3

I am trying to use stunnel to get an older usenet client to support SSL. I tried the following config:

[myservice]
accept = <LOCAL_PORT>
connect = <REMOTE_HOST>:<REMOTE_PORT>

but stunnel kept failing with the error:

Section myservice: SSL server needs a certificate

What am I doing wrong?

1 Answer 1

3

Set client = yes in the [myservice] section. This tells stunnel that the connect (aka "server") side is the SSL one and the accept (aka "client") side is plain. The default is the opposite, which requires an SSL certificate.

But that's not all! For some insane reason, stunnel defaults to completely insecure mode that does no verification of the server's certificates, which means that you would be subject to man-in-the-middle (MitM) attacks! To fix this, use the verify = 2 and CAfile options. On Ubuntu, the CAfile can be found at /etc/ssl/certs/ca-certificates.crt (from the ca-certificates package). While you're at it, also set options = NO_SSLv2 to disable the insecure SSLv2 protocol.

Finally, when you configure your usenet program, disable SSL, since the connection between the application and stunnel does NOT use SSL.

I wrote the following wrapper script to help with this. Replace <LOCAL_PORT>, <REMOTE_HOST>, and <REMOTE_PORT> as appropriate, and replace # ... with whatever command you want to run.

#!/bin/bash
PIDFILE=/tmp/stunnel-agent.pid

# Start stunnel in the background.
cat << EOF | stunnel4 -fd 0
pid = $PIDFILE

# Enable proper SSL security.  Without this, you are completely insecure!
verify = 2
CAfile = /etc/ssl/certs/ca-certificates.crt
options = NO_SSLv2

[myservice]
client = yes
accept = <LOCAL_PORT>
connect = <REMOTE_HOST>:<REMOTE_PORT>
EOF

# Start whatever program you want.
# ...

# Kill stunnel.
kill $(cat "$PIDFILE")

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .