- stunnel-users - stunnel.org

STunnel nCipher openssl chil problems
by Marc Phillips 06 Aug '15

06 Aug '15

Has anyone managed to get STunnel to work with nCipher using the chil engine? STunnel appears to load the engine just fine, but failes when loading the key: [ ] Enabling support for engine "chil" [ ] Initializing engine #1 (chil) [ ] Engine #1 (chil) initialized [.] FIPS mode disabled [ ] Compression disabled [ ] PRNG seeded successfully [ ] Initializing service [https-server] [ ] Loading certificate from file: /usr/local/stunnel/etc/keystores/servercert.crt [ ] Loading key from engine: /usr/local/stunnel/etc/keystores/servercert.key [!] error queue: 26096080: error:26096080:engine routines:ENGINE_load_private_key:failed loading private key [!] ENGINE_load_private_key: 80069066: error:80069066:CHIL engine:HWCRHK_LOAD_PRIVKEY:chil error [!] Service [https-server]: Failed to initialize SSL context Using openssl directly, the key works fine (both with s_server and s_client). My stunnel config is pretty simple: pid = /usr/local/var/log/stunnel.pid debug = 7 output = /usr/local/var/log/stunnel.log options = -NO_SSLv3 engine = chil CApath = /usr/local/etc/cacerts/ [https-server] engineNum=1 accept = 4466 connect = 4433 cert=/usr/local/stunnel/etc/keystores/servercert.crt key=/usr/local/stunnel/etc/keystores/servercert.key R. Marc

1 0

Install Guide for STunnel Version 5.22
by Deepak Subbanarasimha 05 Aug '15

05 Aug '15

All, Is there an install guide for Stunnel version 5.22 for windows? If so, could you point me to it? -Deepak IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

2 2

"Chained" stunnel instances
by Michael Gebis 01 Aug '15

01 Aug '15

Hello. I have a question about a strange stunnel configuration; specifically, I'm like to use 'chained' stunnel instances, and I'm running into an issue. We have a conceptually simple setup: a client that connects to a server. We use stunnel both for encryption and for the failover mechanism. Here's a diagram of our simplest setup: /----S1 / C--st0-----S2 \ \----S3 We have a client that connects to stunnel. Our stunnel configuration lists three connections with "prio" failover mode. So usually, connections go from C thru st and onto Server 1. If S1 is down, st0 fails to connect to S1 and instead tries S2, and all is good. However, sometimes we may place an optional second instance of stunnel in front of the servers. /----st1--S1 / C--st0-----st2--S2 \ \----st3--S3 The failover mode of stunnel does not work so well in this configuration. If S1 is down, st0's failover algorithm does not kick in. Instead, st0 happily connects to st1, which is still alive and running. st1 then detects S1 is down and immediately closes the connection, but st0 does not care. Since the initial connection was successful, it does not initiate the failover algorithm. You may ask "why not change to round-robin mode?" The answer is that S1 is a dedicated machine, and S2/S3 are underpowered backups that have other primary responsibilities. We really want to direct all connections to S1 and only use S2/S3 in emergencies. You may also ask, "Why the second layer of stunnel?"--unfortunately, there are several hairy implementation-specific details that make this hard to change. My question is: is there any stunnel configuration option that can help us out? We would like the failover to work with and without the second layer of stunnel. From looking at the source code, I think I'm out of luck, but I figured it couldn't hurt to ask. Thanks! Michael

3 3

stunnel 5.21 - fails to listen on both IPv4/IPv6 (Linux)
by Lonnie Abelbeck 30 Jul '15

30 Jul '15

Very long-time user with the AstLinux project... stunnel 5.19 works fine, when upgrading to stunnel 5.21 with the same config I get: -- Starting Stunnel Server Proxy... [.] stunnel 5.21 on i586-pc-linux-gnu platform [.] Compiled/running with OpenSSL 1.0.1p 9 Jul 2015 [.] Threading:FORK Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/server.conf [.] UTF-8 byte order mark not detected [ ] Compression disabled [ ] PRNG seeded successfully [!] Error resolving "::": Address family for nodename not supported (EAI_ADDRFAMILY) [!] /etc/stunnel/server.conf:14: "accept = :::8443": Failed to resolve accepting address -- Has the syntax changed to listen on both IPv4/IPv6 ? Lonnie

2 2

Configuring stunnel on multi tenant server
by Saurabh Beriwal 30 Jul '15

30 Jul '15

Hi All, I want to configure stunnel on multi tenant server. Please let us know the best possible way to do this. Also is it OK if I keep multiple accept and connect parameters in stunnel configuration file. Thank you.

