- stunnel-users - stunnel.org

Handling AUTH LOGIN for SMTP
by reaperunknown＠live.com 22 Apr '22

22 Apr '22

Hello everyone. Perhaps I'm a little new with Stunnel but, I've successfully used it to get an old EarthLink MailStation compatible with GMail SMTP and POP mail. Kind of neat. That said, I wish to use Outlook, but going through the SMTP process manually via Telnet, I've found that the SMTP requires you issue "AUTH LOGIN" command, and give the username and password in Base64. If I do this manually, I can send SMTP mail all day. However, this unit is old enough that I don't think it knows how to do anything with SMTP auth. It also looks like Outlook doesn't turn SMTP auth off for Outlook.com personal accounts. Is there any way that I've missed to have Stunnel handle the AUTH LOGIN part of the SMTP process, so that device that can't, doesn't have to? Thanks!

2 1

Force PSK Authentication
by gerhard＠ats.hacktic.nl 19 Apr '22

19 Apr '22

Hi stunnel-users, Is there a way to force PSK Authentication? Current behavior is that if the client has no PSK Authentication configured, no authentication is performed and the connection proceeds even when the server has this configured: ciphers = PSK PSKsecrets = mypsk.txt Is this expected behavior? Is there a way to enforce PSK, in other words block clients without PSK Authentication? Thanks

2 1

Windows service won't start. ""The Stunnel TLS wrapper service is marked as an interactive service."
by robert.croteau＠quest.com 15 Apr '22

15 Apr '22

Window 10 LTCS (1089): "The Stunnel TLS wrapper service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly." looks like starting with version 5.61, this above error appears in the System Event log. I've given a quick glance at the changes from 5.60 to 5.61 and there a lot of them. From the release notes, seems that windows services code might have been affected: New features for the Windows platform - Added client mode allowing authenticated users to view logs, reconfigure and terminate running stunnel services. - Added support for multiple GUI and service instances distinguised by the location of stunnel.conf. On GitHub, I also noticed that in the source code for src/ui_win_gui.c the service is created as follows: service=CreateService(scm, SERVICE_NAME, SERVICE_DISPLAY_NAME, SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS, SERVICE_AUTO_START, SERVICE_ERROR_NORMAL, service_path, NULL, NULL, TEXT("TCPIP\0"), NULL, NULL);ui_win_gui.c at around line 1622 the SERVICE_INTERACTIVE_PROCESS flag is set Is this flag necessary? I guess that would be the culprit. my reason to upgrade is because of the CVE-2022-0778 OpenSSL vulnerability anyone has a workaround for this? Microsoft has fully disabled Interactive Service Detection starting with Windows 10 Build 1803 and Windows Server 2016 and 2019. So, it looks like that that Interactive services are no longer allowed and this can't be circumvented by changing some registry setting like it seems it was possible before. thank you

3 5

issue with vendor trying to use proxy for tls
by Daniel Trickett 14 Apr '22

14 Apr '22

Hi stunnelers, We have a supplier which we are attempting punchout to ecommerce site. We use the url http://local-val.dc-clic.com:8899/punchout/request/0fd1ef2b-d09a-441d-b161-… to initiate punchout. The host local-val.dc.clic.com routes to our local host, where stunnel is listening on port 8899. Our config file contains the following below. accept = local-val.dc-clic.com:8899 connect = val.dc-clic.com:443 The application fails to connect and is trying to connect using the incorrect url. Error Code: 202 Supplier Site Does Not Respond Unable to send the Login Request XML. Supplier Login URL: http://local-val.dc-clic.com:8899/punchout/request/0fd1ef2b-d09a-441d-b161-… We use stunnel as tls proxy for various suppliers and have been encountering more issues lately. I am feeling that the long string after the request is causing an issue for stunnel, but unclear to us. Our understanding is stunnel will open the connection to https:// val.dc-clic.com:443/punchout/request/0fd1ef2b-d09a-441d-b161-5ada0e226b80. Stunnel log indicates that a connection is opened to val.dc-clic.com. Any help appreciated! Thanks and best regards Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here: merckgroup.com/privacy-statement-countries<https://www.merckgroup.com/en/privacy-statement/privacy-statement-countries…>

