December 2013 - stunnel-users

stunnel and Calypso: pop3 works, smtp error!
by greeksalad 12 Dec '13

12 Dec '13

Hallo Everybody! trying hard to get stunnel worked with Calypso email client! When I only check emails, it works via stunnel at ssl port 995. But sending email fails with following message from Calypso: *** Sending pending mail from account xyz(a)gmx.net' @ 13.12.2013 01:54 *** Connecting to: '127.0.0.1' -> Successful Logging into the SMTP server as: "xxx" The server does not support any secure password authentication providers Disconnecting -> Successful Failed to send one or more pending messages. Smtp.c[287] Smtp.dll the config file via stunnel looks so: cert = stunnel.pem [gmx-pop3] client = yes accept = 127.0.0.1:108 connect = pop.gmx.net:995 [gmx-smtp] client = yes accept = 127.0.0.1:107 connect = mail.gmx.net:465 the mailserver- config of Calypso is so: pop3: 127.0.0.1 port 108 smtp: 127.0.0.1 port 107 smtp authentication method: user pop account.... So, I am really out of ideas to get the very best email client of the world - CALYPSO - running to send emails via ssl connection, wich my provider forces me to send via ssl from 1.jan.2014... Anyone can help? thanks allot! johann

3 2

Client Authentication - Configuring Service Definition
by j nasty 10 Dec '13

10 Dec '13

Hello Everyone, I’m attempting to consume a web service that requires I authenticate the client using certificates. I was given a (.pfx) certificate locked with a password by the 3rd party vendor. I know I need to convert the current certificate I have into a (.pem) certificate, which I’ll use the openssl tools to accomplish this. I’m a bit new to SSL and network security, thus I’m not entirely sure if I should only be creating a client certificate from the original (.pfx) file or if a server certificate will also need to get created. I used the command: “pkcs12 –in certificate.pfx –out certificate.pem –nodes (–clcerts/-cacerts)” to create my pem certificate. Here is my current configuration: [SSLconnection] debug = 7 CAfile = certificate.pem client = yes verify = 2 accept = 127.0.0.1:9001 connect = web.service.com:443 And the log: (I obscured some information identity information) 2013.12.10 09:36:41 LOG5[9776:8488]: stunnel 4.56 on x86-pc-msvc-1500 platform 2013.12.10 09:36:41 LOG5[9776:8488]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 2013.12.10 09:36:41 LOG5[9776:8488]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2013.12.10 09:36:41 LOG5[9776:8488]: Reading configuration from file stunnel.conf 2013.12.10 09:36:41 LOG5[9776:8488]: FIPS mode is enabled 2013.12.10 09:36:41 LOG5[9776:8488]: Configuration successful 2013.12.10 09:36:44 LOG5[9776:9024]: Service [SSLconnection] accepted connection from 127.0.0.1:60659 2013.12.10 09:36:44 LOG5[9776:9024]: connect_blocking: connected web.service.com:443 2013.12.10 09:36:44 LOG5[9776:9024]: Service [SSLconnection] connected remote server from 192.168.50.211:60660 2013.12.10 09:36:44 LOG5[9776:9024]: Certificate accepted: depth=1, /C=US/O=Entrust, Inc./OU=www.entrust.net/rpa is incorporated by reference/OU=(c) 2009 Entrust, Inc./CN=Entrust Certification Authority - L1C 2013.12.10 09:36:44 LOG5[9776:9024]: Certificate accepted: depth=1, /C=US/O=Entrust, Inc./OU=www.entrust.net/rpa is incorporated by reference/OU=(c) 2009 Entrust, Inc./CN=Entrust Certification Authority - L1C 2013.12.10 09:36:44 LOG4[9776:9024]: CERT: Certificate not found in local repository 2013.12.10 09:36:44 LOG4[9776:9024]: Certificate check failed: depth=0, /C=US/ST=Texas/L=Austin/O=OName/CN=web.service.com 2013.12.10 09:36:44 LOG3[9776:9024]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2013.12.10 09:36:44 LOG5[9776:9024]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Looks like my problem is stemming from "Certificate not found in local repository"? Thank you in advance for any assistance, Jake

