- stunnel-users - stunnel.org

hi
by fieldengineer59＠yahoo.com 04 Nov '20

04 Nov '20

hi

1 0

Stunnel failover
by Ray 02 Nov '20

02 Nov '20

Has anyone tested this scenario with a number of stunnel clients and servers chained in a row with failover capability. The problem is that Stunnel in server mode accepts a connection and performs the SSL handshake before it checks if the connect endpoint is reachable. This causes the downlink client peer wrongly assumes that the link is up and therefore would not try the alternative failover endpoint. You will only observe this problem if you cascade several nodes in a row Ex: Dummy TCP Client <-> Stunnel1 (client) <-> Stunnel2 (server) <-> Stunnel3 (client) <-> Dummy SSL Server In this scenario, dummy client connects to S1, S1 connects to S2 (SSL), S2 tries to connect to S3 but since Dummy SSL server is down, S3 rejects but this rejection is not bouncing back to Dummy Client because S2 has down the downlink handshake and therefore S1 assumes everything is OK. So, the ultimate question is how can we tell Stunnel to first try to connect to endpoints and then send a SYN-ACK back to downlink TCP connection request. This way, a client sends a SYN to Stunnel, Stunnel holds on 3-way handshake, tries to connect to the uplink and completes the downlink handshake only if the uplink connection is OK.

1 0

Stunnel - SSL socket error Connection timed out
by sravan kumar 22 Oct '20

22 Oct '20

Hi Team, Need help on one issue. We recently configured stunnel on our servers for securely establishing DB connections[certs exchanged on stunnel client and server]. Stunnel installed on client machine. Stunnel installed on server machine. Configurations are completed and publishing working for sometime like 1 hr. After that the stunnel on the destination server did not respond and we noticed "SSL socket error: Connection timed out (110)". We made updates to the stunnel.conf with below entries but they are not updating. TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 Any help would be greatly appreciated. Regards, Sravan

1 0

5.57 cb_new_auth
by duncan.morris＠cdl.co.uk 20 Oct '20

20 Oct '20

When compiling 5.57 against OpenSSL 1.0.2 I am getting compiler warnings for the cb_new_auth definition. ENGD20 is running V8.4 [840] on ALPHA Building with OpenSSL 1.0.2 Image : STUNNEL.HPE_ALPHA_EXE "session authenticated", cb_new_auth, NULL, NULL); .................................^ %CC-W-PTRMISMATCH, In this statement, the referenced type of the pointer value "cb_new_auth" is "function (pointer to void, pointer to void, pointer to struct crypto_ex_data_st, int, long, pointer to void) returning void", which is not compatible with "function (pointer to void, pointer to void, pointer to struct crypto_ex_data_st, int, long, pointer to void) returning int" . at line number 80 in file DISK$ORACLE:[STUNNEL_BUILDS.stunnel-557.src]ssl.c;1 This appears to be the result of OpenSSL 1.0.2 defining this as an integer function, whilst 1.1.1 defines it as a void function. Duncan

1 0

Changelog policy / watch out for 5.57 if you have 1024-bit keys in use
by ian.bamforth＠tracsis.com 20 Oct '20

20 Oct '20

Morning, [ ] Loading certificate from file: /opt/clients/certificate_2020-04-23.pem [!] SSL_CTX_use_certificate_chain_file: ssl/ssl_rsa.c:301: error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small [!] Service [RailCompanion]: Failed to initialize TLS context [!] Configuration failed We encountered a production outage yesterday when upgrading to 5.57, as it seems that a new securityLevel config has been added, a side-effect of which looks to have been the rejection of certificates of less than 2048 bits by default. We still had a 1024 bit cert in use. Obviously we should've had monitoring to check that stunnel was actually running (we will next time!) but it seems to me like this is a change that deserved more attention in the log, which only identifies it as a new feature, with no mention of breaking changes. Anyway, our problem is now solved, but if you encounter stunnel failing to start when you next upgrade then this might be a candidate to look at. Ian

