- stunnel-users - stunnel.org

error invalid stunnel.conf - No limit of clients
by Christian Huber 09 Dec '13

09 Dec '13

Hi, I just installed stunnel for my email programm courier. I edited the stunnel.conf as followed but am unfortunatly becoming the message from stunnel: invalid stunnel.conf No limit detected for the number of clients stunnel 4.56 on x86-pc-msvc-1500 platform Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D07808C: error:2D07808C:FIPS routines:FIPS_module_mode_set:unsupported platform Line 11: "[POP3 T-Online]": Failed to initialize SSL Server is down my stunnel.conf is as followed: # GLOBAL OPTIONS client = yes output = stunnel-log.txt debug=4 taskbar = yes # SERVICE-LEVEL OPTIONS [POP3 T-Online] accept = 127.0.0.1:108 connect = securepop.t-online.de:995 [SMTP T-Online] accept = 127.0.0.1:107 connect = securesmtp.t-online.de:587 [POP3 web.de] accept = 127.0.0.1:106 connect = pop3.web.de:995 [SMTP web.de] accept = 127.0.0.1:105 connect = smtp.web.de:587 [POP3 STRATO] accept = 127.0.0.1:104 connect = pop3.strato.de:995 [SMTP STRATO] accept = 127.0.0.1:103 connect = smtp.strato.de:465 [POP3 GMX ] accept = 127.0.0.1:102 connect = pop.gmx.net:995 [SMTP GMX ] accept = 127.0.0.1:101 connect = mail.gmx.net:465 ___________________ Would be nice if someone could tell me what is wrong! Greetings Christian Huber

3 3

t-online, web.de E-mail with Courier
by Christian Huber 08 Dec '13

08 Dec '13

Hi, stunnel is now working with the fips=no global option without error! My e-mail programm courier is working with the servers from strato and gmx! But with t-online it is not working at the moment! I can not login into the pop3 server! >From courier I get the message: Sendrecv.c[229] Pop3.dll recv() failed WINSOCK Error: Connection reset. (The mail server terminated the connection. With web.de I can login into the pop3 server and receive mails. But sending mails is not sucessfull! >From courier I get the message: Sendrecv.c[188] Smtp.dll recv(MSG_PEEK) failed WINSOCK Error: Connection reset. (The mail server terminated the connection. Would be nice if someone has a solution! My stunnel.conf: # GLOBAL OPTIONS client = yes fips=no output = stunnel-log.txt debug=4 taskbar = yes # SERVICE-LEVEL OPTIONS [POP3 T-Online] accept = 127.0.0.1:108 connect = securepop.t-online.de:995 [SMTP T-Online] accept = 127.0.0.1:107 connect = securesmtp.t-online.de:587 [POP3 web.de] accept = 127.0.0.1:106 connect = pop3.web.de:995 [SMTP web.de] accept = 127.0.0.1:105 connect = smtp.web.de:587 [POP3 STRATO] accept = 127.0.0.1:104 connect = pop3.strato.de:995 [SMTP STRATO] accept = 127.0.0.1:103 connect = smtp.strato.de:465 [POP3 GMX ] accept = 127.0.0.1:102 connect = pop.gmx.net:995 [SMTP GMX ] accept = 127.0.0.1:101 connect = mail.gmx.net:465

1 0

stunnel domain name resolution bug
by David Slachta 07 Dec '13

07 Dec '13

I'm new to the mailing lists so I hope it's the correct way to report a bug. There's an issue with resolving domain names. I'm connecting an stunnel client to a server that sits on a computer which IP address is dynamic. Therefore I'm using a dyndns for the IP address of the server. When the IP address of the server is changed, the stunnel client doesn't update the name resolution of the dyndns name and tries to connect to the old IP which is of course unsuccessful. This can be resolved only by exiting and starting stunnel client again when a new domain name resolution is made. Would it be possible to add a functionality to the stunnel that wouldn't cache the name resolution but try to resolve the domain names every time there's a connection request? I'm using a Windows OS for both server and client, not sure if that makes a difference. Thanks! David

2 1

Re: [stunnel-users] stunnel domain name resolution bug
by Brian Wilkins 06 Dec '13

06 Dec '13

Sent you traffic from Sept 19th from Trojnara. May be helpful On Dec 6, 2013 6:11 PM, "Brian Wilkins" <bwilkins(a)gmail.com> wrote: > See my forward > On Dec 6, 2013 5:53 PM, "David Slachta" <elpin(a)volny.cz> wrote: > >> I'm new to the mailing lists so I hope it's the correct way to report a >> bug. >> >> There's an issue with resolving domain names. I'm connecting an stunnel >> client to a server that sits on a computer which IP address is dynamic. >> Therefore I'm using a dyndns for the IP address of the server. When the IP >> address of the server is changed, the stunnel client doesn't update the >> name resolution of the dyndns name and tries to connect to the old IP which >> is of course unsuccessful. This can be resolved only by exiting and >> starting stunnel client again when a new domain name resolution is made. >> >> Would it be possible to add a functionality to the stunnel that wouldn't >> cache the name resolution but try to resolve the domain names every time >> there's a connection request? >> >> I'm using a Windows OS for both server and client, not sure if that makes >> a difference. >> >> Thanks! >> David >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >>

