Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #257506 > unrolled thread

Starting stunnel with systemd.

Back to article view | Back to linux.debian.user

Contents

  Starting stunnel with systemd. peter@easthope.ca - 2023-04-23 19:00 +0200
    Re: Starting stunnel with systemd. Darac Marjal <mailinglist@darac.org.uk> - 2023-04-23 20:30 +0200
      Re: Starting stunnel with systemd. Virgo Pärna <virgo.parna@mail.ee> - 2023-04-27 10:20 +0200
    Re: Starting stunnel with systemd. Jeffrey Walton <noloader@gmail.com> - 2023-04-24 04:10 +0200
    Re: Starting stunnel with systemd. john doe <johndoe65534@mail.com> - 2023-04-24 09:10 +0200
      Re: Starting stunnel with systemd. <tomas@tuxteam.de> - 2023-04-24 09:50 +0200
        Re: Starting stunnel with systemd. Greg Wooledge <greg@wooledge.org> - 2023-04-24 13:50 +0200

#257506 — Starting stunnel with systemd.

Hi,

After starting interactively, stunnel works.

To automate, this service file was created.

$ cat /etc/systemd/system/stunnel.service
[Unit]
Description=StunnelStarter
Documentation=man:stunnel(8)
After=network.target auditd.service

[Service]
ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf foreground=yes
Restart=no
Type=simple

[Install]
WantedBy=multi-user.target
Alias=stunnel.service

After booting, no stunnel.

$ ps aux | grep stunnel
root        1463  0.0  0.0   6244   700 pts/0    S+   09:31   0:00 grep 
stunnel

$ systemctl status stunnel
* stunnel.service - StunnelStarter
      Loaded: loaded (/etc/systemd/system/stunnel.service; enabled; 
vendor preset: enabled)
      Active: inactive (dead) since Sun 2023-04-23 08:52:52 PDT; 7min ago
        Docs: man:stunnel(8)
     Process: 572 ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf 
foreground=yes (code=exited, status=0/SUCCESS)
    Main PID: 572 (code=exited, status=0/SUCCESS)
         CPU: 13ms

Apr 23 08:52:52 imager stunnel[572]: LOG5[ui]: Threading:PTHREAD 
Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP
Apr 23 08:52:52 imager stunnel[572]: LOG5[ui]: Reading configuration 
from file /etc/stunnel/stunnel.conf
Apr 23 08:52:52 imager stunnel[572]: LOG5[ui]: UTF-8 byte order mark not 
detected
Apr 23 08:52:52 imager stunnel[572]: LOG5[ui]: FIPS mode disabledApr 23 
08:52:52 imager stunnel[572]: LOG4[ui]: Service [pop3] needs 
authenticati
on to prevent MITM attacks
Apr 23 08:52:52 imager stunnel[572]: LOG5[ui]: Configuration successful
Apr 23 08:52:52 imager stunnel[584]: LOG5[main]: Terminated
Apr 23 08:52:52 imager stunnel[584]: LOG5[main]: Terminating 1 service 
thread(s)
Apr 23 08:52:52 imager stunnel[584]: LOG5[main]: Service threads 
terminated
Apr 23 08:52:52 imager systemd[1]: stunnel.service: Succeeded.

Terminated.  Why?

Thanks,               ... P.

[toc] | [next] | [standalone]

#257508

[Multipart message — attachments visible in raw view] — view raw

1. stunnel hasn't been in Debian since etch (Debian 4.0).

2. stunnel4 comes with a service file template 
(https://sources.debian.org/src/stunnel4/3%3A5.68-2/debian/stunnel4%40.stunnel.service/), 
which is likely to have been tested to work.

3. Could the warning about protecting your POP3 connection be the cause?


On 23/04/2023 17:41, peter@easthope.ca wrote:
> Hi,
>
> After starting interactively, stunnel works.
>
> To automate, this service file was created.
>
> $ cat /etc/systemd/system/stunnel.service
> [Unit]
> Description=StunnelStarter
> Documentation=man:stunnel(8)
> After=network.target auditd.service
>
> [Service]
> ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf foreground=yes
> Restart=no
> Type=simple
>
> [Install]
> WantedBy=multi-user.target
> Alias=stunnel.service
>
> After booting, no stunnel.
>
> $ ps aux | grep stunnel
> root        1463  0.0  0.0   6244   700 pts/0    S+   09:31   0:00 
> grep stunnel
>
> $ systemctl status stunnel
> * stunnel.service - StunnelStarter
>      Loaded: loaded (/etc/systemd/system/stunnel.service; enabled; 
> vendor preset: enabled)
>      Active: inactive (dead) since Sun 2023-04-23 08:52:52 PDT; 7min ago
>        Docs: man:stunnel(8)
>     Process: 572 ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf 
> foreground=yes (code=exited, status=0/SUCCESS)
>    Main PID: 572 (code=exited, status=0/SUCCESS)
>         CPU: 13ms
>
> Apr 23 08:52:52 imager stunnel[572]: LOG5[ui]: Threading:PTHREAD 
> Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP
> Apr 23 08:52:52 imager stunnel[572]: LOG5[ui]: Reading configuration 
> from file /etc/stunnel/stunnel.conf
> Apr 23 08:52:52 imager stunnel[572]: LOG5[ui]: UTF-8 byte order mark 
> not detected
> Apr 23 08:52:52 imager stunnel[572]: LOG5[ui]: FIPS mode disabledApr 
> 23 08:52:52 imager stunnel[572]: LOG4[ui]: Service [pop3] needs 
> authenticati
> on to prevent MITM attacks
> Apr 23 08:52:52 imager stunnel[572]: LOG5[ui]: Configuration successful
> Apr 23 08:52:52 imager stunnel[584]: LOG5[main]: Terminated
> Apr 23 08:52:52 imager stunnel[584]: LOG5[main]: Terminating 1 service 
> thread(s)
> Apr 23 08:52:52 imager stunnel[584]: LOG5[main]: Service threads 
> terminated
> Apr 23 08:52:52 imager systemd[1]: stunnel.service: Succeeded.
>
> Terminated.  Why?
>
> Thanks,               ... P.
>

