Securing stunnel.pem on Windows

Question

How can I prevent reading of the stunnel.pem file by any user other than the service user running Stunnel? How can I permit access to this directory (C:\Program Files\stunnel) in Windows XP to only the Stunnel service?

Answer 1

The safest way to do this is to create a user account specifically for the stunnel service, and then apply the permissions appropriately

1. Start > Run > lusrmgr.msc
2. Right-click users and choose New user...
3. Enter in the user details, and generate a strong password for the account (you'll only need it for the new few minutes, so just keep it in notepad for the time being).
4. Start > Run > services.msc
5. Right-click the stunnel service and go to properties
6. Go to the Log On tab and check the option for This Account
7. Enter the username and password from Step 3
8. Click OK and you should get a message about the account being granted "Logon as a service" right
9. Go to the security properties of C:\Program Files\stunnel\ and apply Full Control to the user from Step 3
10. Remove excess permissions from the folder (you might need to go to Advanced and un-check Include inheritable permissions from this object's parent)

Done!