1 0

Hostname verification, support for, and patches
by fslama＠comcast.net 06 Dec '13

06 Dec '13

After scouring the net I've found several isolated discussions regarding stunnel hostname validation. And also some patches that seem to implement hostname validation: https://www.stunnel.org/pipermail/stunnel-users/2010-March/002613.html I have a requirement to have stunnel (4.56) validate client certificates and their identity by comparing the its CNAME against the source address. I recall reading one response (which I can't find at the moment) from Marzena Trojnara indicating that this feature won't be supported. If so, can you explain the rational? Are there sanctioned patches out there today? Regards, -Fred

4 3

setup stunnel problem
by edu.bit.es＠gmail.com 20 Nov '13

20 Nov '13

Hi everybody, I'm absolutely new in stunnel. I came around because of a post in the google forums about making Symantec System Recovery mail through smtp.gmail.com. Symantec is not capable of doing SSL/TLS so I need a solution like stunnel. But I've an issue: it doesn't seem to work :) I installed the program ok, and configured in the following way: cert=stunnel.pem socket = l:TCP_NODELAY=1 socket= r:TCP_NODELAY=1 [gmail-smtp] client=yes accept:127.0.0.1:25 connect= smtp.gamil.com:465 EOF The server is listening on port 127.0.0.1:25 but when I do a telnet to that port gives an error and doesn't seem to tunnel me to smtp.gmail.com. On the other hand, I configured outlook to use that tunnel but gives an error stating it can reach the smtp server. What am I doing wrong? Should I change the TLS version? Best regards and thanks in advance.

