210 lines
6 KiB
Groff
210 lines
6 KiB
Groff
.Dd 2013-01-14
|
|
.Dt TINCD 8
|
|
.\" Manual page created by:
|
|
.\" Ivo Timmermans
|
|
.\" Guus Sliepen <guus@tinc-vpn.org>
|
|
.Sh NAME
|
|
.Nm tincd
|
|
.Nd tinc VPN daemon
|
|
.Sh SYNOPSIS
|
|
.Nm
|
|
.Op Fl cdDKnsoLRU
|
|
.Op Fl -config Ns = Ns Ar DIR
|
|
.Op Fl -no-detach
|
|
.Op Fl -debug Ns Op = Ns Ar LEVEL
|
|
.Op Fl -net Ns = Ns Ar NETNAME
|
|
.Op Fl -option Ns = Ns Ar [HOST.]KEY=VALUE
|
|
.Op Fl -mlock
|
|
.Op Fl -logfile Ns Op = Ns Ar FILE
|
|
.Op Fl -syslog
|
|
.Op Fl -bypass-security
|
|
.Op Fl -chroot
|
|
.Op Fl -user Ns = Ns Ar USER
|
|
.Op Fl -help
|
|
.Op Fl -version
|
|
.Sh DESCRIPTION
|
|
This is the daemon of tinc, a secure virtual private network (VPN) project.
|
|
When started,
|
|
.Nm
|
|
will read it's configuration file to determine what virtual subnets it has to serve
|
|
and to what other tinc daemons it should connect.
|
|
It will connect to the ethertap or tun/tap device
|
|
and set up a socket for incoming connections.
|
|
Optionally a script will be executed to further configure the virtual device.
|
|
If that succeeds,
|
|
it will detach from the controlling terminal and continue in the background,
|
|
accepting and setting up connections to other tinc daemons
|
|
that are part of the virtual private network.
|
|
Under Windows (not Cygwin) tinc will install itself as a service,
|
|
which will be restarted automatically after reboots.
|
|
.Sh OPTIONS
|
|
.Bl -tag -width indent
|
|
.It Fl c, -config Ns = Ns Ar DIR
|
|
Read configuration files from
|
|
.Ar DIR
|
|
instead of
|
|
.Pa @sysconfdir@/tinc/ .
|
|
.It Fl D, -no-detach
|
|
Don't fork and detach.
|
|
This will also disable the automatic restart mechanism for fatal errors.
|
|
If not mentioned otherwise, this will show log messages on the standard error output.
|
|
.It Fl d, -debug Ns Op = Ns Ar LEVEL
|
|
Increase debug level or set it to
|
|
.Ar LEVEL
|
|
(see below).
|
|
.It Fl n, -net Ns = Ns Ar NETNAME
|
|
Connect to net
|
|
.Ar NETNAME .
|
|
This will let tinc read all configuration files from
|
|
.Pa @sysconfdir@/tinc/ Ar NETNAME .
|
|
Specifying
|
|
.Li .
|
|
for
|
|
.Ar NETNAME
|
|
is the same as not specifying any
|
|
.Ar NETNAME .
|
|
.It Fl o, -option Ns = Ns Ar [HOST.]KEY=VALUE
|
|
Without specifying a
|
|
.Ar HOST ,
|
|
this will set server configuration variable
|
|
.Ar KEY
|
|
to
|
|
.Ar VALUE .
|
|
If specified as
|
|
.Ar HOST.KEY=VALUE ,
|
|
this will set the host configuration variable
|
|
.Ar KEY
|
|
of the host named
|
|
.Ar HOST
|
|
to
|
|
.Ar VALUE .
|
|
This option can be used more than once to specify multiple configuration variables.
|
|
.It Fl L, -mlock
|
|
Lock tinc into main memory.
|
|
This will prevent sensitive data like shared private keys to be written to the system swap files/partitions.
|
|
This option is not supported on all platforms.
|
|
.It Fl -logfile Ns Op = Ns Ar FILE
|
|
Write log entries to a file instead of to the system logging facility.
|
|
If
|
|
.Ar FILE
|
|
is omitted, the default is
|
|
.Pa @localstatedir@/log/tinc. Ns Ar NETNAME Ns Pa .log.
|
|
.It Fl s, -syslog
|
|
When this option is is set, tinc uses syslog instead of stderr in --no-detach mode.
|
|
.It Fl -pidfile Ns = Ns Ar FILENAME
|
|
Store a cookie in
|
|
.Ar FILENAME
|
|
which allows
|
|
.Xr tinc 8
|
|
to authenticate.
