slapauth

title: slapauth(8)

text:
# slapauth(8)

## NAME
slapauth - Check a list of string-represented IDs for LDAP authc/authz

## SYNOPSIS
/usr/sbin/slapauth [-d debug-level] [-f slapd.conf] [-F confdir] [-M mech] [-o option[=value]] [-R realm] [-U authcID] [-v] [-X authzID] ID [...]

## DESCRIPTION
Slapauth is used to check the behavior of the slapd in mapping identities for authentication and authorization purposes, as specified in slapd.conf(5). It opens the slapd.conf(5) configuration file or the slapd-config(5) backend, reads in the authz-policy/olcAuthzPolicy and authz-regexp/olcAuthzRegexp directives, and then parses the ID list given on the command-line.

## OPTIONS
-d debug-level

enable debugging messages as defined by the specified debug-level; see slapd(8) for details.

-f slapd.conf

specify an alternative slapd.conf(5) file.

-F confdir

specify a config directory. If both -f and -F are specified, the config file will be read and converted to config directory format and written to the specified directory. If neither option is specified, an attempt to read the default config directory will be made before trying to use the default config file. If a valid config directory exists then the default config file is ignored.

-M mech

specify a mechanism.

-o option[=value]

Specify an option with a(n optional) value. Possible generic options/values are:

```
              syslog=<subsystems>  (see `-s' in slapd(8))

              syslog-level=<level> (see `-S' in slapd(8))

              syslog-user=<user>   (see `-l' in slapd(8))
```

-R realm

specify a realm.

-U authcID

specify an ID to be used as authcID throughout the test session. If present, and if no authzID is given, the IDs in the ID list are treated as authzID.

-X authzID

specify an ID to be used as authzID throughout the test session. If present, and if no authcID is given, the IDs in the ID list are treated as authcID. If both authcID and authzID are given via command line switch, the ID list cannot be present.

-v

enable verbose mode.

## EXAMPLES
The command

```
	/usr/sbin/slapauth -f //etc/openldap/slapd.conf -v \

            -U bjorn -X u:bjensen
```

tests whether the user bjorn can assume the identity of the user bjensen provided the directives

```
	authz-policy from
	authz-regexp "^uid=([^,]+).*,cn=auth$"
		"ldap:///dc=example,dc=net??sub?uid=$1"
```

are defined in slapd.conf(5).

## SEE ALSO
ldap(3), slapd(8), slaptest(8)

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

## ACKNOWLEDGEMENTS
OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.


slapcat

package: openldap-servers

title: slapcat(8)

summary: SLAPD database to LDIF utility

text:
# slapcat(8)

## NAME
slapcat - SLAPD database to LDIF utility

## SYNOPSIS
/usr/sbin/slapcat [-afilter] [-bsuffix] [-c] [-ddebug-level] [-fslapd.conf] [-Fconfdir] [-g] [-HURI] [-lldif-file] [-ndbnum] [-ooption[=value]] [-ssubtree-dn] [-v]

## DESCRIPTION
Slapcat is used to generate an LDAP Directory Interchange Format (LDIF) output based upon the contents of a slapd(8) database. It opens the given database determined by the database number or suffix and writes the corresponding LDIF to standard output or the specified file. Databases configured as subordinate of this one are also output, unless -g is specified.

The entry records are presented in database order, not superior first order. The entry records will include all (user and operational) attributes stored in the database. The entry records will not include dynamically generated attributes (such as subschemaSubentry).

The output of slapcat is intended to be used as input to slapadd(8). The output of slapcat cannot generally be used as input to ldapadd(1) or other LDAP clients without first editing the output. This editing would normally include reordering the records into superior first order and removing no-user-modification operational attributes.

## OPTIONS
-a filter

Only dump entries matching the asserted filter. For example slapcat -a \

"(!(entryDN:dnSubtreeMatch:=ou=People,dc=example,dc=com))"

will dump all but the "ou=People,dc=example,dc=com" subtree of the "dc=example,dc=com" database. Deprecated; use -H ldap:///???(filter) instead.

-b suffix

Use the specified suffix to determine which database to generate output for. The -b cannot be used in conjunction with the -n option.

-c

Enable continue (ignore errors) mode. Multiple occorrences of -c make slapcat(8) try harder.

-d debug-level

Enable debugging messages as defined by the specified debug-level; see slapd(8) for details.

-f slapd.conf

Specify an alternative slapd.conf(5) file.

-F confdir

specify a config directory. If both -f and -F are specified, the config file will be read and converted to config directory format and written to the specified directory. If neither option is specified, an attempt to read the default config directory will be made before trying to use the default config file. If a valid config directory exists then the default config file is ignored.

-g

disable subordinate gluing. Only the specified database will be processed, and not its glued subordinates (if any).

-H URI

use dn, scope and filter from URI to only handle matching entries.

-l ldif-file

Write LDIF to specified file instead of standard output.

-n dbnum

Generate output for the dbnum-th database listed in the configuration file. The config database slapd-config(5), is always the first database, so use -n 0 to select it. The -n cannot be used in conjunction with the -b option.

-o option[=value]

Specify an option with a(n optional) value. Possible generic options/values are:

```
              syslog=<subsystems>  (see `-s' in slapd(8))

              syslog-level=<level> (see `-S' in slapd(8))

              syslog-user=<user>   (see `-l' in slapd(8))

              ldif-wrap={no|<n>}

n is the number of columns allowed for the LDIF output
(n equal to 0 uses the default, corresponding to 78).
The minimum is 2, leaving space for one character and one
continuation character.
Use no for no wrap.
```

-s subtree-dn

```
Only dump entries in the subtree specified by this DN.
Implies -b subtree-dn if no
-b
or
-n
option is given.
Deprecated; use -H ldap:///subtree-dn instead.
```

-v

```
Enable verbose mode.
```

## LIMITATIONS
For some backend types, your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. It is always safe to run slapcat with the slapd-bdb(5), slapd-hdb(5), slapd-mdb(5), and slapd-null(5) backends.

## EXAMPLES
To make a text backup of your SLAPD database and put it in a file called ldif, give the command:

```
	/usr/sbin/slapcat -l ldif
```

## SEE ALSO
ldap(3), ldif(5), slapadd(8), ldapadd(1), slapd(8)

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

## ACKNOWLEDGEMENTS
OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.


slapd

title: slapd(8)

summary: Stand-alone LDAP Daemon

text:
# slapd(8)

## NAME
slapd - Stand-alone LDAP Daemon

## SYNOPSIS
/usr/lib/slapd [-4|-6] [-T {acl|a[dd]|auth|c[at]| d[n]|i[ndex]|p[asswd]|s[chema]|t[est]}] [-d debug-level] [-f slapd-config-file] [-F slapd-config-directory] [-h URLs] [-n service-name] [-s syslog-level] [-l syslog-local-user] [-o option[=value]] [-r directory] [-u user] [-g group] [-c cookie]

## DESCRIPTION
Slapd is the stand-alone LDAP daemon. It listens for LDAP connections on any number of ports (default 389), responding to the LDAP operations it receives over these connections. slapd is typically invoked at boot time, usually out of /etc/rc.local. Upon startup, slapd normally forks and disassociates itself from the invoking tty. If configured in the config file (or config directory), the slapd process will print its process ID (see getpid(2)) to a .pid file, as well as the command line options during invocation to an .args file (see slapd.conf(5)). If the -d flag is given, even with a zero argument, slapd will not fork and disassociate from the invoking tty.

See the "OpenLDAP Administrator's Guide" for more details on slapd.

## OPTIONS
-4

Listen on IPv4 addresses only.

-6

Listen on IPv6 addresses only.

-T tool

Run in Tool mode. The tool argument selects whether to run as slapadd, slapcat, slapdn, slapindex, slappasswd, slapschema, or slaptest (slapacl and slapauth need the entire acl and auth option value to be spelled out, as a is reserved to slapadd). This option should be the first option specified when it is used; any remaining options will be interpreted by the corresponding slap tool program, according to the respective man pages. Note that these tool programs will usually be symbolic links to slapd. This option is provided for situations where symbolic links are not provided or not usable.

-d debug-level

Turn on debugging as defined by debug-level. If this option is specified, even with a zero argument, slapd will not fork or disassociate from the invoking terminal. Some general operation and status messages are printed for any value of debug-level. debug-level is taken as a bit string, with each bit corresponding to a different kind of debugging information. See <ldap_log.h> for details. Comma-separated arrays of friendly names can be specified to select debugging output of the corresponding debugging information. All the names recognized by the loglevel directive described in slapd.conf(5) are supported. If debug-level is ?, a list of installed debug-levels is printed, and slapd exits. Remember that if you turn on packet logging, packets containing bind passwords will be output, so if you redirect the log to a logfile, that file should be read-protected.

-s syslog-level

This option tells slapd at what debug-level debugging statements should be logged to the syslog(8) facility. The value syslog-level can be set to any value or combination allowed by the -d switch. Slapd logs all messages selected by syslog-level at the syslog(3) severity debug-level DEBUG, on the unit specified with -l.

-n service-name

Specifies the service name for logging and other purposes. Defaults to basename of argv[0], i.e.: "slapd".

-l syslog-local-user

Selects the local user of the syslog(8) facility. Value can be LOCAL0, through LOCAL7, as well as USER and DAEMON. The default is LOCAL4. However, this option is only permitted on systems that support local users with the syslog(8) facility. Logging to syslog(8) occurs at the "DEBUG" severity debug-level.

-f slapd-config-file

Specifies the slapd configuration file. The default is /etc/openldap/slapd.conf.

-F slapd-config-directory

Specifies the slapd configuration directory. The default is /etc/openldap/slapd.d. If both -f and -F are specified, the config file will be read and converted to config directory format and written to the specified directory. If neither option is specified, slapd will attempt to read the default config directory before trying to use the default config file. If a valid config directory exists then the default config file is ignored. All of the slap tools that use the config options observe this same behavior.

