/usr/share/doc/fex/SSL is in fex 20160919-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 | # http://www.stunnel.org/faq/certs.html
# execute this as root!
# Redhat+CentOS : stunnel does not work! you need to install stunnel-4
#
# Debian+Ubuntu : stunnel-5 does not work! you need to install stunnel-4
#
# apt-get install gcc make libssl-dev
# yum install gcc make openssl-devel
# cd /tmp
# wget ftp://ftp.nluug.nl/pub/networking/stunnel/archive/4.x/stunnel-4.57.tar.gz
# tar xvzf stunnel-4.57.tar.gz
# cd stunnel-4.57
# ./configure --prefix /opt/stunnel-4.57
# make
# make install
# ln -s /opt/stunnel-4.57/bin/stunnel /usr/local/bin/stunnel4
mkdir /home/fex/etc
cd /home/fex/etc/
# create self-signed certificate
# see http://www.infodrom.org/Debian/tips/stunnel.html
openssl req -new -x509 -days 9999 -nodes -out stunnel.pem -keyout stunnel.pem
dd if=/dev/urandom count=2 | openssl dhparam -rand - 1024 >> stunnel.pem
openssl x509 -text -in stunnel.pem
chmod 600 stunnel.pem
cat <<EOD>stunnel.conf
debug = warning
output = /home/fex/spool/stunnel.log
cert = /home/fex/etc/stunnel.pem
sslVersion = all
fips = no
TIMEOUTclose = 1
exec = /home/fex/bin/fexsrv
execargs = fexsrv stunnel
EOD
## https://www.stunnel.org/pipermail/stunnel-users/2013-October/004414.html
#case $(lsb_release -a 2>/dev/null) in
# *CentOS*) echo 'fips = no' >>stunnel.conf;;
#esac
chown -R fex .
stunnel=$(which stunnel4)
if [ -z "$stunnel" ]; then
echo "no stunnel4 found" >&2
exit
fi
cat <<EOD>/etc/xinetd.d/fexs
# default: on
# description: fex web server with SSL
# note: only possible on port 443!
service fexs
{
socket_type = stream
wait = no
type = unlisted
protocol = tcp
port = 443
cps = 10 2
user = fex
groups = yes
server = $stunnel
server_args = /home/fex/etc/stunnel.conf
nice = 0
disable = no
}
EOD
/etc/init.d/xinetd restart
echo 'To enforce https, add to fex.ph:'
echo '$force_https = 1;'
# Hint: on some systems stunnel works not well with xinetd
# you can also run stunnel without xinetd, in server daemon mode
|