- stunnel-users - stunnel.org

uninstall.exe
by Michael Curran 22 Nov '16

22 Nov '16

With the distrubuted version of stunnel, there is an uninstall.exe Are there any options for this uninstaller, so I can automate removal and upgrade processes ? Like a /quiet or /Q ?? Which uninstaller application is this based off of?

1 0

Connection failure on IPv4-only box with IPv6-address in RR DNS record
by Michael Weiser 18 Nov '16

18 Nov '16

Hi, the server I connect to using stunnel has just been upgraded to IPv6. In the process an AAAA record was added to its DNS entry. The box I run stunnel on is IPv4-only, meaning, the kernel does not have any IPv6 support at all. The DNS stub resolver is still looking for AAAA records though. Consequently stunnel connections now fail about half of the time with error: 2016.11.18 20:10:57 LOG3[ui]: remote socket: Address family not supported by protocol (97) >From looking at client.c I can see that stunnel supports trying all target addresses in turn but will bail if the socket cannot be created: for(ind_try=0; ind_try<c->connect_addr.num; ind_try++) { c->fd=s_socket(c->connect_addr.addr[ind_cur].sa.sa_family, SOCK_STREAM, 0, 1, "remote socket"); if(c->fd==INVALID_SOCKET) longjmp(c->err, 1); [...] if(s_connect(c, &c->connect_addr.addr[ind_cur], [...] continue; /* next IP */ } [...] return fd; /* success! */ So I guess the problem would go away if I enabled IPv6 in the kernel of my client box: s_socket() would succeed but connect() would fail with ENETUNREACH. But couldn't stunnel just continue with the next IP if s_socket() failed with EAFNOSUPPORT? -- Thanks, Michael

1 0

Deactivate expiry date check, Have CA check with verify = 3
by Mark Shine 18 Nov '16

18 Nov '16

Hello, I would like to setup stunnel but the certificate from my other tunnel is expired. How would I tell stunnel to ignore verification of expiry date of the certificate coming from stunnel client mode to the stunnel server mode? I want to be able to verify the certificate but ignore the expiry date. Not disable cert check all the way I have a stunnel setup by someone else that has done this exact thing but I have no clue how they did it. Stunnel seems to use openssl for the verification so I guess the question should be how to bypass openssl expiry check. Please see the below link for my issue on stackexchange. http://unix.stackexchange.com/questions/323997/stunnel-how-to-ignore-the-ce… [http://cdn.sstatic.net/Sites/unix/img/apple-touch-icon@2.png?v=32fb07f7ce26…]<http://unix.stackexchange.com/questions/323997/stunnel-how-to-ignore-the-ce…> Stunnel: How to ignore the cert expiry date<http://unix.stackexchange.com/questions/323997/stunnel-how-to-ignore-the-ce…> unix.stackexchange.com I would like to setup stunnel but the certificate from my other tunnel is expired. How would I tell stunnel to ignore verification of expiry date of the certificate coming from stunnel client mode ...

1 0

Windows builds
by Michael Curran 16 Nov '16

16 Nov '16

Hello -- Are there some solid instructions for building stunnel on windows? I am using Microsoft VS 2015 and the 64-bit compilers -- This is the basic error I am running into, but could be that stunnel wont work with 64-bit? C:\stunnel_build\stunnel-5.36.tar\stunnel-5.36\src>.\makew32.bat W32 ENVIRONMENT OK Microsoft (R) Program Maintenance Utility Version 14.00.24210.0 Copyright (C) Microsoft Corporation. All rights reserved. Detected target: win64 cl /MD /W3 /O2 /nologo /I"\devel\win64\openssl\include" /DUNICODE /D_UNICODE -Fo..\obj\win64\stunnel.obj -c ..\src\stunnel.c stunnel.c c:\stunnel_build\stunnel-5.36.tar\stunnel-5.36\src\common.h(414): fatal error C1083: Cannot open include file: 'openssl/opensslconf.h': No such file or directory NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\BIN\amd64\cl.EXE"' : return code '0x2' Stop.

2 2

Stunnel-5.x on windows 10
by Michael Curran 15 Nov '16

15 Nov '16

I have a method with VS to compile Stunnel as 64-bit for use with Windows Are there any decent instructions for compiling it as 64-bit? Michael Curran | Systems Architect Office: 614-568-2285 Mobile: 614-403-6320 ConnectSolutions | 126 Post St. Ste. 400 | San Francisco, CA 94108

1 0

Assistance needed debugging Stunnel AWS EC2 Interface
by Donald F. Coffin 15 Nov '16

