rbldnsd

package: rbldnsd

title: rbldnsd(8)

summary: DNS daemon suitable for running DNS\-based blocklists

text:
# rbldnsd(8)

## NAME
rbldnsd - DNS daemon suitable for running DNS-based blocklists

## SYNOPSIS
rbldnsd options zone:dataset...

## DESCRIPTION
rbldnsd is a small DNS-protocol daemon which is designed to handle queries to DNS-based IP-listing or NAME-listing services. Such services are a simple way to share/publish a list of IP addresses or (domain) names which are "listed" for for some reason, for example in order to be able to refuse a service to a client which is "listed" in some blocklist.

rbldnsd is not a general-purpose nameserver. It will answer to A and TXT (and SOA and NS if such RRs are specified) queries, and has limited ability to answer to some other types of queries.

rbldnsd tries to handle data from two different perspectives: given a set (or several) of "listed entries" (e.g. IP address ranges or domain names), it builds and serves a DNS zone. Note the two are not the same: list of spammer's IPs is NOT a DNS zone, but may be represented and used as such, provided that some additional information necessary to build complete DNS zone (e.g. NS and SOA records, maybe A records necessary for http to work) is available. In this context, rbldnsd is very different from other general-purpose nameservers such as BIND or NSD: rbldnsd operates with datasets (sets of entries - IP addresses or domain names, logically grouped together), while other general-purpose nameservers operates with zones. The way how rbldnsd operates may be somewhat confusing to BIND experts.

For rbldnsd, a building block is a dataset: e.g., set of insecure/abuseable hosts (IP addresses), set of network ranges that belongs to various spam operations (IP ranges), domain names that belong to spammers (RHSBL) and so on. Usually, different kind of information is placed into separate file, for easy maintenance. From a number of such datasets, rbldnsd constructs a number of DNS zones as specified on command line. A single dataset may be used for several zones, and a single zone may be constructed from several datasets.

rbldnsd will answer queries to DNS zones specified on the command line as a set of zone specifications. Each zone specification consists of zone basename, dataset type and a comma-separated list of files that forms a given dataset: zone:type:file,file,...

Several zones may be specified in command line, so that rbldnsd will answer queries to any of them. Also, a single zone may be specified several times with different datasets, so it is possible to form a zone from a combination of several different dataset. The same dataset may be reused for several zones too (and in this case, it will be read into memory only once).

There are several dataset formats available, each is suitable and optimized (in terms of memory, speed and ease of use) for a specific task. Available dataset types may be grouped into the following categories:

lists of IP addresses. When a query is done to a zone with such data, query is interpreted as an IP address in a reverse form (similar to in-addr.arpa zone). If the address is found in dataset data, rbldnsd will return A and TXT records specified in data for that IP. This is a classical IP-based blocklist.

lists of domain names. Similar to list of IP addresses, but with generic domain names instead of IPs (wildcards allowed). This type of data may be used to form a blocklist of e.g. sender domain names.

generic list of various types of records, as an auxilary data to form a complete nameserver. This format is similar to bind-style datafiles, but very simplified. One may specify A, TXT, NS and MX records here.

combined set, different datasets from the list above combined in the single (set of) source files, for easy maintenance.

acl, or Access Control List. This is a pseudo dataset, that works by overweriting query results based on the requestor (peer) IP address.

## OPTIONS
The following options may be specified:

-u user[:group]

rbldnsd will change its userid to the specified user, which defaults to rbldns, and group, which by default is the primary group of a user. rbldnsd will refuse to run as the root user, since this is insecure.

-r rootdir

rbldnsd will chroot to rootdir if specified. Data files should be available inside rootdir.

-w workdir

rbldnsd will change its working directory to workdir (after chrooting to rootdir if -r option is also specified). May be used to shorten filename paths.

-b address/port

This option is required. rbldnsd will bind to specified address and port (port defaults to port 53, domain). Either numeric IP address or a hostname may be specified, and either port number or service name is accepted. It is possible to specify several addresses to listen on this way, by repeating -b option. Additionally, if there are several addresses listed for a hostname, rbldnsd will listen on all of them. Note that rbldnsd will work slightly faster if only one listening address is specified. Note the delimiter between host and port is a slash (/), not a colon, to be able to correctly handle IPv6 addresses.

-4

Use IPv4 listening socket/transport, do not attempt to use IPv6 (ignored if rbldnsd was built without IPv6 support).

-6

Use IPv6 listening socket/transport, do not attempt to use IPv4 (this option will be reported as error if IPv6 support was not compiled in).

-t defttl:minttl:maxttl

Set default reply time-to-live (TTL) value to be defttl, and set constraints for TTL to minttl and maxttl. Default applies when there's no TTL defined in a given scope (in data file), and constraints are applied when such value provided in data. Any of the values may be omitted, including trailing colon (:) characters, e.g. "-t 30" set default TTL to be 30 secound, and "-t ::120" or "-t ::2m" sets maximum allowed TTL to 2 minutes. All 3 values are in time units, with optional suffix: s (secounds, default), m (minutes), h (hours), d (days) or w (weeks). Zero minttl or maxttl means no corresponding constraint will be enforced. Default defttl is 35m.

-c check

Set interval between checking for zone file changes to be check, default is 1m (one minute). rbldnsd will check zone file's last modification time every so often, and if it detects a change, zone will be automatically reloaded. Setting this value to 0 disables automatic zone change detection. This procedure may also be triggered by sending a SIGHUP signal to rbldnsd (see SIGNALS section below).

-e

Allow non-network addresses to be used in CIDR ranges. Normally, rbldnsd rejects addresses such as 127.2.3.4/24, where prefix is not within the network mask derived from bit number (in this case, correct form is 127.2.3.0/24, note the trailing zero in prefix). This is done in order to catch possible typos in zones (rbldnsd will warn about a problem and will ignore such entry). This option disables checking whether the CIDR prefix fits within the network mask.

-q

Quick and quiet start. Normally, rbldnsd does socket initialization and zone load in foreground, writing progress and statistic to standard output, and aborts in case of any errors. With this flag, nothing will be printed and first zone load will be done in background (unless -n option is also given), and zone load errors will be non-fatal.

-p pidfile

Write rbldnsd's pid to the specified pidfile, so it will be easily findable. This file gets written before entering a chroot jail (if specified) and before changing userid, so it's ok to specify e.g. /var/run/rbldnsd.pid here.

-l logfile

Specifies a file to which log all requests made. This file is created after entering a chroot jail and becoming a user. Logfiles may be quite large, esp. on busy sites (rbldnsd will log every recognized request if this option is specified). This option is mainly intended for debugging purposes. Upon receiption of SIGHUP signal, rbldnsd reopens its logfile. If logfile prefixed with a plus sign (+), logging will not be buffered (i.e. each line will be flushed to disk); by default, logging is buffered to reduce system load. Specify a single hyphen (-) as a filename to log to standard output (filedescriptor 1), either buffered by default, or line-buffered if specified as `+-' (standard output will not be "reopened" upon receiving SIGHUP signal, but will be flushed in case logging is buffered).

-s statsfile

Specifies a file where rbldnsd will write a line with short statistic summary of queries made per zone, every check (-c) interval. Format of each line is:

```
  timestamp zone:qtot:qok:qnxd:bin:bout zone:...
```

where timestamp is unix time (secounds since epoch), zone is the name of the base zone, qtot is the total number of queries received, qok - number of positive replies, qnxd - number of NXDOMAIN replies, bin is the total number of bytes read from network (excluding IP/UDP overhead and dropped packets), bout is the total number of bytes written to network. Ther are as many such tuples as there are zones, and one extra, total typle at the end, with zone being "*", like:

```
  1234 bl1.ex:10:5:4:311:432 bl2.ex:24:13:7:248:375 *:98:35:12:820:987
```

Note the total values may be larger than the sum of per-zone values, due to queries made against unlisted zones, or bad/broken packets. Rbldnsd will write bare timestamp to statsfile when it is starting up, shutting down or when statistic counters are being reset after receiving SIGUSR2 signal (see below), to indicate the points where the counters are starting back from zero.

By default, rbldnsd writes absolute counter values into statsfile (number of packets (bytes) since startup or last reset). statsfile may be prefixed with plus sign (+), in which case rbldnsd will write delta values, that is, number of packets or bytes since last write, or number of packets (bytes) per unit of time ("incremental" mode, hence the "+" sign).

-n

Do not become a daemon. Normally, rbldnsd will fork and go to the background after successful initialization. This option disables this behaviour.

-f

Request rbldnsd to continue processing requests during data reloads. Rbldnsd forks a child process to handle requests while parent reloads the data. This ensures smooth operations, but requires more memory, since two copies of data is keept in memory during reload process.

-d

Dump all zones to stdout in BIND format and exit. This may be suitable to convert easily editable rbldnsd-style data into BIND zone. rbldnsd dumps all zones as one stream, so one may want to specify only one zone with -d. Zone file will have appropriate $ORIGIN tags. Note that data generated may be really huge (as BIND format isn't appropriate for this sort of things), and some entries may not be really the same in BIND as in rbldnsd (e.g., IP netblocks of large size will be represented as wildcard entries - 10.0.0.0/8 will become *.10; excluded entries will be represented by a CNAME to `excluded' name, so such name should not be present in a data set). In this mode, rbldnsd ignores -r (root directory) option.

-v

Do not show exact version information in response to version.bind CH TXT queries (by default rbldnsd responds to such queries since version 0.98). With single -v, rbldnsd will only return "rbldnsd" to the caller, without the version number. Second -v disables providing any information in response to such requests, i.e. rbldnsd will return REFUSE code.

-C

Disable automatic on-the-fly uncompression of data files if this feature is compiled in (see below).

-A

-a

Controls "laziness" of rbldnsd when constructing replies. With -a specified, rbldnsd does not add AUTH section (containing NS records) to replies unless explicitly asked for NS records. It is equivalent to BIND9 "minimal-answers" configuration setting. While with -A specified, rbldnsd will always fill in AUTH section, increasing size of replies dramatically but allowing (caching) resolver clients to react faster to changes in nameserver lists. Currently (as of 0.998 version), non-lazy (as with -A) mode is the default, but it will change in future release.

-x extension

Load the given extension file (a dynamically-linked library, usually with ".so" suffix). This allows to gather custom statistics or perform other custom tasks. See separate document for details about building and using extensions. This feature is not available on all platforms, and can be disabled at compile time.

-X extarg

Pass the given argument, extarg, to the extension loaded with -x.

## DATASET TYPES AND FORMATS
Dataset files are text files which are interpreted depending on type specified in command line. Empty lines and lines starting with hash character (#) or semicolon (;) are ignored, except for a special case outlined below in section titled "Special Entries".

A (comma-separated) list of files in dataset specification (in type:file,file,...) is interpreted as if all files where logically combined into one single file.

When compiled with zlib support, rbldnsd is able to read gzip-compressed data files. So, every file in dataset specification can be compressed with gzip(1), and rbldnsd will read such a file decompressing it on-the-fly. This feature may be turned off by specifying -C option.

rbldnsd is designed to service a DNSBL, where each entry have single A record and optional TXT record assotiated with it. rbldnsd allows to specify A value and TXT template either for each entry individually, or to use default A value and TXT template pair for a group of entries. See section "Resulting A values and TXT templates" below for a way to specify them.

### Special Entries
If a line starts with a dollar sign ($), hash character and a dollar sign (#$), semicolon and dollar sign (;#) or colon and a dollar sign (:$), it is interpreted in a special way, regardless of dataset type (this is one exception where a line starting with hash character is not ignored - to be able to use zone files for both rbldnsd and for DJB's rbldns). The following keywords, following a dollar sign, are recognized:

$SOA ttl origindn persondn serial refresh retry expire minttl

Specifies SOA (Start Of Authority) record for all zones using this dataset. Only first SOA record is interpreted. This is the only way to specify SOA - by default, rbldnsd will not add any SOA record into answers, and will REFUSE to answer to certain queries (notably, SOA query to zone's base domain name). It is recommended, but not mandatory to specify SOA record for every zone. If no SOA is given, negative replies will not be cacheable by caching nameservers. Only one, first $SOA line is recognized in every dataset (all subsequent $SOA lines encountered in the same dataset are silently ignored). When constructing a zone, SOA will be taken from first dataset where $SOA line is found, in an order as specified in command line, subsequent $SOA lines, if any, are ignored. This way, one may overwrite $SOA found in 3rd party data by prepending small local file to the dataset in question, listing it before any other files.

If serial value specified is zero, timestamp of most recent modified file will be substituted as serial.

If ttl field is zero, default ttl (-t option or last $TTL value, see below) will be used.

All time fields (ttl, refresh, retry, expire, minttl) may be specified in time units. See -t option for details.

$NS ttl nameserverdn nameserverdn...

Specifies NS (Name Server) records for all zones using this dataset. Only first $NS line in a dataset is recognized, all subsequent lines are silently ignored. When constructing a zone from several datasets, rbldnsd uses nameservers from $NS line in only first dataset where $NS line is given, in command-line order, just like for $SOA record. Only first 32 namservers are recognized. Individual nameserver(s) may be prefixed with a minus sign (-), which means this single nameserver will be ignored by rbldnsd. This is useful to temporary comment out one nameserver entry without removing it from the list. If ttl is zero, default ttl will be used. The list of NS records, just like $SOA value, are taken from the first data file in a dataset where the $NS line is found, subsequent $NS lines, if any, are ignored.

$TTL time-to-live

Specifies TTL (time-to-live) value for all records in current dataset. See also -t option. $TTL special overrides -t value on a per-dataset basis.

$TIMESTAMP dstamp [expires]

(experimental) Specifies the data timestamp dstamp when the data has been generated, and optionally when it will expire. The timestamps are in form yyyy:mm:dd[:hh[:mi[:ss]]], where yyyy is the year like 2005, mm is the month number (01..12), dd is the month day number (01..31), hh is hour (00..23), mi and ss are minutes and secounds (00.59); hours, minutes and secounds are optional and defaults to 0; the delimiters (either colon or dash may be used) are optional too, but are allowed for readability. Also, single zero (0) or dash (-) may be used as dstamp and/or expires, indicating the value is not given. expires may also be specified as +rel, where rel is a time specification (probably with suffix like s, m, h, d) as an offset to dstamp. rbldnsd compares dstamp with current timestamp and refuses to load the file if dstamp specifies time in the future. And if expires is specified, rbldnsd will refuse to service requests for that data if current time is greather than the value specified in expires field.

Note that rbldnsd will check the data expiry time every time it checks for data file updates (when receiving SIGHUP signal or every -c interval). If automatic data reload timer (-c option) is disabled, zones will not be exipired automatically.

$MAXRANGE4 range-size

Specifies maximum size of IPv4 range allowed for IPv4-based datasets. If an entry covers more IP addresses than range-size, it will be ignored (and a warning will be logged). range-size may be specified as a number of hosts, like 256, or as network prefix lenght, like /24 (the two are the same):

```
  $MAXRANGE4 /24

  $MAXRANGE4 256
```

This constraint is active for a dataset it is specified in, and can be owerwritten (by subsequent $MAXRANGE statement) by a smaller value, but can not be increased.

$n text

(n is a single digit). Specifies a substitution variable for use as $n placeholders (the $n entries are ignored in generic daaset). See section "Resulting A values and TXT templates" below for description and usage examples.

$= text

Set the base template for all individual TXT records. See section "Resulting A values and TXT templates" below for more information.

### ip4set Dataset
A set of IP addresses or CIDR address ranges, together with A and TXT resulting values. IP addresses are specified one per line, by an IP address prefix (initial octets), complete IP address, CIDR range, or IP prefix range (two IP prefixes or complete addresses delimited by a dash, inclusive). Examples, to specify 127.0.0.0/24:

```
  127.0.0.0/24

  127.0.0

  127/24

  127-127.0.0

  127.0.0.0-127.0.0.255

  127.0.0.1-255
```

to specify 127.16.0.0-127.31.255.255:

```
  127.16.0.0-127.31.255.255

  127.16.0-127.31.255

  127.16-127.31

  127.16-31

  127.16.0.0/12

  127.16.0/12

  127.16/12
```

Note that in prefix range, last boundary is completed with all-ones (255), not all-zeros line with first boundary and a prefix alone. In prefix ranges, if last boundary is only one octet (127.16-31), it is treated as "suffix", as value of last specified octet of the first boundary prefix (127.16.0-31 is treated as 127.16.0.0-127.16.31.255, i.e. 127.16.0.0/19).

After an IP address range, A and TXT values for a given entry may be specified. If none given, default values in current scope (see below) applies. If a value starts with a colon, it is interpreted as a pair of A record and TXT template, delimited by colon (:127.0.0.2:This entry is listed). If a value does not start with a colon, it is interpreted as TXT template only, with A record defaulting to the default A value in current scope.

IP address range may be followed by a comment char (either hash character (#) or semicolon (;)), e.g.:

```
  127/8 ; loopback network
```

In this case all characters up to the end of line are ignored, and default A and TXT values will be used for this IP range. Every IP address that fits within any of specified ranges is "listed", and rbldnsd will respond to reverse queries against it within specified zone with positive results. In contrast, if an entry starts with an exclamation sign (!), this is an exclusion entry, i.e. corresponding address range is excluded from being listed (and any value for this record is ignored). This may be used to specify large range except some individual addresses, in a compact form.

If a line starts with a colon (:), this line specifies the default A value and TXT template to return (see below) for all subsequent entries up to end of current file. If no default entry specified, and no value specified for a given record, rbldnsd will return 127.0.0.2 for matching A queries and no record for matching TXT queries. If TXT record template is specified and contains occurences of of dollar sign ($), every such occurence is replaced with an IP address in question, so singe TXT template may be used to e.g. refer to a webpage for an additional information for a specific IP address.

### ip4trie Dataset
Set of IP4 CIDR ranges with corresponding (A, TXT) values. This dataset is similar to ip4set, but uses a different internal representation. It accepts CIDR ranges only (not a.b.c.d-e.f.g.h), and allows for the specification of A/TXT values on a per CIDR range basis. (If multiple CIDR ranges match a query, the value for longest matching prefix is returned.) Exclusions are supported too.

This dataset is not particularly memory-efficient for storing many single IP addresses — it uses about 50% more memory than the ip4set dataset in that case. The ip4trie dataset is better adapted, however, for listing CIDR ranges (whose lengths are not a multiple of 8 bits.)

### ip4tset Dataset
"trivial" ip4set: a set of single IP addresses (one per line), with the same A+TXT template. This dataset type is more efficient than ip4set (in both memory usage and access times), but have obvious limitation. It is intended for DNSBLs like DSBL.org, ORDB.org and similar, where each entry uses the same default A+TXT template. This dataset uses only half a memory for the same list of IP addresses compared to ip4set.

### ip6trie Dataset
Set of IP6 CIDR ranges. This is the IP6 equivalent of the ip4trie dataset. It allows the sepecification of individual A/TXT values for each CIDR range and supports exclusions. Compressed ("::") ip6 notation is supported.

Example zone data:

```
  # Default A and TXT template valuse

  :127.0.1.2: Listed, see http://example.com/lookup?$

  # A listing, note that trailing :0s can be omitted

  2001:21ab:c000/36

  # /64 range with non-default A and TXT values

  2001:21ab:def7:4242 :127.0.1.3: This one smells funny

  # compressed notation

  2605:6001:42::/52

  ::1                   # localhost

  !2605:6001:42::bead   # exclusion
```

### ip6tset Dataset
"Trivial" ip6 dataset: a set of /64 IP6 CIDR ranges (one per line), all sharing a single A+TXT template. Exclusions of single IP6 (/128) addresses are also supported. This dataset type is quite memory-efficient — it uses about 40% of the memory that the ip6trie dataset would use — but has obvious limitations.

This dataset wants the /64s listed as four ip6 words, for example:

```
  2001:20fe:23:41ed

  abac:adab:ad00:42f
```

Exclusions are denoted with a leading exclamation mark. You may also use compressed "::" notation for excluded addresses. E.g.:

```
  !abac:adab:ad00:42f:face:0f:a:beef

  !abac:adab:ad00:42f::2
```

### dnset Dataset
Set of (possible wildcarded) domain names with associated A and TXT values. Similar to ip4set, but instead of IP addresses, data consists of domain names (not in reverse form). One domain name per line, possible starting with wildcard (either with star-dot (*.) or just a dot). Entry starting with exclamation sign is exclusion. Default value for all subsequent lines may be specified by a line starting with a colon.

Wildcards are interpreted as follows:

example.com

only example.com domain is listed, not subdomains thereof. Not a wildcard entry.

*.example.com

all subdomains of example.com are listed, but not example.com itself.

.example.com

all subdomains of example.com and example.com itself are listed. This is a shortcut: to list a domain name itself and all it's subdomains, one may either specify two lines (example.com and *.example.com), or one line (.example.com).

This dataset type may be used instead of ip4set, provided all CIDR ranges are expanded and reversed (but in this case, TXT template will be expanded differently).

