openconnect

package: openconnect

title: openconnect(8)

text:
# openconnect(8)

## NAME
openconnect - Multi-protocol VPN client, for Cisco AnyConnect VPNs and others

## SYNOPSIS
openconnect

[--config configfile] [-b,--background] [--pid-file pidfile] [-c,--certificate cert] [-e,--cert-expire-warning days] [-k,--sslkey key] [-C,--cookie cookie] [--cookie-on-stdin] [--compression MODE] [-d,--deflate] [-D,--no-deflate] [--force-dpd interval] [--force-trojan interval] [-F,--form-entry form:opt=value] [-g,--usergroup group] [-h,--help] [--http-auth methods] [-i,--interface ifname] [-l,--syslog] [--timestamp] [--passtos] [-U,--setuid user] [--csd-user user] [-m,--mtu mtu] [--base-mtu mtu] [-p,--key-password pass] [-P,--proxy proxyurl] [--proxy-auth methods] [--no-proxy] [--libproxy] [--key-password-from-fsid] [-q,--quiet] [-Q,--queue-len len] [-s,--script vpnc-script] [-S,--script-tun] [-u,--user name] [-V,--version] [-v,--verbose] [-x,--xmlconfig config] [--authgroup group] [--authenticate] [--cookieonly] [--printcookie] [--cafile file] [--disable-ipv6] [--dtls-ciphers list] [--dtls12-ciphers list] [--dtls-local-port port] [--dump-http-traffic] [--no-system-trust] [--pfs] [--no-dtls] [--no-http-keepalive] [--no-passwd] [--no-xmlpost] [--non-inter] [--passwd-on-stdin] [--protocol proto] [--token-mode mode] [--token-secret {secret[,counter]|@file}] [--reconnect-timeout] [--resolve host:ip] [--servercert sha1] [--useragent string] [--version-string string] [--local-hostname string] [--os string] [https://]server[:port][/group]

## DESCRIPTION
The program openconnect connects to VPN servers which use standard TLS/SSL, DTLS, and ESP protocols for data transport.

It was originally written to support Cisco "AnyConnect" VPN servers, and has since been extended with experimental support for Juniper Network Connect (--protocol=nc) and Junos Pulse VPN servers (--protocol=pulse) and PAN GlobalProtect VPN servers (--protocol=gp).

The connection happens in two phases. First there is a simple HTTPS connection over which the user authenticates somehow - by using a certificate, or password or SecurID, etc. Having authenticated, the user is rewarded with an authentication cookie which can be used to make the real VPN connection.

The second phase uses that cookie to connect to a tunnel via HTTPS, and data packets can be passed over the resulting connection. When possible, a UDP tunnel is also configured: AnyConnect uses DTLS, while Juniper and GlobalProtect use UDP-encapsulated ESP. The UDP tunnel may be disabled with --no-dtls, but is preferred when correctly supported by the server and network for performance reasons. (TCP performs poorly and unreliably over TCP-based tunnels; see http://sites.inka.de/~W1011/devel/tcp-tcp.html.)

## OPTIONS
--config=CONFIGFILE

Read further options from CONFIGFILE before continuing to process options from the command line. The file should contain long-format options as would be accepted on the command line, but without the two leading -- dashes. Empty lines, or lines where the first non-space character is a # character, are ignored. Any option except the config option may be specified in the file.

-b,--background

Continue in background after startup

--pid-file=PIDFILE

Save the pid to PIDFILE when backgrounding

-c,--certificate=CERT

Use SSL client certificate CERT which may be either a file name or, if OpenConnect has been built with an appropriate version of GnuTLS, a PKCS#11 URL.

-e,--cert-expire-warning=DAYS

Give a warning when SSL client certificate has DAYS left before expiry

-k,--sslkey=KEY

Use SSL private key KEY which may be either a file name or, if OpenConnect has been built with an appropriate version of GnuTLS, a PKCS#11 URL.

-C,--cookie=COOKIE

Use authentication cookie COOKIE.

--cookie-on-stdin

Read cookie from standard input.

-d,--deflate

Enable all compression, including stateful modes. By default, only stateless compression algorithms are enabled.

-D,--no-deflate

Disable all compression.

--compression=MODE

Set compression mode, where MODE is one of stateless, none, or all. By default, only stateless compression algorithms which do not maintain state from one packet to the next (and which can be used on UDP transports) are enabled. By setting the mode to all stateful algorithms (currently only zlib deflate) can be enabled. Or all compression can be disabled by setting the mode to none.

--force-dpd=INTERVAL

Use INTERVAL as minimum Dead Peer Detection interval (in seconds) for CSTP and DTLS, forcing use of DPD even when the server doesn't request it.

-g,--usergroup=GROUP

Use GROUP as login UserGroup

-F,--form-entry=FORM:OPTION=VALUE

Provide authentication form input, where FORM and OPTION are the identifiers from the form and the specific input field, and VALUE is the string to be filled in automatically. For example, the standard username field (also handled by the --user option) could also be provided with this option thus: --form-entry main:username=joebloggs.

-h,--help

Display help text

--http-auth=METHODS

Use only the specified methods for HTTP authentication to a server. By default, only Negotiate, NTLM and Digest authentication are enabled. Basic authentication is also supported but because it is insecure it must be explicitly enabled. The argument is a comma-separated list of methods to be enabled. Note that the order does not matter: OpenConnect will use Negotiate, NTLM, Digest and Basic authentication in that order, if each is enabled, regardless of the order specified in the METHODS string.

-i,--interface=IFNAME

Use IFNAME for tunnel interface

-l,--syslog

Use syslog for progress messages

--timestamp

Prepend a timestamp to each progress message

--passtos

Copy TOS / TCLASS of payload packet into DTLS and ESP packets. This is not set by default because it may leak information about the payload (for example, by differentiating voice/video traffic).

-U,--setuid=USER

Drop privileges after connecting, to become user USER

--csd-user=USER

Drop privileges during execution of trojan binary or script (CSD, TNCC, or HIP).

--csd-wrapper=SCRIPT

Run SCRIPT instead of the trojan binary or script.

--force-trojan=INTERVAL

Use INTERVAL as interval (in seconds) for repeat execution of Trojan binary or script, overriding default and/or server-set interval.

-m,--mtu=MTU

Request MTU from server as the MTU of the tunnel.

--base-mtu=MTU

Indicate MTU as the path MTU between client and server on the unencrypted network. Newer servers will automatically calculate the MTU to be used on the tunnel from this value.

-p,--key-password=PASS

Provide passphrase for certificate file, or SRK (System Root Key) PIN for TPM

-P,--proxy=PROXYURL

Use HTTP or SOCKS proxy for connection. A username and password can be provided in the given URL, and will be used for authentication. If authentication is required but no credentials are given, GSSAPI and automatic NTLM authentication using Samba's ntlm_auth helper tool may be attempted.

--proxy-auth=METHODS

Use only the specified methods for HTTP authentication to a proxy. By default, only Negotiate, NTLM and Digest authentication are enabled. Basic authentication is also supported but because it is insecure it must be explicitly enabled. The argument is a comma-separated list of methods to be enabled. Note that the order does not matter: OpenConnect will use Negotiate, NTLM, Digest and Basic authentication in that order, if each is enabled, regardless of the order specified in the METHODS string.

--no-proxy

Disable use of proxy

--libproxy

Use libproxy to configure proxy automatically (when built with libproxy support)

--key-password-from-fsid

Passphrase for certificate file is automatically generated from the fsid of the file system on which it is stored. The fsid is obtained from the statvfs(2) or statfs(2) system call, depending on the operating system. On a Linux or similar system with GNU coreutils, the fsid used by this option should be equal to the output of the command:

```
stat --file-system --printf=%i\\n $CERTIFICATE

```

It is not the same as the 128-bit UUID of the file system.

-q,--quiet

Less output

-Q,--queue-len=LEN

Set packet queue limit to LEN pkts

-s,--script=SCRIPT

Invoke SCRIPT to configure the network after connection. Without this, routing and name service are unlikely to work correctly. The script is expected to be compatible with the vpnc-script which is shipped with the "vpnc" VPN client. See http://www.infradead.org/openconnect/vpnc-script.html for more information. This version of OpenConnect is configured to use /etc/vpnc/vpnc-script by default. On Windows, a relative directory for the default script will be handled as starting from the directory that the openconnect executable is running from, rather than the current directory. The script will be invoked with the command-based script host cscript.exe.

-S,--script-tun

Pass traffic to 'script' program over a UNIX socket, instead of to a kernel tun/tap device. This allows the VPN IP traffic to be handled entirely in userspace, for example by a program which uses lwIP to provide SOCKS access into the VPN.

-u,--user=NAME

Set login username to NAME

-V,--version

Report version number

-v,--verbose

More output (may be specified multiple times for additional output)

-x,--xmlconfig=CONFIG

XML config file

--authgroup=GROUP

Choose authentication login selection

--authenticate

Authenticate only, and output the information needed to make the connection a form which can be used to set shell environment variables. When invoked with this option, openconnect will not make the connection, but if successful will output something like the following to stdout:

```
COOKIE=3311180634@13561856@1339425499@B315A0E29D16C6FD92EE...
HOST=10.0.0.1
FINGERPRINT=469bb424ec8835944d30bc77c77e8fc1d8e23a42
```

Thus, you can invoke openconnect as a non-privileged user (with access to the user's PKCS#11 tokens, etc.) for authentication, and then invoke openconnect separately to make the actual connection as root:

```
eval `openconnect --authenticate https://vpnserver.example.com`;
[ -n $COOKIE ] && echo $COOKIE |
  sudo openconnect --cookie-on-stdin $HOST --servercert $FINGERPRINT
```

--cookieonly

Fetch and print cookie only; don't connect

--printcookie

Print cookie before connecting

--cafile=FILE

Additional CA file for server verification. By default, this simply causes OpenConnect to trust additional root CA certificate(s) in addition to those trusted by the system. Use --no-system-trust to prevent OpenConnect from trusting the system default certificate authorities.

--no-system-trust

Do not trust the system default certificate authorities. If this option is given, only certificate authorities given with the --cafile option, if any, will be trusted automatically.

--disable-ipv6

Do not advertise IPv6 capability to server

--dtls-ciphers=LIST

Set OpenSSL ciphers to support for DTLS

--dtls12-ciphers=LIST

Set OpenSSL ciphers for Cisco's DTLS v1.2

--dtls-local-port=PORT

Use PORT as the local port for DTLS and UDP datagrams

--dump-http-traffic

Enable verbose output of all HTTP requests and the bodies of all responses received from the server.