2 1

stunnel 5.22 released
by Michal Trojnara 30 Jul '15

30 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.22 of stunnel. The ChangeLog entry: Version 5.22, 2015.07.30, urgency: HIGH * New features - "OCSPaia = yes" added to the configuration file templates. - Improved double free detection. * Bugfixes - Fixed a number of OCSP bugs. The most severe of those bugs caused stunnel to treat OCSP responses that failed OCSP_basic_verify() checks as if they were successful. - Fixed the passive IPv6 resolver (broken in stunnel 5.21). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 8ad628a6948153cdb2044283f6988384a30585ea7e14778c2ee616a6678cb83f stunnel-5.22.tar.gz 9b3fe70bcfeb64b013b7b926e475a7d100ef1fdf5ce352ad90ac1034f780ea2a stunnel-5.22-installer.exe 2f49313debe7af27feeab246a771dc513e5e368e1839e92fba4cfe0b2735aeba stunnel-5.22-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVufy2AAoJEC78f/DUFuAUHVYQAK+keyqWyllv3ky5hRi8DlXe LLtuUdTYTalI64Fg5/TYL6+fbrEjWoAWtGwg+X/muVNj7KW4twlKrakMtkDpSDNd 0xSh94/u/PCrPVThxCq7AUbTPLyrG6ox5RKYDkOKfyGQ3q5ix6yba0l6fQqHXPCr OAbaRuwn5U6u7lPxXa69ozwyY5JHIiGqhMfQJBRXwFoeNbWak3HM7+Pe5DZ0ACLa SRY0iCseR1aQ12pZaaNoknkAAL9kmHgRP+fuPFqKMkp8TgZ2469qg30s/Bzn7n0U h5GvAuhYkQdDDbC7ozWgqaNxRNpOe+3RZ50fpCueyAlZESe8agHcyXchoj4JUVx+ 5ihOms4WujamCtP4MzHrRo6eQpeoGbw1EZ2P//Q9TlxX4METgEfV0lzaR7n376jr y24xIFEMl2tnqJ81lKQZWlxAP4MiKZgr//GOueRewRCtYSSQcK/mHvxZMDFfHAc7 N2LUmzm+PpsHwto7VkUy1m4eEAb34Tr3QubzvrT1yD4YMQDR6tID+xkRmuJWjMhf qBcXecKetIQq70KuI+VVqJxdP3Ekgjb+xnNOSKelUP/TkHpvubjTViSIVPu+5DSb x2viDBKAbgWcER2aZsB6UWXfQwjT/apDhqu6XrwjAcFfBk0ul0QazmH0HMc9ouVd yziOHVATYgcXYcTIQvj9 =DTOg -----END PGP SIGNATURE-----

1 0

Questions between stunnel 4.56 and 5.21 (current version)
by Guy.Gaudreau.TCR06＠ssss.gouv.qc.ca 28 Jul '15

28 Jul '15

Will a 4.56 installation be able to establish a tunnel to a 5.21 version. Will a 5.21 installation be able to establsih a tunnel to a 4.56 version What happends If I have a server that is currently running a 4.56 version and we install the 5.21 version on the same server. Will both versions co-exist on the same server peacefully or will the install process uninstall the 4.56 version. in that last scenario will the tunnels already configured under versio 4.56 work under the 5.21 install? Thank you Guy Gaudreau

