rfkill

package: rfkill

title: rfkill(8)

text:
# rfkill(8)

## NAME
rfkill - tool for enabling and disabling wireless devices

## SYNOPSIS
rfkill [options] [command] [ID|type ...]

## DESCRIPTION
rfkill lists, enabling and disabling wireless devices.

The command "list" output format is deprecated and maintained for backward compatibility only. The new output format is the default when no command is specified or when the option --output is used.

The default output is subject to change. So whenever possible, you should avoid using default outputs in your scripts. Always explicitly define expected columns by using the --output option together with a columns list in environments where a stable output is required.

## OPTIONS
-J, --json

Use JSON output format.

-n, --noheadings

Do not print a header line.

-o, --output

Specify which output columns to print. Use --help to get a list of available columns.

--output-all

Output all available columns.

-r, --raw

Use the raw output format.

-h, --help

Display help text and exit.

-V, --version

Print version and exit.

## COMMANDS
help

Display help text and exit.

event

Listen for rfkill events and display them on stdout.

list [id|type ...]

List the current state of all available devices. The command output format is deprecated, see the DESCRIPTION section. It is a good idea to check with list command id or type scope is appropriate before setting block or unblock. Special all type string will match everything. Use of multiple ID or type arguments is supported. Possible types are all, {wlan | wifi}, bluetooth, {uwb | ultrawideband}, wimax, wwan, gps, fm, nfc.

block id|type [...]

Disable the corresponding device.

unblock id|type [...]

Enable the corresponding device. If the device is hard-blocked, for example via a hardware switch, it will remain unavailable though it is now soft-unblocked.

toggle id|type [...]

Enable or disable the corresponding device.

## EXAMPLE

```
  rfkill --output ID,TYPE

  rfkill block all

  rfkill unblock wlan

  rfkill block bluetooth uwb wimax wwan gps fm nfc
```

## AUTHORS
rfkill was originally written by Johannes Berg <johannes@sipsolutions.net> and Marcel Holtmann <marcel@holtmann.org>. The code has been later modified by Sami Kerola <kerolasa@iki.fi> and Karel Zak <kzak@redhat.com> for the util-linux project.

This manual page was written by Darren Salt <linux@youmustbejoking.demon.co.uk> for the Debian project (and may be used by others).

## SEE ALSO
powertop(8), systemd-rfkill(8), Linux kernel documentation <https://docs.kernel.org/driver-api/rfkill.html>

## REPORTING BUGS
For bug reports, use the issue tracker at <https://github.com/util-linux/util-linux/issues>.

## AVAILABILITY
The rfkill command is part of the util-linux package which can be downloaded from Linux Kernel Archive <https://www.kernel.org/pub/linux/utils/util-linux/>.


rinetd

package: rinetd

title: rinetd(8)

summary: internet

text:
# rinetd(8)

## NAME
rinetd — internet “redirection server”

## SYNOPSIS
/usr/sbin/rinetd

## VERSION
Version 0.62+syslog+bind, 04/14/2003.

## DESCRIPTION
rinetd redirects TCP connections from one IP address and port to another. rinetd is a single-process server which handles any number of connections to the address/port pairs specified in the file /etc/rinetd.conf. Since rinetd runs as a single process using nonblocking I/O, it is able to redirect a large number of connections without a severe impact on the machine. This makes it practical to run TCP services on machines inside an IP masquerading firewall. rinetd does not redirect FTP, because FTP requires more than one socket.

rinetd is typically launched at boot time, using the following syntax:

/usr/sbin/rinetd

The configuration file is found in the file /etc/rinetd.conf, unless another file is specified using the -c command line option.

## FORWARDING RULES
Most entries in the configuration file are forwarding rules. The format of a forwarding rule is as follows:

bindaddress bindport connectaddress connectport [sourceaddress]

For example:

206.125.69.81 80 10.1.1.2 80

Would redirect all connections to port 80 of the "real" IP address 206.125.69.81, which could be a virtual interface, through rinetd to port 80 of the address 10.1.1.2, which would typically be a machine on the inside of a firewall which has no direct routing to the outside world.

Although responding on individual interfaces rather than on all interfaces is one of rinetd's primary features, sometimes it is preferable to respond on all IP addresses that belong to the server. In this situation, the special IP address 0.0.0.0 can be used. For example:

0.0.0.0 23 10.1.1.2 23

Would redirect all connections to port 23, for all IP addresses assigned to the server. This is the default behavior for most other programs.

Service names can be specified instead of port numbers. On most systems, service names are defined in the file /etc/services.

Both IP addresses and hostnames are accepted for bindaddress and connectaddress.

The optional sourceaddress can be used to bind to a specific local address for the outgoing connection.

## ALLOW AND DENY RULES
Configuration files can also contain allow and deny rules.

Allow rules which appear before the first forwarding rule are applied globally: if at least one global allow rule exists, and the address of a new connection does not satisfy at least one of the global allow rules, that connection is immediately rejected, regardless of any other rules.

Allow rules which appear after a specific forwarding rule apply to that forwarding rule only. If at least one allow rule exists for a particular forwarding rule, and the address of a new connection does not satisfy at least one of the allow rules for that forwarding rule, that connection is immediately rejected, regardless of any other rules.

Deny rules which appear before the first forwarding rule are applied globally: if the address of a new connection satisfies any of the global deny rules, that connection is immediately rejected, regardless of any other rules.

Deny rules which appear after a specific forwarding rule apply to that forwarding rule only. If the address of a new connection satisfies any of the deny rules for that forwarding rule, that connection is immediately rejected, regardless of any other rules.

The format of an allow rule is as follows:

allow pattern

Patterns can contain the following characters: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, . (period), ?, and *. The ? wildcard matches any one character. The * wildcard matches any number of characters, including zero.

For example:

allow 206.125.69.*

This allow rule matches all IP addresses in the 206.125.69 class C domain.

Host names are NOT permitted in allow and deny rules. The performance cost of looking up IP addresses to find their corresponding names is prohibitive. Since rinetd is a single process server, all other connections would be forced to pause during the address lookup.

## LOGGING
rinetd is able to produce a log output in three ways: tab-delimited , web server-style "common log format." both are file-based or as syslog output.

By default, rinetd does not produce a log file. To activate logging, add the following line to the configuration file:

logfile log-file-location

Example: logfile /var/log/rinetd.log

By default, rinetd logs in a simple tab-delimited format containing the following information:

Date and time

Client address

Listening host

Listening port

Forwarded-to host

Forwarded-to port

Bytes received from client

Bytes sent to client

Result message

To activate web server-style "common log format" logging, add the following line to the configuration file:

logcommon

to activate syslog output enter the following line to the configuration file:

syslog facility priority

Example1:

syslog local0 info

in this case all output is logged to the destination configured in your syslogd config for facility local0 and priority info

Example2:

syslog

in this case everything goes to daemon info

Example3:

syslog wrongfacility wrongpriority

logging to default: daemon info

If configured, the local source address is given in square brackets after the "listening host" entry.

## COMMAND LINE OPTIONS
The -c command line option is used to specify an alternate configuration file.

The -h command line option produces a short help message.

The -v command line option displays the version number.

## REINITIALIZING RINETD
The kill -1 signal (SIGHUP) can be used to cause rinetd to reload its configuration file without interrupting existing connections. Under Linux™ the process id is saved in the file /var/run/rinetd.pid to facilitate the kill -HUP. An alternate filename can be provided by using the pidlogfile configuration file option.

## LIMITATIONS
rinetd redirects TCP connections only. There is no support for UDP. rinetd only redirects protocols which use a single TCP socket. This rules out FTP.

## BUGS
The server redirected to is not able to identify the host the client really came from. This cannot be corrected; however, the log produced by rinetd provides a way to obtain this information. Under Unix, Sockets would theoretically lose data when closed with SO_LINGER turned off, but in Linux this is not the case (kernel source comments support this belief on my part). On non-Linux Unix platforms, alternate code which uses a different trick to work around blocking close() is provided, but this code is untested. The logging is inadequate. The duration of each connection should be logged.

## LICENSE
Copyright (c) 1997, 1998, 1999, Thomas Boutell and Boutell.Com, Inc. This software is released for free use under the terms of the GNU Public License, version 2 or higher. NO WARRANTY IS EXPRESSED OR IMPLIED. USE THIS SOFTWARE AT YOUR OWN RISK.

## CONTACT INFORMATION
See http://www.boutell.com/rinetd/ for the latest release. Thomas Boutell can be reached by email: boutell@boutell.com

Logging to syslog added by SuSE. Sourceaddress extension added by Lutz Pressler <lp@SerNet.DE>.

