tlswrapper-smtp - TLS encryption wrapper - smtp helper

       The  tlswrapper-smtp adds STARTTLS support to old inetd-style SMTP servers which doesn't support STARTTLS
       naturally.  Is executed as follows:

       Internet <--> systemd.socket/inetd/tcpserver/... <--> tlswrapper <--> tlswrapper-smtp  <--> smtpprogram

       run QMAIL qmail-smtpd on port 25 with STARTTLS enabled (without patching QMAIL):
           exec softlimit -m 64000000 -f 100000000 \
           tcpserver -HRDl0 0 25 \
           tlswrapper -v -n -f /etc/ssl/cert.pem \
           tlswrapper-smtp -v -u qmaild \
           qmail-smtpd

       tlswrapper-smtp - TLS encryption wrapper - smtp helper

-q     Quiet mode. No error messages.

       -v     Enable verbose mode. Multiple -v options increase the verbosity. The maximum is 3.

       -tseconds
              Set the SMTP session timeout to seconds seconds. (default 600).

       -Tseconds
              Set the connect/read/write timeout to seconds seconds. (default 15).

       -uuser
              Run program prog under a specified user's uid and gid

       -ghost:port
              Enable greylist support (postgrey protocol) and use server running on host:port .

       -c     Handle communication  to  greylist  server  in  fail-closed  mode.  If  a  greylist  lookup  fails
              temporarily, tlswrapper-smtp exits with status 111.

       -C     Handle communication to greylist server in fail-open mode. If a greylist lookup fails temporarily,
              assume that the address is not greylisted (default).

       -Jjaildir
              Chroot into a specified jaildir (default: /var/lib/tlswraper/empty).

       -jjailuser
              Run under a specified jailuser's uid and gid. If unset run under random uid and gid.

       prog   program

JAIL-Privilegeseparation,filesystemisolation,limits

       The tlswrapper-smtp similarly to tlswrapper processes runs under dedicated non-zero uid to prohibit kill,
       ptrace,  etc.   Is  chrooted  into  an  empty,  unwritable directory to prohibit filesystem access.  Sets
       ulimits to prohibit new files, sockets, etc. Sets ulimits to prohibit forks.

tlswrapper(1)

                                                                                              tlswrapper-smtp(1)

tlswrapper-smtp[options]prog