1 0

stunnel log message
by Daniel Trickett 01 Apr '22

01 Apr '22

Hello all, Happy Friday! Hope I can get some clarification on this entry from the stunnel log. The below shows up in our log, our input to stunnel is SSLv3. Is that all this is referring to? TLS state (connect): SSLv3 Thanks for your reply! Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here: merckgroup.com/privacy-statement-countries<https://www.merckgroup.com/en/privacy-statement/privacy-statement-countries…>

1 0

Stunnel version 5.63 and openssl 3.0.2 CA signature digest algorithm too weak
by c t browne 30 Mar '22

30 Mar '22

I upgraded to version 5.63 on openssl 3.02 and received a CA signature digest algorithm too week error. I tried setting the securityLevel to 2 and also to 1 and the error did not go away. I have no way to change the certificate on the remove system. Is there an way around this problem? Thanks, Carter

2 2

Can parent proxy see what's going through stunnel
by mingheng wang 28 Mar '22

28 Mar '22

Hi community, I'm using stunnel behind my company proxy like this: protocol=connect connect=proxy.ourcompany.com:3128 protocolHost=myownproxy.net:443 Since I notice that our company seems to be intercepting HTTPS because my web browser sometimes sees our company's certificate instead of the real websites'. So I want to make sure if the company proxy can see what's going through stunnel. Thanks in advance.

1 0

Stunnel aborted the workflow silently in half way
by ygaochn＠amazon.com 25 Mar '22

25 Mar '22

Hey stunnel-users, We are using stunnel as the encryption transit between our NFS client and server. Recently we detected that the stunnel aborted the workflow silently in half way for unknown reason. We'd like to understand what could be the potential reason that cause the issue. Stunnel version: 4.56/5.56, below logs are for 4.56, 5.56 is from customer report without detail log Occurance #1: 2022.03.17 02:19:58 LOG7[1105:139990955783936]: connect_blocking: s_poll_wait IP:PORT: waiting 10 seconds # -> There should be a `TIMEOUTconnect exceeded` failure if the connection failed, but there is no info about how is the waiting going on, there is no log further 2022.03.17 02:56:09 LOG7[1105:139990955789440]: Dispatching signals from the signal pipe Occurance #2: 2022.03.23 16:10:49 LOG6[19003:140551554406144]: CERT: Host name "**" matched with "**" # Aborted again, this is the handshake phase 2022.03.23 16:56:09 LOG7[19003:140551554411648]: Dispatching signals from the signal pipe From the PCAP of the #2 occurance, there is no client side cert and key send to server side, so we can rule out the network issue. 8510 2022-03-23 16:09:47.660910 A B TLSv1.2 5507 Server Hello, Certificate[Packet size limited during capture] 8511 2022-03-23 16:09:47.660919 B A TCP 68 38390 → 2049 [ACK] Seq=340 Ack=5440 Win=57472 Len=0 TSval=698509941 TSecr=1821371384 ... No other client side packet send to server side afterwards, server side are waiting Does anyone encounter this before? I searched the archive but there is no similar issue. What could cause stunnel swallow all the subsequent workflow? Thanks.