1 0

connect error 0 running on ARM platform
by FX35 10 Dec '13

10 Dec '13

Hello, Running stunnel 4?56 on an ARM platform (ARM926EJ) with Linux 2.6.36.4, I encounter the following error : the call to connect() return -1, but errno is set to 0 ! Is somebody meet the same error ? Is the problem in stunnel program ? An other application, using non blocking call to connect() run correctly. Thanks for help. FWX.

1 0

newbie - sTunnel examples and users archive searching
by Attila Horvath 10 Dec '13

10 Dec '13

All I'm new to sTunnel and tunneling in general. Have a couple of quick questions... [1] It's been *many* years since I've used or subscribed to mailman. Is there a way of searching the mail archives online for specific topics and/or keywords without downloading everything so previously asked questions aren't repeated ad nauseam? [2] I have a specific need which I believe sTunnel will solve but not sure how to go about it. I want to access a machine that is behind a restrictive firewall from outside the network to perform perform remote desktop control. The firewall permits HTTP, HTTPS protocols and some similar common protocols. However, I do not have access to the firewall server ergo have no control/say over which ports are blocked or forwarded. I have heard about HTTP hole punching via ssl and http-tunnel - eg: http://sebsauvage.net/punching/. It sounds like sTunnel is similar/identical. Can someone point me to specific examples on how to use sTunnel as well as any examples that might satisfy my need? Is proxy server necessary to accomplish this? To date I've been using Teamviewer to access/control my machine(s) in conjunction with things like AdVOR, TOR, or UltraSurf. While these are excellent applications and their free use are limited, I do not expect this will last forever. I prefer to use and trust 'open source' applications where/when I can. Much appreciated and thank you in advance. Attila

1 0

error invalid stunnel.conf - No limit of clients
by Christian Huber 09 Dec '13

09 Dec '13

Hi, I just installed stunnel for my email programm courier. I edited the stunnel.conf as followed but am unfortunatly becoming the message from stunnel: invalid stunnel.conf No limit detected for the number of clients stunnel 4.56 on x86-pc-msvc-1500 platform Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D07808C: error:2D07808C:FIPS routines:FIPS_module_mode_set:unsupported platform Line 11: "[POP3 T-Online]": Failed to initialize SSL Server is down my stunnel.conf is as followed: # GLOBAL OPTIONS client = yes output = stunnel-log.txt debug=4 taskbar = yes # SERVICE-LEVEL OPTIONS [POP3 T-Online] accept = 127.0.0.1:108 connect = securepop.t-online.de:995 [SMTP T-Online] accept = 127.0.0.1:107 connect = securesmtp.t-online.de:587 [POP3 web.de] accept = 127.0.0.1:106 connect = pop3.web.de:995 [SMTP web.de] accept = 127.0.0.1:105 connect = smtp.web.de:587 [POP3 STRATO] accept = 127.0.0.1:104 connect = pop3.strato.de:995 [SMTP STRATO] accept = 127.0.0.1:103 connect = smtp.strato.de:465 [POP3 GMX ] accept = 127.0.0.1:102 connect = pop.gmx.net:995 [SMTP GMX ] accept = 127.0.0.1:101 connect = mail.gmx.net:465 ___________________ Would be nice if someone could tell me what is wrong! Greetings Christian Huber