15 Nov '16

I am using stunnel as a proxy to support SoapUI mock services which are used to test an SSL based application. The SoapUI and stunnel proxy are running on an AWS Ubuntu 14.04 EC2 Instance communicating to a Tomcat server running on a second AWS Ubuntu 14.04 EC2 Instance. The target application uses a wildcard SSL Certificate and works successfully when accessed using a desktop browser (Chrome or Firefox). The issue I am encountering is that the stunnel connection logs a "SSL closed on SSL_read" message as soon as the cipher suite is negotiated as shown in the following stunnel.log: 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Clients allowed=2000 2016.11.14 21:34:19 LOG5[5287:140430154716992]: stunnel 4.53 on x86_64-pc-linux-gnu platform 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Compiled with OpenSSL 1.0.1e 11 Feb 2013 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Running with OpenSSL 1.0.1f 6 Jan 2014 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Update OpenSSL shared libraries or rebuild stunnel 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Reading configuration from file /etc/stunnel/stunnel.conf 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Compression not enabled 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Snagged 64 random bytes from /home/ubuntu/.rnd 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Wrote 1024 new random bytes to /home/ubuntu/.rnd 2016.11.14 21:34:19 LOG7[5287:140430154716992]: PRNG seeded successfully 2016.11.14 21:34:19 LOG6[5287:140430154716992]: Initializing service section [resourceServer] 2016.11.14 21:34:19 LOG4[5287:140430154716992]: Insecure file permissions on /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Key file: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Private key loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Verify directory set to /etc/ssl/certs 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Added /etc/ssl/certs revocation lookup directory 2016.11.14 21:34:19 LOG7[5287:140430154716992]: SSL options set: 0x00000004 2016.11.14 21:34:19 LOG6[5287:140430154716992]: Initializing service section [tpserver] 2016.11.14 21:34:19 LOG4[5287:140430154716992]: Insecure file permissions on /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Key file: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Private key loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Verify directory set to /etc/ssl/certs 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Added /etc/ssl/certs revocation lookup directory 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Could not load DH parameters from /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Using hardcoded DH parameters 2016.11.14 21:34:19 LOG7[5287:140430154716992]: DH initialized with 2048-bit key 2016.11.14 21:34:19 LOG7[5287:140430154716992]: ECDH initialized with curve prime256v1 2016.11.14 21:34:19 LOG7[5287:140430154716992]: SSL options set: 0x00000004 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Configuration successful 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Service [resourceServer] (FD=12) bound to 127.0.0.1:8080 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Service [tpserver] (FD=13) bound to 127.0.0.1:8444 2016.11.14 21:34:19 LOG7[5293:140430154716992]: Created pid file /var/run/stunnel4.pid 2016.11.14 21:34:25 LOG7[5293:140430154716992]: Service [resourceServer] accepted (FD=3) from 127.0.0.1:41256 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Service [resourceServer] started 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Waiting for a libwrap process 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Acquired libwrap process #0 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Releasing libwrap process #0 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Released libwrap process #0 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Service [resourceServer] permitted by libwrap from 127.0.0.1:41256 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Service [resourceServer] accepted connection from 127.0.0.1:41256 2016.11.14 21:34:25 LOG6[5293:140430154827520]: connect_blocking: connecting 52.43.245.161:8443 2016.11.14 21:34:25 LOG7[5293:140430154827520]: connect_blocking: s_poll_wait 52.43.245.161:8443: waiting 10 seconds 2016.11.14 21:34:25 LOG5[5293:140430154827520]: connect_blocking: connected 52.43.245.161:8443 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Service [resourceServer] connected remote server from 172.31.44.97:34077 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Remote socket (FD=15) initialized 2016.11.14 21:34:25 LOG7[5293:140430154827520]: SNI: host name: 52.43.245.161 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Starting certificate verification: depth=2, /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 2016.11.14 21:34:25 LOG6[5293:140430154827520]: CERT: Verification not enabled 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Certificate accepted: depth=2, /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Starting certificate verification: depth=1, /C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA 2016.11.14 21:34:25 LOG6[5293:140430154827520]: CERT: Verification not enabled 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Certificate accepted: depth=1, /C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Starting certificate verification: depth=0, /CN=*.greenbuttonalliance.org 2016.11.14 21:34:25 LOG6[5293:140430154827520]: CERT: Verification not enabled 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Certificate accepted: depth=0, /CN=*.greenbuttonalliance.org 2016.11.14 21:34:25 LOG6[5293:140430154827520]: SSL connected: new session negotiated 2016.11.14 21:34:25 LOG6[5293:140430154827520]: Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) 2016.11.14 21:34:25 LOG6[5293:140430154827520]: Compression: null, expansion: null 2016.11.14 21:34:45 LOG7[5293:140430154827520]: SSL closed on SSL_read 2016.11.14 21:34:45 LOG7[5293:140430154827520]: Sent socket write shutdown 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Socket closed on read 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Sending close_notify alert 2016.11.14 21:34:56 LOG6[5293:140430154827520]: SSL_shutdown successfully sent close_notify alert 2016.11.14 21:34:56 LOG5[5293:140430154827520]: Connection closed: 342 byte(s) sent to SSL, 250 byte(s) sent to socket 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Remote socket (FD=15) closed 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Local socket (FD=3) closed 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Service [resourceServer] finished (0 left) The stunnel.conf file contains the following configuration: ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** CApath = /etc/ssl/certs ; ************************************************************************** ; * Logging * ; ************************************************************************** debug = 7 output = /home/ubuntu/Git/energyos/OpenESPI-GreenButtonCMDTest/SOAPUI/stunnel.log ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ************************************************************************** ; * Resource Server * ; ************************************************************************** [resourceServer] accept=localhost:8080 connect=52.43.245.161:8443 ciphers=AES128-SHA client = yes cert=/etc/stunnel/stunnel.pem verify=0 [tpserver] accept=127.0.0.1:8444 connect=localhost:8081 cert=/etc/stunnel/stunnel.pem verify=0 client=no ciphers=AES128-SHA Are there any additional stunnel logging options or debugging techniques you can recommend to help determine why the session is being closed? Does stunnel support wildcard based certificates (i.e. *.greenbuttonalliance.org)? Best regards, Don Donald F. Coffin Technical Manager Green Button Alliance 2335 Dunwoody Crossing Suite E Dunwoody, GA 30338-8221 http://www.greenbuttonalliance.org <http://www.greenbuttonalliance.org/> (949) 636-8571 Mobile

1 0

rpmbuild errors using stunnel.spec
by Wiest, Damian 07 Nov '16

07 Nov '16

I noticed a few issues with the stunnel.spec file included with the distribution that I wanted to report. I'm building on an Amazon Linux host. There appears to be a bad date entry in the changelog section, warning: bogus date in %changelog: Sun Jun 24 2000 Brian Hatch <bri(a)stunnel.org> Sunday is the 25th? The stunnel.init and stunnel.logrotate files are being installed from the rpmbuild/SOURCES/ directory and not rpmbuild/BUILD/stunnel-5.37/tools/. Copying the files from the build area and retrying resolves this. stunnel.spec:Source1: %{name}.init stunnel.spec:Source2: %{name}.logrotate ... stunnel.spec:%{__install} -p -m0755 %{SOURCE1} $RPM_BUILD_ROOT%{_initrddir}/%{name} stunnel.spec:%{__install} -p -m0644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/%{name} + /usr/bin/install -p -m0755 /home/ec2-user/rpmbuild/SOURCES/stunnel.init /home/ec2-user/rpmbuild/BUILDROOT/stunnel-5.37-1.amzn1.x86_64/etc/rc.d/init.d/stunnel /usr/bin/install: cannot stat '/home/ec2-user/rpmbuild/SOURCES/stunnel.init': No such file or directory + /usr/bin/install -p -m0644 /home/ec2-user/rpmbuild/SOURCES/stunnel.logrotate /home/ec2-user/rpmbuild/BUILDROOT/stunnel-5.37-1.amzn1.x86_64/etc/logrotate.d/stunnel /usr/bin/install: cannot stat '/home/ec2-user/rpmbuild/SOURCES/stunnel.logrotate': No such file or directory rpmbuild also complains that the files under /usr/share/doc/stunnel/ are unpackaged. I added %{_docdir}/* at the end of the files section to correct this. -Damian -- Confidentiality Notice: This e-mail transmission may contain confidential or legally privileged information that is intended only for the individual or entity named in the e-mail address. If you have received this communication in error, please notify me by return e-mail, and destroy this communication and all copies thereof, including any attachments. Apervita ® is a registered trademark of Apervita Inc.

1 0

Bulk Requests - Stunnel throwing exceptions
by Lakshmi Narayana Lanka 03 Nov '16

03 Nov '16

Hello, I'm using Stunnel infront of a TCP/IP connection. When we receive bulk requests simultaneously it starts throwing exceptions. Is it something by design with Stunnel? -- Thanks & Regards, Lakshmi N Lanka