1 0

Fix the expansion of @sysconfdir@ in the sample config file
by Peter Pentchev 19 Mar '22

19 Mar '22

Hi, Thanks a lot for writing and maintaining stunnel over the years! What do you think about the attached trivial patch that makes sure @sysconfdir@ is expanded correctly in the sample config file? If something should go wrong with the attachment, it is also available at: https://salsa.debian.org/debian/stunnel/-/blob/master/debian/patches/05-sam… Thanks in advance, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)debian.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

the stunnel stops showing the ssl after a few hours of operation
by Daniel Cordero Gonzalez 18 Mar '22

18 Mar '22

I send an image of the error presented by the stunnel

1 0

the stunnel stops showing the ssl after a few hours of operation
by daniel＠hostingtico.com 18 Mar '22

18 Mar '22

hello, thank you very much for the opportunity to humbly ask for help, I had a server with centos 6 for approximately 3 years and the stunnel never gave me any problem, I recently changed my server with centos 7 but now after a few hours of being active it stops showing the ssl in the ports that I have configured to show shoutcast when viewing the stunnel status: service stunnel status after a few hours it shows most of the result in red and there it does not show the shoutcast in ssl, after giving restart: service stunnel restart everything returns to normal but before 6 hours the problem returns, Could someone give me a light to solve this problem, I'm running the latest version of stunnel my stunnel.conf: client=no [Orto] accept=7000 connect=208.77.20.179:8006 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [radio] accept=7002 connect=208.77.20.179:9942 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [Metro] accept=7004 connect=208.77.20.179:8014 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [arrge] accept=7006 connect=208.77.20.179:8016 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [radio2] accept=7008 connect=208.77.20.179:9932 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [Radiored] accept=7010 connect=208.77.20.179:8023 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2

1 0

stunnel error message
by Stephen McQuaid 18 Mar '22

18 Mar '22

Hello, I am getting the following error message in stunnel 2022.03.18 14:27:01 LOG3[0]: SSL_read (s_ssl_read_eof): Operation would block (WSAEWOULDBLOCK) (10035) 2022.03.18 14:27:01 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket But when I send a second email immediately after the first one, it goes through ok, does anyone know how to resolve this please?? Regards, Stephen McQuaid Local I.T. Office, Dublin, Ireland Henkel dx - creating the next [Ein Bild, das Schild, Ende, sitzend, Front enth?lt. Automatisch generierte Beschreibung] Office : +353-1-4046338 Mobile: +353-87-2470012 stephen.mcquaid(a)henkel.com<mailto:stephen.mcquaid@henkel.com> www.henkeldx.com<http://www.henkeldx.com/> Have a question visit Digital Business Norden<https://henkelgroup.sharepoint.com/teams/IBSNITInfoPortal/SitePages/IBS-Nor…>

1 0

stunnel 5.63 released
by Michał Trojnara 15 Mar '22

15 Mar '22

Dear Users, I have released version 5.63 of stunnel. ### Version 5.63, 2022.03.15, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.2. * New features - Updated stunnel.spec to support bash completion. * Bugfixes - Fixed a PRNG initialization crash (thx to Gleydson Soares). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c74c4e15144a3ae34b8b890bb31c909207301490bd1e51bfaaa5ffeb0a994617 stunnel-5.63.tar.gz 723f54c28073f17b1ac095a2ab9922735c69f73fba6144a5c68cc160dc673b10 stunnel-5.63-win64-installer.exe c77850c39dfb42f95d26d4f5830a261a95c3785d8c39bdd9f28764ba43ee1d7d stunnel-5.63-android.zip Best regards, Mike

1 0

src/ssl.c:319 - RAND_get_rand_method() may return NULL
by Gleydson Soares 03 Mar '22

03 Mar '22

Hello, The following patch avoids crashess. In src/ssl.c:prng_init(), the RAND_get_rand_method() may return NULL so strict the check to skip PRNG initialization. Diff inline below, against 5.62 gsoares --- ssl.c.orig Thu Mar 3 16:10:39 2022 +++ ssl.c Thu Mar 3 16:13:17 2022 @@ -354,7 +354,7 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *global) { const RAND_METHOD *meth=RAND_get_rand_method(); /* skip PRNG initialization when no seeding methods are available */ - if(meth->status==NULL || meth->add==NULL) { + if(meth==NULL || meth->status==NULL || meth->add==NULL) { s_log(LOG_DEBUG, "No PRNG seeding methods"); return 0; /* success */ }

