Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [stunnel]

Stunnel is a small tool that can wrap the connection of other protocols with SSL/TLS.

0
votes
0answers
42 views

SSH tunnel for serving web sites from localhost

This is more question... When I do like this... I am able to serve my site to external IP of my VPS... ssh -L 8080:localhost:80 username@server.com How secure and is it okay to serve websites ...
0
votes
2answers
63 views

How do I get a “valid SSL public certificate” from Windows Certificate ? (for stunnel configuration)

In these directions for configuring Stunnel on Windows the following text appears : Copy a valid SSL public certificate to the directory "C:\Program Files (x86)\stunnel." To make things more ...
1
vote
2answers
299 views

Can sslh differentiate between OpenVPN and HTTPS after they've been through STunnel?

Can sslh tell the difference between OpenVPN traffic and HTTPS traffic efter they have both been through STunnel? Like this: .---------. .------.HTTP/TCP.-------------. -->| stunnel |----&...
0
votes
0answers
144 views

Correct configuration for Apache, OpenVPN and Stunnel on ports 80 & 443 only?

I have recently set up OpenVPN on port 443 of my server. I chose 443 as I thought it would be able to bypass the strict firewall I am facing. I also run a couple websites on this server so I used the ...
0
votes
1answer
214 views

Install trusted Certificate on stunnel

I would like to be able to use a trusted certificate on Stunnel proxy, The default one does not seem to allow me to do this. Is there a way to do this please? Would need to be free.
0
votes
1answer
151 views

Configure SSL for openvpn on synology diskstation

I currently have a Synology DS218J and I have openvpn installed on it. I'm wondering how to configure SSL tunneling between the VPN server and the client. I did hear something about stunnel but I'm ...
0
votes
0answers
31 views

How change Galera Cluster port 3306 to avoid conflict between stunnel and SSL

My web app is in another server and I connect to mysql db through stunnel port 3306. Can I change the Galera Cluster regular port from port 3306 to another port? I need this port from web app be ...
0
votes
0answers
36 views

Debian as TCP-TLS proxy

I would like to use a Debian as tcp to tls proxy. Currently I have: Clients (10.1.10.10/10) > My new Debian TCP/TLS proxy > Remote TLS server On my Debian I do receive all outgoing traffic ...
2
votes
1answer
640 views

stunnel: ssl3_get_record error when using TLS 1.2

I'm trying to use stunnel to be able to use HTTPS (port 443) on my localhost for a development web server running locally on port 8000. It starts and accepts connections, but every time I open https:/...
1
vote
0answers
101 views

stunnel dropping first packet

I'm looking to send GELF (Graylog Extended Log Format) log messages from a logstash instance to Graylog. But since the GELF output in logstash does not support TLS I want to use stunnel to encrypt the ...
0
votes
2answers
237 views

Stunnel - SMTP Authentication failed

Hi ServerFault community, I have posted this to the stunnel-users mailing list on 30 April 2018 and again on 16 May 2018 at https://www.stunnel.org/pipermail/stunnel-users/2018-April/006000.html, ...
1
vote
1answer
103 views

HAProxy-Apache encrypt connection

I have haproxy_server and apache_server in different datacenters, what is the best way to have encrypt connection between them? It’s working with the certbotand with the following configuration: ...
1
vote
0answers
135 views

stunnel create systemd service files ?

I need to use stunnel to encrypt a service that by itself does not support any type of encryption. stunnel needs to run on the frontend and on the backend server. Because stunnel does not come with a ...
1
vote
0answers
909 views

How to put Stunnel behind a Nginx reverse proxy to mask OpenVPN?

I have setup Nginx as a reverse proxy listening to the 443 port for several blogs. I'd like to have Nginx pass a specific sub-domain to Stunnel to have a less-detectable VPN as shown below. Is it ...
1
vote
1answer
274 views

Will ssh tunnelling be a simpler way to solve my link encryption issue rather than stunnel?

We have an encryption issue from a vendors mid-tier to an Oracle database. We can use encrypted database connections and have done for 90% of cases. Our security team has advised us that since this ...
0
votes
1answer
124 views

Why does the AWS SES developer guide recommend using stunnel with Postfix?