3 3

t-online, web.de E-mail with Courier
by Christian Huber 08 Dec '13

08 Dec '13

Hi, stunnel is now working with the fips=no global option without error! My e-mail programm courier is working with the servers from strato and gmx! But with t-online it is not working at the moment! I can not login into the pop3 server! >From courier I get the message: Sendrecv.c[229] Pop3.dll recv() failed WINSOCK Error: Connection reset. (The mail server terminated the connection. With web.de I can login into the pop3 server and receive mails. But sending mails is not sucessfull! >From courier I get the message: Sendrecv.c[188] Smtp.dll recv(MSG_PEEK) failed WINSOCK Error: Connection reset. (The mail server terminated the connection. Would be nice if someone has a solution! My stunnel.conf: # GLOBAL OPTIONS client = yes fips=no output = stunnel-log.txt debug=4 taskbar = yes # SERVICE-LEVEL OPTIONS [POP3 T-Online] accept = 127.0.0.1:108 connect = securepop.t-online.de:995 [SMTP T-Online] accept = 127.0.0.1:107 connect = securesmtp.t-online.de:587 [POP3 web.de] accept = 127.0.0.1:106 connect = pop3.web.de:995 [SMTP web.de] accept = 127.0.0.1:105 connect = smtp.web.de:587 [POP3 STRATO] accept = 127.0.0.1:104 connect = pop3.strato.de:995 [SMTP STRATO] accept = 127.0.0.1:103 connect = smtp.strato.de:465 [POP3 GMX ] accept = 127.0.0.1:102 connect = pop.gmx.net:995 [SMTP GMX ] accept = 127.0.0.1:101 connect = mail.gmx.net:465

1 0

stunnel domain name resolution bug
by David Slachta 06 Dec '13

06 Dec '13

I'm new to the mailing lists so I hope it's the correct way to report a bug. There's an issue with resolving domain names. I'm connecting an stunnel client to a server that sits on a computer which IP address is dynamic. Therefore I'm using a dyndns for the IP address of the server. When the IP address of the server is changed, the stunnel client doesn't update the name resolution of the dyndns name and tries to connect to the old IP which is of course unsuccessful. This can be resolved only by exiting and starting stunnel client again when a new domain name resolution is made. Would it be possible to add a functionality to the stunnel that wouldn't cache the name resolution but try to resolve the domain names every time there's a connection request? I'm using a Windows OS for both server and client, not sure if that makes a difference. Thanks! David

2 1

Re: [stunnel-users] stunnel domain name resolution bug
by Brian Wilkins 06 Dec '13

06 Dec '13

Sent you traffic from Sept 19th from Trojnara. May be helpful On Dec 6, 2013 6:11 PM, "Brian Wilkins" <bwilkins(a)gmail.com> wrote: > See my forward > On Dec 6, 2013 5:53 PM, "David Slachta" <elpin(a)volny.cz> wrote: > >> I'm new to the mailing lists so I hope it's the correct way to report a >> bug. >> >> There's an issue with resolving domain names. I'm connecting an stunnel >> client to a server that sits on a computer which IP address is dynamic. >> Therefore I'm using a dyndns for the IP address of the server. When the IP >> address of the server is changed, the stunnel client doesn't update the >> name resolution of the dyndns name and tries to connect to the old IP which >> is of course unsuccessful. This can be resolved only by exiting and >> starting stunnel client again when a new domain name resolution is made. >> >> Would it be possible to add a functionality to the stunnel that wouldn't >> cache the name resolution but try to resolve the domain names every time >> there's a connection request? >> >> I'm using a Windows OS for both server and client, not sure if that makes >> a difference. >> >> Thanks! >> David >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >>

1 0

Hostname verification, support for, and patches
by fslama＠comcast.net 06 Dec '13

06 Dec '13

After scouring the net I've found several isolated discussions regarding stunnel hostname validation. And also some patches that seem to implement hostname validation: https://www.stunnel.org/pipermail/stunnel-users/2010-March/002613.html I have a requirement to have stunnel (4.56) validate client certificates and their identity by comparing the its CNAME against the source address. I recall reading one response (which I can't find at the moment) from Marzena Trojnara indicating that this feature won't be supported. If so, can you explain the rational? Are there sanctioned patches out there today? Regards, -Fred

4 3