2 4

Use SNI
by Benjamin Hartwich 31 Oct '16

31 Oct '16

Hi, I´ve found the SNI parameter at stunnel, but it doesn´t work at my Ubuntu 16.04. My goal is, to use one dfn cert for the stunnel cert, which has 4 hostnames. This cert is on both servers. At the client server this cert works, because at the cert this is first hostname. At the second server I use the same cert, but it can´t be verified, because stunnel doesn´t recognize the correct hostname from the cert. Can anyone send me an example for a working SNI configuration? My Configs: Server one: client = yes cert = /etc/stunnel/cert.pem service = test debug = debug output = /var/log/stunnel4/stunnel.log foreground = no sslVersion = TLSv1 options = NO_SSLv3 options = NO_SSLv2 CAfile = /etc/ssl/web/chain.pem verify = 2 socket = r:TCP_NODELAY=1 [app1] accept = localhost:8090 connect = 10.1.2.1:8085´ ----- Server 2 (fails): client = no cert = /etc/stunnel/cert.pem service = test debug = debug output = /var/log/stunnel4/stunnel.log sslVersion = TLSv1 options = NO_SSLv3 options = NO_SSLv2 foreground = no CAfile = /etc/ssl/web/chain.pem verify = 2 socket = l:TCP_NODELAY=1 [ajp] accept = 8085 connect = 127.0.0.1:8009 --- Error: 2016.10.31 15:01:40 LOG7[9]: SNI: no virtual services defined 2016.10.31 15:01:40 LOG4[9]: CERT: Pre-verification error: unsupported certificate purpose Regards, Benjamin Hartwich Referat Basisdienste Zentrum für Informationstechnologie und Medienmanagement Universität Passau Innstr. 33, 94032 Passau Telefon +49 (0)851/509-3285, Telefax +49 (0)851/509-1802 E-Mail: benjamin.hartwich(a)uni-passau.de

1 0

Running Stunnel 5.23 as multiple windows services
by David Jones 25 Oct '16

25 Oct '16

Hi, I'm trying to run stunnel as a windows service. I have used the stunnel -install and one service has successfully been setup. We now have a need to run a second instance of stunnel and so that we are able to stop/start this instance and not affect the connectivity of the other one we would like to install it as a separate service. On an older version of stunnel we simply named the stunnel.exe differently and it ran both services separately. But with 5.23 it is not allowing us to do so. Coming up the error "CreateService: error 1073: The specified service already exists". I've tried adding service = into the .conf file and also using service= on the command line for the install but nothing works. So what have I missed? Thanks David Config: Service = Stunnel_TLS_Generic CApath = ./ debug=7 #debug = 1 output = TLS_Generic.log # Use it for client mode client = yes # Service-level configuration [Service_Name] options = NO_SSLv2 options = NO_SSLv3 sslVersion = TLSv1 accept = 20002 connect = URLtoserver:443

1 0

Re: [stunnel-users] JHH re: Server down? [GishPuppy]
by gmane.bl4＠gishpuppy.com 20 Oct '16

20 Oct '16

John H Hoffmann wrote: > upgraded to latest sTunnel v 5.36. > > In restarting sTunnel I immediately got a > 'server down' error > > [ ] Service [pop3s] (FD=432) bound to 0.0.0.0:995 > > > [!] bind: Permission denied (WSAEACCES) (10013) > > [!] Error binding service [comcast-pop3] to 127.0.0.1:995 > You probably have in the stunnel.conf something similar to: [pop3s] accept=995 {...} [comcast-pop3] accept=127.0.0.1:995 {...} accept=995 == 0.0.0.0:995 == (all localhost IPv4 addresses):995 Which includes 127.0.0.1:995 When the [comcast-pop3] service tries to bind to port 995 it fails because it is already bound at the [pop3s] service. Gishpuppy | To change the delivery settings for this email, click here: http://www.gishpuppy.com/cgi-bin/edit.py?email=gmane.bl4@gishpuppy.com

2 1

JHH re: Server down?
by John H Hoffmann | 847.998.6198 18 Oct '16

18 Oct '16

Hi .. I have been having spotty access to my main ISP email account the last two days so I upgraded to latest sTunnel v 5.36. I use sTunnel to help get emails from my ISP, Comcast, to load into an older version of GoldMine CRM. sTunnel has worked like a charm since 09/2013. In restarting sTunnel I immediately got a 'server down' error, log included below. Ideas? Suggestions? [ ] Cron thread initialized [ ] Running on Windows 6.1 [ ] No limit detected for the number of clients [.] stunnel 5.36 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2i-fips 22 Sep 2016 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [pop3s] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [imaps] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [ssmtp] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [comcast-pop3] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [comcast-pop3] needs authentication to prevent MITM attacks [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [ ] Initializing service [comcast-smtp] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [comcast-smtp] needs authentication to prevent MITM attacks [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=432) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [pop3s] (FD=432) bound to 0.0.0.0:995 [ ] Listening file descriptor created (FD=436) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [imaps] (FD=436) bound to 0.0.0.0:993 [ ] Listening file descriptor created (FD=440) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [ssmtp] (FD=440) bound to 0.0.0.0:465 [ ] Listening file descriptor created (FD=444) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [!] bind: Permission denied (WSAEACCES) (10013) [!] Error binding service [comcast-pop3] to 127.0.0.1:995 [ ] Closing service [pop3s] [ ] Service [pop3s] closed (FD=432) [ ] Service [pop3s] closed [ ] Closing service [imaps] [ ] Service [imaps] closed (FD=436) [ ] Service [imaps] closed [ ] Closing service [ssmtp] [ ] Service [ssmtp] closed (FD=440) [ ] Service [ssmtp] closed [ ] Closing service [comcast-pop3] [ ] Service [comcast-pop3] closed [ ] Closing service [comcast-smtp] [ ] Service [comcast-smtp] closed [!] Server is down Respectfully, John John H Hoffmann

2 1

Stunnel stops on Windows Server 2012
by Sam Ash 03 Oct '16

03 Oct '16

I've upgraded Stunnel from 5.35 to 5.36 on a server running windows server 2012. Since the upgrade it appears to stop running once i log out. I installed it as a service and set the service start to automatic. It has no problems running when someone is logged into the server. I'm not sure what i changed when i updated the version. Thanks

1 0

No cert?
by Dave Gradwell 27 Sep '16

27 Sep '16

Is there any way to configure a Stunnel server so that it doesn’t require a cert at all? I implement peer authentication using other means; I just want session encryption from Stunnel. Ideally, I’d like keys to be generated on-the-fly for each new connection. I don’t mind if this takes a few seconds… Thanks, Dave.

1 0

Re: [stunnel-users] Hangs when connecting -- advice pls
by Scott McKeown 21 Sep '16

21 Sep '16

Hi Guys, To me this looks like a cipher issue. There are a few options that you can try to resolve this if it is. I would try adding the following lines into your STunnel Configuration file: delay = yes options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = CIPHER_SERVER_PREFERENCE options = DONT_INSERT_EMPTY_FRAGMENTS Delay will delay and DNS lookups that maybe actioned by the request (not normally needed but I always include if for sanity sake) The three 'options' sections turn off all the known problematic cipher lists if you need a key that is in one of these block feel free to remove that directive but I think a good start would be to leave the 'NO_SSLv3' option in place The 'CIPHER_SERVER_PREFERENCE' option will make set whether the client is allowed to renegotiat the ciphers that are to be used between the client and the server process. And finally 'DONT_INSERT_EMPTY_FRAGMENTS' will mitigate an issue in the CBC ciphers that was in the SSLv3 and TLS1.0 cipher lists again I only include it for sanity sake now but its better to have than to go without. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 (24x7) Tel (US) - +1 888.867.9504 (Toll Free)(24x7)

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 146, Issue 10
by Hon Quach 16 Sep '16