2 7

Stunnel with gmail not working on RHEL 6.4
by André Luís 17 Nov '13

17 Nov '13

Hello, I am trying to setup stunnel to send email using gmail smtp server trough Oracle Database. I first tested on my windows machine. I installed and configured stunnel and it worked fine.But now I tried to do the same on our server (RHEL 6.4) and it doesn't work. I can successfuly telnet the 25 port: [root@server1 stunnel]# telnet localhost 25Trying 127.0.0.1...Connected to localhost.Escape character is '^]'.220 mx.google.com ESMTP so2sm18740691pbc.5 - gsmtp When I send the email, i receive this error: SMTP permanent error: 534 5.7.14 54 ef10sm21262349pac.1 - gsmtp anyone have any idea? the stunnel.conf: pid = /stunnel.pidoutput = /var/log/stunnel.logcompression = zlibsslVersion = alloptions = NO_SSLv2debug = 7 [gmail-smtp]client = yesaccept = localhost:25connect = smtp.gmail.com:465 Here is the Stunnel log:2013.11.17 15:58:34 LOG7[23729:139952118699968]: gmail-smtp accepted FD=13 from 127.0.0.1:560892013.11.17 15:58:34 LOG7[23729:139952118695680]: gmail-smtp started2013.11.17 15:58:34 LOG7[23729:139952118695680]: FD 13 in non-blocking mode2013.11.17 15:58:34 LOG7[23729:139952118695680]: Waiting for a libwrap process2013.11.17 15:58:34 LOG7[23729:139952118695680]: Acquired libwrap process #02013.11.17 15:58:34 LOG7[23729:139952118695680]: Releasing libwrap process #02013.11.17 15:58:34 LOG7[23729:139952118695680]: Released libwrap process #02013.11.17 15:58:34 LOG7[23729:139952118695680]: gmail-smtp permitted by libwrap from 127.0.0.1:560892013.11.17 15:58:34 LOG5[23729:139952118695680]: gmail-smtp accepted connection from 127.0.0.1:560892013.11.17 15:58:34 LOG7[23729:139952118695680]: FD 14 in non-blocking mode2013.11.17 15:58:34 LOG6[23729:139952118695680]: connect_blocking: connecting 74.125.129.108:4652013.11.17 15:58:34 LOG7[23729:139952118695680]: connect_blocking: s_poll_wait 74.125.129.108:465: waiting 10 seconds2013.11.17 15:58:34 LOG5[23729:139952118695680]: connect_blocking: connected 74.125.129.108:4652013.11.17 15:58:34 LOG5[23729:139952118695680]: gmail-smtp connected remote server from 172.31.22.161:510672013.11.17 15:58:34 LOG7[23729:139952118695680]: Remote FD=14 initialized2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): before/connect initialization2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv2/v3 write client hello A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read server hello A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read server certificate A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read server done A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 write client key exchange A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 write change cipher spec A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 write finished A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 flush data2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read server session ticket A2013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read finished A2013.11.17 15:58:34 LOG7[23729:139952118695680]: 1 items in the session cache2013.11.17 15:58:34 LOG7[23729:139952118695680]: 1 client connects (SSL_connect())2013.11.17 15:58:34 LOG7[23729:139952118695680]: 1 client connects that finished2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 client renegotiations requested2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 server connects (SSL_accept())2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 server connects that finished2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 server renegotiations requested2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 session cache hits2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 external session cache hits2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 session cache misses2013.11.17 15:58:34 LOG7[23729:139952118695680]: 0 session cache timeouts2013.11.17 15:58:34 LOG6[23729:139952118695680]: SSL connected: new session negotiated2013.11.17 15:58:34 LOG6[23729:139952118695680]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA12013.11.17 15:58:34 LOG7[23729:139952118695680]: SSL socket closed on SSL_read2013.11.17 15:58:34 LOG7[23729:139952118695680]: Socket write shutdown2013.11.17 15:58:34 LOG5[23729:139952118695680]: Connection closed: 90 bytes sent to SSL, 860 bytes sent to socket2013.11.17 15:58:34 LOG7[23729:139952118695680]: gmail-smtp finished (0 left)2013.11.17 16:01:01 LOG7[23729:139952118699968]: gmail-smtp accepted FD=13 from 127.0.0.1:561202013.11.17 16:01:01 LOG7[23729:139952118695680]: gmail-smtp started2013.11.17 16:01:01 LOG7[23729:139952118695680]: FD 13 in non-blocking mode2013.11.17 16:01:01 LOG7[23729:139952118695680]: Waiting for a libwrap process2013.11.17 16:01:01 LOG7[23729:139952118695680]: Acquired libwrap process #02013.11.17 16:01:01 LOG7[23729:139952118695680]: Releasing libwrap process #02013.11.17 16:01:01 LOG7[23729:139952118695680]: Released libwrap process #02013.11.17 16:01:01 LOG7[23729:139952118695680]: gmail-smtp permitted by libwrap from 127.0.0.1:561202013.11.17 16:01:01 LOG5[23729:139952118695680]: gmail-smtp accepted connection from 127.0.0.1:561202013.11.17 16:01:01 LOG7[23729:139952118695680]: FD 14 in non-blocking mode2013.11.17 16:01:01 LOG6[23729:139952118695680]: connect_blocking: connecting 74.125.129.109:4652013.11.17 16:01:01 LOG7[23729:139952118695680]: connect_blocking: s_poll_wait 74.125.129.109:465: waiting 10 seconds2013.11.17 16:01:01 LOG5[23729:139952118695680]: connect_blocking: connected 74.125.129.109:4652013.11.17 16:01:01 LOG5[23729:139952118695680]: gmail-smtp connected remote server from 172.31.22.161:569712013.11.17 16:01:01 LOG7[23729:139952118695680]: Remote FD=14 initialized2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): before/connect initialization2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 write client hello A2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read server hello A2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 read finished A2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 write change cipher spec A2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 write finished A2013.11.17 16:01:01 LOG7[23729:139952118695680]: SSL state (connect): SSLv3 flush data2013.11.17 16:01:01 LOG7[23729:139952118695680]: 1 items in the session cache2013.11.17 16:01:01 LOG7[23729:139952118695680]: 2 client connects (SSL_connect())2013.11.17 16:01:01 LOG7[23729:139952118695680]: 2 client connects that finished2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 client renegotiations requested2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 server connects (SSL_accept())2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 server connects that finished2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 server renegotiations requested2013.11.17 16:01:01 LOG7[23729:139952118695680]: 1 session cache hits2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 external session cache hits2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 session cache misses2013.11.17 16:01:01 LOG7[23729:139952118695680]: 0 session cache timeouts2013.11.17 16:01:01 LOG6[23729:139952118695680]: SSL connected: previous session reused2013.11.17 16:01:02 LOG7[23729:139952118695680]: SSL socket closed on SSL_read2013.11.17 16:01:02 LOG7[23729:139952118695680]: Socket write shutdown2013.11.17 16:01:02 LOG5[23729:139952118695680]: Connection closed: 241 bytes sent to SSL, 825 bytes sent to socket2013.11.17 16:01:02 LOG7[23729:139952118695680]: gmail-smtp finished (0 left) Thanks a lot