I swear they changed this in the last year or two, but as of 2017-11-20, the SES developer guide for Postfix recommends setting up TLS via stunnel. This seems odd to me, considering that Postfix can ...
0
votes
0answers
710 views

Stunnel DNS over TLS

I am trying to setup DNS over TLS, see here:https://www.privacyfoundation.de/wiki/SSL-DNS.html . But i cannot figure out why my setup is not working. Here is my stunnel configuration: sslVersion =...
2
votes
1answer
1k views

stunnel - certificate verification

I have stunnel to provide SSL for Redis. I have the following configuration: [redis] CAfile= /etc/stunnel/ca.crt accept = 636 cert = /etc/stunnel/server1.crt connect = localhost:6379 key = /etc/...
0
votes
1answer
210 views

Email From Linux Using Stunnel

I'm trying to send an email from a linux instance using stunnel and AWS SES as outlined here. I've been through the above documention and and I seem to be getting a connection to my server that has ...
0
votes
1answer
238 views

Can't connect over https with stunnel - troubleshooting

I have stunnel forwarding from HTTP on port 8040 to HTTPS on port 8091. My stunnel.conf file: [henhouse] accept = 8091 connect = 127.0.0.1:8041 cert = /etc/stunnel/stunnel.pem How I generated said ...
1
vote
1answer
118 views

Stunnel agent emitting file not found error

I have an Stunnel 4.29 on Red Hat Linux 6.8 that will not start and emits a 'No such file or directory' error: # /usr/bin/stunnel /etc/stunnel/agent/dynatrace-agent.conf 2017.05.03 19:04:26 LOG7[...
1
vote
0answers
46 views

Hosting SSL tunneled OpenVPN and HTTPS on the same server at the same 443 port [duplicate]

Is there a way to host a SSL-tunneled (using stunnel) OpenVPN server and a regular Apache HTTPS server on the same server using HAProxy? It seems that by using stunnel, the format of the packets ...
0
votes
1answer
116 views

Restart stunnel4 quietly with no output

How can I restart stunnel4 and suppress output unless there is an error? I tried using the -quiet flag, but according to the manpage that is NT/2000/XP only $ /etc/init.d/stunnel4 restart -quiet /...
1
vote
0answers
682 views

Stunnel on ubuntu fails to listen on the port

I have installed stunnel4 on my 16.04 ubuntu and I have not been able to get any result out of the specific ports I have set it on via netstat -tulnp | grep 4444 here is my service status : ...
0
votes
0answers
566 views

Round robin & load balance to local port range using iptables on RedHat Linux

I wanted to implement load balancer (round robin) using 4 instances of ssh reverse tunnels running localhost:11669, localhost:11670, localhost:11671 & localhost:11672 connecting to remote host ...
0
votes
1answer
2k views

CentOS with SELinux, systemd and stunnel

I am using CentOS 7.3 with stunnel. If I launch stunnel like that : stunnel /etc/stunnel/stunnel.conf Everything works fine ! I would like to manage stunnel with systemd. Here is my stunnel.service ...
1
vote
1answer
1k views

Server closed connection error when checking if key exists in a redis cluster using stunnel

Using redis-cli command line utility with the -c switch to connect to a redis cluster with stunnel configured and running. When I execute the EXISTS command to verify a key, as expected, it redirects ...
1
vote
0answers
317 views

Stunnel with SNI: Section *name*: SNI section name not found

Im trying to use stunnel with 2 domains on the same IP. My conf is this: ;key = /etc/ssl/private/namecheap/server.key # See this link http://www.sysadminworld.com/2011/how-do-i-use-an-intermediate-...
0
votes
0answers
306 views

Stunnel broke packets

I'm trying to set up a secure connection between a computer and another. I'm my case, SSH doesn't seem a good solution, and VPN is worst in our case too. To begin, I've test my configuration in ...
1
vote
1answer
459 views

Redis Cluster over stunnel configuration

I'm trying to set up a 3 node Redis Cluster that communicates over stunnel. Redis listens on port 6379 (configurable) for client pub/sub and on the configured port+10000 (not configurable - it ...
0
votes
0answers
90 views

Establish a permanent TLS connection

Here's a usual stunnel setup: [client] <-- plaintext --> [stunnel] <=== TLS ===> [remote] By default, whenever client connects to stunnel, the TLS connection to remote is established ...
2
votes
0answers
3k views

stunnel won't verify client certificate as expected

I'm trying to set up stunnel to provide a TLS wrapper to an HTTP service that doesn't natively support TLS. I have this working well without using TLS client certificates. When adding the client ...
1
vote
1answer
1k views

Stunnel “wrong version number” error with TLS-PSK

I've got Stunnel running on a Raspberry Pi which is acting as a TLS wrapper for an apache2 server. I've configured it to use TLS-PSK (correctly, I think), but the logs show the following when I try to ...
3
votes
0answers
351 views

stunnel TIMEOUTconnect on Ubuntu 15.10

We use stunnel extensively for LDAP proxying. We recently set up a Ubuntu 15.10 server to migrate some of the tunnels to and are unable to get it to work. We've scraped through the logs, configs, ...
2
votes
1answer
3k views