16 Sep '16

Can I be please removed from the mailing list? Sent from my iPhone > On Sep 16, 2016, at 12:14 PM, stunnel-users-request(a)stunnel.org wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: compilation error with stunnel-5.35 (Josealf.rm) > 2. Re: compilation error with stunnel-5.35 (Viorel Panaite) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 16 Sep 2016 13:04:09 -0500 > From: "Josealf.rm" <josealf(a)rocketmail.com> > To: Viorel Panaite <Viorel.Panaite(a)tecsys.com> > Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> > Subject: Re: [stunnel-users] compilation error with stunnel-5.35 > Message-ID: <6CE9A3F0-EE74-4CF0-ACCE-C5941B6B40A2(a)rocketmail.com> > Content-Type: text/plain; charset="utf-8" > > > Visorel, > > Did you compile OpenSSL yourself? Did you enable shared library support? > Maybe you system is picking system installed OpenSSL headers (0.9.8) instead of the new ones. > > Regards > Jose > > > Enviado desde mi iPhone >> El 16/09/2016, a las 9:39 a.m., Viorel Panaite <Viorel.Panaite(a)tecsys.com> escribió: >> >> I downloaded stunnel-5.35 and I’m trying to compile using openssl-1.0.2h on RedHat EL linux 5.4 >> >> I get this error when I’m trying to compile them together, >> >> Configure log >> ./configure --prefix=/apps/stunnel/535 --with-ssl=/apps/openssl/1.0.2h/ >> ……………………. >> hecking for broken poll() implementation... no >> checking for pipe2... no >> checking for accept4... no >> configure: **************************************** optional features >> checking whether to enable IPv6 support... yes (default) >> checking whether to enable FIPS support... autodetecting >> checking whether to enable systemd socket activation support... autodetecting >> checking for library containing sd_listen_fds... no >> configure: systemd library not found >> checking whether to enable TCP wrappers support... autodetecting >> checking for hosts_access in -lwrap... yes >> configure: libwrap support enabled >> configure: **************************************** SSL >> checking for compiler sysroot... / >> checking for SSL directory... /apps/openssl/1.0.2h/ >> checking for FIPS_mode_set... yes >> configure: FIPS support enabled >> configure: **************************************** write the results >> checking that generated files are newer than configure... done >> configure: creating ./config.status >> config.status: creating Makefile >> config.status: creating src/Makefile >> config.status: creating doc/Makefile >> config.status: creating tools/Makefile >> config.status: creating src/config.h >> config.status: src/config.h is unchanged >> config.status: executing depfiles commands >> config.status: executing libtool commands >> configure: **************************************** success >> >> make log >> >> [root@mybox stunnel-5.35]# make >> Making all in src >> make[1]: Entering directory `/apps/stunnel/stunnel-5.35/src' >> make all-am >> make[2]: Entering directory `/apps/stunnel/stunnel-5.35/src' >> CCLD stunnel >> /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libssl.a when searching for -lssl >> /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libcrypto.a when searching for -lcrypto >> stunnel-client.o: In function `client_run': >> /apps/stunnel/stunnel-5.35/src/client.c:201: undefined reference to `ERR_remove_thread_state' >> stunnel-options.o: In function `parse_service_option': >> /apps/stunnel/stunnel-5.35/src/options.c:2669: undefined reference to `TLSv1_2_client_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2670: undefined reference to `TLSv1_2_server_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2662: undefined reference to `TLSv1_1_client_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2663: undefined reference to `TLSv1_1_server_method' >> stunnel-ctx.o: In function `auth_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:442: undefined reference to `SSL_CTX_set_psk_server_callback' >> stunnel-ctx.o: In function `context_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:133: undefined reference to `SSL_CTX_set_client_cert_engine' >> stunnel-ctx.o: In function `auth_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:440: undefined reference to `SSL_CTX_set_psk_client_callback' >> stunnel-ctx.o: In function `conf_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:376: undefined reference to `SSL_CONF_CTX_new' >> /apps/stunnel/stunnel-5.35/src/ctx.c:381: undefined reference to `SSL_CONF_CTX_set_ssl_ctx' >> /apps/stunnel/stunnel-5.35/src/ctx.c:382: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:383: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:385: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:392: undefined reference to `SSL_CONF_cmd' >> /apps/stunnel/stunnel-5.35/src/ctx.c:420: undefined reference to `SSL_CONF_CTX_finish' >> /apps/stunnel/stunnel-5.35/src/ctx.c:422: undefined reference to `SSL_CONF_CTX_free' >> stunnel-ctx.o: In function `ecdh_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:351: undefined reference to `EC_KEY_new_by_curve_name' >> /apps/stunnel/stunnel-5.35/src/ctx.c:359: undefined reference to `EC_KEY_free' >> stunnel-ctx.o: In function `conf_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:414: undefined reference to `SSL_CONF_CTX_free' >> /apps/stunnel/stunnel-5.35/src/ctx.c:409: undefined reference to `SSL_CONF_CTX_free' >> /apps/stunnel/stunnel-5.35/src/ctx.c:425: undefined reference to `SSL_CONF_CTX_free' >> stunnel-ctx.o: In function `servername_cb': >> /apps/stunnel/stunnel-5.35/src/ctx.c:229: undefined reference to `SSL_get_servername' >> /apps/stunnel/stunnel-5.35/src/ctx.c:253: undefined reference to `SSL_set_SSL_CTX' >> stunnel-verify.o: In function `ocsp_request': >> /apps/stunnel/stunnel-5.35/src/verify.c:499: undefined reference to `OCSP_CERTID_dup' >> stunnel-verify.o: In function `ocsp_get_response': >> /apps/stunnel/stunnel-5.35/src/verify.c:614: undefined reference to `OCSP_sendreq_new' >> /apps/stunnel/stunnel-5.35/src/verify.c:625: undefined reference to `OCSP_REQ_CTX_add1_header' >> /apps/stunnel/stunnel-5.35/src/verify.c:629: undefined reference to `OCSP_REQ_CTX_add1_header' >> /apps/stunnel/stunnel-5.35/src/verify.c:634: undefined reference to `OCSP_REQ_CTX_set1_req' >> /apps/stunnel/stunnel-5.35/src/verify.c:641: undefined reference to `OCSP_sendreq_nbio' >> /apps/stunnel/stunnel-5.35/src/verify.c:668: undefined reference to `OCSP_REQ_CTX_free' >> stunnel-verify.o: In function `cert_check_subject': >> /apps/stunnel/stunnel-5.35/src/verify.c:299: undefined reference to `X509_check_host' >> stunnel-verify.o: In function `ocsp_check': >> /apps/stunnel/stunnel-5.35/src/verify.c:457: undefined reference to `X509_get1_ocsp' >> stunnel-verify.o: In function `cert_check_subject': >> /apps/stunnel/stunnel-5.35/src/verify.c:312: undefined reference to `X509_check_email' >> /apps/stunnel/stunnel-5.35/src/verify.c:323: undefined reference to `X509_check_ip_asc' >> stunnel-verify.o: In function `cert_check_local': >> /apps/stunnel/stunnel-5.35/src/verify.c:356: undefined reference to `X509_STORE_get1_certs' >> stunnel-sthreads.o: In function `sthreads_init': >> /apps/stunnel/stunnel-5.35/src/sthreads.c:287: undefined reference to `CRYPTO_THREADID_set_callback' >> stunnel-sthreads.o: In function `threadid_func': >> /apps/stunnel/stunnel-5.35/src/sthreads.c:268: undefined reference to `CRYPTO_THREADID_set_numeric' >> collect2: ld returned 1 exit status >> make[2]: *** [stunnel] Error 1 >> make[2]: Leaving directory `/apps/stunnel/stunnel-5.35/src' >> make[1]: *** [all] Error 2 >> make[1]: Leaving directory `/apps/stunnel/stunnel-5.35/src' >> make: *** [all-recursive] Error 1 >> >> Thanks for your help. >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