1 0

Weird tunneling eMule's web interface
by Javier 17 Nov '13

17 Nov '13

Hi there, lets see: When I setup a server for the eMule's web interface and I access with the browser through https, the result is that the web interface never fully loads. When I setup a server for the web interface and a client connecting to that server and I access with the browser through http and with help of the client, the web interface loads without problems. Ok, at this point you think... "maybe the browser doesn't understand stunnel server at first instance for some reason... and needs the client to have a good SSL connection". So, we complicate things.... ;-) I made the following scenario because, sometimes, you can't use a client in the remote computer (where is not the web interface, if you are lost what with I'm telling). So, now we setup a server for the web interface, a client that connects to the server and a new server that connects to the client to serve to the remote browser... and... happens the same as the first example, as if it was only one server serving the web interface: it never fully loads. (I know, this scenario was quite weird :-P ). In case it was the browser I checked max connections, pipelining, etc, (allowing crazy max connection limits) but that didn't help on success :-( No matter of what web browser I use, they all do the same. They create between 7 to 15 connections with stunnel (sometimes more, others less) and nothing else. With the help of the client, all is smooth with over 150 connections. I tried too to create an html file "similar" to the web interface with the same resources (basically loads of images and therefore requests per second) and with my own web server and, in this case, there was no drama at all. The browsers connect to the stunnel server with over 190 connections in an eye blink and without of an stunnel client. At this point, I'm quite lost :-S Why doesn't load the web interface connecting directly to the stunnel server but does with the help of a client? Any ideas? Probably is the built-in web server of eMule, but it doesn't give problems when there is no stunnel in between or when using an stunnel client to connect to that stunnel server :S If you use eMule, test it and tell me if it works for you. Regards. P.S.: I hope you understood all because, even for me, has been confusing to explain.

1 0

stunnel server configuration requirement to handle CBC protection
by Simner, John 13 Nov '13

13 Nov '13

Hi, Having recently used stunnel on the phone as a server to encrypt the communication between an external client and a simple TCP server socket on the phone, one of the clients have raised the following.... Phone resets a TLS conection from client, when CBC protection is enabled on tomcat server. The phone syslog shows: Oct 28 14:26:14 10 user.crit syslog: CommsChannelExtenderRx(28881): ./src/CommsChannelExtenderRx.cpp:186 Header section invalid To prevent a SSL/TLS BEAST attack (CVE-2011-3389) Oracle Java (JSSE) has implemented a CBC protection which can be set with System Property jsse.enableCBCProtection. The default value is true. What was done: Start client and connect it with a phone. The TLS connection is established, but then the phone resets the connection, and client is not working. When I set jsse.enableCBCProtection to false at the tomcat server, the phone accepts the connection and client is working. To prevent man-in-the-middle attacks, the phone should be able to handle the fragmented TLS block when CBC protection is activated on the client tomcat server. I have been unable to find the appropriate stunnel configuration item to support this. Please could you inform me how this is handled through stunnel. Thank you for your assistance and I look forward to your responses. Thanks.. John John Simner BSc(Hons) MSc CEng. MIET Software Engineer Unify Enterprise Communications Ltd. Devices Development K Block, Technology Drive, Beeston, Nottingham, NG9 1LA Tel.: +44 (0) 19088 17378 Email: john.simner(a)unify.com <mailto:vorname.name@unify.com> www.unify.co.uk<http://www.unify.co.uk/> Follow us: [Social_media_icons] <http://www.unify.com/social-media> Unify Enterprise Communications Limited. Registered Office: Brickhill Street, Willen Lake, Milton Keynes, MK15 0DJ Registered No: 5903714, England. This email contains confidential information and is for the exclusive use of the addressee. If you are not the addressee then any distribution, copying, or use of this email is prohibited. If received in error, please advise the sender and delete immediately. We accept no liability for any loss or damage suffered by any person arising from use of this email.

