- stunnel-users - stunnel.org

stunnel 5.62 released
by Michał Trojnara 17 Jan '22

17 Jan '22

Dear Users, I have released version 5.62 of stunnel. ### Version 5.62, 2022.01.17, urgency: MEDIUM * New features - Added a bash completion script. * Bugfixes - Fixed a transfer() loop bug. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 9cf5bb949022aa66c736c1326554cca27d0641605a6370274edc4951eb5bd339 stunnel-5.62.tar.gz fbfcc5759344bcafff9ff3bc6cf56c7fb75cb1244b76d4934c5d9a3eb7eee32d stunnel-5.62-win64-installer.exe 4b52ed6e4bb8293fdefb10ee8c271400a8c1749254a11b674ff690eae00b3c5e stunnel-5.62-android.zip Best regards, Mike

1 0

Re: stunnel 5.61transfer() loop executes not transferring any data Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket inetd mode
by Roberto CORRADO 17 Jan '22

17 Jan '22

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Mike, Good job! Stunnel 5.62 beta 1 work fine! """ 2022.01.16 22:08:47 LOG6[ui]: Initializing inetd mode configuration 2022.01.16 22:08:47 LOG5[ui]: stunnel 5.62 on i586-slackware-linux-gnu platform 2022.01.16 22:08:47 LOG5[ui]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2022.01.16 22:08:47 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2022.01.16 22:08:47 LOG6[ui]: Initializing inetd mode configuration 2022.01.16 22:08:47 LOG5[ui]: Reading configuration from file /etc/stunnel/imaps.conf 2022.01.16 22:08:47 LOG5[ui]: UTF-8 byte order mark not detected 2022.01.16 22:08:47 LOG5[ui]: FIPS mode disabled 2022.01.16 22:08:47 LOG6[ui]: Compression enabled: 0 methods 2022.01.16 22:08:47 LOG6[ui]: stunnel default security level set: 2 2022.01.16 22:08:47 LOG6[ui]: Session resumption enabled 2022.01.16 22:08:47 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2022.01.16 22:08:47 LOG6[ui]: DH initialization needed for DHE-RSA-AES256-GCM-SHA384 2022.01.16 22:08:47 LOG6[ui]: 4096-bit DH parameters loaded 2022.01.16 22:08:47 LOG5[ui]: Configuration successful 2022.01.16 22:08:47 LOG5[0]: Service [stunnel] accepted connection from 10.19.79.235:41136 2022.01.16 22:08:47 LOG6[0]: Peer certificate not required 2022.01.16 22:08:47 LOG6[0]: No peer certificate received 2022.01.16 22:08:47 LOG6[0]: Session id: 65640462303D0DA1CD16CAB4977F22B04FFB74693150104FC69AB9FBDC48AED9 2022.01.16 22:08:47 LOG6[0]: No peer certificate received 2022.01.16 22:08:47 LOG6[0]: Session id: B9505D917FA6F2E9C8A0EF14D6E4B01C3ED54599271D93E325ED7412CA2AC5F3 2022.01.16 22:08:47 LOG6[0]: TLS accepted: new session negotiated 2022.01.16 22:08:47 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.01.16 22:08:47 LOG6[0]: Peer temporary key: X25519, 253 bits 2022.01.16 22:08:47 LOG6[0]: Local mode child started (PID=16984) 2022.01.16 22:08:47 LOG6[0]: TLS closed (SSL_read) 2022.01.16 22:08:47 LOG6[0]: Read socket closed (readsocket) 2022.01.16 22:08:47 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2022.01.16 22:08:47 LOG5[0]: Connection closed: 979 byte(s) sent to TLS, 128 byte(s) sent to socket """ Thanks a lot! - -Roberto -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAmHkjDoACgkQWVOoL214ZeGntwCbBtV1G/J2uThR06ftFC+F2XTP KeQAnjnCTOrk26zzcsNsCOQoWg54MWhD =alm2 -----END PGP SIGNATURE----- ----- Original Message ----- Sent: Sunday, January 16, 2022 9:52 PM Michał Trojnara wrote: > Hi Roberto, > > Could you try https://www.stunnel.org/downloads/beta/stunnel-5.62b1.tar.gz ? > > Best regards, > Mike