1 0

Can't Connect To Gmail
by lrogersjunk＠gmail.com 17 Oct '20

17 Oct '20

Hello all - I have tried to set up stunnel to send emails through gmail from a legacy device that can only send to port 25. But I'm having no success. My config file seems correct, as it matches config files posted by others who appear able to send through gmail. This is what it looks like: output = stunnel-log.txt debug = 7 Taskbar = yes [gmail-imap] client = yes accept = 143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes I originally thought the problem was gmail's recent new security features, requiring app-passwords for apps that do not support gmail's latest security features. So I set up an app-password for use by stunnel but that didn't work, either. So I then turned on "allow less secure apps" in gmail and used the account's original password (not the app-password). But even that doesn't work. So I'm at a total loss and can't think of anything else to do. Can anyone assist? Many thanks.

4 3

Stunnel & Gmail security
by BOXI31 TEST 16 Oct '20

16 Oct '20

Hi all, To make "Stunnel 5.31" work with Gmail, I have to go in security settings of Gmail and "allow less secure apps to access my account". Is it mandatory ? Is it possible to set Stunnel to access Gmail without lowering it security level ? How ? I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider it as a "less secure app." ! Regards, Steve

2 1

clarification on Security BugFix released in version 5.57
by svitatissimo2004＠hotmail.com 15 Oct '20

15 Oct '20

looking the changelog of latest version of stunnle (version 5.57) I see the following statement: "The "redirect" option was fixed to properly handle "verifyChain = yes" (thx to Rob Hoes)." It is possible to have more information on the vulnerability fixed?

1 0

clarification on Security BugFix released in version 5.57
by svitatissimo2004＠hotmail.com 15 Oct '20

15 Oct '20

looking the changelog of latest version of stunnle (version 5.57) I see the following statement: "The "redirect" option was fixed to properly handle "verifyChain = yes" (thx to Rob Hoes)." It is possible to have more information on the vulnerability fixed?

1 0

CERT: Pre-verification error: unsupported certificate purpose
by Bob Bob 12 Oct '20

12 Oct '20

Hi, I just updated to version 5.57 and the config I used for ever does not work anymore. I regenerated the self certs using the "Build a Self-signed stunnel.pem" in Windows and made sure the CN was matching the hostname of the server machine. I understand there is an issue with the self signed certificate... ...but it was working fine under 5.56. Server configuration [Server_SyncThing] cert = stunnel.pem accept = 999 connect = 127.0.0.1:24596 ciphers = PSK PSKsecrets = psk.txt Client configuration [SyncThing] client = yes accept = 127.0.0.1:24596 connect = 192.168.0.102:999 verifyPeer = yes CAfile = stunnel.pem PSKsecrets = psk.txt Service [SyncThing] connected remote server from 192.168.1.44:5455 2020.10.12 14:25:06 LOG7[33]: Setting remote socket options (FD=1516) 2020.10.12 14:25:06 LOG7[33]: Option TCP_NODELAY set on remote socket 2020.10.12 14:25:06 LOG7[33]: Remote descriptor (FD=1516) initialized 2020.10.12 14:25:06 LOG6[33]: SNI: sending servername: 192.168.0.102 2020.10.12 14:25:06 LOG6[33]: Peer certificate required 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): before SSL initialization 2020.10.12 14:25:06 LOG7[33]: Initializing application specific data for session authenticated 2020.10.12 14:25:06 LOG6[33]: PSK client configured for identity "user1" 2020.10.12 14:25:06 LOG7[33]: Initializing application specific data for session authenticated 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): SSLv3/TLS write client hello 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): SSLv3/TLS write client hello 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): SSLv3/TLS read server hello 2020.10.12 14:25:06 LOG7[33]: TLS state (connect): TLSv1.3 read encrypted extensions 2020.10.12 14:25:06 LOG7[33]: Verification started at depth=0: C=FR, ST=Centre, L=Marseilles, O=CA, OU=CA, CN= TRUCK-D98J8TY 2020.10.12 14:25:06 LOG4[33]: CERT: Pre-verification error: unsupported certificate purpose 2020.10.12 14:25:06 LOG4[33]: Rejected by CERT at depth=0: C=FR, ST=Centre, L=Marseilles, O=CA, OU=CA, CN= TRUCK-D98J8TY 2020.10.12 14:25:06 LOG7[33]: TLS alert (write): fatal: unsupported certificate 2020.10.12 14:25:06 LOG3[33]: SSL_connect: ssl/statem/statem_clnt.c:1913: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed 2020.10.12 14:25:06 LOG5[33]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.10.12 14:25:06 LOG7[33]: Deallocating application specific data for session connect address 2020.10.12 14:25:06 LOG7[33]: Deallocating application specific data for session connect address 2020.10.12 14:25:06 LOG7[33]: Remote descriptor (FD=1516) closed Any help would be welcome. Thanks.