4 10

Patch for Start TLS for LDAP clients (RFC 2830)
by Bart Dopheide 07 Nov '13

07 Nov '13

Hi, I noticed that latest/greatest stunnel does not support the Start TLS operation for LDAP (RFC2830). Yet, I need it in my organisation as a quick workaround. After fiddling with OpenLDAP, tracing, and reading RFC 2830 a bit, I patched stunnel 4.56 and the patch has not failed me yet. But I must remark that I am no LDAP expert, nor an certified stunnel hacker. So, I will submit this patch as a first suggestion. Will you consider the feature request of implementing the Start TLS feature as described in RFC 2830? Cheers, Bart Dopheide My patch suggestion is: dopheideb@anguish:/tmp$ diff -aur stunnel-4.56 stunnel-4.56-ldap-starttls-patch diff -aur stunnel-4.56/src/protocol.c stunnel-4.56-ldap-starttls-patch/src/protocol.c --- stunnel-4.56/src/protocol.c 2013-03-13 14:41:16.000000000 +0100 +++ stunnel-4.56-ldap-starttls-patch/src/protocol.c 2013-11-05 11:19:10.388365359 +0100 @@ -53,6 +53,7 @@ static void imap_client(CLI *); static void imap_server(CLI *); static void nntp_client(CLI *); +static void openldap_client(CLI *); static void connect_server(CLI *); static void connect_client(CLI *); @@ -82,6 +83,7 @@ {"pop3", {{PROTOCOL_PRE_SSL, pop3_server}, {PROTOCOL_PRE_SSL, pop3_client}}}, {"imap", {{PROTOCOL_PRE_SSL, imap_server}, {PROTOCOL_PRE_SSL, imap_client}}}, {"nntp", {{PROTOCOL_NONE, NULL}, {PROTOCOL_PRE_SSL, nntp_client}}}, + {"openldap",{{PROTOCOL_NONE, NULL}, {PROTOCOL_PRE_SSL, openldap_client}}}, {"connect", {{PROTOCOL_PRE_CONNECT, connect_server}, {PROTOCOL_PRE_SSL, connect_client}}}, {NULL, {{PROTOCOL_NONE, NULL}, {PROTOCOL_NONE, NULL}}} }; @@ -513,6 +515,88 @@ str_free(line); } +/**************************************** LDAP, RFC 2830 */ + +u8 ldap_startssl_message[0x1d + 2] = +{ + 0x30, /* tag = UNIVERSAL SEQUENCE */ + 0x1d, /* len = 29 (the remaining number of bytes in this message) */ + 0x02, /* messageID */ + 0x01, /* len = 1 */ + 0x01, /* value = 1 (this is messageID 1) */ + /* --- */ + 0x77, /* protocolOp = APPLICATION (23) (=ExtendedRequest) + * 0b01xxxxxx => APPLICATION + * 0bxx1xxxxx => ? + * 0xxxx10111 => 23 + */ + 0x18, /* len = 24 */ + 0x80, /* type = requstName? */ + 0x16, /* len = 22 */ + /* OID: 1.3.6.1.4.1.1466.20037 (=LDAP_START_TLS_OID)*/ + '1', '.', + '3', '.', + '6', '.', + '1', '.', + '4', '.', + '1', '.', + '1', '4', '6', '6', '.', + '2', '0', '0', '3', '7' + /* No requestValue, as per RFC2830 (in 2.1: "The requestValue field is absent") */ +}; +static void openldap_client(CLI *c) { + u8 buffer[1]; + u8 ldap_response[256]; + + s_log(LOG_DEBUG, "Requesting LDAP Start TLS"); + write_blocking(c, c->remote_fd.fd, ldap_startssl_message, ldap_startssl_message[1] + 2); + + read_blocking(c, c->remote_fd.fd, buffer, 1); + if(buffer[0] != 0x30) { + s_log(LOG_ERR, "start tag is not UNIVERSAL SEQUENCE"); + longjmp(c->err, 1); + } + + s_log(LOG_DEBUG, "Reading LDAP message size (1 byte)."); + read_blocking(c, c->remote_fd.fd, buffer, 1); + + s_log(LOG_DEBUG, "Reading LDAP message (%u byte(s))", buffer[0]); + read_blocking(c, c->remote_fd.fd, ldap_response, buffer[0]); + + if(ldap_response[0] != 0x02) { + s_log(LOG_ERR, "LDAP response does not start with type messageID"); + longjmp(c->err, 1); + } + if(ldap_response[1] != 0x01) { + s_log(LOG_ERR, "This is not an extendedResp(1)"); + longjmp(c->err, 1); + } + if(ldap_response[2] != 0x01) { + s_log(LOG_ERR, "Non-matching messageID"); + longjmp(c->err, 1); + } + if(ldap_response[3] != 0x78) { + s_log(LOG_ERR, "This is not a protocolOp for APPLICATION ExtendedResponse"); + longjmp(c->err, 1); + } + if(ldap_response[4] != 0x07) { + s_log(LOG_ERR, "Expected 0x07 indicating extendedResp is 7 bytes long"); + longjmp(c->err, 1); + } + if(ldap_response[5] != 0x0a) { + s_log(LOG_ERR, "This is not an extendedResp"); + longjmp(c->err, 1); + } + if(ldap_response[6] != 0x01) { + s_log(LOG_ERR, "This is not an extendedResp"); + longjmp(c->err, 1); + } + if(ldap_response[7] != 0x00) { + s_log(LOG_ERR, "This is not resultCode success"); + longjmp(c->err, 1); + } +} + /**************************************** connect */ static void connect_server(CLI *c) { dopheideb@anguish:/tmp$

