--- name: "spiped" section: "1" platform: "linux" package: "spiped" version: "1.6.4-2" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/spiped" --- # spiped(1) secure pipe daemon ## NAME spiped - secure pipe daemon ## SYNOPSIS **spiped** {-e \| -d} -s \ -t \ -k \\ \[-DFj\] \[-b \\] \[-f \| -g\] \[-n \\]\ \[-o \\] \[-p \\] \[-r \ \| -R\] \[--syslog\]\ \[-u \ \| \<:groupname\> \| \\]\ **spiped** -v ## OPTIONS - **-e** Take unencrypted connections from the *source socket* and send encrypted connections to the *target socket*. - **-d** Take encrypted connections from the *source socket* and send unencrypted connections to the *target socket*. - **-s \** Address on which spiped should listen for incoming connections. The accepted formats are the same as the ones accepted by *target socket*. Note that contrary to *target socket* hostnames are resolved when **spiped** is launched and are not re-resolved later; thus if DNS entries change **spiped** will continue to accept connections at the expired address. - **-t \** Address to which **spiped** should connect. Must be in one of the following formats: - • /absolute/path/to/unix/socket - • host.name:port - • \[ip.v4.ad.dr\]:port - • \[ipv6::addr\]:port - Hostnames are re-resolved every *rtime* seconds. - **-k \** Use the provided key file to authenticate and encrypt. Pass "-" to read from standard input. - **-b \** Bind the outgoing address. If this is a network address, the port number may either be specified or left to the operating system. If you specify the port number, the operating system will not permit you to open a second connection until the first one has completely expired (i.e. the TCP state is no longer in the TIME-WAIT state). - **-D** Wait for DNS. Normally when **spiped** is launched it resolves addresses and binds to its *source socket* before the parent process returns; with this option it will daemonize first and retry failed DNS lookups until they succeed. This allows **spiped** to launch even if DNS isn't set up yet, but at the expense of losing the guarantee that once **spiped** has finished launching it will be ready to create pipes. - **-f** Use fast/weak handshaking: This reduces the CPU time spent in the initial connection setup by disabling the Diffie-Hellman handshake, at the expense of losing perfect forward secrecy. - **-g** Require perfect forward secrecy by dropping connections if the other host is using the -f option. - **-F** Run in foreground. This can be useful with systems like daemontools. - **-j** Disable transport layer keep-alives. (By default they are enabled.) - **-n \** Limit on the number of simultaneous connections allowed. A value of 0 indicates that no limit should be imposed; this may be inadvisable in some circumstances, since **spiped** will terminate if it fails to allocate memory for handling a new connection. Defaults to 100 connections. - **-o \** Timeout, in seconds, after which an attempt to connect to the target or a protocol handshake will be aborted (and the connection dropped) if not completed. Defaults to 5s. - **-p \** File to which **spiped**'s process ID should be written. Defaults to *source socket*.pid (in the current directory if *source socket* is not an absolute path). No file will be written if -F (run in foreground) is used. - **-r \** Re-resolve the address of *target socket* every *rtime* seconds. Defaults to re-resolution every 60 seconds. - **-R** Disable target address re-resolution. - **--syslog** After daemonizing, send warnings to syslog instead of stderr. Has no effect if -F (run in foreground) is used. - **-u \ \| \<:groupname\> \| \** After binding a socket, change the user to *username* and/or the group to *groupname*. - **-v** Print version number. ## SIGNALS spiped provides special treatment of the following signals: - **SIGTERM** On receipt of the *SIGTERM* signal **spiped** will stop accepting new connections and exit once there are no active connections left. ## SEE ALSO [**spipe**(1)](/spipe/1.md).