-h URLlist

slapd will by default serve ldap:/// (LDAP over TCP on all interfaces on default LDAP port). That is, it will bind using INADDR_ANY and port 389. The -h option may be used to specify LDAP (and other scheme) URLs to serve. For example, if slapd is given -h "ldap://127.0.0.1:9009/ ldaps:/// ldapi:///", it will listen on 127.0.0.1:9009 for LDAP, 0.0.0.0:636 for LDAP over TLS, and LDAP over IPC (Unix domain sockets). Host 0.0.0.0 represents INADDR_ANY (any interface). A space separated list of URLs is expected. The URLs should be of the LDAP, LDAPS, or LDAPI schemes, and generally without a DN or other optional parameters (excepting as discussed below). Support for the latter two schemes depends on selected configuration options. Hosts may be specified by name or IPv4 and IPv6 address formats. Ports, if specified, must be numeric. The default ldap:// port is 389 and the default ldaps:// port is 636. For LDAP over IPC, name is the name of the socket, and no port is required, nor allowed; note that directory separators must be URL-encoded, like any other characters that are special to URLs; so the socket

/usr/local/var/ldapi

must be specified as

ldapi://%2Fusr%2Flocal%2Fvar%2Fldapi

The default location for the IPC socket is /var/run/ldapi

The listener permissions are indicated by "x-mod=-rwxrwxrwx", "x-mod=0777" or "x-mod=777", where any of the "rwx" can be "-" to suppress the related permission, while any of the "7" can be any legal octal digit, according to chmod(1). The listeners can take advantage of the "x-mod" extension to apply rough limitations to operations, e.g. allow read operations ("r", which applies to search and compare), write operations ("w", which applies to add, delete, modify and modrdn), and execute operations ("x", which means bind is required). "User" permissions apply to authenticated users, while "other" apply to anonymous users; "group" permissions are ignored. For example, "ldap:///????x-mod=-rw-------" means that read and write is only allowed for authenticated connections, and bind is required for all operations. This feature is experimental, and requires to be manually enabled at configure time.

-r directory

Specifies a directory to become the root directory. slapd will change the current working directory to this directory and then chroot(2) to this directory. This is done after opening listeners but before reading any configuration file or initializing any backend. When used as a security mechanism, it should be used in conjunction with -u and -g options.

-u user

slapd will run slapd with the specified user name or id, and that user's supplementary group access list as set with initgroups(3). The group ID is also changed to this user's gid, unless the -g option is used to override. Note when used with -r, slapd will use the user database in the change root environment. Note that on some systems, running as a non-privileged user will prevent passwd back-ends from accessing the encrypted passwords. Note also that any shell back-ends will run as the specified non-privileged user.

-g group

slapd will run with the specified group name or id. Note when used with -r, slapd will use the group database in the change root environment.

-c cookie

This option provides a cookie for the syncrepl replication consumer. The cookie is a comma separated list of name=value pairs. Currently supported syncrepl cookie fields are rid, sid, and csn. rid identifies a replication thread within the consumer server and is used to find the syncrepl specification in slapd.conf(5) or slapd-config(5) having the matching replication identifier in its definition. The rid must be provided in order for any other specified values to be used. sid is the server id in a multi-provider configuration. csn is the commit sequence number received by a previous synchronization and represents the state of the consumer content which the syncrepl engine will synchronize to the current provider content. In case of multi-provider replication agreement, multiple csn values, semicolon separated, can appear. Use only the rid part to force a full reload.

-o option[=value]

This option provides a generic means to specify options without the need to reserve a separate letter for them. It supports the following options:

slp={on|off|slp-attrs}

When SLP support is compiled into slapd, disable it (off),

enable it by registering at SLP DAs without specific SLP attributes (on), or with specific SLP attributes slp-attrs that must be an SLP attribute list definition according to the SLP standard. For example, "slp=(tree=production),(server-type=OpenLDAP),(server-version=2.4.15)" registers at SLP DAs with the three SLP attributes tree, server-type and server-version that have the values given above. This allows one to specifically query the SLP DAs for LDAP servers holding the production tree in case multiple trees are available.

## EXAMPLES
To start slapd and have it fork and detach from the terminal and start serving the LDAP databases defined in the default config file, just type:

```
	/usr/lib/slapd
```

To start slapd with an alternate configuration file, and turn on voluminous debugging which will be printed on standard error, type:

```
	/usr/lib/slapd -f /var/tmp/slapd.conf -d 255
```

To test whether the configuration file is correct or not, type:

```
	/usr/lib/slapd -Tt
```

## SEE ALSO
ldap(3), slapd.conf(5), slapd-config(5), slapd.access(5), slapacl(8), slapadd(8), slapauth(8), slapcat(8), slapdn(8), slapindex(8), slappasswd(8), slapschema(8), slaptest(8).

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

## BUGS
See http://www.openldap.org/its/

## ACKNOWLEDGEMENTS
OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.


slapdn

title: slapdn(8)

text:
# slapdn(8)

## NAME
slapdn - Check a list of string-represented LDAP DNs based on schema syntax

## SYNOPSIS
/usr/sbin/slapdn [-d debug-level] [-f slapd.conf] [-F confdir] [-N|-P] [-o option[=value]] [-v] DN [...]

## DESCRIPTION
Slapdn is used to check the conformance of a DN based on the schema defined in slapd(8) and that loaded via slapd.conf(5). It opens the slapd.conf(5) configuration file or the slapd-config (5) backend, reads in the schema definitions, and then parses the DN list given on the command-line.

## OPTIONS
-d debug-level

enable debugging messages as defined by the specified debug-level; see slapd(8) for details.

-f slapd.conf

specify an alternative slapd.conf(5) file.

-F confdir

specify a config directory. If both -f and -F are specified, the config file will be read and converted to config directory format and written to the specified directory. If neither option is specified, an attempt to read the default config directory will be made before trying to use the default config file. If a valid config directory exists then the default config file is ignored.

-N

only output a normalized form of the DN, suitable to be used in a normalization tool; incompatible with -P.

-o option[=value]

Specify an option with a(n optional) value. Possible generic options/values are:

```
              syslog=<subsystems>  (see `-s' in slapd(8))

              syslog-level=<level> (see `-S' in slapd(8))

              syslog-user=<user>   (see `-l' in slapd(8))
```

-P

only output a prettified form of the DN, suitable to be used in a check and beautification tool; incompatible with -N.

-v

enable verbose mode.

## EXAMPLES
To check a DN give the command:

```
	/usr/sbin/slapdn -f //etc/openldap/slapd.conf -v DN
```

## SEE ALSO
ldap(3), slapd(8), slaptest(8)

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

## ACKNOWLEDGEMENTS
OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.


slapindex

title: slapindex(8)

summary: Reindex entries in a SLAPD database

text:
# slapindex(8)

## NAME
slapindex - Reindex entries in a SLAPD database

## SYNOPSIS
/usr/sbin/slapindex [-b suffix] [-c] [-d debug-level] [-f slapd.conf] [-F confdir] [-g] [-n dbnum] [-o option[=value]] [-q] [-t] [-v] [attr[...]]

## DESCRIPTION
Slapindex is used to regenerate slapd(8) indices based upon the current contents of a database. It opens the given database determined by the database number or suffix and updates the indices for all values of all attributes of all entries. If a list of specific attributes is provided on the command line, only the indices for those attributes will be regenerated. Databases configured as subordinate of this one are also re-indexed, unless -g is specified.

All files eventually created by slapindex will belong to the identity slapindex is run as, so make sure you either run slapindex with the same identity slapd(8) will be run as (see option -u in slapd(8)), or change file ownership before running slapd(8).

## OPTIONS
-b suffix

Use the specified suffix to determine which database to generate output for. The -b cannot be used in conjunction with the -n option.

-c

enable continue (ignore errors) mode.

-d debug-level

enable debugging messages as defined by the specified debug-level; see slapd(8) for details.

-f slapd.conf

specify an alternative slapd.conf(5) file.

-F confdir

specify a config directory. If both -f and -F are specified, the config file will be read and converted to config directory format and written to the specified directory. If neither option is specified, an attempt to read the default config directory will be made before trying to use the default config file. If a valid config directory exists then the default config file is ignored.

-g

disable subordinate gluing. Only the specified database will be processed, and not its glued subordinates (if any).

-n dbnum

Generate output for the dbnum-th database listed in the configuration file. The config database slapd-config(5), is always the first database, so use -n 0 The -n cannot be used in conjunction with the -b option.

-o option[=value]

Specify an option with a(n optional) value. Possible generic options/values are:

```
              syslog=<subsystems>  (see `-s' in slapd(8))

              syslog-level=<level> (see `-S' in slapd(8))

              syslog-user=<user>   (see `-l' in slapd(8))
```

-q

enable quick (fewer integrity checks) mode. Performs no consistency checks when writing the database. Improves indexing time, however the database will most likely be unusable if any errors or interruptions occur.

-t

enable truncate mode. Truncates (empties) an index database before indexing any entries. For back-bdb/hdb, may only be used with quick mode. For back-mdb it is usable with and without quick mode.

-v

enable verbose mode.

## LIMITATIONS
Your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database.

This command provides ample opportunity for the user to obtain and drink their favorite beverage.

## EXAMPLES
To reindex your SLAPD database, give the command:

```
	/usr/sbin/slapindex
```

To regenerate the index for only a specific attribute, e.g. "uid", give the command:

```
	/usr/sbin/slapindex uid
```

## SEE ALSO
ldap(3), ldif(5), slapadd(8), ldapadd(1), slapd(8)

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

## ACKNOWLEDGEMENTS
OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.


slappasswd

title: slappasswd(8)

summary: OpenLDAP password utility

text:
# slappasswd(8)

## NAME
slappasswd - OpenLDAP password utility

## SYNOPSIS
/usr/sbin/slappasswd [-v] [-u] [-g|-s secret|-T file] [-h hash] [-c salt-format] [-n] [-o option[=value]]

## DESCRIPTION
Slappasswd is used to generate an userPassword value suitable for use with ldapmodify(1), slapd.conf(5) rootpw configuration directive or the slapd-config(5) olcRootPW configuration directive.

## OPTIONS
-v

enable verbose mode.

-u

Generate RFC 2307 userPassword values (the default). Future versions of this program may generate alternative syntaxes by default. This option is provided for forward compatibility.

-s secret

The secret to hash. If this, -g and -T are absent, the user will be prompted for the secret to hash. -s, -g and -T are mutually exclusive flags.

-g

Generate the secret. If this, -s and -T are absent, the user will be prompted for the secret to hash. -s, -g and -T are mutually exclusive flags. If this is present, {CLEARTEXT} is used as scheme. -g and -h are mutually exclusive flags.

-T "file"

Hash the contents of the file. If this, -g and -s are absent, the user will be prompted for the secret to hash. -s, -g and -T and mutually exclusive flags.

-h "scheme"

If -h is specified, one of the following RFC 2307 schemes may be specified: {CRYPT}, {MD5}, {SMD5}, {SSHA}, and {SHA}. The default is {SSHA}. Note that scheme names may need to be protected, due to { and }, from expansion by the user's command interpreter.

{SHA} and {SSHA} use the SHA-1 algorithm (FIPS 160-1), the latter with a seed.

{MD5} and {SMD5} use the MD5 algorithm (RFC 1321), the latter with a seed.

{CRYPT} uses the crypt(3).

{CLEARTEXT} indicates that the new password should be added to userPassword as clear text. Unless {CLEARTEXT} is used, this flag is incompatible with option -g.

-c crypt-salt-format

Specify the format of the salt passed to crypt(3) when generating {CRYPT} passwords. This string needs to be in sprintf(3) format and may include one (and only one) %s conversion. This conversion will be substituted with a string of random characters from [A-Za-z0-9./]. For example, '%.2s' provides a two character salt and '$1$%.8s' tells some versions of crypt(3) to use an MD5 algorithm and provides 8 random characters of salt. The default is '%s', which provides 31 characters of salt.

-n

Omit the trailing newline; useful to pipe the credentials into a command.

-o option[=value]

Specify an option with a(n optional) value. Possible generic options/values are:

```
              module-path=<pathspec> (see `modulepath' in slapd.conf(5))

              module-load=<filename> (see `moduleload' in slapd.conf(5))

You can load a dynamically loadable password hash module by
using this option.
```

## LIMITATIONS
The practice of storing hashed passwords in userPassword violates Standard Track (RFC 4519) schema specifications and may hinder interoperability. A new attribute type, authPassword, to hold hashed passwords has been defined (RFC 3112), but is not yet implemented in slapd(8).

It should also be noted that the behavior of crypt(3) is platform specific.

## SECURITY CONSIDERATIONS
Use of hashed passwords does not protect passwords during protocol transfer. TLS or other eavesdropping protections should be in-place before using LDAP simple bind.

The hashed password values should be protected as if they were clear text passwords.

## SEE ALSO
ldappasswd(1), ldapmodify(1), slapd(8), slapd.conf(5), slapd-config(5), RFC 2307, RFC 4519, RFC 3112

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

## ACKNOWLEDGEMENTS
OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.


slapschema

title: slapschema(8)

text:
# slapschema(8)

## NAME
slapschema - SLAPD in-database schema checking utility

## SYNOPSIS
/usr/sbin/slapschema [-afilter] [-bsuffix] [-c] [-ddebug-level] [-fslapd.conf] [-Fconfdir] [-g] [-HURI] [-lerror-file] [-ndbnum] [-ooption[=value]] [-ssubtree-dn] [-v]

## DESCRIPTION
Slapschema is used to check schema compliance of the contents of a slapd(8) database. It opens the given database determined by the database number or suffix and checks the compliance of its contents with the corresponding schema. Errors are written to standard output or the specified file. Databases configured as subordinate of this one are also output, unless -g is specified.

Administrators may need to modify existing schema items, including adding new required attributes to objectClasses, removing existing required or allowed attributes from objectClasses, entirely removing objectClasses, or any other change that may result in making perfectly valid entries no longer compliant with the modified schema. The execution of the slapschema tool after modifying the schema can point out inconsistencies that would otherwise surface only when inconsistent entries need to be modified.

The entry records are checked in database order, not superior first order. The entry records will be checked considering all (user and operational) attributes stored in the database. Dynamically generated attributes (such as subschemaSubentry) will not be considered.

## OPTIONS
-a filter

Only check entries matching the asserted filter. For example slapschema -a \

"(!(entryDN:dnSubtreeMatch:=ou=People,dc=example,dc=com))"

will check all but the "ou=People,dc=example,dc=com" subtree of the "dc=example,dc=com" database. Deprecated; use -H ldap:///???(filter) instead.

-b suffix

Use the specified suffix to determine which database to check. The -b cannot be used in conjunction with the -n option.

-c

Enable continue (ignore errors) mode.

-d debug-level

Enable debugging messages as defined by the specified debug-level; see slapd(8) for details.

-f slapd.conf

Specify an alternative slapd.conf(5) file.

-F confdir

specify a config directory. If both -f and -F are specified, the config file will be read and converted to config directory format and written to the specified directory. If neither option is specified, an attempt to read the default config directory will be made before trying to use the default config file. If a valid config directory exists then the default config file is ignored.

-g

disable subordinate gluing. Only the specified database will be processed, and not its glued subordinates (if any).

-H URI

use dn, scope and filter from URI to only handle matching entries.

-l error-file

Write errors to specified file instead of standard output.

-n dbnum

Check the dbnum-th database listed in the configuration file. The config database slapd-config(5), is always the first database, so use -n 0 The -n cannot be used in conjunction with the -b option.

-o option[=value]

Specify an option with a(n optional) value. Possible generic options/values are:

```
              syslog=<subsystems>  (see `-s' in slapd(8))

              syslog-level=<level> (see `-S' in slapd(8))

              syslog-user=<user>   (see `-l' in slapd(8))
```

-s subtree-dn

Only check entries in the subtree specified by this DN. Implies -b subtree-dn if no -b nor -n option is given. Deprecated; use -H ldap:///subtree-dn instead.

-v

Enable verbose mode.

## LIMITATIONS
For some backend types, your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. It is always safe to run slapschema with the slapd-bdb(5), slapd-hdb(5), and slapd-null(5) backends.

## EXAMPLES
To check the schema compliance of your SLAPD database after modifications to the schema, and put any error in a file called errors.ldif, give the command:

```
	/usr/sbin/slapschema -l errors.ldif
```

## SEE ALSO
ldap(3), ldif(5), slapd(8)

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

## ACKNOWLEDGEMENTS
OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.


slaptest

title: slaptest(8)

text:
# slaptest(8)

## NAME
slaptest - Check the suitability of the OpenLDAP slapd configuration

## SYNOPSIS
/usr/sbin/slaptest [-d debug-level] [-f slapd.conf] [-F confdir] [-ndbnum] [-o option[=value]] [-Q] [-u] [-v]

## DESCRIPTION
Slaptest is used to check the conformance of the slapd(8) configuration. It opens the slapd.conf(5) configuration file or the slapd-config(5) backend, and parses it according to the general and the backend-specific rules, checking its sanity.

## OPTIONS
-d debug-level

enable debugging messages as defined by the specified debug-level; see slapd(8) for details.

-f slapd.conf

specify an alternative slapd.conf(5) file.

-F confdir

specify a config directory. If both -f and -F are specified, the config file will be read and converted to config directory format and written to the specified directory. If neither option is specified, slaptest will attempt to read the default config directory before trying to use the default config file. If a valid config directory exists then the default config file is ignored. If dry-run mode is also specified, no conversion will occur.

-n dbnum

Just open and test the dbnum-th database listed in the configuration file. To only test the config database slapd-config(5), use -n 0 as it is always the first database.

-o option[=value]

Specify an option with a(n optional) value. Possible generic options/values are:

```
              syslog=<subsystems>  (see `-s' in slapd(8))

              syslog-level=<level> (see `-S' in slapd(8))

              syslog-user=<user>   (see `-l' in slapd(8))
```

-Q

Be extremely quiet: only the exit code indicates success (0) or not (any other value).

-u

enable dry-run mode (i.e. don't fail if databases cannot be opened, but config is fine).

-v

enable verbose mode.

## EXAMPLES
To check a slapd.conf(5) give the command:

```
	/usr/sbin/slaptest -f //etc/openldap/slapd.conf -v
```

## SEE ALSO
ldap(3), slapd(8), slapdn(8)

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

## ACKNOWLEDGEMENTS
OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.


ntpd

package: openntpd

title: ntpd(8)

summary: Network Time Protocol daemon

text:
# ntpd(8)

## NAME
ntpd - "Network Time Protocol daemon"

## SYNOPSIS
ntpd [-dSs] [-f file]

## DESCRIPTION
The ntpd daemon synchronizes the local clock to one or more remote NTP servers, and can also act as an NTP server itself, redistributing the local time. It implements the Simple Network Time Protocol version 4, as described in RFC 2030, and the Network Time Protocol version 3, as described in RFC 1305.

ntpd uses the adjtime(2) system call to correct the local system time without causing time jumps. Adjustments larger than 128ms are logged using syslog(3). The threshold value is chosen to avoid having local clock drift thrash the log files. Should ntpd be started with the -d option, all calls to adjtime(2) will be logged.

When ntpd starts up, it reads settings from a configuration file, typically ntpd.conf(5).

The options are as follows:

-d

Do not daemonize. If this option is specified, ntpd will run in the foreground and log to stderr.

-f file

Use file as the configuration file, instead of the default /etc/ntpd.conf.

-S

Do not set the time immediately at startup.

-s

Set the time immediately at startup if the local clock is off by more than 180 seconds. Allows for a large time correction, eliminating the need to run rdate(8) before starting . This is the default.

## FILES
/etc/ntpd.conf

default ntpd configuration file

## SEE ALSO
date(1), adjtime(2), ntpd.conf(5), rdate(8), timed(8)

, Network Time Protocol (Version 3), March 1992.

, Simple Network Time Protocol (SNTP) Version 4, October 1996.

## HISTORY
The ntpd program first appeared in OpenBSD 3.6 .


title: r2test(8)

summary: MFC/R2 call setup test program

text:
# r2test(8)

## NAME
r2test - MFC/R2 call setup test program

## SYNOPSIS
r2test -c <file>

r2test -l

r2test -v

## DESCRIPTION
This tool can be used to test the OpenR2 library with MFC/R2 lines

## SEE ALSO
r2test.conf(5)

## AUTHOR
This manual page was written by Alexandre Cavalcante Alencar <alexandre.alencar@gmail.com>

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 any later version published by the Free Software Foundation.


openrazer-daemon

package: openrazer-daemon

title: openrazer-daemon(8)

text:
# openrazer-daemon(8)

## NAME
openrazer-daemon - Daemon to manage Razer devices in userspace

## SYNOPSIS
openrazer-daemon [options...]

## DESCRIPTION
openrazer-daemon is a userspace service which is designed to be an intermediary between userspace programs and the Razer drivers. It will provide some higher level functions to allow similar operation to the Windows Razer Synapse program. This service is designed to be started by xdg-autostart as a session service.

The service has the functionality to sync effects between multiple devices, perform on-the-fly macro recording and playback and reimplements the FN+Keys logic so they work when macro_keys are enabled. The service can also perform various ripple effects and turn off the devices when the screensaver is active.

Note, that all paths shown as defaults, eg ~/.local/share/ or ~/.config/ can be changed with XDG Base Directory specification variables: $XDG_CONFIG_HOME, $XDG_DATA_HOME and $XDG_RUNTIME_DIR.

## OPTIONS
-v, --verbose

Enable logging of DEBUG messages.

-F, --foreground

Run the daemon in the foreground and don't fork. This also enables sending the log output to stdout (in addition to the log file).

-r, --respawn

Stop any running daemon first (if one is running) before starting.

-s, --stop

Gracefully stop the running daemon.

--as-root

Allow the daemon to be started as root.

--config=config_file

Specifies the location of the config file. If this is not provided it will default to ~/.config/openrazer/razer.conf and create it if needed from the example config.