2 1

I NEED A HELP TO SETUP THE SSL/TLS EMAILS SUPPORT
by Muj 01 Jan '22

01 Jan '22

HI TECHNICAL SUPPORT, FIRSTLY, I AM APOLOGIZING TO YOU FOR WRITING WITH LARGE CAPS ONLY, IT IS BECAUSE RECENTLY I GOT A BRAIN STROKE AND AM NOT RECOVERED YET. AS FOR MY ISSUE, TO UNDERSTAND IT BETTER, THE FOLLOWING IS MY INFO. - I HAVE AN OLD WINDOWS-XP 32BIT OS. - I AM USING TERABYTE 2.99 TO BACKUP AND RESTORE MY OS, BUT LOOSING MANY EMAILS BECAUSE TERABYTE IS NO LONGER SUPPORTING 2.99 VERSION. THEY SUPPORT RESTORING ALL EMAILS BEGINNING FROM 3 VERSION. THEREFORE, THEY HAVE RECOMMENDED ME TO CONTACT YOU DIRECTLY. NOW WHAT I DID SO FAR. - I DOWNLOADED AND INSTALLED YOUR STUNNEL 4.53 - AFTER AUTOMATIC SETTING, EDITING STUNNEL.CONF FILE, MAKING SOME CHANGES IN IT AND SAVING IT, THE SERVER WENT DOWN. ATTACHED PLEASE FIND STUNNEL.CONF TXT FILE. - BECAUSE THE SERVER WENT DOWN, I TRIED TO DOWNLOAD AND INSTALL STUNNEL AGAIN, BUT ALWAYS GOT THE SAME ERROR MESSAGE.PLEASE CAN YOU HELP ME WITH THIS ISSUE? - I HAVE 3 POP3 EMAIL ACCOUNTS AND 1 IMAP. ALL REQUIRE A CONNECTION SECURITY SSL/TLS. *PLEASE, I NEED TO KNOW HOW **TO COMPLETELY REMOVE THE CURRENT STUNNEL PROGRAM AND AFTER THAT, WHAT STUNNEL VERSION I SHOULD **DOWNLOAD AGAIN **TO BE ABLE TO SET IT UP*. AFTER A SUCCESSFUL NEW INSTALLATION I WOULD GIVE YOU MORE NEEDED INFO FOR SETTING UP MY EMAILS. PLEASE LET ME KNOW IN YOUR BEST CONVENIENCE AND HAVE A BEAUTIFUL NEW YEAR 2022. KIND REGARDS, MARTIN

1 0

stunnel 5.61transfer() loop executes not transferring any data Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket inetd mode
by Roberto CORRADO 29 Dec '21

29 Dec '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 """ 2021.12.28 14:03:40 LOG6[ui]: Initializing inetd mode configuration 2021.12.28 14:03:40 LOG5[ui]: stunnel 5.61 on i586-slackware-linux-gnu platform 2021.12.28 14:03:40 LOG5[ui]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2021.12.28 14:03:40 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.12.28 14:03:40 LOG6[ui]: Initializing inetd mode configuration 2021.12.28 14:03:40 LOG5[ui]: Reading configuration from file /etc/stunnel/imaps.conf 2021.12.28 14:03:40 LOG5[ui]: UTF-8 byte order mark not detected 2021.12.28 14:03:40 LOG5[ui]: FIPS mode disabled 2021.12.28 14:03:40 LOG6[ui]: Compression enabled: 0 methods 2021.12.28 14:03:40 LOG6[ui]: stunnel default security level set: 2 2021.12.28 14:03:40 LOG6[ui]: Session resumption enabled 2021.12.28 14:03:40 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2021.12.28 14:03:40 LOG6[ui]: DH initialization skipped: no DH ciphersuites 2021.12.28 14:03:40 LOG5[ui]: Configuration successful 2021.12.28 14:03:40 LOG5[0]: Service [stunnel] accepted connection from 127.0.0.1:40876 2021.12.28 14:03:40 LOG6[0]: Peer certificate not required 2021.12.28 14:03:40 LOG6[0]: No peer certificate received 2021.12.28 14:03:40 LOG6[0]: Session id: 0E092C2715D12901219C3E0F54DFA029F7C50040C7EC8F8C88211BA6883B9D1F 2021.12.28 14:03:40 LOG6[0]: No peer certificate received 2021.12.28 14:03:40 LOG6[0]: Session id: 26CFB9D13C499CE27C4ED1575FDF3FB2604C616418BA6068849B49EF75AF2162 2021.12.28 14:03:40 LOG6[0]: TLS accepted: new session negotiated 2021.12.28 14:03:40 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2021.12.28 14:03:40 LOG6[0]: Peer temporary key: X25519, 253 bits 2021.12.28 14:03:40 LOG6[0]: Local mode child started (PID=4997) 2021.12.28 14:03:40 LOG3[0]: transfer() loop executes not transferring any data 2021.12.28 14:03:40 LOG3[0]: please report the problem to Michal.Trojnara(a)stunnel.org 2021.12.28 14:03:40 LOG3[0]: stunnel 5.61 on i586-slackware-linux-gnu platform 2021.12.28 14:03:40 LOG3[0]: Compiled/running with OpenSSL 1.1.1m 14 Dec 2021 2021.12.28 14:03:40 LOG3[0]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.12.28 14:03:40 LOG3[0]: protocol=TLSv1.3, SSL_pending=0, SSL_has_pending=0 2021.12.28 14:03:40 LOG3[0]: sock_open_rd=Y, sock_open_wr=Y 2021.12.28 14:03:40 LOG3[0]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2021.12.28 14:03:40 LOG3[0]: sock_can_rd=n, sock_can_wr=n 2021.12.28 14:03:40 LOG3[0]: ssl_can_rd=n, ssl_can_wr=n 2021.12.28 14:03:40 LOG3[0]: read_wants_read=Y, read_wants_write=n 2021.12.28 14:03:40 LOG3[0]: write_wants_read=n, write_wants_write=Y 2021.12.28 14:03:40 LOG3[0]: shutdown_wants_read=n, shutdown_wants_write=n 2021.12.28 14:03:40 LOG3[0]: socket input buffer: 154 byte(s), TLS input buffer: 0 byte(s) 2021.12.28 14:03:40 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket """ """ debug = info output = /var/log/stunnel-imaps.log cert = /etc/stunnel/stunnel.pem exec = /usr/sbin/imapd execargs = imapd sslVersion = all options = NO_SSLv2 options = NO_SSLv3 """ -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAmHLE48ACgkQWVOoL214ZeFpYwCfe+qv09KWSfjNixhhcb5MJbr2 yAkAoKOyXZJwnKddSXYzIhbi7k1yPkoU =oGR+ -----END PGP SIGNATURE-----

1 0

Config to only listen when connect port is up
by roartysa＠gmail.com 23 Dec '21

23 Dec '21

Is there a config flag that can be set in the conf file that will tell stunnel to listen on the https accept port only when the connect port is up and listening? The issue i am trying to address is when a load balancer talks to a server, I need to make sure the port that stunnel redirects to is healthy. Right now the load balancer will send traffic to the port all the time regardless of the health of the port that stunnel redirects the traffic to.

2 1

stunnel 5.61 released
by Michał Trojnara 22 Dec '21

22 Dec '21

Dear Users, I have released version 5.61 of stunnel. ### Version 5.61, 2021.12.22, urgency: LOW * New features sponsored by the University of Maryland - Added new "protocol = capwin" and "protocol = capwinctrl" configuration file options. * New features for the Windows platform - Added client mode allowing authenticated users to view logs, reconfigure and terminate running stunnel services. - Added support for multiple GUI and service instances distinguised by the location of stunnel.conf. - Improved log window scrolling. - Added a new 'Pause auto-scroll' GUI checkbox. - Double click on the icon tray replaced with single click. - OpenSSL DLLs updated to version 3.0.1. * Other new features - Rewritten the testing framework in python (thx to Peter Pentchev for inspiration and initial framework). - Added support for missing SSL_set_options() values. - Updated stunnel.spec to support RHEL8. * Bugfixes - Fixed OpenSSL 3.0 build. - Fixed reloading configuration with "systemctl reload stunnel.service". - Fixed incorrect messages logged for OpenSSL errors. - Fixed printing IPv6 socket option defaults on FreeBSD. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 91ea0ca6482d8f7e7d971ee64ab4f86a2817d038a372f0893e28315ef2015d7a stunnel-5.61.tar.gz 19c5ff1f4101af1e69585328303c14249db2ec9063542101ca31edb6f6cc502f stunnel-5.61-win64-installer.exe 928ec94690564498bf523228946b2cdc90c7e346d6f0baf1f71b76cbe769b96c stunnel-5.61-android.zip Best regards, Mike

1 0

Log4j Vulnerability
by Tracy Drake - IQGC-C 17 Dec '21

17 Dec '21

Hello! Can you please tell me if Stunnel uses log4j and/or if it is vulnerable to it? Your feedback would be greatly appreciated! Thanks in advance! -- *TRACY DRAKE | CSM URSA/Infoconnect Training and Support* GSA COMET Hale Bopp Contract Work Phone: 704-253-5193 | Email: tracy.drake(a)gsa.gov

2 1

issue with connection sending cxml out
by Daniel Trickett 08 Dec '21

08 Dec '21

Hi, We are trying to send a cxml message from an old app using ssl_v3 to a client server using tls 1.2. We negotiate a connection and then the below happens. Any thoughts? This is on our test server. 2021.12.08 14:26:55 LOG6[12]: TLS connected: new session negotiated 2021.12.08 14:26:55 LOG6[12]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2021.12.08 14:26:55 LOG7[12]: Compression: null, expansion: null 2021.12.08 14:26:55 LOG7[12]: TLS alert (read): warning: close notify <<< 2021.12.08 14:26:55 LOG6[12]: TLS closed (SSL_read) 2021.12.08 14:26:55 LOG7[12]: Sent socket write shutdown 2021.12.08 14:26:55 LOG6[12]: Read socket closed (readsocket) 2021.12.08 14:26:55 LOG7[12]: Sending close_notify alert 2021.12.08 14:26:55 LOG7[12]: TLS alert (write): warning: close notify 2021.12.08 14:26:55 LOG6[12]: SSL_shutdown successfully sent close_notify alert 2021.12.08 14:26:55 LOG5[12]: Connection closed: 10187 byte(s) sent to TLS, 561 byte(s) sent to socket Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here emdgroup.com/en/privacy-statement.html<https://www.emdgroup.com/en/privacy-statement.html>

1 0

Revert automatically to https
by cnocera＠hyhat.com 08 Dec '21

08 Dec '21

With stunnel, is there a way for the website to automatically revert to https by just typing in the url without https:// in front of it?

