- stunnel-users - stunnel.org

Log to file WSS Websocket packet traffic
by Francesco Alfano 04 Feb '16

04 Feb '16

How can I log to file all packet traffic coming from a wss web socket on port 1234 using stunnel, openssl and tcpdump ? I have already seen https://gist.github.com/jeremiahsnapp/6426298#file-stunnel-mitm-proxy-conf , but I would like to know how to configure it

1 0

Microsoft Exchange 2010 - SMTP issue
by mahdi＠kadtekautomation.com 03 Feb '16

03 Feb '16

Hey all, Has anybody here been successful connecting to Microsoft Exchange 2010 servers usnig STunnel? Here is what I have in my stunnel.conf: ******************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [ssmtp] accept = 127.0.0.1:587 connect = smtp.ex3.secureserver.net:587 ******************* And this is what I see in the log: ******************* 2016.02.03 18:55:14 LOG5[63]: Service [ssmtp] accepted connection from 127.0.0.1:57314 2016.02.03 18:55:14 LOG5[63]: s_connect: connected 184.168.131.205:587 2016.02.03 18:55:14 LOG5[63]: Service [ssmtp] connected remote server from 10.10.10.10:57315 2016.02.03 18:55:14 LOG3[63]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2016.02.03 18:55:14 LOG5[63]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket ******************* I am quite sure that my server address and port is correct, and obviously the other application is pushing data to stunnel. Seems like what's coming back from server is puzzling. Any help regarding this? Thanks, Mahdi.

1 0

stunnel 5.30 released
by Michal Trojnara 28 Jan '16

28 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.30 of stunnel. The ChangeLog entry: Version 5.30, 2016.01.28, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2f. https://www.openssl.org/news/secadv_20160128.txt * New features - Improved compatibility with the current OpenSSL 1.1.0-dev tree. - Added OpenSSL autodetection for the recent versions of Xcode. * Bugfixes - Fixed references to /etc removed from stunnel.init.in. - Stopped even trying -fstack-protector on unsupported platforms (thx to Rob Lockhart). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 7d6eb389f6a1954b3bcf6c71d4ae3c5f9dde1990dd0b9e0cb1c7caf138d60570 stunnel-5.30.tar.gz cf13a881d2f19b8db5e70fafac6e5dad31f041ee6b9c0316dbd8f9f425c16418 stunnel-5.30-installer.exe 102c54d0f58937fc3c3de2a6fb6295622222e48eae200123d6357889defa45c1 stunnel-5.30-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWqkhcAAoJEC78f/DUFuAUbZoP/iH+4dndQdh5SSpSH8NR2dUf Nx10nPHP9WXZIVF9C0pISDGpRcpRi6k+4p3NU8SblGsTRm78zCpWYmeEso46Q9ve IHCrUrmQntygZ5xL5Igij9rvN8s6VeucxiMX1pZBJWAvtV5Mj2XDWFEgGiUc+sPC leCJIhj+2G6hNZJzl5whptW48+smqQvh8LC5jEtFaAUp5C0ptjrmz/vebEDlVKOs qZOZMwLmNojP3WGWWrt5fkBCLZXKvkDipgI4ln3aro/fCYQZ5fikGYbW7dTOvNCT lFmCS2vXg1hqFNM3qBWp8HKqiyYR9nVYNesW5vQW/INp6wRSqul9QSJQwsVge37N wbl19KLZL0bqXYV5a5OTovi5X1X+wRbKkcGE8yozptifV4n1AgZL4rbLkKqFu/BF zHHUmOi1m5SkRAoN8pmaTmNFe/Zp72o6unN1kfrXyvJj6NCiDKXMqTmYw4bfoSBM UUg6uKtc7k7XGPvgca/HrdEu8DJPQIWcRqNVqQ5AxVnub9gBFsJC15XdgutHJK97 XuLhZhHBdm10Frf2u/nk2Q2GpPdHAPK67QgERzO2Nr35KGOxwMXahyxKK0jI5ue5 bekTLYjZYUKS94Lt/uUgxaVmwG0x1qjurfhdXoUemuYKUAzv2tZlNF1NiGme3feP WqLyTnuGhYIxEbltnFif =gYXk -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] Access an arbitrary https website on http://localhost:3000 via stunnel.
by Hongyi Zhao 15 Jan '16