1 0

stunnel 5.21 released
by Michal Trojnara 27 Jul '15

27 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.21 of stunnel. The ChangeLog entry: Version 5.21, 2015.07.27, urgency: MEDIUM * New features - Signal names are displayed instead of numbers. - First resolve IPv4 addresses on passive resolver requests. This speeds up stunnel startup on Win32 with a slow/defunct DNS service. - The "make check" target was modified to only build Win32 executables when stunnel is built from a git repository (thx to Peter Pentchev). - More elaborate descriptions were added to the warning about using "verify = 2" without "checkHost" or "checkIP". - Performance optimization was performed on the debug code. * Bugfixes - Fixed the FORK and UCONTEXT threading support. - Fixed "failover=prio" (broken since stunnel 5.15). - Added a retry when sleep(3) was interrupted by a signal in the cron thread scheduler. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 2aef568b1955f5e233f6a8e17ebce3d30755f1be44c813f5a48e621f785596e3 stunnel-5.21.tar.gz d5ec83140060af2b373a82abab0f7fd34c76a68c4f2990d46be460526b325de6 stunnel-5.21-installer.exe 2788d9e11b65dd4b111616bab1d7f09943916c924ba023cc3ad4260ac1f6f6d7 stunnel-5.21-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVtfz2AAoJEC78f/DUFuAUey4P/0tQ8yj3Yt7K5yLIorDGu9lI w95Vs2MtyOvFQyoX24dPKrDULKmxE28Dg8RJt51ZuT9q8mIfPdBA+jphyfjbpzl0 BeNQNbzEfN36dhOa2+dvr4+fcna/lnRpNMQg6sP/z4KHDLoI72lAg9vVwv5VX/4X JAMAaTxbrOXuXOmVPLSdHBeug7Y/0Q/+jPg9tSEslMtBaJvMd4CcHs4q8dCW9OQv AUWLtOiSsubfCvQ9rwGODObFJCA3BINrmh3a9EyhKJTov+8JKHlJY02r4zGJYMC4 PIVAVZWit9mEFefG6BuEWwOw4gohAInDXpsN2X9BNNDfUAVlUtp6OoxATcGv/H45 Uf25Dz2Bu8WtKIuuCIhN79PBfqSG8f2mSwNsec8OcYNOTzkAHKoFQQfKbJ1FUD5+ lTBhOFfo/B5haQA1EHNf0z8JxDulnsL7JsQQo4hF3ShSiCZpEAVvSkixpwCjm2kR WCtQ0w5eLccD/CnfjNrcOp3QKGLacZ+PCm9MH+cQDQvnmhAaelWK+OL67L9FKwBf hbJMA2RwwjN7efwEeUlnzVTBiJS9fsPTJghh8CzYuDWlnhEEnB9WX2FI1yVZVxM+ 8tGifpdOkRCFhpQSQkj0pWy/qf/cU8mL2uM31hBNcsRjCt6PfjQfKQ7jyMFvicmc rWJhvWvAfLAJXl+rgn5r =WvhQ -----END PGP SIGNATURE-----

1 0

Disable TLSv1
by Smith, Michael 23 Jul '15

23 Jul '15

I am running stunnel version 5.20. How do I disable TLSv1 and leave only TLSv1.2 and TSLv2 enabled? Michael Smith System Specialist II 281-283-2930

2 1

Question about behavior with "failover = prio"
by Michael Gebis 22 Jul '15

22 Jul '15

Hello again. We recently noticed a behavior in stunnel that surprised us, and seems to be inconsistent with the man page description. We use "failover = prio" in our configuration file. To refresh everyone's memory, the man page describes this option here: failover = rr | prio Failover strategy for multiple "connect" targets. rr (round robin) - fair load distribution prio (priority) - use the order specified in config file default: rr Our config file contains a list of connect targets, like this: [...] connect = h1.example.com connect = h2.example.com connect = h3.example.com connect = h4.example.com [...] Based on the description, we expect the connection to try h1 first, and if h1 fails, failover through the remainder of the list, in-order. However, what we observe is that the connections start at a seemingly random place in the list. It does appear to proceed in-order...it's just the starting place that seems incorrect. For example, we might get a sequence that proceeds "h3->h4->h1->h2". Please let me know if I am misunderstanding the intended behavior of the 'prio' failover strategy. Here is a trial patch that hard-codes the starting place for the failover to the beginning of the list. I am not sure if this change has any unintended consequences for other configurations. But as a proof-of-concept, it does seem to fix the behavior to be consistent with our reading of the man page. This patch is against 5.20 but it appears that 5.21b2 acts the same way. Thanks! Michael diff -ru stunnel-5.20.orig/src/client.c stunnel-5.20-prio-fix/src/client.c --- stunnel-5.20.orig/src/client.c 2015-07-16 15:55:52.213064746 -0700 +++ stunnel-5.20-prio-fix/src/client.c 2015-07-17 16:13:12.129184507 -0700 @@ -1285,7 +1285,8 @@ *c->connect_addr.rr_ptr=(i+1)%c->connect_addr.num; s_log(LOG_INFO, "failover: round-robin"); } else { - s_log(LOG_INFO, "failover: priority"); + s_log(LOG_INFO, "failover: priority, starting at first entry"); + i=0; } return i; }