1 0

Insecure file permissions on /etc/ssl/private.key
by jose isaias cabrera 29 Nov '21

29 Nov '21

Greetings! I have duckduckgo'ed and I have not found an answer, but what should be the permissions for the private key since the stunnel is giving me a warning/error regarding that: ... [ ] Loading private key from file: /etc/ssl/private.key [:] Insecure file permissions on /etc/ssl/private.key [ ] Private key loaded from file: /etc/ssl/private.key ... this is that I have set: jic@web:~$ ls -l /etc/ssl/private.key -rw-r--r-- 1 root www-data 1702 Oct 13 02:54 /etc/ssl/private.key the www-data is the user that runs the website. All is running well, apparently, but, I would like to set the correct permission on the private.key file. Thanks for your support. josé -- What if eternity is real? Where will you spend it? Hmmmm...

4 6

Althttpd web server setup using ZeroSSL
by jose isaias cabrera 29 Nov '21

29 Nov '21

Greetings! I have the ssl files from ZeroSSL, and I am trying to set up https using stunnel4 on an ubuntu server. I am new to https, I would love some of your help setting this up. Here is what I have done so far: 1. Installed Althttpd and http is working fine on the home network and from the external network. 2. I have installed stunnel4 on the ubuntu server jcabrera@selva:~$ stunnel -v [ ] Clients allowed=500 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled with OpenSSL 1.1.1c 28 May 2019 [.] Running with OpenSSL 1.1.1f 31 Mar 2020 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [!] Invalid configuration file name "-v" [!] realpath: No such file or directory (2) [ ] Deallocating section defaults 3. I have placed the ZeroSSl ssl files on the ssl directory as per ZeroSSL instructions jcabrera@selva:~$ ls -l /etc/ssl/*.crt -rw-r--r-- 1 root root 2431 Oct 20 16:27 /etc/ssl/ca_bundle.crt -rw-r--r-- 1 root root 2354 Oct 20 16:31 /etc/ssl/certificate.crt root@selva:/home/jcabrera# ls -l /etc/ssl/private/*.key -rw-r--r-- 1 root root 1702 Oct 20 16:33 /etc/ssl/private/private.key 4. Created the the /etc/stunnel/stunnel.conf file with these entries: root@selva:/home/jcabrera# cat /etc/stunnel/stunnel.conf cert = /etc/ssl/certificate.crt key = /etc/ssl/private/private.key \[https\] accept = :::443 TIMEOUTclose = 0 exec = /usr/bin/althttpd execargs = /usr/bin/althttpd -logfile ~/www/http.log -root ~/www -user www-data -https 1 And, I don't know what else to do. Any help would be greatly appreciated. Thanks. josé -- What if eternity is real? Where will you spend it? Hmmmm...

2 3

Office 365 connections stopped working
by Ben Bazian 26 Nov '21

26 Nov '21

This has been working for years and recently stopped. I am a novice here. Can someone look at this and please tell me what is happening? It is an old server that does not support TLS so we put Stunnel in front of it. I am sure the version of stunnel is pretty old. Maybe a TLS level issue? 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG6[21968:139797665822784]: Initializing service [SMTP Outgoing] 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG6[21968:139797665822784]: Initializing service [IMAP] 2021.10.26 14:47:30 LOG7[21968:139797665822784]: SSL options set: 0x01000004 2021.10.26 14:47:30 LOG5[21968:139797665822784]: Configuration successful 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [POP3 Incoming] (FD=12) bound to 0.0.0.0:110 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [SMTP Outgoing] (FD=13) bound to 0.0.0.0:25 2021.10.26 14:47:30 LOG7[21968:139797665822784]: Service [IMAP] (FD=14) bound to 0.0.0.0:143 2021.10.26 14:47:30 LOG7[21974:139797665822784]: Created pid file /var/run/stunnel.pid 2021.10.26 14:48:30 LOG7[21974:139797665822784]: Service [IMAP] accepted (FD=3) from 10.55.3.159:1852 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] started 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Waiting for a libwrap process 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Acquired libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Releasing libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Released libwrap process #0 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] permitted by libwrap from 10.55.3.159:1852 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Service [IMAP] accepted connection from 10.55.3.159:1852 2021.10.26 14:48:30 LOG6[21974:139797665818368]: connect_blocking: connecting 52.96.87.226:993 2021.10.26 14:48:30 LOG7[21974:139797665818368]: connect_blocking: s_poll_wait 52.96.87.226:993: waiting 10 seconds 2021.10.26 14:48:30 LOG5[21974:139797665818368]: connect_blocking: connected 52.96.87.226:993 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Service [IMAP] connected remote server from 10.55.3.200:51358 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Remote socket (FD=16) initialized 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SNI: sending servername: outlook.office365.com 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SSL state (connect): before/connect initialization 2021.10.26 14:48:30 LOG7[21974:139797665818368]: SSL state (connect): SSLv3 write client hello A 2021.10.26 14:48:30 LOG3[21974:139797665818368]: SSL_connect: Peer suddenly disconnected 2021.10.26 14:48:30 LOG5[21974:139797665818368]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Remote socket (FD=16) closed 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Local socket (FD=3) closed 2021.10.26 14:48:30 LOG7[21974:139797665818368]: Service [IMAP] finished (0 left)

