or the disabled named curves? Thank you, Randy Curry Senior Integration Services Architect [cid:image005.jpg@01D6602C.0A82CC60] [cid:image002.png@01D6602B.17ACD030]randy.curry@mihin.org<mailto:randy.curry@mihin.org> [cid:image003.png@01D6602B.17ACD030] 919.588.1036 [cid:image004.png@01D6602B.17ACD030] www.mihin.org<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.mihin.org&d=DwQGaQ&…> [cid:image006.png@01D6602C.0A82CC60]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_MiHIN&d=Dw…>[cid:image007.png@01D6602C.0A82CC60]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.youtube.com_user_M…>[cid:image008.png@01D6602C.0A82CC60]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…> Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by returning the e-mail and destroying all copies of the original message.

1 0

stunnel 5.71 released
by Michał Trojnara 19 Sep '23

19 Sep '23

Dear Users, I have released version 5.71 of stunnel. ### Version 5.71, 2023.09.19, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.1.3. * Bugfixes - Fixed the console output of tstunnel.exe. * Features sponsored by SAE IT-systems - OCSP stapling is requested and verified in the client mode. - Using "verifyChain" automatically enables OCSP stapling in the client mode. - OCSP stapling is always available in the server mode. - An inconclusive OCSP verification breaks TLS negotiation. This can be disabled with "OCSPrequire = no". - Added the "TIMEOUTocsp" option to control the maximum time allowed for connecting an OCSP responder. * Features - Added support for Red Hat OpenSSL 3.x patches. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: f023aae837c2d32deb920831a5ee1081e11c78a5d57340f8e6f0829f031017f5 stunnel-5.71.tar.gz 945df5118473bcbf1ecdc5561fd6f26743c5dd1fd82e1a25199d0fd5c39a9373 stunnel-5.71-win64-installer.exe d511df533bb89464a324b2439e7e04b24b6ce26ecc0e03b67ada307725343d40 stunnel-5.71-android.zip Best regards, Mike

2 1

New machine
by stunnel＠paapnet.nl 16 Sep '23

16 Sep '23

Hello All, Who can help me? Just setup a new Ubuntu 22.04 (server) machine gcc version 11.4.0 (Ubuntu 11.4.0-1ubuntu1~22.04) grabbed stunnel (git) However running into issues (an old linux box runs well with compile) configure runs well: config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tests/Makefile config.status: creating tests/certs/Makefile config.status: creating src/config.h config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success Make bails out: root@dns:/Downloads/stunnel# make CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/bash '/Downloads/stunnel/auto/missing' aclocal-1.16 -I m4 cd . && /bin/bash /Downloads/stunnel/auto/missing automake-1.16 --foreign CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/bash '/Downloads/stunnel/auto/missing' autoconf configure.ac:53: warning: back quotes and double quotes must not be escaped in: Unknown thread model \"${withval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1553: AC_ARG_WITH is expanded from... configure.ac:53: the top level configure.ac:285: warning: back quotes and double quotes must not be escaped in: bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:285: the top level configure.ac:309: warning: back quotes and double quotes must not be escaped in: bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:309: the top level configure.ac:334: warning: back quotes and double quotes must not be escaped in: Bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:334: the top level configure.ac:369: warning: back quotes and double quotes must not be escaped in: Bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:369: the top level configure.ac:4: error: possibly undefined macro: AC_MSG_NOTICE If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. configure.ac:22: error: possibly undefined macro: AC_DEFINE make: *** [Makefile:409: configure] Error 1 aclocal (GNU automake) 1.16.5 autoconf (GNU Autoconf) 2.71 Is active What do I mis here ? Chrs....