3 2

stunnel x forwarded not working
by Libindas 05 Nov '13

05 Nov '13

Hi all, We are facing problem with stunnel + HAproxy + Tomcat Client -----> Stunnel-----> HAProxy----> Tomcat { I need get client IP in Tomcat Servers} I have compiled(stunnel-4.32 + stunnel-4.32-xforwarded-for.diff) and installed but not working. Really appreciate your help Thanks Libin

2 1

Trouble sending email via smtp with a particular gmail address
by Brian Morgan 01 Nov '13

01 Nov '13

I'm having trouble sending email through stunnel with our customer service email address. We use google premium services for our hosted email. I can send through stunnel using my own personal account, but when I switch to the cust service account, I get the error: "Failed to send an E-mail through the specified SMTP server [127.0.0.1]: The SMTP server requires a secure connection or the client was not authenticated. The server response was 5.5.1 Authentication Required." And yes, I double/triple checked credentials and can login through the gmail interface with them just fine. I also tried changing the password to a strong password which did not help. gmail settings in stunnel.conf: [gmail-smtp] client = yes accept = 127.0.0.1:259 connect = smtp.gmail.com:465 I also tried port 587 but that produces another error: "Failed to send an E-mail through the specified SMTP server [127.0.0.1]: Failure sending mail." Any ideas?

2 4

Clear LogWindow without Restart stunnel possible?
by Ben Stover 01 Nov '13

01 Nov '13

Can I somehow clear the current LogWindows WITHOUT exit+restarting stunnel?

2 1

Question Regarding Client Installer
by Andrew Smith 29 Oct '13

29 Oct '13

We currently use Stunnel to allow our clients to connect to their Databases that are hosted by us. I think this product is great. However, I am a newbie to Stunnel as our previous resource has passed away. What I would like to know now to do is create an installer for clients machines that have the correct configuration files in etc... I am sure this is pretty easy and I will be able to do it this once I am guided in the correct direction. Thanks in advance! ________________________________ Andrew Smith Support Technical Services Analyst P: 614-875-4910 x109 F: 614-875-4088 E: andrew.smith(a)harriscomputer.com [http://www.harriscomputer.com/images/signatures/HarrisSchools.jpg] [http://www.harriscomputer.com/images/signatures/DivisionofHarris.gif]<http://www.harriscomputer.com/> 6110 Enterprise Parkway Grove City, OH 43123 www.harris-schoolsolutions.com<http://www.harris-schoolsolutions.com> This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.

2 1

Re: [stunnel-users] Is it usual/recommended to have key and cert in ONE stunnel.pem file?
by Ben Stover 29 Oct '13

29 Oct '13

Hello John, thank you for your clarification. Two more additional questions: According to stunnel guide I created a cert + key with the following command: openssl.exe req -new -x509 -days 3650 -nodes -config stunnel.cnf -out stunnelcert.pem -keyout stunnelkey.pem 1.) For what do I need here the -config stunnel.cnf parameter? I am prompted by openssl for the content values during generation anyway. Can stunnel.cnf be seen only as a default value pattern for the created cert during generation? Can I omit this parameter? 2.) After creation of cert+key I have to specify them (as client) in stunnel.conf (with "o") as follows: cert = stunnelcert.pem key = stunnelkey.pem Is this sufficient? Thank you Ben On Mon, Oct 28, 2013 at 06:39:15PM +0100, Ben Stover wrote: > According to some tutorial pages I generated with OpenSSL a (selfsigned) certificate. > > This file stunnel.pem contains the certifictae as well as the private key. > > Is this usual/recommended? Hello John, That sort of falls into the "tragedy waiting to happen" category. The certificate is supposed to be given to clients, and the key belongs to the server and has to be kept private or there's really no point in using SSL. > Or should user put these two parts in two independent files? Yes, absolutely. In fact I suppose you're using Windows or went through some hoop-jumping to combine them, because in "normal" OpenSSL usage the key is generated first and then the certs are requested and signed by the CA (or selfsigning) key. /jl

2 1

VPAT Section 508 Compliance
by Tracy Drake - QI-C 28 Oct '13

28 Oct '13

Hello Stunnel Support! I am seeking a VPAT showing the level Sec 508 compliance so that we can move toward making Stunnel a GSA-approved software. I guess the biggest question is whether or not Stunnel is considered to be section 508 compliant. Please advise as to where/how I can obtain this information. -- Tracy Drake CSM Senior Consultant GSA-FAS FAME Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

1 0

Is it usual/recommended to have key and cert in ONE stunnel.pem file?
by Ben Stover 28 Oct '13

28 Oct '13

According to some tutorial pages I generated with OpenSSL a (selfsigned) certificate. This file stunnel.pem contains the certifictae as well as the private key. Is this usual/recommended? Or should user put these two parts in two independent files? Ben