15 Jan '16

2016-01-14 16:51 GMT+08:00 Michal Trojnara <Michal.Trojnara(a)stunnel.org>: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > Hi Hongyi, > > My hint: > > $ curl -s http://localhost:3000/ > Cannot GET / > > $ curl -s -H 'Host: coolaj86.com' http://localhost:3000/ Thanks a lot, I still have some issues: 1- Why must we use the ''-H 'Host: coolaj86.com' '' in this command for getting the correct result? 2- If I want to use internet explorer, such as firefox/chrome to open the corresponding url, i.e., http://localhost:3000/, how should I do? 3- There are 3 certificates given by the owner of the website https://coolaj86.com/. They are all stored here: https://gist.github.com/coolaj86/327cee3eee6fc119b389/ Just as you can see, the 3 certificates are named as follows: cert.pem chain.pem root.pem What's the relationship between the above 3 certificates? And the first certificate, i.e., the cert.pem, is the one used for the website https://coolaj86.com/. So, I just want to know why we must the root.pem in the stunnel's conf file? Regards > <!DOCTYPE html> > <html lang="en"> > <head> > <meta charset="utf-8"> > <title>AJ ONeal</title> > ... > > Best regards, > Mike > > On 14.01.2016 05:51, Hongyi Zhao wrote: >> Hi all, >> >> Based on the descriptions on the following webpage: >> >> http://plug.org/pipermail/plug/2015-August/033939.html >> >> I do the following testing: >> >> 1- Complile and install the lastest stunnel, i.e., the >> stunnel-5.29. >> >> 2- Obtaining the root cert >> >> wget -q >> https://gist.githubusercontent.com/coolaj86/327cee3eee6fc119b389/raw/r > oot.pem >> >> > - -O /tmp/root.pem >> >> 3- Prepare the following config file for stunnel: >> >> pid = /tmp/stunnel-tlsvpn.pid >> >> client = yes verify = 1 foreground = yes >> >> [tlsvpn] accept = localhost:3000 sni = coolaj86.com connect = >> coolaj86.com:443 CAfile = /tmp/root.pem >> >> 4- Starting the stunnel: >> >> $ stunnel ./stunnel-tlsvpn.conf >> >> 5- Testing: >> >> At this moment, I use the firefox to open the following url: >> >> http://localhost:3000 >> >> But the firefox will only give the following line in its windows: >> >> Cannot GET / >> >> Any hints on this issue? >> >> Regards >> > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2 > > iQIcBAEBCAAGBQJWl2GYAAoJEC78f/DUFuAUwlAP/3w4sq5u4Wp1SV9mbB4Sr7D4 > nP++WO10HLpSFQRnO85BaX2XHwU5aC+AxDI9wztvkEXLE9gup3KfT9Dvk9cfrHHv > Vb+EmOnspKslsOI1X/pHbSxB7tuc816aqqW9Q2Vmwh9RoVnt0djFIIB/GpKQa/0m > YhJrfcpT+WmZ3xrKQUcsahVFTzgxWxZCbDO26c/B3n/ORSmCvs4lRuYXtAuqfGlX > q0+qHt4+gi69lc6PMLeGWEonFhgHCl3Mc2Oa5Y3atb52uWG3KS2b4KF+ZQWfhPFK > qMggrXNnGgtxrb52rTw8C0/e14v3ZmENB2NX3qZGOvgiS4YujbjE2yGOgjeJzaxo > x/UEOFY2X879TECrThEWS87e6BiMog5iKYw8VneJ6rAYn40vGPEji5Lg8kTUU3kC > Du5u2zyIdPmqHhTKqpSoIgFKt1w80VpM7wZ/Z8H12yJJh1MHvh7EFUZTZ987nMpt > UNf8wCTTDxMEnQI/kMODLBLO9ntGnCHF0PXQ3s24zQ10/BftLyNbTMMTs14bktQG > hyWV/aGqF7+dtgcTgirLn1cypxKW5wrF8JOt5I/B1c3/fafHny/I4NyuF5MQuEB9 > GDDjYwbcQrU4shSA4Hoe5mWQDpdBJUBb5+8wHkgZg2neU8wcfyzEPucS960eG46Q > zSbvpAgUjmvP91qZhWyI > =oyVS > -----END PGP SIGNATURE----- -- Hongyi Zhao <hongyi.zhao(a)gmail.com> Xinjiang Technical Institute of Physics and Chemistry Chinese Academy of Sciences GnuPG DSA: 0xD108493