## THANKS
Thanks are due to Bill Davidsen, Libor Pechachek, Sascha Ziemann, the Apache Group, and many others who have contributed advice and/or source code to this and other free software projects.


rinse

package: rinse

title: rinse(8)

summary: RPM Installation Entity.

text:
# rinse(8)

## NAME
rinse - RPM Installation Entity.

## SYNOPSIS

```
  rinse [options]
  Help Options:
   --help     Show help information.
   --manual   Read the manual for this script.
   --version  Show the version information and exit.
  Mandatory Options:
   --directory    The directory to install the distribution within.
   --distribution The distribution to install.
  Customization Options:
   --add-pkg-list        Additional packages to download and install
   --after-post-install  Additionally run the specified script after
                         the post install script.
   --before-post-install Additionally run the specified script before
                         the post install script.
   --post-install        Run the given post-install script instead of the
                         default files in /usr/share/rinse/$distro
  Misc Options:
   --arch                Specify the architecture to install.
   --cache               Should we use a local cache?  (Default is 1)
   --cache-dir           Specify the directory we should use for the cache.
   --clean-cache         Clean our cache of .rpm files.
   --config              Specify a different configuration file.
                         (Default is /etc/rinse/rinse.conf)
   --pkgs-dir            Specify a different directory containing
                         <distribution>.packages files.
   --list-distributions  Show installable distributions.
   --print-uris          Only show the RPMs which should be downloaded.
                         default files in /usr/share/rinse/$distro
```

## OPTIONS
--arch Specify the architecture to install. Valid choices are 'amd64' and 'i386' only.

--add-pkg-list Add a list of additional packages.

--cache Specify whether to cache packages (1) or not (0).

--cache-dir Specify the directory we should use for the cache.

--clean-cache Remove all cached .rpm files.

--directory Specify the directory into which the distribution should be installed.

--distribution Specify the distribution to be installed.

--help Show help information.

--list-distributions Show the distributions which are installable.

--manual Read the manual for this script.

--print-uris Only show the files we would download, don't actually do so.

--version Show the version number and exit.

## DESCRIPTION

```
  rinse is a simple script which is designed to be able to install
 a minimal working installation of an RPM-based distribution into
 a directory.
  The tool is analogous to the standard Debian GNU/Linux debootstrap
 utility.
```

## USAGE

```
  To use this script you will need to be root.  This is required
 to mount /proc, run chroot, and more.
  Basic usage is as simple as:
```

```
   rinse --distribution fedora-core-6 --directory /tmp/test
```

```
  This will download the required RPM files and unpack them into
 a minimal installation of Fedora Core 6.
  To see which RPM files would be downloaded, without actually
 performing an installation or downloading anything, then you
 may run the following:
```

```
   rinse --distribution fedora-core-6 --print-uris
```

## TODO

```
  Short of supporting more distributions or architectures there aren't
 really any outstanding issues.
```

## AUTHOR

```
 Steve
 --
 http://www.steve.org.uk/
```

## LICENSE
Copyright (c) 2007-2008 by Steve Kemp. All rights reserved.

This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. The LICENSE file contains the full text of the license.


rkhunter

package: rkhunter

title: rkhunter(8)

summary: RootKit Hunter

text:
# rkhunter(8)

## NAME
rkhunter - RootKit Hunter

## SYNOPSIS
rkhunter {--check | --unlock | --update | --versioncheck |

--propupd [{filename | directory | package name},...] |

--list [tests | {lang | languages} | rootkits | perl |

propfiles] |

--config-check | --version | --help} [options]

## DESCRIPTION
rkhunter is a shell script which carries out various checks on the local system to try and detect known rootkits and malware. It also performs checks to see if commands have been modified, if the system startup files have been modified, and various checks on the network interfaces, including checks for listening applications.

rkhunter has been written to be as generic as possible, and so should run on most Linux and UNIX systems. It is provided with some support scripts should certain commands be missing from the system, and some of these are perl scripts. rkhunter does require certain commands to be present for it to be able to execute. Additionally, some tests require specific commands, but if these are not present then the test will be skipped. rkhunter needs to be run under a Bourne-type shell, typically bash or ksh. rkhunter can be run as a cron job or from the command-line.

## COMMAND OPTIONS
If no command option is given, then --help is assumed. rkhunter will set the exit code to zero if there are no errors or warnings, otherwise it is set to one. Some options may cause a different non-zero exit code to be set. The option descriptions below will indicate if they do this.

-c, --check

This command option tells rkhunter to perform various checks on the local system. The result of each test will be displayed on stdout. If anything suspicious is found, then a warning will be displayed. A log file of the tests and the results will be automatically produced. It is suggested that this command option is run regularly in order to ensure that the system has not been compromised.

--unlock

This command option simply unlocks (removes) the lock file. If this option is used on its own, then no log file is created.

--update

This command option causes rkhunter to check if there is a later version of any of its text data files. A command-line web browser, for example wget or lynx, must be present on the system when using this option. It is suggested that this command option is run regularly in order to ensure that the data files are kept up to date.

If this option is used via cron, then it is recommended that the --nocolors option is also used.

An exit code of zero for this command option means that no updates were available. An exit code of one means that a download error occurred, and a code of two means that no error occurred but updates were available and have been installed.

NOTE: This option does NOT update the rkhunter command. It only updates the data files used by rkhunter.

--propupd [{filename | directory | package name},...]

One of the checks rkhunter performs is to compare various current file properties of various commands, against those it has previously stored. This command option causes rkhunter to update its data file of stored values with the current values. If the filename option is used, then it must either be a full pathname, or a plain file name (for example, 'awk'). When used, then only the entry in the file properties database for that entry will be updated. If the directory option is used, then only those entries listed in the database that are in the given directory will be updated. Similarly, if the package name option is used, then only those entries in the database which are part of the specified package will be updated. The package name must be the base part of the name, no version numbers should be included - for example, 'coreutils'. Package names will, of course, only be stored in the file properties database if a package manager is being used. If a package name is the same as a file name - for example, 'file' could refer to the 'file' command or to the RPM 'file' package (which contains the 'file' command) - the package name will be used.

If no specific option is given, then the entire database is updated. If multiple options are given, then they must be separated by a single comma (',') character.

WARNING: It is the users responsibility to ensure that the files on the system are genuine and from a reliable source. rkhunter can only report if a file has changed, but not on what has caused the change. Hence, if a file has changed, and the --propupd command option is used, then rkhunter will assume that the file is genuine.

--versioncheck

This command option causes rkhunter to check if there is a later version of the program. A command-line web browser must be present on the system when using this option. If this option is used via cron, then it is recommended that the --nocolors option is also used.

An exit code of zero for this command option means that no new version was available. An exit code of one means that an error occurred downloading the latest version number, and a code of two means that no error occurred but a new version is available.

--list [tests | {lang | languages} | rootkits | perl | propfiles]

This command option will list some of the supported capabilities of the program, and then exit. The tests option lists the currently available test names (see the README file for more details about test names). The languages option lists the currently available languages, and the rootkits option lists the rootkits that are searched for by rkhunter. The perl option lists the installation status of the perl command and perl modules that may be used by some of the tests. Note that it is not required to install these modules. However, if rkhunter is forced to use perl to execute a test then the module must be present. The propfiles option will list the file names that are used to generate the file properties database. If no specific option is given, then all the lists, except for the file properties database, are displayed.

-C, --config-check

This command option causes rkhunter to check its configuration file(s), and then exit. The program will run through its normal configuration checks as specified by the enable and disable options on the command-line and in the configuration files. That is, only the configuration options for tests which would normally run are checked. In order to check all the configured options, then use the --enable all --disable none options on the command line. Additionally, the program will check to see if there are any unrecognised configuration options. If any configuration problems are found, then they will be displayed, unless the --quiet option is used, and the return code will be set to one. No output is written to the log file when this command option is used.

It is suggested that this option is used whenever the configuration file(s) have been changed.

-V, --version

This command option causes rkhunter to display its version number, and then exit.

-h, --help

This command option displays the help screen menu, and then exits.

## OPTIONS
rkhunter uses a configuration file, named rkhunter.conf, for many of its configuration options. It can also use a local configuration file, named rkhunter.conf.local, and a directory named rkhunter.d if it is present. Both the local configuration file, and the local directory, must be in the same directory as the main configuration file. The installer does not create the local file or directory, but one, or both, can be created by the user if required. If a directory is used, then within the directory any file ending in .conf will be treated as a local configuration file.

Some options can also be specified on the command-line, and these will override the equivalent configuration file options. The configuration file options are well documented within the main configuration file itself. The following are the command-line options. The defaults mentioned here are the program defaults, unless explicitly stated as the configuration file default.

--append-log

By default a new log file will be created when rkhunter runs, and the previous log file will be renamed by having .old appended to its name. This option tells rkhunter to append to the existing log file. If the log file does not exist, then it will be created.

--bindir <directory>...

This option modifies which directories rkhunter looks in to find the various commands it requires (that is, its PATH). The default is the root PATH, and an internal list of some common command directories. By default a specified directory will be appended to the default list. However, if the directory name begins with the '+' character, then it will be prepended to the list (that is, it will be put at the start of the list).

--cloe, --copy-log-on-error

This option tells rkhunter to take a copy of the current log file if an error or warning occurs during an rkhunter check. The copied log file will have the date and time appended to its name.

--cs2, --color-set2

By default rkhunter will display its test results in color. The colors used are green for successful tests, red for failed tests (warnings), and yellow for skipped tests. These colors are visible when a black background is used, but are difficult to see on a white background. This option tells rkhunter to use a different color set which is more suited to a white background.