1 0

Use of dante socks proxy with Stunnel
by vinesh＠techvinesh.com 15 Sep '23

15 Sep '23

I am deploying connection between on premise database with BI application on cloud. Currently the on premise database connecting via jdbc driver and it not supporting encryption. As per my understanding Stunnel opens port listening on http:127.0.0.1 ( as local) and forward traffic to destination over https using TLSv1.2. I have few question on this , to protect on network level, 1- can I use dante socks proxy along with Stunnel to provide 2 layer of protection? On-prem --- cloud ( 2 layer of protection) -- dante socks ( unencrypted tunnel) -- Stunnel ( e2e Encryption) 2- will it supporting CA other than openSsl

1 0

The stunnel process running on an AWS EC2 instance frequently enters a zombie state.
by sharukh.khan+stunnel＠seclore.com 12 Sep '23

12 Sep '23

We're facing an issue where the stunnel process running on our AWS Ec2 enters a zombie state. This results in the nfs server timeout (We're using EFS). We're running Amazon Linux 2 (Kernel version 4.14.318-241.531) with stunnel version 5.6.4. The configuration for stunnel is stated below: ; Sample stunnel configuration file for Win64 by Michal Trojnara 2002-2022 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) ;debug = info ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later ;securityLevel = 0 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini

2 4

stunnel events
by noel_melvin＠neimanmarcus.com 11 Sep '23

11 Sep '23

We have stunnel running on Windows machine. Just would like to know whether the below events is anything abnormal/critical to be addressed. 2023.09.07 10:10:16 LOG5[7]: Service [Application1] accepted connection from x.x.x.x:1234 2023.09.07 10:10:16 LOG6[7]: Peer certificate not required 2023.09.07 10:10:16 LOG6[7]: No peer certificate received 2023.09.07 10:10:16 LOG6[7]: Session id: (Alphanumeric) 2023.09.07 10:10:16 LOG6[7]: TLS accepted: new session negotiated 2023.09.07 10:10:16 LOG6[7]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-SHA256 (128-bit encryption) 2023.09.07 10:10:16 LOG6[7]: s_connect: connecting x.x.x.x:1234 2023.09.07 10:10:16 LOG5[7]: s_connect: connected x.x.x.x:1234 2023.09.07 10:10:16 LOG6[7]: persistence: x.x.x.x:1234 cached

1 1

Stunnel hangs with static build with openssl 1.1.1c
by eklein＠triple-eye.nl 07 Sep '23

07 Sep '23

I successfully cross compiled and built a static version of stunnel for ARM. It works with stunnel 5.70 and openssl 1.1.1b If however, I try to use openssl 1.1.1c, stunnel hangs. I narrowed the problem down to the following call in compression_init in ssl.c: comp_methods[COMP_NONE]=sk_SSL_COMP_new_null(); The program does not get past this point. I also tried to build with openssl 1.1.1v and 3.0.0, to no avail. I am using the following commands: To build openssl: ./Configure linux-armv4 --prefix=/home/erik/Documents/openssl-1.1.1b/install --openssldir=/home/erik/Documents/openssl-1.1.1b/install threads shared make CC=arm-linux-gnueabi-gcc make install To build stunnel: sed -i 's/^stunnel_LDFLAGS = /&-all-static /' src/Makefile.in export CFLAGS='-Os -fomit-frame-pointer -pipe' ./configure --with-ssl=/home/erik/Documents/openssl-1.1.1b/install --disable-fips --disable-shared --enable-static --disable-silent-rules --build x86_64-pc-linux-gnu --host arm-linux-gnueabi make What is the difference between openssl1.1.1b and 1.1.1c which causes this problem?

