IPSEC-PLUTO(8) Executable programs IPSEC-PLUTO(8)

.SH "NAME" ipsec-pluto, pluto - Internet Key Exchange daemon

.SH "SYNOPSIS"

.HP 288u

**ipsec pluto**  
\[--help]  
\[--version]

\[--nofork]  
\[--rundir *path*]  
\[--efence-protect]

\[--stderrlog]  
\[--logfile *filename*]  
\[--log-no-time]  
\[--log-no-append]  
\[--log-no-ip]  
\[--log-no-audit]

\[--config *filename*]  
\[--secretsfile *secrets-file*]  
\[--ipsecdir *dirname*]  
\[--nssdir *dirname*]  
\[--coredir *dirname*]

\[--vendorid *VID*]  
\[--uniqueids]  
\[--virtual-private *network\_list*]  
\[--keep-alive *delay\_sec*]  
\[--force-busy]  
\[--crl-strict]  
\[--crlcheckinterval]  
\[--listen *ipaddr*]  
\[--nhelpers *number*]  
\[--seedbits *numbits*]  
\[--statsbin *filename*]  
\[--secctx-attr-type *number*]

\[--use-xfrm]  
\[--use-bsdkame]

.SH "DESCRIPTION"

.PP **pluto** is Libreswan's Internet Key Exchange (IKE) daemon.

.PP **pluto** is not normally run directly. Instead the daemon is controlled the hosts [**init**(8)](/man/enterprise-packages/libreswan/init.8) system (such as [**systemd**(8)](/man/enterprise-packages/libreswan/systemd.8) or [**rc**(8)](/man/enterprise-packages/libreswan/rc.8)) or the command **ipsec** (see [**ipsec**(8)](/man/enterprise-packages/libreswan/ipsec.8)).

.PP For more general information on Libreswan see [**libreswan**(7)](/man/enterprise-packages/libreswan/libreswan.7).

.PP For information on how to configure Libreswan and the **pluto** daemon see [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5).

.SS "Help Options"

.PP **--help**

show **pluto's** usage message

.RE .PP **--version**

show Libreswan's version details

.RE

.SS "Starting pluto"

.PP When starting, **pluto** attempts to create a lockfile with the name /run/pluto/pluto.pid. If the lockfile cannot be created, **pluto** exits - this prevents multiple **pluto**s from competing. Any "leftover" lockfile must be manually removed before **pluto** will run. **pluto** then writes its *PID* into this file so that scripts can find it. **pluto** then forks and the parent exits (this is the conventional "daemon fork").

.PP The following options alter how **pluto** starts:

.PP **--nofork**

disable "daemon fork"

In addition, after the lock file and control socket are created, print the line "Pluto initialized" to standard out.

.RE .PP **--rundir path**

change the run directory from the default /run/pluto)

The run directory contains:

.PP *path*/pluto.ctl

the socket through which **whack** communicates with **pluto**

.RE .PP *path*/pluto.pid

the lockfile to prevent multiple **pluto** instances

.RE .sp

.RE .PP **--efence-protect**

enable efence protection

.RE

.SS "Logging"

.PP All logging, including diagnostics, are sent to [**syslog**(3)](/man/enterprise-packages/libreswan/syslog.3) with facility=authpriv; it decides where to put these messages. The following options alter this behaviour:

.PP **--stderrlog**

direct logging to standard error instead of a log file. When specified, overrides any logfile= setting from the configuration file, regardless of argument order.

Often combined with **--nofork** debugging **pluto**.

.RE .PP **--logfile filename**

direct logging to *filename* instead of [**syslog**(3)](/man/enterprise-packages/libreswan/syslog.3)

When *filename* is empty (**--logfile=**), any logfile= setting from the configuration file is cleared, causing **pluto** to fall back to **--stderrlog** or [**syslog**(3)](/man/enterprise-packages/libreswan/syslog.3).

See [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5) and logfile=*filename*.

.RE .PP **--log-no-time**

do not include a timestamp prefix when logging to a file

See [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5) and logtime=no.

.RE .PP **--log-no-append**

do not append to the end of an existing log file

See [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5) and logappend=no.

.RE .PP **--log-no-ip**

do not include IP addresses when logging

See [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5) and logip=no.

.RE .PP **--log-no-audit**

do not generate audit logs (on systems that support Linux Auditing)

See [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5) and audit-log=no.

.RE

.SS "Configuration Files"

.PP The following options override **pluto's** default configuration parameters:

.PP **--config filename**

specify a [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5) file containing additional configuration parameters

The "config" section of *filename* will be loaded.

Normally, **pluto** is started using **ipsec start**, and that passes the parameter **--config /etc/ipsec.conf** so that the default configuration is read.

.RE .PP **--secretsfile secrets-file**

specify the file for authentication secrets

This name is subject to "globbing" as in [**sh**(1)](/man/enterprise-packages/libreswan/sh.1), so every file with a matching name is processed. Quoting is generally needed to prevent the shell from doing the globbing.

Default is /etc/ipsec.secrets. See [**ipsec.secrets**(5)](/man/enterprise-packages/libreswan/ipsec.secrets.5).

.RE .PP **--ipsecdir dirname**

the directory containing additional configuration files

Default is /etc/ipsec.d.