compilation error with stunnel-5.35
by Viorel Panaite 16 Sep '16

16 Sep '16

I downloaded stunnel-5.35 and I'm trying to compile using openssl-1.0.2h on RedHat EL linux 5.4 I get this error when I'm trying to compile them together, Configure log ./configure --prefix=/apps/stunnel/535 --with-ssl=/apps/openssl/1.0.2h/ ......................... hecking for broken poll() implementation... no checking for pipe2... no checking for accept4... no configure: **************************************** optional features checking whether to enable IPv6 support... yes (default) checking whether to enable FIPS support... autodetecting checking whether to enable systemd socket activation support... autodetecting checking for library containing sd_listen_fds... no configure: systemd library not found checking whether to enable TCP wrappers support... autodetecting checking for hosts_access in -lwrap... yes configure: libwrap support enabled configure: **************************************** SSL checking for compiler sysroot... / checking for SSL directory... /apps/openssl/1.0.2h/ checking for FIPS_mode_set... yes configure: FIPS support enabled configure: **************************************** write the results checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating src/config.h config.status: src/config.h is unchanged config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success make log [root@mybox stunnel-5.35]# make Making all in src make[1]: Entering directory `/apps/stunnel/stunnel-5.35/src' make all-am make[2]: Entering directory `/apps/stunnel/stunnel-5.35/src' CCLD stunnel /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libssl.a when searching for -lssl /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libcrypto.a when searching for -lcrypto stunnel-client.o: In function `client_run': /apps/stunnel/stunnel-5.35/src/client.c:201: undefined reference to `ERR_remove_thread_state' stunnel-options.o: In function `parse_service_option': /apps/stunnel/stunnel-5.35/src/options.c:2669: undefined reference to `TLSv1_2_client_method' /apps/stunnel/stunnel-5.35/src/options.c:2670: undefined reference to `TLSv1_2_server_method' /apps/stunnel/stunnel-5.35/src/options.c:2662: undefined reference to `TLSv1_1_client_method' /apps/stunnel/stunnel-5.35/src/options.c:2663: undefined reference to `TLSv1_1_server_method' stunnel-ctx.o: In function `auth_init': /apps/stunnel/stunnel-5.35/src/ctx.c:442: undefined reference to `SSL_CTX_set_psk_server_callback' stunnel-ctx.o: In function `context_init': /apps/stunnel/stunnel-5.35/src/ctx.c:133: undefined reference to `SSL_CTX_set_client_cert_engine' stunnel-ctx.o: In function `auth_init': /apps/stunnel/stunnel-5.35/src/ctx.c:440: undefined reference to `SSL_CTX_set_psk_client_callback' stunnel-ctx.o: In function `conf_init': /apps/stunnel/stunnel-5.35/src/ctx.c:376: undefined reference to `SSL_CONF_CTX_new' /apps/stunnel/stunnel-5.35/src/ctx.c:381: undefined reference to `SSL_CONF_CTX_set_ssl_ctx' /apps/stunnel/stunnel-5.35/src/ctx.c:382: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:383: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:385: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:392: undefined reference to `SSL_CONF_cmd' /apps/stunnel/stunnel-5.35/src/ctx.c:420: undefined reference to `SSL_CONF_CTX_finish' /apps/stunnel/stunnel-5.35/src/ctx.c:422: undefined reference to `SSL_CONF_CTX_free' stunnel-ctx.o: In function `ecdh_init': /apps/stunnel/stunnel-5.35/src/ctx.c:351: undefined reference to `EC_KEY_new_by_curve_name' /apps/stunnel/stunnel-5.35/src/ctx.c:359: undefined reference to `EC_KEY_free' stunnel-ctx.o: In function `conf_init': /apps/stunnel/stunnel-5.35/src/ctx.c:414: undefined reference to `SSL_CONF_CTX_free' /apps/stunnel/stunnel-5.35/src/ctx.c:409: undefined reference to `SSL_CONF_CTX_free' /apps/stunnel/stunnel-5.35/src/ctx.c:425: undefined reference to `SSL_CONF_CTX_free' stunnel-ctx.o: In function `servername_cb': /apps/stunnel/stunnel-5.35/src/ctx.c:229: undefined reference to `SSL_get_servername' /apps/stunnel/stunnel-5.35/src/ctx.c:253: undefined reference to `SSL_set_SSL_CTX' stunnel-verify.o: In function `ocsp_request': /apps/stunnel/stunnel-5.35/src/verify.c:499: undefined reference to `OCSP_CERTID_dup' stunnel-verify.o: In function `ocsp_get_response': /apps/stunnel/stunnel-5.35/src/verify.c:614: undefined reference to `OCSP_sendreq_new' /apps/stunnel/stunnel-5.35/src/verify.c:625: undefined reference to `OCSP_REQ_CTX_add1_header' /apps/stunnel/stunnel-5.35/src/verify.c:629: undefined reference to `OCSP_REQ_CTX_add1_header' /apps/stunnel/stunnel-5.35/src/verify.c:634: undefined reference to `OCSP_REQ_CTX_set1_req' /apps/stunnel/stunnel-5.35/src/verify.c:641: undefined reference to `OCSP_sendreq_nbio' /apps/stunnel/stunnel-5.35/src/verify.c:668: undefined reference to `OCSP_REQ_CTX_free' stunnel-verify.o: In function `cert_check_subject': /apps/stunnel/stunnel-5.35/src/verify.c:299: undefined reference to `X509_check_host' stunnel-verify.o: In function `ocsp_check': /apps/stunnel/stunnel-5.35/src/verify.c:457: undefined reference to `X509_get1_ocsp' stunnel-verify.o: In function `cert_check_subject': /apps/stunnel/stunnel-5.35/src/verify.c:312: undefined reference to `X509_check_email' /apps/stunnel/stunnel-5.35/src/verify.c:323: undefined reference to `X509_check_ip_asc' stunnel-verify.o: In function `cert_check_local': /apps/stunnel/stunnel-5.35/src/verify.c:356: undefined reference to `X509_STORE_get1_certs' stunnel-sthreads.o: In function `sthreads_init': /apps/stunnel/stunnel-5.35/src/sthreads.c:287: undefined reference to `CRYPTO_THREADID_set_callback' stunnel-sthreads.o: In function `threadid_func': /apps/stunnel/stunnel-5.35/src/sthreads.c:268: undefined reference to `CRYPTO_THREADID_set_numeric' collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/apps/stunnel/stunnel-5.35/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/apps/stunnel/stunnel-5.35/src' make: *** [all-recursive] Error 1 Thanks for your help.