--configfile <file>

The installation process will automatically tell rkhunter where its configuration file is located. However, if necessary, this option can be used to specify a different pathname. If a local configuration file, or directory, is to be used, then it must reside in the same directory as the configuration file specified by this option.

--cronjob

This is similar to the --check command option, but it disables several of the interactive options. When this option is used --check, --nocolors and --skip-keypress are assumed. By default no output is sent to stdout, so the --report-warnings-only option may be useful with this option.

--dbdir <directory>

The installation process will automatically configure where the data files are stored for rkhunter. However, if necessary, this option can be used to specify a different directory. The directory can be read-only, after installation, provided that neither of the --update or --propupd options are specified, and that the --versioncheck option is not specified if ROTATE_MIRRORS is set to 1 in the configuration file.

--debug

This is a special option mainly for the developers. It produces no output on stdout. Regular logging will continue as per default or as specified by the --logfile option, and the debug output will be in a randomly generated filename which starts with /tmp/rkhunter-debug.

--disable <test>[,<test>...]

This option tells rkhunter not to run the specified tests. Read the README file for more information about test names. By default no tests are disabled.

--display-logfile

This option will cause the logfile to be displayed on the screen once rkhunter has finished.

--enable <test>[,<test>...]

This option tells rkhunter to only run the specified tests. If only one test name, other than all, is given, then the --skip-keypress option is assumed. Read the README file for more information about test names. By default all tests are enabled. All the test names are listed below under TESTS.

--hash {MD5 | SHA1 | SHA224 | SHA256 | SHA384 | SHA512 |

NONE | <command>}

Both the file properties check and the --propupd command option will use a hash function to determine a files current hash value. This option tells rkhunter which hash function to use. The MD5 and SHA options will look for the relevant command, and, if not found, a perl support script will then be used to see if a perl module supporting the function has been installed. Alternatively, a specific command may be specified. A value of NONE can be used to indicate that the hash values should not be obtained or used as part of the file properties check. The default is SHA256. Systems using prelinking must use either MD5, SHA1 or NONE.

--lang, --language <language>

This option specifies which language to use for the displayed tests and results. The currently supported languages can be seen by the --list command option. The default is en (English). If a message to be displayed cannot be found in the language file, then the English version will be used. As such, the English language file must always be present. The --update command option will update the language files when new versions are available.

-l, --logfile [file]

By default rkhunter will write out a log file. The default location of the file is /var/log/rkhunter.log. However, this location can be changed by using this option. If /dev/null is specified as the log file, then no log file will be written. If no specific file is given, then the default will be used. By default rkhunter will create a new log file each time it is run. Any previously existing logfile is moved out of the way, and has .old appended to it.

--noappend-log

This option reverts rkhunter to its default behaviour of creating a new log file rather than appending to it.

--nocf

This option is only valid when the command-line --disable option is used. When the --disable option is used, by default, the configuration file option to disable tests is also used to determine which tests to run. If only the --disable option is to be used to determine which tests to run, then --nocf must be given.

--nocloe, --no-copy-log-on-error

This option tells rkhunter not to take a copy of the log file, even if an error or warning occurs during an rkhunter check. This is the configuration file default.

--nocolors

This option causes the result of each test to not be displayed in a specific color. The default color, usually the reverse of the background color, will be used (typically this is just black and white).

--nolog

This option tells rkhunter not to write anything to a log file.

--nomow, --no-mail-on-warning

The configuration file has an option which will cause a simple email message to be sent to a user should rkhunter detect any warnings during system checks. This command-line option overrides the configuration file option, and prevents an email message from being sent. The configuration file default is not to email a message.

--ns, --nosummary

When the --check command option is used, by default a short summary of results is displayed at the end. This option prevents the summary from being displayed.

--novl, --no-verbose-logging

During some tests rkhunter will log a lot of information. Use of this option reduces the amount of logging, and so can improve the performance of rkhunter. However, the log file will contain less information should any warnings occur. By default verbose logging is enabled.

--pkgmgr {RPM | DPKG | BSD | BSDng | SOLARIS | NONE}

This option is used during the file properties check or when the --propupd command option is given. It tells rkhunter that the current file property values should be obtained from the relevant package manager. See the README file for more details of this option. The default is NONE, which means not to use a package manager.

-q, --quiet

This option tells rkhunter not to display any output. It can be useful when only the exit code is going to be checked. Other options may be used with this one, to force only specific items to be displayed.

--rwo, --report-warnings-only

This option causes only warning messages to be displayed. This can be useful when rkhunter is run via cron. Other options may be used to force other items of information to be displayed. This option will override the -q option.

--shell

If a non-Bash and non-Korn shell is used, then rkhunter will try and switch to one of those shells (the log file will record this). The program will stop if neither shell is found. This option will prevent rkhunter from trying to switch shells. Although this option should not generally be used, it does allow users with restrictive systems to try and get rkhunter to run with other shells.

--sk, --skip-keypress

When the --check command option is used, after certain sections of tests, the user will be prompted to press the return key in order to continue. This option disables that feature, and rkhunter will run until all the tests have completed. If this option has not been given, and the user is prompted to press the return key, a single 's' character, in upper- or lowercase, may be given followed by the return key. rkhunter will then continue the tests without prompting the user again (as if this option had been given).

--summary

This option will cause the summary of test results to be displayed. This is the default. Specifying this option will cause it to override the -q option.

--syslog [facility.priority]

When the --check command option is used, this option will cause the start and finish times to be logged to syslog. The default is not to log anything to syslog, but if the option is used, then the default level is authpriv.notice.

--tmpdir <directory>

The installation process will automatically configure where temporary files are to be created. However, if necessary, this option can be used to specify a different directory. The directory must not be a symbolic link, and must be secure (root access only).

--vl, --verbose-logging

This option tells rkhunter that when it runs some tests, it should log as much information as possible. This can be useful when trying to diagnose why a warning has occurred, but it obviously also takes more time. The default is to use verbose logging.

-x, --autox

When this option is used, rkhunter will try and detect if the X Window system is in use. If it is in use, then the second color set will automatically be used (see the --color-set2 option). This allows rkhunter to be run on, for example, a server console (where X is not present, so the default color set should be used), and on a users terminal (where X is in use, so the second color set should be used). In both cases rkhunter will use the correct color set. The configuration file default is to try and detect X.

-X, --no-autox

This option prevents rkhunter from automatically detecting if the X Window system is being used. See the --autox option.

## TESTS
[This section to be written]

additional_rkts

This test is for SHORT_EXPLANATION. It works as part of GROUP. Corresponding configuration file entries: ONE=one, TWO=two and for white-listing THREE=three,three. Simple globbing (/dev/shm/file-*) works.

all

apps

attributes

avail_modules

deleted_files

filesystem

group_accounts

group_changes

hashes

hidden_ports

hidden_procs

immutable

known_rkts

loaded_modules

local_host

malware

network

none

os_specific

other_malware

packet_cap_apps

passwd_changes

ports

possible_rkt_files

possible_rkt_strings

promisc

properties

rootkits

running_procs

scripts

shared_libs

shared_libs_path

startup_files

startup_malware

strings

suspscan

system_commands

system_configs

trojans

## EXIT STATUS
If there was an error or warning from whatever command option rkhunter was running, then the exit status will be 1. When there are no errors or warnings the exit status will be 0, but some options (see below) may modify this meaning slightly or may set an exit status of 2.

The --update command option will set an exit status of 2 if there was no error but updates were installed. An exit status of 0 means that there was no error and no updates required.

The --versioncheck command option will set an exit status of 2 if there was no error but a new version is available. An exit status of 0 means that there was no error and no new version available.

When multiple command options are specified on the same command-line, an exit status of 1 takes priority over any subsequent exit status. Where applicable, an exit status of 2 will only be set if the exit status is currently 0. That is, 2 will only be set if there have been no errors or warnings from any previously actioned command option.

## FILES
(For a default installation)

/etc/rkhunter.conf

/var/log/rkhunter.log

## SEE ALSO
See the CHANGELOG file for recent changes.

The README file has information about installing rkhunter, as well as specific sections on test names and using package managers.

The FAQ file should also answer some questions.

## LICENSING
RootKit Hunter is licensed under the GNU GPL license, copyright (C) Michael Boelen. See the LICENSE file for details of GPL licensing.

## CONTACT INFORMATION
This software was developed by the RootKit Hunter project team. To report bugs, patches, comments and questions, please go to: https://rkhunter.sourceforge.io/


rmt

package: rmt

title: rmt(8)

summary: remote magtape protocol module

text:
# rmt(8)

## NAME
rmt - remote magtape protocol module

## SYNOPSIS
rmt

## DESCRIPTION
Rmt is a program used by the remote dump(8), restore(8) or tar(1) programs in manipulating a magnetic tape drive through an interprocess communication connection. Rmt is normally started up with an rexec(3) or rcmd(3) call.

The rmt program accepts requests specific to the manipulation of magnetic tapes, performs the commands, then responds with a status indication. All responses are in ASCII and in one of the following two forms.

