NAME

       tlswrapper-tcp - TLS encryption wrapper - tcp client

SYNOPSIS

       tlswrapper-tcp [ options ] host port

DESCRIPTION

       The  tlswrapper-tcp  is  TCP client which connects to host:port and transfers data from standard input to
       the host and from the host to the standard output.  it's designed to work to together with tlswrapper and
       is from the tlswrapper executed.  Allows you to protect  non-TLS  TCP  service  using  TLS  similarly  to
       stunnel(8).     Systemd.socket/inetd/tcpserver/...    creates    the    server    connection,   tlswraper
       encrypts/decrypts data stream  and  tlswrapper-tcp  creates  the  client  connection  and  sends/receives
       unencrypted data to/from the host:port as follows:

       Internet <--> systemd.socket/inetd/tcpserver/... <--> tlswrapper <--> tlswrapper-tcp <-> host:port

OPTIONS

       -q     Quiet mode. No error messages.

       -v     Enable verbose mode. Multiple -v options increase the verbosity. The maximum is 3.

       -t seconds
              Set the network timeout to seconds seconds. (default 3600).

       -T seconds
              Set the connect timeout to seconds seconds. (default 10).

       -p version
              Enable incoming proxy-protocol version version string.

       -P version
              Enable outgoing proxy-protocol version version string.

       -J jaildir
              Chroot network-process into a specified jaildir (default: /var/lib/tlswraper/empty).

       -j jailuser
              Run network-process and dnsresolver-process under a specified jailuser's uid and gid. If unset run
              network-process and dnsresolver-process under random uid and gid.

       host   host or IP

       port   TCP port

SECURITY

       Separate process for network connection and separate process for DNS resolving

       To  protect  against  secret-information leaks to the network connection (such Heartbleed) tlswrapper-tcp
       runs two independent processes.  One process resolves the hostname and second  creates  a  connection  to
       host:port.

       JAIL - Privilege separation, filesystem isolation, limits

       The  tlswrapper-tcp similarly to tlswrapper processes runs under dedicated non-zero uid to prohibit kill,
       ptrace, etc.  Is chrooted into an empty,  unwritable  directory  to  prohibit  filesystem  access.   Sets
       ulimits to prohibit new files, sockets, etc. Sets ulimits to prohibit forks.

EXAMPLES

       Run  tlswrapper using tcpserver/busybox/inetd on port 443 and connect to non-TLS service ip 127.0.0.1 and
       port 80
           tcpserver -HRDl0 0 443 tlswrapper [ options ] tlswrapper-tcp 127.0.0.1 80
           busybox tcpsvd 0 443 tlswrapper [ options ] tlswrapper-tcp 127.0.0.1 80
           inetd.conf line: https stream tcp nowait root /usr/bin/tlswrapper tlswrapper [ options ] /usr/bin/tlswrapper-tcp 127.0.0.1 80

SEE ALSO

       tlswrapper(1)

                                                                                               tlswrapper-tcp(1)