1 1

Failover configuration using a proxy
by Daphne Shaw 06 Sep '23

06 Sep '23

Hello! I have a configuration question around failover with stunnel as a https client (that is, "client=yes"). The end goal here is a "Try to connect to host A, if that fails, connect to host B, etc." type of setup. I can do that with multiple connect= options, one per host, and it works as expected: connect=x.x.x.x connect=y.y.y.y connect=z.z.z.z The question I have is around doing the same thing with a proxy. In a proxy configuration, connect= specifies the proxy (https in my case, so "protocol=connect"), and protocolHost= specifies the host that I want to connect to via that proxy. Unfortunately, it seems that protocolHost only allows a single host and cannot be used multiple times, so I can't specify the hosts to failover to. connect=my.proxy.ip protocol=connect protocolhost=x.x.x.x protocolhost=y.y.y.y protocolhost=z.z.z.z That always attempts to connect to z.z.z.z (the last specified host) via the proxy. I am using stunnel 4.56 (stock stunnel from Centos 7), but happy to upgrade if a newer version makes this possible (the manual suggests the latest version works the same way). Any suggestions? I'm sure I could accomplish this by wrapping stunnel in a script that generates a new config file for each failover, but well, I'm hoping to not have to do that. Thanks, Daphne

2 2

Connection abend between Stunnel and multiple clients
by arunprasanna_dhayalavel＠neimanmarcus.com 06 Sep '23

06 Sep '23

Hello All!! We are experiencing multiple transactions initiated from the different clients towards the Stunnel getting reset. We are trying to identify if the below events relate to the issue. If yes, kindly suggest how we can rectify the below. 2023.09.05 09:10:43 LOG6[210]: transfer: s_poll_wait: TIMEOUTidle exceeded: sending reset 2023.09.05 09:10:43 LOG5[210]: Connection reset: 2505 byte(s) sent to TLS, 59 byte(s) sent to socket

1 0

error:0A000126 on windows 10
by Stewart Anderson 02 Sep '23

02 Sep '23

Hi, First apologies I posted this question on a google stunnel group, but I realise that does not have much activity, so posting here also. I am trying to get stunnel up and running and getting the error in the subject. The full error text is: "SSL_accept: ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number" I have a simple service which seems to load fine. I have stunnel up at the "server side" on a VM in azure and if I telnet to the VM public address I can see the activity in the stunnel logs on the VM, so I know at least a pipe is open. I can hit the port server side and see the log activity in stunnel also. If I try a telnet to the local stunnel accept port. I see the error above. This is the full log. 2023.08.23 11:01:04 LOG7[service]: Found 1 ready file descriptor(s) 2023.08.23 11:01:04 LOG7[service]: FD=604 ifds=r-x ofds=--- 2023.08.23 11:01:04 LOG7[service]: FD=664 ifds=r-x ofds=r-- 2023.08.23 11:01:04 LOG7[service]: Service [dev-dev-testHarness] accepted (FD=708) from 127.0.0.1:10756 2023.08.23 11:01:04 LOG7[service]: Creating a new thread 2023.08.23 11:01:04 LOG7[service]: New thread created 2023.08.23 11:01:04 LOG7[4]: Service [dev-dev-testHarness] started 2023.08.23 11:01:04 LOG7[4]: Setting local socket options (FD=708) 2023.08.23 11:01:04 LOG7[4]: Option TCP_NODELAY set on local socket 2023.08.23 11:01:04 LOG5[4]: Service [dev-dev-testHarness] accepted connection from 127.0.0.1:10756 2023.08.23 11:01:04 LOG6[4]: Peer certificate not required 2023.08.23 11:01:04 LOG7[4]: TLS state (accept): before SSL initialization 2023.08.23 11:01:04 LOG7[4]: TLS alert (write): fatal: decode error 2023.08.23 11:01:04 LOG3[4]: SSL_accept: ssl/record/rec_layer_s3.c:303: error:0A000126:SSL routines::unexpected eof while reading 2023.08.23 11:01:04 LOG5[4]: Connection reset/closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.08.23 11:01:04 LOG7[4]: Local descriptor (FD=708) closed 2023.08.23 11:01:04 LOG7[4]: Service [dev-dev-testHarness] finished (0 left) What am I missing, I haven't used stunnel for quite a while and previous effort were on linux and I did not see this problem then. Using telnet/TNC as the local test tools and stunnel was installed with bare default installation. The only thing I have done different is to set a config fragment folder to separate services on the sever side and they report as loading fine. any help greatly appreciated. Stu

1 1

← Newer
1
...
7
8
9
10
11
12
13
...
330
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users