Successful commands have responses of:

Anumber\n

where number is an ASCII representation of a decimal number.

Unsuccessful commands are responded to with:

Eerror-number\nerror-message\n

where error-number is one of the possible error numbers described in intro(2) and error-message is the corresponding error string as printed from a call to perror(3).

The protocol is comprised of the following commands, which are sent as indicated - no spaces are supplied between the command and its arguments, or between its arguments, and \n indicates that a newline should be supplied:

Odevice\nmode\n

Open the specified device using the indicated mode. Device is a full pathname and mode is an ASCII representation of a decimal number suitable for passing to open(2). If a device had already been opened, it is closed before a new open is performed.

Cdevice\n

Close the currently open device. The device specified is ignored.

Lwhence\noffset\n

Perform an lseek(2) operation using the specified parameters. The response value is that returned from the lseek call.

Wcount\n

Write data onto the open device. Rmt reads count bytes from the connection, aborting if a premature end-of-file is encountered. The response value is that returned from the write(2) call.

Rcount\n

Read count bytes of data from the open device. If count exceeds the size of the data buffer (10 kilobytes), it is truncated to the data buffer size. Rmt then performs the requested read(2) and responds with Acount-read\n if the read was successful; otherwise an error in the standard format is returned. If the read was successful, the data read is then sent.

Ioperation\ncount\n

Perform a MTIOCOP ioctl(2) command using the specified parameters. The parameters are interpreted as the ASCII representations of the decimal values to place in the mt_op and mt_count fields of the structure used in the ioctl call. The return value is the count parameter when the operation is successful.

By issuing the I-1\n0\n command, a client will specify that he is using the VERSION 1 protocol.

For a VERSION 0 client, the operation parameter is the platform mt_op value (could be different if the client and the rmt server are on two different platforms). For a VERSION 1 client, the operation parameter is standardized as below:

0

Issue a MTWEOF command (write count end-of-file records).

1

Issue a MTFSF command (forward space over count file marks).

2

Issue a MTBSF command (backward space over count file marks).

3

Issue a MTFSR command (forward space count inter-record gaps).

4

Issue a MTBSR command (backward space count inter-record gaps).

5

Issue a MTREW command (rewind).

6

Issue a MTOFFL command (rewind and put the drive offline).

7

Issue a MTNOP command (no operation, set status only).

ioperation\ncount\n

Perform an extended MTIOCOP ioctl(2) command using the specified parameters. The parameters are interpreted as the ASCII representations of the decimal values to place in the mt_op and mt_count fields of the structure used in the ioctl call. The return value is the count parameter when the operation is successful. The possible operations are:

0

Issue a MTCACHE command (switch cache on).

1

Issue a MTNOCACHE command (switch cache off).

2

Issue a MTRETEN command (retension the tape).

3

Issue a MTERASE command (erase the entire tape).

4

Issue a MTEOM command (position to end of media).

5

Issue a MTNBSF command (backward space count files to BOF).

S

Return the status of the open device, as obtained with a MTIOCGET ioctl call. If the operation was successful, an “ack” is sent with the size of the status buffer, then the status buffer is sent (in binary, which is non-portable between different platforms).

ssub-command

This is a replacement for the previous S command, portable across different platforms. If the open device is a magnetic tape, return members of the magnetic tape status structure, as obtained with a MTIOCGET ioctl call. If the open device is not a magnetic tape, an error is returned. If the MTIOCGET operation was successful, the numerical value of the structure member is returned in decimal. The following sub commands are supported:

T

return the content of the structure member mt_type which contains the type of the magnetic tape device.

D

return the content of the structure member mt_dsreg which contains the "drive status register".

E

return the content of the structure member mt_erreg which contains the "error register". This structure member must be retrieved first because it is cleared after each MTIOCGET ioctl call.

R

return the content of the structure member mt_resid which contains the residual count of the last I/O.

F

return the content of the structure member mt_fileno which contains the file number of the current tape position.

B

return the content of the structure member mt_blkno which contains the block number of the current tape position.

f

return the content of the structure member mt_flags which contains MTF_ flags from the driver.

b

return the content of the structure member mt_bf which contains the optimum blocking factor.

Any other command causes rmt to exit.

## DIAGNOSTICS
All responses are of the form described above.

## SEE ALSO
rcmd(3), rexec(3), /usr/include/sys/mtio.h, rdump(8), rrestore(8)

## BUGS
People should be discouraged from using this for a remote file access protocol.

## AUTHOR
The dump/restore backup suit was ported to Linux's Second Extended File System by Remy Card <card@Linux.EU.Org>. He maintained the initial versions of dump (up and including 0.4b4, released in january 1997).

Starting with 0.4b5, the new maintainer is Stelian Pop <stelian@popies.net>.

## AVAILABILITY
The dump/restore backup suit is available from <http://dump.sourceforge.net>

## HISTORY
The rmt command appeared in 4.2BSD.


rngd

package: rng-tools

title: rngd(8)

text:
# rngd(8)

## NAME
rngd - Check and feed random data from hardware device to kernel random device

## SYNOPSIS
rngd [-b, --background] [-f, --foreground] [-d, --debug] [-l, --list] [-x, --exclude] [-n, --include] [-O, --option] [-i, --ignorefail] [-o, --random-device=file] [-p, --pid-file=file] [-r, --rng-device=file] [-s, --random-step=nnn] [-t, --test] [-W, --fill-watermark=nnn] [-R, --force-reseed=nnn] [-q, --quiet] [-?, --help] [-V, --version]

## DESCRIPTION
This daemon feeds data from a random number generator to the kernel's random number entropy pool, after first checking the data to ensure that it is properly random.

The -f or --foreground options can be used to tell rngd to avoid forking on startup. This is typically used for debugging. The -b or --background options, which fork and put rngd into the background automatically, are the default.

The -r or --rng-device options can be used to select an alternate source of input, besides the default /dev/hwrng. The -o or --random-device options can be used to select an alternate entropy output device, besides the default /dev/random. Note that this device must support the Linux kernel /dev/random ioctl API.

## OPTIONS
-b, --background

Become a daemon (default)

-f, --foreground

Do not fork and become a daemon

-d, --debug

Enable debug messages

-l, --list

List the indexes and names of available entropy sources. Exit code when listing sources is 0 if at least 1 entropy source was found and initialized, 1 otherwise.

-x, --exclude

Disable entropy sources based on index or (shortname) reported from --list option

-n, --include

Enable entropy sources based on index or (shortname) reported from --list option

-O, --option

Provide specific config options to individual entropy sources, in the format --option [index|shortname]:key:value. See Entropy Sources section below for indices and source specific options. Note that specifying -O [<index>|<shortname>] will print the available options for that index to the console

-p file, --pid-file=file

File used for recording daemon PID, and multiple exclusion (default: /var/run/rngd.pid)

-i, --ignorefail

Ignore repeated fips failures

-o file, --random-device=file

Kernel device used for random number output (default: /dev/random)

-r file, --rng-device=file

Kernel device used for random number input (default: /dev/hwrng)

-s nnn, --random-step=nnn

Number of bytes written to random-device at a time (default: 64)

-t, --test

Enter test mode. In this mode (which implies -f), all generated entropy is discarded and rngd reports the amount of entropy generated every second

-e nnn, --entropy-count=nnn

Number of bits to consider random when adding entropy. 1<=e<=8 (default: 8)

-W n, --fill-watermark=nnn

Once we start doing it, feed entropy to random-device until at least fill-watermark bits of entropy are available in its entropy pool. By default, this value is set to 75% of the entropy pool size or 2048 bits if the entropy pool size couldn't be determined. Setting this too high will cause rngd to dominate the contents of the entropy pool. Low values will hurt system performance during entropy starves. Do not set fill-watermark above the size of the entropy pool (usually 4096 bits). A value of 0 to this option will cause no watermark to be set.

-R n, --force-reseed=nnn

For newer kernels which support non-blocking entropy pools, it is still beneficial to periodically add fresh entropy as a reseeding event. --force-reseed defines the number of seconds between which fresh entropy is added to the kernel entropy pool. Defaults to 5 minutes.

-q, --quiet

Suppress all messages

-?, --help

Give a short summary of all program options.

-V, --version

Print program version

## ENTROPY SOURCES

Rngd is made up of multiple entropy sources, the data from which is aggregated and fed into the kernels entropy pool. Note that not all entropy sources are available on all systems, and if an entropy source is enabled for a system on which it is not appropriate (or possible) to use, it may fail initialization. It is not fatal to rngd for any single entropy source to fail during startup. Only a single entropy sources is needed for rngd to operate. The following entropy sources are currently defined in rngd

Hardware RNG (hwrng) [Index 0]

The Hardware RNG is a generic entropy source that draws entropy from a hardware rng attached by default to /dev/hwrng

TPM (tpm) [Index 1]

Entropy drawn from on board TPM device. Note this entropy source is deprecated and will be removed soon, as newer tpm devices export entropy via /dev/hwrng, which is collected by the hwrng source above

RDRAND/RDSEED (rdrand) [Index 2]

Entropy drawn from the RDRAND and RDSEED instructions (x86 only)

Options

use_aes - select if rdrand is used to seed a cprng to produce entropy, or if all entropy is drawn directly from rdrand instruction (default 0)

DARN (darn) [Index 3]

Entropy drawn from the DARN instruction (ppc64 only)

Options

use_aes - select if the power darn instruction is used to directly fill the entropy poll, or if it is used as a periodic seed to an aes based cprng (default 1)

RNDR (rndr) [Index 8]

Entropy drawn from the RNDR instruction (aarch64 only)

Options

use_aes - select if the arm rndr instruction is used to directly fill the entropy poll, or if it is used as a periodic seed to an aes based cprng (default 0)

NIST Entropy Beacon (nist) [Index 4]

Entropy gathered from the NIST network entropy beacon. Note that this entropy source is disabled by default as it should never be used for cryptographic purposes, or any use case in which random data should be known only by a single entity.

JITTER (jitter) [Index 5]

Entropy gathered by measuring timing variance of operations on the local cpu

Options

thread_count - Set the number of threads that the jitter entropy source will spawn buffer_size - Set the size of the buffer cache that each thread maintains

refill_thresh - Set the low watermark for the cache that triggers its corresponding thread to start refill operations

retry_count - If all entropy buffers are empty, retry this many times before giving up. Note that jitterentropy can take several seconds to refill a buffer, and so retries after a delay may be preferable to repeatedly spining on an empty buffer (default 1)

retry_delay - between each retry for retry_count above, sleep for this many seconds. May also be the special value -1, representing adaptive sleep, where each retry delay will be half the recorded execution time of the last entropy gathering round (default -1)

force_soft_timer - on platforms with a hardware timer that is too coarse to sample jitter, we can instead use a software based timer loop. Detection and use of this mechanism is automatic, but this can be useful for testing purposes

PKCS11 (pkcs11) [Index 6]

Entropy gathered via the opensc openssl engine, which can extract entropy from various smart card readers

Options

engine_path - Set the patch for the pkcs11 engine DSO to load chunk_size - Some pkcs11 engines have restrictions on how much data can be requested at a time, this option allows for the request to be subdivided into smaller chunks to be satisfied

RTLSDR (rtlsdr) [Index 7]

Entropy gathered via the rtl software defined radio library, which can gather entropy using various usb software defined radios listening to random radio static

Options

devid - When multiple devices are available the integer index of the device to use freq_min - The minimum frequence range to scan in

freq_max - The maximum frequency range to scan in

sample_min - The minimum sample rate of the radio

sample_max - The maximum sample rate of the radio

## AUTHORS
Philipp Rumpf

Jeff Garzik - jgarzik@pobox.com

Matt Sottek

Brad Hill

Neil Horman - nhorman@tuxdriver.com


pppoe

package: rp-pppoe-base

title: pppoe(8)

summary: user-space PPPoE client.

text:
# pppoe(8)

## NAME
pppoe - user-space PPPoE client.

## SYNOPSIS
pppd pty 'pppoe [pppoe_options]' [pppd_options]

pppoe -A [pppoe_options]

## DESCRIPTION
pppoe is a user-space client for PPPoE (Point-to-Point Protocol over Ethernet) for Linux and other UNIX systems. pppoe works in concert with the pppd PPP daemon to provide a PPP connection over Ethernet, as is used by many DSL service providers.

## OPTIONS
-I interface

The -I option specifies the Ethernet interface to use. Under Linux, it is typically eth0 or eth1. The interface should be "up" before you start pppoe, but should not be configured to have an IP address.

-T timeout

The -T option causes pppoe to exit if no session traffic is detected for timeout seconds. I recommend that you use this option as an extra safety measure, but if you do, you should make sure that PPP generates enough traffic so the timeout will normally not be triggered. The best way to do this is to use the lcp-echo-interval option to pppd. You should set the PPPoE timeout to be about four times the LCP echo interval.

-D file_name

The -D option causes every packet to be dumped to the specified file_name. This is intended for debugging only; it produces huge amounts of output and greatly reduces performance.

-V

The -V option causes pppoe to print its version number and exit.

-A

The -A option causes pppoe to send a PADI packet and then print the names of access concentrators in each PADO packet it receives. Do not use this option in conjunction with pppd; the -A option is meant to be used interactively to give interesting information about the access concentrator.

-S service_name

Specifies the desired service name. pppoe will only initiate sessions with access concentrators which can provide the specified service. In most cases, you should not specify this option. Use it only if you know that there are multiple access concentrators or know that you need a specific service name.

-C ac_name

Specifies the desired access concentrator name. pppoe will only initiate sessions with the specified access concentrator. In most cases, you should not specify this option. Use it only if you know that there are multiple access concentrators. If both the -S and -C options are specified, they must both match for pppoe to initiate a session.

-U

Causes pppoe to use the Host-Uniq tag in its discovery packets. This lets you run multiple pppoe daemons without having their discovery packets interfere with one another. You must supply this option to all pppoe daemons if you intend to run multiple daemons simultaneously. The specific Host-Uniq value used is the hexadecimal representation of the pppoe process's PID.

-W value

Causes pppoe to use the Host-Uniq tag in its discovery packets, and furthermore to set the value of Host-Uniq to value. Use with caution. Note that -W and -U are mutually-incompatible.

-s

Causes pppoe to use synchronous PPP encapsulation. If you use this option, then you must use the sync option with pppd. You are encouraged to use this option if it works, because it greatly reduces the CPU overhead of pppoe. However, it MAY be unreliable on slow machines -- there is a race condition between pppd writing data and pppoe reading it. For this reason, the default setting is asynchronous. If you encounter bugs or crashes with Synchronous PPP, turn it off -- don't e-mail me for support!

-m MSS

Causes pppoe to clamp the TCP maximum segment size at the specified value. Because of PPPoE overhead, the maximum segment size for PPPoE is smaller than for normal Ethernet encapsulation. This could cause problems for machines on a LAN behind a gateway using PPPoE. If you have a LAN behind a gateway, and the gateway connects to the Internet using PPPoE, you are strongly recommended to use a -m 1412 option. This avoids having to set the MTU on all the hosts on the LAN.

-p file

Causes pppoe to write its process-ID to the specified file. This can be used to locate and kill pppoe processes.

-e sess:mac

Causes pppoe to skip the discovery phase and move directly to the session phase. The session is given by sess and the MAC address of the peer by mac. This mode is not meant for normal use; it is designed only for pppoe-server(8).

-n

Causes pppoe not to open a discovery socket. This mode is not meant for normal use; it is designed only for pppoe-server(8).

-k

Causes pppoe to terminate an existing session by sending a PADT frame, and then exit. You must use the -e option in conjunction with this option to specify the session to kill. This may be useful for killing sessions when a buggy peer does not realize the session has ended.

-d

Causes pppoe to perform discovery and then exit, after printing session information to standard output. The session information is printed in exactly the format expected by the -e option. This option lets you initiate a PPPoE discovery, perform some other work, and then start the actual PPP session. Be careful; if you use this option in a loop, you can create many sessions, which may annoy your peer.

-f disc:sess

The -f option sets the Ethernet frame types for PPPoE discovery and session frames. The types are specified as hexadecimal numbers separated by a colon. Standard PPPoE uses frame types 8863:8864. You should not use this option unless you are absolutely sure the peer you are dealing with uses non-standard frame types. If your ISP uses non-standard frame types, complain!

-h

The -h option causes pppoe to print usage information and exit.

## PPPOE BACKGROUND
PPPoE (Point-to-Point Protocol over Ethernet) is described in RFC 2516 and is a protocol which allows the session abstraction to be maintained over bridged Ethernet networks.

PPPoE works by encapsulating PPP frames in Ethernet frames. The protocol has two distinct stages: The discovery and the session stage.

In the discovery stage, the host broadcasts a special PADI (PPPoE Active Discovery Initiation) frame to discover any access concentrators. The access concentrators (typically, only one access concentrator) reply with PADO (PPPoE Active Discovery Offer) packets, announcing their presence and the services they offer. The host picks one of the access concentrators and transmits a PADR (PPPoE Active Discovery Request) packet, asking for a session. The access concentrator replies with a PADS (PPPoE Active Discovery Session-Confirmation) packet. The protocol then moves to the session stage.

In the session stage, the host and access concentrator exchange PPP frames embedded in Ethernet frames. The normal Ethernet MTU is 1500 bytes, but the PPPoE overhead plus two bytes of overhead for the encapsulated PPP frame mean that the MTU of the PPP interface is at most 1492 bytes. This causes all kinds of problems if you are using a Linux machine as a firewall and interfaces behind the firewall have an MTU greater than 1492. In fact, to be safe, I recommend setting the MTU of machines behind the firewall to 1412, to allow for worst-case TCP and IP options in their respective headers.

Normally, PPP uses the Link Control Protocol (LCP) to shut down a PPP link. However, the PPPoE specification allows the link to be shut down with a special PADT (PPPoE Active Discovery Terminate) packet. This client recognizes this packet and will correctly terminate if a terminate request is received for the PPP session.

