DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 4D420385770C
Message-ID: <0100018db4504c0a-a8320068-b704-4458-b4b1-eee8b912bdc7-000000@email.amazonses.com>
Date: Fri, 16 Feb 2024 23:46:17 +0000
MIME-Version: 1.0
In-Reply-To: <2orusip0fcft7bvfemu05eb61l43vsnmj8@4ax.com>
References: <0100018dae3b46a4-ccc76b81-1814-421b-a81c-d00436297c10-000000@email.amazonses.com>
 <2orusip0fcft7bvfemu05eb61l43vsnmj8@4ax.com>
To: cygwin@cygwin.com, Andrew Schulman <andrex.e.schulman@gmail.com>
Subject: Re: ssh over stunnel hangs on second connection
Feedback-ID: 1.us-east-1.Zao4ZYFkcQIqFUKHPFqcIUzSz0SUuTXbgFyfdyEho8U=:AmazonSES
Precedence: list
From: cygwin--- via Cygwin <cygwin@cygwin.com>
Reply-To: cygwin@kosowsky.org
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces+archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>

Andrew Schulman via Cygwin wrote at about 09:36:58 -0500 on Friday, February 16, 2024:
 > Hi. I'm the stunnel maintainer for Cygwin. I don't know why stunnel would hang
 > as you describe, but I'll try to help.
 > 
 > I agree that your configuration of ssh over TLS is common - I used it myself for
 > years. However as matthew patton suggests, there are other ways to get the same
 > goal, that may let you work around this problem.
 > 
 > One possibility that matthew didn't mention, is to run your ssh server on port
 > 443, and connect directly to it with ssh - no TLS wrapper. Yes, that's
 > non-standard, but if you can live with that, it might work fine for you and be
 > simpler. My best understanding is that ssh and TLS are indistinguishable to an
 > application firewall.

I actually ran SSHD over 443 (technically, had my router port forward
443 to 22 on my server) for about 15 years.
But then I started finding some corporate and airline networks would
use DPI to block non-ssl packets on 443 which would block SSH.
This is the reason I went to SSH over SSL/stunnel to get around such
DPI and it has worked fine for the past 5+ years.

I only noticed the current problem when I moved to a new Win11 laptop
along with upgraded Cygwin...

 > 
 > But supposing you keep your current configuration. Can you please clarify how
 > you're invoking stunnel? Do you have a ProxyCommand directive in your
 > .ssh/config, like:
 > 
 > ProxyCommand /usr/bin/stunnel stunnel.conf

No... I just ssh to 'localhost' on the port that per stunnel.conf is
listening for client connections.
This works fine in Ubuntu and has worked fine for me before on
Win7/Win10.

I don't use any fixed ProxyCommand to invoke stunnel because the vast
majority of the time I just use straight SSH -- I only use 'stunnel'
when SSH is blocked.

 > or is it some other way? I ask this because with ProxyCommand as above, you
 > should get a separate stunnel process for each new ssh connection, and I can't
 > think why they would interfere with each other.
 > 
 > Andrew
 > 
 > 
 > -- 
 > Problem reports:      https://cygwin.com/problems.html
 > FAQ:                  https://cygwin.com/faq/
 > Documentation:        https://cygwin.com/docs.html
 > Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple