Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I prevent reading of the stunnel.pem file by any user other than the service user running Stunnel? How can I permit access to this directory (C:\Program Files\stunnel) in Windows XP to only the Stunnel service?

share|improve this question
Are you on a domain? – Mark Henderson Jan 18 '11 at 3:56
@Mark: Nope. No domain. – Brian Jan 18 '11 at 3:58
up vote 4 down vote accepted

The safest way to do this is to create a user account specifically for the stunnel service, and then apply the permissions appropriately

  1. Start > Run > lusrmgr.msc
  2. Right-click users and choose New user...
  3. Enter in the user details, and generate a strong password for the account (you'll only need it for the new few minutes, so just keep it in notepad for the time being).
  4. Start > Run > services.msc
  5. Right-click the stunnel service and go to properties
  6. Go to the Log On tab and check the option for This Account
  7. Enter the username and password from Step 3
  8. Click OK and you should get a message about the account being granted "Logon as a service" right
  9. Go to the security properties of C:\Program Files\stunnel\ and apply Full Control to the user from Step 3
  10. Remove excess permissions from the folder (you might need to go to Advanced and un-check Include inheritable permissions from this object's parent)


share|improve this answer
Thanks Mark. Works great! – Brian Jan 18 '11 at 15:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.