### generic Dataset
Generic type, simplified bind-style format. Every record should be on one line (line continuations are not supported), and should be specified completely (i.e. all domain names in values should be fully-qualified, entry name may not be omitted). No wildcards are accepted. Only A, TXT, and MX records are recognized. TTL value may be specified before record type. Examples:

```
 # bl.ex.com

 # specify some values for current zone

 $NS 0 ns1.ex.com ns2.ex.com

 # record with TTL

 www 3000 A 127.0.0.1

 about TXT "ex.com combined blocklist"
```

### combined Dataset
This is a special dataset that stores no data by itself but acts like a container for several other datasets of any type except of combined type itself. The data file contains an optional common section, where various specials are recognized like $NS, $SOA, $TTL (see above), and a series of sections, each of which defines one (nested) dataset and several subzones of the base zone, for which this dataset should be consulted. New (nested) dataset starts with a line

```
  $DATASET type[:name] subzone subzone...
```

and all subsequent lines up to the end of current file or to next $DATASET line are interpreted as a part of dataset of type type, with optional name (name is used for logging purposes only, and the whole ":name" (without quotes or square brackets) part is optional). Note that combined datasets cannot be nested. Every subzone will always be relative to the base zone name specified on command line. If subzone specified as single character "@", dataset will be connected to the base zone itself.

This dataset type aims to simplify subzone maintenance, in order to be able to include several subzones in one file for easy data transfer, atomic operations and to be able to modify list of subzones on remote secondary nameservers.

Example of a complete dataset that contains subzone `proxies' with a list of open proxies, subzone `relays' with a list of open relays, subzone `multihop' with output IPs of multihop open relays, and the base zone itself includes proxies and relays but not multihops:

```
  # common section

  $NS 1w ns1.ex.com ns2.ex.com

  $SOA 1w ns1.ex.com admin.ex.com 0 2h 2h 1w 1h

  # list of open proxies,

  # in `proxies' subzone and in base zone

  $DATASET ip4set:proxy proxies @

  :2:Open proxy, see http://bl.ex.com/proxy/$

  127.0.0.2

  127.0.0.10

  # list of open relays,

  # in `relays' subzone and in base zone

  $DATASET ip4set:relay relays @

  :3:Open relay, see http://bl.ex.com/relay/$

  127.0.0.2

  127.0.2.10

  # list of optputs of multistage relays,

  # in `multihop' subzone only

  $DATASET ip4set:multihop-relay multihop

  :4:Multihop open relay, see http://bl.ex.com/relay/$

  127.0.0.2

  127.0.9.12

  # for the base zone and all subzones,

  # include several additional records

  $DATASET generic:common proxies relays multihop @

  @ A 127.0.0.8

  www A 127.0.0.8

  @ MX 10 mx.ex.com

  # the above results in having the following records

  # (provided that the base zone specified is bl.ex.com):

  #  proxies.bl.ex.com A 127.0.0.8

  #  www.proxies.bl.ex.com 127.0.0.8

  #  relays.bl.ex.com A 127.0.0.8

  #  www.relays.bl.ex.com 127.0.0.8

  #  multihop.bl.ex.com A 127.0.0.8

  #  www.multihop.bl.ex.com 127.0.0.8

  #  bl.ex.com A 127.0.0.8

  #  www.bl.ex.com 127.0.0.8
```

Note that $NS and $SOA values applies to the base zone only, regardless of the placement in the file. Unlike the $TTL values and $n substitutions, which may be both global and local for a given (sub-)dataset.

### Resulting A values and TXT templates
In all zone file types except generic, A values and TXT templates are specified as following:

```
  :127.0.0.2:Blacklisted: http://example.com/bl?$
```

If a line starts with a colon, it specifies default A and TXT for all subsequent entries in this dataset. Similar format is used to specify values for individual records, with the A value (enclosed by colons) being optional:

```
  127.0.0.2 :127.0.0.2:Blacklisted: http://example.com/bl?$
```

or, without specific A value:

```
  127.0.0.2 Blacklisted: http://example.com/bl?$
```

Two parts of a line, delimited by second colon, specifies A and TXT record values. Both are optional. By default (either if no default line specified, or no IP address within that line), rbldnsd will return 127.0.0.2 as A record. 127.0.0 prefix for A value may be omitted, so the above example may be simplified to:

```
  :2:Blacklisted: http://example.com/bl?$
```

There is no default TXT value, so rbldnsd will not return anything for TXT queries it TXT isn't specified. When A value is specified for a given entry, but TXT template is omitted, there may be two cases interpreted differently, namely, whenever there's a second semicolon (:) after the A value. If there's no second semicolon, default TXT value for this scope will be used. In contrast, when second semicolon is present, no TXT template will be generated at all. All possible cases are outlined in the following example:

```
  # default A value and TXT template

  :127.0.0.2:IP address $ is listed

  # 127.0.0.4 will use default A and TXT

  127.0.0.4

  # 127.0.0.5 will use specific A and default TXT

  127.0.0.5 :5

  # 127.0.0.6 will use specific a and no TXT

  127.0.0.6 :6:

  # 127.0.0.7 will use default A and specific TXT

  127.0.0.7 IP address $ running an open relay
```

In a TXT template, references to substitution variables are replaced with values of that variables. In particular, single dollar sign ($) is replaced by a listed entry (an IP address in question for IP-based datasets and the domain name for domain-based datasets). $n-style constructs, where n is a single digit, are replaced by a substitution variable $n defined for this dataset in current scope (see section "Special Entries" above). To specify a dollar sign as-is, use $$.

For example, the following lines:

```
  $1 See http://www.example.com/bl

  $2 for details

  127.0.0.2  $1/spammer/$ $2

  127.0.0.3  $1/relay/$ $2

  127.0.0.4  This spammer wants some $$$$.  $1/$
```

will result in the following text to be generated:

```
  See http://www.example.com/bl/spammer/127.0.0.2 for details

  See http://www.example.com/bl/relay/127.0.0.3 for details

  This spammer wants some $$.  See http://www.example.com/bl/127.0.0.4
```

If the "base template" ($= variable) is defined, this template is used for expansion, instead of the one specified for an entry being queried. Inside the base template, $= construct is substituted with the text given for individual entries. In order to stop usage of base template $= for a single record, start it with = (which will be omitted from the resulting TXT value). For example,

```
  $0 See http://www.example.com/bl?$= ($) for details

  127.0.0.2	r123

  127.0.0.3

  127.0.0.4	=See other blocklists for details about $
```

produces the following TXT records:

```
  See http://www.example.com/bl?r123 (127.0.0.2) for details

  See http://www.example.com/bl?127.0.0.3 (127.0.0.3) for details

  See other blocklists for details about 127.0.0.4
```

### acl Dataset
This is not a real dataset, while the syntax and usage is the same as with other datasets. Instead of defining which records exists in a given zone and which do not, the acl dataset specifies which client hosts (peers) are allowed to query the given zone. The dataset specifies a set of IPv4 and/or IPv6 CIDR ranges (with the syntax exactly the same as understood by the ip4trie and ip6trie datasets), together with action specifiers. When a query is made from an IP address listed (not for the IP address), the specified action changes rules used to construct the reply. Possible actions and their meanings are:

:ignore

ignore all queries from this IP address altogether. rbldnsd acts like there was no query received at all. This is the default action.

:refuse

refuse all queries from the IP in question. rbldnsd will always return REFUSED DNS response code.

:empty

pretend there's no data in all other datasets for the given zone. This means that all the clients in question will always receive reply from rbldnsd telling that the requested IP address or domain name is not listed in a given DNSBL. rbldnsd still replies to metadata queries (SOA and NS records, and to all queries satisfied by generic dataset if specified for the given zone) as usual.

:pass

process the request as usual. This may be used to add a "whitelisting" entry for a network/host bloked by another (larger) ACL entry.

a_txt_template

usual A+TXT template as used by other datasets. This means that rbldnsd will reply to any valid DNSBL query with "it is listed" answer, so that the client in question will see every IP address or domain name is listed in a given DNSBL. TXT record used in the reply is taken from the acl dataset instead of real datasets. Again, just like with empty case, rbldnsd will continue replying to metadata queries (including generic datasets if any) as usual.

Only one ACL dataset can be specified for a given zone, and each zone must have at least one non-acl dataset. It is also possible to specify one global ACL dataset, by specifying empty zone name (which is not allowed for other dataset types), like

```
  rbldnsd ... :acl:filename...
```

In this case the ACL defined in filename applies to all zones. If there are both global ACL and local zone-specific ACL specified, both will be consulted and actions taken in the order specified above, ie, if either ACL returns ignore for this IP, the request will be ignored, else if either ACL returns refuse, the query will be refused, and so on. If both ACLs specifies "always listed" A+TXT template, the reply will contain A+TXT from global ACL. For this dataset type, only a few $-style specials are recognized. In particular, $SOA and $NS keywords are not allowed. When rbldnsd performs $ substitution in the TXT template returned from ACL dataset, it will use client IP address to substitute for a single $ character, instead of the IP address or domain name found in the original query.

## SIGNALS
Rbldnsd handles the following signals:

SIGHUP

recheck zone files and reload any outdated ones. This is done automatically if enabled, see -c option. Additionally, rbldnsd will reopen logfile upon receiving SIGHUP, if specified (-l option).

SIGTERM, SIGINT

Terminate process.

SIGUSR1

Log current statistic counters into syslog. Rbldnsd collects how many packets it handled, how many bytes was received, sent, how many OK requests/replies (and how many answer records) was received/sent, how many NXDOMAIN answers was sent, and how many errors/refusals/etc was sent, in a period of time.

SIGUSR2

The same as SIGUSR1, but reset all counters and start new sample period.

## NOTES
Some unsorted usage notes follows.

### Generating and transferring data files
When creating a data file for rbldnsd (and for anything else, it is a general advise), it is a good idea to create the data in temporary file and rename the temp file when all is done. Never try to write to the main file directly, it is possible that at the same time, rbldnsd will try to read it and will get incomplete data as the result. The same applies to copying data using cp(1) utility and similar (including scp(1)), that performs copying over existing data. Even if you're sure noone is reading the data while you're copying or generating it, imagine what will happen if you will not be able to complete the process for whatever reason (interrupt, filesystem full, endless number of other reasons...). In most cases is better to keep older but correct data instead of leaving incomplete/corrupt data in place.

Right:

```
  scp remote:data target.tmp && mv target.tmp target
```

Wrong:

```
  scp remote:data target
```

Right:

```
  ./generate.pl > target.tmp && mv target.tmp target
```

Wrong:

```
  ./generate.pl > target
```

From this point of view, rsync(1) command seems to be safe, as it always creates temporary file and renames it to the destination only when all is ok (but note the --partial option, which is good for downloading something but may be wrong to transfer data files -- usually you don't want partial files to be loaded). In contrast, scp(1) command is not safe, as it performs direct copying. You may still use scp(1) in a safe manner, as shown in the example above.

Also try to eliminate a case when two (or more) processes performs data copying/generation at the same time to the same destination. When your data is generated by a cron job, use file locking (create separate lock file (which should never be removed) and flock/fcntl it in exclusive mode without waiting, exiting if lock fails) before attempting to do other file manipulation.