--persistence=persistence_file

Specifies the location of the persistence file. This will be created if non-existent. This file will store device states so they persist between reboots.

--run-dir=run_directory

Tells the daemon what directory is its run directory, the directory it will change to once started. It will default to $XDG_RUNTIME_DIR, if not set it falls back to ~/.local/share/openrazer/.

--log-dir=log_directory

This argument decides where the log directory will be, the daemon itself will handle log rotation as it's a user session service. The daemon will default to ~/.local/share/openrazer/logs/ for its log directory.

--test-dir=test_dir

If provided the daemon will operate in test-driver mode in which it exposes devices that aren't physically connected. Use scripts/create_fake_device.py or scripts/setup_fake_devices.sh from the source repository to create the directory structure.

## DOCUMENTATION
The full and most up-to-date documentation can be found on our GitHub repository at https://github.com/openrazer/openrazer.

## SEE ALSO
razer.conf(5)


resolvconf

package: openresolv

title: resolvconf(8)

text:
# resolvconf(8)

## NAME
resolvconf — a framework for managing multiple DNS configurations

## SYNOPSIS
resolvconf

-I

resolvconf

[-m metric] [-p] [-x] -a interface[.protocol] <file

resolvconf

-C pattern

resolvconf

-c pattern

resolvconf

[-f] -d interface[.protocol]

resolvconf

[-x] -il pattern

resolvconf

-u

resolvconf

--version

## DESCRIPTION
resolvconf manages resolv.conf(5) files from multiple sources, such as DHCP and VPN clients. Traditionally, the host runs just one client and that updates /etc/resolv.conf. More modern systems frequently have wired and wireless interfaces and there is no guarantee both are on the same network. With the advent of VPN and other types of networking daemons, many things now contend for the contents of /etc/resolv.conf.

resolvconf solves this by letting the daemon send their resolv.conf(5) file to resolvconf via stdin(4) with the argument -a interface[.protocol] instead of the filesystem. resolvconf then updates /etc/resolv.conf as it thinks best. When a local resolver other than libc is installed, such as dnsmasq(8) or named(8), then resolvconf will supply files that the resolver should be configured to include.

resolvconf assumes it has a job to do. In some situations resolvconf needs to act as a deterrent to writing to /etc/resolv.conf. Where this file cannot be made immutable or you just need to toggle this behaviour, resolvconf can be disabled by adding resolvconf=NO to resolvconf.conf(5).

resolvconf can mark an interfaces resolv.conf as private. This means that the name servers listed in that resolv.conf are only used for queries against the domain/search listed in the same file. This only works when a local resolver other than libc is installed. See resolvconf.conf(5) for how to configure resolvconf to use a local name server and how to remove the private marking.

resolvconf can mark an interfaces resolv.conf as exclusive. Only the latest exclusive interface is used for processing, otherwise all are.

When an interface goes down, it should then call resolvconf with -d interface.* arguments to delete the resolv.conf file(s) for all the protocols on the interface. For systems that support the concept of persisting configuration when the carrier goes down, then it should instead call resolvconf with -C interface.* arguments to deprecate the matching interfaces and -c interface.* to activate the matching interfaces when the carrier comes up. This only affects the order in which interfaces are processed.

Here are some options for the above commands:-

-f

Ignore non existent interfaces. Only really useful for deleting interfaces.

-m metric

Set the metric of the interface when adding it, default of 0. Lower metrics take precedence. This affects the default order of interfaces when listed.

-p

Marks the interface resolv.conf as private.

-x

Mark the interface resolv.conf as exclusive when adding, otherwise only use the latest exclusive interface.

resolvconf has some more commands for general usage:-

-i pattern

List the interfaces and protocols, optionally matching pattern, we have resolv.conf files for.

-l pattern

List the resolv.conf files we have. If pattern is specified then we list the files for the interfaces and protocols that match it.

-u

Force resolvconf to update all its subscribers. resolvconf does not update the subscribers when adding a resolv.conf that matches what it already has for that interface.

--version

Echo the resolvconf version to stdout.

resolvconf also has some commands designed to be used by it's subscribers and system startup:-

-I

Initialise the state directory /var/run/resolvconf. This only needs to be called if the initial system boot sequence does not automatically clean it out; for example the state directory is moved somewhere other than /var/run. If used, it should only be called once as early in the system boot sequence as possible and before resolvconf is used to add interfaces.

-R

Echo the command used to restart a service.

-r service

If the service is running then restart it. If the service does not exist or is not running then zero is returned, otherwise the result of restarting the service.

-v

Echo variables DOMAINS, SEARCH and NAMESERVERS so that the subscriber can configure the resolver easily.

-V

Same as -v except that only the information configured in resolvconf.conf(5) is set.

## INTERFACE ORDERING
For resolvconf to work effectively, it has to process the resolv.confs for the interfaces in the correct order. resolvconf first processes interfaces from the interface_order list, then interfaces without a metic and that match the dynamic_order list, then interfaces with a metric in order and finally the rest in the operating systems lexical order. See resolvconf.conf(5) for details on these lists.

## PROTOCOLS
Here are some suggested protocol tags to use for each resolv.conf file registered on an interface:-

dhcp

Dynamic Host Configuration Protocol. Initial versions of resolvconf did not recommend a protocol tag be appended to the interface name. When the protocol is absent, it is assumed to be the DHCP protocol.

ppp

Point-to-Point Protocol.

ra

IPv6 Router Advertisement.

dhcp6

Dynamic Host Configuration Protocol, version 6.

## IMPLEMENTATION NOTES
If a subscriber has the executable bit then it is executed otherwise it is assumed to be a shell script and sourced into the current environment in a subshell. This is done so that subscribers can remain fast, but are also not limited to the shell language.

Portable subscribers should not use anything outside of /bin and /sbin because /usr and others may not be available when booting. Also, it would be unwise to assume any shell specific features.

## ENVIRONMENT
IF_METRIC

If the -m option is not present then we use IF_METRIC for the metric.

IF_PRIVATE

Marks the interface resolv.conf as private.

IF_EXCLUSIVE

Marks the interface resolv.conf as exclusive.

## FILES
/etc/resolv.conf.bak

Backup file of the original resolv.conf.

/etc/resolvconf.conf

Configuration file for resolvconf.

/lib/resolvconf

Directory of subscribers which are run every time resolvconf adds, deletes or updates.

/etc/hooks/resolv.conf.d

Directory of subscribers which are run after the libc subscriber is run.

/var/run/resolvconf

State directory for resolvconf.

## SEE ALSO
resolver(3), stdin(4), resolv.conf(5), resolvconf.conf(5)

## HISTORY
This implementation of resolvconf is called openresolv and is fully command line compatible with Debian's resolvconf, as written by Thomas Hood.

## AUTHORS
Roy Marples <roy@marples.name>

## BUGS
Please report them to http://roy.marples.name/projects/openresolv

resolvconf does not validate any of the files given to it.

When running a local resolver other than libc, you will need to configure it to include files that resolvconf will generate. You should consult resolvconf.conf(5) for instructions on how to configure your resolver.


oscap-docker

package: openscap-containers

title: oscap-docker(8)

text:
# oscap-docker(8)

## NAME
oscap-docker - Tool for running oscap within docker container or image

## DESCRIPTION
oscap-docker tool can asses vulnerabilities or security compliance of running Docker containers or cold Docker images. OpenSCAP tool oscap(8) is used underneath. Definition of vulnerabilities (CVE stream) is downloaded from product vendor.

### Compliance scan of Docker image
Usage: oscap-docker image IMAGE_NAME OSCAP_ARGUMENT [OSCAP_ARGUMENT...]

Run any OpenSCAP oscap(8) command within chroot of mounted docker image. Learn more about arguments in oscap(8) man page.

### Compliance scan of Docker container
Usage: oscap-docker container CONTAINER_NAME OSCAP_ARGUMENT [OSCAP_ARGUMENT...]

Run any OpenSCAP oscap(8) command within chroot of mounted docker container. Result of this command may differ from scanning just an image due to defined mount points.

### Vulnerability scan of Docker image
Usage: oscap-docker image-cve IMAGE_NAME [--results oval-results-file.xml [--report report.html]]

Attach docker image, determine OS variant/version, download CVE stream applicable to the given OS, and finally run vulnerability scan.

### Vulnerability scap of Docker container
Usage: oscap-docker container-cve CONTAINER_NAME [--results oval-results-file.xml [--report report.html]]

Chroot to running container, determine OS variant/version, download CVE stream applicable to the given OS and finally run a vulnerability scan.

In order to use different oscap(8) binary pass it like --oscap=<path/to/oscap>, as the first argument.

## SECURITY POLICIES
SCAP-Security-Guide package contains multiple configuration policies.

Red Hat CVE stream can be found online - https://www.redhat.com/security/data/metrics/