1 0

Error -63 when connecting to Office 365 to retrieve emails
by sedick＠logicore.co.za 01 Mar '22

01 Mar '22

Hi All, A problem started recently with error -63 when connecting to office 365 server to retrieve emails. The code I am using are as follows: * variables ChannelNo = 0 Pop3Server = 'outlook.office365.com' Pop3User = UserName Pop3Pass = Password Pop3Port = '995' ProxYServer = '127.0.0.1' ProxyPort = '110' ProxyDir = 'C:\see4OI\SSL\' ProxyExe = 'stunnel.exe' ProxyCert = 'stunnel.pem' * retreives mail in MIME format Gosub GET_EMAILS return Mail_Rec * ----------------------------------------------------------------------------------------- GET_EMAILS: * close previous session If it wasnt closed properly Code = seeClose(ChannelNo) Code = seeRelease() * attach key code Code = seeAttach(1, KeyCode) if Code < 0 then RetFlag = 1 return end * start stunnel Code = seeSetProxySSL(0, 1, ProxyDir, ProxyCert, ProxyExe) If Code < 0 Then RETURN end * connect to email server Code = seePop3ConnectSSL(ChannelNo, ProxyPort, Pop3Port, Pop3Server, Pop3User, Pop3Pass, ProxyServer) If Code < 0 Then RETURN End Help urgently required please. Stunnel version 5.42 with a special exception for OpenSSL Kind Regards, Sedick

1 0

SmtpConnectSSL question
by sportman7＠netzero.com 28 Feb '22

28 Feb '22

When I use SmtpConectSSL I establish the SSL connection but Stunnel opens a Stunnel window. I would like the connection to run without this window. Anyone know how I can stop the window from opening? Is there a setting in .conf or a parameter for SmtpConnectSSL I need?

1 0

Re: tunnel for IMAP/SMTP
by Eberhard 13 Feb '22

13 Feb '22

Just saying -- if something is deprecated it does not mean you MUST stop using it. Use an older version of the software. You can of course have both -- put the older version in one place and the newer one in another. Configure your system to use whichever version you need. The habit of always updating "just because" is sometimes not good for you 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com https://www.facebook.com/groups/286143052248115 -----Original Message----- From: Germano Massullo <germano.massullo(a)gmail.com> On Behalf Of Caterpillar Sent: Saturday, February 12, 2022 7:18 AM To: Josealf.rm <josealf(a)rocketmail.com> Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: tunnel for IMAP/SMTP Il 10/02/22 01:56, Josealf.rm ha scritto: > OK, I see you’re using stunnel only on your client and it looks you’re > connecting using TLS 1.0 which is deprecated. > > My proposed solution runs stunnel on your server and aims to implement > a front end proxy to the imap/smtp product. This can give you the > support for new TLS versions and no need to run stunnel on your clients. No, I don't have access to the mail server machine. I just installed stunnel on a localhost VM, then lowered the VM minimum accepted TLS to 1.0, and then run Thunderbird from host machine. The latter will connect to the stunnel running in the VM _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org

1 0

tunnel for IMAP/SMTP
by Caterpillar 12 Feb '22

12 Feb '22

Good day. I need to be able to use Thunderbird to connect to a mail server (IMAP/SMTP) that has an obsolete TLS version (1.1) and I don't want to low the TLS minimum version on my computers. For this need I would like to use stunnel between Thunderbid clients and the mail server. I tried to use tutorial [1] plus "sslVersion = all" option, but I think the guide is quite incomplete. Do you have any other guide/tutoral that is more complete? Thank you [1]: https://petermolnar.com/secure-smtp-and-imap-sessions-with-stunnel/