### Absolute vs relative domain names
All keys specified in dataset files are always relative to the zone base DN. In contrast, all the values (NS and SOA records, MX records in generic dataset) are absolute. This is different from BIND behaviour, where trailing dot indicates whenever this is an absolute or relative DN. Trailing dots in domain names are ignored by rbldnsd.

### Aggregating datasets
Several zones may be served by rbldnsd, every zone may consist of several datasets. There are numerous ways to combine several data files into several zones. For example, suppose you have a list of dialup ranges in file named `dialups', and a list of spammer's ip addresses in file named `spammers', and want to serve 3 zones with rbldnsd: dialups.bl.ex.com, spam.bl.ex.com and bl.ex.com which is a combination of the two. There are two ways to do this:

```
 rbldnsd options... \

   dialups.bl.ex.com:ip4set:dialups \

   spam.bl.ex.com:ip4set:spammers \

   bl.ex.com:ip4set:dialups,spammers
```

or:

```
 rbldnsd options... \

   dialups.bl.ex.com:ip4set:dialups \

   spam.bl.ex.com:ip4set:spammers \

   bl.ex.com:ip4set:dialups \

   bl.ex.com:ip4set:spammers
```

(note you should specify combined bl.ex.com zone after all its subzones in a command line, or else subzones will not be consulted at all).

In the first form, there will be 3 independent data sets, and every record will be stored 2 times in memory, but only one search in internal data structures will be needed to resolve queries for aggregate bl.ex.com. In second form, there will be only 2 data sets, every record will be stored only once (both datasets will be reused), but 2 searches will be performed by rbldnsd to answer queries against aggregate zone (but difference in speed is almost unnoticeable). Note that when aggregating several data files into one dataset, an exclusion entry in one file becomes exclusion entry in the whole dataset (which may be a problem when aggregating dialups, where exclusions are common, with open relays/proxies, where exclusions are rare if at all used).

Similar effect may be achieved by using combined dataset type, sometimes more easily. combined dataset results in every nested dataset to be used independantly, like in second form above.

combined dataset requires rbldnsd to be the authoritative nameserver for the whole base zone. Most important, one may specify SOA and NS records for the base zone only. So, some DNSBLs which does not use a common subzone for the data, cannot use this dataset. An example being DSBL.org DNSBL, where each of list.dsbl.org, multihop.dsbl.org and unconfirmed.dsbl.org zones are separate, independant zones with different set of nameservers. But for DSBL.org, where each dataset is really independant and used only once (there's no (sub)zone that is as a combinations of other zones), combined dataset isn't necessary. In contrast, SORBS.net zones, where several subzones used and main zone is a combination of several subzones, combined dataset is a way to go.

### All authoritative nameservers should be set up similarily
When you have several nameservers for your zone, set them all in a similar way. Namely, if one is set up using combined dataset, all the rest should be too, or else DNS meta-data will be broken. This is because metadata (SOA and NS) records returned by nameservers using combined and other datasets will have different origin. With combined dataset, rbldnsd return NS and SOA records for the base zone, not for any subzone defined inside the dataset. Given the above example with dialups.bl.ex.com, spammers.bl.ex.com and aggregate bl.ex.com zones, and two nameservers, first is set up in any ways described above (using individual datasets for every of the 3 zones), and second is set up for the whole bl.ex.com zone using combined dataset. In this case, for queries against dialups.bl.ex.com, first nameserver will return NS records like

```
  dialups.bl.ex.com. IN NS a.ns.ex.com.
```

while second will always use base zone, and NS records will look like

```
  bl.ex.com. IN NS a.ns.ex.com.
```

All authoritative nameservers for a zone must have consistent metadata records. The only way to achieve this is to use similar configuration (combined or not) on all nameservers. Have this in mind when using other software for a nameserver.

### Generic dataset usage
generic dataset type is very rudimentary. It's purpose is to complement all the other type to form complete nameserver that may answer to A, TXT and MX queries. This is useful mostly to define A records for HTTP access (relays.bl.example.com A, www.bl.example.com A just in case), and maybe descriptive texts as a TXT record.

Since rbldnsd only searches one, most closely matching (sub)zone for every request, one cannot specify a single e.g. generic dataset in form

```
  proxies      TXT list of open proxies

  www.proxies  A 127.0.0.8

  relays       TXT list of open relays

  www.relays   A 127.0.0.9
```

for several (sub)zones, each of which are represented as a zone too (either in command line or as combined dataset). Instead, several generic datasets should be specified, separate one for every (sub)zone. If the data for every subzone is the same, the same, single dataset may be used, but it should be specified for every zone it should apply to (see combined dataset usage example above).

## BUGS
Most of the bugs outlined in this section aren't really bugs, but present due to non-standartized and thus unknown expected behaviour of a nameserver that serves a DNSBL zone. rbldnsd matches BIND runtime behaviour where appropriate, but not always.

rbldnsd lowercases some domain names (the ones that are lookup keys, e.g. in `generic' and `dnset' datasets) when loading, to speed up lookup operations. This isn't a problem in most cases.

There is no TCP mode. If a resource record does not fit in UDP packet (512 bytes), it will be silently ignored. For most usages, this isn't a problem, because there should be only a few RRs in an answer, and because one record is usually sufficient to decide whenever a given entry is "listed" or not. rbldnsd isn't a full-featured nameserver, after all.

rbldnsd will not always return a list of nameserver records in the AUTHORITY section of every positive answer: NS records will be provided (if given) only if there's a room for them in single UDP packet. If records does not fit, AUTHORITY section will be empty.

rbldnsd does not allow AXFR operations. For DNSBLs, AXFR is the stupidiest yet common thing to do - use rsync for zone transfers instead. This isn't a bug in rbldnsd itself, but in common practice of using AXFR and the like to transfer huge zones in a format which isn't suitable for such a task. Perhaps in the future, if there will be some real demand, I'll implement AXFR "server" support (so that rbldnsd will be able to act as master for BIND nameservers, but not as secondary), but the note remains: use rsync.

rbldnsd truncates all TXT records to be at most 255 bytes. DNS specs allows longer TXTs, but long TXTs is something that should be avoided as much as possible - TXT record is used as SMTP rejection string. Note that DNS UDP packet is limited to 512 bytes. rbldnsd will log a warning when such truncation occurs.

## VERSION
This manpage corresponds to rbldnsd version 0.998.

## AUTHOR
The rbldnsd daemon written by Michael Tokarev <mjt+rbldnsd@corpit.ru>, based on ideas by Dan Bernstein and his djbdns package, with excellent contributions by Geoffrey T. Dairiki <dairiki@dairiki.org>.

## LICENCE
Mostly GPL, with some code licensed under 3-clause BSD license.


rdma-ndd

package: rdma-core

title: rdma-ndd(8)

text:
# rdma-ndd(8)

## NAME
RDMA-NDD - RDMA device Node Description update daemon

## SYNOPSIS
rdma-ndd <options>

## DESCRIPTION
rdma-ndd is a system daemon which watches for rdma device changes and/or hostname changes and updates the Node Description of the rdma devices based on those changes.

## DETAILS
Full operation of this daemon requires kernels which support polling of the procfs hostname file as well as libudev.

If your system does not support either of these features, the daemon will set the Node Descriptions at start up and then sleep forever.

### Node Description configuration
The daemon uses the environment variable RDMA_NDD_ND_FORMAT to set the node description. The following wild cards can be specified for more dynamic control.

%h -- replace with the current hostname (not including domain)

%d -- replace with the device name (for example mlx4_0, qib0, etc.)

If not specified the default is "%h %d".

NOTE: At startup, and on new device detection, the Node Description is always written to ensure the SM and rdma-ndd are in sync. Subsequent events will only write the Node Description on a device if it has changed.

### Using systemd
Setting the environment variable for the daemon is normally be done via a systemd drop in unit. For example the following could be added to a file named /etc/systemd/system/rdma-ndd.service.d/nd-format.conf to use only the hostname as your node description.

[Service] Environment="RDMA_NDD_ND_FORMAT=%%h"

NOTE: Systemd requires an extra '%'.

## OPTIONS
-f, --foreground Run in the foreground instead of as a daemon

-d, --debugging Log additional debugging information to syslog

--systemd Enable systemd integration.

## AUTHOR
Ira Weiny

< ira.weiny@intel.com >


rdnssd

package: rdnssd

title: rdnssd(8)

text:
# rdnssd(8)

## NAME
rdnssd - IPv6 Recursive DNS Server discovery Daemon

## SYNOPSIS
rdnssd [-f] [-H merge-hook] [-r resolv-file] [-p pidfile] [-u username]

## DESCRIPTON
rdnssd is a daemon program providing client-side support for DNS configuration using the Recursive DNS Server (RDNSS) option, as described in RFC 5006. Its purpose is to supply IPv6 DNS resolvers through stateless autoconfiguration, carried by Router Advertisements.

rdnssd parses RDNSS options and keeps track of resolvers to write nameservers entries to a resolv.conf(5) configuration file. By default, it writes its own separate file, and may call an external hook to merge it with the main /etc/resolv.conf. This is aimed at easing coexistence with concurrent daemons, especially IPv4 ones, updating /etc/resolv.conf too.

On Linux, since version 2.6.24, rdnssd takes advantage of a new netlink interface, forwarding RDNSS options validated by the kernel to userland. Otherwise, it merely listens to all ICMPv6 traffic through a raw socket.

## OPTIONS
-f or --foreground

Do not detach from the console. Run the program in the foreground.

-H merge-hook or --merge-hook merge-hook

Execute this hook whenever resolv.conf is updated. If this option is not specified, then no hook will be called.

-h or --help

Display some help and exit.

-p pidfile or --pidfile pidfile

Override the location of the pidfile.

-r resolv-file or --resolv-file resolv-file

Set the path to the generated resolv.conf file.

-u username or --user username

Override the user that the program will run as. By default, it runs as nobody.

-V or --version

Display program version and license and exit.

## FILES
/etc/rdnssd/merge-hook

A basic merge hook shipped with rdnssd, to be called with the -H option.

/var/run/rdnssd/resolv.conf

The default resolv.conf(5) file that rdnssd writes its configuration to.

/var/run/rdnssd.pid

The process-id file.

## BUGS
rdnssd does not keep track of the lifetimes of the routers associated with some DNS resolvers, whereas it should to strictly comply with RFC 5006.

When rdnssd uses a raw socket instead of the netlink kernel interface, it does not validate received Neighbor Discovery traffic in any way. For example, it will always consider Router Advertisement packets, whereas it should not if the host is configured as a router. When the netlink interface is used, such validation is done by the kernel.

