--- name: "sslio" section: "8" platform: "linux" package: "ipsvd" version: "1.0.0-2" release: "Debian 7 (Wheezy)" platforms: ["linux"] url: "https://new.carta.tech/sslio" --- # sslio(8) SSL input/output for service programs ## NAME sslio - SSL input/output for service programs ## SYNOPSIS **sslio** \[-cv\] \[-u *user*\] \[-U *user*\] \[-/ *root*\] \[-C *cert*\] \[-K *key*\] \[-A *ca*\] *prog* ## DESCRIPTION **sslio** provides SSL encrypted network connections for service programs started by [**tcpsvd**(8)](/tcpsvd/8.md) or [**tcpserver**(1)](/tcpserver/1.md), and [**tcpclient**(1)](/tcpclient/1.md). Normally **sslio** is started by [**tcpsvd**(8)](/tcpsvd/8.md) or **[tcpclient(1)](/tcpclient/1.md),** in turn starts the service program *prog*, and runs as child process of the service program. After performing the SSL handshake, **sslio** reads SSL encrypted data from the network, and writes decrypted data to the service program *prog*; it reads data from the service program *prog*, and writes SSL encrypted data to the network. **sslio** should run under a different user ID than the service program, and with a changed root directory. When started by root, the -u option must be given, and the -U and -/ options should be given. The **sslio** program uses the SSLv3 implementation of the matrixssl library. ## OPTIONS - *prog* *prog* consists of one or more arguments, specifying the service program normally run directly by [**tcpsvd**(8)](/tcpsvd/8.md), or [**tcpserver**(1)](/tcpserver/1.md). - **-u *\[:\]user\[:group\]*** drop permissions. Set uid and gid to the *user*'s uid and gid, as found in */etc/passwd*, before reading data from, or writing data to the network. If *user* is followed by a colon and a *group*, set the gid to *group*'s gid, as found in */etc/group*, instead of *user*'s gid. If *group* consists of a colon-separated list of group names, set the group ids of all listed groups. If *user* is prefixed with a colon, the *user* and all *group* arguments are interpreted as uid and gids respectively, and not looked up in the password or group file. All supplementary groups are removed. This option must be set when **sslio** is started by root, and cannot be set otherwise. - **-U *\[:\]user\[:group\]*** drop permissions. Set uid and gid to the *user*'s uid and gid, as found in */etc/passwd*, before running *prog*. If *user* is followed by a colon and a *group*, set the gid to *group*'s gid, as found in */etc/group*, instead of *user*'s gid. If *group* consists of a colon-separated list of group names, set the group ids of all listed groups. If *user* is prefixed with a colon, the *user* and all *group* arguments are interpreted as uid and gids respectively, and not looked up in the password or group file. All supplementary groups are removed. This option should be set when **sslio** is started by root, and cannot be set otherwise. - **-/ *root*** chroot. Change the root directory to *root* before reading data from, or writing data to the network. This option should be set when **sslio** is started by root, and cannot be set otherwise. - **-C *cert*** cert file (server mode). Read the certificate from the file *cert* (default is \`\`./cert.pem''). If the -/ option is given, first the root directory is changed, then the cert file is read. - **-K *key*** private key (server mode). Read the private key from the file *key* (default is *cert*). If the -/ option is given, first the root directory is changed, then the private key is read. - **-A *ca*** ca file (client mode). Read the trusted root certificate from the file *ca*. Multiple files can be specified, using a semicolon as delimiter. If the -/ option is given, first the root directory is changed, then the ca file is read. - **-c** client mode. This option must be given when running **sslio** under [**tcpclient**(1)](/tcpclient/1.md). In client mode, filedescriptors 6 and 7 are used instead of standard input and standard ouput to read from and write to the network and the service program. If the -A option is given, **sslio** refuses to connect to a servers which's certificates cannot be verified by the root certificates, it accepts any server certificate otherwise. - **-v** verbose. Print verbose messages to standard error. - **-vv** more verbose. Print more verbose messages to standard error. - **-vvv** even more verbose. Print even more verbose messages to standard error. ## ENVIRONMENT - SSLIO\_BUFIN The environment variable *SSLIO\_BUFIN* overrides the default input buffer size for **sslio** (8192). - SSLIO\_BUFOU The environment variable *SSLIO\_BUFOU* overrides the default output buffer size for **sslio** (12288). If the output buffer is too small to hold encrypted or decrypted data, **sslio** automatically blows up the buffer to *SSLIO\_BUFOU* more bytes. - SSLIO\_BAD\_CERTIFICATE (client mode) If the environment variable *SSLIO\_BAD\_CERTIFICATE* is set, **sslio -c** accepts server ceritificates it would normally reject with\ fatal: ssl decode error: bad certificate - SSLIO\_HANDSHAKE\_TIMOUT The environment variable *SSLIO\_HANDSHAKE\_TIMEOUT* overrides the default number of seconds **sslio** will try to complete the ssl handshake (300). If the handshake isn't completed after this number of seconds, **sslio** exits. ## SEE ALSO [sslsvd(8)](/sslsvd/8.md), [tcpsvd(8)](/tcpsvd/8.md), [udpsvd(8)](/udpsvd/8.md), [ipsvd(7)](/ipsvd/7.md), [ipsvd-instruct(5)](/ipsvd-instruct/5.md), [ipsvd-cdb(8)](/ipsvd-cdb/8.md) http://smarden.org/ipsvd/ ## AUTHOR Gerrit Pape \