stunnel-users January 2021

8 participants
9 discussions

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

Seeing Message in Plain Text in Wireshark
by David Brower 28 Jan '21

28 Jan '21

First time user of Stunnel and I just wanted to check what I'm doing wrong. I have two processes running: a TCP Listener that listens on port 13000 and a TCP client that sends it a message. I'm running Stunnel on Windows 10 with the following config: [myapp] client = yes accept = 13001 connect = 13000 cert = stunnel.pem TIMEOUTclose=0 I updated the TCP client to send the message to port 13001 but when I check Wireshark I can still see the contents of the message in plaintext. Shouldn't I no longer be able to see the unencrypted contents of this message? Here are the relevant logs: 2021.01.27 20:57:26 LOG7[main]: Found 1 ready file descriptor(s) 2021.01.27 20:57:26 LOG7[main]: FD=588 ifds=r-x ofds=r-- 2021.01.27 20:57:26 LOG7[main]: FD=596 ifds=r-x ofds=--- 2021.01.27 20:57:26 LOG7[main]: Service [myapp] accepted (FD=924) from 127.0.0.1:9322 2021.01.27 20:57:26 LOG7[main]: Creating a new thread 2021.01.27 20:57:26 LOG7[main]: New thread created 2021.01.27 20:57:26 LOG7[2]: Service [myapp] started 2021.01.27 20:57:26 LOG7[2]: Setting local socket options (FD=924) 2021.01.27 20:57:26 LOG7[2]: Option TCP_NODELAY set on local socket 2021.01.27 20:57:26 LOG5[2]: Service [myapp] accepted connection from 127.0.0.1:9322 2021.01.27 20:57:26 LOG6[2]: s_connect: connecting 127.0.0.1:13000 2021.01.27 20:57:26 LOG7[2]: s_connect: s_poll_wait 127.0.0.1:13000: waiting 10 seconds 2021.01.27 20:57:26 LOG7[2]: FD=940 ifds=rwx ofds=--- 2021.01.27 20:57:26 LOG5[2]: s_connect: connected 127.0.0.1:13000 2021.01.27 20:57:26 LOG5[2]: Service [myapp] connected remote server from 127.0.0.1:9323 2021.01.27 20:57:26 LOG7[2]: Setting remote socket options (FD=940) 2021.01.27 20:57:26 LOG7[2]: Option TCP_NODELAY set on remote socket 2021.01.27 20:57:26 LOG7[2]: Remote descriptor (FD=940) initialized 2021.01.27 20:57:26 LOG6[2]: SNI: sending servername: localhost 2021.01.27 20:57:26 LOG6[2]: Peer certificate not required 2021.01.27 20:57:26 LOG7[2]: TLS state (connect): before SSL initialization 2021.01.27 20:57:26 LOG7[2]: Initializing application specific data for session authenticated 2021.01.27 20:57:26 LOG7[2]: TLS state (connect): SSLv3/TLS write client hello

3 2

Stunnel intercept and modify payload
by Sealside - 26 Jan '21

26 Jan '21

Hi! I'm wondering if it is possible to modify payload before it is encrypted? I have a stunnel config which intercepts TLS. I have the following config: [server] client = no cert= /etc/stunnel/stunnel.pem accept = 127.0.0.1:11010 connect = 127.0.0.1:12220 [client] client = yes accept = 127.0.0.1:12220 connect = remoteserver_ip:12222 So when posting TLS messages on port 11010 from my TLS-client on the same server, I can connect to port 12220 using tcp-dump and read the payload unencrypted. Is it possible to alter the payload before it is sent? In that case any pointers would be appreciated , I have tried searching but it does not seem to be a common use case. Would be great if I could tunnel it somewhere else and back (external python program). Thanks in advance, S

1 0

Poss Memory Leak
by Danny Clowes 25 Jan '21

25 Jan '21

Hi, Using the latest build of S'tunnel getting this error when do systemctl status stunnel4 can anyone shed some light on this please using Debian 9 as unable to get Debian 10 work with Stunnel. Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508179]: Possible memory leak at ../ssl/packet_locl.h:385: 1021646 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508091]: Possible memory leak at ../ssl/packet_locl.h:385: 1021646 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508179]: Possible memory leak at ../crypto/threads_pthread.c:21: 526301 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508091]: Possible memory leak at ../crypto/threads_pthread.c:21: 526301 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508170]: Possible memory leak at ../crypto/stack/stack.c:108: 1026780 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508170]: Possible memory leak at ../ssl/packet_locl.h:385: 1021646 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508170]: Possible memory

1 0

installation v run ad-hoc
by Andrew Zenz 21 Jan '21

21 Jan '21

Hi there, a bit of background to start. We are using SEE4C (from marshallsoft.com) for sending email from our application, and have been for some time. We call various functions from their see32.dll. It has been sitting on the back-burner for some time, but now we must implement TLS/SSL for outgoing mail. MarshallSoft don't do TLS/SSL themselves, instead passing that responsibility on to stunnel by way of an internal function I have been reading MarshallSoft's doco and find that I have to 'install' stunnel and have it running in the background either as a services or starting it when the user logs on (in the Startup group). I also read in their doco regarding mapped drives: MAPPED DRIVES Beginning with Windows 10 update 1803, all executables (such as SEE application programs, SEE32.DLL/SEE64.DLL, and Stunnel) must be loaded from a local drive, not a mapped drive. Unfortunately the requirement to install stunnel and inability to run it from a mapped drive doesn't suit many of our clients installation base. Many of them run our application from a mapped drive. I also don't want the overhead of installing stunnel on each workstation that needs to send email or distribute and maintain configuration files. I have enough work to do. Can stunnel be called (started) on an ad-hoc basis and stopped again, only when email is being sent? I don't mean to whine, what options do I have, do our clients have? Cheers, Andrew