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
```

## AUTHORS

```
Šimon Lukašík <slukasik@redhat.com>
```


oscap

package: openscap-scanner

title: oscap(8)

summary: OpenSCAP command line tool

text:
# oscap(8)

## NAME
oscap - OpenSCAP command line tool

## SYNOPSIS
oscap [general-options] module operation [operation-options-and-arguments]

## DESCRIPTION
oscap is Security Content Automation Protocol (SCAP) toolkit based on OpenSCAP library. It provides various functions for different SCAP specifications (modules).

OpenSCAP tool claims to provide capabilities of Authenticated Configuration Scanner and Authenticated Vulnerability Scanner as defined by The National Institute of Standards and Technology.

## GENERAL OPTIONS
-V, --version

Print supported SCAP specifications, location of schema files, schematron files, CPE files, probes and supported OVAL objects. Displays a list of inbuilt CPE names.

-h, --help

Help screen.

## MODULES
info

Determine type and print information about a file.

xccdf

The eXtensible Configuration Checklist Description Format.

oval

Open Vulnerability and Assessment Language.

ds

SCAP Data Stream

cpe

Common Platform Enumeration.

cvss

Common Vulnerability Scoring System

cve

Common Vulnerabilities and Exposures

cvrf

Common Vulnerability Reporting Framework

## COMMON OPTIONS FOR ALL MODULES
--verbose VERBOSITY_LEVEL

Turn on verbose mode at specified verbosity level. VERBOSITY_LEVEL is one of: DEVEL, INFO, WARNING, ERROR.

--verbose-log-file FILE

Set filename to write additional information.

## INFO OPERATIONS
[options] any-scap-file.xml

This module prints information about SCAP content in a file specified on a command line. It determines SCAP content type, specification version, date of creation, date of import and so on. Info module doesn't require any additional operation switch. For XCCDF or SCAP source data stream files, the info module prints out IDs of incorporated profiles, components, and data streams. These IDs can be used to specify the target for evaluation. Use options --profile, --xccdf-id (or --oval-id), and --datastream-id respectively.

--fetch-remote-resources

Allow download of remote components referenced from data stream.

--local-files DIRECTORY

Instead of downloading remote data stream components from the network, use data stream components stored locally as files in the given directory. In place of the remote data stream component OpenSCAP will attempt to use a file whose file name is equal to @name attribute of the uri element within the catalog element within the component-ref element in the data stream if such file exists.

--profile PROFILE

Show info of the profile with the given ID.

--profiles

Show profiles from the input file in the <id>:<title> format, one line per profile.

--references

Show list of references available in each benchmark.

## XCCDF OPERATIONS
eval [options] INPUT_FILE [oval-definitions-files]

Perform evaluation of XCCDF document file given as INPUT_FILE. Print result of each rule to standard output, including rule title, rule id and security identifier(CVE, CCE). Optionally you can give an SCAP source data stream as the INPUT_FILE instead of an XCCDF file (see --datastream-id). oscap returns 0 if all rules pass. If there is an error during evaluation, the return code is 1. If there is at least one rule with either fail or unknown result, oscap finishes with return code 2.

Unless --skip-validation (--skip-valid) is used, the INPUT_FILE is validated using XSD schemas (depending on document type of INPUT_FILE) and rejected if invalid.

You may specify OVAL Definition files as the last parameter, XCCDF evaluation will then proceed only with those specified files. Otherwise, when oval-definitions-files parameter is missing, oscap tool will try to load all OVAL Definition files referenced from XCCDF automatically (search in the same path as XCCDF).

--profile PROFILE

Select a particular profile from XCCDF document. If "(all)" is given a virtual profile that selects all groups and rules will be used.

--rule RULE

Select a particular rule from XCCDF document. Only this rule will be evaluated. Any other rules required by this rule won't be evaluated. Rule will use values according to the selected profile. If no profile is selected, default values are used. This option can be used multiple times to specify multiple rules at once.

--skip-rule RULE

Skip a particular rule from XCCDF document. This option can be used multiple times to skip multiple rules at once.

--reference NAME:IDENTIFIER

Evaluate rules matching the given reference. This option can be used to check for evaluating compliance with a particular policy requirement. Rules that match the reference will be evaluated, other rules will be skipped and a result of notselected will be returned. The argument needs to be provided in the form NAME:IDENTIFIER (colon is a separator), where NAME is the reference name used as a text of xccdf:reference elements that are child of xccdf:Benchmark element and IDENTIFIER is a text of xccdf:reference element that is child of a particular xccdf:Rule element which has the same @href value as the xccdf:reference element of the NAME value. This feature requires SCAP content to be formed in the aforementioned way. For example: --reference "cis:4.1.3.19", --reference "anssi:BP28(R29)" List of references available in the given benchmark can be obtained by running the oscap info --references command.

--tailoring-file TAILORING_FILE

Use given file for XCCDF tailoring. Select profile from tailoring file to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--tailoring-id COMPONENT_REF_ID

Use tailoring component in input source data stream for XCCDF tailoring. The tailoring component must be specified by its Ref-ID (value of component-ref/@id attribute in input source data stream). Select profile from tailoring component to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--cpe CPE_FILE

Use given CPE dictionary or language (auto-detected) for applicability checks. (Some CPE names are provided by openscap, see oscap --version for inbuilt CPE names)

--results FILE

Write XCCDF results into FILE.

--results-arf FILE

Writes results to a given FILE in Asset Reporting Format. It is recommended to use this option instead of --results when dealing with data streams.

--stig-viewer FILE

Writes XCCDF results into FILE. The rule result IDs in FILE are modified according to STIG references in evaluated content. The FILE can be simply imported into DISA STIG Viewer. See https://public.cyber.mil/stigs/srg-stig-tools/ for information about DISA STIG Viewer.

--thin-results

Thin Results provides only minimal amount of information in OVAL/ARF results. The option --without-syschar is automatically enabled when you use Thin Results.

--without-syschar

Don't provide system characteristics in OVAL/ARF result files.

--report FILE

Write HTML report into FILE.

--oval-results

Generate OVAL Result file for each OVAL session used for evaluation. File with name 'original-oval-definitions-filename.result.xml' will be generated for each referenced OVAL file in current working directory. To change the directory where OVAL files are generated change the CWD using the `cd` command.

--check-engine-results

After evaluation is finished, each loaded check engine plugin is asked to export its results. The export itself is plugin specific, please refer to documentation of the plugin for more details.

--export-variables

Generate OVAL Variables documents which contain external variables' values that were provided to the OVAL checking engine during evaluation. The filename format is 'original-oval-definitions-filename-session-index.variables-variables-index.xml'.

--datastream-id ID

Uses a data stream with that particular ID from the given data stream collection. If not given the first data stream is used. Only applies if you give source data stream in place of an XCCDF file.

--xccdf-id ID

Takes component ref with given ID from checklists. This allows one to select a particular XCCDF component even in cases where there are multiple XCCDFs in a single data stream. If none is given, the first component from the checklists element is used.

--benchmark-id ID

Selects a component ref from any data stream that references a component with XCCDF Benchmark such that its @id attribute matches given string exactly. Please note that this is not the recommended way of selecting a component-ref. You are advised to use --xccdf-id AND/OR --datastream-id for more precision. --benchmark-id is only used when both --xccdf-id and --datastream-id are not present on the command line!

--skip-valid, --skip-validation

Do not validate input/output files.

--skip-signature-validation

Do not validate digital signatures in digitally signed SCAP source data streams.

--enforce-signature

Process only digitally signed SCAP source data streams. Data streams without a signature would be rejected if this switch is used.

--fetch-remote-resources

Allow download of remote OVAL content referenced from XCCDF by check-content-ref/@href.

--local-files DIRECTORY

Instead of downloading remote data stream components from the network, use data stream components stored locally as files in the given directory. In place of the remote data stream component OpenSCAP will attempt to use a file whose file name is equal to @name attribute of the uri element within the catalog element within the component-ref element in the data stream if such file exists.

--remediate

Execute XCCDF remediation in the process of XCCDF evaluation. This option automatically executes content of XCCDF fix elements for failed rules, and thus this shall be avoided unless for trusted content. Use of this option is always at your own risk.

remediate [options] INPUT_FILE [oval-definitions-files]

This module provides post-scan remediation. It assumes that the INPUT_FILE is result of `oscap xccdf eval` operation. The input file must contain TestResult element. This module executes XCCDF fix elements for failed rule-result contained in the given TestResult. Use of this option is always at your own risk and it shall be avoided unless for trusted content. --result-id ID

ID of the XCCDF TestResult element which shall be remedied. If this option is missing the last TestResult (in top-down processing) will be remedied.

--skip-valid, --skip-validation

Do not validate input/output files.

--fetch-remote-resources

Allow download of remote OVAL content referenced from XCCDF by check-content-ref/@href.

--local-files DIRECTORY

Instead of downloading remote data stream components from the network, use data stream components stored locally as files in the given directory. In place of the remote data stream component OpenSCAP will attempt to use a file whose file name is equal to @name attribute of the uri element within the catalog element within the component-ref element in the data stream if such file exists.

--cpe CPE_FILE

Use given CPE dictionary or language (auto-detected) for applicability checks.

--results FILE

Write XCCDF results into FILE.

--results-arf FILE

Writes results to a given FILE in Asset Reporting Format. It is recommended to use this option instead of --results when dealing with data streams.

--stig-viewer FILE

Writes XCCDF results into FILE. The rule result IDs in FILE are modified according to STIG references in evaluated content. The FILE can be simply imported into DISA STIG Viewer. See https://public.cyber.mil/stigs/srg-stig-tools/ for information about DISA STIG Viewer.

--report FILE

Write HTML report into FILE.

--oval-results

Generate OVAL Result file for each OVAL session used for evaluation. File with name 'original-oval-definitions-filename.result.xml' will be generated for each referenced OVAL file.

--check-engine-results

After evaluation is finished, each loaded check engine plugin is asked to export its results. The export itself is plugin specific, please refer to documentation of the plugin for more details.

--export-variables

Generate OVAL Variables documents which contain external variables' values that were provided to the OVAL checking engine during evaluation. The filename format is 'original-oval-definitions-filename-session-index.variables-variables-index.xml'.

--progress

Switch to sparse output suitable for progress reporting. Format of the output is "$rule_id:$result\n".

--progress-full

Switch to sparse but a bit more saturated output also suitable for progress reporting. Format of the output is "$rule_id|$rule_title|$result\n".

resolve -o output-file xccdf-file

Resolve an XCCDF file as described in the XCCDF specification. It will flatten inheritance hierarchy of XCCDF profiles, groups, rules, and values. Result is another XCCDF document, which will be written to output-file. --force

Force resolving XCCDF document even if it is already marked as resolved.

validate [options] xccdf-file

Validate given XCCDF file against a XML schema. Every found error is printed to the standard error. Return code is 0 if validation succeeds, 1 if validation could not be performed due to some error, 2 if the XCCDF document is not valid. --skip-schematron

Turn off Schematron-based validation. It is able to find more errors and inconsistencies but is much slower. Schematron is available only for XCCDF version 1.2.

export-oval-variables [options] xccdf-file [oval-definitions-files]

Collect all the XCCDF values that would be used by OVAL during evaluation of a certain profile and export them as OVAL external-variables document(s). The filename format is 'original-oval-definitions-filename-session-index.variables-variables-index.xml'. --profile PROFILE

Select a particular profile from XCCDF document.

--fetch-remote-resources

Allow download of remote OVAL content referenced from XCCDF by check-content-ref/@href.

--local-files DIRECTORY

Instead of downloading remote data stream components from the network, use data stream components stored locally as files in the given directory. In place of the remote data stream component OpenSCAP will attempt to use a file whose file name is equal to @name attribute of the uri element within the catalog element within the component-ref element in the data stream if such file exists.

--skip-valid, --skip-validation

Do not validate input/output files.

--datastream-id ID

Uses a data stream with that particular ID from the given data stream collection. If not given the first data stream is used. Only applies if you give an SCAP source data stream in place of an XCCDF file.

--xccdf-id ID

Takes component ref with given ID from checklists. This allows one to select a particular XCCDF component even in cases where there are 2 XCCDFs in one data stream.

--benchmark-id ID

Selects a component ref from any data stream that references a component with XCCDF Benchmark such that its @id attribute matches given string exactly. Please note that this is not the recommended way of selecting a component-ref. You are advised to use --xccdf-id AND/OR --datastream-id for more precision. --benchmark-id is only used when both --xccdf-id and --datastream-id are not present on the command line!

--cpe CPE_FILE

Use given CPE dictionary or language (auto-detected) for applicability checks. The variables documents are created only for xccdf:Rules which are applicable.

generate [options] <submodule> [submodule-specific-options]

Generate another document from an XCCDF file such as security guide or result report. --profile ID

Apply profile with given ID to the Benchmark before further processing takes place.

Available submodules:

guide [options] xccdf-file

Generate a HTML document containing a security guide from an XCCDF Benchmark. Unless the --output option is specified it will be written to the standard output. Without profile being set only groups (not rules) will be included in the output. --output FILE

Write the guide to this file instead of standard output.

