tlswrapper-tcp(1)

NAME
tlswrapper-tcp - TLS encryption wrapper - tcp client

SYNOPSIS
tlswrapper-tcp [ options ] host port

DESCRIPTION

The tlswrapper-tcp is TCP client which connects to host:port and transfers data from standard input to the host and from the host to the standard output. It is designed to work together with tlswrapper and is executed from tlswrapper. Allows you to protect non-TLS TCP service using TLS similarly to stunnel(8). Systemd.socket/inetd/tcpserver/... creates the server connection, tlswrapper encrypts/decrypts data stream and tlswrapper-tcp creates the client connection and sends/receives unencrypted data to/from the host:port as follows:

Internet <--> systemd.socket/inetd/tcpserver/... <--> tlswrapper <--> tlswrapper-tcp <-> host:port

OPTIONS

-q  Quiet mode. No error messages.

-v  Enable verbose mode. Multiple -v options increase the verbosity. The maximum is 3.

-t seconds
    Set the network timeout to seconds seconds. (default 3600).

-T seconds
    Set the connect timeout to seconds seconds. (default 10).

-p version
    Enable incoming proxy-protocol version version string.

-P version
    Enable outgoing proxy-protocol version version string.

-J jaildir
    Chroot network-process into a specified jaildir (default: /var/lib/tlswrapper/empty).

-j jailuser
    Run network-process and dnsresolver-process under a specified jailuser's uid and gid. If unset run network-process and dnsresolver-process under random uid and gid.

host
    host or IP

port
    TCP port

SECURITY
Separate process for network connection and separate process for DNS resolving

To protect against secret-information leaks to the network connection (such as Heartbleed) tlswrapper-tcp runs two independent processes. One process resolves the hostname and second creates a connection to host:port.

JAIL - Privilege separation, filesystem isolation, limits

The tlswrapper-tcp similarly to tlswrapper processes runs under dedicated non-zero uid to prohibit kill, ptrace, etc. Is chrooted into an empty, unwritable directory to prohibit filesystem access. Sets ulimits to prohibit new files, sockets, etc. Sets ulimits to prohibit forks.

EXAMPLES

Run tlswrapper using tcpserver/busybox/inetd on port 443 and connect to non-TLS service ip 127.0.0.1 and port 80
    tcpserver -HRDl0 0 443 tlswrapper [ options ] tlswrapper-tcp 127.0.0.1 80
    busybox tcpsvd 0 443 tlswrapper [ options ] tlswrapper-tcp 127.0.0.1 80
    inetd.conf line: https stream tcp nowait root /usr/bin/tlswrapper tlswrapper [ options ] /usr/bin/tlswrapper-tcp 127.0.0.1 80

SEE ALSO
tlswrapper(1)