2 1

Is "fips=no" recommended?
by Ben Stover 25 Oct '13

25 Oct '13

I stunnel.conf there is a parameter fips=no which is currently commented out here. Is it (resp. when is it) recommended to activate this parameter? Ben

2 1

Verify = 4 Fails Yet Again
by Thomas Eifert 25 Oct '13

25 Oct '13

I've just encountered another situation in which verify = 4 fails on a seemingly valid certificate. Since I've previously posted details regarding this issue, I'm only going to post the certificate here. This is the 3rd certificate I've run across in the past 6 months that fails to verify. Can all 3 of the certificates be faulty, or is there an issue with Stunnel or OpenSSL here? Thomas -----BEGIN CERTIFICATE----- MIIGyTCCBbGgAwIBAgIQC0NHQrtbGPWbZINtfJec1jANBgkqhkiG9w0BAQUFADBm MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5j ZSBDQS0zMB4XDTEzMDYwMzAwMDAwMFoXDTE2MDgxMDEyMDAwMFowgYQxCzAJBgNV BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRIwEAYDVQQHEwlFc2NvbmRpZG8x JjAkBgNVBAoTHUZvcnRlIEludGVybmV0IFNvZnR3YXJlLCBJbmMuMQswCQYDVQQL EwJJVDEXMBUGA1UEAwwOKi5mb3J0ZWluYy5jb20wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDZ8XZFzc6kdJt8WMByc4VPw7Ru4JZ6P+AyZXcLNA/hSih0 Xes5fGjw7oBTyUJWic/FIe397AKkjM8WGtH70EnOv3BzAHzv5ftdhG6UskJmZV7K pokKao+M6AtL0yLyXTDXXF0c7dcUwmQ9lu2LIvyqMCo5RNjaNHPoG+pqxXSN4mSj kSxUsW62p6+qE+uJGBP9HW14DGzE+OBUfB/noC63qMWjYIOWmRX/rIC8H6NyFBWl K0X0yUkxbkc5o/f9DiChCCvzK7RUIiZfDxBKKQ4VZq8+cIHIhHzbziDj2J7Twj2b VeL052E7EjTxRvYIEkyaU2JIbvcLKDzJ1H5vHxpTAgMBAAGjggNSMIIDTjAfBgNV HSMEGDAWgBRQ6nOJ2yn7EI+e5QEg1N55mUiD9zAdBgNVHQ4EFgQUwgLEas/pP7rM UfpMXPrkHEg4SWcwJwYDVR0RBCAwHoIOKi5mb3J0ZWluYy5jb22CDGZvcnRlaW5j LmNvbTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF BwMCMGEGA1UdHwRaMFgwKqAooCaGJGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9j YTMtZzIyLmNybDAqoCigJoYkaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL2NhMy1n MjIuY3JsMIIBxAYDVR0gBIIBuzCCAbcwggGzBglghkgBhv1sAQEwggGkMDoGCCsG AQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9zc2wtY3BzLXJlcG9zaXRv cnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUAcwBlACAAbwBm ACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMAdABp AHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAg AEQAaQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAg AFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAg AHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBu AGQAIABhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBp AG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMHsGCCsGAQUFBwEBBG8wbTAk BggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEUGCCsGAQUFBzAC hjlodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJh bmNlQ0EtMy5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAfaQd sAZueUdpTa/3TBpGPlKRiirlATk4kLgpk08R73hEsbA3LICRA5RbfvBGZ56031Hh rxzU8ZhI8q4kKiLbYawpRw9bzxlX35GW5MwuZiQTY0eL45V2L17Ya+Qi1+zYSAvA ZrkC2IGXUuV+sup+WQ8nx+A+HE0aGBWwCoza8qbrbFc86DrPKaGBqyanSSNQBDOg Jzojg6do31qnrDOc/Sg9fckSOtBTFO3Dqgyv0UiaaimcQE3OOqEeianQ7REE2XIX 96d2iRp5fVxMjx9SCfaD31DIogTbYmrw7+3KEPgU8QNn1RAzjPUkSZxvcO8X/Xue vw2kqH9uZ7dlx7c6CA== -----END CERTIFICATE----- -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 10

