Ubuntu Manpage: sslio - SSL input/output for service programs

NAME

       sslio - SSL input/output for service programs

SYNOPSIS

       sslio [-cv] [-u user] [-U user] [-/ root] [-C cert] [-K key] [-A ca] prog

DESCRIPTION

       sslio provides SSL encrypted network connections for service programs started by tcpsvd(8)
       or tcpserver(1), and tcpclient(1).

       Normally sslio is started by tcpsvd(8) or tcpclient(1), in turn starts the service program
       prog,  and  runs  as  child  process  of  the  service  program.  After performing the SSL
       handshake, sslio reads SSL encrypted data from the network, and writes decrypted  data  to
       the  service  program  prog;  it  reads data from the service program prog, and writes SSL
       encrypted data to the network.  sslio should run  under  a  different  user  ID  than  the
       service  program,  and with a changed root directory.  When started by root, the -u option
       must be given, and the -U and -/ options should be given.

       The sslio program uses the SSLv3 implementation of the matrixssl library.

OPTIONS

prog prog consists of one or more arguments, specifying the service program normally run
directly by tcpsvd(8), or tcpserver(1).

-u [:]user[:group]
drop permissions. Set uid and gid to the user's uid and gid, as found in
/etc/passwd, before reading data from, or writing data to the network. If user is
followed by a colon and a group, set the gid to group's gid, as found in
/etc/group, instead of user's gid. If group consists of a colon-separated list of
group names, set the group ids of all listed groups. If user is prefixed with a
colon, the user and all group arguments are interpreted as uid and gids
respectively, and not looked up in the password or group file. All supplementary
groups are removed. This option must be set when sslio is started by root, and
cannot be set otherwise.

-U [:]user[:group]
drop permissions. Set uid and gid to the user's uid and gid, as found in
/etc/passwd, before running prog. If user is followed by a colon and a group, set
the gid to group's gid, as found in /etc/group, instead of user's gid. If group
consists of a colon-separated list of group names, set the group ids of all listed
groups. If user is prefixed with a colon, the user and all group arguments are
interpreted as uid and gids respectively, and not looked up in the password or
group file. All supplementary groups are removed. This option should be set when
sslio is started by root, and cannot be set otherwise.

-/ root
chroot. Change the root directory to root before reading data from, or writing
data to the network. This option should be set when sslio is started by root, and
cannot be set otherwise.

-C cert
cert file (server mode). Read the certificate from the file cert (default is
``./cert.pem''). If the -/ option is given, first the root directory is changed,
then the cert file is read.

-K key private key (server mode). Read the private key from the file key (default is
cert). If the -/ option is given, first the root directory is changed, then the
private key is read.

-A ca ca file (client mode). Read the trusted root certificate from the file ca.
Multiple files can be specified, using a semicolon as delimiter. If the -/ option
is given, first the root directory is changed, then the ca file is read.

-c client mode. This option must be given when running sslio under tcpclient(1). In
client mode, filedescriptors 6 and 7 are used instead of standard input and
standard ouput to read from and write to the network and the service program. If
the -A option is given, sslio refuses to connect to a servers which's certificates
cannot be verified by the root certificates, it accepts any server certificate
otherwise.

-v verbose. Print verbose messages to standard error.

-vv more verbose. Print more verbose messages to standard error.

-vvv even more verbose. Print even more verbose messages to standard error.

ENVIRONMENT

       SSLIO_BUFIN
              The  environment  variable  SSLIO_BUFIN overrides the default input buffer size for
              sslio (8192).

       SSLIO_BUFOU
              The environment variable SSLIO_BUFOU overrides the default output buffer  size  for
              sslio  (12288).   If  the output buffer is too small to hold encrypted or decrypted
              data, sslio automatically blows up the buffer to SSLIO_BUFOU more bytes.

       SSLIO_BAD_CERTIFICATE
              (client mode)  If the environment variable SSLIO_BAD_CERTIFICATE is set,  sslio  -c
              accepts server ceritificates it would normally reject with
               fatal: ssl decode error: bad certificate

       SSLIO_HANDSHAKE_TIMOUT
              The  environment  variable  SSLIO_HANDSHAKE_TIMEOUT overrides the default number of
              seconds sslio will try to complete the ssl handshake (300).  If the handshake isn't
              completed after this number of seconds, sslio exits.

AUTHOR