2 1

Stunnel inetd Linux configuration
by Marco Marchi 30 Sep '20

30 Sep '20

Good morning, I'm trying to configure Stunnel on Linux (Slackware 14). Can anybody post an example of configuration file in order to run and manage Stunnel by means of inetd, keeping in mind that goal is to secure pop3 and imap? Openssl is already installed and running (version 1.1.1g, april 2020). Stunnel version downloaded and installed is 5.56. Certifcate has been generated by means of Openssl. Issues are related to the right syntax in stunnel.conf. Thank you in advance. Marco

1 0

sslVersion
by Ray 25 Sep '20

25 Sep '20

Hi Is sslVersion a global parameter that belongs to all segments or can it be inside a segment to only affect that segment? Example: output = /tmp/stunnel.log debug = emerg sslVersion = all # I assume it is applied to all Stunnel connection definitions [Stunnel_1] sslVersion = tls1_2 # How about this? I only want Stunnel_1 to be affected with sslVersion tls1_2 option. client = yes accept = 2222 connect = some_domain.com.au:8449 verify = 2 CAfile = /etc/stunnel/certs/root_digicert_ca.crt Thanks Ray

1 0

Address already in use (98) error trying to run stunnel client in Ubuntu Docker container
by greg＠yesenergy.com 24 Sep '20

24 Sep '20

Hello all, I'm getting the following error when I try to connect to a remote server from inside a running Docker container: "Binding service [client] to 127.0.0.1:1589: Address already in use (98)". I don't think this port is actually in use, and I've tried other ports with the same results. I know that this configuration works in my Windows dev machine, from which I have consistently connected to the remote server, no problem. I suspect this might be related to Docker's internal networking schema and port-forwarding, but I thought I would ask this group if anyone knows how to overcome this hurdle. Thanks for listening! Here is the config: [client] client = yes accept = 127.0.0.1:1589 connect = nn.nnn.nnn.nnn:443 checkHost = xxxxxxxxx.com sslVersion = TLSv1.2 CAfile = /usr/local/etc/stunnel/my_pemfile.pem verifyPeer = yes Here is the log trace: [ ] Clients allowed=512000 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled/running with OpenSSL 1.1.1d 10 Sep 2019 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /usr/local/etc/stunnel/stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [client] [ ] Ciphers: DES-CBC3-SHA:IDEA-CBC-MD5-DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA [ ] TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 [ ] TLS options: 0x02100004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [.] Configuration successful [ ] Binding service [client] [ ] Listening file descriptor created (FD=8) [ ] Setting accept socket options (FD=8) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [client] to 127.0.0.1:1589: Address already in use (98) [ ] Listening file descriptor created (FD=8) [ ] Setting accept socket options (FD=8) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [client] to 127.0.0.1:1589: Address already in use (98) [!] Binding service [client] failed [ ] Deallocating section defaults [ ] Unbinding service [client] [ ] Service [client] closed [ ] Deallocating section [client]

