Original release 20160919

[fex.git] / doc / SSL

diff --git a/doc/SSL b/doc/SSL
index fccd4488f0298e34c4883b9f1f8f11b0d45d88f6..90e01efd57f9685ba02dfef6c71df080a37a8852 100644 (file)
--- a/doc/SSL
+++ b/doc/SSL
@@ -2,35 +2,56 @@
 
 # execute this as root!
 
 
 # execute this as root!
 

+# Redhat+CentOS : stunnel does not work! you need to install stunnel-4
+#
+# Debian+Ubuntu : stunnel-5 does not work! you need to install stunnel-4
+#
+# apt-get install gcc make libssl-dev
+# yum install gcc make openssl-devel
+# cd /tmp
+# wget ftp://ftp.nluug.nl/pub/networking/stunnel/archive/4.x/stunnel-4.57.tar.gz
+# tar xvzf stunnel-4.57.tar.gz
+# cd stunnel-4.57
+# ./configure --prefix /opt/stunnel-4.57
+# make
+# make install
+# ln -s /opt/stunnel-4.57/bin/stunnel /usr/local/bin/stunnel4
+

 mkdir /home/fex/etc
 cd /home/fex/etc/
 
 mkdir /home/fex/etc
 cd /home/fex/etc/
 

-openssl req -new -x509 -days 9999 -nodes -out stunnel.pem -keyout stunnel.pem
+# create self-signed certificate

 # see http://www.infodrom.org/Debian/tips/stunnel.html
 # see http://www.infodrom.org/Debian/tips/stunnel.html

+openssl req -new -x509 -days 9999 -nodes -out stunnel.pem -keyout stunnel.pem

 dd if=/dev/urandom count=2 | openssl dhparam -rand - 1024 >> stunnel.pem
 openssl x509 -text -in stunnel.pem
 chmod 600 stunnel.pem
 
 cat <<EOD>stunnel.conf
 dd if=/dev/urandom count=2 | openssl dhparam -rand - 1024 >> stunnel.pem
 openssl x509 -text -in stunnel.pem
 chmod 600 stunnel.pem
 
 cat <<EOD>stunnel.conf

+debug = warning
+output = /home/fex/spool/stunnel.log

 cert = /home/fex/etc/stunnel.pem
 sslVersion = all
 cert = /home/fex/etc/stunnel.pem
 sslVersion = all

+fips = no

 TIMEOUTclose = 1
 TIMEOUTclose = 1

-exec = perl
-execargs = perl -T /home/fex/bin/fexsrv stunnel
+exec = /home/fex/bin/fexsrv
+execargs = fexsrv stunnel

 EOD
 
 EOD
 

-case $(lsb_release -a 2>/dev/null) in 
-  *CentOS*) echo 'fips = no' >>stunnel.conf;;
-esac
+## https://www.stunnel.org/pipermail/stunnel-users/2013-October/004414.html
+#case $(lsb_release -a 2>/dev/null) in
+#  *CentOS*) echo 'fips = no' >>stunnel.conf;;
+#esac

 
 chown -R fex .
 
 stunnel=$(which stunnel4)
 if [ -z "$stunnel" ]; then
 
 chown -R fex .
 
 stunnel=$(which stunnel4)
 if [ -z "$stunnel" ]; then

-  echo "no stunnel found" >&2
-else
+  echo "no stunnel4 found" >&2
+  exit
+fi

 
 

-  cat <<EOD>/etc/xinetd.d/fexs
+cat <<EOD>/etc/xinetd.d/fexs

 # default: on
 # description: fex web server with SSL
 # note: only possible on port 443!
 # default: on
 # description: fex web server with SSL
 # note: only possible on port 443!


@@ -41,7 +62,7 @@ service fexs
         type            = unlisted
         protocol        = tcp
         port            = 443
         type            = unlisted
         protocol        = tcp
         port            = 443

-        cps             = 5 10
+        cps             = 10 2

         user            = fex
         groups          = yes
         server          = $stunnel
         user            = fex
         groups          = yes
         server          = $stunnel


@@ -51,11 +72,9 @@ service fexs
 }
 EOD
 
 }
 EOD
 

-  /etc/init.d/xinetd restart
-  echo 'To enforce https, add to fex.ph:'
-  echo '$force_https = 1;'
-
-fi
+/etc/init.d/xinetd restart
+echo 'To enforce https, add to fex.ph:'
+echo '$force_https = 1;'

 
 # Hint: on some systems stunnel works not well with xinetd
 #       you can also run stunnel without xinetd, in server daemon mode
 
 # Hint: on some systems stunnel works not well with xinetd
 #       you can also run stunnel without xinetd, in server daemon mode