[toc] | [prev] | [next] | [standalone]

#257658

On Sun, 23 Apr 2023 19:09:16 +0100, Darac Marjal <mailinglist@darac.org.uk> wrote:
> 1. stunnel hasn't been in Debian since etch (Debian 4.0).
> 
> 2. stunnel4 comes with a service file template 
> (https://sources.debian.org/src/stunnel4/3%3A5.68-2/debian/stunnel4%40.stunnel.service/), 
> which is likely to have been tested to work.

	It seems, that at least in in bullseye installed stunnel4 uses
init.d script even with stunnel. 
Loaded: loaded (/etc/init.d/stunnel4; generated)

	And it works just fine. /etc/default/stunnel4 configures what
configuration files are used (default is /etc/stunnel/*.conf). 
	So there seems to be no need to create my own custom service,
when using services configured in /et/stunnel/. 

-- 
Virgo Pärna 
virgo.parna@mail.ee

[toc] | [prev] | [next] | [standalone]

#257522

On Sun, Apr 23, 2023 at 12:57 PM <peter@easthope.ca> wrote:
>
> After starting interactively, stunnel works.
>
> To automate, this service file was created.
>
> $ cat /etc/systemd/system/stunnel.service
> [Unit]
> Description=StunnelStarter
> Documentation=man:stunnel(8)
> After=network.target auditd.service
>
> [Service]
> ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf foreground=yes
> Restart=no
> Type=simple
>
> [Install]
> WantedBy=multi-user.target
> Alias=stunnel.service
>
> After booting, no stunnel.

Two items come to mind. First, how quickly did you restart the
service? Is the the socket in use because it is lingering?

Second, what does the stunnel.conf look like?

The man page says REUSEADDR=no is the default
(https://manpages.ubuntu.com/manpages/trusty/man8/stunnel4.8.html):

    socket = a:SO_REUSEADDR=no (enabled by default)

Jeff

[toc] | [prev] | [next] | [standalone]

#257524

On 4/23/23 18:41, peter@easthope.ca wrote:
> Hi,
>
> After starting interactively, stunnel works.
>
> To automate, this service file was created.
>
> $ cat /etc/systemd/system/stunnel.service
> [Unit]
> Description=StunnelStarter
> Documentation=man:stunnel(8)
> After=network.target auditd.service
>
> [Service]
> ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf foreground=yes

I'm not sure about the forground option if you want a daemon in the
background! :)

--
John Doe

[toc] | [prev] | [next] | [standalone]

#257525

[Multipart message — attachments visible in raw view] — view raw

On Mon, Apr 24, 2023 at 08:45:16AM +0200, john doe wrote:
> On 4/23/23 18:41, peter@easthope.ca wrote:
> > Hi,
> > 
> > After starting interactively, stunnel works.
> > 
> > To automate, this service file was created.
> > 
> > $ cat /etc/systemd/system/stunnel.service
> > [Unit]
> > Description=StunnelStarter
> > Documentation=man:stunnel(8)
> > After=network.target auditd.service
> > 
> > [Service]
> > ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf foreground=yes
> 
> I'm not sure about the forground option if you want a daemon in the
> background! :)

Under systemd, foreground is the new background!

(No, seriously: AFAIU that's how it's supposed to be done with
systemd, because that's how it does its process monitoring and
log munging. Do take this with some fists of salt, as my systemd
knowledge is purely theoretical. Ask an expert)

Cheers
-- 
t

[toc] | [prev] | [next] | [standalone]

#257528

On Mon, Apr 24, 2023 at 09:29:46AM +0200, tomas@tuxteam.de wrote:
> On Mon, Apr 24, 2023 at 08:45:16AM +0200, john doe wrote:
> > On 4/23/23 18:41, peter@easthope.ca wrote:
> > > $ cat /etc/systemd/system/stunnel.service
> > > [Unit]
> > > Description=StunnelStarter
> > > Documentation=man:stunnel(8)
> > > After=network.target auditd.service
> > > 
> > > [Service]
> > > ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf foreground=yes
> > 
> > I'm not sure about the forground option if you want a daemon in the
> > background! :)
> 
> Under systemd, foreground is the new background!
> 
> (No, seriously: AFAIU that's how it's supposed to be done with
> systemd, because that's how it does its process monitoring and
> log munging. Do take this with some fists of salt, as my systemd
> knowledge is purely theoretical. Ask an expert)

You're correct.  Whenever possible, the goal is to ExecStart a single
foreground process which is your service.  If you can do that, then
you have a "simple" service type.  If you cannot, then you probably have
a "forking" service type, and systemd has to track a whole bunch of
processes instead of just one.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web