2 1

stunnel 5.20 issue using "--with-threads=ucontext"
by Michael Gebis 21 Jul '15

21 Jul '15

Hello. We recently upgraded from stunnel 5.10 to 5.20. We compile using "--with-threads=ucontext" and with this flag, compilation of 5.20 fails in two places. Both failures seem like minor oversights. Here is a proposed patch to fix the two failures. This patch is against 5.20, but I just checked the most recent 5.21b2 and it appears to require the same changes. Thanks! Michael diff -ru stunnel-5.20.orig/src/cron.c stunnel-5.20-ucontext-fix/src/cron.c --- stunnel-5.20.orig/src/cron.c 2015-07-16 15:55:52.214064748 -0700 +++ stunnel-5.20-ucontext-fix/src/cron.c 2015-07-16 16:15:56.593107354 -0700 @@ -47,7 +47,9 @@ #if defined(USE_PTHREAD) || defined(USE_WIN32) NOEXPORT void cron_worker(void); NOEXPORT void cron_dh_param(void); -#endif +#elif !defined(OPENSSL_NO_DH) +NOEXPORT void cron_dh_param(void); +#endif #if defined(USE_PTHREAD) diff -ru stunnel-5.20.orig/src/tls.c stunnel-5.20-ucontext-fix/src/tls.c --- stunnel-5.20.orig/src/tls.c 2015-07-16 15:55:52.180064660 -0700 +++ stunnel-5.20-ucontext-fix/src/tls.c 2015-07-16 15:56:30.520164252 -0700 @@ -110,7 +110,7 @@ if(ready_head) ready_head->tls=tls_data; else /* ucontext threads not initialized */ - global_tls=tls; + global_tls=tls_data; } TLS_DATA *tls_get() {

2 1

Unable to open log file
by Matt brancato 16 Jul '15

16 Jul '15

Hi all, Did a search but didn't see an answer so i figured i'd ask. I'm trying to runstunnel but am having some issues. I attempt to run stunnel but i run into an issue where it can't read the log file and then closes up. Any ideas? sudo stunnel stunnel.conf [ ] Clients allowed=500 [.] stunnel 5.19 on x86_64-unknown-linux-gnu platform [.] Compiled/running with OpenSSL 1.0.1 14 Mar 2012 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from /root/.rnd [ ] Wrote 1024 new random bytes to /root/.rnd [ ] PRNG seeded successfully [ ] Initializing service [<service>] [ ] Loading certificate from file: /etc/stunnel/server.pem [ ] Loading key from file: /etc/stunnel/server.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from /etc/stunnel/server.pem [ ] DH parameters will be generated [ ] Cron started [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=7) [ ] Service [<service>] (FD=7) bound to 127.0.0.1:9999 [ ] Executing cron jobs [.] Updating DH parameters [!] Cannot open log file: /home/tim/Desktop/stunnel.log [ ] Closing service [<service>] [ ] Service [<service>] closed (FD=7) [ ] Service [<service>] closed -- *CONFIDENTIALITY NOTICE* THE INFORMATION CONTAINED IN THIS COMMUNICATION IS INTENDED FOR THE NAMED RECEIVER ONLY. THE TRANSMISSION MAY CONTAIN PRIVILEGED AND CONFIDENTIAL MATERIAL. IF YOU ARE NOT THE NAMED RECIPIENT, PLEASE BE ADVISED THAT ANY USE, DISSEMINATION OR UNAUTHORIZED COPYING OF THE MATERIAL IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS TRANSMISSION IN ERROR, PLEASE NOTIFY SUPPORT(a)TRUEEX.COM AND DESTROY THE RECEIVED COPY. THANK YOU.

1 0

stunnel 5.20 released
by Michal Trojnara 15 Jul '15

15 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.20 of stunnel. The ChangeLog entry: Version 5.20, 2015.07.09, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2d. https://www.openssl.org/news/secadv_20150709.txt * New features - poll(2) re-enabled on MacOS X 10.5 and later. - Xcode SDK is automatically used on MacOS X if no other locally installed OpenSSL directory is found. - The SSL library detection algorithm was made a bit smarter. - Warnings about insecure authentication were modified to include the name of the affected service section. - A warning was added to stunnel.init if no pid file was specified in the configuration file (thx to Peter Pentchev). - Optional debugging symbols are included in the Win32 installer. - Documentation updates (closes Debian bug #781669). * Bugfixes - Signal pipe reinitialization added to prevent turning the main accepting thread into a busy wait loop when an external condition breaks the signal pipe. This bug was found to surface on Win32, but other platforms may also be affected. - Fixed removing the disabled taskbar icon. - Generated temporary DH parameters are used for configuration reload instead of the static defaults. - LSB compatibility fixes added to the stunnel.init script (thx to Peter Pentchev). - Fixed the manual page headers (thx to Gleydson Soares). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 4a36a3729a7287d9d82c4b38bf72c4d3496346cb969b86129c5deac22b20292b stunnel-5.20.tar.gz 9d9d38241e972713cd0937e2cf66fdacf3adcb357fbea82d8e46648de4e26fa4 stunnel-5.20-installer.exe cfc1e94cb7c7bf14c832ac8799db4a3438ae7542aa04ec5e9c6695a1a3c3843d stunnel-5.20-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVnoXOAAoJEC78f/DUFuAUGvoP/1WQ2DliVyQQNGDYPkE2Rbqk BJ7lMEseYdPLjZVtkNPQIuH9PCc/qbWMrDFK1sJg+R7d0yyp+Ip+ucH4i5GCfW6o xIZQ00WVa/qV52AcEDGTZ+43EBPBIFNMkSeJlkwyj81ISZ+my0YpqPNSF77fZFdN IqGln9e+1n4gM+8SOgPnJs2XiR2EsbQzmwaZcTCOoKp56j6q2bLXlYC802B9KezJ ex2dmbGV2JEHmNarSUxWO45VnFdqhjhz4qHySm6KnLD2hoyS9Ex2XyynuuyIiIVx yU9M1zliZvgQSQ4RTpO3Ko2b9Qy2cYDECrFwk7i5rlwmiCw1zH5zWGh1rnAsLJHn 7SAxc5BfiB3VQl16CgoLM65no2mJ60f499ab3LA0uTNbt03PrPkc5cK8w+ec3YNU 6E59R4FXC6ae5T4iR7b9mBGifUHWtg53I1H7qbD6Pye/EH5QciSSPizEHeORYlPy fC3jOMEIUDlXjqI7k/XMGVPJ7SSKFkBNiqHKTKoM12QhiZXLLh4Ig3aQJgqX5IBQ VdML1/W9MdBlZNAHYaUBrkSls99aVbIsHJ5yAE0gsF5Lgi6hK6zDkXiKoVEozN5A N6MtfQHs/JS2nvlmCbtGWrK66EXKxW409f0JS3AJG6tjOquuSZYmR944EPzQD+zA WPivIUH2TVk63kULw/ui =Uw+D -----END PGP SIGNATURE-----

3 10

keyfile is not encrypted
by Madhava Gaikwad (madgaikw) 15 Jul '15

15 Jul '15

Hello, I am asking too much, but keyfile with stunnel is required to be stored on disk (I am aware about file permission applied) and is in plain text. Is there any way we can encrypt the keyfile and then store, and then subsequently ask stunnel to obtain the decryption key somehow and then use it. For encryption/decryption of the key, stunnel (or some other program) can give network based ability(service over socket) to provide the key so key can be encrypted by the third party(who generates the config for stunnel). Stunnel config option will specify key is encrypted and therefore stunnel knows why and how to decrypt it. Of course you will ask me to implement my own custom algo for this, but I am checking if anybody has thought about it or in such case, how they have worked on it. I was told, there is also basic level of FIPS compliance requirement that requires key not to be stored on disk in plain text irrespective of file permission. Thank you. Madhava

2 1

please remove me from the mailing list
by Kjell Osness 14 Jul '15

14 Jul '15

Thank you. Kjell Osness IT Technician American Home Entertainment cell (619) 520-9417 office (858) 430-1701 fax (858) 430-1702

1 0

help on options and sslversion
by Madhava Gaikwad (madgaikw) 13 Jul '15

13 Jul '15

Hi, I am using stunnel 5.03 version. I want to understand how the config option "sslVersion " and "options " works. The problem I am trying to solve is: I want to enable say only particular ssl connect methods, for example sslv3 and TLs1.2. I am not able to do it. For me if I do below setting: Options = all Option = NO_SSLv2 Option = NO_SSLv3 Option = NO_TLSv1 Option = NO_TLSv1.1 Option = NO_TLSv1.2 Still I see all methods are being enabled. I removed Option = all, but no effect. What is expected behavior? Also, The sslVersion seems enables either particular sslversion, or else all the versions. So wondering what can be the escape mechanism. Any help will be highly appreciated. Thank you. Madhava

