Hi, folks.

I've been using stunnel on our mail server (sendmail, spamassassin, clamav, mailscanner, mailwatch). I note the following being written to syslog, and wonder if stunnel is causing it:

Mar 29 14:07:31 mail1 su(pam_unix)[29493]: session closed for user nobody

Mar 29 14:08:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1723

Mar 29 14:08:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33540

Mar 29 14:08:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket

Mar 29 14:08:43 mail1 su(pam_unix)[29640]: session opened for user nobody by (uid=0)

Mar 29 14:08:43 mail1 su(pam_unix)[29640]: session closed for user nobody

Mar 29 14:09:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1724

Mar 29 14:09:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33544

Mar 29 14:09:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket

Mar 29 14:10:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1725

Mar 29 14:10:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33546

Mar 29 14:10:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket

Mar 29 14:10:11 mail1 su(pam_unix)[30025]: session opened for user nobody by (uid=0)

Mar 29 14:10:11 mail1 su(pam_unix)[30025]: session closed for user nobody

Mar 29 14:10:33 mail1 su(pam_unix)[30075]: session opened for user nobody by (uid=0)

Mar 29 14:10:33 mail1 su(pam_unix)[30075]: session closed for user nobody

Mar 29 14:11:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1726

Mar 29 14:11:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33559

Mar 29 14:11:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket

Mar 29 14:11:03 mail1 su(pam_unix)[30206]: session opened for user nobody by (uid=0)

Mar 29 14:11:03 mail1 su(pam_unix)[30206]: session closed for user nobody

Mar 29 14:11:06 mail1 su(pam_unix)[30215]: session opened for user nobody by (uid=0)

Mar 29 14:11:06 mail1 su(pam_unix)[30215]: session closed for user nobody

It's the sessions opened and closed for the user nobody that has me concerned. stunnel appears to be the only process being run by the user nobody. If, in fact, this is caused by stunnel, do I keep these (and only these) session opened/closed instances from being logged?

Thanks.

Dimitri