2 2

Hangs when connecting -- advice pls
by Dave Gradwell 14 Sep '16

14 Sep '16

My Stunnel client gets to this point, then hangs indefinitely: SSL state (connect): SSLv2/v3 write client hello A Is this a fault with Stunnel or is it something I’m doing wrong Full client-side output: """"""""""""""""""" Last login: Wed Sep 14 06:50:40 on ttys004 Daves-MBP-2016:~ dave$ /Users/dave/Desktop/stunnel-test/stunnel /Users/dave/Desktop/stunnel-test/stunnel-sender.conf 2016.09.14 06:54:35 LOG7[ui]: Clients allowed=125 2016.09.14 06:54:35 LOG7[cron]: Cron thread initialized 2016.09.14 06:54:35 LOG5[ui]: stunnel 5.35 on x86_64-apple-darwin15.4.0 platform 2016.09.14 06:54:35 LOG5[ui]: Compiled with OpenSSL 0.9.8zd 8 Jan 2015 2016.09.14 06:54:35 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016 2016.09.14 06:54:35 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2016.09.14 06:54:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI 2016.09.14 06:54:35 LOG7[ui]: errno: (*__error()) 2016.09.14 06:54:35 LOG5[ui]: Reading configuration from file /Users/dave/Desktop/stunnel-test/stunnel-sender.conf 2016.09.14 06:54:35 LOG5[ui]: UTF-8 byte order mark not detected 2016.09.14 06:54:35 LOG7[ui]: Compression disabled 2016.09.14 06:54:35 LOG7[ui]: Snagged 64 random bytes from /Users/dave/.rnd 2016.09.14 06:54:35 LOG7[ui]: Wrote 1024 new random bytes to /Users/dave/.rnd 2016.09.14 06:54:35 LOG7[ui]: PRNG seeded successfully 2016.09.14 06:54:35 LOG6[ui]: Initializing inetd mode configuration 2016.09.14 06:54:35 LOG6[ui]: Loading certificate from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Certificate loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Loading private key from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG4[ui]: Insecure file permissions on /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Private key loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG7[ui]: Private key check succeeded 2016.09.14 06:54:35 LOG4[ui]: Service [stunnel] needs authentication to prevent MITM attacks 2016.09.14 06:54:35 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.09.14 06:54:35 LOG5[ui]: Configuration successful 2016.09.14 06:54:35 LOG7[ui]: Service [stunnel] started 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] accepted connection 2016.09.14 06:54:35 LOG6[ui]: failover: round-robin, starting at entry #0 2016.09.14 06:54:35 LOG6[ui]: s_connect: connecting ::1:874 2016.09.14 06:54:35 LOG7[ui]: s_connect: s_poll_wait ::1:874: waiting 10 seconds 2016.09.14 06:54:35 LOG5[ui]: s_connect: connected ::1:874 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] connected remote server from ::1:51362 2016.09.14 06:54:35 LOG7[ui]: Option TCP_NODELAY set on remote socket 2016.09.14 06:54:35 LOG7[ui]: Remote descriptor (FD=3) initialized 2016.09.14 06:54:35 LOG6[ui]: SNI: sending servername: localhost 2016.09.14 06:54:35 LOG6[ui]: Peer certificate not required 2016.09.14 06:54:35 LOG7[ui]: SSL state (connect): before/connect initialization 2016.09.14 06:54:35 LOG7[ui]: SSL state (connect): SSLv2/v3 write client hello A ^C Daves-MBP-2016:~ dave$ """"""""""""""""""" My stunnel-sender.conf: """"""""""""""""""" debug = 7 output = /Users/dave/Desktop/stunnel-test/sender-stunnel-output.log foreground = yes client = yes connect = localhost:874 cert = /Users/dave/Desktop/stunnel-test/cert.pem verify = 0 """"""""""""""""""" My stunnel-receiver.conf: """"""""""""""""""" debug = 7 output = /Users/dave/Desktop/stunnel-test/receiver-stunnels-output.log pid = /Users/dave/Desktop/stunnel-test/stunnel-rsyncd-stunnels.pid cert = /Users/dave/Desktop/stunnel-test/cert.pem verify = 0 delay = yes exec = /Users/dave/Desktop/stunnel-test/rsync execArgs = -vvvv --daemon --server --config=/Users/dave/Desktop/stunnel-test/stunnel-rsyncd.conf . foreground = yes client = no """"""""""""""""""" My receiver-error.log: """"""""""""""""""" 2016.09.14 06:54:35 LOG7[ui]: Clients allowed=125 2016.09.14 06:54:35 LOG7[cron]: Cron thread initialized 2016.09.14 06:54:35 LOG5[ui]: stunnel 5.35 on x86_64-apple-darwin15.4.0 platform 2016.09.14 06:54:35 LOG5[ui]: Compiled with OpenSSL 0.9.8zd 8 Jan 2015 2016.09.14 06:54:35 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016 2016.09.14 06:54:35 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2016.09.14 06:54:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI 2016.09.14 06:54:35 LOG7[ui]: errno: (*__error()) 2016.09.14 06:54:35 LOG5[ui]: Reading configuration from file /Users/dave/Desktop/stunnel-test/stunnel-receiver.conf 2016.09.14 06:54:35 LOG5[ui]: UTF-8 byte order mark not detected 2016.09.14 06:54:35 LOG7[ui]: Compression disabled 2016.09.14 06:54:35 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2016.09.14 06:54:35 LOG7[ui]: PRNG seeded successfully 2016.09.14 06:54:35 LOG6[ui]: Initializing inetd mode configuration 2016.09.14 06:54:35 LOG6[ui]: Loading certificate from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Certificate loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Loading private key from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG4[ui]: Insecure file permissions on /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Private key loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG7[ui]: Private key check succeeded 2016.09.14 06:54:35 LOG7[ui]: DH initialization 2016.09.14 06:54:35 LOG7[ui]: Using DH parameters from /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: 2048-bit DH parameters loaded 2016.09.14 06:54:35 LOG7[ui]: ECDH initialization 2016.09.14 06:54:35 LOG7[ui]: ECDH initialized with curve prime256v1 2016.09.14 06:54:35 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.09.14 06:54:35 LOG5[ui]: Configuration successful 2016.09.14 06:54:35 LOG7[ui]: Service [stunnel] started 2016.09.14 06:54:35 LOG7[ui]: Option TCP_NODELAY set on local socket 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] accepted connection from ::1:51362 2016.09.14 06:54:35 LOG6[ui]: Peer certificate not required 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): before/accept initialization 2016.09.14 06:54:35 LOG7[ui]: SNI: no virtual services defined 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 read client hello A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write server hello A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write certificate A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write certificate request A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 flush data 2016.09.14 06:54:40 LOG3[ui]: SSL_accept: Peer suddenly disconnected 2016.09.14 06:54:40 LOG5[ui]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.14 06:54:40 LOG7[ui]: Deallocating application specific data for addr index 2016.09.14 06:54:40 LOG7[ui]: Service [stunnel] finished (0 left) """"""""""""""""""" The server-side-Stunnel is invoked via launchd using this LaunchDaemon (but this seems to be working okay — I think): """"""""""""""""""" <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Disabled</key> <false/> <key>StandardErrorPath</key> <string>/Users/dave/Desktop/stunnel-test/receiver-error.log</string> <key>StandardOutPath</key> <string>/Users/dave/Desktop/stunnel-test/receiver-out.log</string> <key>Label</key> <string>com.stunnel.test</string> <key>ProgramArguments</key> <array> <string>/Users/dave/Desktop/stunnel-test/stunnel</string> <string>/Users/dave/Desktop/stunnel-test/stunnel-receiver.conf</string> </array> <key>inetdCompatibility</key> <dict> <key>Wait</key> <false/> </dict> <key>Sockets</key> <dict> <key>Listeners</key> <dict> <key>SockServiceName</key> <string>874</string> <key>SockType</key> <string>stream</string> </dict> </dict> </dict> </plist> """"""""""""""""""" I’ve looked at the output of bash-3.2# tcpdump -i all -XX -xx -vv port 874 but this didn’t give me any obvious clues. I can send it if it’s useful but I’ve omitted it for now as it’s long. I’ve reproduced the same hang on Mac OS X 10.11 and 10.6. I’ve recompiled Stunnel in 10.11 and 10.9 environments but still get this same hang. Any advice appreciated.. — Dave.