Transparent Proxy Source on HPUX 11i
by Jeremy Brock 24 Oct '13

24 Oct '13

Hi All, Are there any plans to make Transparent Mode possible on HPUX? 2013.10.22 16:24:22 LOG5[3607:1]: stunnel 4.56 on ia64-hp-hpux11.23 platform 2013.10.22 16:24:22 LOG5[3607:1]: Compiled/running with OpenSSL 0.9.8y 5 Feb 2013 2013.10.22 16:24:22 LOG5[3607:1]: Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP 2013.10.22 16:24:22 LOG5[3607:1]: Reading configuration from file /ASKPLUS/stunnel/stunnel.conf 2013.10.22 16:24:22 LOG5[3607:1]: Configuration successful 2013.10.22 16:24:47 LOG5[3608:2]: Service [ vsrvtcp ] accepted connection from 192.168.15.6:1169 *2013.10.22 16:24:47 LOG3[3608:2]: Transparent proxy in remote mode is not supported on this platform* 2013.10.22 16:24:47 LOG5[3608:2]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket ~Jeremy -- Jeremy Brock Vital Soft, Inc www.vital-soft.com

2 1

Stunnel Service as other user
by Florian Götz 24 Oct '13

24 Oct '13

Hi Stunnel users, if I use xinetd to start a service I got the possibility to start the service with a dedicated user. For example: service fex { socket_type = stream wait = no type = unlisted protocol = tcp bind = 123.12.1.12 port = 80 cps = 10 2 * user = fex groups = yes server = /home/fex/bin/fexsrv nice = 0 disable = no } I got some kind of webserver (not apache, nginx etc) that needs to be started with xinetd (the example above). This server should get a SSL tunnel. If I use Stunnel in daemon mode (without jails/chroot) and define a service like this: [https] accept = 123.12.1.12:443 exec = /home/fex/bin/fexsrv execargs = fexsrv stunnel TIMEOUTclose = 2 Everything works fine, except that the server now runs as root. Is there a possibility to set a user for a service? Best regards Florian Götz -- Mit freundlichen Grüßen Florian Götz ----------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6232 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

2 1

Username and Password in Clear Text
by Peter K. O'Connor 24 Oct '13

24 Oct '13

Hi, I am using stunnel 4.56 Windows verison. I thought the username and password will *only* be sent to SERVER2, *after* the SSL handshake, with each request. However, the truth is that the Proxy-Authorization header is attached to the request to SERVER1 "CONNECT SERVER2:433 HTTP/1.1", as well. So SERVER1 can see username and password. It is not necessary and safe. Am I missing anything here? Regards, Peter [stunnel] client = yes accept = 127.0.0.1:8080 connect = SERVER1:3128 protocol = connect protocolHost = SERVER2:443 protocolUsername = username protocolPassword = password

2 1

Re: [stunnel-users] Which X.509 certificate types (.crt, .pem, .der .p7c) possible for stunnel and how to import them?
by Ben Stover 24 Oct '13

24 Oct '13

Assume I have already an *.pem cert (for SMTP over STARTTLS transfer). Where (in whcih directory) should I put this cert file? Ben On Fri, 18 Oct 2013 12:35:25 +0000, Eckert, Doug wrote: >You can use OpenSSL to convert between formats (to .pem for STunnel) >https://support.ssl.com/Knowledgebase/Article/View/19/0/der-vs-crt-vs-cer-v… >You can also use openssl to strip the key's passphrase. This is handy for automatic starting (init/cron/at) of STunnel without having it prompt for the passphrase. > $ openssl rsa -in source.pem -out target.pem >-----Original Message----- >From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Ben Stover >Sent: Friday, October 18, 2013 3:21 AM >To: Stunnel Users >Subject: [stunnel-users] Which X.509 certificate types (.crt, .pem, .der .p7c) possible for stunnel and how to import them? >Which X.509 certificate types (e.g. .crt, .pem, .der .p7c) are possible for stunnel? >Assume I have got such a certificate as separate file (and not retrieved by OpenSSL). >How do I import it into stunnel? >Do I have to just copy it into (which ?) directory? >Does the certifcate file name have to have a certain pattern? >Or is stunnel smart enough to read and analyze the content independently from filename? >Thank you >Ben >_______________________________________________ >stunnel-users mailing list >stunnel-users(a)stunnel.org >https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Which X.509 certificate types (.crt, .pem, .der .p7c) possible for stunnel and how to import them?
by Ben Stover 18 Oct '13

18 Oct '13

Which X.509 certificate types (e.g. .crt, .pem, .der .p7c) are possible for stunnel? Assume I have got such a certificate as separate file (and not retrieved by OpenSSL). How do I import it into stunnel? Do I have to just copy it into (which ?) directory? Does the certifcate file name have to have a certain pattern? Or is stunnel smart enough to read and analyze the content independently from filename? Thank you Ben

2 1

How to setup most detailed error log (for one service?
by Ben Stover 17 Oct '13

17 Oct '13

currently I have specified in *.conf file debug = 7 Is this the most detailed log output possible? I miss somehow the transfer protocol lines (what is sent and what received) How do I get this? Is it possible to setup debug = 3 as global variable and to define debug = 7 for just ONE particular service? Ben

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users