CentOS - Apr 2008 - stunnel

Dear all,

I had notice that my logwatch has a heap of stunneling like the one below.
Is there a security breech?

**Unmatched Entries**
 (1) LOG5[6504:3086657232]: Connection closed: 29433 bytes sent to SSL, 62
bytes sent to socket
 (1) LOG5[9516:3086649040]: stunnel 4.15 on i686-redhat-linux-gnu with
OpenSSL 0.9.8b 04 May 2006
 (1) LOG5[9516:3086649040]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6
Auth:LIBWRAP
 (1) LOG5[9516:3086649040]: Connection closed: 29433 bytes sent to SSL, 62
bytes sent to socket
 (1) LOG5[10472:3086608080]: stunnel 4.15 on i686-redhat-linux-gnu with
OpenSSL 0.9.8b 04 May 2006
 (1) LOG5[10472:3086608080]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6
Auth:LIBWRAP
 (1) LOG5[10472:3086608080]: Connection closed: 29434 bytes sent to SSL, 62
bytes sent to socket
 (1) LOG5[11422:3086517968]: stunnel 4.15 on i686-redhat-linux-gnu with
OpenSSL 0.9.8b 04 May 2006
 (1) LOG5[11422:3086517968]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6
Auth:LIBWRAP
 (1) LOG5[11422:3086517968]: Connection closed: 31916 bytes sent to SSL, 84
bytes sent to socket
 (1) LOG5[12306:3086350032]: stunnel 4.15 on i686-redhat-linux-gnu with
OpenSSL 0.9.8b 04 May 2006
 (1) LOG5[12306:3086350032]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6
Auth:LIBWRAP
 (1) LOG5[12306:3086350032]: Connection closed: 29482 bytes sent to SSL, 62
bytes sent to socket
 (1) LOG5[13201:3086767824]: stunnel 4.15 on i686-redhat-linux-gnu with
OpenSSL 0.9.8b 04 May 2006
 (1) LOG5[13201:3086767824]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6
Auth:LIBWRAP
 (1) LOG5[13201:3086767824]: Connection closed: 29482 bytes sent to SSL, 62
bytes sent to socket


Thanks
nic

On Wed, Apr 16, 2008 at 10:40 PM, CentOS List <centoslist at gmail.com>
wrote:
> Dear all,
>
>  I had notice that my logwatch has a heap of stunneling like the one below.
>  Is there a security breech?

Well, just stunnel by itself doesn't mean there's a breach, unless you
never configured anything to use stunnel. You might want to do a
little more digging on the system to confirm or disprove your
suspicions. Have a look in places like /tmp or /var/tmp for hidden
scripts or directories etc.


-- 
During times of universal deceit, telling the truth becomes a revolutionary act.
George Orwell