2 2

"make check" tries to build Windows binary on Unix
by Dagobert Michelsen 13 Jul '15

13 Jul '15

Hi, I just tries to build stunnel 5.20 on Solaris 10 Sparc and noticed a strange behaviour during „make check“ which yields in a try to build Windows executables: > dam@unstable10s [unstable10s]:/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20 > gmake check > Making check in src > gmake[1]: Entering directory '/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20/src' > gmake stunnel.exe tstunnel.exe > gmake[2]: Entering directory '/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20/src' > i686-w64-mingw32-gcc -c -I/usr/src/openssl-1.0.2d-i686/include -mthreads -fstack-protector -O2 -Wall -Wextra -Wpedantic -Wformat=2 -Wconversion -Wno-long-long -D_FORTIFY_SOURCE=2 -DUNICODE -D_UNICODE -o tls.obj tls.c > /bin/bash: i686-w64-mingw32-gcc: command not found > Makefile:1206: recipe for target 'tls.obj' failed > gmake[2]: *** [tls.obj] Error 127 > gmake[2]: Leaving directory '/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20/src' > Makefile:1054: recipe for target 'check-am' failed I think this comes from these lines in src/Makefile.am: > # Just check if the programs can be built, don't perform any actual tests > check_PROGRAMS = stunnel.exe tstunnel.exe Essentially the „check“ phase could just not be called during build, but it would be cleaner to not bail out on Unix. Best regards — Dago -- "You don't become great by trying to be great, you become great by wanting to do something, and then doing it so hard that you become great in the process." - xkcd #896

3 6

Re: [stunnel-users] problem with buffering data on stunnel
by Michal Trojnara 10 Jul '15

10 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10.07.2015 20:17, wujot/Adalbert wrote: > But unencrypted session on path between Stunnel server and hi-speed > end server (both in LAN) is using TcpWindowSize on level 64KB - > 131KB Did you consider also tuning SO_SNDBUF of the sending application? > (in Windows 2008 or newer it is calculated automatically). So I > steel have at least 64KB buffer in stunnel. IMHO Windows is probably not the best server platform... > Is there any possibility to force stunnel to use on faster part of > connection (LAN side) the value of TcpWindowSize similar to > calculated on slower part (on WAN side)? I don't think such tricks are possible with BSD sockets. BTW: You can also change BUFFSIZE in common.h and rebuild stunnel. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVoDm6AAoJEC78f/DUFuAURJQQAM1ix6ZkSqOCa9iLiBDIFvrS DajgeGDGeSE75WkyI+IQrPYjWJGNielOeXhCPjYdQh+5o/bddYPaRlQRsu0HlY6F Nncj1kP8Xy0WNO4uxz1YWpnnJtE/Ph9VUVLqS/63tJgkrhmvXF1HODeu677JLzEb wjOn0kv6SmPnzkFMpjbBmkRPt5GeSRc43POGoHcuqFKijeaTDGoqhBLo+tGLhtNV ezYN+QFvyyzMVPe8tscWa+vyXYdbMzgLBXXCHFMbFmlpu6QKHKb0823Q7g7OgMCb DYkVbw0a0ys6hdreBHejvAbgfG8fTKOtYfdOa7lnjCuivGpVKLa018yTk/1qjUbs dmr08MFPGkkMSfV/sQ+PMgZ0Dxaoczt1yXanzURNDXC4eiUlgEXfs4S5J2NYxTOe g4ZG7ZXQIHrux1AcQD9TQF+G9h7YxXeRMt0K29qA54dH+x+Xie920OJMXohMAZJ0 ddkblmt7SHO2XiEV6C2ie1VvB/roZ+aeqKQME4T8oZliy/kaDgXgs/eFLT2Kxw9B WwlWt4r4pLHFkJfExJF/nMWe0qRt/tlVoqyvOFE1hnTxOGr5pGLnY0XOoHX13kr/ ow1TC0N0UPWV++Uydm2oJwXA+o7a/TRs8O+PEhhHTqLDi4O/apC7kL9fM6DjESGr Zj+br1nUiaF+LscAiC/D =kA2M -----END PGP SIGNATURE-----