3 4

stunnel (5.62 and 5.59) causing high load...
by erik＠baigar.de 06 Feb '22

06 Feb '22

Hi there, I was running stunnel successfully for many years (4.26 with older openssl) wrapping http and imap and upgraded for security reasons to openssl 1.1.1 with stunnel 5.59. The platform is somewhat exotic: SPARC Solaris 10 using gcc 3.4.6. The stunnel works for imap and https without problems for some time but after heavy load conditions it starts consuming 100% CPU load although it still works. In this case it is not the DH computation as no ciphers depending on that one are used: 2022.02.06 11:56:33 LOG6[ui]: DH initialization skipped: no DH ciphersuites On the life machine it happens e.g. after some script based port scan attacks and in a way to trigger the phenomenon I found, that running a cipher enumberate for example triggers the "high-load" state. Running nmap 7.80 the command doing the job is nmap --script ssl-enum-ciphers -p PORT SERVER-IP Checking the log-file (level 7) the end of the logfile after such a burst of acitity with the stunnel ennding up at 100% CPU load looks like that: 2022.02.06 14:23:17 LOG7[39]: Deallocating application specific data for session connect address 2022.02.06 14:23:17 LOG7[39]: linger (local): Invalid argument (22) 2022.02.06 14:23:17 LOG7[39]: Local descriptor (FD=22) closed 2022.02.06 14:23:17 LOG7[39]: Service [imaps] finished (6 left) 2022.02.06 14:23:14 LOG7[main]: FD=4 events=0x1 revents=0x1 2022.02.06 14:23:17 LOG7[main]: FD=11 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=12 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=13 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: FD=14 events=0x1 revents=0x0 2022.02.06 14:23:17 LOG7[main]: Dispatching a signal from the signal pipe 2022.02.06 14:23:17 LOG7[main]: Processing SIGCHLD 2022.02.06 14:23:17 LOG7[main]: Retrieving pid statuses with waitpid() 2022.02.06 14:23:17 LOG7[main]: Retrieving pid statuses with waitpid() - DONE Remarkable is that some imaps (we named the IMAP service to be wrapped imaps) still seem to remain active (6 left). The last entry always is the one with the waitpid() and to be sure that it is not the while loop in that one (stunnel.c) I added an additional log entry "DONE" in the source whenever the routine is left - so it is not that easy. The workaround currently is a script monitoring the CPU usage of stunnel and killing/restarting it if >80% for extended period of time is observed, but that can just be a temporary solution. Any ideas what to try/debug locating the reason for the problem? Thanks, Erik. P.S. Experimenting with the timeouts does not alter the phenomenon. P.P.S. Here the active lines of the config file (deleted comments and unused lines to remove clutter): cert = /usr/local/etc/stunnel/stunnel.pem sslVersion = all chroot = /var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [imaps] accept = 14310 connect = 143 local = 127.0.0.1

1 0

Re: stunnel 5-15 minute outages
by Eberhard 05 Feb '22

05 Feb '22

I a hate to sound like a broken record – why not at least try inetd mode for a few days? If nothing else it will tell you if it is stunnel (either server issues or problems with continuing running programs) with little cost to you to try it. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com> Sent: Saturday, February 5, 2022 3:01 AM To: john.robertson.arnold(a)gmail.com Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: stunnel 5-15 minute outages We haven't taken any actions yet. We have so far believed that it was a network side issue, so we have been looking hard at the network devices and getting vendor cases open. We have been looking at packet captures to see if we can figure it out. We haven't found anything that points to the network, but still looking at that. Do you happen to have any load balancers in front of stunnel? I plan to recommend some changes to stunnel suggested in this thread. Thanks, and sorry you are facing this same issue. On Fri, Feb 4, 2022 at 11:36 PM <john.robertson.arnold(a)gmail.com <mailto:john.robertson.arnold@gmail.com> > wrote: I second your problem! We are experiencing what sounds like the same issue. We have had 8 outages since November. They come in pairs, roughly 48 hours apart. Each outage is between 10-12 minutes, then self resolves. I literally just came to this thread tonight while troubleshooting the latest outage. Did the suggestion in the thread work for you? _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org <mailto:stunnel-users-leave@stunnel.org> -- Steve Clement steve3279(a)gmail.com <mailto:steve3279@gmail.com> 614-632-7380