--pfs

Enforces Perfect Forward Secrecy (PFS). That ensures that if the server's long-term key is compromised, any session keys established before the compromise will be unaffected. If this option is provided and the server does not support PFS in the TLS channel the connection will fail. PFS is available in Cisco ASA releases 9.1(2) and higher; a suitable cipher suite may need to be manually enabled by the administrator using the ssl encryption setting.

--no-dtls

Disable DTLS and ESP

--no-http-keepalive

Version 8.2.2.5 of the Cisco ASA software has a bug where it will forget the client's SSL certificate when HTTP connections are being re-used for multiple requests. So far, this has only been seen on the initial connection, where the server gives an HTTP/1.0 redirect response with an explicit Connection: Keep-Alive directive. OpenConnect as of v2.22 has an unconditional workaround for this, which is never to obey that directive after an HTTP/1.0 response. However, Cisco's support team has failed to give any competent response to the bug report and we don't know under what other circumstances their bug might manifest itself. So this option exists to disable ALL re-use of HTTP sessions and cause a new connection to be made for each request. If your server seems not to be recognising your certificate, try this option. If it makes a difference, please report this information to the openconnect-devel@lists.infradead.org mailing list.

--no-passwd

Never attempt password (or SecurID) authentication.

--no-xmlpost

Do not attempt to post an XML authentication/configuration request to the server; use the old style GET method which was used by older clients and servers instead. This option is a temporary safety net, to work around potential compatibility issues with the code which falls back to the old method automatically. It causes OpenConnect to behave more like older versions (4.08 and below) did. If you find that you need to use this option, then you have found a bug in OpenConnect. Please see http://www.infradead.org/openconnect/mail.html and report this to the developers.

--non-inter

Do not expect user input; exit if it is required.

--passwd-on-stdin

Read password from standard input

--protocol=PROTO

Select VPN protocol PROTO to be used for the connection. Supported protocols are anyconnect for Cisco AnyConnect (the default), nc for experimental support for Juniper Network Connect (also supported by most Junos Pulse servers), pulse for experimental support for Junos Pulse, and gp for experimental support for PAN GlobalProtect. OpenConnect does not yet support all of the authentication options used by Pulse, nor does it support Host Checker/TNCC with Pulse. If your Junos Pulse VPN is not yet supported with --protocol=pulse, then --protocol=nc may be a useful fallback option.

--token-mode=MODE

Enable one-time password generation using the MODE algorithm. --token-mode=rsa will call libstoken to generate an RSA SecurID tokencode, --token-mode=totp will call liboath to generate an RFC 6238 time-based password, and --token-mode=hotp will call liboath to generate an RFC 4226 HMAC-based password. Yubikey tokens which generate OATH codes in hardware are supported with --token-mode=yubioath. --token-mode=oidc will use the provided OpenIDConnect token as an RFC 6750 bearer token.

--token-secret={ SECRET[,COUNTER] | @FILENAME }

The secret to use when generating one-time passwords/verification codes. Base 32-encoded TOTP/HOTP secrets can be used by specifying "base32:" at the beginning of the secret, and for HOTP secrets the token counter can be specified following a comma. RSA SecurID secrets can be specified as an Android/iPhone URI or a raw numeric CTF string (with or without dashes).

For Yubikey OATH the token secret specifies the name of the credential to be used. If not provided, the first OATH credential found on the device will be used.

For OIDC the secret is the bearer token to be used.

FILENAME, if specified, can contain any of the above strings. Or, it can contain a SecurID XML (SDTID) seed.

If this option is omitted, and --token-mode is "rsa", libstoken will try to use the software token seed saved in ~/.stokenrc by the "stoken import" command.

--reconnect-timeout

Keep reconnect attempts until so much seconds are elapsed. The default timeout is 300 seconds, which means that openconnect can recover VPN connection after a temporary network down time of 300 seconds.

--resolve=HOST:IP

Automatically resolve the hostname HOST to IP instead of using the normal resolver to look it up.

--servercert=HASH

Accept server's SSL certificate only if the provided fingerprint matches. The allowed fingerprint types are SHA1, SHA256, and PIN-SHA256. They are distinguished by the 'sha1:', 'sha256:' and 'pin-sha256:' prefixes to the encoded hash. The first two are custom identifiers providing hex encoding of the peer's public key, while 'pin-sha256:' is the RFC7469 key PIN, which utilizes base64 encoding. To ease certain testing use-cases, a partial match of the hash will also be accepted, if it is at least 4 characters past the prefix.

--useragent=STRING

Use STRING as 'User-Agent:' field value in HTTP header. (e.g. --useragent 'Cisco AnyConnect VPN Agent for Windows 2.2.0133')

--version-string=STRING

Use STRING as the software version reported to the head end. (e.g. --version-string '2.2.0133')

--local-hostname=STRING

Use STRING as 'X-CSTP-Hostname:' field value in HTTP header. For example --local-hostname 'mypc', will advertise the value 'mypc' as the suggested hostname to point to the provided IP address.

--os=STRING

OS type to report to gateway. Recognized values are: linux, linux-64, win, mac-intel, android, apple-ios. Reporting a different OS type may affect the dynamic access policy (DAP) applied to the VPN session. If the gateway requires CSD, it will also cause the corresponding CSD trojan binary to be downloaded, so you may need to use --csd-wrapper if this code is not executable on the local machine.

## SIGNALS
In the data phase of the connection, the following signals are handled:

SIGINT / SIGTERM

performs a clean shutdown by logging the session off, disconnecting from the gateway, and running the vpnc-script to restore the network configuration.

SIGHUP

disconnects from the gateway and runs the vpnc-script, but does not log the session off; this allows for reconnection later using --cookie.

SIGUSR2

forces an immediate disconnection and reconnection; this can be used to quickly recover from LAN IP address changes.

## LIMITATIONS
Note that although IPv6 has been tested on all platforms on which openconnect is known to run, it depends on a suitable vpnc-script to configure the network. The standard vpnc-script shipped with vpnc 0.5.3 is not capable of setting up IPv6 routes; the one from git://git.infradead.org/users/dwmw2/vpnc-scripts.git will be required.

## SEE ALSO
ocserv(8)

## AUTHORS
David Woodhouse <dwmw2@infradead.org>


opendkim

package: opendkim

title: opendkim(8)

text:
# opendkim(8)

## NAME
opendkim - DKIM signing and verifying filter for MTAs

## SYNOPSIS
opendkim [-A] [-b modes] [-c canon] [-d domain[,...]] [-D] [-e name] [-f] [-F time] [-k keyfile] [-l] [-L min] [-n] [-o hdrlist] [-p socketspec] [-P pidfile] [-Q] [-r] [-s selector] [-S signalg] [-t testfiles] [-T secs] [-u userid[:group]] [-v] [-V] [-W] [-x configfile] [-X]

## DESCRIPTION
opendkim implements the DKIM standard for signing and verifying e-mail messages on a per-domain basis.

opendkim uses the milter interface, originally distributed as part of version 8.11 of sendmail(8), to provide DKIM signing and/or verifying service for mail transiting a milter-aware MTA.

Most, if not all, of the command line options listed below can also be set using a configuration file. See the -x option for details.

## DATA SETS
Many of the command line and configuration file parameters will refer to a "dataset" as their values. This refers to a string that either contains the list of desirable values, or to a file that contains them, or (if enabled at compile time) a database containing the data.

Some data sets require that the value contain more than one entry. How this is done depends on which data set type is used.

Which type is used depends on the format of the specification string. Note that not all of these are necessarily supported for all installations; most of them depend on the availability of a particular third-party library at compile time.

In particular:

a)

If the string begins with "file:", then the remainder of the string is presumed to refer to a flat file that contains elements of the data set, one per line. If a line contains whitespace-separated values, then the line is presumed to define a key and its corresponding value. Blank lines are ignored, and the hash ("#") character denotes the start of a comment. If a value contains multiple entries, the entries should be separated by colons.

b)

If the string begins with "refile:", then the remainder of the string is presumed to specify a file that contains a set of patterns, one per line, and their associated values. The pattern is taken as the start of the line to the first whitespace, and the portion after that whitespace is taken as the value to be used when that pattern is matched. Patterns are simple wildcard patterns, matching all text except that the asterisk ("*") character is considered a wildcard. If a value contains multiple entries, the entries should be separated by colons.

c)

If the string begins with "db:" and the program was compiled with Sleepycat DB support, then the remainder of the string is presumed to identify a Sleepycat database containing keys and corresponding values. These may be used only to test for membership in the data set, or for storing keys and corresponding values. If a value contains multiple entries, the entries should be separated by colons.

d)

If the string begins with "dsn:" and the OpenDKIM library was compiled to support that database type, then the remainder of the string is a Data Store Name describing the type, location parameters and access credentials for an ODBC or SQL database. The DSN is of the form: backend://[user[:pwd]@][port+]host/dbase[/key=value[?...]]

where backend is the name of a supported backend database mechanism (e.g. "mysql"), user and password are optional login credentials for the database, port and host describe the destination of a TCP connection to connect to that database, dbase is the name of the database to be accessed, and the key=value pairs must specify at least "table", "keycol" and "datacol" values specifying the name of the table, the name of the column to consider as the key, and the name(s) of the column(s) to be considered as the values (separated by commas). For example (all in one line):

mysql:://dbuser:dbpass@3306+dbhost/odkim/table=macros

?keycol=host?datacol=v1,v2

defines a MySQL database listening at port 3306 on host "dbhost"; the userid "dbuser" and password "dbpass" should be used to access the database; the database name is "odkim", and the data are in columns "host" (the keys) and "v1" and "v2" (the values) inside table "macros". This example would thus return two values when a match is found.

The key may also include a "filter" value which will be included in all generated SQL as an AND clause after the WHERE clause that declares the search criteria. For example, given the above DSN specification with an additional "filter" value of "ID > 1000", the generated SQL for a query for "foo" would look like so:

SELECT v1,v2 FROM macros WHERE host = 'foo' AND ID > 1000

No value within the DSN may contain any of the six punctuation characters (":", "/", "@", "+", "?" and "=") used to delimit portions of the DSN. To include such characters within a value, encode them in quoted-printable style (e.g., "=20" will be translated into a single space character). Encoding of spaces is also advised.

e)

If the string begins with "ldap:", "ldaps:" or "ldapi:", it is presumed to be a space-separated set of one or more LDAP URLs that identify a set of servers to be queried. The first one should be a full RFC4516 LDAP URL indicating a base DN template and optional scope, filter and attribute names to use in queries. When constructing a DN template or filter, the special tokens "$d" and "$D" are replaced with the key being queried and the key broken into components, separated at "." characters, each component preceded by "dc=" and followed by "," (so "example.com" would become "dc=example,dc=com"). If a data set requires multiple values to be returned, the appropriate attribute names should be given in the correct order to satisfy such requests.

f)

If the string begins with "lua:", it is presumed to refer to a file that contains a Lua script to be executed whenever a query is performed. The key for the query is placed in a global variable called "query", which the called script can then access. The script may return any number of values as required for the type of query being performed.

g)

If the string begins with "memcache:", it is presumed to refer to a memory cache database provided by memcached. The remainder of the string is a comma-separated list of hosts to which query attempts should be made, each optionally followed by ":" and a port number; that list must be followed by a slash ("/") character and a string that will be used to prefix queries send to the cache. For example: memcache:localhost,otherhost/keyname

This would use either "localhost" or "otherhost" to conduct queries, and all strings sent to the dataset will be prefixed with "keyname:".

h)

If the string contains none of these prefixes but ends with ".db", it is presumed to be a Sleepycat DB as described above (if support for same is compiled in).

i)

If the string contains none of these prefixes but starts with a slash ("/") character, it is presumed to be a flat file as described above.

j)

If the string begins with "csl:", the string is treated as a comma-separated list as described in m) below.

k)

If the string begins with "erlang:", it is presumed to refer to a function called to be made to the specified distributed Erlang node(s). The specification is of the form erlang:node@host[,...]:cookie:module:function

where node[,...] is a list of comma-separated erlang nodes, cookie is the cookie for the known nodes of the distributed Erlang setup, module is the name of the Erlang module where the function to be called resides, function is the name of the Erlang function to be called. For example, (all in one line):

erlang:mynode@myhost,myothernode@myotherhost:

chocolate:dkim:lookup

will join the distributed Erlang setup connecting to either "mynode@myhost" or "myothernode@myotherhost" (connections to nodes are tried in order) using "chocolate" as the cookie, and use the function "dkim:lookup/1" for lookups.

l)

If the string begins with "mdb:", it refers to a directory that contains a memory database, as provided by libmdb from OpenLDAP.

m)

In any other case, the string is presumed to be a comma-separated list. Elements in the list are either simple data elements that are part of the set or, in the case of an entry of the form "x=y", are stored as key-value pairs as described above.

## OPTIONS
-A

Automatically re-start on failures. Use with caution; if the filter fails instantly after it starts, this can cause a tight fork(2) loop. This can be mitigated using some values in the configuration file to limit restarting. See opendkim.conf(5).

-b modes

Selects operating modes. modes is a concatenation of characters that indicate which mode(s) of operation are desired. Valid modes are s (signer) and v (verifier). The default is sv except in test mode (see -t below) in which case the default is v.

-c canon

Selects the canonicalization method(s) to be used when signing messages. When verifying, the message's DKIM-Signature: header specifies the canonicalization method. The recognized values are relaxed and simple as defined by the DKIM specification. The default is simple. The value may include two different canonicalizations separated by a slash ("/") character, in which case the first will be applied to the headers and the second to the body.

-d dataset

A set of domains whose mail should be signed by this filter. Mail from other domains will be verified rather than being signed.

-D

Sign subdomains of those listed by the -d option as well as the actual domains.

-e name

Extracts the value of name from the configuration file (if any).

-f

Normally opendkim forks and exits immediately, leaving the service running in the background. This flag suppresses that behaviour so that it runs in the foreground.

-F time

Specifies a fixed time to use when generating signatures. Ignored unless also used in conjunction with -t (see below). The time must be expressed in the usual UNIX time_t (seconds since epoch) format.

-k keyfile

Gives the location of a PEM-formatted private key to be used for signing all messages. Ignored if a configuration file is referenced that defines a KeyTable.

-l

Log via calls to syslog(3) any interesting activity.

-L min[%+]

Instructs the verification code to fail messages for which a partial signature was received. There are three possible formats: min indicating at least min bytes of the message must be signed (or if the message is smaller than min then all of it must be signed); min% requiring that at least min percent of the received message must be signed; and min+ meaning there may be no more than min bytes of unsigned data appended to the message for it to be considered valid.

-n

Parse the configuration file and command line arguments, reporting any errors found, and then exit. The exit value will be 0 if the filter would start up without complaint, or non-zero otherwise.

-o dataset

Specifies a list of headers that should be omitted when generating signatures. If an entry in the list names any header which is mandated by the DKIM specification, the entry is ignored. A set of headers is listed in the DKIM specification as "SHOULD NOT" be signed; the default list for this parameter contains those headers (Return-Path, Received, Comments, Keywords, Bcc, Resent-Bcc and DKIM-Signature). To omit no headers, simply use the string "-" (or any string that will match no headers).

-p socketspec

Specifies the socket that should be established by the filter to receive connections from sendmail(8) in order to provide service. socketspec is in one of two forms: local:path which creates a UNIX domain socket at the specified path, or inet:port[@host] or inet6:port[@host] which creates a TCP socket on the specified port using the requested protocol family. If the host is not given as either a hostname or an IP address, the socket will be listening on all interfaces. A literal IP address must be enclosed in square brackets. If neither socket type is specified, local is assumed, meaning the parameter is interpreted as a path at which the socket should be created. This parameter is mandatory either here or in the configuration file.

-P pidfile

Specifies a file into which the filter should write its process ID at startup.

-Q

Query test mode. The filter will read two lines from standard input, one containing a database description to be opened and one containing a string of the form "q/n" where "q" is the query to be performed and "n" is the number of fields to be retrieved.

-r

Checks all messages for compliance with RFC5322 header count requirements. Non-compliant messages are rejected.

-s selector

Defines the name of the selector to be used when signing messages. See the DKIM specification for details.

-S signalg

Selects the signing algorithm to use when generating signatures. Use 'opendkim -V' to see the list of supported algorithms. The default is rsa-sha256 if it is available, otherwise it will be rsa-sha1.

-t testfiles

Evaluates (verifies) one or more RFC5322-formatted message found in testfiles and exits. The value of testfiles should be a comma-separated list of one or more filenames, one of which may be "-" if the message should be read from standard input.

-T secs

Sets the DNS timeout in seconds. A value of 0 causes an infinite wait. The default is 5. Ignored if not using an asynchronous resolver package. See also the NOTES section below.

-u userid[:group]

Attempts to be come the specified userid before starting operations. The process will be assigned all of the groups and primary group ID of the named userid unless an alternate group is specified. See the FILE PERMISSIONS section for more information.

-v

Increase verbose output during test mode (see -t above). May be specified more than once to request increasing amounts of output.

-V

Print the version number and supported canonicalization and signature algorithms, and then exit without doing anything else.

-W

If logging is enabled (see -l above), issues very detailed logging about the logic behind the filter's decision to either sign a message or verify it. The "W" stands for "Why?!" since the logic behind the decision is non-trivial and can be confusing to administrators not familiar with its operation. A description of how the decision is made can be found in the OPERATION section of this document. This causes a large increase in the amount of log data generated for each message, so it should be limited to debugging use and not enabled for general operation.

-x configfile

Read the named configuration file. See the opendkim.conf(5) man page for details. Values in the configuration file are overridden when their equivalents are provided on the command line until a configuration reload occurs. The OPERATION section describes how reloads are triggered. The default is to read a configuration file from /etc/opendkim.conf if one exists, or otherwise to apply defaults to all values.

-X

Tolerates configuration file items that have been internally marked as "deprecated". Normally when a configuration file item is removed from the package, it is flagged in this way for at least one full release cycle. The presence of a deprecated configuration file item typically causes the filter to return an error and refuse to start. Setting this flag will allow the filter to start and a warning is logged. In some future release when the item is removed completely, a different error results, and it will not be possible to start the filter. Use of this flag is NOT RECOMMENDED; it could effectively hide a major configuration change with serious security implications.

## OPERATION
A message will be verified unless it conforms to the signing criteria, which are: (1) the domain on the From: address (if present) must be listed by the -d command line switch or the Domain configuration file setting, and (2) (a) the client connecting to the MTA must have authenticated, or (b) the client connecting to the MTA must be listed in the file referenced by the InternalHosts configuration file setting (or be in the default list for that option), or (c) the client must be connected to a daemon port named by the MTAs configuration file setting, or (d) the MTA must have set one or more macros matching the criteria set by the MacroList configuration file setting.

For (a) above, the test is whether or not the MTA macro "{auth_type}" is set and contains any non-empty value. This means the MTA must pass the value of that macro to the filter before or during the end-of-header (EOH) phase in order for its value to be tested. Check your MTA's configuration documentation for details.

For (1) above, other header fields may be selected using the SenderHeaders configuration file setting. See opendkim.conf(5) for more information.

When signing a message, a DKIM-Signature: header will be prepended to the message. The signature is computed using the private key provided. You must be running a version of sendmail(8) recent enough to be able to do header prepend operations (8.13.0 or later).

When verifying a message, an Authentication-Results: header will be prepended to indicate the presence of a signature and whether or not it could be validated against the body of the message using the public key advertised by the sender's nameserver. The value of this header can be used by mail user agents to sort or discard messages that were not signed or could not be verified.

Upon receiving SIGUSR1, if the filter was started with a configuration file, it will be re-read and the new values used. Note that any command line overrides provided at startup time will be lost when this is done. Also, the following configuration file values (and their corresponding command line items, if any) are not reloaded through this process: AutoRestart (-A), AutoRestartCount, AutoRestartRate, Background, MilterDebug, PidFile (-P), POPDBFile, Quarantine (-q), QueryCache, Socket (-p), StrictTestMode, TestPublicKeys, UMask, UserID (-u). The filter does not automatically check the configuration file for changes and reload.

## MTA MACROS
opendkim makes use of three MTA-provided macros, plus any demanded by configuration. The basic three are: "i" (the envelope ID, also known as the job ID or the queue ID), which is used for logging; "daemon_name" (the symbolic name given to the MTA instance that accepted the connection), which is used when performing tests against any "MTAs" setting used; and "auth_type", which is used to determine whether or not the SMTP client authenticated to the MTA. If the MTA does not provide them to opendkim then it is not able to apply their corresponding tests or do useful logging. Consult your MTA documentation to determine how to adjust your its configuration if some or all of these are not available.

## FILE PERMISSIONS
When the filter is started as the superuser and the UserID (-u) setting is used, the filter gives up its root privileges by changing to the specified user after the following steps are taken: (1) the configuration file (if any) is loaded; (2) if the KeyFile (-k) setting is used, that key is loaded into memory; (3) all data sets in the configuration file are opened, and those that are based on flat files are also read into memory; and (4) if ChangeRootDirectory is set, the process root is changed to that directory. This means on configuration reload, the filter will not be accessing these files or the configuration file as the superuser (and possibly from a different root), and any key files referenced by the KeyTable will also be accessed by the new user.

Thus, keys referenced by the KeyTable must always be accessible for read by the unprivileged user. Also, run-time reloads are not possible if any of the other files will not be readable by the unprivileged user.

