sslio
provides SSL encrypted network connections for service programs started by
tcpsvd(8)
or
tcpserver(1),
and
tcpclient(1).
Normally
sslio
is started by
tcpsvd(8)
or
tcpclient(1),
in turn starts the service program
prog,
and runs as child process of the service program.
After performing the SSL handshake,
sslio
reads SSL encrypted data from the network, and writes decrypted data to the
service program
prog;
it reads data from the service program
prog,
and writes SSL encrypted data to the network.
sslio
should run under a different user ID than the service program, and with a
changed root directory.
When started by root, the -u option must be given, and the -U and -/
options should be given.
The
sslio
program uses the SSLv3 implementation of the matrixssl library.
OPTIONS
prog
prog
consists of one or more arguments, specifying the service program normally
run directly by
tcpsvd(8),
or
tcpserver(1).
-u [:]user[:group]
drop permissions.
Set uid and gid to the
user's
uid and gid, as found in
/etc/passwd,
before reading data from, or writing data to the network.
If
user
is followed by a colon and a
group,
set the gid to
group's
gid, as found in
/etc/group,
instead of
user's
gid.
If
group
consists of a colon-separated list of group names,
set the group ids of all listed groups.
If
user
is prefixed with a colon, the
user
and all
group
arguments are interpreted as uid and gids respectively, and not looked up in
the password or group file.
All supplementary groups are removed.
This option must be set when
sslio
is started by root, and cannot be set otherwise.
-U [:]user[:group]
drop permissions.
Set uid and gid to the
user's
uid and gid, as found in
/etc/passwd,
before running
prog.
If
user
is followed by a colon and a
group,
set the gid to
group's
gid, as found in
/etc/group,
instead of
user's
gid.
If
group
consists of a colon-separated list of group names,
set the group ids of all listed groups.
If
user
is prefixed with a colon, the
user
and all
group
arguments are interpreted as uid and gids respectively, and not looked up in
the password or group file.
All supplementary groups are removed.
This option should be set when
sslio
is started by root, and cannot be set otherwise.
-/ root
chroot.
Change the root directory to
root
before reading data from, or writing data to the network.
This option should be set when
sslio
is started by root, and cannot be set otherwise.
-C cert
cert file (server mode).
Read the certificate from the file
cert
(default is ``./cert.pem'').
If the -/ option is given, first the root directory is changed, then the
cert file is read.
-K key
private key (server mode).
Read the private key from the file
key
(default is
cert).
If the -/ option is given, first the root directory is changed, then the
private key is read.
-A ca
ca file (client mode).
Read the trusted root certificate from the file
ca.
Multiple files can be specified, using a semicolon as delimiter.
If the -/ option is given, first the root directory is changed, then the
ca file is read.
-c
client mode.
This option must be given when running
sslio
under
tcpclient(1).
In client mode, filedescriptors 6 and 7 are used instead of standard input
and standard ouput to read from and write to the network and the service
program.
If the -A option is given,
sslio
refuses to connect to a servers which's certificates cannot be verified by
the root certificates, it accepts any server certificate otherwise.
-v
verbose.
Print verbose messages to standard error.
-vv
more verbose.
Print more verbose messages to standard error.
-vvv
even more verbose.
Print even more verbose messages to standard error.
ENVIRONMENT
SSLIO_BUFIN
The environment variable
SSLIO_BUFIN
overrides the default input buffer size for
sslio
(8192).
SSLIO_BUFOU
The environment variable
SSLIO_BUFOU
overrides the default output buffer size for
sslio
(12288).
If the output buffer is too small to hold encrypted or decrypted data,
sslio
automatically blows up the buffer to
SSLIO_BUFOU
more bytes.
SSLIO_BAD_CERTIFICATE
(client mode) If the environment variable
SSLIO_BAD_CERTIFICATE
is set,
sslio -c
accepts server ceritificates it would normally reject with
fatal: ssl decode error: bad certificate
SSLIO_HANDSHAKE_TIMOUT
The environment variable
SSLIO_HANDSHAKE_TIMEOUT
overrides the default number of seconds
sslio
will try to complete the ssl handshake (300).
If the handshake isn't completed after this number of seconds,
sslio
exits.