## SEE ALSO
resolv.conf(5), rdisc6(8), ipv6(7)

## AUTHOR
Pierre Ynard <linkfanel at yahoo.fr>

http://www.remlab.net/ndisc6/


realm

package: realmd

title: realm(8)

summary: Manage enrollment in realms

text:
# realm(8)

## NAME
realm - Manage enrollment in realms

## SYNOPSIS
realm discover [realm-name]

realm join [-U user] [realm-name]

realm leave [-U user] [realm-name]

realm list

realm permit [-ax] [-R realm] {user@domain...}

realm deny -a [-R realm]

## DESCRIPTION
realm is a command line tool that can be used to manage enrollment in kerberos realms, like Active Directory domains or IPA domains.

See the various sub commands below. The following global options can be used:

-i, --install=/path

Run in install mode. This makes realmd chroot into the directory specified by an absolute path and place files in appropriate locations for use during an installer. No packages will be installed or services will be started when running in this mode.

--unattended

Run in unattended mode without prompting for input.

-v, --verbose

Display verbose diagnostics while doing running commands.

## DISCOVER
Discover a realm and its capabilities.

```
$ realm discover
```

```
$ realm discover domain.example.com
```

After discovering a realm, its name, type and capabilities are displayed.

If no domain is specified, then the domain assigned through DHCP is used as a default.

The following options can be used:

-a, --all

Show all discovered realms (in various configurations).

--client-software=xxx

Only discover realms for which we can use the given client software. Possible values include sssd or winbind.

-n, --name

Only show the names of the discovered realms.

--server-software=xxx

Only discover realms which run the given server software. Possible values include active-directory or ipa.

--membership-software=xxx

Only discover realms for which the given membership software can be used to subsequently perform enrollment. Possible values include samba or adcli.

--use-ldaps

See option description in the section called “JOIN”.

## JOIN
Configure the local machine for use with a realm.

```
$ realm join domain.example.com
```

```
$ realm join --user=admin --computer-ou=OU=Special domain.example.com
```

The realm is first discovered, as we would with the discover command. If no domain is specified, then the domain assigned through DHCP is used as a default.

After a successful join, the computer will be in a state where it is able to resolve remote user and group names from the realm. For kerberos realms, a computer account and host keytab is created.

Joining arbitrary kerberos realms is not supported. The realm must have a supported mechanism for joining from a client machine, such as Active Directory or IPA.

If the domain has been preconfigured, and unless --user is explicitly specified, an automatic join is attempted first.

Note that the --user, --no-password, and --one-time-password options are mutually exclusive. At most one of them can be specified.

It is generally possible to use kerberos credentials to perform a join operation. Use the kinit command to acquire credentials prior to starting the join. Do not specify the --user argument, the user will be selected automatically from the credential cache. The realm respects the KRB5_CCACHE environment variable, but uses the default kerberos credential cache if it's not present. Not all types of servers can be joined using kerberos credentials, some (like IPA) insist on prompting for a password.

The following options can be used:

--automatic-id-mapping=no

Do not perform UID/GID mapping for users and groups, but expect these identifiers to be present in the domain already.

--client-software=xxx

Only join realms for which we can use the given client software. Possible values include sssd or winbind. Not all values are supported for all realms. By default the client software is automatically selected.

--computer-ou=OU=xxx

The distinguished name of an organizational unit to create the computer account. The exact format of the distinguished name depends on the client software and membership software. You can usually omit the root DSE portion of distinguished name. This is an Active Directory specific option.

--membership-software=xxx

The software to use when joining to the realm. Possible values include samba or adcli. Not all values are supported for all realms. By default the membership software is automatically selected.

--computer-name=xxx

This option only applies to Active Directory realms. Specify this option to override the default name used when creating the computer account. The system's FQDN will still be saved in the dNSHostName attribute. Specify the name as a string of 15 or fewer characters that is a valid NetBIOS computer name.

--no-password

Perform the join automatically without a password.

--one-time-password=xxxx

Perform the join using a one time password specified on the command line. This is not possible with all types of realms.

--os-name=xxx

The name of the operation system of the client. When joining an AD domain the value is store in the matching AD attribute.

--os-version=xxx

The version of the operation system of the client. When joining an AD domain the value is store in the matching AD attribute.

--server-software=xxx

Only join realms for run the given server software. Possible values include active-directory or ipa.

-U, --user=xxx

The user name to be used to authenticate with when joining the machine to the realm. You will be prompted for a password.

--user-principal=host/name@REALM

Set the userPrincipalName field of the computer account to this kerberos principal. If you omit the value for this option, then a principal will be set based on the defaults of the membership software. AD makes a distinction between user and service principals. Only with user principals you can request a Kerberos Ticket-Granting-Ticket (TGT), i.e. only user principals can be used with the kinit command. By default the user principal and the canonical principal name of an AD computer account is shortname$@AD.DOMAIN, where shortname is the NetBIOS name which is limited to 15 characters.

If there are applications which are not aware of the AD default and are using a hard-coded default principal the --user-principal can be used to make AD aware of this principal. Please note that userPrincipalName is a single value LDAP attribute, i.e. only one alternative user principal besides the AD default user principal can be set.

--use-ldaps

Use the ldaps port when connecting to AD where possible. In general this option is not needed because realmd itself only read public information from the Active Directory domain controller which is available anonymously. The supported membership software products will use encrypted connections protected with GSS-SPNEGO/GSSAPI which offers a comparable level of security than ldaps. This option is only needed if the standard LDAP port (389/tcp) is blocked by a firewall and only the LDAPS port (636/tcp) is available. Given that and to lower the initial effort to discover a remote domain realmd does not require a strict certificate check. If the validation of the LDAP server certificate fails realmd will continue to setup the encrypted connection to the LDAP server. If this option is set to yes realmd will use the ldaps port when reading the rootDSE and call the adcli membership software with the option --use-ldaps. The Samba base membership currently offers only deprecated ways to enable ldaps. Support will be added in realmd when a new way is available.

--do-not-touch-config

Run the join operation but do not touch the local configuration of the client except adding new Kerberos keys to the keytab. The purpose of this option is to synchronize the keytab entries with the ones stored in AD or recreate the computer object in AD without changing the local configuration which might contain changes which would get overwritten by a fully leave/join cycle. If running realm join with this options does not help to fix issues it is recommended to call realm leave followed by realm join to enforce a fresh configuration with default settings. Since this might overwrite manual changes to the related configuration files it is recommend to save those change before running the commands.

This options is only available when joining AD domains.

## LEAVE
Deconfigure the local machine for use with a realm.

```
$ realm leave
```

```
$ realm leave domain.example.com
```

If no realm name is specified, then the first configured realm will be used.

The following options can be used:

--client-software=xxx

Only leave the realm which is using the given client software. Possible values include sssd or winbind.

--server-software=xxx

Only leave the realm which is using the given server software. Possible values include active-directory or ipa.

--remove

Remove or disable computer account from the directory while leaving the realm. This will usually prompt for a pasword.

-U, --user

The user name to be used to authenticate with when leaving the realm. You will be prompted for a password. Implies --remove.

--use-ldaps

See option description in the section called “JOIN”.

## LIST
List all the discovered and configured realms.

```
$ realm list
```

By default, realms that have been discovered, but not configured (using the join command), are not displayed. Also, by default, the list of realm details displayed is verbose. The options below can be used to change this default behavior

The following options can be used:

--all

Show all discovered realms (whether or not they have been configured).

--name-only

Display only realm names (as opposed to verbose output).

## PERMIT
Permit local login by users of the realm.

```
$ realm permit --all
$ realm permit user@example.com
$ realm permit DOMAIN\\User2
$ realm permit --withdraw user@example.com
```

The current login policy and format of the user names can be seen by using the realm list command.

The following options can be used:

--all, -a

Permit logins using realm accounts on the local machine according to the realm policy.This usually defaults to allowing any realm user to log in.

--groups, -g

Treat the specified names as groups rather than user login names. Permit login by users in the specified groups.

--realm, -R

Specify the of the realm to change login policy for.

--withdraw, -x

Remove a login from the list of realm accounts permitted to log into the machine.

## DENY
Deny local login by realm accounts.

```
$ realm deny --all
```

This command prevents realm accounts from logging into the local machine. Use realm permit to restrict logins to specific accounts.

The following options can be used:

--all, -a

This option should be specified

--realm, -R

Specify the name of the realm to deny users login to.

## SEE ALSO
realmd.conf(5)

## AUTHOR
Stef Walter <stef@thewalter.net>

Maintainer


title: debugfs.reiser4(8)

text:
# debugfs.reiser4(8)

## NAME
debugfs.reiser4 - the program for debugging reiser4 filesystem.

## SYNOPSIS
debugfs.reiser4 [ options ] FILE

## DESCRIPTION
debugfs.reiser4 is reiser4 filesystem debug program. You can disscover the internal reiser4 filesystem structures by using it.

## COMMON OPTIONS
-V, --version

prints program version.

-?, -h, --help

prints program help.

-y, --yes

assumes an answer 'yes' to all questions.

-f, --force

forces debugfs to use whole disk, not block device or mounted partition.

-c, --cache N

sets tree cache node number to passed value. This affects very much behavior of libreiser4. It affects speed, tree allocation, etc.

## BROWSING OPTIONS
-k, --cat

browses passed file like standard cat and ls programs.

## PRINT OPTIONS
-t, --print-tree

prints the internal tree.

-b, --print-block N

prints the block associated with the passed block number.

-n, --print-nodes FILE

prints all nodes that the passed file lies in.

-i, --print-file

prints all items that the passed file consists of.

-s, --print-super

prints the both super blocks: master super block and format specific one.

-j, --print-journal

prints the journal with not yet commited transactions (if any).

-a, --print-alloc

prints the block allocator data.

-d, --print-oid

prints the oid allocator data.

## METADATA OPTIONS
-P, --pack-metadata

fetches filesystem metadata and writes them to the standard output.

-U, --unpack-metadata

reads filesystem metadata stream from the stdandard input and constructs a new filesystem based on the metadata. debugfs.reiser4 --pack-metadata <FS1> | debugfs.reiser4 --unpack-metadata <FS2> and then debugfs.reiser4 --pack-metadata <FS2> produces a stream equivalent to the first one.

## PLUGIN OPTIONS
-p, --print-profile

prints the plugin profile. This is the set of default plugins used for all parts of a filesystem -- format, nodes, files, directories, hashes, etc. If --override is specified, then prints modified plugins.

-l, --print-plugins

prints all plugins libreiser4 knows about.

-o, --override TYPE=PLUGIN, ...

overrides the default plugin of the type "TYPE" by the plugin "PLUGIN" in the plugin profile.