1 0

Stunnel to smtp-relay.gmail.com
by Anton Palmgård 22 Sep '20

22 Sep '20

Hi, a few days ago up to a week my stunnel connection to smtp-gmail.gmail.com. stopped working with the error: ep 21 17:25:57 stunnel LOG50: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Sep 21 17:25:57 stunnel LOG30: Remote server is not RFC 1425 compliant Sep 21 17:25:57 stunnel LOG50: Service [to_gmail] connected remote server from xxx.xxx.xxx.xxx:29662 Tried from 2 different Locations / sites (i.e companies) same error. The relay work fine without client settings but that leaves TLS to the endpoint.. Office 365 relay works fine with TLS. Contacted Google support but the claimed nothing have been changed. I assume somehting with the TLS version/ CIPHERS is wrong ? Conf simply looks like this: cert = /usr/local/etc/stunnel/stunnel.pem chroot = /var/tmp/stunnel setuid = stunnel setgid = stunnel [to_gmail] client = yes accept = 0.0.0.0:587 connect = smtp-relay.gmail.com:587 debug = 7 TIMEOUTclose = 0 protocol = smtp BR, Anton.

2 4

Stunnel failover
by Ray 16 Sep '20

16 Sep '20

Stunnel's failover option with prio settings works fine but the application first tries 3 syn to connect to the first endpoint and if failed then it tries the second endpoint. Is there any way to configure stunnel to try only once and failover to the second connection endpoint?

1 0

using Android Keystore with stunnel
by blacksun＠directbox.com 09 Sep '20

09 Sep '20

Hello, i am using stunnel 5.56 on Android 7.0. It is a non-rooted device. Android stores keys and certs in the android keystore. I am using a Let's Encrypt Cert on serverside, and on clients the options veryChain and chechHost. How can i use the System-integrated CA-Certs of Android for verifying the server-cert issued by Let's Encrypt? When i am searching the net, there are infos saying that the certs and keys are not accessible by filestructure, but there would be apis to access the keystore. The keystore would be protected with the PIN of the device. Thanks.

1 0

How to configure stunnel as HTTP proxy on Windows?
by Jason Long 08 Sep '20

08 Sep '20

Hello, I want to use stunnel on Windows as HTTP proxy, I changed the configuration as below: ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store [example-proxy] client = yes accept = 127.0.0.1:8080 connect = google.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token [example-pkcs11] client = yes accept = 127.0.0.1:8080 connect = google.com:8443 ;engineId = pkcs11 cert = pkcs11:token=MyToken;object=MyCert key = pkcs11:token=MyToken;object=MyKey But, it show me configuration error. How can I solve it? Thank you.

1 0

Stunnel - how to block IPs?
by Brent Kimberley 04 Sep '20

04 Sep '20

Hi James.To the best of my knowledge, your options include Darwin firewall and HAProxy - geoip. >>Just wondering if there is a way to have Stunnel not accept connection from certain IPs? stunnel -version stunnel 5.56 on x86_64-apple-darwin18.7.0 platform Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI

1 0

Stunnel - how to block IPs?
by James Brown 03 Sep '20

03 Sep '20

Just wondering if there is a way to have Stunnel not accept connection from certain IPs? stunnel -version stunnel 5.56 on x86_64-apple-darwin18.7.0 platform Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Thanks, James.