--hide-profile-info

This option has no effect and is kept only for backward compatibility purposes.

--benchmark-id ID

Selects a component ref from any datastream that references a component with XCCDF Benchmark such that its @id attribute matches given string exactly.

--xccdf-id ID

Takes component ref with given ID from checklists. This allows one to select a particular XCCDF component even in cases where there are multiple XCCDFs in a single data stream. If none is given, the first component from the checklists element is used.

--tailoring-file TAILORING_FILE

Use given file for XCCDF tailoring. Select profile from tailoring file to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--tailoring-id COMPONENT_REF_ID

Use tailoring component in input source data stream for XCCDF tailoring. The tailoring component must be specified by its Ref-ID (value of component-ref/@id attribute in input source data stream). Select profile from tailoring component to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--skip-signature-validation

Do not validate digital signatures in digitally signed SCAP source data streams.

--enforce-signature

Process only digitally signed SCAP source data streams. Data streams without a signature would be rejected if this switch is used.

report [options] xccdf-file

Generate a HTML document containing results of an XCCDF Benchmark execution. Unless the --output option is specified it will be written to the standard output. --output FILE

Write the report to this file instead of standard output.

--result-id ID

ID of the XCCDF TestResult from which the report will be generated.

--oval-template template-string

To use the ability to include additional information from OVAL in xccdf result file, a template which will be used to obtain OVAL result file names has to be specified. The template can be either a filename or a string containing wildcard character (percent sign '%'). Wildcard will be replaced by the original OVAL definition file name as referenced from the XCCDF file. This way it is possible to obtain OVAL information even from XCCDF documents referencing several OVAL files. To use this option with results from an XCCDF evaluation, specify %.result.xml as a OVAL file name template.

--sce-template template-string

To use the ability to include additional information from SCE in XCCDF result file, a template which will be used to obtain SCE result file names has to be specified. The template can be either a filename or a string containing wildcard character (percent sign '%'). Wildcard will be replaced by the original SCE script file name as referenced from the XCCDF file. This way it is possible to obtain SCE information even from XCCDF documents referencing several SCE files. To use this option with results from an XCCDF evaluation, specify %.result.xml as a SCE file name template.

fix [options] xccdf-file

Generate a script that shall bring the system to a state of compliance with given XCCDF Benchmark. There are 2 possibilities when generating fixes: Result-oriented fixes (--result-id) or Profile-oriented fixes (--profile). Result-oriented takes precedences over Profile-oriented, if result-id is given, oscap will ignore any profile provided. Result-oriented fixes are generated using result-id provided to select only the failing rules from results in xccdf-file, it skips all other rules.

It isn't possible to generate result-oriented fixes for the bootc fix type.

Profile-oriented fixes are generated using all rules within the provided profile. If no result-id/profile are provided, (default) profile will be used to generate fixes.

--fix-type TYPE

Specify fix type. There are multiple programming languages in which the fix script can be generated. TYPE should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes, blueprint, bootc. Default is bash. This option is mutually exclusive with --template, because fix type already determines the template URN.

--output FILE

Write the report to this file instead of standard output.

--result-id ID

Fixes will be generated for failed rule-results of the specified TestResult.

--template ID|FILE

Template to be used to generate the script. If it contains a dot '.' it is interpreted as a location of a file with the template definition. Otherwise it identifies a template from standard set which currently includes: bash (default if no --template switch present). Brief explanation of the process of writing your own templates is in the XSL file xsl/legacy-fix.xsl in the openscap data directory. You can also take a look at the default template xsl/legacy-fixtpl-bash.xml.

--xccdf-id ID

Takes component ref with given ID from checklists. This allows one to select a particular XCCDF component even in cases where there are multiple XCCDFs in a single data stream. If none is given, the first component from the checklists element is used.

--benchmark-id ID

Selects a component ref from any data stream that references a component with XCCDF Benchmark such that its @id attribute matches given string exactly.

--tailoring-file TAILORING_FILE

Use given file for XCCDF tailoring. Select profile from tailoring file to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--tailoring-id COMPONENT_REF_ID

Use tailoring component in input source data stream for XCCDF tailoring. The tailoring component must be specified by its Ref-ID (value of component-ref/@id attribute in input source data stream). Select profile from tailoring component to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--skip-signature-validation

Do not validate digital signatures in digitally signed SCAP source data streams.

--enforce-signature

Process only digitally signed SCAP source data streams. Data streams without a signature would be rejected if this switch is used.

custom --stylesheet xslt-file [options] xccdf-file

Generate a custom output (depending on given XSLT file) from an XCCDF file. --stylesheet FILE

Specify an absolute path to a custom stylesheet to format the output.

--output FILE

Write the document into file.

## OVAL OPERATIONS
eval [options] INPUT_FILE

Probe the system and evaluate all definitions from OVAL Definition file. Print result of each definition to standard output. The return code is 0 after a successful evaluation. On error, value 1 is returned. INPUT_FILE can be either OVAL Definition File or SCAP source data stream, it depends on used options.

Unless --skip-validation (--skip-valid) is used, the INPUT_FILE is validated using XSD schemas (depending on document type of INPUT_FILE) and rejected if invalid.

--id DEFINITION-ID

Evaluate ONLY specified OVAL Definition from OVAL Definition File.

--variables FILE

Provide external variables expected by OVAL Definition File.

--directives FILE

Use OVAL Directives content to specify desired results content.

--without-syschar

Don't provide system characteristics in result file.

--results FILE

Write OVAL Results into file.

--report FILE

Create human readable (HTML) report from OVAL Results.

--datastream-id ID

Uses a data stream with that particular ID from the given data stream collection. If not given the first data stream is used. Only applies if you give source data stream in place of an OVAL file.

--oval-id ID

Takes component ref with given ID from checks. This allows one to select a particular OVAL component even in cases where there are multiple OVALs in a single data stream.

--skip-valid, --skip-validation

Do not validate input/output files.

--fetch-remote-resources

Allow download of remote components referenced from data stream.

--local-files DIRECTORY

Instead of downloading remote data stream components from the network, use data stream components stored locally as files in the given directory. In place of the remote data stream component OpenSCAP will attempt to use a file whose file name is equal to @name attribute of the uri element within the catalog element within the component-ref element in the data stream if such file exists.

collect [options] definitions-file

Probe the system and gather system characteristics for all objects in OVAL Definition file. --id OBJECT-ID

Collect system characteristics ONLY for specified OVAL Object.

--variables FILE

Provide external variables expected by OVAL Definitions.

--syschar FILE

Write OVAL System Characteristic into file.

--skip-valid, --skip-validation

Do not validate input/output files.

analyse [options] --results FILE definitions-file syschar-file

In this mode, the oscap tool does not perform data collection on the local system, but relies upon the input file, which may have been generated on another system. The output (OVAL Results) is printed to file specified by --results parameter. --variables FILE

Provide external variables expected by OVAL Definitions.

--directives FILE

Use OVAL Directives content to specify desired results content.

--skip-valid, --skip-validation

Do not validate input/output files.

validate [options] oval-file

Validate given OVAL file against a XML schema. Every found error is printed to the standard error. Return code is 0 if validation succeeds, 1 if validation could not be performed due to some error, 2 if the OVAL document is not valid. --definitions, --variables, --syschar, --results --directives

Type of the OVAL document is automatically detected by default. If you want enforce certain document type, you can use one of these options.

--skip-schematron

Turn off Schematron-based validation. It is able to find more errors and inconsistencies but is much slower.

generate <submodule> [submodule-specific-options]

Generate another document from an OVAL file. Available submodules:

report [options] oval-results-file

Generate a formatted HTML page containing visualisation of an OVAL results file. Unless the --output option is specified it will be written to the standard output. --output FILE

Write the report to this file instead of standard output.

## CPE OPERATIONS
check name

Check whether name is in correct CPE format.

match name dictionary.xml

Find an exact match of CPE name in the dictionary.

validate cpe-dict-file

Validate given CPE dictionary file against a XML schema. Every found error is printed to the standard error. Return code is 0 if validation succeeds, 1 if validation could not be performed due to some error, 2 if the XCCDF document is not valid.

## CVSS OPERATIONS
score cvss_vector

Calculate score from a CVSS vector. Prints base score for base CVSS vector, base and temporal score for temporal CVSS vector, base and temporal and environmental score for environmental CVSS vector.

describe cvss_vector

Describe individual components of a CVSS vector in a human-readable format and print partial scores.

CVSS vector consists of several slash-separated components specified as key-value pairs. Each key can be specified at most once. Valid CVSS vector has to contain at least base CVSS metrics, i.e. AV, AC, AU, C, I, and A. Following table summarizes the components and possible values (second column is metric category: B for base, T for temporal, E for environmental):

AV:[L|A|N] B Access vector: Local, Adjacent network, Network

AC:[H|M|L] B Access complexity: High, Medium, Low

AU:[M|S|N] B Required authentication: Multiple instances, Single instance, None

C:[N|P|C] B Confidentiality impact: None, Partial, Complete

I:[N|P|C] B Integrity impact: None, Partial, Complete

A:[N|P|C] B Availability impact: None, Partial, Complete

E:[ND|U|POC|F|H] T Exploitability: Not Defined, Unproven, Proof of Concept, Functional, High

RL:[ND|OF|TF|W|U] T Remediation Level: Not Defined, Official Fix, Temporary Fix, Workaround, Unavailable

RC:[ND|UC|UR|C] T Report Confidence: Not Defined, Unconfirmed, Uncorroborated, Confirmed

CDP:[ND|N|L|LM|MH|H] E Collateral Damage Potential: Not Defined, None, Low, Low-Medium, Medium-High, High

TD:[ND|N|L|M|H] E Target Distribution: Not Defined, None, Low, Medium, High

CR:[ND|L|M|H] E Confidentiality requirement: Not Defined, Low, Medium, High

IR:[ND|L|M|H] E Integrity requirement: Not Defined, Low, Medium, High

AR:[ND|L|M|H] E Availability requirement: Not Defined, Low, Medium, High

## DS OPERATIONS
sds-compose [options] SOURCE_XCCDF TARGET_SDS

Creates an SCAP source data stream from the XCCDF file given in SOURCE_XCCDF and stores the result in TARGET_SDS. Dependencies like OVAL files are automatically detected and bundled in the created source data stream. --skip-valid, --skip-validation

Do not validate input/output files.

sds-add [options] NEW_COMPONENT EXISTING_SDS

Adds given NEW_COMPONENT file to the existing source data stream (EXISTING_SDS). Component file might be OVAL, XCCDF or CPE Dictionary file. Dependencies like OVAL files are automatically detected and bundled in target source data stream. --datastream-id DATASTREAM_ID

Uses a data stream with that particular ID from the given data stream collection. If not given the first data stream is used.

--skip-valid, --skip-validation

Do not validate input/output files.

sds-split [options] SOURCE_DS TARGET_DIR

Splits given source data stream into multiple files and stores all the files in TARGET_DIR. --datastream-id DATASTREAM_ID

Uses a data stream with that particular ID from the given data stream collection. If not given the first data stream is used.

--xccdf-id XCCDF_ID

Takes component ref with given ID from checklists. This allows one to select a particular XCCDF component even in cases where there are multiple XCCDFs in a single data stream.

--skip-valid, --skip-validation

Do not validate input/output files.

--fetch-remote-resources

Allow download of remote components referenced from data stream.

--local-files DIRECTORY

Instead of downloading remote data stream components from the network, use data stream components stored locally as files in the given directory. In place of the remote data stream component OpenSCAP will attempt to use a file whose file name is equal to @name attribute of the uri element within the catalog element within the component-ref element in the data stream if such file exists.

sds-validate SOURCE_DS

Validate given source data stream file against a XML schema. Every found error is printed to the standard error. Return code is 0 if validation succeeds, 1 if validation could not be performed due to some error, 2 if the source data stream is not valid.

rds-create [options] SDS TARGET_ARF XCCDF_RESULTS [OVAL_RESULTS [OVAL_RESULTS ..]]

Takes given source data stream, XCCDF and OVAL results and creates a result data stream (in Asset Reporting Format) and saves it to file given in TARGET_ARF. --skip-valid, --skip-validation

Do not validate input/output files.

rds-split [options] [--report-id REPORT_ID] RDS TARGET_DIR

Takes given result data stream (also called ARF = asset reporting format) and splits given report and its respective report-request to given target directory. If no report-id is given, we assume user wants the first applicable report in top-down order in the file. --skip-valid, --skip-validation

Do not validate input/output files.

rds-validate SOURCE_RDS

Validate given result data stream file against a XML schema. Every found error is printed to the standard error. Return code is 0 if validation succeeds, 1 if validation could not be performed due to some error, 2 if the result data stream is not valid.

## CVE OPERATIONS
validate cve-nvd-feed.xml

Validate given CVE data feed.

find CVE cve-nvd-feed.xml

Find given CVE in data feed and report base score, vector string and vulnerable software list.

## EXIT STATUS
Normally, the exit status is 0 when operation finished successfully and 1 otherwise. In cases when oscap performs evaluation of the system it may return 2 indicating success of the operation but incompliance of the assessed system.

## EXAMPLES
Evaluate XCCDF content using CPE dictionary and produce HTML report. In this case we use United States Government Configuration Baseline (USGCB) for Red Hat Enterprise Linux 5 Desktop.

