TINCD(8)

📦
version 1.0.37 · 4 versions
, in arch rolling

🌸 TINCD(8) — tinc VPN daemon, bestie edition 🌸

okay so you opened the manual for tincd, the actual daemon behind tinc (that's the secure virtual private network — VPN — project, iykyk). she's the main character of this whole page and honestly she ate. let's get into it 💅

✨ SYNOPSIS ✨

like, the literal shape of the command, copied exactly because we do NOT freestyle here:

tincd [-cdDkKnoLRU] [--config=DIR] [--no-detach] [--debug[=LEVEL]]
      [--kill[=SIGNAL]] [--net=NETNAME] [--generate-keys[=BITS]]
      [--option=[HOST.]KEY=VALUE] [--mlock] [--logfile[=FILE]]
      [--pidfile=FILE] [--bypass-security] [--chroot] [--user=USER]
      [--help] [--version]

🦋 DESCRIPTION 🦋

so this is the daemon of tinc, a secure virtual private network (VPN) project. when you start her up, tincd reads her configuration file to figure out which virtual subnets she has to serve and which other tinc daemons she should connect to 🔥

then she connects to the tun/tap device and sets up a socket for incoming connections. optionally a script gets executed to further configure the virtual device. if all that succeeds, she detaches from the controlling terminal and keeps going in the background — accepting connections and setting up connections to the other tinc daemons that are part of the virtual private network. queen behavior honestly 👑

and like, under Windows (not Cygwin, ok specific) tinc will install itself as a service, which gets restarted automatically after reboots. so she's always there. always watching. 💀

🎀 OPTIONS 🎀

every single flag, no skips, because you deserve the full picture 🫶

  • -c, --config=DIR — read configuration files from DIR instead of /etc/tinc/. moving out, getting a new address basically 💖
  • -D, --no-detach — don't fork and detach. this also disables the automatic restart mechanism for fatal errors (so like, no safety net, respect). unless mentioned otherwise, this shows log messages on the standard error output.
  • -d, --debug[=LEVEL] — increase debug level, or set it to LEVEL (see the debug levels section below, it's giving ladder energy).
  • -k, --kill[=SIGNAL] — attempt to kill a running tincd (optionally with the specified SIGNAL instead of SIGTERM) and exit. under Windows (not Cygwin) the optional argument is ignored — the service will always be stopped and removed. no negotiating with Windows, periodt 🙈
  • -n, --net=NETNAME — connect to net NETNAME. this lets tinc read all configuration files from /etc/tinc/NETNAME. specifying . for NETNAME is the same as not specifying any NETNAME at all. same same, but different ✨
  • -K, --generate-keys[=BITS] — generate a public/private RSA keypair and exit. if BITS is omitted, the default length will be 2048 bits. and heads up: when saving keys to existing files, tinc will not delete the old keys — you have to remove them manually. she does not clean up after you, bestie 😭
  • -o, --option=[HOST.]KEY=VALUE — without specifying a HOST, this sets server configuration variable KEY to VALUE. if you write it as HOST.KEY=VALUE, it sets the host configuration variable KEY of the host named HOST to VALUE. and you can use this option more than once to specify multiple configuration variables. stacking options like accessories 💅
  • -L, --mlock — lock tinc into main memory. this prevents sensitive data like shared private keys from being written to the system swap files/partitions. protective queen, we love to see it 🔒
  • --logfile[=FILE] — write log entries to a file instead of to the system logging facility. if FILE is omitted, the default is /var/log/tinc.NETNAME.log.
  • --pidfile=FILE — write PID to FILE instead of /var/run/tinc.NETNAME.pid. under Windows this option will be ignored. (Windows catching strays again 💀)
  • --bypass-security — disables encryption and authentication of the meta protocol. only useful for debugging.
⚠️ okay so seriously, --bypass-security is literally turning off encryption and authentication. debugging only. do not ship that. do not.
  • -R, --chroot — with this option tinc chroots into the directory where the network config is located (/etc/tinc/NETNAME if the -n option is used, or to the directory specified with the -c option) after initialization. cozy little box, iconic.
  • -U, --user=USER — setuid to the specified USER after initialization.
  • --help — display a short list of options. the classic.
  • --version — output version information and exit. drop the number and dip ✌️

🧚 SIGNALS 🧚

the way she responds to signals is honestly such a mood board:

  • ALRM — forces tincd to try to connect to all uplinks immediately. usually tincd attempts to do this herself, but she increases the time she waits between attempts each time it failed — and if tincd didn't succeed in connecting to an uplink the first time after she started, it defaults to the maximum time of 15 minutes. patient but dramatic ⏰
  • HUP — partially rereads configuration files. connections to hosts whose host config file are removed are closed. new outgoing connections specified in tinc.conf will be made. if the --logfile option is used, this will also close and reopen the log file — super useful when log rotation is used. glow-up + fresh start 🌸
  • INT — temporarily increases debug level to 5. send this signal again to revert to the original level. toggle toggle toggle 🎚️
  • USR1 — dumps the connection list to syslog.
  • USR2 — dumps virtual network device statistics, all known nodes, edges and subnets to syslog. the full lore dump.
  • WINCH — purges all information remembered about unreachable nodes. moving on, blocking, healing 💜

⭐ DEBUG LEVELS ⭐

the tinc daemon can send a lot of messages to the syslog. the higher the debug level, the more messages she logs. each level inherits all the messages of the previous level (so it's cumulative, not a clean slate, got it?):

  • 0 — logs a message indicating tincd has started, along with a version number. it will also log any serious error.
  • 1 — logs all connections that are made with other tinc daemons.
  • 2 — logs status and error messages from scripts and other tinc daemons.
  • 3 — logs all requests that are exchanged with other tinc daemons. these include authentication, key exchange and connection list updates.
  • 4 — logs a copy of everything received on the meta socket.
  • 5 — logs all network traffic over the virtual private network. full surveillance mode, no cap 👀

🌈 FILES 🌈

  • /etc/tinc/ — directory containing the configuration files tinc uses. for more information, see tinc.conf(5).
  • /var/run/tinc.NETNAME.pid — the PID of the currently running tincd is stored in this file.

💀 BUGS 💀

  • the BindToInterface option may not work correctly. she's trying her best ok 😭
  • the cryptography in tinc is not well tested yet. use it at your own risk! for real, at your own risk 🚨
  • if you find any bugs, report them to tinc@tinc-vpn.org.

🍓 TODO 🍓

a lot. especially security auditing. (the honesty?? we stan a self-aware icon.)

👑 SEE ALSO 👑

tinc.conf(5), https://www.tinc-vpn.org/, http://www.cabal.org/.

the full documentation for tinc is maintained as a Texinfo manual. if the info and tinc programs are properly installed at your site, the command info tinc should give you access to the complete manual.

tinc comes with ABSOLUTELY NO WARRANTY. this is free software, and you are welcome to redistribute it under certain conditions; see the file COPYING for details. read the fine print bestie, it's literally in caps 🫶

🎀 AUTHORS 🎀

  • Ivo Timmermans
  • Guus Sliepen <guus@tinc-vpn.org>

and thanks to many others for their contributions to tinc! 💖

and that's the whole page, babes — this edition of TINCD(8) is dated 2014-05-11, so go forth, run your VPN, and remember: secure, virtual, private, and absolutely iconic ✨💅🦋

📦 where this page comes from