|
|
If
|
|
.Ar FILE
|
|
is omitted, the default is
|
|
.Pa @localstatedir@/run/tinc. Ns Ar NETNAME Ns Pa .pid.
|
|
.It Fl -bypass-security
|
|
Disables encryption and authentication of the meta protocol.
|
|
Only useful for debugging.
|
|
.It Fl R, -chroot
|
|
With this option tinc chroots into the directory where network
|
|
config is located (@sysconfdir@/tinc/NETNAME if -n option is used,
|
|
or to the directory specified with -c option) after initialization.
|
|
This option is not supported on all platforms.
|
|
.It Fl U, -user Ns = Ns Ar USER
|
|
setuid to the specified
|
|
.Ar USER
|
|
after initialization.
|
|
This option is not supported on all platforms.
|
|
.It Fl -help
|
|
Display short list of options.
|
|
.It Fl -version
|
|
Output version information and exit.
|
|
.El
|
|
.Sh SIGNALS
|
|
.Bl -tag -width indent
|
|
.It ALRM
|
|
Forces
|
|
.Nm
|
|
to try to connect to all uplinks immediately.
|
|
Usually
|
|
.Nm
|
|
attempts to do this itself,
|
|
but increases the time it waits between the attempts each time it failed,
|
|
and if
|
|
.Nm
|
|
didn't succeed to connect to an uplink the first time after it started,
|
|
it defaults to the maximum time of 15 minutes.
|
|
.It HUP
|
|
Partially rereads configuration files.
|
|
Connections to hosts whose host config file are removed are closed.
|
|
New outgoing connections specified in
|
|
.Pa tinc.conf
|
|
will be made.
|
|
If the
|
|
.Fl -logfile
|
|
option is used, this will also close and reopen the log file,
|
|
useful when log rotation is used.
|
|
.El
|
|
.Sh DEBUG LEVELS
|
|
The tinc daemon can send a lot of messages to the syslog.
|
|
The higher the debug level,
|
|
the more messages it will log.
|
|
Each level inherits all messages of the previous level:
|
|
.Bl -tag -width indent
|
|
.It 0
|
|
This will log a message indicating
|
|
.Nm
|
|
has started along with a version number.
|
|
It will also log any serious error.
|
|
.It 1
|
|
This will log all connections that are made with other tinc daemons.
|
|
.It 2
|
|
This will log status and error messages from scripts and other tinc daemons.
|
|
.It 3
|
|
This will log all requests that are exchanged with other tinc daemons. These include
|
|
authentication, key exchange and connection list updates.
|
|
.It 4
|
|
This will log a copy of everything received on the meta socket.
|
|
.It 5
|
|
This will log all network traffic over the virtual private network.
|
|
.El
|
|
.Sh FILES
|
|
.Bl -tag -width indent
|
|
.It Pa @sysconfdir@/tinc/
|
|
Directory containing the configuration files tinc uses.
|
|
For more information, see
|
|
.Xr tinc.conf 5 .
|
|
.It Pa @localstatedir@/run/tinc. Ns Ar NETNAME Ns Pa .pid
|
|
The PID of the currently running
|
|
.Nm
|
|
is stored in this file.
|
|
.El
|
|
.Sh BUGS
|
|
The
|
|
.Va BindToInterface
|
|
option may not work correctly.
|
|
.Pp
|
|
.Sy The cryptography in tinc is not well tested yet. Use it at your own risk!
|
|
.Pp
|
|
If you find any bugs, report them to tinc@tinc-vpn.org.
|
|
.Sh TODO
|
|
A lot, especially security auditing.
|
|
.Sh SEE ALSO
|
|
.Xr tinc 8 ,
|
|
.Xr tinc.conf 5 ,
|
|
.Pa https://www.tinc-vpn.org/ ,
|
|
.Pa http://www.cabal.org/ .
|
|
.Pp
|
|
The full documentation for tinc is maintained as a Texinfo manual.
|
|
If the info and tinc programs are properly installed at your site,
|
|
the command
|
|
.Ic info tinc
|
|
should give you access to the complete manual.
|
|
.Pp
|
|
tinc comes with ABSOLUTELY NO WARRANTY.
|
|
This is free software, and you are welcome to redistribute it under certain conditions;
|
|
see the file COPYING for details.
|
|
.Sh AUTHORS
|
|
.An "Ivo Timmermans"
|
|
.An "Guus Sliepen" Aq guus@tinc-vpn.org
|
|
.Pp
|
|
And thanks to many others for their contributions to tinc!
|