Andy said:
What about
Webmin (10000) and Usermin(20000)?
Thanks, I'll give them a try.
Did you do a test between 2am and now?
Gavin's post prompted me to have a look... and until this morning, the
miniserv process used by webmin was still using the old library (or at
least that's what
lsof -n | grep ssl | grep DEL
thought!)
The other things that were also doing so were fail2ban and opendkim, but
neither of those should have been visible from outside the VPS.
Ian