## DESIGN GOALS
My design goals for this PPPoE client were as follows, in descending order of importance:

o

It must work.

o

It must be a user-space program and not a kernel patch.

o

The code must be easy to read and maintain.

o

It must be fully compliant with RFC 2516, the proposed PPPoE standard.

o

It must never hang up forever -- if the connection is broken, it must detect this and exit, allowing a wrapper script to restart the connection.

o

It must be fairly efficient.

I believe I have achieved all of these goals, but (of course) am open to suggestions, patches and ideas. See my home page, https://dianne.skoll.ca/projects/rp-pppoe/, for contact information.

## NOTES
For best results, you must give pppd an mtu option of 1492. I have observed problems with excessively-large frames unless I set this option. Also, if pppoe is running on a firewall machine, all machines behind the firewall should have MTU's of 1412.

If you have problems, check your system logs. pppoe logs interesting things to syslog. You may have to turn on logging of debug-level messages for complete diagnosis.

## AUTHORS
pppoe was written by Dianne Skoll <dianne@skoll.ca>, with much inspiration from an earlier version by Luke Stras.

The pppoe home page is https://dianne.skoll.ca/projects/rp-pppoe/.

## SEE ALSO
pppoe-start(8), pppoe-stop(8), pppoe-connect(8), pppd(8), pppoe.conf(5), pppoe-setup(8), pppoe-status(8), pppoe-sniff(8), pppoe-server(8), pppoe-relay(8)


pppoe-relay

title: pppoe-relay(8)

summary: user-space PPPoE relay agent.

text:
# pppoe-relay(8)

## NAME
pppoe-relay - user-space PPPoE relay agent.

## SYNOPSIS
pppoe-relay [options]

## DESCRIPTION
pppoe-relay is a user-space relay agent for PPPoE (Point-to-Point Protocol over Ethernet) for Linux. pppoe-relay works in concert with the pppoe client and pppoe-server server. See the OPERATION section later in this manual for details on how pppoe-relay works.

## OPTIONS
-S interface

Adds the Ethernet interface interface to the list of interfaces managed by pppoe-relay. Only PPPoE servers may be connected to this interface.

-C interface

Adds the Ethernet interface interface to the list of interfaces managed by pppoe-relay. Only PPPoE clients may be connected to this interface.

-B interface

Adds the Ethernet interface interface to the list of interfaces managed by pppoe-relay. Both PPPoE clients and servers may be connected to this interface.

-n num

Allows at most num concurrent PPPoE sessions. If not specified, the default is 5000. num can range from 1 to 65534.

-i timeout

Specifies the session idle timeout. If both peers in a session are idle for more than timeout seconds, the session is terminated. If timeout is specified as zero, sessions will never be terminated because of idleness. Note that the idle-session expiry routine is never run more frequently than every 30 seconds, so the timeout is approximate. The default value for timeout is 600 seconds (10 minutes.)

-F

The -F option causes pppoe-relay not to fork into the background; instead, it remains in the foreground.

-h

The -h option prints a brief usage message and exits.

## OPERATION
pppoe-relay listens for incoming PPPoE PADI frames on all interfaces specified with -B or -C options. When a PADI frame appears, pppoe-relay adds a Relay-Session-ID tag and broadcasts the PADI on all interfaces specified with -B or -S options (except the interface on which the frame arrived.)

Any PADO frames received are relayed back to the client which sent the PADI (assuming they contain valid Relay-Session-ID tags.) Likewise, PADR frames from clients are relayed back to the matching access concentrator.

When a PADS frame is received, pppoe-relay enters the two peers' MAC addresses and session-ID's into a hash table. (The session-ID seen by the access concentrator may be different from that seen by the client; pppoe-relay must renumber sessions to avoid the possibility of duplicate session-ID's.) Whenever either peer sends a session frame, pppoe-relay looks up the session entry in the hash table and relays the frame to the correct peer.

When a PADT frame is received, pppoe-relay relays it to the peer and deletes the session entry from its hash table.

If a client and server crash (or frames are lost), PADT frames may never be sent, and pppoe-relay's hash table can fill up with stale sessions. Therefore, a session-cleaning routine runs periodically, and removes old sessions from the hash table. A session is considered "old" if no traffic has been seen within timeout seconds. When a session is deleted because of a timeout, a PADT frame is sent to each peer to make certain that they are aware the session has been killed.

## EXAMPLE INVOCATIONS

```
pppoe-relay -C eth0 -S eth1
```

The example above relays frames between PPPoE clients on the eth0 network and PPPoE servers on the eth1 network.

```
pppoe-relay -B eth0 -B eth1
```

This example is a transparent relay -- frames are relayed between any mix of clients and servers on the eth0 and eth1 networks.

```
pppoe-relay -S eth0 -C eth1 -C eth2 -C eth3
```

This example relays frames between servers on the eth0 network and clients on the eth1, eth2 and eth3 networks.

## AUTHORS
pppoe-relay was written by Dianne Skoll <dianne@skoll.ca>.

The pppoe home page is https://dianne.skoll.ca/projects/rp-pppoe/.

## SEE ALSO
pppoe-start(8), pppoe-stop(8), pppoe-connect(8), pppd(8), pppoe.conf(5), pppoe(8), pppoe-setup(8), pppoe-status(8), pppoe-sniff(8), pppoe-server(8)


pppoe-sniff

title: pppoe-sniff(8)

text:
# pppoe-sniff(8)

## NAME
pppoe-sniff - examine network for non-standard PPPoE frames

## SYNOPSIS
pppoe-sniff [options]

## DESCRIPTION
pppoe-sniff listens for likely-looking PPPoE PADR and session frames and deduces extra options required for pppoe(8) to work.

Some DSL providers seem to use non-standard frame types for PPPoE frames, and/or require a certain value in the Service-Name field. It is often easier to sniff those values from a machine which can successfully connect rather than try to pry them out of the DSL provider.

To use pppoe-sniff, you need two computers, a DSL modem and an Ethernet hub (not an Ethernet switch.)

If the DSL modem normally connects directly to your computer's Ethernet card, connect it to the "uplink" port on the Ethernet hub. Plug two computers into normal ports on the hub. On one computer, run whatever software the DSL provider gave you on whatever operating system the DSL provider supports. On the other computer, run Linux and log in as root.

On the Linux machine, put the Ethernet interface into promiscuous mode and start pppoe-sniff. If the ethernet interface is eth0, for example, type these commands:

```
	ip link set eth0 promisc on
	pppoe-sniff -I eth0
```

On the other machine, start your DSL connection as usual. After a short time, pppoe-sniff should print recommendations for the value of PPPOE_EXTRA. Set this value in /etc/ppp/pppoe.conf.

After pppoe-sniff finishes (or you stop it if it seems hung), remember to turn off promiscuous mode:

```
	ip link set eth0 promisc on
```

## OPTIONS
-I interface

The -I option specifies the Ethernet interface to use. Under Linux, it is typically eth0 or eth1. The interface should be "up" and in promiscuous mode before you start pppoe-sniff.

-V

The -V option causes pppoe-sniff to print its version number and exit.

## BUGS
pppoe-sniff only works on Linux.

## AUTHORS
pppoe-sniff was written by Dianne Skoll <dianne@skoll.ca>.

The pppoe home page is https://dianne.skoll.ca/projects/rp-pppoe/.

## SEE ALSO
pppoe-start(8), pppoe-stop(8), pppoe-connect(8), pppd(8), pppoe.conf(5), pppoe(8), pppoe-setup(8), pppoe-status(8), pppoe-server(8), pppoe-relay(8)


pppoe-connect

package: rp-pppoe-client

title: pppoe-connect(8)

summary: Shell script to manage a PPPoE link

text:
# pppoe-connect(8)

## NAME
pppoe-connect - Shell script to manage a PPPoE link

## SYNOPSIS
pppoe-connect [config_file]

pppoe-connect interface user [config_file]

## DESCRIPTION
pppoe-connect is a shell script which manages a PPPoE connection using the Roaring Penguin user-space PPPoE client. If you omit config_file, the default file /etc/ppp/pppoe.conf is used. If you supply interface and user, then they override the Ethernet interface and user-name settings in the configuration file.

Note that normally, you should not invoke pppoe-connect directly. Instead, use pppoe-start to bring up the PPPoE connection.

pppoe-connect first reads a configuration file. It then brings up a PPPoE connection. If the connection ever drops, a message is logged to syslog, and pppoe-connect re-establishes the connection. In addition, each time the connection is dropped or cannot be established, pppoe-connect executes the script /etc/ppp/pppoe-lost if it exists and is executable.

The shell script pppoe-stop causes pppoe-connect to break out of its loop, bring the connection down, and exit.

## TECHNICAL DETAILS
pppoe-connect uses the following shell variables from the configuration file:

ETH

The Ethernet interface connected to the DSL modem (for example, eth0).

USER

The PPPoE user-id (for example, b1xxnxnx@sympatico.ca).

PIDFILE

A file in which to write the process-ID of the pppoe-connect process (for example, /var/run/pppoe.pid). Two additional files ($PIDFILE.pppd and $PIDFILE.pppoe) hold the process-ID's of the pppd and pppoe processes, respectively.