1 0

Re: stunnel 5-15 minute outages
by Eberhard 05 Feb '22

05 Feb '22

Which is why my advice is “strange.” We support so many Unix versions with thousands of users of various capabilities. I don’t want to have to learn secret tricks – especially as they change with versions of the O/S. So I use inetd – all the same on every O/S and always works. I see no reason not to do this unless you have a belief that there is a performance issue with it, which is possible I suppose but I suspect completely unlikely in modern computers. Further, inetd is running anyway so the server part is hardly affected by stunnel whereas if you use stunnel in server mode it has overhead … so a real picky person would do performance analysis and it still may be more efficient to use inetd depending on server overhead. Which is like different by O/S and computer hardware and … I worry about performance only when it actually matters. I’d rather concern myself with reliable with less maintenance on my part. My primary O/S is AIX which is stone reliable and requires little fussing with – hence using AIX to do the server part (inetd) makes my life easier. And probably 95% of the people here will disagree with me and that is fine because there is no “right” answer, just choices. I just think some people dismiss inetd out of hand because they were told a decade or two ago (I am old 😊 ) that performance was an issue and that remains the legend. And, I have helped several people overcome issues by changing to inetd, especially those with little experience in server management and/or O/S settings like Danny did (good job!). So please don’t flame me people – this is just explaining why one might consider using inetd mode, not making a case to always use it. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Danny Clowes <danny0809881(a)gmail.com> Sent: Friday, February 4, 2022 1:21 PM To: Eric Eberhard <flash(a)vicsmba.com> Cc: Steve Clement <steve3279(a)gmail.com>; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re: stunnel 5-15 minute outages Hi, Ive been using stunnel on number of servers for very long time over all experience has been very good not had any issues or concerns with the stunnel they never crash always online. Ive just tested stunnel on debian 11 it's working brilliant. The Linux system do have limitations in place and the client will only allow so many connections before it will close down say can't take anymore connections however I edited the Linux server remove limitation in place. These where teething issues when started to use stunnel. If anyone interested I would provide hidden scrects how make stunnel work like dream. On Fri, 4 Feb 2022, 19:04 Eberhard, <flash(a)vicsmba.com <mailto:flash@vicsmba.com> > wrote: I will give you strange advice assuming you are on Unix of some flavor. Use inetd. It always works or the O/S does not work 😊 It then becomes the actual server and a new instance of stunnel is fired for every connection. I use it because it is the most reliable way and takes no server software management. There is an old argument against this – it is in theory has less performance when a correction is created. I say theoretical as modern computers are so fast that creating a process millions of times does not stress a machine. I run 100s of millions of connections daily on a single computer and have zero performance issues. I also have zero issues like you described and I always had them before. Even if you do have an issue it would only affect one connection. Because each connection is unique. From your description it is the server process having an issue or perhaps some of the children not getting “clean” as they keep them running in a loop. With inetd it does it’s business and ends. There are no cross-connection or server issues. I give this advice several times a year and may ¼ take it and thank me. The rest mock the idea citing the theoretical performance difference (without even trying it) and continue to struggle. This is not just an issue with this version. Many versions have had trouble with running in a loop like that – memory management, variables not cleared, etc. And remember openssl is tied to this as well. The other thing I would recommend (also weird) is using static links. That way an install of say a new openssl (where your encryption issue appears to be now) won’t affect you. There is no way anyone is testing the software with every version of every O/S with every version of openssl. If you do a static link and have a working version, no need to change. Until a new TLS comes out or something but you can control that well when you have a static link. And that, BTW, theoretically loads faster. The program is much bigger but in need not load dynamic libraries from all over the place when it is fired up. Let me know what you find out and do 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com <mailto:steve3279@gmail.com> > Sent: Friday, February 4, 2022 4:52 AM To: stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Subject: [stunnel-users] stunnel 5-15 minute outages Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com <mailto:steve3279@gmail.com> 614-632-7380 _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org <mailto:stunnel-users-leave@stunnel.org>