3 6

Access an arbitrary https website on http://localhost:3000 via stunnel.
by Hongyi Zhao 13 Jan '16

13 Jan '16

Hi all, Based on the descriptions on the following webpage: http://plug.org/pipermail/plug/2015-August/033939.html I do the following testing: 1- Complile and install the lastest stunnel, i.e., the stunnel-5.29. 2- Obtaining the root cert wget -q https://gist.githubusercontent.com/coolaj86/327cee3eee6fc119b389/raw/root.p… -O /tmp/root.pem 3- Prepare the following config file for stunnel: pid = /tmp/stunnel-tlsvpn.pid client = yes verify = 1 foreground = yes [tlsvpn] accept = localhost:3000 sni = coolaj86.com connect = coolaj86.com:443 CAfile = /tmp/root.pem 4- Starting the stunnel: $ stunnel ./stunnel-tlsvpn.conf 5- Testing: At this moment, I use the firefox to open the following url: http://localhost:3000 But the firefox will only give the following line in its windows: Cannot GET / Any hints on this issue? Regards -- Hongyi Zhao <hongyi.zhao(a)gmail.com> Xinjiang Technical Institute of Physics and Chemistry Chinese Academy of Sciences GnuPG DSA: 0xD108493

2 1

Re: [stunnel-users] Fwd: Stunnel log file format
by Ludolf Holzheid 12 Jan '16

12 Jan '16

On Tue, 2016-01-12 11:23:43 -0430, Jesús Alfredo Cambera wrote: > Hello Ludof, > > Thanks for answering so fast. I think this information would be really > useful for other users. I'd would be great if it could be included the the > manual page (https://www.stunnel.org/static/stunnel.html) > > I had just completed the logstash filters but still I have one last > question: What do the log levels correspond to: error, warning, info? Hi Alfredo, always answer to the list, so others may read along and/or chime in. >From the stunnel man page: >> >> Level is a one of the syslog level names or numbers emerg (0), alert (1), crit (2), >> err (3), warning (4), notice (5), info (6), or debug (7). All logs for the specified >> level and all levels numerically less than it will be shown. Use debug = debug or >> debug = 7 for greatest debugging output. The default is notice (5). This seems to perfectly match the 'conventional meaning of the log level' used for most POSIX system log daemons (e.g. the linux syslogd). I don't know how significant the level /names/ actually are - Maybe all you can read from this is that level 0 gives the fewest and level 7 gives the most messages. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:lholzheid@bihl-wiedemann.de http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

2 1

Fwd: Stunnel log file format
by Jesús Alfredo Cambera 12 Jan '16

12 Jan '16

Hi everybody, I'm pretty new on stunnel and I'm still learning a lot through the documentation. One of the tasks that i need to accomplish is to consolidate all the log information using logstash and ELK. So far I had managed to figure out most of the log file format. Here is an example of my log file 2013.01.11 11:26:35 LOG5[13520:140223486400256]: stunnel3 accepted connection from 127.0.0.1:45939 2013.01.11 11:26:35 LOG6[13520:140223486400256]: connect_blocking: connecting 123.4.5.6:9130 2013.01.11 11:26:35 LOG5[13520:140223486498560]: connect_blocking: connected 7.8.9.10:9130 The first two fields are date and hour but I don't understand what do the next field means (LOG5, LOG6). Next is the pid, but I don't know anything about the next field. The last one is the error explanation. Is there documentation about log file format? I'd really appreciate your help. Greetings from Venezuela, Alfredo

2 1

Re: [stunnel-users] Help: sTunnel http to Apache https?
by Hathor27 11 Jan '16

11 Jan '16

Please everybody out there, can anybody tell me, if I can wrap a http-proxy request into http over ssl (https, with sTunnel) and receive it by an Apache https server (without sTunnel server)? Best regards Hathor27