1 0

Re: [stunnel-users] stunnel 5.x no answer in server mode?
by Ulli Horlacher 14 Sep '16

14 Sep '16

On Tue 2016-09-13 (22:25), Micha?? Trojnara wrote: > On 13.09.2016 20:35, Ulli Horlacher wrote: > >> It is impossible to say anything without analysis of the executed fexsrv > >> program. > > > > The problem cannot be in fexsrv, because it works with stunnel 4.27 > > What is the point of sending an email to the mailing list when you > ignore our effort to help you? Where do I ignore help? > fexsrv terminates immediately with exit code 1. No. It does not start at all, so it does not terminate. fexsrv logs everything and when running with stunnel 5.x the log file is empty. But meanwhile I found the error: stunnel 5.x needs the a full path for the exec statement: exec = /usr/bin/perl For stunnel 4.x it was sufficent to use: exec = perl -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<45835cd9-b239-d80c-38a0-3f978132e40e(a)stunnel.org>

2 1

Errors in log
by Mark Hannig 13 Sep '16

13 Sep '16

Can you please help me. Stunnel has been working fine for months and I just started getting these errors in the last day or two. Thank you: 2016.09.11 13:43:38 LOG5[10]: Service [ssmtp] accepted connection from 46.101.193.127:33818 2016.09.11 13:43:40 LOG3[10]: SSL_accept: Peer suddenly disconnected 2016.09.11 13:43:40 LOG5[10]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 13:43:40 LOG5[11]: Service [ssmtp] accepted connection from 46.101.193.127:34154 2016.09.11 13:43:40 LOG3[11]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:ssl3_get_client_hello:wrong version number 2016.09.11 13:43:40 LOG5[11]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 13:43:40 LOG5[12]: Service [ssmtp] accepted connection from 46.101.193.127:34254 2016.09.11 13:43:42 LOG3[12]: s_connect: connect 127.0.0.1:25: Connection refused (WSAECONNREFUSED) (10061) 2016.09.11 13:43:42 LOG5[12]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 17:22:39 LOG5[13]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:58020 2016.09.11 17:22:39 LOG5[13]: s_connect: connected 52.35.228.26:465 2016.09.11 17:22:39 LOG5[13]: Service [smtp-tls-wrapper] connected remote server from 172.31.10.223:58021 2016.09.11 17:22:40 LOG5[13]: Connection closed: 7072 byte(s) sent to SSL, 369 byte(s) sent to socket 2016.09.11 17:22:40 LOG5[14]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:58022 2016.09.11 17:22:40 LOG5[14]: s_connect: connected 52.35.58.187:465 2016.09.11 17:22:40 LOG5[14]: Service [smtp-tls-wrapper] connected remote server from 172.31.10.223:58023 2016.09.11 17:22:40 LOG5[14]: Connection closed: 7302 byte(s) sent to SSL, 361 byte(s) sent to socket -- Mark F. Hannig mhannig(a)gmail.com

2 2

Re: [stunnel-users] stunnel 5.x no answer in server mode?
by Ulli Horlacher 13 Sep '16

13 Sep '16

On Tue 2016-09-13 (12:10), Ma??gorzata Olszówka wrote: > > I use stunnel as a https proxy for my own http server (*). > > > > The server mode of stunnel 5.x does not work any more. > > It accepts the connection and then immediatelly closes it without sending > > back any data. > > stunnel 4.x is working fine (for many years!), with the same configuration. > > The client receives no data at all, the connection is closed by the server > > (stunnel). > > > > As I wrote: with stunnel 4.27 everything works as expected. Does stunnel > > 5.x need another configuration? > > The log messages show, that the child process terminated with code 1. > This is the point where you should start looking for the cause. The client fexsrv does not start at all with stunnel 5.x, whereas with stunnel 4.27 everything works fine. > It is impossible to say anything without analysis of the executed fexsrv > program. The problem cannot be in fexsrv, because it works with stunnel 4.27 -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<f0622f17-fd11-bdb8-4a82-9665463c0d64(a)olszowka.net>

1 0

Upgrade from 5.03 to 5.35
by Hon Quach 07 Sep '16

07 Sep '16

Hi, When I perform the upgrade the stunnel service won't start, it tries to load the pem files but it is failing. I noticed when I install stunnel on my test system, the conf file is different from the version 5.03. I'm looking for documentation a on how to perform a clean upgrade but I'm having difficulty finding that information. Thanks! Sent from my iPhone

