NAME¶

gtlsshd - Server for shell over TLS

SYNOPSIS¶

gtlsshd [options]

DESCRIPTION¶

The gtlsshd program receives connections from gtlssh, authenticates the connections, and connects them to a shell or a program as requested.

gtlsshd will listen on both SCTP and TCP sockets unless told otherwise.

gtlsshd uses openssl public key certificate authentication both directions. When something connections, it uses standard SSL handling to validate itself to the user with the given key and certificate files.

On SSL does its job, it then runs an authentication protocol for the user on top of the SSL connection. The user sends the username, and gtlsshd will use the $HOME/.gtlssh/allowed_certs directory to authenticate a certificate the user presents. If the user doesn't have a certificate that matches the presented certificate, gtlsshd will attempt a normal password login if that is enabled.

OPTIONS¶

-p|--port port

Use the given port instead of the default port.

-h|--keyfile file

Use the given file for the key instead of the default. Defaults to /etc/gtlssh/gtlsshd.key.

-c|--certfile file

Set the certificate to use. Defaults to /etc/gtlssh/gtlsshd.crt.

--permit-root

Allow root logins. Otherwise root or uid=0 is denied.

--allow-password

Allow password logins. By default only certificate-based logins are allowed. Passwords are much less secure than certificate logins, so their use is discouraged.

--oneshot

Do not fork the program at the beginning or when a connection is received. This allows easier debugging of the program.

--nodaemon

Do not daemonize (double fork) the program.

--nosctp

Disable SCTP support.

--notcp

Disable TCP support

--other_acc <accepter>

Enable the given accepter to receive connections for gtlsshd. This does not disable TCP or SCTP.

-P|--pidfile file

Create a standard pidfile using the given filename.

-4

Do IPv4 only.

-6

Do IPv6 only. -d|--debug Generate debugging output. Specifying more than once increases the output. This also causes syslog output to go to standard error.

-h|--help

Help output

SEE ALSO¶

gensio(5), gtlssh(1), gtlssh-keygen(1)

KNOWN PROBLEMS¶

None.

AUTHOR¶

Corey Minyard <minyard@acm.org>