NAME¶

tlswrapper-tcp - TLS encryption wrapper - tcp client

SYNOPSIS¶

tlswrapper-tcp [ options ] host port

DESCRIPTION¶

The tlswrapper-tcp is TCP client which connects to host:port and transfers data from standard input to the host and from the host to the standard output. it's designed to work to together with tlswrapper and is from the tlswrapper executed. Allows you to protect non-TLS TCP service using TLS similarly to stunnel(8). Systemd.socket/inetd/tcpserver/... creates the server connection, tlswraper encrypts/decrypts data stream and tlswrapper-tcp creates the client connection and sends/receives unencrypted data to/from the host:port as follows:

Internet <--> systemd.socket/inetd/tcpserver/... <--> tlswrapper <--> tlswrapper-tcp <-> host:port

OPTIONS¶

-q

Quiet mode. No error messages.

-v

Enable verbose mode. Multiple -v options increase the verbosity. The maximum is 3.

-t seconds

Set the network timeout to seconds seconds. (default 3600).

-T seconds

Set the connect timeout to seconds seconds. (default 10).

-p version

Enable incoming proxy-protocol version version string.

-P version

Enable outgoing proxy-protocol version version string.

-J jaildir

Chroot network-process into a specified jaildir (default: /var/lib/tlswraper/empty).

-j jailuser

Run network-process and dnsresolver-process under a specified jailuser's uid and gid. If unset run network-process and dnsresolver-process under random uid and gid.

host

host or IP

port

TCP port

SECURITY¶

Separate process for network connection and separate process for DNS resolving

To protect against secret-information leaks to the network connection (such Heartbleed) tlswrapper-tcp runs two independent processes. One process resolves the hostname and second creates a connection to host:port.

JAIL - Privilege separation, filesystem isolation, limits

The tlswrapper-tcp similarly to tlswrapper processes runs under dedicated non-zero uid to prohibit kill, ptrace, etc. Is chrooted into an empty, unwritable directory to prohibit filesystem access. Sets ulimits to prohibit new files, sockets, etc. Sets ulimits to prohibit forks.

EXAMPLES¶

Run tlswrapper using tcpserver/busybox/inetd on port 443 and connect to non-TLS service ip 127.0.0.1 and port 80

tcpserver -HRDl0 0 443 tlswrapper [ options ] tlswrapper-tcp 127.0.0.1 80
busybox tcpsvd 0 443 tlswrapper [ options ] tlswrapper-tcp 127.0.0.1 80
inetd.conf line: https stream tcp nowait root /usr/bin/tlswrapper tlswrapper [ options ] /usr/bin/tlswrapper-tcp 127.0.0.1 80

SEE ALSO¶

tlswrapper(1)