## Examples:
debugfs.reiser4 -o nodeptr=nodeptr41,hash=rupasov_hash /dev/hda2

## REPORTING BUGS
Report bugs to <reiserfs-devel@vger.kernel.org>

## SEE ALSO
measurefs.reiser4(8), mkfs.reiser4(8), fsck.reiser4(8)

## AUTHOR
This manual page was written by Yury Umanets <umka@namesys.com>


title: fsck.reiser4(8)

text:
# fsck.reiser4(8)

## NAME
fsck.reiser4 - the program for checking and repairing reiser4 filesystem.

## SYNOPSIS
fsck.reiser4 [ options ] FILE

## DESCRIPTION
fsck.reiser4 is reiser4 filesystem check and repair program.

## CHECK OPTIONS
--check

the default action checks the consistency and reports, but does not repair any corruption that it finds. This option may be used on a read-only file system mount.

--fix

fixes minor corruptions that do not require rebuilding; sets up correct values of bytes unsupported by kernel in the case of transparent compression.

--build-sb

fixes all severe corruptions in super blocks, rebuilds super blocks from scratch if needed.

--build-fs

fixes all severe fs corruptions, except super block ones; rebuilds reiser4 filesystem from the scratch if needed.

-L, --logfile

forces fsck to report any corruption it finds to the specified logfile rather then on stderr.

-n, --no-log

prevents fsck from reporting any kind of corruption.

-a, --auto

automatically checks the file system without any questions.

-q, --quiet

supresses gauges.

-r

ignored.

## PLUGIN OPTIONS
--print-profile

prints the plugin profile. This is the set of default plugins used for all parts of a filesystem -- format, nodes, files, directories, hashes, etc. If --override is specified, then prints modified plugins.

-l, --print-plugins

prints all plugins libreiser4 know about.

-o, --override TYPE=PLUGIN, ...

overrides the default plugin of the type "TYPE" by the plugin "PLUGIN" in the plugin profile.

## COMMON OPTIONS
-V, --version

prints program version

-?, -h, --help

prints program help

-q, --quiet

suppress messages.

-y, --yes

assumes an answer 'yes' to all questions.

-f, --force

forces fsck to use whole disk, not block device or mounted partition.

-p, --preen

automatically repair minor corruptions on the filesystem.

-c, --cache N

tunes number of nodes in the libreiser4 tree buffer cache

## REPORTING BUGS
Report bugs to <reiserfs-devel@vger.kernel.org>

## SEE ALSO
debugfs.reiser4(8), mkfs.reiser4(8), measurefs.reiser4(8)

## AUTHOR
This manual page was written by Vitaly Fertman <vitaly@namesys.com>


title: measurefs.reiser4(8)

text:
# measurefs.reiser4(8)

## NAME
measurefs.reiser4 - the program for measuring reiser4 filesystem parameters (fragmentation, node packing, etc.).

## SYNOPSIS
measurefs.reiser4 [ options ] FILE

## DESCRIPTION
measurefs.reiser4 is reiser4 filesystem measure program. You can estimate reiser4 filesystem fragmentation, packingm etc. structures by using it.

## COMMON OPTIONS
-V, --version

prints program version.

-?, -h, --help

prints program help.

-y, --yes

assumes an answer 'yes' to all questions.

-f, --force

forces measurefs to use whole disk, not block device or mounted partition.

-c, --cache N

sets tree cache node number to passed value. This affects very much behavior of libreiser4. It affects speed, tree allocation, etc.

## MEASUREMENT OPTIONS
-S, --tree-stat

shows different tree statistics (node packing, internal nodes, leaves, etc)

-T, --tree-frag

measures total tree fragmentation. The result is fragmentation factor - value from 0.00000 (minimal fragmentation) to 1.00000 (maximal one). Most probably, this factor may affect sequential read performance.

-D, --data-frag

measures average files fragmentation. This means, that fragmentation of each file in filesystem will be measured separately and results will be averaged. The result is fragmentation factor - value from 0.00000 (minimal fragmentation) to 1.00000 (maximal one). Note, that for the fresh filesystem (created not very long time ago) and even fully filled by data, this value will be pretty small.

-F, --file-frag FILE

measures fragmentation of the specified file. The result is fragmentation factor - value from 0.00000 (minimal fragmentation) to 1.00000 (maximal one). Note, that fragmentation of a small file (depends of used tail policy), which consists of tail items, is not very reliable value. That is because, they is always afoot due to balancing. Examples:

measurefs.reiser4 -F /usr/bin /dev/hda2

measurefs.reiser4 -F /bin/bash /dev/hda2

-E, --show-file

show file fragmentation for each file if --data-frag is specified.

## PLUGIN OPTIONS
-p, --print-profile

prints the plugin profile. This is the set of default plugins used for all parts of a filesystem -- format, nodes, files, directories, hashes, etc. If --override is specified, then prints modified plugins.

-l, --print-plugins

prints all plugins libreiser4 know about.

-o, --override TYPE=PLUGIN, ...

overrides the default plugin of the type "TYPE" by the plugin "PLUGIN" in the plugin profile. Examples:

measurefs.reiser4 -o nodeptr=nodeptr41,hash=rupasov_hash /dev/hda2

## REPORTING BUGS
Report bugs to <reiserfs-devel@vger.kernel.org>

## SEE ALSO
debugfs.reiser4(8), mkfs.reiser4(8), fsck.reiser4(8)

## AUTHOR
This manual page was written by Yury Umanets <umka@namesys.com>


title: mkfs.reiser4(8)

text:
# mkfs.reiser4(8)

## NAME
mkfs.reiser4 - the program for creating reiser4 filesystem.

## SYNOPSIS
mkfs.reiser4 [ options ] FILE1 FILE2 ... [ size[K|M|G] ]

## DESCRIPTION
mkfs.reiser4 is reiser4 filesystem creation program. It is based on new libreiser4 library. Since libreiser4 is fully plugin-based, we have the potential to create not just reiser4 partitions, but any filesystem or database format, which is based on balanced trees.

## COMMON OPTIONS
-V, --version

prints program version.

-?, -h, --help

prints program help.

-y, --yes

assumes an answer 'yes' to all questions.

-f, --force

forces mkfs to use whole disk, not block device or mounted partition.

## MKFS OPTIONS
-b, --block-size N

block size to be used (architecture page size by default)

-L, --label LABEL

volume label to be used

-U, --uuid UUID

universally unique identifier to be used

-s, --lost-found

forces mkfs to create lost+found directory.

-d, --discard

tells mkfs to discard given device before creating the filesystem (for solid state drives).

## PLUGIN OPTIONS
-p, --print-profile

prints the plugin profile. This is the set of default plugins used for all parts of a filesystem -- format, nodes, files, directories, hashes, etc. If --override is specified, then prints modified plugins.

-l, --print-plugins

prints all plugins libreiser4 know about.

-o, --override TYPE=PLUGIN, ...

overrides the default plugin of the type "TYPE" by the plugin "PLUGIN" in the plugin profile. Examples:

assign short key plugin to "key" field in order to create filesystem with short keys policy:

mkfs.reiser4 -yf -o key=key_short /dev/hda2

## REPORTING BUGS
Report bugs to <reiserfs-devel@vger.kernel.org>

## SEE ALSO
measurefs.reiser4(8), debugfs.reiser4(8), fsck.reiser4(8)

## AUTHOR
This manual page was written by Yury Umanets <umka@namesys.com>


debugreiserfs

package: reiserfsprogs

title: debugreiserfs(8)

text:
# debugreiserfs(8)

## NAME
debugreiserfs - The debugging tool for the ReiserFS filesystem.

## SYNOPSIS
debugreiserfs [ -dDJmoqpuSV ] [ -j device ] [ -B file ] [ -1 N ]

device

## DESCRIPTION
debugreiserfs sometimes helps to solve problems with reiserfs filesystems. When run without options it prints the super block of the ReiserFS filesystem found on the device.

device

is the special file corresponding to the device (e.g /dev/hdXX for an IDE disk partition or /dev/sdXX for a SCSI disk partition).

## OPTIONS
-j device

prints the contents of the journal. The option -p allows it to pack the journal with other metadata into the archive.

-J

prints the journal header.

-d

prints the formatted nodes of the internal tree of the filesystem.

-D

prints the formatted nodes of all used blocks of the filesystem.

-m

prints the contents of the bitmap (slightly useful).

-o

prints the objectid map (slightly useful).

-B file

takes the list of bad blocks stored in the internal ReiserFS tree and translates it into an ascii list written to the specified file.

-1 blocknumber

prints the specified block of the filesystem.

-p

extracts the filesystem's metadata with debugreiserfs -p /dev/xxx | gzip -c > xxx.gz. None of your data are packed unless a filesystem corruption presents when the whole block having this corruption is packed. You send us the output, and we use it to create a filesystem with the same strucure as yours using debugreiserfs -u. When the data file is not too large, this usually allows us to quickly reproduce and debug the problem.

-u

builds the ReiserFS filesystem image with gunzip -c xxx.gz | debugreiserfs -u /dev/image of the previously packed metadata with debugreiserfs -p. The result image is not the same as the original filesystem, because mostly only metadata were packed with debugreiserfs -p, but the filesystem structure is completely recreated.

-S

When -S is not specified -p deals with blocks marked used in the filesystem bitmap only. With this option set debugreiserfs will work with the entire device.

-q

When -p is in use, suppress showing the speed of progress.

## AUTHOR
This version of debugreiserfs has been written by Vitaly Fertman <vitaly@namesys.com>.

## BUGS
Please report bugs to the ReiserFS developers <reiserfs-devel@vger.kernel.org>, providing as much information as possible--your hardware, kernel, patches, settings, all printed messages; check the syslog file for any related information.

## SEE ALSO
reiserfsck(8), mkreiserfs(8)


mkreiserfs

title: mkreiserfs(8)

text:
# mkreiserfs(8)

## NAME
mkreiserfs - The create tool for the Linux ReiserFS filesystem.

## SYNOPSIS
mkreiserfs [ -dfV ] [ -b | --block-size N ] [ -h | --hash HASH ] [ -u | --uuid UUID ] [ -l | --label LABEL ] [ --format FORMAT ] [ -q | --quiet ] [ -j | --journal-device FILE ] [ -s | --journal-size N ] [ -o | --journal-offset N ] [ -t | --transaction-max-size N ] [ -B | --badblocks file ] device [ filesystem-size ]

## DESCRIPTION
mkreiserfs creates a Linux ReiserFS filesystem on a device (usually a disk partition).

device

is the special file corresponding to a device or to a partition (e.g /dev/hdXX for an IDE disk partition or /dev/sdXX for a SCSI disk partition).

filesystem-size

is the size in blocks of the filesystem. If omitted, mkreiserfs will automatically set it.

## OPTIONS
-b | --block-size N

N is block size in bytes. It may only be set to a power of 2 within the 512-8192 interval.

-h | --hash HASH

HASH specifies which hash function will sort the names in the directories. Choose from r5, rupasov, or tea. r5 is the default one.