3 2

stunnel 5-15 minute outages
by Steve Clement 05 Feb '22

05 Feb '22

Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com 614-632-7380

2 2

Re: stunnel 5-15 minute outages
by Eberhard 04 Feb '22

04 Feb '22

I will give you strange advice assuming you are on Unix of some flavor. Use inetd. It always works or the O/S does not work 😊 It then becomes the actual server and a new instance of stunnel is fired for every connection. I use it because it is the most reliable way and takes no server software management. There is an old argument against this – it is in theory has less performance when a correction is created. I say theoretical as modern computers are so fast that creating a process millions of times does not stress a machine. I run 100s of millions of connections daily on a single computer and have zero performance issues. I also have zero issues like you described and I always had them before. Even if you do have an issue it would only affect one connection. Because each connection is unique. From your description it is the server process having an issue or perhaps some of the children not getting “clean” as they keep them running in a loop. With inetd it does it’s business and ends. There are no cross-connection or server issues. I give this advice several times a year and may ¼ take it and thank me. The rest mock the idea citing the theoretical performance difference (without even trying it) and continue to struggle. This is not just an issue with this version. Many versions have had trouble with running in a loop like that – memory management, variables not cleared, etc. And remember openssl is tied to this as well. The other thing I would recommend (also weird) is using static links. That way an install of say a new openssl (where your encryption issue appears to be now) won’t affect you. There is no way anyone is testing the software with every version of every O/S with every version of openssl. If you do a static link and have a working version, no need to change. Until a new TLS comes out or something but you can control that well when you have a static link. And that, BTW, theoretically loads faster. The program is much bigger but in need not load dynamic libraries from all over the place when it is fired up. Let me know what you find out and do 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Steve Clement <steve3279(a)gmail.com> Sent: Friday, February 4, 2022 4:52 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel 5-15 minute outages Hello, I have been working on an issue that seems a lot like this one: https://www.stunnel.org/pipermail/stunnel-users/2011-January/002898.html We are running stunnel 5.56 and it has been working with no issues until November. Since November there have been 6 short 5-15 minute outages where we see network traffic between client and server in the packet captures, but stunnel logs stop during this period. Everything recovers on its own after this brief outage. I am looking for help in what to look for to explain this. Feb 2 14:49:29 *host* stunnel: LOG5[22565874]: Connection closed: 83 byte(s) sent to TLS, 74 byte(s) sent to socket Feb 2 15:00:36 *host* stunnel: LOG6[2705685]: Peer certificate not required We usually see dozens of messages every second, so to have an 11 minute gap in the logs is unusual. Any help would be appreciated, thank you. -- Steve Clement steve3279(a)gmail.com <mailto:steve3279@gmail.com> 614-632-7380

2 1

Use Stunnel with CMD
by gilaguigui＠gmail.com 02 Feb '22

02 Feb '22

Hi, I am trying to use stunnel with CMD (as a service) I get pop up message for each command (service installed \ service stopped etc.) the command in CMD: stunnel.exe -install\ -uninstall.... how can I disable it? run stunnel with no pop up? thanks GG.

1 0

New to stunnel! Need help connecting to a REST API
by Tim Townsend 18 Jan '22

18 Jan '22

Hello! I need help! We have an integration from an ERP package to a REST API (Avatax) that will soon be requiring TLS 1.2 connections. Our tech platform does not have built-in support for TLS 1.2, so I'm hoping to be able to use stunnel to make that happen. Where do I start? What would the conf file section look like for this? I don't see this directly discussed in the documentation. Any help appreciated! [cid:image001.jpg@01D80C02.6F1F2690] Tim Townsend Programmer Earnest & Associates * Profitability Improvement Specialists Voice: 410.766.6076<tel:+14107666076> ext 210 Email: tim.townsend(a)earnestassoc.com<mailto:tim.townsend@earnestassoc.com> * Web: earnestassoc.com<http://www.earnestassoc.com/>

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users