IPSEC-PLUTO(8)

📦
version 5.4.1 · 14 versions
, in fedora 43, fedora 44

💖 IPSEC-PLUTO 💖

okay bestie, listen, the manual name is IPSEC-PLUTO(8) and yeah we're using ipsec-pluto and pluto interchangeably the whole time, keep up 💅

✨ NAME ✨

ipsec-pluto, pluto — the Internet Key Exchange daemon, aka the moment your VPN actually starts working 🦋

🌸 SYNOPSIS 🌸

ipsec pluto [--help] [--version]
            [--nofork] [--rundir path] [--efence-protect]
            [--stderrlog] [--logfile filename] [--log-no-time]
            [--log-no-append] [--log-no-ip] [--log-no-audit]
            [--config filename] [--secretsfile secrets-file]
            [--ipsecdir dirname] [--nssdir dirname] [--coredir dirname]
            [--vendorid VID] [--uniqueids]
            [--virtual-private network_list] [--keep-alive delay_sec]
            [--force-busy] [--crl-strict] [--crlcheckinterval]
            [--listen ipaddr] [--nhelpers number] [--seedbits numbits]
            [--statsbin filename] [--secctx-attr-type number]
            [--use-xfrm] [--use-bsdkame]

👑 DESCRIPTION 👑

pluto is Libreswan's Internet Key Exchange (IKE) daemon. that's the whole vibe bestie, that's her job 🎀

so here's the tea: you do not normally run pluto directly. nope. instead the daemon gets controlled by the host's init(8) system — think systemd(8) or rc(8) — or by the ipsec command (peep ipsec(8)). she has people for that. main character energy honestly 💅

want the general lore on Libreswan? that's libreswan(7).

want to know how to actually configure Libreswan and the pluto daemon? that's ipsec.conf(5), go read it, it's giving reference material 🍓

🌈 Help Options

  • --help — shows pluto's usage message. the "what do i even do here" button ✨
  • --version — shows Libreswan's version details. flex the digits 📊

🚀 Starting pluto

when she boots up, pluto tries to create a lockfile named /run/pluto/pluto.pid. if that lockfile cannot be created, pluto exits — and honestly that's a feature, it stops multiple plutos from fighting over the same turf. no drama allowed 🙅‍♀️

⚠️ any "leftover" lockfile has to be manually removed before pluto will run again. she does not clean up after herself on that one, you have to do it. 💀

after that, pluto writes its PID into the file so scripts can find it. then pluto forks and the parent exits — which is the classic, conventional, textbook "daemon fork" moment. iconic behaviour only 🧚

these options change how pluto starts up:

  • --nofork — disables the "daemon fork". also, once the lock file and control socket are created, it prints the line Pluto initialized to standard out. she announces herself 💅
  • --rundir path — changes the run directory from the default /run/pluto. this directory is where the goods live:
    • path/pluto.ctl — the socket through which whack communicates with pluto (the group chat 📱)
    • path/pluto.pid — the lockfile that prevents multiple pluto instances (the "only one of us talks" rule ✋)
  • --efence-protect — enables efence protection 🛡️

📝 Logging

okay so all logging, diagnostics included, gets sent to syslog(3) with facility=authpriv, and syslog decides where those messages end up. not pluto's call. the following options change that whole arrangement:

  • --stderrlog — directs logging to standard error instead of a log file. when you specify this, it overrides any logfile= setting from the configuration file, regardless of argument order. no cap, order does not save you here. often combined with --nofork when debugging pluto 🔍
  • --logfile filename — directs logging to filename instead of syslog(3). when filename is empty (--logfile=), any logfile= setting from the configuration file gets cleared, which makes pluto fall back to --stderrlog or syslog(3). see ipsec.conf(5) and logfile=filename 📄
  • --log-no-time — no timestamp prefix when logging to a file. see ipsec.conf(5) and logtime=no ⏰
  • --log-no-append — does not append to the end of an existing log file. see ipsec.conf(5) and logappend=no 📎
  • --log-no-ip — leaves IP addresses out when logging. see ipsec.conf(5) and logip=no 🙈
  • --log-no-audit — does not generate audit logs (on systems that support Linux Auditing). see ipsec.conf(5) and audit-log=no 🧾

📂 Configuration Files

these options override pluto's default configuration parameters, periodt:

  • --config filename — specify an ipsec.conf(5) file containing additional configuration parameters. the "config" section of filename will be loaded. normally pluto is started using ipsec start, and that passes the parameter --config /etc/ipsec.conf so the default configuration gets read 🫶
  • --secretsfile secrets-file — specify the file for authentication secrets. 🤫 this name is subject to "globbing" as in sh(1), so every file with a matching name gets processed. quoting is generally needed to stop the shell from doing the globbing yourself, bestie. default is /etc/ipsec.secrets. see ipsec.secrets(5).
  • --ipsecdir dirname — the directory containing additional configuration files. default is /etc/ipsec.d. 🗂️
  • --nssdir dirname — the directory containing the NSS trust store. default is /var/lib/ipsec/nss. 🔐
  • --coredir dirname — the directory to write a core file should pluto abort. default is /run/pluto. 💥

🎀 Other Options

these options tweak pluto's behaviour:

  • --vendorid VID — (the page doesn't spill any details on this one, so we're not gonna invent them 💀)
  • --uniqueids — require all connections to have a unique identifier. if this option has been selected, whenever a new ISAKMP SA is established, any connection with the same Peer ID but a different Peer IP address is unoriented (causing all its SAs to be deleted). this helps clean up dangling SAs when a connection is lost and then regained at another IP address. messy breakups, cleaned up 💔
  • --virtual-private network_list — Pluto supports RFC 3947 NAT-Traversal. the allowed range behind the NAT routers is submitted using the --virtual-private option. see ipsec.conf(5) for the syntax 📖
  • --keep-alive delay_sec — the --keep-alive sets the delay (in seconds) of these keep-alive packets. the newer NAT-T standards support port floating, and Libreswan enables this per default. 💓
  • --force-busy — if this option has been selected, pluto will be forced to be "busy". in this state, which happens when there is a Denial of Service attack, will force pluto to use cookies before accepting new incoming IKE packets. cookies are send and required in ikev1 Aggressive Mode and in ikev2. this option is mostly used for testing purposes, but can be selected by paranoid administrators as well. 🍪
  • --crl-strict — reject authentication using X.509 until a valid certificate revocation list has been loaded. no list, no entry 🚫
  • --crlcheckinterval — (no description on the page, so we're leaving it exactly as-is 🫥)
  • --listen ipaddr — (same deal, no description given, not making one up 🫥)
  • --nhelpers number — specify the number of threads to use when offloading cryptographic operations. Pluto can also use helper children to off-load cryptographic operations. this behavior can be fine tuned using the --nhelpers. Pluto will start (n-1) of them, where n is the number of CPU's you have (including hypherthreaded CPU's). a value of 0 forces pluto to do all operations in the main process. a value of -1 tells pluto to perform the above calculation. any other value forces the number to that amount. ✨ see ipsec.conf(5) and nhelpers=number.
  • --seedbits numbits — specify the number of seed bits to read from the RNG before starting. Pluto uses the NSS crypto library as its random source. some government Three Letter Agency requires that pluto reads 440 bits from /dev/random and feed this into the NSS RNG before drawing random from the NSS library, despite the NSS library itself already seeding its internal state. since this process can block pluto for an extended time, the default is to not perform this redundant seeding. the --seedbits option can be used to specify the number of bits that will be pulled from /dev/random and seeded into the NSS RNG. 🎲 see ipsec.conf(5) and seedbits=number.
🛑 this option should not be used by most people. fr fr, step away from the flag.
  • --statsbin filename — (no description on the page, keeping it real and empty 🫥)
  • --secctx-attr-type number — (no description on the page either 🫥)

Libreswan supports different IPstacks on different operating systems. since most IPstacks have died the list is very short:

  • --use-xfrm — linux only 🐧
  • --use-bsdkame — BSD only 😈

🐛 Debugging

very occasionally it is necessary to enable debugging early in pluto's startup process. the follow options enable this:

  • --debug help (whack only) — list the debugging classes recognised by pluto 📋
  • --debug none — disable logging for all debugging classes 🔇
  • --debug class, --no-debug class, --debug no-class — enable (disable) logging of the specified debugging class 🔧

for more details, see plutodebug= in ipsec.conf(5).

📣 SIGNALS 📣

pluto responds to SIGHUP by issuing a suggestion that ipsec listen might have been intended. she's just guessing what you meant, gently 💅

pluto exits when it receives SIGTERM. bye bestie 👋

🚪 EXIT STATUS 🚪

pluto normally forks a daemon process, so the exit status is a very preliminary result. like, don't read too much into it 🫠

  1. 0 — means that all is OK so far. ✅
  2. 1 — means that something was wrong. ❌
  3. 10 — means that the lock file already exists. 🔒

🗃️ FILES 🗃️

/run/pluto/pluto.pid /run/pluto/pluto.ctl /etc/ipsec.secrets
/etc/ipsec.conf

🌱 ENVIRONMENT 🌱

pluto does not use any environment variables. not one. she's self-contained, we love that for her 💜

👀 SEE ALSO 👀

the rest of the Libreswan distribution, in particular libreswan(7).

📜 HISTORY 📜

this code is released under the GPL terms. see the accompanying files CHANGES COPYING and CREDITS.* for more details. 📚

detailed history (including FreeS/WAN and Openswan) can be found in the docs/ directory. 🏛️

💀 BUGS 💀

please see https://github.com/libreswan/libreswan/issues for a list of currently known bugs and missing features. go be nosy, they documented it 🐛

🌟 AUTHOR 🌟

Andrew Cagney, Anish Singh Rawat, Antony Antony, Daniel Kahn Gillmor, D. Hugh Redelmeier, Harald Jenny, Jose Quaresma, Matt Rogers, Max-Julian Pogner, Michael Richardson, Paul Wouters, Pietro Monteiro, Simon Deziel, Tuomo Soini, Vinayak Sandur, Vukasin Karadzic 👑

that's the whole page bestie!! this was brought to you by Libreswan 5.4.1, dated 10/23/2026, and IPSEC-PLUTO(8) — stay encrypted, stay iconic 🎀✨🦋

📦 where this page comes from