4 5

setting permissions on a unix socket
by David Mandelberg 03 Nov '21

03 Nov '21

Hi, Is there any way for stunnel to set permissions on a unix socket created with the `accept` option? I see setuid and setgid at https://www.stunnel.org/static/stunnel.html but nothing about a umask or permissions. P.S. The link on https://www.stunnel.org/lists.html to see the archive is broken. Apologies if this has come up before.

1 0

Stunnel connection to Akamai Cloud Servers (Hostheaders) with SNI
by Alan C. Bonnici 06 Oct '21

06 Oct '21

Hi, I am trying to use stunnel to exchange data with a service hosted on Akamai Servers. There is a need to implement SNI. In posts dated from 2016 which I found online, Stunnel did not support Host Headers. Is there a workaround, or has Stunnel implemented this functionality? I will be testing using postman. A sample config to get me going would really be appreciated. The URL is related to plivo. It is ak-api.plivo.com. Thank you in anticipation.

3 6

Is it possible to inhibit writing the stunnel logs to the / var / log / messages file?
by simona vittori 28 Sep '21

28 Sep '21

Hello, I ask you if it's possible to inhibit writing the stunnel logs to the / var / log / messages file. How do you it? Thank you in advance Bye Simona

2 1

Need a clean way to reject a client IP
by robin.kerdiles＠emanrisk.fr 28 Sep '21

28 Sep '21

Hello everyone, I'm doing a few tests on a dockerized service for stunnel under Alpine. stunnel -version stunnel 5.60 on x86_64-alpine-linux-musl platform Compiled with OpenSSL 1.1.1k 25 Mar 2021 Running with OpenSSL 1.1.1l 24 Aug 2021 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI If I set a wrong certificate on client side, my server logs get spammed with these lines : 2021.09.28 07:43:52 LOG5[66]: Service [***] accepted connection from *** 2021.09.28 07:43:52 LOG4[66]: CERT: Pre-verification error: unable to get local issuer certificate 2021.09.28 07:43:52 LOG4[66]: Rejected by CERT at depth=2: C=***, O=***, CN=*** 2021.09.28 07:43:52 LOG3[66]: SSL_accept: ssl/statem/statem_srvr.c:3711: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed 2021.09.28 07:43:52 LOG5[66]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket The cpu usage goes up to 35% and it seems there is no way to set a timeout before trying to reconnect on client side (which is not the perfect fix by the way). On server side, I don't know if we are supposed to be able to do something about that (for example rate limiting the requests ?). Even the fail2ban filter doesn't seem to support this case. And anyway it seems it requires manual patching on stunnel source code for the logs. Would it be possible to put on the same line the client IP and a message about the connection which has been rejected ? fail2ban filter : https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/stunnel.co… What would be appreciated -> a log line in this format : 2021.09.28 07:43:52 LOG4[66]: HOST has been rejected by CERT at depth=2: C=***, O=***, CN=*** Of course, I don't have in mind the other possible cases (missing cert, etc...). Thank you in advance, Robin KERDILES

2 1

Disguising HTTP 503 services unavailable
by Haruka Takagi 18 Sep '21

18 Sep '21

It is my understanding that; stunnel clients give up connecting servers because of HTTP 503 services unavailable, tunneling failure causes stunnel clients to notify original senders of errors, and original senders acknowledge communication failure and stop program. I would like stunnel clients to reconnecting servers in cases of 503 and not to notify original senders of failure, in order that original senders are unaware of failure and can continue program. If possible, I want to do this by writing stunnel.conf without modifying souce codes. Is this configuration possible?

4 5

protocol = proxy with redirect
by Rob Hoes 15 Sep '21

15 Sep '21

Hi, I am using client certificate verification with the redirect option, so that the connection gets transferred to a separate socket in case the certificate is not accepted (rather than dropping the connection). This works well, unless I add the option “protocol = proxy” in order to get the client’s TCP params passed on. In this case, the redirect option seems to be ignored. Are the “redirect” and “protocol = proxy” options incompatible with one another? Is there an alternative? Thanks, Rob

2 1

How to resolve DNS by stunnel?
by shiga＠smart-cast.co.jp 14 Sep '21

14 Sep '21

Hi, I'm facing DNS issues when connecting to a server using a dynamic IP address. I think stunnel refers to DNS at startup, so if the IP address changes in the middle, it will get a connection error. Can this be resolved with the "delay=on" option? I'm looking for a way to handle a dynamic IP address in stunnel. Thanks.

2 1

Session reuse problem
by Alen Loncaric 10 Sep '21

10 Sep '21

Hi guys, any reason my stunnel would not reuse sessions? 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): before SSL initialization 2021.09.09 13:14:00 LOG6[8]: writesocket: Socket is closed 2021.09.09 13:14:00 LOG7[9]: Initializing application specific data for session authenticated 2021.09.09 13:14:00 LOG5[8]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:00 LOG7[8]: Remote descriptor (FD=10) closed 2021.09.09 13:14:00 LOG7[8]: Local descriptor (FD=3) closed 2021.09.09 13:14:00 LOG7[8]: Service [squid] finished 2021.09.09 13:14:00 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:00 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:00 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:00 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:00 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:00 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:00 LOG6[ui]: Process 1933 finished with code 0 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server hello 2021.09.09 13:14:00 LOG6[9]: Certificate verification disabled 2021.09.09 13:14:00 LOG6[9]: Certificate verification disabled 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server certificate 2021.09.09 13:14:00 LOG6[9]: Client certificate not requested 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server done 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write client key exchange 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write change cipher spec 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server session ticket 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read change cipher spec 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read finished 2021.09.09 13:14:00 LOG7[9]: New session callback 2021.09.09 13:14:00 LOG7[9]: Peer certificate was cached (2037 bytes) 2021.09.09 13:14:00 LOG6[9]: Session id: DC783240F69C6910A2F8B9829504840EF619E30A14FEA982C944FBFB6828555F 2021.09.09 13:14:00 LOG7[9]: 1 client connect(s) requested 2021.09.09 13:14:00 LOG7[9]: 1 client connect(s) succeeded 2021.09.09 13:14:00 LOG7[9]: 0 client renegotiation(s) requested 2021.09.09 13:14:00 LOG7[9]: 0 session reuse(s) 2021.09.09 13:14:00 LOG6[9]: TLS connected: new session negotiated 2021.09.09 13:14:00 LOG6[9]: TLSv1.2 ciphersuite: AES128-GCM-SHA256 (128-bit encryption) 2021.09.09 13:14:00 LOG3[9]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2021.09.09 13:14:00 LOG7[9]: Compression: null, expansion: null 2021.09.09 13:14:01 LOG6[9]: Read socket closed (readsocket) 2021.09.09 13:14:01 LOG7[9]: Sending close_notify alert 2021.09.09 13:14:01 LOG6[9]: socket fd: Broken pipe (32) 2021.09.09 13:14:01 LOG7[9]: TLS alert (write): warning: close notify 2021.09.09 13:14:01 LOG6[9]: SSL_shutdown successfully sent close_notify alert 2021.09.09 13:14:01 LOG6[9]: writesocket: Socket is closed 2021.09.09 13:14:01 LOG5[9]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:01 LOG7[9]: Remote descriptor (FD=10) closed 2021.09.09 13:14:01 LOG7[9]: Local descriptor (FD=3) closed 2021.09.09 13:14:01 LOG7[9]: Service [squid] finished 2021.09.09 13:14:01 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:01 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:01 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:01 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:01 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:01 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:01 LOG6[ui]: Process 1934 finished with code 0 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: Service [squid] accepted (FD=3) from 127.0.0.1:49567 2021.09.09 13:14:03 LOG7[10]: Service [squid] started 2021.09.09 13:14:03 LOG7[10]: Setting local socket options (FD=3) 2021.09.09 13:14:03 LOG7[10]: Option TCP_NODELAY set on local socket 2021.09.09 13:14:03 LOG5[10]: Service [squid] accepted connection from 127.0.0.1:49567 2021.09.09 13:14:03 LOG6[10]: s_connect: connecting 44.44.44.44:522 2021.09.09 13:14:03 LOG7[10]: s_connect: s_poll_wait 44.44.44.44:522: waiting 10 seconds 2021.09.09 13:14:03 LOG7[10]: FD=6 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[10]: FD=10 events=0x5 revents=0x0 2021.09.09 13:14:03 LOG5[10]: s_connect: connected 44.44.44.44:522 2021.09.09 13:14:03 LOG5[10]: Service [squid] connected remote server from 10.1.3.57:42843 2021.09.09 13:14:03 LOG7[10]: Setting remote socket options (FD=10) 2021.09.09 13:14:03 LOG7[10]: Option TCP_NODELAY set on remote socket 2021.09.09 13:14:03 LOG7[10]: Remote descriptor (FD=10) initialized 2021.09.09 13:14:03 LOG6[10]: SNI: sending servername: 44.44.44.44 2021.09.09 13:14:03 LOG6[10]: Peer certificate not required 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): before SSL initialization 2021.09.09 13:14:03 LOG7[10]: Initializing application specific data for session authenticated 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server hello 2021.09.09 13:14:03 LOG6[10]: Certificate verification disabled 2021.09.09 13:14:03 LOG6[10]: Certificate verification disabled 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server certificate 2021.09.09 13:14:03 LOG6[10]: Client certificate not requested 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server done 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write client key exchange 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write change cipher spec 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server session ticket 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read change cipher spec 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read finished 2021.09.09 13:14:03 LOG7[10]: New session callback 2021.09.09 13:14:03 LOG7[10]: Peer certificate was cached (2037 bytes) 2021.09.09 13:14:03 LOG6[10]: Session id: 85FD50E2A9D57B12D315C834EBA949CF015B7776C6A18486B06CE53F4C52D689 2021.09.09 13:14:03 LOG7[10]: 1 client connect(s) requested 2021.09.09 13:14:03 LOG7[10]: 1 client connect(s) succeeded 2021.09.09 13:14:03 LOG7[10]: 0 client renegotiation(s) requested 2021.09.09 13:14:03 LOG7[10]: 0 session reuse(s) 2021.09.09 13:14:03 LOG6[10]: TLS connected: new session negotiated 2021.09.09 13:14:03 LOG6[10]: TLSv1.2 ciphersuite: AES128-GCM-SHA256 (128-bit encryption) 2021.09.09 13:14:03 LOG3[10]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2021.09.09 13:14:03 LOG7[10]: Compression: null, expansion: null 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: Service [squid] accepted (FD=3) from 127.0.0.1:49569 2021.09.09 13:14:03 LOG7[11]: Service [squid] started 2021.09.09 13:14:03 LOG7[11]: Setting local socket options (FD=3) 2021.09.09 13:14:03 LOG7[11]: Option TCP_NODELAY set on local socket 2021.09.09 13:14:03 LOG5[11]: Service [squid] accepted connection from 127.0.0.1:49569 2021.09.09 13:14:03 LOG6[11]: s_connect: connecting 44.44.44.44:522 2021.09.09 13:14:03 LOG7[11]: s_connect: s_poll_wait 44.44.44.44:522: waiting 10 seconds 2021.09.09 13:14:03 LOG7[11]: FD=6 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[11]: FD=10 events=0x5 revents=0x0 2021.09.09 13:14:03 LOG5[11]: s_connect: connected 44.44.44.44:522 2021.09.09 13:14:03 LOG5[11]: Service [squid] connected remote server from 10.1.3.57:42845 2021.09.09 13:14:03 LOG6[10]: Read socket closed (readsocket) 2021.09.09 13:14:03 LOG7[11]: Setting remote socket options (FD=10) 2021.09.09 13:14:03 LOG7[11]: Option TCP_NODELAY set on remote socket 2021.09.09 13:14:03 LOG7[11]: Remote descriptor (FD=10) initialized 2021.09.09 13:14:03 LOG7[10]: Sending close_notify alert 2021.09.09 13:14:03 LOG6[11]: SNI: sending servername: 44.44.44.44 2021.09.09 13:14:03 LOG6[10]: socket fd: Broken pipe (32) 2021.09.09 13:14:03 LOG6[11]: Peer certificate not required 2021.09.09 13:14:03 LOG7[10]: TLS alert (write): warning: close notify 2021.09.09 13:14:03 LOG6[10]: SSL_shutdown successfully sent close_notify alert 2021.09.09 13:14:03 LOG6[10]: writesocket: Socket is closed 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): before SSL initialization2021.09.09 13:14:03 LOG5[10]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:03 LOG7[11]: Initializing application specific data for session authenticated 2021.09.09 13:14:03 LOG7[10]: Remote descriptor (FD=10) closed 2021.09.09 13:14:03 LOG7[10]: Local descriptor (FD=3) closed 2021.09.09 13:14:03 LOG7[10]: Service [squid] finished 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:03 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:03 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:03 LOG6[ui]: Process 1937 finished with code 0 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server hello 2021.09.09 13:14:03 LOG6[11]: Certificate verification disabled 2021.09.09 13:14:03 LOG6[11]: Certificate verification disabled 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server certificate 2021.09.09 13:14:03 LOG6[11]: Client certificate not requested 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server done 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write client key exchange 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write change cipher spec 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server session ticket 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read change cipher spec 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read finished 2021.09.09 13:14:03 LOG7[11]: New session callback 2021.09.09 13:14:03 LOG7[11]: Peer certificate was cached (2037 bytes) 2021.09.09 13:14:03 LOG6[11]: Session id: B171BF0D4CDB808D50C3CE4CDAA6AE53F2396068A9BD947D8277294F91CCFBFE 2021.09.09 13:14:03 LOG7[11]: 1 client connect(s) requested 2021.09.09 13:14:03 LOG7[11]: 1 client connect(s) succeeded 2021.09.09 13:14:03 LOG7[11]: 0 client renegotiation(s) requested 2021.09.09 13:14:03 LOG7[11]: 0 session reuse(s) 2021.09.09 13:14:03 LOG6[11]: TLS connected: new session negotiated 2021.09.09 13:14:03 LOG6[11]: TLSv1.2 ciphersuite: AES128-GCM-SHA256 (128-bit encryption) 2021.09.09 13:14:03 LOG3[11]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2021.09.09 13:14:03 LOG7[11]: Compression: null, expansion: null 2021.09.09 13:14:03 LOG6[11]: Read socket closed (readsocket) 2021.09.09 13:14:03 LOG7[11]: Sending close_notify alert 2021.09.09 13:14:03 LOG6[11]: socket fd: Broken pipe (32) 2021.09.09 13:14:03 LOG7[11]: TLS alert (write): warning: close notify 2021.09.09 13:14:03 LOG6[11]: SSL_shutdown successfully sent close_notify alert 2021.09.09 13:14:03 LOG6[11]: writesocket: Socket is closed 2021.09.09 13:14:03 LOG5[11]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:03 LOG7[11]: Remote descriptor (FD=10) closed 2021.09.09 13:14:03 LOG7[11]: Local descriptor (FD=3) closed 2021.09.09 13:14:03 LOG7[11]: Service [squid] finished 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:03 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:03 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:03 LOG6[ui]: Process 1938 finished with code 0 If i test with s_client: openssl s_client -connect 44.44.44.44:522 -reconnect I see TLS reused every time. Thank you!

1 0

stunnel logfile and setuid/setgid
by Norbert Hanke 02 Sep '21

02 Sep '21

Hi, I'm new to this list and hope I don't raise a question that has been raised many times before. I searched the archive and couldn't find that discussed previously... I want to configure stunnel using setuid = nobody setgid = nobody while having it write its output to its own logfile, not using syslog, with output = /var/log/stunnel.log log = append syslog = no This works when user nobody has write-access to an existing logfile, or user nobody is allowed to create the file in the directory. Both is not a good idea: user nobody should not have write access there. I could limit potential damage by having a separate directory with such access to nobody, but that is still kind of wrong. Or I could create a separate user only for stunnel and give that user full access to a separate directory: that would be more secure, only a hijacked (hopefully not) stunnel could tamper with its own logfiles. Shouldn't stunnel create and/or open the logfile while it is still running as root, and only then switch to user nobody? Or is there an option that I did not see so far allowing for what I'm trying? Thanks for any help. Regards, Norbert

1 0

Stunnel 5.60 started via Stunnel TLS wrapper on Windows 10 machine doesn't seem to be working
by ling＠aliko.com 01 Sep '21

01 Sep '21

Hi, I am trying to get Stunnel 5.60 started automatically as a service. My stunnel.conf is stored under C:\Program Files (x86)\stunnel\config works fine if I run stunnel.exe manually from CMD or bring up the GUI and reload configuration. Now I would like it to start automatically after reboots. I tried running stunnel.exe -install which installs the Stunnel TLS wrapper service. Starting the service does not however do anything. The "Path to execute" it installs for the service is "C:\Program Files (x86)\stunnel\config" -service -install. I don't see anything in the log. I can see that the stunnel.exe process is running in task manager. But running netstat -ao shows that no port is being listened to by the PID. Tried removing my stunnel.conf file and the service will still starts but stunnel doesn't seem to be doing anything. What could be the problem?

2 2

Minor bugfix: parameter type
by Peter Pentchev 19 Aug '21

19 Aug '21

Hi, Thanks a lot for the continued development of stunnel! While checking whether my Debian packages can be built with the upcoming GCC 11, I found (or rather, GCC reported) a minor discrepancy in the type of the "hash" parameter to the crypt_DES() function in protocol.c. What do you think about the attached patch? It is also available at: https://salsa.debian.org/debian/stunnel/-/blob/master/debian/patches/06-des… Thanks again, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)debian.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

stunnel 60 released
by Michał Trojnara 16 Aug '21

16 Aug '21

Dear Users, I have released version 5.60 of stunnel. ### Version 5.60, 2021.08.16, urgency: LOW * New features - New 'sessionResume' service-level option to allow or disallow session resumption - Added support for the new SSL_set_options() values. - Download fresh ca-certs.pem for each new release. * Bugfixes - Fixed 'redirect' with 'protocol'. This combination is not supported by 'smtp', 'pop3' and 'imap' protocols. - Enforced minimum WIN32 log window size. - Fixed support for password-protected private keys with OpenSSL 3.0 (thx to Dmitry Belyavskiy). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c45d765b1521861fea9b03b425b9dd7d48b3055128c0aec673bba5ef9b8f787d stunnel-5.60.tar.gz 190b79cb94a4f70f362e44c32d150edf8ae660734d3fa0cbd990c3821e8f3083 stunnel-5.60-win64-installer.exe bac9bb4503cc5091d78c9deb6aa013fc07e39d67db0dfcc073b098db52f54427 stunnel-5.60-android.zip Best regards, Mike

1 0

Is it possible to tunnel all tcp sessions of docker containers
by Yichun Ding 15 Aug '21

15 Aug '21

Hi, We are looking for the possibility to encrypt all the tcp sessions of containers between hosts with stunnel. So far I had no luck to come up with an iptables rule to route the packets to stunnel running on the host. We cannot change the container code as there are too many of them. Any advice would be appreciated! -yd

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users