By using different configuration files with different PIDFILE settings, you can manage multiple PPPoE connections. Just specify the configuration file as an argument to pppoe-start and pppoe-stop.

## AUTHOR
pppoe-connect was written by Dianne Skoll <dianne@skoll.ca>.

The pppoe home page is https://dianne.skoll.ca/projects/rp-pppoe/.

## SEE ALSO
pppoe(8), pppoe-start(8), pppoe-stop(8), pppd(8), pppoe.conf(5), pppoe-setup(8), pppoe-status(8), pppoe-sniff(8), pppoe-server(8), pppoe-relay(8)


pppoe-setup

title: pppoe-setup(8)

text:
# pppoe-setup(8)

## NAME
pppoe-setup - Shell script to configure RP-PPPoE client

## SYNOPSIS
pppoe-setup

## DESCRIPTION
pppoe-setup is a shell script which prompts you for various pieces of information and sets up an /etc/ppp/pppoe.conf configuration script for the pppoe-start, pppoe-stop and pppoe-connect scripts.

## AUTHOR
pppoe-setup was written by Dianne Skoll <dianne@skoll.ca>.

The pppoe home page is https://dianne.skoll.ca/projects/rp-pppoe/.

## SEE ALSO
pppoe(8), pppoe-start(8), pppoe-stop(8), pppoe-connect(8), pppd(8), pppoe.conf(5), pppoe-status(8), pppoe-sniff(8), pppoe-relay(8), pppoe-server(8)


pppoe-start

title: pppoe-start(8)

summary: Shell script to bring up a PPPoE link

text:
# pppoe-start(8)

## NAME
pppoe-start - Shell script to bring up a PPPoE link

## SYNOPSIS
pppoe-start [config_file]

pppoe-start interface user [config_file]

## DESCRIPTION
pppoe-start is a shell script which starts the RP-PPPoE user-space PPPoE client. If you omit config_file, the default file /etc/ppp/pppoe.conf is used. If you supply interface and user, then they override the Ethernet interface and user-name settings in the configuration file.

## AUTHOR
pppoe-start was written by Dianne Skoll <dianne@skoll.ca>.

The pppoe home page is https://dianne.skoll.ca/projects/rp-pppoe/.

## SEE ALSO
pppoe(8), pppoe-stop(8), pppoe-connect(8), pppd(8), pppoe.conf(5), pppoe-setup(8), pppoe-status(8), pppoe-sniff(8), pppoe-relay(8), pppoe-server(8)


pppoe-status

title: pppoe-status(8)

text:
# pppoe-status(8)

## NAME
pppoe-status - Shell script to report on status of PPPoE link

## SYNOPSIS
pppoe-status [config_file]

## DESCRIPTION
pppoe-status is a shell script which checks the status of the PPPoE link established by the Roaring Penguin user-space PPPoE client. If you omit config_file, the default file /etc/ppp/pppoe.conf is used.

## AUTHOR
pppoe-status was written by Dianne Skoll <dianne@skoll.ca>.

The pppoe home page is https://dianne.skoll.ca/projects/rp-pppoe/.

## SEE ALSO
pppoe(8), pppoe-start(8), pppoe-connect(8), pppd(8), pppoe.conf(5), pppoe-setup(8), pppoe-stop(8), pppoe-sniff(8), pppoe-relay(8), pppoe-server(8)


pppoe-stop

title: pppoe-stop(8)

summary: Shell script to shut down a PPPoE link

text:
# pppoe-stop(8)

## NAME
pppoe-stop - Shell script to shut down a PPPoE link

## SYNOPSIS
pppoe-stop [config_file]

## DESCRIPTION
pppoe-stop is a shell script which stops the RP-PPPoE user-space PPPoE client. If you omit config_file, the default file /etc/ppp/pppoe.conf is used.

## AUTHOR
pppoe-stop was written by Dianne Skoll <dianne@skoll.ca>

The pppoe home page is https://dianne.skoll.ca/projects/rp-pppoe/.

## SEE ALSO
pppoe(8), pppoe-start(8), pppoe-connect(8), pppd(8), pppoe.conf(5), pppoe-setup(8), pppoe-status(8), pppoe-sniff(8), pppoe-relay(8), pppoe-server(8)


pppoe-server

package: rp-pppoe-server

title: pppoe-server(8)

summary: user-space PPPoE server

text:
# pppoe-server(8)

## NAME
pppoe-server - user-space PPPoE server

## SYNOPSIS
pppoe-server [options]

## DESCRIPTION
pppoe-server is a user-space server for PPPoE (Point-to-Point Protocol over Ethernet) for Linux and other UNIX systems. pppoe-server works in concert with the pppoe client to respond to PPPoE discovery packets and set up PPPoE sessions.

## OPTIONS
-F

The -F option causes pppoe-server not to fork and become a daemon. The default is to fork and become a daemon.

-I interface

The -I option specifies the Ethernet interface to use. Under Linux, it is typically eth0 or eth1. The interface should be "up" before you start pppoe-server, but need not have an IP address. You can supply multiple -I options if you want the server to respond on more than one interface.

-X pidfile

This option causes pppoe-server to write its process ID to pidfile. Additionally, it keeps the file locked so that only a single process may be started for a given pidfile.

-q /path/to/pppd

Specifies the full path to the pppd program. The default is determined at compile time. One use of this option is to supply a wrapper program that modifies the arguments passed to pppd. This lets you do things not directly supported by the server (for example, specify IPv6 addresses.)

-Q /path/to/pppoe

Specifies the full path to the pppoe program. The default is determined at compile time. This option is only relevant if you are not using kernel-mode PPPoE.

-T timeout

This option is passed directly to pppoe; see pppoe(8) for details. If you are using kernel-mode PPPoE, this option has no effect.

-C ac_name

Specifies which name to report as the access concentrator name. If not supplied, the host name is used.

-S name

Offer a service named name. Multiple -S options may be specified; each one causes the named service to be advertised in a Service-Name tag in the PADO frame. The first -S option specifies the default service, and is used if the PPPoE client requests a Service-Name of length zero.

-m MSS

This option is passed directly to pppoe; see pppoe(8) for details. If you are using kernel-mode PPPoE, this option has no effect.

-x n

Limit the number of sessions per peer MAC address to n. If a given MAC address attempts to create more than n sessions, then its PADI and PADR packets are ignored. If you set n to 0 (the default), then no limit is imposed on the number of sessions per peer MAC address.

-s

This option is passed directly to pppoe; see pppoe(8) for details. In addition, it causes pppd to be invoked with the sync option.

-L ip

Sets the local IP address. This is passed to spawned pppd processes. If not specified, the default is 10.0.0.1.

-R ip

Sets the starting remote IP address. As sessions are established, IP addresses are assigned starting from ip. pppoe-server automatically keeps track of the pool of addresses and passes a valid remote IP address to pppd. If not specified, a starting address of 10.67.15.1 is used.

-N num

Allows at most num concurrent PPPoE sessions. If not specified, the default is 64.

-M string

Sends string in a MOTM tag in a PADM packet right after sending the PADS to a client.

-H url

Sends url in a HURL tag in a PADM packet right after sending the PADS to a client. Note that url must start with either http:// or https://.

-O fname

This option causes pppoe-server to tell pppd to use the option file fname instead of the default /etc/ppp/pppoe-server-options.

-p fname

Reads the specified file fname which is a text file consisting of one IP address per line. These IP addresses will be assigned to clients. The number of sessions allowed will equal the number of addresses found in the file. The -p option overrides both -R and -N. In addition to containing IP addresses, the pool file can contain lines of the form:

```
	a.b.c.d-e
```

which includes all IP addresses from a.b.c.d to a.b.c.e. For example, the line:

```
	1.2.3.4-7
```

is equivalent to:

```
	1.2.3.4
	1.2.3.5
	1.2.3.6
	1.2.3.7
```

-r

Tells the PPPoE server to randomly permute session numbers. Instead of handing out sessions in order, the session numbers are assigned in an unpredictable order.

-u

Tells the server to invoke pppd with the unit option. Note that this option only works for pppd version 2.4.0 or newer.

-o offset

Instead of numbering PPPoE sessions starting at 1, they will be numbered starting at offset+1. This allows you to run multiple servers on a given machine; just make sure that their session numbers do not overlap.

-f disc:sess

The -f option sets the Ethernet frame types for PPPoE discovery and session frames. The types are specified as hexadecimal numbers separated by a colon. Standard PPPoE uses frame types 8863:8864. You should not use this option unless you are absolutely sure the peer you are dealing with uses non-standard frame types.

-k

The -k option tells the server to use kernel-mode PPPoE on Linux. This option is available only on Linux kernels 2.4.0 and later, and only if the server was built with kernel-mode support.

-i

The -i option tells the server to completely ignore PADI frames if there are no free session slots.

-h

The -h option prints a brief usage message and exits.