.RE .PP **--nssdir dirname**

the directory containing the NSS trust store

Default is /var/lib/ipsec/nss.

.RE .PP **--coredir dirname**

the directory to write a core file should **pluto** abort

Default is /run/pluto.

.RE

.SS "Other Options"

.PP The following options tweak **pluto's** behaviour:

.PP **--vendorid VID**

.RE .PP **--uniqueids**

require all connections to have a unique identifier

If this option has been selected, whenever a new ISAKMP SA is established, any connection with the same Peer ID but a different Peer IP address is unoriented (causing all its SAs to be deleted). This helps clean up dangling SAs when a connection is lost and then regained at another IP address.

.RE .PP **--virtual-private network\_list**

Pluto supports RFC 3947 NAT-Traversal. The allowed range behind the NAT routers is submitted using the **--virtual-private** option.

See [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5) for the syntax

.RE .PP **--keep-alive delay\_sec**

The **--keep-alive** sets the delay (in seconds) of these keep-alive packets. The newer NAT-T standards support *port floating*, and Libreswan enables this per default.

.RE .PP **--force-busy**

If this option has been selected, pluto will be forced to be "busy". In this state, which happens when there is a Denial of Service attack, will force pluto to use cookies before accepting new incoming IKE packets. Cookies are send and required in ikev1 Aggressive Mode and in ikev2. This option is mostly used for testing purposes, but can be selected by paranoid administrators as well.

.RE .PP **--crl-strict**

reject authentication using X.509 until a valid certificate revocation list has been loaded

.RE .PP **--crlcheckinterval**

.RE .PP **--listen ipaddr**

.RE .PP **--nhelpers number**

specify the number of threads to use when offloading cryptographic operations

Pluto can also use helper children to off-load cryptographic operations. This behavior can be fine tuned using the **--nhelpers**. Pluto will start *(n-1)* of them, where *n* is the number of CPU's you have (including hypherthreaded CPU's). A value of *0* forces pluto to do all operations in the main process. A value of *-1* tells pluto to perform the above calculation. Any other value forces the number to that amount.

See [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5) and nhelpers=*number*.

.RE .PP **--seedbits numbits**

specify the number of seed bits to read from the RNG before starting

Pluto uses the NSS crypto library as its random source. Some government Three Letter Agency requires that pluto reads 440 bits from /dev/random and feed this into the NSS RNG before drawing random from the NSS library, despite the NSS library itself already seeding its internal state. As this process can block pluto for an extended time, the default is to not perform this redundant seeding. The **--seedbits** option can be used to specify the number of bits that will be pulled from /dev/random and seeded into the NSS RNG.

See [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5) and seedbits=*number*.

This option should not be used by most people.

.RE .PP **--statsbin filename**

.RE .PP **--secctx-attr-type number**

.RE

.PP **Libreswan** supports different IPstacks on different operating systems. Since most IPstacks have died the list is very short:

.PP **--use-xfrm**

linux only

.RE .PP **--use-bsdkame**

BSD only

.RE

.SS "Debugging"

.PP Very occasionally it is necessary to enable debugging early in **pluto's** startup process. The follow options enable this:

.PP **--debug help** (whack only)

List the debugging classes recognised by **pluto**.

.RE

.PP **--debug none**

Disable logging for all debugging classes.

.RE

.PP **--debug class**  
**--no-debug class**  
**--debug no-class**

Enable (disable) logging of the specified debugging *class*.

.RE

.PP For more details, see **plutodebug=** in [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5).

.SH "SIGNALS"

.PP **pluto** responds to **SIGHUP** by issuing a suggestion that **ipsec listen** might have been intended.

.PP **pluto** exits when it receives **SIGTERM**.

.SH "EXIT STATUS"

.PP **pluto** normally forks a daemon process, so the exit status is a very preliminary result.

.PP **0**

means that all is OK so far.

.RE

.PP **1**

means that something was wrong.

.RE

.PP **10**

means that the lock file already exists.

.RE

.SH "FILES"

.PP /run/pluto/pluto.pid /run/pluto/pluto.ctl /etc/ipsec.secrets /etc/ipsec.conf

.SH "ENVIRONMENT"

.PP **pluto** does not use any environment variables.

.SH "SEE ALSO"

.PP The rest of the Libreswan distribution, in particular [**libreswan**(7)](/man/enterprise-packages/libreswan/libreswan.7).

.SH "HISTORY"

.PP This code is released under the GPL terms. See the accompanying files CHANGES COPYING and CREDITS.* for more details.

.PP Detailed history (including FreeS/WAN and Openswan) can be found in the docs/ directory.

.SH "BUGS"

.PP Please see **https://github.com/libreswan/libreswan/issues** for a list of currently known bugs and missing features.

.SH "AUTHOR"

Andrew Cagney, Anish Singh Rawat, Antony Antony, Daniel Kahn Gillmor, D. Hugh Redelmeier, Harald Jenny, Jose Quaresma, Matt Rogers, Max-Julian Pogner, Michael Richardson, Paul Wouters, Pietro Monteiro, Simon Deziel, Tuomo Soini, Vinayak Sandur, Vukasin Karadzic

10/06/2026 Libreswan v5.4.1-HEAD

---

Document: ipsec-pluto(8) from libreswan 5.4.1-r0 (Chainguard OS)
Source: https://github.com/libreswan/libreswan