trusty (8) sslio.8.gz

NAME

       sslio - SSL input/output for service programs

SYNOPSIS

       sslio [-cv] [-u user] [-U user] [-/ root] [-C cert] [-K key] [-A ca] prog

DESCRIPTION

       sslio  provides  SSL  encrypted  network  connections  for  service  programs  started  by  tcpsvd(8)  or
       tcpserver(1), and tcpclient(1).

       Normally sslio is started by tcpsvd(8) or tcpclient(1), in turn starts the service program prog, and runs
       as  child  process of the service program.  After performing the SSL handshake, sslio reads SSL encrypted
       data from the network, and writes decrypted data to the service program prog;  it  reads  data  from  the
       service  program  prog, and writes SSL encrypted data to the network.  sslio should run under a different
       user ID than the service program, and with a changed root directory.  When started by root, the -u option
       must be given, and the -U and -/ options should be given.

       The sslio program uses the SSLv3 implementation of the matrixssl library.

OPTIONS

       prog   prog  consists  of  one or more arguments, specifying the service program normally run directly by
              tcpsvd(8), or tcpserver(1).

       -u [:]user[:group]
              drop permissions.  Set uid and gid to the user's uid and gid,  as  found  in  /etc/passwd,  before
              reading  data  from,  or writing data to the network.  If user is followed by a colon and a group,
              set the gid to group's gid, as found in /etc/group, instead of user's gid.  If group consists of a
              colon-separated  list of group names, set the group ids of all listed groups.  If user is prefixed
              with a colon, the user and all group arguments are interpreted as uid and gids  respectively,  and
              not  looked  up in the password or group file.  All supplementary groups are removed.  This option
              must be set when sslio is started by root, and cannot be set otherwise.

       -U [:]user[:group]
              drop permissions.  Set uid and gid to the user's uid and gid,  as  found  in  /etc/passwd,  before
              running prog.  If user is followed by a colon and a group, set the gid to group's gid, as found in
              /etc/group, instead of user's gid.  If group consists of a colon-separated list  of  group  names,
              set  the group ids of all listed groups.  If user is prefixed with a colon, the user and all group
              arguments are interpreted as uid and gids respectively, and not looked up in the password or group
              file.   All  supplementary groups are removed.  This option should be set when sslio is started by
              root, and cannot be set otherwise.

       -/ root
              chroot.  Change the root directory to root before reading  data  from,  or  writing  data  to  the
              network.  This option should be set when sslio is started by root, and cannot be set otherwise.

       -C cert
              cert file (server mode).  Read the certificate from the file cert (default is ``./cert.pem'').  If
              the -/ option is given, first the root directory is changed, then the cert file is read.

       -K key private key (server mode).  Read the private key from the file key (default is cert).  If  the  -/
              option is given, first the root directory is changed, then the private key is read.

       -A ca  ca file (client mode).  Read the trusted root certificate from the file ca.  Multiple files can be
              specified, using a semicolon as delimiter.  If the -/ option is given, first the root directory is
              changed, then the ca file is read.

       -c     client  mode.   This  option must be given when running sslio under tcpclient(1).  In client mode,
              filedescriptors 6 and 7 are used instead of standard input and standard ouput  to  read  from  and
              write to the network and the service program.  If the -A option is given, sslio refuses to connect
              to a servers which's certificates cannot be verified by the  root  certificates,  it  accepts  any
              server certificate otherwise.

       -v     verbose.  Print verbose messages to standard error.

       -vv    more verbose.  Print more verbose messages to standard error.

       -vvv   even more verbose.  Print even more verbose messages to standard error.

ENVIRONMENT

       SSLIO_BUFIN
              The environment variable SSLIO_BUFIN overrides the default input buffer size for sslio (8192).

       SSLIO_BUFOU
              The  environment  variable SSLIO_BUFOU overrides the default output buffer size for sslio (12288).
              If the output buffer is too small to hold encrypted or decrypted data, sslio  automatically  blows
              up the buffer to SSLIO_BUFOU more bytes.

       SSLIO_BAD_CERTIFICATE
              (client  mode)   If the environment variable SSLIO_BAD_CERTIFICATE is set, sslio -c accepts server
              ceritificates it would normally reject with
               fatal: ssl decode error: bad certificate

       SSLIO_HANDSHAKE_TIMOUT
              The environment variable SSLIO_HANDSHAKE_TIMEOUT overrides the default  number  of  seconds  sslio
              will  try to complete the ssl handshake (300).  If the handshake isn't completed after this number
              of seconds, sslio exits.

SEE ALSO

       sslsvd(8), tcpsvd(8), udpsvd(8), ipsvd(7), ipsvd-instruct(5), ipsvd-cdb(8)

       http://smarden.org/ipsvd/

AUTHOR

       Gerrit Pape <pape@smarden.org>

                                                                                                        sslio(8)