Stunnel TLS authentication with multiple Authorities

I am trying to secure a rethinkdb cluster behind stunnel. The service needs to support multiple Certificate Authorities (CA). Currently I concat the accepted CAs into one file (/certs/ca.pem) but it ...
2
votes
0answers
556 views

iptables configuations for stunnel+squid

I'm building a highly anonymous proxy server with squid and stunnel, and I'm facing a configurations problem on iptables. The server should act like this: browser <-> client stunnel <=> ...
1
vote
0answers
181 views

stunnel does not handle SNI correctly

I am trying to get stunnel-4.53-1.1 in Debian Wheezy running. The important parts of my configuration (/etc/stunnel/stunnel.conf) look like that: [https] cert = /etc/ssl/certs/mydomain.pem key = /etc/...
2
votes
3answers
1k views

Stunnel: ssl to ssl

I have a little service which listen only on https://localhost:41952 and checks source hostname (it must be localhost). I want to connect on "listen:1988" and redirect requests with stunnel to "...
3
votes
0answers
2k views

HTTP to HTTPS local proxy that can do the HTTPS connection over a proxy

Here's the deal: Our client software can only connect using http protocol, it can not do https. However, security requirements dictate end-to-end security, so we need to use https when talking to the ...
2
votes
1answer
4k views

How to log/see the traffic going through stunnel before/after encryption?

So I am using stunnel to talk to a SSL server. I would like to see the messages I am sending before they get encrypted and more importantly the messages I am receiving after they get decrypted. I ...
5
votes
1answer
892 views

How does stunnel redirect traffic?

I am familiar with the stunnel.conf and I know how to specify which unencrypted ports it listens to and to which encrypted ports it redirects, but I would like to understand how it gets the power to "...
3
votes
0answers
154 views

Why is the loopback device needed on a client side of Stunnel?

This SANS Institute guide states that "On the client side, a port listening on the loopback interface of the local system would send/receive data on the clear-text protocol and tunnel out on ...
0
votes
3answers
428 views

Did I install stunnel correctly?

Running Ubuntu 14.04 64-bit. apt-get install build-essential -y apt-get install libssl-dev -y apt-get install wget -y cd srv wget https://www.stunnel.org/downloads/stunnel-5.23.tar.gz tar -xzf ...
3
votes
2answers
6k views

Failed to start stunnel4 on Ubuntu 15.04

I get the following error starting stunnel4 service on Ubuntu 15.04: root@scw-d91ec7:~# service stunnel4 start Job for stunnel4.service failed. See "systemctl status stunnel4.service" and "journalctl ...
1
vote
0answers
989 views

Syslog-ng and Stunnel between two hosts (Connection refused)

I'd like to setup syslog-ng over stunnel between a host on my LAN and a host in my DMZ but can't quite figure out the configuration. The stunnel config seems to be correct. If I shutdown syslog on ...
0
votes
0answers
392 views

CentOS Postfix/Dovecot status deferred conversation with 127.0.0.1[127.0.0.1] timed out while receiving the initial server greeting

Linux Kernel: Linux 2.6.32-504.16.2.el6.i686 on i686 RAM: 6GB OS: CentOS 6.6 Postfix 2.6.6 Dovecot 2.0.9 Relay Host Verizon Stunnel through 127.0.0.1:2525 Webmin 1.750 Virtualmin 4.17.gpl Multiple ...
11
votes
2answers
16k views

stunnel vpn traffic and ensure it looks like SSL traffic on port 443

I am trying to make my outgoing and incoming traffic look as legitimate as close to SSL traffic as possible. Is there a way to DPI my own traffic to ensure it looks like SSL traffic and not OpenVPN ...
3
votes
1answer
639 views

Set up stunnel to wrap SSL for a single application

I am trying to use stunnel to get an older usenet client to support SSL. I tried the following config: [myservice] accept = <LOCAL_PORT> connect = <REMOTE_HOST>:<REMOTE_PORT> but ...
1
vote
1answer
2k views

stunnel4: Disable Secure Client-Initiated Renegotiation

How is it possible to disable Secure Client-Initiated Renegotiation in stunnel4? I'm using version stunnel 4.53-1.1ubuntu1 on Ubuntu 14.04 Trusty with OpenSSL 1.0.1f and stunnel 4.53-1.1 on Debian ...
0
votes
2answers
2k views

Binding stunnel on both IPv6 and IPv4

I would like to make a local unencrypted service that listens on 127.0.0.1:8000 available via SSL on both IPv4 and IPv6 on port 8001. Unfortunately, stunnel configuration [Server] accept = 8001 ...