```
 oscap xccdf eval --fetch-remote-resources --oval-results \
         --profile united_states_government_configuration_baseline \
         --report usgcb-rhel5desktop.report.html \
         --results usgcb-rhel5desktop-xccdf.xml.result.xml \
         --cpe usgcb-rhel5desktop-cpe-dictionary.xml \
         usgcb-rhel5desktop-xccdf.xml
```

```

```

## CONTENT
SCAP Security Guide - https://github.com/OpenSCAP/scap-security-guide/

National Vulnerability Database - http://web.nvd.nist.gov/view/ncp/repository

Red Hat CVE content repository - https://www.redhat.com/security/data/metrics/ds/v2/

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
Make sure you include the full output of `oscap --v` in the bug report.
```

## AUTHORS

```
Peter Vrabec <pvrabec@redhat.com>
Šimon Lukašík
Martin Preisler <mpreisle@redhat.com>
```


autotailor

package: openscap-utils

title: autotailor(8)

text:
# autotailor(8)

## NAME
autotailor - CLI tool for tailoring of SCAP data streams.

## DESCRIPTION
The autotailor tool produces tailoring files that SCAP-compliant scanners can use to complement SCAP data streams. A tailoring file adds a new profile, which is supposed to extend a profile that is already present in the data stream.

Tailoring can add, remove or refine rules, and it also can redefine contents of XCCDF variables.

The tool requires data stream location and ID of the base profile as inputs. Note however, that the referenced data stream is not opened, and the validity of tailoring is not checked against it. The tool doesn't prevent you from extending non-existent profiles, selecting non-existent rules, and so on.

## SYNOPSIS
autotailor [OPTION...] DATASTREAM_FILE [BASE_PROFILE_ID]

## OPTIONS
--title TITLE

Title of the new profile.

--id-namespace ID_NAMESPACE

The reverse-DNS style string that is part of entities IDs in the corresponding data stream. If left out, the default value 'org.ssgproject.content' is used.

-v VAR=VALUE, --var-value VAR=VALUE

Specify modification of the XCCDF value in form <varname>=<value>. Name of the variable can be either its full name, or the suffix, in which case the 'xccdf_<id-namespace>_value' prefix will be prepended internally. Specify the argument multiple times if needed.

-v VAR=SELECTOR, --var-value VAR=SELECTOR

Specify refinement of the XCCDF value in form <varname>=<selector>. Name of the variable can be either its full name, or the suffix, in which case the 'xccdf_<id-namespace>_value' prefix will be prepended internally. Specify the argument multiple times if needed.

-r RULE=ROLE, --rule-role RULE=ROLE

Specify refinement of the XCCDF rule role in form <rule_id>=<role>. Name of the rule can be either its full name, or the suffix, in which case the 'xccdf_<id-namespace>_rule_' prefix will be prepended internally. The value of <role> can be one of full, unscored, unchecked. Specify the argument multiple times if needed.

-e RULE=SEVERITY, --rule-severity RULE=SEVERITY

Specify refinement of the XCCDF rule severity in form <rule_id>=<severity>. Name of the rule can be either its full name, or the suffix, in which case the 'xccdf_<id-namespace>_rule_' prefix will be prepended internally. The value of <severity> can be one of unknown, info, low, medium, high. Specify the argument multiple times if needed.

-s RULE_ID, --select RULE_ID

Specify the rule to select. The rule ID can be either full, or just the suffix, in which case the 'xccdf_<id-namespace>_rule' prefix will be prepended internally. Specify the argument multiple times if needed.

-u RULE_ID, --unselect RULE_ID

Specify the rule to unselect. The argument works the same way as the --select argument.

-p NEW_PROFILE_ID, --new-profile-id NEW_PROFILE_ID

Specify the ID of the tailored profile. The ID of the new profile can be either its full ID, or the suffix, in which case the 'xccdf_<id-namespace>_profile_' prefix will be prepended internally. If left out, the new ID will be obtained by appending '_customized' to the tailored profile ID.

--json-tailoring JSON_TAILORING_FILE

Import tailoring from a JSON file (https://github.com/ComplianceAsCode/schemas/tree/main/tailoring). This option makes BASE_PROFILE_ID positional argument optional. However, data passed in the command line options takes precedence over JSON contents, including the BASE_PROFILE_ID argument.

## USAGE

### Modify a variable value
$ autotailor --var-value xccdf_org.ssgproject.content_value_var_screensaver_lock_delay=120 -o tailoring.xml ssg-rhel8-ds.xml xccdf_org.ssgproject.content_profile_pci_dss

The utility allows you to specify the ID namespace using the --namespace-id option, so you don't have to repeat the xccdf_org.ssgproject.content_... prefix everywhere. The default namespace ID is actually org.ssgproject.content, so the following invocations are equivalent to the first one:

$ autotailor --var-value var_screensaver_lock_delay=120 --namespace-id org.ssgproject.content -o tailoring.xml ssg-rhel8-ds.xml pci_dss

$ autotailor --var-value var_screensaver_lock_delay=120 -o tailoring.xml ssg-rhel8-ds.xml pci_dss

The tailoring tailoring_file defines a new profile, xccdf_org.ssgproject.content_profile_pci_dss_customized, which alters the screensaver lock delay.

### Perform more modifications
$ autotailor --var-value var_screensaver_lock_delay=120 --select gconf_gnome_screensaver_idle_delay --var-value inactivity_timeout_value=600 ssg-rhel8-ds.xml pci_dss

### Import JSON tailoring
$ autotailor ssg-rhel8-ds.xml --json-tailoring tailoring.json

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
```

## AUTHORS

```
Matěj Týč <matyc@redhat.com>
Jan Černý <jcerny@redhat.com>
Evgenii Kolesnikov <ekolesni@redhat.com>
```


oscap-chroot

title: oscap-chroot(8)

text:
# oscap-chroot(8)

## NAME
oscap-chroot - Tool for offline SCAP evaluation of filesystems mounted at arbitrary paths.

## DESCRIPTION
oscap-chroot runs oscap tool on it in a filesystem mounted at given path.

Usage of the tool mimics usage and options of oscap(8) tool.

## USAGE

### Evaluation of XCCDF content
$ oscap-chroot CHROOT_PATH xccdf eval [options] INPUT_CONTENT

supported oscap xccdf eval options are:

--profile

--tailoring-file

--tailoring-id

--cpe (external OVAL dependencies are not supported yet!)

--oval-results

--check-engine-results

--results

--results-arf

--report

--skip-valid

--skip-validation

--fetch-remote-resources

--local-files

--progress

--datastream-id

--xccdf-id

--benchmark-id

### Evaluation of OVAL content
$ oscap-chroot image CHROOT_PATH oval eval [options] INPUT_CONTENT

supported oscap oval eval options are:

--id

--variables

--directives

--results

--report

--skip-valid

--skip-validation

--datastream-id

--oval-id

### Collection of OVAL System Characteristic
$ oscap-chroot CHROOT_PATH oval collect [options] INPUT_CONTENT

supported oscap oval collect options are:

--id

--syschar

--variables

--skip-valid

--skip-validation

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
```

## AUTHORS

```
Martin Preisler <mpreisle@redhat.com>
```


oscap-im

title: oscap-im(8)

text:
# oscap-im(8)

## NAME
oscap-im - Tool for building hardened bootable container images

## DESCRIPTION
The oscap-im tool is a convenience script that makes building hardened bootable container images easier. This tool is designed to be used during the build of the bootable container image. Include oscap-im in your Containerfile that will be used to build your bootable container image. The oscap-im runs oscap tool on a given container image.

