---
name: "pluto"
section: "8"
platform: "linux"
package: "libreswan"
version: "5.2-2.2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/ipsec-pluto"
---

# pluto(8)

Internet Key Exchange daemon

Part of [ipsec-pluto(8)](/ipsec-pluto/8.md).

## NAME

ipsec-pluto, pluto - Internet Key Exchange daemon

## SYNOPSIS

**ipsec pluto** \[--help\] \[--version\]\
 \[--nofork\] \[--rundir *path*\] \[--leak-detective\] \[--efence-protect\]\
 \[--stderrlog\] \[--logfile *filename*\] \[--log-no-time\] \[--log-no-append\] \[--log-no-ip\] \[--log-no-audit\]\
 \[--config *filename*\] \[--secretsfile *secrets-file*\] \[--ipsecdir *dirname*\] \[--nssdir *dirname*\] \[--coredir *dirname*\]\
 \[--vendorid *VID*\] \[--uniqueids\] \[--virtual-private *network\_list*\] \[--keep-alive *delay\_sec*\] \[--force-busy\] \[--crl-strict\] \[--crlcheckinterval\] \[--listen *ipaddr*\] \[--nhelpers *number*\] \[--seedbits *numbits*\] \[--statsbin *filename*\] \[--secctx-attr-type *number*\]\
 \[--use-xfrm\] \[--use-bsdkame\]

## DESCRIPTION

**pluto** is Libreswan's Internet Key Exchange (IKE) daemon.

**pluto** is not normally run directly. Instead the daemon is controlled the hosts [**init**(8)](/init/8.md) system (such as [**systemd**(1)](/systemd/1.md) or [**rc**(8)](/rc/8.md)) or the command **ipsec** (see [**ipsec**(8)](/ipsec/8.md)).

For more general information on Libreswan see [**libreswan**(7)](/libreswan/7.md).

For information on how to configure Libreswan and the **pluto** daemon see [**ipsec.conf**(5)](/ipsec.conf/5.md).

### Help Options

- **--help**

  show **pluto's** usage message

- **--version**

  show Libreswan's version details

### Starting pluto

When starting, **pluto** attempts to create a lockfile with the name /run/pluto/pluto.pid. If the lockfile cannot be created, **pluto** exits - this prevents multiple **pluto**s from competing. Any "leftover" lockfile must be manually removed before **pluto** will run. **pluto** then writes its *PID* into this file so that scripts can find it. **pluto** then forks and the parent exits (this is the conventional "daemon fork").

The following options alter how **pluto** starts:

- **--nofork**

  disable "daemon fork"

  In addition, after the lock file and control socket are created, print the line "Pluto initialized" to standard out.

- **--rundir** *path*

  change the run directory from the default /run/pluto)

  The run directory contains:

  *path*/pluto.ctl

  the socket through which **whack** communicates with **pluto**

  *path*/pluto.pid

  the lockfile to prevent multiple **pluto** instances

- **--leak-detective**

  enable leak detective

- **--efence-protect**

  enable efence protection

### Logging

All logging, including diagnostics, are sent to [**syslog**(3)](/syslog/3.md) with facility=authpriv; it decides where to put these messages. The following options alter this behaviour:

- **--stderrlog**

  direct logging to standard error instead of a log file

  Often combined with **--nofork** debugging **pluto**.

- **--logfile** *filename*

  direct logging to *filename* instead of [**syslog**(3)](/syslog/3.md)

  See [**ipsec.conf**(5)](/ipsec.conf/5.md) and logfile=*filename*.

- **--log-no-time**

  do not include a timestamp prefix when logging to a file

  See [**ipsec.conf**(5)](/ipsec.conf/5.md) and logtime=no.

- **--log-no-append**

  do not append to the end of an existing log file

  See [**ipsec.conf**(5)](/ipsec.conf/5.md) and logappend=no.

- **--log-no-ip**

  do not include IP addresses when logging

  See [**ipsec.conf**(5)](/ipsec.conf/5.md) and logip=no.

- **--log-no-audit**

  do not generate audit logs (on systems that support Linux Auditing)

  See [**ipsec.conf**(5)](/ipsec.conf/5.md) and audit-log=no.

### Configuration Files

The following options overide **pluto's** default configuration parameters:

- **--config** *filename*

  specify a [**ipsec.conf**(5)](/ipsec.conf/5.md) file containing additional configuration parameters

  The "config" section of *filename* will be loaded.

  Normally, **pluto** is started using **ipsec start**, and that passes the parameter **--config /etc/ipsec.conf** so that the default configuration is read.

- **--secretsfile** *secrets-file*

  specify the file for authentication secrets

  This name is subject to "globbing" as in [**sh**(1)](/sh/1.md), so every file with a matching name is processed. Quoting is generally needed to prevent the shell from doing the globbing.

  Default is /etc/ipsec.secrets. See [**ipsec.secrets**(5)](/ipsec.secrets/5.md).

- **--ipsecdir** *dirname*

  the directory containing additional configuration files

  Default is /etc/ipsec.d.

