GSASL(1)

📦
version 2.2.4 · 12 versions
, in arch rolling

💅 GSASL(1) — the gsasl glow-up (GNU SASL command line interface)

okay bestie, so this is the manual page for gsasl — like, the whole thing, it lives in the User Commands section of the manual. Buckle up, we're going in 🌸

✨ SYNOPSIS ✨

gsasl [OPTION]... [HOST [PORT]]...

that's it, that's the shape of it. options first, then optionally a host and port. iconic.

🦋 DESCRIPTION 🦋

So the whole vibe: gsasl authenticates a user to a server using the Simple Authentication and Security Layer (SASL, iykyk). Right now it's got your back for IMAP and SMTP servers specifically — those are the two supported ones. Basically it's the command line interface for the GNU SASL library 💖

Right up top, the two classic little guys:

  • -h, --help — prints help and dips out (exit).
  • -V, --version — prints the version and dips out too.

👑 Commands

  • -c, --client — act as a client. this one's default=on so you're in client mode unless you say otherwise 💅
  • -s, --server — act as a server. (default=off — so not unless you ask, bestie.)
  • --client-mechanisms — writes the names of supported client mechanisms to stdout, separated by a space. (default=off)
  • --server-mechanisms — same energy but for server mechanisms, space-separated, to stdout. (default=off)
  • -k, --mkpasswd — derive a password. you gotta pass --mechanism as SCRAM-SHA-1 or SCRAM-SHA-256. required inputs: the password (either through --password or read from the terminal); optional inputs: iteration count (through --iteration-count, or it defaults to 65536) and salt (through --salt, or generated randomly). the output is a string shaped exactly like this:
{mech}count,salt,stored-key,server-key[,salted-password]

where mech is the mechanism, count is the number of times the password was hashed, salt is the provided/generated base64-encoded salt, and stored-key and server-key are the two derived and base64-encoded server-side keys. When you pass --verbose, salted-password gets included too, as the hex-encoded PBKDF2-derived password. (default=off) slay.

🌈 Network options

  • --connect=HOST[:PORT] — connect to a TCP server and negotiate on the stream instead of stdin/stdout. PORT is either the protocol service name or an integer denoting the port, and it defaults to 143 (imap) if you don't specify. it also sets the --hostname default ✨

🎀 Generic options

  • -d, --application-data — after authentication, read data from stdin, run it through the mechanism's security layer, and print it base64 encoded to stdout. default behavior is to just terminate after authentication. (default=on)
  • --imap — use an IMAP-like logon procedure (client only). also sets the --service default to 'imap'. (default=off)
  • --smtp — use a SMTP-like logon procedure (client only). also sets the --service default to 'smtp'. (default=off)
  • -m, --mechanism=STRING — the mechanism to use.
  • --no-client-first — disallow the client from sending data first (client only). (default=off)

💜 SASL mechanism options (they get prompted for when required, so don't stress)

  • -n, --anonymous-token=STRING — token for anonymous authentication, usually a mail address (ANONYMOUS only).
  • -a, --authentication-id=STRING — identity of the credential owner.
  • -z, --authorization-id=STRING — identity to request service for.
  • -p, --password=STRING — password for authentication (insecure for non-testing purposes — like, seriously, not for prod, bestie 😭).
  • -r, --realm=STRING — realm. defaults to hostname.
  • --passcode=NUMBER — passcode for authentication (SECURID only).
  • --service=STRING — set the requested service name (should be a registered GSSAPI host based service name).
  • --hostname=STRING — set the name of the server with the requested service.
  • --service-name=STRING — set the generic server name in case of a replicated server (DIGEST-MD5 only).
  • --enable-cram-md5-validate — validate CRAM-MD5 challenge and response interactively. (default=off)
  • --disable-cleartext-validate — disable cleartext validate hook, forcing server to prompt for password. (default=off)
  • --quality-of-protection=TYPE — how the application payload will be protected. 'qop-auth' means no protection, 'qop-int' means integrity protection, and 'qop-conf' means integrity and confidentialiy protection. currently only used by DIGEST-MD5, where the default is 'qop-int'.
  • --iteration-count=NUMBER — indicate PBKDF2 hash iteration count (SCRAM only). (default = 65536)
  • --salt=B64DATA — indicate PBKDF2 salt as a base64-encoded string (SCRAM only).
  • --scram-salted-password=STRING — salted SCRAM password for authentication (SCRAM only; 40 hex characters for SCRAM-SHA-1 and 64 characters for SCRAM-SHA-256). count those characters, bestie 🔥

🧚 STARTTLS options

  • --starttls — force use of STARTTLS. the default is to use STARTTLS when it's available. (default=off)
  • --no-starttls — unconditionally disable STARTTLS. (default=off)
  • --no-cb — don't use channel bindings from TLS. (default=off)
  • --x509-ca-file=FILE — file containing one or more X.509 Certificate Authorities certificates in PEM format, used to verify the certificate received from the server. if you don't specify it, verification uses system trust settings. and if FILE is the empty string, don't fail on X.509 server certificates verification errors 🙈
  • --x509-cert-file=FILE — file containing the client X.509 certificate in PEM format. used together with --x509-key-file to specify the certificate/key pair.
  • --x509-key-file=FILE — private key for the client X.509 certificate in PEM format. used together with --x509-key-file to specify the certificate/key pair. (yes, the page says --x509-key-file both times — that's what it says, so that's what I'm telling you 🫶)
  • --priority=STRING — cipher priority string.

⭐ Other options

  • --verbose — produce verbose output. (default=off)
  • --quiet — don't produce any diagnostic output. (default=off)
lowkey pick one of --verbose and --quiet, they're kind of opposites, but the page doesn't police you. do with that what you will 💀

🌸 AUTHOR 🌸

Written by Simon Josefsson. king behavior 👑

🦋 REPORTING BUGS 🦋

please actually report them instead of just suffering in silence, bestie 😭💖

Copyright © 2026 Simon Josefsson. License GPLv3+: GNU GPL version 3 or later https://gnu.org/licenses/gpl.html.

This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. (all caps warning, not me being dramatic ✨)

💜 SEE ALSO 💜

The full documentation for gsasl is maintained as a Texinfo manual. If the info and gsasl programs are properly installed at your site, the command

info gsasl

should give you access to the complete manual. go read it, it's giving ✨encyclopedia✨

💅 and that's the whole page! this one's from GNU SASL 2.2.4, dated June 2026 — mwah, go authenticate something 🫶

📦 where this page comes from
  • arch rolling: gsasl 2.2.4-1 · LGPL-2.1-or-later AND GPL-3.0-or-later AND GFDL-1.3-or-later
  • 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms