☰

stunnel 无法找到日志文件

tag-icon • tag-icon stunnel
stunnel 无法找到日志文件

我已经在 3.11.6 上使用 NGINX、Node.js 和 stunnel 构建了一个 alpine linux docker 容器，当我通过调用正在stunnel运行的容器内部来加载 stunnel 时，我发现它找不到日志文件/var/log/stunnel/stunnel.log，但该文件确实存在于容器中并且可写/可读。

$ bash-5.0# stunnel
[ ] Clients allowed=500
[.] stunnel 5.56 on x86_64-alpine-linux-musl platform
[.] Compiled with OpenSSL 1.1.1d  10 Sep 2019
[.] Running  with OpenSSL 1.1.1g  21 Apr 2020
[.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI
[ ] errno: (*__errno_location())
[.] Reading configuration from file /etc/stunnel/stunnel.conf
[.] UTF-8 byte order mark not detected
[ ] No PRNG seeding was required
[ ] Initializing service [fb-live]
[ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK
[ ] TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
[ ] TLS options: 0x02100004 (+0x00000000, -0x00000000)
[ ] Loading certificate from file: /certs/cert.pem
[ ] Certificate loaded from file: /certs/cert.pem
[ ] Loading private key from file: /certs/key.pem
[ ] Private key loaded from file: /certs/key.pem
[ ] Private key check succeeded
[:] Service [fb-live] needs authentication to prevent MITM attacks
[.] Configuration successful
[ ] Binding service [fb-live]
[ ] Listening file descriptor created (FD=9)
[ ] Setting accept socket options (FD=9)
[ ] Option SO_REUSEADDR set on accept socket
[ ] Service [fb-live] (FD=9) bound to 0.0.0.0:1936
[!] Cannot open log file: /var/log/stunnel/stunnel.log
[ ] Deallocating section defaults
[ ] Unbinding service [fb-live]
[ ] Service [fb-live] closed (FD=9)
[ ] Service [fb-live] closed
[ ] Deallocating section [fb-live]

$ bash-5.0# find . -name *stunnel*
./usr/lib/stunnel
./usr/lib/stunnel/libstunnel.so
./usr/bin/stunnel3
./usr/bin/stunnel
./var/log/stunnel
./var/log/stunnel/stunnel.log
./var/lib/stunnel
./etc/stunnel
./etc/stunnel/stunnel.conf
./etc/default/stunnel
./run/stunnel

$ bash-5.0# ls /var/log/stunnel/stunnel.log -lash
     0 -rw-rw----    1 root     root           0 Oct  9 17:25 /var/log/stunnel/stunnel.log
bash-5.0#

我尝试将文件路径移动到 bin 内的不同目录中，/var/run/stunnel但看不到任何允许它打开它的内容。我相信这就是 stunnel 无法正确加载的原因。

$ grep setuid /etc/stunnel/stunnel.conf
setuid = stunnel

答案1

感谢@kubanczyk 的帮助。用户stunnel无权读取/写入文件。我最终运行

$ chown -R stunnel:stunnel var/log/stunnel/stunnel.log
$ chown -R stunnel:stunnel var/run/stunnel/

这使得 stunnel 可以访问文件并正确启动。

相关内容