- **--nssdir** *dirname*

  the directory containing the NSS trust store

  Default is /var/lib/ipsec/nss.

- **--coredir** *dirname*

  the directory to write a core file should **pluto** abort

  Default is /run/pluto.

### Other Options

The following options tweak **pluto's** behaviour:

- **--vendorid** *VID*

  - **--uniqueids**

  require all connections to have a unique identifier

  If this option has been selected, whenever a new ISAKMP SA is established, any connection with the same Peer ID but a different Peer IP address is unoriented (causing all its SAs to be deleted). This helps clean up dangling SAs when a connection is lost and then regained at another IP address.

- **--virtual-private** *network\_list*

  Pluto supports RFC 3947 NAT-Traversal. The allowed range behind the NAT routers is submitted using the **--virtual-private** option.

  See [**ipsec.conf**(5)](/ipsec.conf/5.md) for the syntax

- **--keep-alive** *delay\_sec*

  The **--keep-alive** sets the delay (in seconds) of these keep-alive packets. The newer NAT-T standards support *port floating*, and Libreswan enables this per default.

- **--force-busy**

  If this option has been selected, pluto will be forced to be "busy". In this state, which happens when there is a Denial of Service attack, will force pluto to use cookies before accepting new incoming IKE packets. Cookies are send and required in ikev1 Aggressive Mode and in ikev2. This option is mostly used for testing purposes, but can be selected by paranoid administrators as well.

- **--crl-strict**

  reject authentication using X.509 until a valid certificate revocation list has been loaded

- **--crlcheckinterval**

  - **--listen** *ipaddr*

  - **--nhelpers** *number*

  specify the number of threads to use when offloading cryptographic operations

  Pluto can also use helper children to off-load cryptographic operations. This behavior can be fine tuned using the **--nhelpers**. Pluto will start *(n-1)* of them, where *n* is the number of CPU's you have (including hypherthreaded CPU's). A value of *0* forces pluto to do all operations in the main process. A value of *-1* tells pluto to perform the above calculation. Any other value forces the number to that amount.

  See [**ipsec.conf**(5)](/ipsec.conf/5.md) and nhelpers=*number*.

- **--seedbits** *numbits*

  specify the number of seed bits to read from the RNG before starting

  Pluto uses the NSS crypto library as its random source. Some government Three Letter Agency requires that pluto reads 440 bits from /dev/random and feed this into the NSS RNG before drawing random from the NSS library, despite the NSS library itself already seeding its internal state. As this process can block pluto for an extended time, the default is to not perform this redundant seeding. The **--seedbits** option can be used to specify the number of bits that will be pulled from /dev/random and seeded into the NSS RNG.

  See [**ipsec.conf**(5)](/ipsec.conf/5.md) and seedbits=*number*.

  This option should not be used by most people.

- **--statsbin** *filename*

  - **--secctx-attr-type** *number*

  **Libreswan** supports different IPstacks on different operating systems. Since most IPstacks have died the list is very short:

- **--use-xfrm**

  linux only

- **--use-bsdkame**

  BSD only

### Debugging

When running **pluto** under a debugger, the options **--nofork** and **--stderrlog** are recommended.

**pluto** is willing to produce a prodigious amount of debugging information. There are several classes of debugging output, and **pluto** may be directed to produce a selection of them. All lines of debugging output are prefixed with "\|" to distinguish them from normal diagnostic messages.

See [**ipsec.conf**(5)](/ipsec.conf/5.md) and plutodebug=*options*.

Very occasionally it is necessary to enable debugging early in **pluto's** startup process. The follow options enable this:

**--debug help** (whack only)

List the debugging classes recognised by **pluto**.

- **--debug none**

  Disable logging for all debugging classes.

- **--debug base**

  Enable debug-logging.

- **--debug cpu-usage**

  Enable cpu-usage logging.

- **--debug** *class*, **--no-debug** *class*, **--debug no-***class*

  Enable (disable) logging of the specified debugging *class* (**--debug help** lists debugging classes supported by this version of **pluto**).

## SIGNALS

**pluto** responds to **SIGHUP** by issuing a suggestion that **ipsec listen** might have been intended.

**pluto** exits when it receives **SIGTERM**.

## EXIT STATUS

**pluto** normally forks a daemon process, so the exit status is a very preliminary result.

**0**

means that all is OK so far.

**1**

means that something was wrong.

**10**

means that the lock file already exists.

## FILES

/run/pluto/pluto.pid /run/pluto/pluto.ctl /etc/ipsec.secrets /etc/ipsec.conf

## ENVIRONMENT

**pluto** does not use any environment variables.

## SEE ALSO

The rest of the Libreswan distribution, in particular [**libreswan**(7)](/libreswan/7.md).

## HISTORY

This code is released under the GPL terms. See the accompanying files CHANGES COPYING and CREDITS.\* for more details.

Detailed history (including FreeS/WAN and Openswan) can be found in the docs/ directory.

## BUGS

Please see **https://github.com/libreswan/libreswan/issues** for a list of currently known bugs and missing features.

## AUTHOR

Paul Wouters Andrew Cagney