Greetings.<br>I&#39;m running the stock stunnel 4.21 on Ubuntu 8.04 (version and configs listed below) as a stand-alone daemon to pass connections between ssl-enabled SMTP, POP3, and IMAP clients and their respective servers, which run on the same machine as stunnel.&nbsp; In previous instances of Stunnel (v4.15) I&#39;ve managed to successfully get the daemon to switch to a non-root user and use only a single process.&nbsp; I now find, however, that I get 6 processes and 5 continue to run as root with only one (albeit the one listening on the specified sockets) switching down to the specified user.&nbsp; Does anyone have any idea why I both can&#39;t set uid/gid and why I&#39;ve now got so many processes?<br>
# ps aux | grep stunnel<br>root&nbsp;&nbsp;&nbsp;&nbsp; 22702&nbsp; 0.0&nbsp; 0.1&nbsp;&nbsp; 3604&nbsp;&nbsp; 428 pts/1&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp; 11:24&nbsp;&nbsp; 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf<br>root&nbsp;&nbsp;&nbsp;&nbsp; 22703&nbsp; 0.0&nbsp; 0.1&nbsp;&nbsp; 3604&nbsp;&nbsp; 428 pts/1&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp; 11:24&nbsp;&nbsp; 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf<br>
root&nbsp;&nbsp;&nbsp;&nbsp; 22704&nbsp; 0.0&nbsp; 0.1&nbsp;&nbsp; 3604&nbsp;&nbsp; 428 pts/1&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp; 11:24&nbsp;&nbsp; 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf<br>root&nbsp;&nbsp;&nbsp;&nbsp; 22705&nbsp; 0.0&nbsp; 0.1&nbsp;&nbsp; 3604&nbsp;&nbsp; 428 pts/1&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp; 11:24&nbsp;&nbsp; 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf<br>
root&nbsp;&nbsp;&nbsp;&nbsp; 22706&nbsp; 0.0&nbsp; 0.1&nbsp;&nbsp; 3604&nbsp;&nbsp; 428 pts/1&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp; 11:24&nbsp;&nbsp; 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf<br>stunnel4 22707&nbsp; 0.0&nbsp; 0.2&nbsp;&nbsp; 3720&nbsp;&nbsp; 932 ?&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Ss&nbsp;&nbsp; 11:24&nbsp;&nbsp; 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf<br>
<br># lsof -i | grep stunnel<br>stunnel4&nbsp; 22707&nbsp;&nbsp; stunnel4&nbsp;&nbsp; 11u&nbsp; IPv4&nbsp; 55934&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; TCP emily:pop3s (LISTEN)<br>stunnel4&nbsp; 22707&nbsp;&nbsp; stunnel4&nbsp;&nbsp; 12u&nbsp; IPv4&nbsp; 55935&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; TCP emily:imaps (LISTEN)<br>stunnel4&nbsp; 22707&nbsp;&nbsp; stunnel4&nbsp;&nbsp; 13u&nbsp; IPv4&nbsp; 55936&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; TCP emily:ssmtp (LISTEN)<br>
<br>I&#39;m invoking stunnel simply as /usr/sbin/stunnel4 /etc/stunnel4/stunnel.conf:<br><br>cert = /etc/stunnel/stunnel.pem<br>sslVersion = SSLv3<br>chroot = /var/lib/stunnel4/<br>setuid = stunnel4<br>setgid = stunnel4<br>
pid = /stunnel4.pid<br>socket = l:TCP_NODELAY=1<br>socket = r:TCP_NODELAY=1<br>[pop3s]<br>accept&nbsp; = <a href="http://64.5.53.172:995">64.5.53.172:995</a><br>connect = <a href="http://64.5.53.172:110">64.5.53.172:110</a><br>
[imaps]<br>accept&nbsp; = <a href="http://64.5.53.172:993">64.5.53.172:993</a><br>connect = <a href="http://64.5.53.172:143">64.5.53.172:143</a><br>[ssmtp]<br>accept&nbsp; = <a href="http://64.5.53.172:465">64.5.53.172:465</a><br>connect = <a href="http://64.5.53.172:25">64.5.53.172:25</a><br>
<br>Version Info:<br>stunnel 4.21 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007<br>Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP<br><br>Global options<br>debug&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = 5<br>pid&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = /var/run/stunnel4.pid<br>
RNDbytes&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = 64<br>RNDfile&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = /dev/urandom<br>RNDoverwrite&nbsp;&nbsp;&nbsp; = yes<br><br>Service-level options<br>cert&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = /etc/stunnel/stunnel.pem<br>ciphers&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH<br>key&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = /etc/stunnel/stunnel.pem<br>
session&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = 300 seconds<br>sslVersion&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = SSLv3 for client, all for server<br>TIMEOUTbusy&nbsp;&nbsp;&nbsp;&nbsp; = 300 seconds<br>TIMEOUTclose&nbsp;&nbsp;&nbsp; = 60 seconds<br>TIMEOUTconnect&nbsp; = 10 seconds<br>TIMEOUTidle&nbsp;&nbsp;&nbsp;&nbsp; = 43200 seconds<br>verify&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = none<br>
<br>