## ENVIRONMENT
The following environment variable(s) can be used to adjust the behaviour of this filter:

DKIM_TMPDIR

The directory to use when creating temporary files. The default is /tmp.

## NOTES
When using DNS timeouts (see the -T option above), be sure not to use a timeout that is larger than the timeout being used for interaction between sendmail and the filter. Otherwise, the MTA could abort a message while waiting for a reply from the filter, which in turn is still waiting for a DNS reply.

The POP authentication database is expected to be a Sleepycat DB file (formerly known as a Berkeley DB) in hash format with keys containing the IP address in text form without a terminating NULL. The values of these records are not checked; only the existence of such records is of interest. The filter will attempt to establish a shared lock on the database before reading from it, so any programs which write to the database should keep their lock use to a minimum or else this filter will appear to hang while waiting for the lock operation to complete.

Features that involve specification of IPv4 addresses or CIDR blocks will use the inet_addr(3) function to parse that information. Users should be familiar with the way that function handles the non-trivial cases (for example, "192.0.2/24" and "192.0.2.0/24" are not the same thing).

## EXIT STATUS
Filter exit status codes are selected according to sysexits(3).

## HISTORY
DKIM is an amalgam of Yahoo!'s DomainKeys proposal, and Cisco's Internet Identified Mail (IIM) proposal.

## VERSION
This man page covers version 2.11.0 of opendkim.

## COPYRIGHT
Copyright (c) 2005-2008, Sendmail, Inc. and its suppliers. All rights reserved.

Copyright (c) 2009-2013, 2015, The Trusted Domain Project. All rights reserved.

## SEE ALSO
opendkim.conf(5), sendmail(8)

Sendmail Operations Guide

RFC5321 - Simple Mail Transfer Protocol

RFC5322 - Internet Messages

RFC5451 - Message Header Field for Indicating Message Authentication Status

RFC6008 - Authentication-Results Registration for Differentiating among Cryptographic Results

RFC6376 - DomainKeys Identified Mail


opendkim-genkey

title: opendkim-genkey(8)

summary: DKIM filter key generation tool

text:
# opendkim-genkey(8)

## NAME
opendkim-genkey - DKIM filter key generation tool

## SYNOPSIS
opendkim-genkey [options]

## DESCRIPTION
opendkim-genkey generates (1) a private key for signing messages using opendkim(8) and (2) a DNS TXT record suitable for inclusion in a zone file which publishes the matching public key for use by remote DKIM verifiers.

The filenames of these are based on the selector (see below); the private key will have a suffix of ".private" and the TXT record will have a suffix of ".txt".

Both long and short names are supported for most options.

## OPTIONS
-a

(--append-domain) Appends the domain name (see -d below) to the label in the generated TXT record, followed by a trailing period. By default it is assumed the domain name is implicit from the context of the zone file, and is therefore not included in the output.

-b bits

(--bits=n) Specifies the size of the key, in bits, to be generated. The default is 1024 which is the value recommended by the DKIM specification.

-d domain

(--domain=string) Names the domain which will use this key for signing. Currently only used in a comment in the TXT record file. The default is "example.com".

-D directory

(--directory=path) Instructs the tool to change to the named directory prior to creating files. By default the current directory is used.

-h algorithms

(--hash-algorithms=name[:name[...]]) Specifies a list of hash algorithms which can be used with this key. By default all hash algorithms are allowed.

--help

Print a help message and exit.

-n note

(--note=string) Includes arbitrary note text in the key record. By default, no such text is included.

-r

(--restricted) Restricts the key for use in e-mail signing only. The default is to allow the key to be used for any service.

-s selector

(--selector=name) Specifies the selector, or name, of the key pair generated. The default is "default".

-S

(--[no]subdomains) Disallows subdomain signing by this key. By default the key record will be generated such that verifiers are told subdomain signing is permitted. Note that for backward compatibility reasons, -S means the same as --nosubdomains.

-t

(--[no]testmode) Indicates the generated key record should be tagged such that verifiers are aware DKIM is in test at the signing domain.

-v

(--verbose) Increase verbose output.

-V

(--version) Print version number and exit.

## NOTES
Requires that the openssl(8) binary be installed and in the executing shell's search path.

## VERSION
This man page covers the version of opendkim-genkey that shipped with version 2.11.0 of OpenDKIM.

## COPYRIGHT
Copyright (c) 2007, 2008 Sendmail, Inc. and its suppliers. All rights reserved.

Copyright (c) 2009, 2011-2013, The Trusted Domain Project. All rights reserved.

## SEE ALSO
opendkim(8), openssl(8)

RFC6376 - DomainKeys Identified Mail


opendkim-genzone

title: opendkim-genzone(8)

text:
# opendkim-genzone(8)

## NAME
opendkim-genzone - DKIM public key zone file generation tool

## SYNOPSIS
opendkim-genzone [-C address] [-d domain] [-D] [-E secs] [-F] [-N ns[,...]] [-o file] [-r secs] [-R secs] [-S] [-t secs] [-T secs] [-u] [-v] [-x conffile] [dataset]

## DESCRIPTION
opendkim-genzone generates a file suitable for use with named(8) to publish a set of public keys.

The dataset parameter should specify a set of data as described in the opendkim(8) man page. It can currently refer to flat files, Sleepycat databases, comma-separated lists, LDAP directories or SQL databases. The dataset may be omitted if a configuration file (via the -x command line flag) is specified referring to a configuration file that sets a KeyTable parameter, in which case that value will be used.

The database contents should be formatted as described for the KeyTable parameter, described in the opendkim.conf(5) man page.

## OPTIONS
-C contact

Uses contact as the contact information to be used when an SOA record is generated (see -S below). If not specified, the userid of the executing user and the local hostname will be used; if the executing user can't be determined, "hostmaster" will be used.

-d domain

Restricts output to those records for which the domain field is the specified domain.

-D

Adds a "._domainkey" suffix to selector names in the zone file.

-E secs

When generating an SOA record (see -S below), use secs as the default record expiration time. The default is 604800.

-F

Adds a "._domainkey" suffix and the domainname to selector names in the zone file.

-N nslist

Specifies a comma-separated list of nameservers, which will be output in NS records before the TXT records. The first nameserver in this list will also be used in the SOA record (if -S is also specified) as the authority hostname.

-o file

Sends output to the named file rather than standard output.

-r secs

When generating an SOA record (see -S below), use secs as the zone refresh time. The default is 10800.

-R secs

When generating an SOA record (see -S below), use secs as the zone retry time. The default is 1800.

-s

Extends the logic of "-d" to include subdomains.

-S

Asks for an SOA record to be generated at the top of the output. The content of this output can be controlled using the -E, -r, -R, -T options. The serial number will be generated based on the current time of day.

-t ttl

Puts a TTL (time-to-live) value of ttl on all records output. The units are in seconds.

-T secs

When generating an SOA record (see -S below), use secs as the default record TTL time. The default is 86400.

-u

Produce output suitable for use as input to nsupdate(8).

-v

Increases the verbosity of debugging output written to standard error.

-x conffile

Names an opendkim.conf(5) file to be read for LDAP-specific parameters when an LDAP dataset is given on the command line. Not required for other dataset types. The default is /etc/opendkim.conf.

## VERSION
This man page covers the version of opendkim-genzone that shipped with version 2.11.0 of OpenDKIM.

## COPYRIGHT
Copyright (c) 2010, 2012, 2014, 2015, The Trusted Domain Project. All rights reserved.

## SEE ALSO
nsupdate(8), opendkim(8), opendkim.conf(5)


opendkim-testkey

title: opendkim-testkey(8)

summary: DKIM filter installation test

text:
# opendkim-testkey(8)

## NAME
opendkim-testkey - DKIM filter installation test

## SYNOPSIS
opendkim-testkey [-d domain] [-s selector] [-k keypath] [-v] [-x configfile]

## DESCRIPTION
opendkim-testkey verifies the setup of signing and verifying (private and public) keys for use with opendkim(8).

The test program will read a domain name and selector from the command line, configuration file or a key table, then query and parse the resulting DKIM key(s), reporting any errors found.

If a key path is also provided, the test program will read the private key named and attempt to confirm that the private key specified by keypath (or in the key table) and the public DKIM key retrieved match.

## OPTIONS
-d domain

Names the domain in which signing is to be done. More specifically, names the domain in which the public key matching the provided private key will be found. This parameter must be provided either explicitly, or in the configuration file, or via a KeyTable (see opendkim.conf(5) for details).

-k keypath

Specifies the path to the private key file which should be used for this test. This parameter is optional

-s selector

Names the selector within the specified domain whose public key should be retrieved and tested, comparing it to the private key if provided. This parameter must be provided either explicitly, or in the configuration file, or via a KeyTable (see opendkim.conf(5) for details).

-v

Increases the amount of output (verbosity) of the program. May be specified multiple times for increased output.

-x conffile

Names a configuration file to be parsed. See the opendkim.conf(5) man page for details. The only values used are Domain, Selector, KeyFile, KeyTable, TrustAnchorFile and ResolverConfig. The default is /etc/opendkim.conf.

## NOTES
The test program will also complain if a private key file is readable by anyone other than the user executing the program.

## VERSION
This man page covers the version of opendkim-testkey that shipped with version 2.11.0 of OpenDKIM.

## COPYRIGHT
Copyright (c) 2007, 2008, Sendmail, Inc. and its suppliers. All rights reserved.

Copyright (c) 2009-2012, The Trusted Domain Project. All rights reserved.

## SEE ALSO
opendkim(8)

RFC6376 - DomainKeys Identified Mail


opendkim-testmsg

title: opendkim-testmsg(8)

summary: DKIM message tst

text:
# opendkim-testmsg(8)

## NAME
opendkim-testmsg - DKIM message tst

## SYNOPSIS
opendkim-testmsg [-C] [-d domain] [-K] [-k keypath] [-s selector] [-t path]

## DESCRIPTION
opendkim-testmsg signs or verifies an input message. This is similar to the test mode for opendkim(8) except that it does not use the same configuration system or milter interface. Rather, it is a direct access to the DKIM library with those functions "out of the way".

The message is read from standard input. In signing mode, the complete signed message will then be written to standard output. When verifying, there will be no output unless an error occurred.

To sign a message, the -d, -k and -s settings in the SYNOPSIS above must be provided. If all of them are absent, the input message will be verified. If some but not all are present, an error is returned.

## OPTIONS
-C

If specified, the signature header field generated in signing mode will be line-terminated with carriage-return line-feed, instead of just line-feed.

-d domain

Names the domain in which signing is to be done. More specifically, names the domain in which the public key matching the provided private key would be found in a live test.

-K

Arranges to keep temporary files generated during message canonicalization for debugging purposes.

-k keypath

Specifies the path to the private key file which should be used to sign the input message.