1 0

Why the version of Client Hello is always TLS 1.0 ?
by liuyongjiao＠synqnc.com 13 Jan '21

13 Jan '21

Hi, Why the TLS version is always 1.0 ? Please help to check. Frame 11: 1721 bytes on wire (13768 bits), 1721 bytes captured (13768 bits) Ethernet II, Src: fa:16:3e:53:dc:2f (fa:16:3e:53:dc:2f), Dst: IETF-VRRP-VRID_02 (00:00:5e:00:01:02) Internet Protocol Version 4, Src: 10.160.8.11, Dst: 10.160.130.34 Transmission Control Protocol, Src Port: 50692, Dst Port: 9002, Seq: 1, Ack: 1, Len: 1655 Transport Layer Security TLSv1 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 1650 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 1646 Version: TLS 1.2 (0x0303) Random: fd7cbf2da8172c362ebd3120b2dcd3886f3015eabfb5f167… Session ID Length: 32 Session ID: 4ea202f00bd35c102c97e8621f68e33dd59ad8ee95a58a2f… Cipher Suites Length: 170 Cipher Suites (85 suites) Compression Methods Length: 1 Compression Methods (1 method) Extensions Length: 1403 Extension: server_name (len=18) Extension: ec_point_formats (len=4) Extension: supported_groups (len=28) Extension: session_ticket (len=1296) Extension: signature_algorithms (len=32) Extension: heartbeat (len=1) Following are the config file: ;************************************************************************** ; * Global options * ; ************************************************************************** ; It is recommended to drop root privileges if stunnel is started by root ;setuid = stunnel4 ;setgid = stunnel4 ; PID file is created inside the chroot jail (if enabled) pid = /home/stunnelnew.pid ; Debugging stuff (may be useful for troubleshooting) ;foreground = yes ;debug = info debug = debug output = /home/log/stunnelnew.log ;options = NO_SSLv2 ;options = NO_SSLv3 ;options = NO_TLSv1 ;options = NO_TLSv1.1 ;sslVersionMax = TLSv1.2 ;sslVersionMin = TLSv1.2 ; ************************************************************************** ; * Service definitions (remove all services for inetd mode) * ; ************************************************************************** [xxxxxxxxxxxx] ;socket = a:SO_REUSEADDR=no retry = yes ;options = NO_SSLv2 ;options = NO_SSLv3 ;options = NO_TLSv1 ;options = NO_TLSv1.1 sslVersion = TLSv1.2 ;socket = l:SO_LINGER=1:13 ;sslVersionMin = TLSv1.2 cert = /home/x/ssltest/x/server.cer key = /home/x/ssltest/x/server_key.pem CAfile = /home/x/ssltest/x/trust.cer client = yes accept = 31115 connect = 10.160.1.11:9113 liuyongjiao(a)synqnc.com

1 0

stunnel to gmail didn't work
by wangweihsiang1109＠gmail.com 09 Jan '21

09 Jan '21

Hello,I have set up a website,and I want to send email by gmail,so I used stunnel,but my gmail didn't send anything. 2021.01.08 15:01:58 LOG5[14]: Service [gmail-smtp] accepted connection from 127.0.0.1:59920 2021.01.08 15:01:58 LOG5[14]: s_connect: connected 2404:6800:4008:c06::6d:587 2021.01.08 15:01:58 LOG5[14]: Service [gmail-smtp] connected remote server from 2001:b011:e:3358:b5b1:fa68:8b3:883c:59921 2021.01.08 15:01:59 LOG5[14]: Connection closed: 22 byte(s) sent to TLS, 154 byte(s) sent to socket conf look like this: [gmail-smtp] client = yes accept = 127.0.0.1:35 connect = smtp.gmail.com:587 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes protocol = smtp protocolUsername = *****(a)gmail.com protocolPassword = *****

1 0

report
by Danny Clowes 03 Jan '21

03 Jan '21

sudo find / -name openssl ive checked some locations but im very lost since learning ssl and stunnel i would be happy if you could forward me to the right location & i'll send information back.. Thank you ------------------- /etc/apparmor.d/abstractions/openssl /usr/include/x86_64-linux-gnu/openssl /usr/include/openssl /usr/bin/openssl /usr/share/lintian/overrides/openssl /usr/share/doc/openssl /usr/share/bash-completion/completions/openssl /root/openssl-master/test/ossl_shim/include/openssl /root/openssl-master/include/openssl /snap/core/10577/etc/apparmor.d/abstractions/openssl /snap/core/10577/usr/bin/openssl /snap/core/10577/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl /snap/core/10577/usr/lib/python3/dist-packages/cryptography/hazmat/bindings/openssl /snap/core/10577/usr/share/bash-completion/completions/openssl /snap/core/10577/usr/share/doc/openssl root@debian:/usr/local/include#

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users January 2021