--format FORMAT

FORMAT specifies the format for the new filsystem. Choose format 3.5 or 3.6. If none is specified mkreiserfs will create format 3.6 if running kernel is 2.4 or higher, and format 3.5 if kernel 2.2 is running, and will refuse creation under all other kernels.

-u | --uuid UUID

Sets the Universally Unique IDentifier of the filesystem to UUID (see also uuidgen(8)). The format of the UUID is a series of hex digits separated by hypthens, e.g.: "c1b9d5a2-f162-11cf-9ece-0020afc76f16". If the option is skipped, mkreiserfs will by default generate a new UUID.

-l | --label LABEL

Sets the volume label of the filesystem. LABEL can at most be 16 characters long; if it is longer than 16 characters, mkreiserfs will truncate it.

-q | --quiet

Sets mkreiserfs to work quietly without producing messages, progress or questions. It is useful, but only for use by end users, if you run mkreiserfs in a script.

-j | --journal-device FILE

FILE is the name of the block device on which is to be places the filesystem journal.

-o | --journal-offset N

N is the offset where the journal starts when it is to be on a separate device. Default is 0. N has no effect when the journal is to be on the host device.

-s | --journal-size N

N is the size of the journal in blocks. When the journal is to be on a separate device, its size defaults to the number of blocks that the device has. When journal is to be on the host device, its size defaults to 8193 and the maximal possible size is 32749 (for blocksize 4k). The minimum size is 513 blocks (whether the journal is on the host or on a separate device).

-t | --transaction-max-size N

N is the maximum transaction size parameter for the journal. The default, and max possible, value is 1024 blocks. It should be less than half the size of the journal. If specified incorrectly, it will automatically be adjusted.

-B | --badblocks file

File is the file name of the file that contains the list of blocks to be marked as bad on the filesystem. This list can be created by /sbin/badblocks -b block-size device.

-f

Forces mkreiserfs to continue even when the device is the whole disk, looks mounted, or is not a block device. If -f is specified more than once, it allows the user to avoid asking for confirmation.

-d

Sets mkreiserfs to print debugging information during mkreiserfs.

-V

Prints the version and then exits.

## AUTHOR
This version of mkreiserfs has been written by Edward Shishkin <edward@namesys.com>.

## BUGS
Please report bugs to the ReiserFS developers <reiserfs-devel@vger.kernel.org>, providing as much information as possible--your hardware, kernel, patches, settings, all printed messages; check the syslog file for any related information.

## SEE ALSO
reiserfsck(8), debugreiserfs(8), reiserfstune(8)


reiserfsck

title: reiserfsck(8)

text:
# reiserfsck(8)

## NAME
reiserfsck - The checking tool for the ReiserFS filesystem.

## SYNOPSIS
reiserfsck [ -aprVy ] [ --rebuild-sb | --check | --fix-fixable | --rebuild-tree | --clean-attributes ] [ -j | --journal device ] [ -z | --adjust-size ] [ -n | --nolog ] [ -B | --badblocks file ] [ -l | --logfile file ] [ -q | --quiet ] [ -y | --yes ] [ -f | --force ] [ -S | --scan-whole-partition ] [ --no-journal-available ] device

## DESCRIPTION
Reiserfsck searches for a Reiserfs filesystem on a device, replays any necessary transactions, and either checks or repairs the file system.

device

is the special file corresponding to a device or to a partition (e.g /dev/hdXX for an IDE disk partition or /dev/sdXX for a SCSI disk partition).

## OPTIONS
--rebuild-sb

This option recovers the superblock on a Reiserfs partition. Normally you only need this option if mount reports "read_super_block: can't find a reiserfs file system" and you are sure that a Reiserfs file system is there. But remember that if you have used some partition editor program and now you cannot find a filesystem, probably something has gone wrong while repartitioning and the start of the partition has been changed. If so, instead of rebuilding the super block on a wrong place you should find the correct start of the partition first.

--check

This default action checks filesystem consistency and reports, but does not repair any corruption that it finds. This option may be used on a read-only file system mount.

--fix-fixable

This option recovers certain kinds of corruption that do not require rebuilding the entire file system tree (--rebuild-tree). Normally you only need this option if the --check option reports "corruption that can be fixed with --fix-fixable". This includes: zeroing invalid data-block pointers, correcting st_size and st_blocks for directories, and deleting invalid directory entries.

--rebuild-tree

This option rebuilds the entire filesystem tree using leaf nodes found on the device. Normally you only need this option if the reiserfsck --check reports "Running with --rebuild-tree is required". You are strongly encouraged to make a backup copy of the whole partition before attempting the --rebuild-tree option. Once reiserfsck --rebuild-tree is started it must finish its work (and you should not interrupt it), otherwise the filesystem will be left in the unmountable state to avoid subsequent data corruptions.

--clean-attributes

This option cleans reserved fields of Stat-Data items. There were days when there were no extended attributes in reiserfs. When they were implemented old partitions needed to be cleaned first -- reiserfs code in the kernel did not care about not used fields in its strutures. Thus if you have used one of the old (pre-attrbutes) kernels with a ReiserFS filesystem and you want to use extented attribues there, you should clean the filesystem first.

--journal device , -j device

This option supplies the device name of the current file system journal. This option is required when the journal resides on a separate device from the main data device (although it can be avoided with the expert option --no-journal-available).

--adjust-size, -z

This option causes reiserfsck to correct file sizes that are larger than the offset of the last discovered byte. This implies that holes at the end of a file will be removed. File sizes that are smaller than the offset of the last discovered byte are corrected by --fix-fixable.

--badblocks file, -B file

This option sets the badblock list to be the list of blocks specified in the given `file`. The filesystem badblock list is cleared before the new list is added. It can be used with --fix-fixable to fix the list of badblocks (see debugreiserfs -B). If the device has bad blocks, every time it must be given with the --rebuild-tree option.

--logfile file, -l file

This option causes reiserfsck to report any corruption it finds to the specified log file rather than to stderr.

--nolog, -n

This option prevents reiserfsck from reporting any kinds of corruption.

--quiet, -q

This option prevents reiserfsck from reporting its rate of progress.

--yes, -y

This option inhibits reiserfsck from asking you for confirmation after telling you what it is going to do. It will assuem you confirm. For safety, it does not work with the --rebuild-tree option.

-a, -p

These options are usually passed by fsck -A during the automatic checking of those partitions listed in /etc/fstab. These options cause reiserfsck to print some information about the specified filesystem, to check if error flags in the superblock are set and to do some light-weight checks. If these checks reveal a corruption or the flag indicating a (possibly fixable) corruption is found set in the superblock, then reiserfsck switches to the fix-fixable mode. If the flag indicating a fatal corruption is found set in the superblock, then reiserfsck finishes with an error.

--force, -f

Force checking even if the file system seems clean.

-V

This option prints the reiserfsprogs version and then exit.

-r

This option does nothing at all; it is provided only for backwards compatibility.

## EXPERT OPTIONS
DO NOT USE THESE OPTIONS UNLESS YOU KNOW WHAT YOU ARE DOING. WE ARE NOT RESPONSIBLE IF YOU LOSE DATA AS A RESULT OF THESE OPTIONS.

--no-journal-available

This option allows reiserfsck to proceed when the journal device is not available. This option has no effect when the journal is located on the main data device. NOTE: after this operation you must use reiserfstune to specify a new journal device.

--scan-whole-partition, -S

This option causes --rebuild-tree to scan the whole partition but not only the used space on the partition.

## AN EXAMPLE OF USING reiserfsck
1. You think something may be wrong with a reiserfs partition on /dev/hda1 or you would just like to perform a periodic disk check.

2. Run reiserfsck --check --logfile check.log /dev/hda1. If reiserfsck --check exits with status 0 it means no errors were discovered.

3. If reiserfsck --check exits with status 1 (and reports about fixable corruptions) it means that you should run reiserfsck --fix-fixable --logfile fixable.log /dev/hda1.

4. If reiserfsck --check exits with status 2 (and reports about fatal corruptions) it means that you need to run reiserfsck --rebuild-tree. If reiserfsck --check fails in some way you should also run reiserfsck --rebuild-tree, but we also encourage you to submit this as a bug report.

5. Before running reiserfsck --rebuild-tree, please make a backup of the whole partition before proceeding. Then run reiserfsck --rebuild-tree --logfile rebuild.log /dev/hda1.

6. If the reiserfsck --rebuild-tree step fails or does not recover what you expected, please submit this as a bug report. Try to provide as much information as possible including your platform and Linux kernel version. We will try to help solve the problem.

## EXIT CODES
reiserfsck uses the following exit codes:

0 - No errors.

1 - File system errors corrected.

2 - Reboot is needed.

4 - File system fatal errors left uncorrected,

reiserfsck --rebuild-tree needs to be launched.

6 - File system fixable errors left uncorrected,

reiserfsck --fix-fixable needs to be launched.

8 - Operational error.

16 - Usage or syntax error.

## AUTHOR
This version of reiserfsck has been written by Vitaly Fertman <vitaly@namesys.com>.

## BUGS
Please report bugs to the ReiserFS developers <reiserfs-devel@vger.kernel.org>, providing as much information as possible--your hardware, kernel, patches, settings, all printed messages, the logfile; check the syslog file for any related information.

## TODO
Faster recovering, signal handling.

## SEE ALSO
mkreiserfs(8), reiserfstune(8) resize_reiserfs(8), debugreiserfs(8),


reiserfstune

title: reiserfstune(8)

text:
# reiserfstune(8)

## NAME
reiserfstune - The tunning tool for the ReiserFS filesystem.

## SYNOPSIS
reiserfstune [ -f ] [ -h | --help ] [ -j | --journal-device FILE ] [ --no-journal-available ] [ --journal-new-device FILE ] [ --make-journal-standard ] [ -s | --journal-new-size N ] [ -o | --journal-new-offset N ] [ -t | --max-transaction-size N ] [ -b | --add-badblocks file ] [ -B | --badblocks file ] [ -u | --uuid UUID ] [ -l | --label LABEL ] [ -c | --check-interval interval-in-days ] [ -C | --time-last-checked timestamp ] [ -m | --max-mnt-count count ] [ -M | --mnt-count count ] device

## DESCRIPTION
reiserfstune is used for tuning the ReiserFS. It can change two journal parameters (the journal size and the maximum transaction size), and it can move the journal's location to a new specified block device. (The old ReiserFS's journal may be kept unused, or discarded at the user's option.) Besides that reiserfstune can store the bad block list to the ReiserFS and set UUID and LABEL. Note: At the time of writing the relocated journal was implemented for a special release of ReiserFS, and was not expected to be put into the mainstream kernel until approximately Linux 2.5. This means that if you have the stock kernel you must apply a special patch. Without this patch the kernel will refuse to mount the newly modified file system. We will charge $25 to explain this to you if you ask us why it doesn't work.