1 0

stunnel 5.x no answer in server mode?
by Ulli Horlacher 31 Aug '16

31 Aug '16

I use stunnel as a https proxy for my own http server (*). The server mode of stunnel 5.x does not work any more. It accepts the connection and then immediatelly closes it without sending back any data. stunnel 4.x is working fine (for many years!), with the same configuration. Here is my (test) config which shows the problem (host is Ubuntu 16.04): root@xerus:/tmp# cat stunnel.conf pid = /tmp/stunnel.pid output = /home/fex/spool/stunneld.log debug = debug fips = no foreground = yes [https] accept = 443 cert = /home/fex/etc/stunnel.pem sslVersion = all TIMEOUTclose = 1 exec = perl execargs = perl -T /home/fex/bin/fexsrv stunnel root@xerus:/tmp# /opt/stunnel-5.35/bin/stunnel stunnel.conf 2016.08.30 18:58:55 LOG7[ui]: Clients allowed=500 2016.08.30 18:58:55 LOG5[ui]: stunnel 5.35 on x86_64-unknown-linux-gnu platform 2016.08.30 18:58:55 LOG5[ui]: Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 2016.08.30 18:58:55 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.08.30 18:58:55 LOG7[ui]: errno: (*__errno_location ()) 2016.08.30 18:58:55 LOG5[ui]: Reading configuration from file /tmp/stunnel.conf 2016.08.30 18:58:55 LOG5[ui]: UTF-8 byte order mark not detected 2016.08.30 18:58:55 LOG5[ui]: FIPS mode disabled 2016.08.30 18:58:55 LOG7[ui]: Compression disabled 2016.08.30 18:58:55 LOG7[ui]: Snagged 64 random bytes from /root/.rnd 2016.08.30 18:58:55 LOG7[ui]: Wrote 1024 new random bytes to /root/.rnd 2016.08.30 18:58:55 LOG7[ui]: PRNG seeded successfully 2016.08.30 18:58:55 LOG6[ui]: Initializing service [https] 2016.08.30 18:58:55 LOG6[ui]: Loading certificate from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Certificate loaded from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Loading private key from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Private key loaded from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG7[ui]: Private key check succeeded 2016.08.30 18:58:55 LOG7[ui]: DH initialization 2016.08.30 18:58:55 LOG7[ui]: Using DH parameters from /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: 1024-bit DH parameters loaded 2016.08.30 18:58:55 LOG7[ui]: ECDH initialization 2016.08.30 18:58:55 LOG7[ui]: ECDH initialized with curve prime256v1 2016.08.30 18:58:55 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.08.30 18:58:55 LOG5[ui]: Configuration successful 2016.08.30 18:58:55 LOG7[ui]: Listening file descriptor created (FD=7) 2016.08.30 18:58:55 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2016.08.30 18:58:55 LOG7[ui]: Service [https] (FD=7) bound to 0.0.0.0:443 2016.08.30 18:58:55 LOG7[ui]: Created pid file /tmp/stunnel.pid (here comes the https client connect) 2016.08.30 18:59:20 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.30 18:59:20 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2016.08.30 18:59:20 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2016.08.30 18:59:20 LOG7[ui]: Service [https] accepted (FD=3) from 127.0.0.1:44166 2016.08.30 18:59:20 LOG7[0]: Service [https] started 2016.08.30 18:59:20 LOG7[0]: Option TCP_NODELAY set on local socket 2016.08.30 18:59:20 LOG5[0]: Service [https] accepted connection from 127.0.0.1:44166 2016.08.30 18:59:20 LOG6[0]: Peer certificate not required 2016.08.30 18:59:20 LOG7[0]: SSL state (accept): before/accept initialization 2016.08.30 18:59:20 LOG7[0]: SNI: no virtual services defined 2016.08.30 18:59:20 LOG7[0]: New session callback 2016.08.30 18:59:20 LOG7[0]: 1 server accept(s) requested 2016.08.30 18:59:20 LOG7[0]: 1 server accept(s) succeeded 2016.08.30 18:59:20 LOG7[0]: 0 server renegotiation(s) requested 2016.08.30 18:59:20 LOG7[0]: 0 session reuse(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache item(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache fill-up(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache miss(es) 2016.08.30 18:59:20 LOG7[0]: 0 external session cache hit(s) 2016.08.30 18:59:20 LOG7[0]: 0 expired session(s) retrieved 2016.08.30 18:59:20 LOG6[0]: SSL accepted: new session negotiated 2016.08.30 18:59:20 LOG6[0]: No peer certificate received 2016.08.30 18:59:20 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-SHA256 (128-bit encryption) 2016.08.30 18:59:20 LOG7[0]: Compression: null, expansion: null 2016.08.30 18:59:20 LOG6[0]: Local mode child started (PID=30833) 2016.08.30 18:59:20 LOG7[0]: Option TCP_NODELAY set on remote socket 2016.08.30 18:59:20 LOG7[0]: Remote descriptor (FD=11) initialized 2016.08.30 18:59:20 LOG6[0]: Read socket closed (readsocket) 2016.08.30 18:59:20 LOG7[0]: Sending close_notify alert 2016.08.30 18:59:20 LOG7[0]: SSL alert (write): warning: close notify 2016.08.30 18:59:20 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2016.08.30 18:59:20 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.30 18:59:20 LOG7[ui]: FD=4 events=0x2001 revents=0x1 2016.08.30 18:59:20 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2016.08.30 18:59:20 LOG7[ui]: Dispatching signals from the signal pipe 2016.08.30 18:59:20 LOG7[ui]: Processing SIGCHLD 2016.08.30 18:59:20 LOG6[ui]: Child process 30833 finished with code 1 2016.08.30 18:59:20 LOG7[ui]: Signal pipe is empty 2016.08.30 18:59:20 LOG3[0]: socket fd: Broken pipe (32) 2016.08.30 18:59:20 LOG6[0]: writesocket: Socket is closed 2016.08.30 18:59:20 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 23 byte(s) sent to socket 2016.08.30 18:59:20 LOG7[0]: Remote descriptor (FD=11) closed 2016.08.30 18:59:20 LOG7[0]: Local descriptor (FD=3) closed 2016.08.30 18:59:20 LOG7[0]: Service [https] finished (0 left) The client receives no data at all, the connection is closed by the server (stunnel). As I wrote: with stunnel 4.27 everything works as expected. Does stunnel 5.x need another configuration? (*) http://fex.rus.uni-stuttgart.de/ -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<20160831074057.GA13703(a)rus.uni-stuttgart.de>

1 0

Issue with stunnel over squid
by Mike McPhee 30 Aug '16

30 Aug '16

Hello, I have a windows machine running as a stunnel client that establishes a session but then, when launching an SSH session to my loopback crashes. Putty reports that the "Server unexpectedly closed the network connection." Here are the logs: 2016.08.30 16:06:08 LOG5[main]: Reading configuration from file stunnel.conf 2016.08.30 16:06:08 LOG5[main]: UTF-8 byte order mark detected 2016.08.30 16:06:08 LOG5[main]: FIPS mode disabled 2016.08.30 16:06:08 LOG4[main]: Service [squid] needs authentication to prevent MITM attacks 2016.08.30 16:06:08 LOG5[main]: Configuration successful 2016.08.30 16:06:17 LOG5[2]: Service [squid] accepted connection from 127.0.0.1:55791 2016.08.30 16:06:17 LOG5[2]: s_connect: connected 10.5.8.74:8888 2016.08.30 16:06:17 LOG5[2]: Service [squid] connected remote server from 10.5.8.69:55792 2016.08.30 16:06:17 LOG5[2]: Connection closed: 28 byte(s) sent to SSL, 0 byte(s) sent to socket Here is the server-side stunnel.conf: sslVersion = all options = NO_SSLv2 client = no cert = /etc/stunnel/server.pem pid = /var/run/stunnel.pid output = /var/log/stunnel [squid] accept = 8888 connect = 127.0.0.1:3128 cert = /etc/stunnel/stunnel.pem [openvpn] client = no accept = 993 connect = 34567 Here is the client side (Windows 7): cert = stunnel.pem client = yes [squid] accept = 127.0.0.1:8080 connect = 10.5.8.74:8443 I seem to be negotiating all of the appropriate keys, openvpn and squid3 are verified running, and have iptables configured, so I am not sure what I am missing. Can anyone assist? Thanks in advance! Mike

1 0

-reopen for Ubuntu?
by mguyre＠comcast.net 24 Aug '16

24 Aug '16

Are there any plans to add the -reopen functionality to other operating systems? Thanks Mike

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users