1 0

stunnel 5.29 released
by Michal Trojnara 08 Jan '16

08 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.29 of stunnel. The ChangeLog entry: Version 5.29, 2016.01.08, urgency: LOW * New features - New WIN32 icons. - Performance improvement: rwlocks used for locking with pthreads. * Bugfixes - Compilation fix for *BSD. - Fixed configuration file reload for relative stunnel.conf path on Unix. - Fixed ignoring CRLfile unless CAfile was also specified (thx to Strukov Petr). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 43909625403ea634fa7cb8399d58faf8e7f11c1b7b29097491469951f56df551 stunnel-5.29.tar.gz c92ccc98cc9eb0c5d95d9550af39ab502e7ea45ed4d9ccc821aa261856f958b1 stunnel-5.29-installer.exe f9db8676e8e2ec6db355bae41eb625eb8ebd45a836ad8cbf06ce60a3c305fde2 stunnel-5.29-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWj/AqAAoJEC78f/DUFuAUZagQAMbBLW8VSgB8x8WGK1ZueSun HJAqXQgCYFY3+Vdz/41gdGy4T8kMB0MHarCwUbI4Wuk/JEvJLIs7OtFzycm1pTBU vXOgk962OkKs/RGD6tygnzIMmYU+BjxPLcfuj0JZR8Z3/Skt2ssFh4RrgCwoFM7/ VxseTRf487dBTU8n2EduWS1naNSIZCN6MlM0Ql1NNenZIGUSYlOfpxXSYo2ZTbe9 At+oVJ5J23eZrv5Vd48cZY7ArfXqCFDkUsCVyBOjUoSSJQ3qZ7srr7tWj4AVY6Pp Nk4Q1w1o7vWpEMDovjEmiLJMUGY2AUiQMpKoZDyfTnDRdtEfEDb7+P9sa++sruSY uauMZ4IL2zjUhWh2RJVnYHgCYCvjAWVw3GeUoM092svR0NXqf0fnBqAGgXNA/uHg zXy2Ljp8yLSK73oR3z7BaSmM3+q1NS2fZBEfWOVpZoOdG+hoyCZvsvuvDpNXh+y8 7WBPiGMl+Umti8HxKDsF/HEiLoSRrBZFZ1t2jwmLM+kZAsA06j3s5ExttK+FNsSC s/yoISPBGIRJyM/xOwYugyO2mDI8xLm3w7YbJADlJ0R2UiaRFVRqJErITv1/i18c Xek1mhk6HgyhQSCns4gxjM/Xc3VuOGJCP6umwUuiXQvyHvP+oypAyYlgshxNmKD1 Ccn+1DCtt3jw83qNLrZE =yIQ7 -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] Help: sTunnel http to Apache https?
by Hathor27 05 Jan '16

05 Jan '16

Thank you for your fast response, Jhon. My target https-server is a Synology DS211+ with Apache 2.2(Unix). Its VirtualHost config looks like: <VirtualHost *:443> ServerName myhost.mydomain.com ServerAlias internal.name.local DocumentRoot /somepath/not/used/at/all/ SSLEngine On SSLProtocol all -SSLv2 -SSLv3 # TLSv1 or higher SSLProxyEngine On ProxyRequests On ProxyBadHeader Ignore ProxyVia Full AllowCONNECT myInternalPort <Proxy *> Order deny,allow Deny from all </Proxy> <ProxyMatch (internal\.name\.local)> Order allow,deny Allow from all </ProxyMatch> LogLevel debug ErrorLog /logpath/sshserver-proxy_error_log CustomLog /logpath/sshserver-proxy_request_log combined </VirtualHost> The sTunnel client config on Win7 is: debug = 7 log = overwrite output = C:\userpath\stunnel\stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [http-2-ssl] accept = 127.0.0.1:80 connect = proxy.gateway:gwPort protocol = connect protocolHost = myhost.mydomain.com:443 retry = yes config = Protocol:ALL config = Protocol:-SSLv3 Finally still remains my initial question: Can I wrap my http-proxy request into http over ssl (https) and receive it on an Apache https server? If 'yes', how? Best regards Hathor27 Btw: Hopefully better posted

1 0