The oscap-im tool can't be used anywhere else than in a Containerfile.

## USAGE
oscap-im [OPTION...] DATASTREAM_FILE

Usage of the tool mimics usage and options of oscap(8) tool.

## OPTIONS
--profile PROFILE_ID

ID of the profile to be evaluated.

--tailoring-file TAILORING_FILE

Use given file for XCCDF tailoring. Select profile from tailoring file to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--tailoring-id COMPONENT_REF_ID

Use tailoring component in input source data stream for XCCDF tailoring. The tailoring component must be specified by its Ref-ID (value of component-ref/@id attribute in input source data stream). Select profile from tailoring component to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--results-arf FILE

Writes results to a given FILE in Asset Reporting Format.

--report FILE

Write HTML report into FILE.

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
```

## AUTHORS

```
Jan Černý <jcerny@redhat.com>
```


oscap-podman

title: oscap-podman(8)

text:
# oscap-podman(8)

## NAME
oscap-podman - Tool for offline SCAP evaluation of Podman container images and Podman containers

## DESCRIPTION
oscap-podman runs oscap tool on a given container image or container.

This script cannot run in rootless mode.

## USAGE
Usage of the tool mimics usage and options of oscap(8) tool.

### Compliance scan of Podman container image:
oscap-podman [--oscap=<OSCAP_BINARY>] IMAGE_NAME OSCAP_ARGUMENT [OSCAP_ARGUMENT...]

### Compliance scan of Podman container:
oscap-podman [--oscap=<OSCAP_BINARY>] CONTAINER_NAME OSCAP_ARGUMENT [OSCAP_ARGUMENT...]

Refer to oscap(8) to learn about OSCAP_ARGUMENT options.

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
```

## AUTHORS

```
Jan Černý <jcerny@redhat.com>
```


oscap-ssh

title: oscap-ssh(8)

text:
# oscap-ssh(8)

## NAME
oscap-ssh - Tool for running oscap over SSH and collecting results.

## DESCRIPTION
oscap-ssh runs oscap tool on a remote system through SSH connection. The input files are transferred to the target system and after the scan finishes result files are transferred back. No temporary data remains on the remote machine.

The tool requires bash, ssh, scp and mktemp to perform OVAL and XCCDF evaluation of remote machines. The remote machine also has to have oscap installed and in $PATH. This can be accomplished by installing openscap-scanner.

Usage of the tool mimics usage and options of oscap(8) tool.

## USAGE

### Evaluation of XCCDF content
$ oscap-ssh user@host 22 xccdf eval [options] INPUT_CONTENT

Only source data streams are supported as INPUT_CONTENT!

Supported options are:

--profile

--tailoring-file

--tailoring-id

--cpe

--results

--results-arf

--report

--skip-valid

--skip-validation

--fetch-remote-resources

--local-files

--progress

--datastream-id

--xccdf-id

--benchmark-id

--remediate

### Evaluation of OVAL content
$ oscap-ssh user@host 22 oval eval [options] INPUT_CONTENT

Supported options are:

--id

--variables

--directives

--results

--report

--skip-valid

--skip-validation

--datastream-id

--oval-id

### Collection of OVAL System Characteristic
$ oscap-ssh user@host 22 oval collect [options] INPUT_CONTENT

Supported options are:

--id

--syschar

--variables

--skip-valid

--skip-validation

Specific option for oscap-ssh (must be first argument):

--sudo

### Environment variables
oscap-ssh checks out the SSH_ADDITIONAL_OPTIONS environment variable, and pastes its contents into the command-line of ssh to the location where options are expected. Supply the variable in form of a string that corresponds to a section of the ssh command-line and that consists of options you want to pass.

### Using --local-files option
The oscap-ssh command supports the --local-files option, but it isn't possible to pass './' and '../' as an argument. Use a full directory path instead.

## EXAMPLE USAGE

### Simple XCCDF evaluation
The following command evaluates a remote Fedora machine as root. HTML report is written out as report.html on the local machine. Can be executed from any machine that has ssh, scp and bash. The local machine does not need to have openscap installed. It also uses the SSH_ADDITIONAL_OPTIONS variable to configure ssh in such way that contents of the known_hosts file are ignored.

$ export SSH_ADDITIONAL_OPTIONS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" $ oscap-ssh root@192.168.1.13 22 xccdf eval --profile xccdf_org.ssgproject.content_profile_common --report report.html /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

### XCCDF Evaluation with tailoring file
The following command uses a tailoring file and also copies back ARF and XCCDF results. The tailoring file is automatically copied from local machine to remote.

$ oscap-ssh --sudo oscap-user@192.168.1.13 22 xccdf eval --profile xccdf_org.ssgproject.content_profile_common --report report.html --results results.xml --results-arf arf.xml --tailoring-file ssg-fedora-ds-tailoring.xml /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

### Running remotely as root
Note that the openscap scanner is best run by the 'root' user as in the first example above. To do this, the "PermitRootLogin" directive must be enabled in /etc/ssh/sshd_config, which is itself a security violation. A safer approach is to enable a non-privileged user ('oscap-user' in the second example above) to run only the oscap binary as root (with the '--sudo' flag) by updating the remote machine's 'sudoers' file or adding a file like /etc/sudoers.d/99-oscap-user:

\# allow oscap-user to run openscap scanner

Defaults!/usr/bin/oscap !requiretty

oscap-user ALL=(root) NOPASSWD: /usr/bin/oscap

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
```

## AUTHORS

```
Martin Preisler <mpreisle@redhat.com>
Šimon Lukašík <slukasik@redhat.com>
```


oscap-vm

title: oscap-vm(8)

text:
# oscap-vm(8)

## NAME
oscap-vm - Tool for offline SCAP evaluation of virtual machines.

## SYNOPSIS
oscap-vm [--oscap=<oscap_binary>] domain VM_DOMAIN [OSCAP_OPTIONS] INPUT_CONTENT

oscap-vm [--oscap=<oscap_binary>] image VM_STORAGE_IMAGE [OSCAP_OPTIONS] INPUT_CONTENT

## DESCRIPTION
oscap-vm performs SCAP evaluation of virtual machine domains or virtual machine images.

The tool mounts the filesystem of given virtual machine and runs oscap(8) to asses the mounted filesystem. The virtual machine is mounted read only, which prevents damaging of the virtual machine during the scan. The evaluation is performed offline which means that it is performed from the host and no additional software is installed in the virtual machine.

oscap-vm is a convenience wrapper on the top of the oscap(8) utility. Most of the SCAP capabilities provided by oscap(8) are available in oscap-vm as well.

## NOTICE
To mount the virtual machine filesystem, oscap-vm uses libguestfs to access the filestystem and FUSE (the "filesystem in userspace") to make it a mountable device.

The tool requires bash, guestmount, mktemp and umount to work properly. If guestmount(1) command is not present on your system, the tool will try to use older fusermount(1) utility instead.

## USAGE
Usage of the tool mimics usage and options of oscap(8) tool.

The type of scan target (either domain or image) has to be specified first. Then identify the target by the domain name (name of a named libvirt domain) or the image path, respectively. Domain UUIDs can be used instead of names. Any domains including the running domains can be scanned.

Optionally, as the very first argument, different oscap(8) binary could be chosen to perform the scan, like --oscap=<path/to/oscap>.

The rest of the options are passed directly to oscap(8) utility. For the detailed description of its options please refer to oscap(8) manual page. However some of its options are not supported in oscap-vm because offline evaluation is used.

Last argument is SCAP content input file.

Supported common options are:

--verbose <verbosity_level>

--verbose-log-file <file>

### Evaluation of XCCDF content
xccdf eval module evaluates XCCDF files or SCAP source data streams. Result of each rule is printed to standard output, including rule title, rule id and security identifier (CVE, CCE).

```
oscap-vm image VM_STORAGE_IMAGE xccdf eval [options] INPUT_CONTENT
oscap-vm domain VM_DOMAIN xccdf eval [options] INPUT_CONTENT
```

```

```

Supported oscap xccdf eval options are:

--profile <name>

--rule <name>

--tailoring-file <file>

--tailoring-id <component-id>

--cpe <name> (external OVAL dependencies are not supported yet!)

--oval-results

--check-engine-results

--results <file>

--results-arf <file>

--thin-results

--without-syschar

--report <file>

--skip-valid

--skip-validation

--fetch-remote-resources

--local-files

--progress

--datastream-id <id>

--xccdf-id <id>

--benchmark-id <id>

Remediation of virtual machines is not supported.

### Evaluation of OVAL content
oval eval module scans the system and evaluate definitions from given OVAL Definitions file.

```
oscap-vm image VM_STORAGE_IMAGE oval eval [options] INPUT_CONTENT
oscap-vm domain VM_DOMAIN oval eval [options] INPUT_CONTENT
```

```

```

Supported oscap oval eval options are:

--id <definition-id>

--variables <file>

--directives <file>

--without-syschar

--results <file>

--report <file>

--skip-valid

--skip-validation

--datastream-id <id>

--oval-id <id>

### Collection of OVAL System Characteristic
oval collect module scans the system and collects items according to given OVAL Definitions file.

```
oscap-vm image VM_STORAGE_IMAGE oval collect [options] INPUT_CONTENT
oscap-vm domain VM_DOMAIN oval collect [options] INPUT_CONTENT
```

```

```

Supported oscap oval collect options are:

--id <object>

--syschar <file>

--variables <file>

--skip-valid

--skip-validation

## EXAMPLES
Evaluate a Red Hat Enterprise Linux 7 virtual domain for compliance with the DISA STIG for Red Hat Enterprise Linux and generate a report.

```
oscap-vm domain rhel7 xccdf eval \
--report report.html --results results.xml \
--profile stig-rhel7-disa \
/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
```

```

```

Evaluate a Red Hat Enterprise Linux 6 virtual machine image for software vulnerabilities using OVAL definitions and generate a report.

```
oscap-vm image /var/lib/libvirt/images/rhel6.qcow2 oval eval \
--report report.html --results results.xml \
com.redhat.rhsa-RHEL6.xml
```

```

```

## EXIT STATUS
Normally, the exit status is 0 when operation finished successfully and 1 otherwise. In cases when oscap-vm performs evaluation of the system it may return 2 indicating success of the operation but incompliance of the assessed system.

## REPORTING BUGS
Please report bugs using https://github.com/OpenSCAP/openscap/issues

## SEE ALSO
oscap(8), scap-security-guide(8)

For detailed information please visit OpenSCAP website: https://www.open-scap.org

## AUTHORS

```
Martin Preisler <mpreisle@redhat.com>
Jan Černý <jcerny@redhat.com>
```