1 0

Cannot open log file
by Matt brancato 10 Jul '15

10 Jul '15

Hi all, Did a search but didn't see an answer so i figured i'd ask. I'm trying to run stunnel but am having some issues. I attempt to run stunnel but i run into an issue where it can't read the log file and then closes up. Any ideas? sudo stunnel stunnel.conf [ ] Clients allowed=500 [.] stunnel 5.19 on x86_64-unknown-linux-gnu platform [.] Compiled/running with OpenSSL 1.0.1 14 Mar 2012 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from /root/.rnd [ ] Wrote 1024 new random bytes to /root/.rnd [ ] PRNG seeded successfully [ ] Initializing service [<service>] [ ] Loading certificate from file: /etc/stunnel/server.pem [ ] Loading key from file: /etc/stunnel/server.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from /etc/stunnel/server.pem [ ] DH parameters will be generated [ ] Cron started [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=7) [ ] Service [<service>] (FD=7) bound to 127.0.0.1:9999 [ ] Executing cron jobs [.] Updating DH parameters [!] Cannot open log file: /home/tim/Desktop/stunnel.log [ ] Closing service [<service>] [ ] Service [<service>] closed (FD=7) [ ] Service [<service>] closed -- *CONFIDENTIALITY NOTICE* THE INFORMATION CONTAINED IN THIS COMMUNICATION IS INTENDED FOR THE NAMED RECEIVER ONLY. THE TRANSMISSION MAY CONTAIN PRIVILEGED AND CONFIDENTIAL MATERIAL. IF YOU ARE NOT THE NAMED RECIPIENT, PLEASE BE ADVISED THAT ANY USE, DISSEMINATION OR UNAUTHORIZED COPYING OF THE MATERIAL IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS TRANSMISSION IN ERROR, PLEASE NOTIFY SUPPORT(a)TRUEEX.COM AND DESTROY THE RECEIVED COPY. THANK YOU.

1 0

Support for SHA-2 256
by Deepak Subbanarasimha 10 Jul '15

10 Jul '15

Does Stunnel support VeriSign SHA-2 256 certificate? If so, which version was this added in? Thanks, Deepak IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

2 1

problem with buffering data on stunnel
by wujot 09 Jul '15

09 Jul '15

I have a problem with transmission from LAN server, which use another server on LAN with running stunnel, to pass encrypted data to remote SSL clients if they are on very slow GPRS network. If server in LAN starts to transfer big amount of data to such slow remote client, stunnel is buffering data and slowly transmits them to the GPRS client. TCP Window on connection from LAN server to stunnel is big (64 - 131kB), and TCP Window on connection from stunnel to slow client is small (about 5kB). And additionally stunnel is buffering data. So, server is finishing transmission in seconds, but in fact most of data are still in buffers of stunnel. And it makes a timeout problem (server is waiting for the confirmation from client if it received all data, but time between last byte sent from server and confirmation from client could be even several minutes). So, stunnel is working in "store and forward" model. Is it possible to switch it to something like "cut through"? Or how to force stunnel to more synchronized transmission between client and server? Regards, Adalbert

2 1

password protected key in client certificate
by Giona Il Profeta 03 Jul '15

03 Jul '15

Hi all, I have inherited an old stunnel installation, configured for mutual authentication (verify=3) and I'm trying to figure out some of the choices of the old sysadmin. One of the client certificates in the CApath directory has its private key encrypted with a password. Is the client supposed to provide the password to decrypt the key when it connects? Thank you G

2 2

Older versions of stunnel
by daninho dj 03 Jul '15

03 Jul '15

Hi guys, Where can I find some older versions of stunnel? I would like to get 5.17 version. Thanks, Daninho

2 1

Problem with read and unreald mails via POP3 SSL
by David Tedjo 30 Jun '15

30 Jun '15

Hi everybody, i bought an Logitech keyboard with display. I use now stunnel to bring my email account to my display. Logitech got a applet for this. Now i can use it but i got a problem with the unread mails. My display shows me 6 unread messages, but thats all my messages in my in-box and i read it already. Is this a problem of stunnel or a problem in the software of the keyboard? Best Regards David

2 1

automation of installation of loopback adapter
by Saurabh Beriwal 29 Jun '15

29 Jun '15

Hi All, I'd like to programmatically install the MS loopback adapter to automate tunneling of SMB over SSH. All the code which i found on net uses MS devcon utility. Please let us know if there is any simple way to automate the installation of MS loopback adapter. Thank you. Regards, Saurabh Beriwal

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users