Member Avatar for leghorn

Hi

I want to install stunnel in user mode.
By user mode I mean that I have created a user using adduser xyz.
Now when I run the ps -aef | grep stunnel .. it should show in xyz and not in root.
One school of thought was to use the parameters setuid and setgid in stunnel.conf by assigning them both "xyz".
but when I run the daemon, the errors flash
stunnel.pem: No such file or directory (2)
Service [https]: Failed to initialize SSL context

Please drop in ur views :)

  • 3 Contributors
  • 3 Replies
  • 207 Views
  • 3 Weeks Discussion Span
  • Latest Post Latest Post by DosDos

Dani AI

Generated

A concise, practical note that ties the replies together and fills the gap left after marked the problem fixed.

stunnel must be able to read the combined certificate+private-key file (stunnel.pem) when it initializes the SSL context. That initialization normally happens before any configured privilege drop (the setuid/setgid settings), and it also requires root to bind ports below 1024. Two common, correct approaches:

  • Start stunnel as root so it can bind privileged ports, set setuid/setgid in stunnel.conf to drop to the unprivileged account after SSL init, and keep the PEM readable by the starter uid (usually root).
  • Run stunnel entirely as the unprivileged account: the PEM must be owned/readable by that account and the service must bind to an unprivileged port (>1023) or the stunnel binary must be given CAP_NET_BIND_SERVICE (authbind/setcap) to allow binding to low ports.

A simple, reliable way to produce a single stunnel PEM and harden it:

openssl genrsa -out /etc/stunnel/key.pem 2048
openssl req -new -x509 -key /etc/stunnel/key.pem -out /etc/stunnel/cert.pem -days 3650 -subj "/CN=your.hostname"
cat /etc/stunnel/key.pem /etc/stunnel/cert.pem > /etc/stunnel/stunnel.pem
chmod 600 /etc/stunnel/stunnel.pem
chown root:root /etc/stunnel/stunnel.pem

If choosing the pure-user run model, chown xyz:xyz /etc/stunnel/stunnel.pem instead and use an unprivileged port or grant the binary binding capability (e.g. setcap cap_net_bind_service=+ep /path/to/stunnel).

Troubleshooting checklist: use absolute paths in stunnel.conf (cert = /etc/stunnel/stunnel.pem), confirm the file exists and ownership/permissions (the cause suggested), check SELinux/AppArmor contexts if enabled, and start stunnel in the foreground with increased logging to see the exact failure during SSL init. This answers ’s PEM question and explains why the permission/ownership step commonly resolves the reported error.

Recommended Answers

All 3 Replies

Member Avatar for rubberman

What is the user.group ownership and flag settings on the stunnel.pem file and the directory it is in? It is likely that either the flags/ownership on the .pem file or the directory containing it are wrong.

Member Avatar for leghorn

its done .. never mind :)

Member Avatar for DosDos

How do you resolved the issue?
I have your same issue and I can't find the correct way to generate the stunnel.pem file

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.