1 0

TLS1.0 fallback when only TLS1.2 allowed
by Wojciech Machula 31 Aug '20

31 Aug '20

So I've configured my stunnel to only use TLS1.2 and usually works ok. However when client gets some bad L7 response it send a TCP RST, after which all subsequent stunnel TLS Client Hellos are some hybrid of TLS1.0/TLS1.2, as can be seen in tshark output below. Once I restart the whole stunnel process subsequent TLS handshakes work fine using TLS1.2, until the next client RST is received. $ stunnel -version stunnel 4.56 on x86_64-redhat-linux-gnu platform $ cat /etc/centos-release CentOS Linux release 7.8.2003 (Core) $cat /etc/stunnel/dsr2rtcg-stunnel.conf output = /var/log/stunnel pid = /etc/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [poc] cert = /etc/pki/tls/certs/stunnel/aaa.crt key = /etc/pki/tls/private/stunnel/aaa.key CAfile = /etc/pki/tls/certs/stunnel/bbb.crt client = yes sslVersion = TLSv1.2 options = NO_TLSv1 accept = 172.18.180.78:45154 connect = 10.74.0.196:45154 ciphers = TLSv1.2+HIGH:!aNULL $ tshark -nn -V -d tcp.port==45154,ssl -r 20200729_09:42:44-port45154.pcap -2R "ssl.handshake" -c 1 | grep -i tls -B3 Secure Sockets Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) -- Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 1610 Version: TLS 1.2 (0x0303)

6 14

Sslkeylog
by Brent Kimberley 22 Aug '20

22 Aug '20

>>Any suggestions on sslkeylog via stunnel application Call SSL_CTX_set_keylog_callback() !? On Thu, Aug 13, 2020, 16:44 tayyib ahmed <tayyib76(a)gmail.com> wrote: > Hi Guys > > Is there any option to set sslkeylog to get ssl session id for stunnel > session? > > Br xx >

2 2

How to archive DNS load balance in stunnel client?
by Peter Zhao 22 Aug '20

22 Aug '20

Hi, We are trying to use DNS load balance in a stunnel client with round-robin algorithm. service.example.com is mapping to two ips. But when we update DNS to remove one of ips for service.example.com stunnel client still forward requests to both ips. How to make stunnel client to resolve domain name and refresh its cache? Here is stunnel configuration. sslVersion=TLSv1.2 cert = /etc/stunnel/stunnel.pem output=/var/log/stunnel.log [service-client] client = yes accept = localhost:4680 connect = service.example.com:4680 [service-server] client = no accept = 10.10.0.16:4680 connect = loclhost:80 Here is the resolving result for service.example.com. ;; ANSWER SECTION: service.example.com. 5 IN A 10.10.0.16 service.example.com. 5 IN A 10.10.0.8

3 3

Sslkeylog
by tayyib ahmed 16 Aug '20

16 Aug '20

Hi Guys Is there any option to set sslkeylog to get ssl session id for stunnel session? Br xx

1 1

Stunnel 5.56 Windows 10 Service - Not functioning after Reboot
by Rod Marr 16 Aug '20

16 Aug '20

Hi all, I have installed Stunnel 5.56 win64 on a fully updated Windows 10 machine to work with Blue Iris. Stunnel operates well when I manually start it however I cannot get it to work automatically after a reboot. I have run the run the “stunnel Service Install” and “stunnel Service Start” shortcuts supplied, and in the first instance the service installs and starts. I can then connect through Stunnel to my Blue Iris server. I have found that after I reboot, the Stunnel service appears to start automatically but it is not functional. I cannot connect through it to Blue Iris. Stunnel is visible and Running in the Windows 10 Services list (from services.msc) and the Windows Task Manager shows a Process and Service active. To rectify this I can manually issue the “stunnel Service Stop”, followed by the “stunnel Service Start” shortcuts and the service becomes functional again. I have tried turning on debug info and the stunnel log file in stunnel.conf and see that log entries only begin after I have done the stop/start manual process. Thanks for any insight to what I’m sure I am missing here. Rod Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10

2 2

Sslkeylog
by Brent Kimberley 14 Aug '20

14 Aug '20

No sign of SSL_CTX_set_keylog_callback()... Date: Thu, 13 Aug 2020 16:44:22 +0100 From: tayyib ahmed <tayyib76(a)gmail.com> To: stunnel-users(a)stunnel.org Subject:Hi Guys Is there any option to set sslkeylog to get ssl session id for stunnel session? Br xx

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users