-s selector

Names the selector within the specified domain that should be included in the signature.

-t path

Specifies the directory in which temporary files are to be created. The default is /tmp.

## VERSION
This man page covers the version of opendkim-testmsg that shipped with version 2.11.0 of OpenDKIM.

## COPYRIGHT
Copyright (c) 2011-2013, The Trusted Domain Project. All rights reserved.

## SEE ALSO
opendkim(8)

RFC6376 - DomainKeys Identified Mail


opendmarc

package: opendmarc

title: opendmarc(8)

summary: DMARC email policy filter for MTAs

text:
# opendmarc(8)

## NAME
opendmarc - DMARC email policy filter for MTAs

## SYNOPSIS
opendmarc [-A] [-c configfile] [-f] [-l] [-n] [-p socketspec] [-P pidfile] [-t file[,file[...]]] [-u userid[:group]] [-v] [-V]

## DESCRIPTION
opendmarc implements the proposed DMARC specification for authentication of message and reporting of observed traffic.

opendmarc uses the milter interface, originally distributed as part of version 8.11 of sendmail(8), to provide a DMARC processing service for mail transiting a milter-aware MTA.

Most, if not all, of the command line options listed below can also be set using a configuration file. See the -c option for details.

opendmarc relies on addition of Authentication-Results fields by upstream filters on trusted hosts to collect input to the DMARC algorithm. It does not itself do DKIM or SPF evaluation.

## OPTIONS
-A

Automatically re-start on failures. Use with caution; if the filter fails instantly after it starts, this can cause a tight fork(2) loop. This can be mitigated using some values in the configuration file to limit restarting. See opendmarc.conf(5).

-c configfile

Read the named configuration file. See the opendmarc.conf(5) man page for details. Values in the configuration file are overridden when their equivalents are provided on the command line until a configuration reload occurs. The OPERATION section describes how reloads are triggered. The default is to read a configuration file from /etc/opendmarc.conf if one exists, or otherwise to apply defaults to all values.

-f

Normally opendmarc forks and exits immediately, leaving the service running in the background. This flag suppresses that behaviour so that it runs in the foreground.

-l

Log via calls to syslog(3) any interesting activity.

-n

Parse the configuration file and command line arguments, reporting any errors found, and then exit. The exit value will be 0 if the filter would start up without complaint, or non-zero otherwise.

-p socketspec

Specifies the socket that should be established by the filter to receive connections from sendmail(8) in order to provide service. socketspec is in one of two forms: local:path which creates a UNIX domain socket at the specified path, or inet:port[@host] or inet6:port[@host] which creates a TCP socket on the specified port within the specified protocol family. If the host is not given as either a hostname or an IP address, the socket will be listening on all interfaces. If neither socket type is specified, local is assumed, meaning the parameter is interpreted as a path at which the socket should be created. If an IP address is used, it must be enclosed in square brackets. This parameter is mandatory.

-P pidfile

Specifies a file into which the filter should write its process ID at startup.

-t file[,file[,...]]

Reads email messages from the named files and processes them as if they were received by the filter. The service is not started, and actions normally sent back to the MTA will instead be printed on standard output.

-u userid[:group]

Attempts to be come the specified userid before starting operations. The process will be assigned all of the groups and primary group ID of the named userid unless an alternate group is specified. See the FILE PERMISSIONS section for more information.

-v

Increase verbose output during test mode (see -t above). May be specified more than once to request increasing amounts of output.

-V

Print the version number and supported canonicalization and signature algorithms, and then exit without doing anything else.

## SIGNALS
Upon receiving SIGUSR1, if the filter was started with a configuration file, it will be re-read and the new values used. Note that any command line overrides provided at startup time will be lost when this is done. Also, the following configuration file values (and their corresponding command line items, if any) are not reloaded through this process: AutoRestart (-A), AutoRestartCount, AutoRestartRate, Background, MilterDebug, PidFile (-P), Socket (-p), UMask, UserID (-u). The filter does not automatically check the configuration file for changes and reload.

## VERSION
This man page covers version 1.4.2 of opendmarc.

## COPYRIGHT
Copyright (c) 2012, The Trusted Domain Project. All rights reserved.

## SEE ALSO
opendmarc.conf(5), sendmail(8)

Sendmail Operations Guide

RFC4408 - Sender Policy Framework

RFC5321 - Simple Mail Transfer Protocol

RFC5322 - Internet Messages

RFC5451 - Message Header Field for Indicating Message Authentication Status

RFC6376 - DomainKeys Identified Mail

RFC6591 - Authentication Failure Reporting Using the Abuse Reporting Format


opendmarc-check

title: opendmarc-check(8)

summary: DMARC record check tool

text:
# opendmarc-check(8)

## NAME
opendmarc-check - DMARC record check tool

## SYNOPSIS
opendmarc-check domain [domain [...]]

## DESCRIPTION
opendmarc-check queries the DNS for a DMARC record for the named domain(s) and then translates the content found to a human-readable form. This can be used to ensure that the DMARC policy you have placed in the nameserver is what you intended for others to see.

## VERSION
This man page covers version 1.4.2 of opendmarc.

## COPYRIGHT
Copyright (c) 2012, The Trusted Domain Project. All rights reserved.

## SEE ALSO
opendmarc.conf(5), opendmarc(8)


opendmarc-expire

title: opendmarc-expire(8)

summary: OpenDMARC history data expiration tool

text:
# opendmarc-expire(8)

## NAME
opendmarc-expire - OpenDMARC history data expiration tool

## SYNOPSIS
opendmarc-expire [options]

## DESCRIPTION
opendmarc-expire expires old records from the database that is part of the OpenDMARC aggregate reporting feature.

## OPTIONS
--alltables

Expire records in all tables rather than only the large ones.

--dbhost=host

Attempts to connect to the database server on the named host. The default is "localhost".

--dbname=name

Requests a connection to the database called name. The default is "opendmarc".

--dbpasswd=password

Attempts to authenticate to the database server using the specified password. The default is "opendmarc".

--dbport=port

Tries to connect to the database at the specified TCP port. The default is 3306.

--dbuser=user

Attempts to authenticate to the database server as the specified user. The default is "opendmarc".

--expire=days

Indicates the number of days of data to keep. The default is 180.

--help

Prints a usage message and exits.

--verbose

Requests verbose output.

--version

Prints version number and exits.

## VERSION
This man page covers the version of opendmarc-expire that shipped with version 1.4.2 of OpenDMARC.

## COPYRIGHT
Copyright (c) 2012, 2014, The Trusted Domain Project. All rights reserved.

## SEE ALSO
opendmarc(8), opendmarc-import(8)


opendmarc-import

title: opendmarc-import(8)

text:
# opendmarc-import(8)

## NAME
opendmarc-import - OpenDMARC aggregate report data import tool

## SYNOPSIS
opendmarc-import [options]

## DESCRIPTION
opendmarc-import reads per-message data recorded by an instance of opendmarc(8) and inserts it into an SQL database, for later use by opendmarc-reports(8) to generate aggregate reports.

## OPTIONS
--dbhost=hostname

Specifies the hostname on which the SQL server is running. Defaults to the value of the environment variable OPENDMARC_DBHOST, or "localhost" if the environment variable is not set.

--dbname=name

Specifies the SQL database name to be accessed. Defaults to the value of the environment variable OPENDMARC_DB, or "opendmarc" if the environment variable is not set.

--dbpasswd=password

Specifies the password for the SQL database to be accessed. Defaults to the value of the environment variable OPENDMARC_PASSWORD, or "opendmarc" if the environment variable is not set.

--dbport=port

Specifies the TCP port on which the SQL server is expected to be listening. Defaults to the value of the environment variable OPENDMARC_PORT, or 3306 if the environment variable is not set.

--dbuser=user

Specifies the SQL user to be used to access the database. Defaults to the value of the environment variable OPENDMARC_USER, or "opendmarc" if the environment variable is not set.

--help

Prints a help message and terminates.

--input=file

Reads from the named file instead of from standard input (the default).

--verbose

Increase the amount of verbosity written to standard output.

--version

Print version number and exit.

## VERSION
This man page covers the version of opendmarc-import that shipped with version 1.4.2 of OpenDMARC.

## COPYRIGHT
Copyright (c) 2012, The Trusted Domain Project. All rights reserved.

## SEE ALSO
opendmarc(8), opendmarc.conf(5) opendmarc-reports(8)


opendmarc-importstats

title: opendmarc-importstats(8)

text:
# opendmarc-importstats(8)

## NAME
opendmarc-importstats - import OpenDMARC statistics/history data

## SYNOPSIS
opendmarc-importstats

## DESCRIPTION
opendmarc-importstats is a fairly trivial shell script, typically executed by cron(8), that rotates an OpenDMARC statistics/history data file to a unique filename and then attempts to import it to a local database for later processing by executing opendmarc-import(8). On successful import, the unique file is removed; on failure, the script executes ls(1) on the file and exits without removing the unique file. The intent of this last step is to cause cron to generate a message to a responsible party so that the failure will be investigated.

## VERSION
This man page covers the version of opendmarc-importstats that shipped with version 1.4.2 of OpenDMARC.

## COPYRIGHT
Copyright (c) 2013, The Trusted Domain Project. All rights reserved.

## SEE ALSO
cron(8), opendmarc(8), opendmarc-import(8)


opendmarc-params

title: opendmarc-params(8)

text:
# opendmarc-params(8)

## NAME
opendmarc-params - OpenDMARC reporting parameters setup tool

## SYNOPSIS
opendmarc-params [options] domain

## DESCRIPTION
opendmarc-params records a specific reporting address for aggregate reports about the named domain and flags it as "locked" in the reporting requests database. This is done to allow an administrator to force generation of reports and have them sent to a specific address regardless of what data may (or may not) be found in the DNS for the named domain.

## OPTIONS
--dbhost=host

Attempts to connect to the database server on the named host. The default is "localhost".

--dbname=name

Requests a connection to the database called name. The default is "opendmarc".

--dbpasswd=password

Attempts to authenticate to the database server using the specified password. The default is "opendmarc".

--dbport=port

Tries to connect to the database at the specified TCP port. The default is 3306.

--dbuser=user

Attempts to authenticate to the database server as the specified user. The default is "opendmarc".

--help

Prints a usage message and exits.

--rua=string

Sets the reporting URI for the named domain to the specified string.

--unlock

Unlocks the record for the named domain.

--verbose

Requests verbose output.

--version

Prints version number and exits.