## OPERATION
pppoe-server listens for incoming PPPoE discovery packets. When a session is established, it spawns a pppd process. The following options are passed to pppd:

```
nodetach noaccomp nobsdcom nodeflate nopcomp novj novjccomp
default-asyncmap
```

In addition, the local and remote IP address are set based on the -L and -R options. The pty option is supplied along with a pppoe command to initiate the PPPoE session. Finally, additional pppd options can be placed in the file /etc/ppp/pppoe-server-options (which must exist, even if it is just empty!)

Note that pppoe-server is meant mainly for testing PPPoE clients. It is not a high-performance server meant for production use.

## AUTHORS
pppoe-server was written by Dianne Skoll <dianne@skoll.ca>.

The pppoe home page is https://dianne.skoll.ca/projects/rp-pppoe/.

## SEE ALSO
pppoe-start(8), pppoe-stop(8), pppoe-connect(8), pppd(8), pppoe.conf(5), pppoe(8), pppoe-setup(8), pppoe-status(8), pppoe-sniff(8), pppoe-relay(8)


rpcbind

package: rpcbind

title: rpcbind(8)

text:
# rpcbind(8)

## NAME
rpcbind — universal addresses to RPC program number mapper

## SYNOPSIS
rpcbind

[-adhiLls]

## DESCRIPTION
The rpcbind utility is a server that converts RPC program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine.

When an RPC service is started, it tells rpcbind the address at which it is listening, and the RPC program numbers it is prepared to serve. When a client wishes to make an RPC call to a given program number, it first contacts rpcbind on the server machine to determine the address where RPC requests should be sent.

The rpcbind utility should be started before any other RPC service. Normally, standard RPC servers are started by port monitors, so rpcbind must be started before port monitors are invoked.

When rpcbind is started, it checks that certain name-to-address translation-calls function correctly. If they fail, the network configuration databases may be corrupt. Since RPC services cannot function correctly in this situation, rpcbind reports the condition and terminates.

The rpcbind utility can only be started by the super-user.

## OPTIONS
-a

When debugging (-d), do an abort on errors.

-d

Run in debug mode. In this mode, rpcbind will log additional information during operation, and will abort on certain errors if -a is also specified. With this option, the name-to-address translation consistency checks are shown in detail.

-f

Do not fork and become a background process.

-h

Specify specific IP addresses to bind to for UDP requests. This option may be specified multiple times and can be used to restrict the interfaces rpcbind will respond to. When specifying IP addresses with -h, rpcbind will automatically add 127.0.0.1 and if IPv6 is enabled, ::1 to the list. If no -h option is specified, rpcbind will bind to INADDR_ANY, which could lead to problems on a multi-homed host due to rpcbind returning a UDP packet from a different IP address than it was sent to. Note that when rpcbind is controlled via systemd's socket activation, the -h option is ignored. In this case, you need to edit the ListenStream and ListenDgram definitions in /usr/lib/systemd/system/rpcbind.socket instead.

-i

“Insecure” mode. Allow calls to SET and UNSET from any host. Normally rpcbind accepts these requests only from the loopback interface for security reasons. This change is necessary for programs that were compiled with earlier versions of the rpc library and do not make those requests using the loopback interface.

-l

Listen on loopback interfaces only.

-v

Turn on libwrap connection logging.

-s

Cause rpcbind to change to the user daemon as soon as possible. This causes rpcbind to use non-privileged ports for outgoing connections, preventing non-privileged clients from using rpcbind to connect to services from a privileged port.

-w

Cause rpcbind to do a "warm start" by read a state file when rpcbind starts up. The state file is created when rpcbind terminates.

## NOTES
All RPC servers must be restarted if rpcbind is restarted.

## SEE ALSO
rpcinfo(8)


rpcinfo

title: rpcinfo(8)

summary: report RPC information

text:
# rpcinfo(8)

## NAME
rpcinfo — report RPC information

## SYNOPSIS
rpcinfo

[-m | -s] [host]

rpcinfo

-p [host]

rpcinfo

-T transport host prognum [versnum]

rpcinfo

-l [-T transport] host prognum versnum

rpcinfo

[-n portnum] -u host prognum [versnum]

rpcinfo

[-n portnum] [-t] host prognum [versnum]

rpcinfo

-a serv_address -T transport prognum [versnum]

rpcinfo

-b [-T transport] prognum versnum

rpcinfo

-d [-T transport] prognum versnum

## DESCRIPTION
rpcinfo makes an RPC call to an RPC server and reports what it finds.

In the first synopsis, rpcinfo lists all the registered RPC services with rpcbind on host. If host is not specified, the local host is the default. If -s is used, the information is displayed in a concise format.

In the second synopsis, rpcinfo lists all the RPC services registered with rpcbind, version 2. Also note that the format of the information is different in the first and the second synopsis. This is because the second synopsis is an older protocol used to collect the information displayed (version 2 of the rpcbind protocol).

The third synopsis makes an RPC call to procedure 0 of prognum and versnum on the specified host and reports whether a response was received. transport is the transport which has to be used for contacting the given service. The remote address of the service is obtained by making a call to the remote rpcbind.

The prognum argument is a number that represents an RPC program number. If a versnum is specified, rpcinfo attempts to call that version of the specified prognum. Otherwise, rpcinfo attempts to find all the registered version numbers for the specified prognum by calling version 0, which is presumed not to exist; if it does exist, rpcinfo attempts to obtain this information by calling an extremely high version number instead, and attempts to call each registered version. Note: the version number is required for -b and -d options.

## OPTIONS
-T transport

Specify the transport on which the service is required. If this option is not specified, rpcinfo uses the transport specified in the NETPATH environment variable, or if that is unset or null, the transport in the netconfig(5) database is used. This is a generic option, and can be used in conjunction with other options as shown in the SYNOPSIS.

-a serv_address

Use serv_address as the (universal) address for the service on transport to ping procedure 0 of the specified prognum and report whether a response was received. The -T option is required with the -a option. If versnum is not specified, rpcinfo tries to ping all available version numbers for that program number. This option avoids calls to remote rpcbind to find the address of the service. The serv_address is specified in universal address format of the given transport.

-b

Make an RPC broadcast to procedure 0 of the specified prognum and versnum and report all hosts that respond. If transport is specified, it broadcasts its request only on the specified transport. If broadcasting is not supported by any transport, an error message is printed. Use of broadcasting should be limited because of the potential for adverse effect on other systems.

-d

Delete registration for the RPC service of the specified prognum and versnum. If transport is specified, unregister the service on only that transport, otherwise unregister the service on all the transports on which it was registered. Only the owner of a service can delete a registration, except the super-user who can delete any service.

-l

Display a list of entries with a given prognum and versnum on the specified host. Entries are returned for all transports in the same protocol family as that used to contact the remote rpcbind.

-m

Display a table of statistics of rpcbind operations on the given host. The table shows statistics for each version of rpcbind (versions 2, 3 and 4), giving the number of times each procedure was requested and successfully serviced, the number and type of remote call requests that were made, and information about RPC address lookups that were handled. This is useful for monitoring RPC activities on host.

-n portnum

Use portnum as the port number for the -t and -u options instead of the port number given by rpcbind. Use of this option avoids a call to the remote rpcbind to find out the address of the service. This option is made obsolete by the -a option.

-p

Probe rpcbind on host using version 2 of the rpcbind protocol, and display a list of all registered RPC programs. If host is not specified, it defaults to the local host. Note: Version 2 of the rpcbind protocol was previously known as the portmapper protocol.

-s

Display a concise list of all registered RPC programs on host. If host is not specified, it defaults to the local host.

-t

Make an RPC call to procedure 0 of prognum on the specified host using TCP, and report whether a response was received. This option is made obsolete by the -T option as shown in the third synopsis.

-u

Make an RPC call to procedure 0 of prognum on the specified host using UDP, and report whether a response was received. This option is made obsolete by the -T option as shown in the third synopsis.

## EXAMPLES
To show all of the RPC services registered on the local machine use:

```
	example% rpcinfo
```

To show all of the RPC services registered with rpcbind on the machine named klaxon use:

```
	example% rpcinfo klaxon
```

The information displayed by the above commands can be quite lengthy. Use the -s option to display a more concise list:

```
	example$ rpcinfo -s klaxon
```

program

version(s)

netid(s)

service

owner

100000

2,3,4

local,tcp,udp,tcp6,udp6

rpcbind

super-user

100008

1

udp,tcp,udp6,tcp6

walld

super-user

100002

2,1

udp,udp6

rusersd

super-user

100001

2,3,4

udp,udp6

rstatd

super-user

100012

1

udp,tcp

sprayd

super-user

100007

3

udp,tcp

ypbind

super-user

To show whether the RPC service with program number prognum and version versnum is registered on the machine named klaxon for the transport TCP use:

```
	example% rpcinfo -T tcp klaxon prognum versnum
```

To show all RPC services registered with version 2 of the rpcbind protocol on the local machine use:

```
	example% rpcinfo -p
```

To delete the registration for version 1 of the walld (program number 100008 ) service for all transports use:

```
	example# rpcinfo -d 100008 1
```

or

```
	example# rpcinfo -d walld 1
```

## SEE ALSO
rpc(3), netconfig(5), rpc(5), rpcbind(8)