tlswrapper-smtp(1)

💖 tlswrapper-smtp — TLS encryption wrapper: smtp helper 💖

okay bestie, gather round, because this is tlswrapper-smtp(1), a General Commands Manual page and honestly? it's giving tiny but mighty. 🌸

---

✨ NAME ✨

tlswrapper-smtp — TLS encryption wrapper, but make it the smtp helper 💅

---

🦋 SYNOPSIS 🦋

tlswrapper-smtp [ options ] prog

---

👑 DESCRIPTION 👑

so here's the tea: tlswrapper-smtp adds STARTTLS support to those old, crusty, inetd-style SMTP servers that lowkey refuse to support STARTTLS natively. no patching required, we just wrap it. 🎀

and the way it gets executed is literally this whole relay chain:

Internet <--> systemd.socket/inetd/tcpserver/... <--> tlswrapper <-->
tlswrapper-smtp  <--> smtpprogram

main character energy in the middle of the pipeline, periodt. 🔥

---

💅 OPTIONS 💅

• -q — quiet mode, bestie. absolutely no error messages. 🤫
• -v — verbose mode unlocked! stack multiple -v options to crank the verbosity up higher. the max is 3, so don't get greedy. 😌
• -t seconds — sets the SMTP session timeout to seconds seconds. default is 600. ⏰
• -T seconds — sets the connect/read/write timeout to seconds seconds. default is 15. ⚡
• -u user — runs program prog under a specified user's uid and gid. heads up though: the account must resolve to a non-zero uid and a non-zero gid, and accounts with uid 0 or gid 0 are rejected. no root shenanigans here, babes. 🚫
• -g host:port — turns on greylist support (postgrey protocol) and uses the server running on host:port. 🍓
• -c — handles communication to the greylist server in fail-closed mode. if a greylist lookup fails temporarily, tlswrapper-smtp exits with status 111. dramatic but honest. 💀
• -C — handles communication to the greylist server in fail-open mode. if a greylist lookup fails temporarily, it assumes the address is not greylisted. this one is the default, iykyk. 🙈
• -J jaildir — chroots into the specified jaildir. default: /var/lib/tlswrapper/empty. 🧚
• -j jailuser — runs under the specified jailuser's uid and gid. same rules as before: the account must resolve to non-zero uid and non-zero gid, and uid 0 / gid 0 accounts are rejected. leave it unset and it runs under a random uid and gid instead. 🎲
• prog — program. yes that's the whole description bestie, that's the argument. 🫶

---

🔒 SECURITY 🔒

JAIL — Privilege separation, filesystem isolation, limits 🏰

tlswrapper-smtp, just like tlswrapper processes, runs under a dedicated non-zero uid to prohibit kill, ptrace, etc. like, don't even think about touching it. 💪

it also gets chrooted into an empty, unwritable directory to prohibit filesystem access — nothing to see, nothing to touch, iconic. 🌈

and it sets ulimits to prohibit new files, sockets, etc. 🌸

it also sets ulimits to prohibit forks. 🍴🚫

fr fr, this thing is locked down tighter than your read receipts. 🔐

---

🌟 EXAMPLES 🌟

run QMAIL qmail-smtpd on port 25 with STARTTLS enabled (without patching QMAIL, because we said no patching):

exec softlimit -m 64000000 -f 100000000 \
tcpserver -HRDl0 0 25 \
tlswrapper -v -n -f /etc/ssl/cert.pem \
tlswrapper-smtp -v -u qmaild \
qmail-smtpd

slay. that's the whole flex. 💅✨

---

🫶 SEE ALSO 🫶

• tlswrapper(1) — go read it, it's the sibling. 👑

---

and that's the page babes! 💖 this little icon was brought to you by tlswrapper-smtp(1) — go be safe, stay jailed, and remember: no cap, only STARTTLS. 🎀🦋💜