## VERSION
This man page covers the version of opendmarc-params that shipped with version 1.4.2 of OpenDMARC.

## COPYRIGHT
Copyright (c) 2012, The Trusted Domain Project. All rights reserved.

## SEE ALSO
opendmarc(8), opendmarc-import(8), opendmarc-reports(8)


opendmarc-reports

title: opendmarc-reports(8)

text:
# opendmarc-reports(8)

## NAME
opendmarc-reports - OpenDMARC aggregate report generation tool

## SYNOPSIS
opendmarc-reports [options]

## DESCRIPTION
opendmarc-reports pulls data from an OpenDMARC database and generates periodic aggregate reports. The database is populated by a running opendmarc-import(8) on a message history file generated by an opendmarc(8) filter as messages arrive and are processed. This includes the collection of reporting URIs, which this script uses to make reports available to those that request them.

## OPTIONS
--day

Generate reports on day boundaries. Overrides the value of --interval (see below).

--dbhost=hostname

Specifies the hostname on which the SQL server is running. Defaults to the value of the environment variable OPENDMARC_DBHOST, or "localhost" if the environment variable is not set.

--dbname=name

Specifies the SQL database name to be accessed. Defaults to the value of the environment variable OPENDMARC_DB, or "opendmarc" if the environment variable is not set.

--dbpasswd=password

Specifies the password for the SQL database to be accessed. Defaults to the value of the environment variable OPENDMARC_PASSWORD, or "opendmarc" if the environment variable is not set.

--dbport=port

Specifies the TCP port on which the SQL server is expected to be listening. Defaults to the value of the environment variable OPENDMARC_PORT, or 3306 if the environment variable is not set.

--dbuser=user

Specifies the SQL user to be used to access the database. Defaults to the value of the environment variable OPENDMARC_USER, or "opendmarc" if the environment variable is not set.

--domain=name

Generates a report (if one is due) for the named domain, rather than checking all of them.

--help

Prints a help message and terminates.

--interval=secs

Generates reports only for hosts that have not had a report generated in at least the last secs seconds.

--nodomain=name

Skips generating a report for the named domain. Can be specified multiple times to skip multiple reporting domains.

--noupdate

Suppresses marking the time of the transmission of the report in the database. Normally this would be done to prevent reports from being sent too close together.

--report-email=addr

Generates reports using the specified address, which is used in the report content and in the SMTP transaction. The default is "postmaster@HOSTNAME" where HOSTNAME is replaced by the hostname of the host generating the report.

--report-org=domain

Generates reports using the specified domain name as the organization responsible for the report. This is used to create the archive filename and is included in the report content. The default is the hostname of the host generating the report.

--smtp-host=host

Causes reports to be sent by transmitting them using SMTP to the named host which can be an IP address or a hostname. The default is "127.0.0.1".

--smtp-port=port

Causes reports to be sent by transmitting them using SMTP to the specified port. The default is 25.

--utc

Instructs the database to change to the UTC timezone when generating output. Otherwise, the database default is used.

--verbose

Increase the amount of verbosity written to standard output.

--version

Print version number and exit.

## VERSION
This man page covers the version of opendmarc-reports that shipped with version 1.4.2 of OpenDMARC.

## COPYRIGHT
Copyright (c) 2012, 2014, 2015, The Trusted Domain Project. All rights reserved.

## SEE ALSO
opendmarc(8), opendmarc.conf(5), opendmarc-import(8)


ods-control

package: opendnssec

title: ods-control(8)

summary: OpenDNSSEC control utility

text:
# ods-control(8)

## NAME
ods-control - OpenDNSSEC control utility

## SYNOPSIS
ods-control hsm ...

ods-control enforcer ...

ods-control signer ...

ods-control start

ods-control stop

## DESCRIPTION
ods-control is a helper utility which gives a combined interface for different command utilities within OpenDNSSEC. It can also start and stop OpenDNSSEC by controlling the two daemons.

## OPTIONS
hsm

The remainder of the command line will be sent to the ods-hsmutil utility

enforcer

The remainder of the command line will be sent to the ods-enforcer utility

signer

The remainder of the command line will be sent to the ods-signer utility

start

Will start the two daemons of OpenDNSSEC, ods-enforcerd and ods-signerd

stop

Will stop the two daemons of OpenDNSSEC, ods-enforcerd and ods-signerd

## SEE ALSO
ods-enforcer(8), ods-enforcerd(8), ods-signer(8), ods-signerd(8), ods-kasp(5), ods-kaspcheck(1), ods-timing(5), ods-hsmspeed(1), ods-hsmutil(1), opendnssec(7), http://www.opendnssec.org/

## AUTHORS
ods-control was written by Jakob Schlyter as part of the OpenDNSSEC project.


ods-enforcer

title: ods-enforcer(8)

summary: OpenDNSSEC enforcer Engine client

text:
# ods-enforcer(8)

## NAME
ods-enforcer - OpenDNSSEC enforcer Engine client

## SYNOPSIS
ods-enforcer help | start | stop | reload | running

ods-enforcer queue | flush | signconf | enforce | verbosity <number>

ods-enforcer update conf | repositorylist | all

ods-enforcer policy list | export | import | purge | resalt

ods-enforcer zone list | add | delete | set-policy

ods-enforcer zonelist export | import

ods-enforcer key list | export | import | ds-submit | ds-seen | ds-retract | ds-gone | generate | purge | rollover

ods-enforcer backup list | prepare | commit | rollback

ods-enforcer rollover list

ods-enforcer repository list

ods-enforcer help [COMMAND]

## DESCRIPTION
ods-enforcer is part of the OpenDNSSEC software. With this tool, you can send commands to the enforcer engine daemon. ods-enforcer manages the operation of the KASP Enforcer, which is the part of OpenDNSSEC that triggers key generation and signing operations on domains based on policies with user-defined timing and security requirements. Among the functions of ods-enforcer are key management, import to the zone list and manually rolling keys to recover from exceptional situations like key loss. The following sections discuss the subcommands.

For more information, go to http://www.opendnssec.org and visit the Documentation page.

## GENERIC OPTIONS
help

Show a brief list of commands.

start

Start the engine and the process.

stop

Stop the engine and terminate the process.

reload

Reload the engine.

running

Return acknowledgment that the engine is running.

verbosity

Set verbosity to the given number.

## SCHEDULING OPTIONS
queue

queue shows all scheduled tasks with their time of the earliest executions, as well as all tasks currently being processed.

flush

Execute all scheduled tasks immediately.

enforce

Force the enforcer to run once for every zone.

## SIGNCONF AND UPDATE SUBCOMMANDS
signconf

Force write of signer configuration files for all zones.

update conf

Update the configuration from conf.xml and reload the enforcer.

update repository list

List repositories.

update all

Perform policy import, zonelist import, and update repository list.

## POLICY ADMINISTRATION SUBCOMMNADS
policy list

List all policies in the database.

policy export (--policy <policy> | --all)

Export a specified policy or all of them from the database.

policy import

Import policies from kasp.xml into the enforcer database.

policy purge

This command will remove any policies from the database which have no associated zones. Use with caution.

policy resalt

Generate new NSEC3 salts for policies that have salts older than the resalt duration.

## ZONE MANAGEMENT SUBCOMMANDS
zone list

List all zones currently in the database.

zone add --zone <zone> [--policy <policy>] [--signerconf <path>] [--in-type <type>] [--input <path>] [--out-type <type>] [--output <path>] [--xml] [--suspend]

Add a new zone to the enforcer database.

zone delete (--zone <zone> | --all [--xml])

Delete a zone or all of zones from the enforcer database.

zone set-policy --zone <zone> --policy <policy> [--xml]

Change the policy for a zone in the enforcer database.

zonelist export

Export list of zones from the database to the zonelist.xml file.

zonelist import [--remove-missing-zones] [--file <absolute path>]

Import zones from zonelist.xml into the enforcer database.

## KEY MANAGEMENT SUBCOMMANDS
key list [--verbose] [--debug] [--full] [--parsable] [--zone] [--keystate] [--all]

List information about keys in all zones, or in a particular zone from the database.

key export (--zone <zone> | --all) [--keystate <state>] [--keytype <type>] [--ds]

Export DNSKEY(s) for a given zone/all from the database.

key import --cka_id <CKA_ID> --repository <repository> --zone <zone> --bits <size> --algorithm <algorithm> --keystate <state> --keytype <type> --inception_time <time>

Add a key which was created outside of the OpenDNSSEC code into the enforcer database.

key ds-submit --zone <zone> (--keytag <keytag> | --cka_id <CKA_ID>)

Issue a ds-submit to the enforcer for a KSK.

key ds-seen --zone <zone> (--keytag <keytag> | --cka_id <CKA_ID>)

Issue a ds-seen to the enforcer for a KSK.

key ds-seen --all

Issue a ds-seen for all ready (for ds-seen) KSKs. This command indicates to OpenDNSSEC that a submitted DS record has appeared in the parent zone, and thereby trigger the completion of a KSK rollover.

key ds-retract --zone <zone> (--keytag <keytag> | --cka_id <CKA_ID>)

Issue a ds-retract to the enforcer for a KSK.

key ds-gone --zone <zone> (--keytag <keytag> | --cka_id <CKA_ID>)

Issue a ds-gone to the enforcer for a KSK.

key generate --duration <duration> (--policy <policy> | --all)

Pre-generate keys for all or a given policy, the duration to pre-generate for can be specified or otherwise its taken from the conf.xml.

key purge (--policy <policy> | --zone <zone> | --delete)

This command will remove keys from the database and HSM that are dead. If the --delete (or -d) flag is given, the keys are also purged from the HSM. Keys are always purged from the HSM if the <Purge>

key rollover (--zone <zone> | --policy <policy>) [--keytype <keytype> | --all]

Start a key rollover of the desired type *now* or all of them. The process is the same as for the scheduled automated rollovers however it does not wait for the keys lifetime to expire before rolling. The next rollover is due after the newest key aged passed its lifetime.

rollover list [--zone <zone>]

List the expected dates and times of upcoming rollovers. This can be used to get an idea of upcoming works.

## REPOSITORY AND BACKUP SUBCOMMANDS
backup list --repository <repository>

Enumerate backup status of keys.

backup prepare --repository <repository>

Flag the keys found in all configured HSMs as to be backed up.

backup commit --repository <repository>

Mark flagged keys found in all configured HSMs as backed up.

backup rollback --repository <repository>

repository list

List repositories.

## FILES
/etc/opendnssec/conf.xml

The main configuration file for OpenDNSSEC.

/etc/opendnssec/zonelist.xml

The list of zones as defined in conf.xml. This list is used during 'zonelist import'.

/etc/opendnssec/kasp.xml

The configuration of policies that define timing and security, as defined in conf.xml.

/var/opendnssec/unsigned/

The location that is usually configured in conf.xml which contains unsigned zones.

/var/opendnssec/signed/

The location that is usually configured in conf.xml which contains signed zones.

## DIAGNOSTICS
will log all the problems via stderr.

## SEE ALSO
ods-control(8), ods-enforcerd(8), ods-signerd(8), ods-signer(8), ods-kasp(5), ods-kaspcheck(1), ods-timing(5), ods-hsmspeed(1), ods-hsmutil(1), opendnssec(7), http://www.opendnssec.org/

## AUTHORS
ods-enforcer was written by NLnet Labs as part of the OpenDNSSEC project.


ods-enforcer-db-setup

title: ods-enforcer-db-setup(8)

text:
# ods-enforcer-db-setup(8)

## NAME
ods-enforcer-db-setup - OpenDNSSEC enforcer daemon initialization utility

## SYNOPSIS
ods-enforcer-db-setup [-h] [-f] [-V]

## DESCRIPTION
The ods-enforcer-db-setup initializes the database used by the ods-enforcerd. It should be used with care since all existing information in the database schema will be deleted. If you have existing zones stored in this database this means that you loose the information on which zones are signed with which keys. Key material itself and signer information are not removed.

ods-enforcer-db-setup is part of the OpenDNSSEC software. For more information, go to http://www.opendnssec.org and visit the Documentation page.

## OPTIONS
-h

Show this help.

-f

Do not ask for confirmation.

-V

Show version and exit.

## DIAGNOSTICS
May log problems via standard syslog(8).

## SEE ALSO
ods-control(8), ods-enforcer(8), ods-signerd(8), ods-signer(8), ods-ksmutil(1), ods-kasp(5), ods-kaspcheck(1), ods-timing(5), ods-hsmspeed(1), ods-hsmutil(1), opendnssec(7), http://www.opendnssec.org/

## AUTHORS
ods-enforcerd was written by NLnet Labs as part of the OpenDNSSEC project.


ods-enforcerd

title: ods-enforcerd(8)

summary: OpenDNSSEC enforcer Engine daemon

text:
# ods-enforcerd(8)

## NAME
ods-enforcerd - OpenDNSSEC enforcer Engine daemon

## SYNOPSIS
ods-enforcerd [-c FILE] [-d] [-h] [-i] [-v] [-V]

## DESCRIPTION
ods-enforcerd is part of the OpenDNSSEC software. It will keep your DNS zones continuous signed. For more information, go to http://www.opendnssec.org and visit the Documentation page.

## OPTIONS
-c FILE

Read configuration from file, instead of using the default.

-d

Run daemon in foreground.

-h

Show this help.

-i

Print configuration and exit (for debugging purposes).

-v

Increase verbosity.

-V

Show version and exit.

## DIAGNOSTICS
will log all the problems via standard syslog(8).

## SEE ALSO
ods-control(8), ods-enforcer(8), ods-signerd(8), ods-signer(8), ods-kasp(5), ods-kaspcheck(1), ods-timing(5), ods-hsmspeed(1), ods-hsmutil(1), opendnssec(7), http://www.opendnssec.org/

## AUTHORS
ods-enforcerd was written by NLnet Labs as part of the OpenDNSSEC project.


ods-signer

title: ods-signer(8)

summary: OpenDNSSEC Signer Engine client

text:
# ods-signer(8)

## NAME
ods-signer - OpenDNSSEC Signer Engine client

## SYNOPSIS
ods-signer [-h] clear <zone> | flush | queue | reload | running | sign <zone>[--serial<number>] | sign --all | start | stop | update [--all] | update <zone> | verbosity <number> | zones

## DESCRIPTION
ods-signer is part of the OpenDNSSEC software. With this tool, you can send commands to the signer engine daemon. For more information, go to http://www.opendnssec.org and visit the Documentation page.

## OPTIONS
-h

Show this help.

## DIAGNOSTICS
will log all the problems via stderr.

## SEE ALSO
ods-control(8), ods-enforcerd(8), ods-hsmspeed(1), ods-hsmutil(1), ods-kaspcheck(1), ods-signerd(8), ods-timing(5), opendnssec(7), http://www.opendnssec.org/

## AUTHORS
ods-signer was written by NLnet Labs as part of the OpenDNSSEC project.


ods-signerd

title: ods-signerd(8)

summary: OpenDNSSEC Signer Engine daemon

text:
# ods-signerd(8)

## NAME
ods-signerd - OpenDNSSEC Signer Engine daemon

## SYNOPSIS
ods-signerd [-1] [-c FILE] [-d] [-h] [-i] [-v] [-V]

## DESCRIPTION
ods-signerd is part of the OpenDNSSEC software. It will keep your DNS zones continuous signed. For more information, go to http://www.opendnssec.org and visit the Documentation page.

## OPTIONS
-1

Run signer engine once, then exit (for debugging purposes).

-c FILE

Read configuration from file, instead of using the default.

-d

Run daemon in foreground.

-h

Show this help.

-i

Print configuration and exit (for debugging purposes).

-v

Increase verbosity.

-V

Show version and exit.

## DIAGNOSTICS
will log all the problems via standard syslog(8).

## SEE ALSO
ods-control(8), ods-enforcerd(8), ods-enforcer(8), ods-hsmspeed(1), ods-hsmutil(1), ods-kaspcheck(1), ods-signer(8), ods-timing(5), ods-kasp(5), opendnssec(7), http://www.opendnssec.org/

## AUTHORS
ods-signerd was written by NLnet Labs as part of the OpenDNSSEC project.


ipmilan

package: openipmi-lanserv

title: ipmilan(8)

summary: IPMI LAN to System Interface Converter

text:
# ipmilan(8)

## NAME
ipmilan - IPMI LAN to System Interface Converter

## SYNOPSIS
ipmilan [-c configfile] [-i ipmidevice] [-d] [-n]

## DESCRIPTION
The ipmilan daemon allows an IPMI system interface using the OpenIPMI device driver to be accessed using the IPMI 1.5 or 2.0 LAN protocol.

ipmilan supports the full authentication capabilities of the IPMI LAN protocol.

ipmilan supports multiple IP addresses for fault-tolerance. Note that messages coming in on an address are always sent back out on the same address they came in.

## OPTIONS
-c config-file

Set the configuration file to one other than the default of /etc/ipmi_lan.conf

-n

Stops the daemon from forking and detaching from the controlling terminal. This is useful for running from init.

-d

Turns on debugging to standard output. You generally have to use -n with this.

## CONFIGURATION
Configuration is accomplished through the file /etc/ipmi_lan.conf. A file with another name or path may be specified using the -c option. See the ipmi_lan config file man page for more details.

## SECURITY
ipmilan implements normal IPMI security. The default is no access for anyone, so the default is pretty safe, but be careful what you add, because this is access to control your box. straight and none authorizations are not recommended, you should probably stick with md2 or md5.

## SIGNALS
SIGHUP

ipmilan should handle SIGHUP and reread it's configuration files. However, it doesn't right now. It might in the future, for now you will have to kill it and restart it. Clients should handle reconnecting in this case. If they don't, they are broken.

## ERROR OUTPUT
At startup, all error output goes to stderr. After that, all error output goes to syslog.

## FILES
/etc/ipmi_lan.conf

## SEE ALSO
ipmi_lan(5),ipmi_ui(1),openipmish(1)

## KNOWN PROBLEMS
Currently, ipmilan does not implement writing the config file. IPMI commands to change configuration options are accepted, but the permanent writing of the changes does not currently work.

## AUTHOR
Corey Minyard <cminyard@mvista.com>


title: openl2tpd(8)

summary: L2TP protocol daemon

text:
# openl2tpd(8)

## NAME
openl2tpd - L2TP protocol daemon

## SYNOPSIS
openl2tpd [-f] [-R] [-D] [-d debugmask] [-L log-facility] [-p plugin-file]

[-u udp-port] [-c config-file] [-S] [-y ppp-throttle-rate]

## DESCRIPTION
openl2tpd implements the control message protocols of L2TP version 2 as specified in RFC2661. It is required to setup, maintain and teardown L2TP tunnels and sessions.

For general information on the features of OpenL2TP refer to openl2tp(7).

## OPTIONS
-d debugmask

Set the system-wide debug trace message mask. The mask may be specified as a decimal or hexadecimal integer or as a comma-separated list of trace categories. Trace messages are categorized as SYSTEM, API, PROTOCOL, FSM (finite state machine), DATA, FUNC (functions), XPRT (transport), AVP, AVPHIDE and AVPDATA. Each category of message may be enabled/disabled when L2TP is first started using this option. See the DEBUGGING section below.

-D

Enable debug messages from all created tunnels and sessions. By default, new tunnels and sessions do not cause trace messages to be output unless the tunnel or session trace_flags parameter is set, perhaps via their profile. This flag sets the default profiles' trace_flags to all-enabled. It is provided as a convenient shortcut to setting the trace_flags of all default profiles to all-enabled. -f Run in the foreground. By default, openl2tpd forks itself and runs in the background. For debugging, it is sometimes useful to run the application in the foreground. Note that when run in the foreground, any trace messages are sent to the controlling terminal rather than to syslog.

-L log-facility

By default, openl2tpd logs messages to the LOG_DAEMON syslog facility. This option may be used to log messages to one of the localN facilities instead (local0..local7) so that the logged messages can be directed via syslog configuration to a separate file or syslog server. See syslog.conf(5) for how to configure syslog.

-p plugin-file

Loads the named L2TP PPP plugin (a shared library supporting the OpenL2TP plugin interface). By default, the ppp_unix plugin is loaded, which makes openl2tpd use the standard UNIX pppd PPP daemon. The ability to load a different plugin allows openl2tpd to interface with other (possibly proprietary) PPP implementations without requiring internal changes to openl2tpd itself. Plugins are installed in /usr/lib/openl2tp/. More than one plugin may be loaded by specifying multiple -p options.

-R

Enables remote management. openl2tpd is controlled using Sun RPC requests. Sun RPC requests may be sent over a network so a control application implementing the OpenL2TP RPC API documented in openl2tp_rpc(4) may control openl2tpd remotely. In most environments, remote configuration isn't useful so is disabled by default. However, in closed cluster or chassis systems where several instances of openl2tpd may be running on different CPUs, the ability to control openl2tpd over a network using RPC is extremely useful.

-u udp-port

Tells openl2tpd to listen on the specified port rather than the default L2TP port (1701).

-c config-file

Read configuration commands from the specified file rather than the default /etc/openl2tpd.conf. This option may not be available in all environments since it is an installation option. If not available, use l2tpconfig's config restore command instead.

-S

Enable openl2tpd system status files. When this option is given, openl2tpd writes status information to files under /var/run/openl2tpd for each profile, peer, tunnel and session. These may be read using any standard file access mechanism to examine status of openl2tpd. This option may not be available in all environments since it is an installation option. If not available, use l2tpconfig commands instead.

-y ppp-throttle-rate

When starting or stopping ppp processes per session, this option will cause openl2tpd to limit the number of active processes to the specified value. PPP processes are deemed active when they are trying to connect to their peer or when they are being shut down. Note that this parameter does not limit the total number of pppd processes - it only limits the number of those processes that are created or deleted simultaneously by openl2tpd. Use this option when starting openl2tpd if the system becomes overloaded when lots of sessions are created or deleted simultaneously, for example when persistant tunnels recover. Most users are unlikely to need this option.

## CONFIGURATION
Configuration is typically done using an application supporting OpenL2TP's RPC interface documented in openl2tp_rpc(4). One such application is l2tpconfig(1) which is bundled with OpenL2TP and which provides an intuitive command line interface.

Since OpenL2TP uses Sun RPC which is available in most commercial operating systems including Microsoft Windows, Sun Solaris and even embedded RTOS such as WindRiver's VxWorks, custom management applications may be developed to control openl2tpd.

Where RPC is not available, the system administrator may install OpenL2TP with local config file support. If this feature is enabled, the config file is read at startup and when openl2tpd receives a SIGHUP signal. Most environments will use the l2tpconfig utility's config restore command to load a previously saved configuration..

## DEBUGGING
Many problems can be debugged without enabling debug logging. openl2tpd maintains numerous counters that can help with problem diagnosis. At the system level, the total number of good/bad L2TP control messages received of each message type are counted, as are the total number of illegal messages received, the number of vendor-specific AVPs received, tunnel authentication failures, session setup failures, resource allocation failures, sequence number errors and so on. Each tunnel keeps detailed status about the low-level L2TP transport such as next sequence number to be sent, sequence number expected next from peer, number of ZLB messages sent and received, number of HELLO messages sent and received and the number of data packets sent and received. Thus the first stage of problem diagnosis should always be to examine system status and statistics.

General status and statistics available will often point to where the problem lies, but it may also be necessary to obtain trace from the system. OpenL2TP allows very fine levels of control over system logging, right down to individual message categories of specific tunnel or session instances. A modifiable trace_flags parameter is a trace message mask. Each tunnel and session instance has a trace_flags parameter, the initial value of which is set from a tunnel or session profile.

trace_flags is defined as a 32-bit bitmask, where bits are defined as follows:-

```
Type        Bitmask       Description
PROTOCOL    1             L2TP control protocol messages
FSM         2             State Machine events and state changes
API         4             Management interface
AVP         8             L2TP message attributes
AVP_HIDE    16            AVP hiding mechanism
AVP_DATA    32            AVP contents
FUNC        64            Low level operations
XPRT        128           Transport
DATA        256           Protocol data
SYSTEM      512           Internal system functions
PPP         1024          PPP operations
```

To debug a locally created tunnel creation, for example, create the tunnel as usual, but also specify a value for the tunnel's trace_flags parameter.

To debug incoming tunnels or sessions, identify or create a tunnel or session profile that will be used for the incoming request, then modify the tunnel or session profile's trace_flags parameter in the same way as described above.

The trace_flags parameter may be specified as an decimal/hexadecimal integer value or as a comma-separated list of trace options from the above list, e.g.

```
	trace_flags=protocol,fsm,avp
```

Note that changing a profile's parameter value affects only new instances created using that profile; instances already created continue to use the parameter value that existed at the time of creation.

If openl2tpd is started with the -D command line flag, all tunnels and sessions are created with trace_flags set to trace all message categories, unless trace_flags is overridden using a specific trace_flags value as described above..

## REPORTING BUGS
Please report bugs to <openl2tp-bugs@lists.sourceforge.net>.

## SEE ALSO
openl2tp(7), openl2tpd(8), openl2tpd.conf(5), openl2tp_rpc(4)


slapacl

package: openldap-servers

title: slapacl(8)

summary: Check access to a list of attributes.

text:
# slapacl(8)

## NAME
slapacl - Check access to a list of attributes.

## SYNOPSIS
/usr/sbin/slapacl -b DN [-d debug-level] [-D authcDN | -U authcID] [-f slapd.conf] [-F confdir] [-o option[=value]] [-u] [-v] [-X authzID | -o authzDN=DN] [attr[/access][:value]] [...]

## DESCRIPTION
slapacl is used to check the behavior of slapd(8) by verifying access to directory data according to the access control list directives defined in its configuration. It opens the slapd.conf(5) configuration file or the slapd-config(5) backend, reads in the access/olcAccess directives, and then parses the attr list given on the command-line; if none is given, access to the entry pseudo-attribute is tested.

## OPTIONS
-b DN

specify the DN which access is requested to; the corresponding entry is fetched from the database, and thus it must exist. The DN is also used to determine what rules apply; thus, it must be in the naming context of a configured database. See also -u.

-d debug-level

enable debugging messages as defined by the specified debug-level; see slapd(8) for details.

-D authcDN

specify a DN to be used as identity through the test session when selecting appropriate <by> clauses in access lists.

-f slapd.conf

specify an alternative slapd.conf(5) file.

-F confdir

specify a config directory. If both -f and -F are specified, the config file will be read and converted to config directory format and written to the specified directory. If neither option is specified, an attempt to read the default config directory will be made before trying to use the default config file. If a valid config directory exists then the default config file is ignored.

-o option[=value]

Specify an option with a(n optional) value. Possible generic options/values are:

```
              syslog=<subsystems>  (see `-s' in slapd(8))

              syslog-level=<level> (see `-S' in slapd(8))

              syslog-user=<user>   (see `-l' in slapd(8))
```

Possible options/values specific to slapacl are:

```
              authzDN

              domain

              peername

              sasl_ssf

              sockname

              sockurl

              ssf

              tls_ssf

              transport_ssf
```

See the related fields in slapd.access(5) for details.

-u

do not fetch the entry from the database. In this case, if the entry does not exist, a fake entry with the DN given with the -b option is used, with no attributes. As a consequence, those rules that depend on the contents of the target object will not behave as with the real object. The DN given with the -b option is still used to select what rules apply; thus, it must be in the naming context of a configured database. See also -b.

-U authcID

specify an ID to be mapped to a DN as by means of authz-regexp or authz-rewrite rules (see slapd.conf(5) for details); mutually exclusive with -D.

-v

enable verbose mode.

-X authzID

specify an authorization ID to be mapped to a DN as by means of authz-regexp or authz-rewrite rules (see slapd.conf(5) for details); mutually exclusive with -o authzDN=DN.

## EXAMPLES
The command

```
	/usr/sbin/slapacl -f /etc/openldap/slapd.conf -v \

            -U bjorn -b "o=University of Michigan,c=US" \
	    "o/read:University of Michigan"
```

tests whether the user bjorn can access the attribute o of the entry o=University of Michigan,c=US at read level.

## SEE ALSO
ldap(3), slapd(8), slaptest(8), slapauth(8)

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

## ACKNOWLEDGEMENTS
OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.


slapadd

title: slapadd(8)

summary: Add entries to a SLAPD database

text:
# slapadd(8)

## NAME
slapadd - Add entries to a SLAPD database

## SYNOPSIS
/usr/sbin/slapadd [-b suffix] [-c] [-d debug-level] [-f slapd.conf] [-F confdir] [-g] [-j lineno] [-l ldif-file] [-n dbnum] [-o option[=value]] [-q] [-s] [-S SID] [-u] [-v] [-w]

## DESCRIPTION
Slapadd is used to add entries specified in LDAP Directory Interchange Format (LDIF) to a slapd(8) database. It opens the given database determined by the database number or suffix and adds entries corresponding to the provided LDIF to the database. Databases configured as subordinate of this one are also updated, unless -g is specified. The LDIF input is read from standard input or the specified file.

All files eventually created by slapadd will belong to the identity slapadd is run as, so make sure you either run slapadd with the same identity slapd(8) will be run as (see option -u in slapd(8)), or change file ownership before running slapd(8).

Note: slapadd will also perform the relevant indexing whilst adding the database if any are configured. For specific details, please see slapindex(8).

## OPTIONS
-b suffix

Use the specified suffix to determine which database to add entries to. The -b cannot be used in conjunction with the -n option.

-c

enable continue (ignore errors) mode.

-d debug-level

enable debugging messages as defined by the specified debug-level; see slapd(8) for details.

-f slapd.conf

specify an alternative slapd.conf(5) file.

-F confdir

specify a config directory. If both -f and -F are specified, the config file will be read and converted to config directory format and written to the specified directory. If neither option is specified, an attempt to read the default config directory will be made before trying to use the default config file. If a valid config directory exists then the default config file is ignored. If dry-run mode is also specified, no conversion will occur.

-g

disable subordinate gluing. Only the specified database will be processed, and not its glued subordinates (if any).

-j lineno

Jump to the specified line number in the LDIF file before processing any entries. This allows a load that was aborted due to errors in the input LDIF to be resumed after the errors are corrected.

-l ldif-file

Read LDIF from the specified file instead of standard input.

-n dbnum

Add entries to the dbnum-th database listed in the configuration file. The -n cannot be used in conjunction with the -b option. To populate the config database slapd-config(5), use -n 0 as it is always the first database. It must physically exist on the filesystem prior to this, however.

-o option[=value]

Specify an option with a(n optional) value. Possible generic options/values are:

```
              syslog=<subsystems>  (see `-s' in slapd(8))

              syslog-level=<level> (see `-S' in slapd(8))

              syslog-user=<user>   (see `-l' in slapd(8))

              schema-check={yes|no}

              value-check={yes|no}

The schema-check option toggles schema checking (default on);
the value-check option toggles value checking (default off).
The latter is incompatible with -q.
```

-q

```
enable quick (fewer integrity checks) mode.  Does fewer consistency checks
on the input data, and no consistency checks when writing the database.
Improves the load time but if any errors or interruptions occur the resulting
database will be unusable.
```

-s

```
disable schema checking.  This option is intended to be used when loading
databases containing special objects, such as fractional objects on a
partial consumer.  Loading normal objects which do not conform to
schema may result in unexpected and ill behavior.
```

-S SID

```
Server ID to use in generated entryCSN.  Also used for contextCSN
if -w is set as well.  Defaults to 0.
```

-u

```
enable dry-run (don't write to backend) mode.
```

-v

```
enable verbose mode.
```

-w

```
write syncrepl context information.
After all entries are added, the contextCSN
will be updated with the greatest CSN in the database.
```

## LIMITATIONS
Your slapd(8) should not be running when you do this to ensure consistency of the database.

slapadd may not provide naming or schema checks. It is advisable to use ldapadd(1) when adding new entries into an existing directory.

## EXAMPLES
To import the entries specified in file ldif into your slapd(8) database give the command:

```
	/usr/sbin/slapadd -l ldif
```

## SEE ALSO
ldap(3), ldif(5), slapcat(8), slapindex(8), ldapadd(1), slapd(8)

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

## ACKNOWLEDGEMENTS
OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.