Set client = yes
in the [myservice]
section. This tells stunnel that the connect
(aka "server") side is the SSL one and the accept
(aka "client") side is plain. The default is the opposite, which requires an SSL certificate.
But that's not all! For some insane reason, stunnel defaults to completely insecure mode that does no verification of the server's certificates, which means that you would be subject to man-in-the-middle (MitM) attacks! To fix this, use the verify = 2
and CAfile
options. On Ubuntu, the CAfile
can be found at /etc/ssl/certs/ca-certificates.crt
(from the ca-certificates
package). While you're at it, also set options = NO_SSLv2
to disable the insecure SSLv2 protocol.
Finally, when you configure your usenet program, disable SSL, since the connection between the application and stunnel does NOT use SSL.
I wrote the following wrapper script to help with this. Replace <LOCAL_PORT>
, <REMOTE_HOST>
, and <REMOTE_PORT>
as appropriate, and replace # ...
with whatever command you want to run.
#!/bin/bash
PIDFILE=/tmp/stunnel-agent.pid
# Start stunnel in the background.
cat << EOF | stunnel4 -fd 0
pid = $PIDFILE
# Enable proper SSL security. Without this, you are completely insecure!
verify = 2
CAfile = /etc/ssl/certs/ca-certificates.crt
options = NO_SSLv2
[myservice]
client = yes
accept = <LOCAL_PORT>
connect = <REMOTE_HOST>:<REMOTE_PORT>
EOF
# Start whatever program you want.
# ...
# Kill stunnel.
kill $(cat "$PIDFILE")