Perhaps the most interesting application of this code is to put the journal on a solid state disk.

device

is the special file corresponding to the newly specified block device (e.g /dev/hdXX for IDE disk partition or /dev/sdXX for the SCSI disk partition).

## OPTIONS
-h | --help

Print usage information and exit.

-j | --journal-device FILE

FILE is the file name of the block device the file system has the current journal (the one prior to running reiserfstune) on. This option is required when the journal is already on a separate device from the main data device (although it can be avoided with --no-journal-available). If you don't specify journal device by this option, reiserfstune suppose that journal is on main device.

--no-journal-available

allows reiserfstune to continue when the current journal's block device is no longer available. This might happen if a disk goes bad and you remove it (and run fsck).

--journal-new-device FILE

FILE is the file name of the block device which will contain the new journal for the file system. If you don't specify this, reiserfstune supposes that journal device remains the same.

-s | --journal-new-size N

N is the size parameter for the new journal. When journal is to be on a separate device - its size defaults to number of blocks that device has. When journal is to be on the same device as the filesytem - its size defaults to amount of blocks allocated for journal by mkreiserfs when it created the filesystem. Minimum is 513 for both cases.

-o | --journal-new-offset N

N is an offset in blocks where journal will starts from when journal is to be on a separate device. Default is 0. Has no effect when journal is to be on the same device as the filesystem. Most users have no need to use this feature. It can be used when you want the journals from multiple filesystems to reside on the same device, and you don't want to or cannot partition that device.

-t | --maximal-transaction-size N

N is the maximum transaction size parameter for the new journal. The default, and max possible, value is 1024 blocks. It should be less than half the size of the journal. If specifed incorrectly, it will be adjusted.

-b | --add-badblocks file

File is the file name of the file that contains the list of blocks to be marked as bad on the fs. The list is added to the fs list of bad blocks.

-B | --badblocks file

File is the file name of the file that contains the list of blocks to be marked as bad on the fs. The bad block list on the fs is cleared before the list specified in the File is added to the fs.

-f | --force

Normally reiserfstune will refuse to change a journal of a file system that was created before this journal relocation code. This is because if you change the journal, you cannot go back (without special option --make-journal-standard) to an old kernel that lacks this feature and be able to use your filesytem. This option forces it to do that. Specified more than once it allows to avoid asking for confirmation.

--make-journal-standard

As it was mentioned above, if your file system has non-standard journal, it can not be mounted on the kernel without journal relocation code. The thing can be changed, the only condition is that there is reserved area on main device of the standard journal size 8193 blocks (it will be so for instance if you convert standard journal to non-standard). Just specify this option when you relocate journal back, or without relocation if you already have it on main device.

-u | --uuid UUID

Set the universally unique identifier ( UUID ) of the filesystem to UUID (see also uuidgen(8)). The format of the UUID is a series of hex digits separated by hypthens, like this: "c1b9d5a2-f162-11cf-9ece-0020afc76f16".

-l | --label LABEL

Set the volume label of the filesystem. LABEL can be at most 16 characters long; if it is longer than 16 characters, reiserfstune will truncate it.

-c | --check-interval interval-in-days

Adjust the maximal time between two filesystem checks. A value of "disable" will disable the time-dependent checking. A value of "default" will restore the compile-time default. It is strongly recommended that either -m (mount-count dependent) or -c (time-dependent) checking be enabled to force periodic full fsck.reiserfs(8) checking of the filesystem. Failure to do so may lead to filesystem corruption (due to bad disks, cables, memory, or kernel bugs) going unnoticed, ultimately resulting in data loss or corruption.

-C | --time-last-checked timestamp

Set the time the filesystem was last checked using fsck.reiserfs. This can be useful in scripts which use a Logical Volume Manager to make a consistent snapshot of a filesystem, and then check the filesystem during off hours to make sure it hasn't been corrupted due to hardware problems, etc. If the filesystem was clean, then this option can be used to set the last checked time on the original filesystem. The format of time-last-checked is the international date format, with an optional time specifier, i.e. YYYYMMDD[HH[MM[SS]]]. The keyword now is also accepted, in which case the last checked time will be set to the current time.

-m | --max-mnt-count max-mount-count

Adjust the number of mounts after which the filesystem will be checked by fsck.reiserfs(8). If max-mount-count is "disable", the number of times the filesystem is mounted will be disregarded by fsck.reiserfs(8) and the kernel. A value of "default" will restore the compile-time default. Staggering the mount-counts at which filesystems are forcibly checked will avoid all filesystems being checked at one time when using journaled filesystems.

You should strongly consider the consequences of disabling mount-count-dependent checking entirely. Bad disk drives, cables, memory, and kernel bugs could all corrupt a filesystem without marking the filesystem dirty or in error. If you are using journaling on your filesystem, your filesystem will never be marked dirty, so it will not normally be checked. A filesys‐ tem error detected by the kernel will still force an fsck on the next reboot, but it may already be too late to prevent data loss at that point.

This option requires a kernel which supports incrementing the count on each mount. This feature has not been incorporated into kernel versions older than 2.6.25.

See also the -c option for time-dependent checking.

-M | --mnt-count count

Set the number of times the filesystem has been mounted. If set to a greater value than the max-mount-counts parameter set by the -m option, fsck.reiserfs(8) will check the filesystem at the next reboot.

## POSSIBLE SCENARIOS OF USING REISERFSTUNE:
1. You have ReiserFS on /dev/hda1, and you wish to have it working with its journal on the device /dev/journal

```
boot kernel patched with special "relocatable journal support" patch
reiserfstune /dev/hda1 --journal-new-device /dev/journal -f
mount /dev/hda1 and use.
You would like to change max transaction size to 512 blocks
reiserfstune -t 512 /dev/hda1
You would like to use your file system on another kernel that doesn't
contain relocatable journal support.
umount /dev/hda1
reiserfstune /dev/hda1 -j /dev/journal --journal-new-device /dev/hda1 --make-journal-standard
mount /dev/hda1 and use.
```

```
2. You would like to have ReiserFS on /dev/hda1 and to be able to
switch between different journals including journal located on the
device containing the filesystem.
```

```
boot kernel patched with special "relocatable journal support" patch
mkreiserfs /dev/hda1
you got solid state disk (perhaps /dev/sda, they typically look like scsi disks)
reiserfstune --journal-new-device /dev/sda1 -f /dev/hda1
Your scsi device dies, it is three in the morning, you have an extra IDE device
lying around
reiserfsck --no-journal-available /dev/hda1
or
reiserfsck --rebuild-tree --no-journal-available /dev/hda1
reiserfstune --no-journal-available --journal-new-device /dev/hda1 /dev/hda1
using /dev/hda1 under patched kernel
```

## AUTHOR
This version of reiserfstune has been written by Vladimir Demidov <vova@namesys.com> and Edward Shishkin <edward@namesys.com>.

## BUGS
Please report bugs to the ReiserFS developers <reiserfs-devel@vger.kerne.org>, providing as much information as possible--your hardware, kernel, patches, settings, all printed messages; check the syslog file for any related information.

## SEE ALSO
reiserfsck(8), debugreiserfs(8), mkreiserfs(8)


title: resize_reiserfs(8)

text:
# resize_reiserfs(8)

## NAME
resize_reiserfs - resizer tool for the ReiserFS filesystem

## SYNOPSIS
resize_reiserfs [ -s [+|-]size[K|M|G] ] [ -j dev ] [ -fqv ] device

## DESCRIPTION
The resize_reiserfs tool resizes an unmounted reiserfs file system. It enlarges or shrinks an reiserfs file system located on a device so that it will have size bytes or size=old_size +(-) size bytes if the + or - prefix is used. If the -s option is not specified, the filesystem will be resized to fill the given device. The size parameter may have one of the optional modifiers K, M, G, which means the size parameter is given in kilo-, mega-, gigabytes respectively.

The resize_reiserfs program does not manipulate the size of the device. If you wish to enlarge a filesystem, you must make sure you expand the underlying device first. This can be done using cfdisk(8) for partitions, by deleting the partition and recreating it with a larger size (assuming there is free space after the partition in question). Make sure you re-create it with the same starting disk cylinder as before! Otherwise, the resize operation will certainly not work, and you may lose your entire filesystem.

The resize_reiserfs program allows to grow a reiserfs on-line if there is a free space on block device.

If you wish to shrink a reiserfs partition, first use resize_reiserfs to shrink the file system. You may then use cfdisk(8) to shrink the device. When shrinking the size of the device, make sure you do not make it smaller than the reduced size of the reiserfs filesystem.

## OPTIONS
-s [+|-]size

Set the new size in bytes.

-j dev

Set the journal device name.

-f

Force, do not perform checks.

-q

Do not print anything but error messages.

-v

Turn on extra progress status messages (default).

## RETURN VALUES
0 Resizing successful.

-1 Resizing not successful.

## EXAMPLES
The following example shows how to test resize_reiserfs. Suppose 2Gb reiserfs filesystem is created on the device /dev/hda8 and is mounted on /mnt. For shrinking the device we need to unmount it first, then run resize_reiserfs with a size parameter (in this case -1Gb):

df

umount /mnt

resize_reiserfs -s -1G /dev/hda8

mount /dev/hda8 /mnt

df /mnt

## AUTHOR
This version of resize_reiserfs has been written by Alexander Zarochentcev <zam@namesys.com>.

## BUGS
Please report bugs to the ReiserFS developers <reiserfs-devel@vger.kernel.org>, providing as much information as possible--your hardware, kernel, patches, settings, all printed messages; check the syslog file for any related information.

## SEE ALSO
cfdisk(8), reiserfsck(8), debugreiserfs(8)


ocf-tester

package: resource-agents

title: ocf-tester(8)

summary: Part of the Linux-HA project

text:
# ocf-tester(8)

## NAME
ocf-tester - Part of the Linux-HA project

## SYNOPSIS
ocf-tester [-LhvqdX] -n resource_name [-o name=value]* /full/path/to/resource/agent

## DESCRIPTION
Tool for testing if a cluster resource is OCF compliant

## OPTIONS
-h

This text

-v

Be verbose while testing

-q

Be quiet while testing

-d

Turn on RA debugging

-n name

Name of the resource

-o name=value

Name and value of any parameters required by the agent

-L

Use lrmadmin/lrmd for tests

Usage: ocf-tester [-Lh] -n resource_name [-o name=value]* /full/path/to/resource/agent

-h

This text

-v

Be verbose while testing

-q

Be quiet while testing

-d

Turn on RA debugging

-X

Turn on RA tracing (expect large output)

-n name

Name of the resource

-o name=value

Name and value of any parameters required by the agent

-L

Use lrmadmin/lrmd for tests