adcli

package: adcli

title: adcli(8)

text:
# adcli(8)

## NAME
adcli - Tool for performing actions on an Active Directory domain

## SYNOPSIS
adcli info domain.example.com

adcli join domain.example.com

adcli update

adcli testjoin

adcli create-user [--domain=domain.example.com] user

adcli delete-user [--domain=domain.example.com] user

adcli passwd-user [--domain=domain.example.com] user

adcli create-group [--domain=domain.example.com] user

adcli delete-group [--domain=domain.example.com] user

adcli add-member [--domain=domain.example.com] group user or computer...

adcli remove-member [--domain=domain.example.com] group user...

adcli preset-computer [--domain=domain.example.com] computer...

adcli reset-computer [--domain=domain.example.com] computer

adcli delete-computer [--domain=domain.example.com] computer

adcli show-computer [--domain=domain.example.com] computer

adcli create-msa [--domain=domain.example.com]

## GENERAL OVERVIEW
adcli is a command line tool that can perform actions in an Active Directory domain. Among other things it can be used to join a computer to a domain.

See the various sub commands below. The following global options can be used:

-D, --domain=domain

The domain to connect to. If a domain is not specified, then the domain part of the local computer's host name is used.

-R, --domain-realm=REALM

Kerberos realm for the domain. If not specified, then the upper cased domain name is used.

-S, --domain-controller=server

Connect to a specific domain controller. If not specified, then an appropriate domain controller is automatically discovered.

--use-ldaps

Connect to the domain controller with LDAPS. By default the LDAP port is used and SASL GSS-SPNEGO or GSSAPI is used for authentication and to establish encryption. This should satisfy all requirements set on the server side and LDAPS should only be used if the LDAP port is not accessible due to firewalls or other reasons. Please note that the place where CA certificates can be found to validate the AD DC certificates must be configured in the OpenLDAP configuration file, e.g. /etc/openldap/ldap.conf. As an alternative it can be specified with the help of an environment variable, e.g.

```
$ LDAPTLS_CACERT=/path/to/ad_dc_ca_cert.pem adcli join --use-ldaps -D domain.example.com
...
```

Please see ldap.conf(5) for details.

-C

Use the default Kerberos credential cache to authenticate with the domain.

--login-ccache[=ccache_name]

Use the specified Kerberos credential cache to authenticate with the domain. If no credential cache is specified, the default Kerberos credential cache will be used. Credential caches of type FILE can be given with the path to the file. For other credential cache types, e.g. DIR, KEYRING or KCM, the type must be specified explicitly together with a suitable identifier. Please note that since the ccache_name is optional the =(equal) sign is mandatory. If = is missing the parameter is treated as optionless extra argument. How this is handled depends on the specific sub-command.

-U, --login-user=User

Use the specified user account to authenticate with the domain. If not specified, then the name 'Administrator' will be used.

--no-password

Don't show prompts for or read a password from input.

-W, --prompt-password

Prompt for a password if necessary. This is the default.

--stdin-password

Read a password from stdin input instead of prompting for a password.

-v, --verbose

Run in verbose mode with debug output.

## QUERYING DOMAIN INFORMATION
adcli info displays discovered information about an Active Directory domain or an Active Directory domain controller.

```
$ adcli info domain.example.com
...
```

```
$ adcli info --domain-controller=dc.domain.example.com
...
```

adcli info will output as much information as it can about the domain. The information is designed to be both machine and human readable. The command will exit with a non-zero exit code if the domain does not exist or cannot be reached.

To show domain info for a specific domain controller use the --domain-controller option to specify which domain controller to query.

Use the --verbose option to show details of how the domain is discovered and queried. Many of the global options, in particular authentication options, are not usable with the adcli info command.

## JOINING THE LOCAL MACHINE TO A DOMAIN
adcli join creates a computer account in the domain for the local machine, and sets up a keytab for the machine. It does not configure an authentication service (such as sssd).

```
$ adcli join domain.example.com
Password for Administrator:
```

In addition to the global options, you can specify the following options to control how this operation is done.

-N, --computer-name=computer

The short non-dotted name of the computer account that will be created in the domain. If not specified, then the first portion of the --host-fqdn is used.

-O, --domain-ou=OU=xxx

The full distinguished name of the OU in which to create the computer account. If not specified, then the computer account will be created in a default location.

-H, --host-fqdn=host

Override the local machine's fully qualified domain name. If not specified, the local machine's hostname will be retrieved via gethostname(). If gethostname() only returns a short name getaddrinfo() with the AI_CANONNAME hint is called to expand the name to a fully qualified domain name.

-K, --host-keytab=/path/to/keytab

Specify the path to the host keytab where host credentials will be written after a successful join operation. If not specified, the default location will be used, usually /etc/krb5.keytab.

--login-type={computer|user}

Specify the type of authentication that will be performed before creating the machine account in the domain. If set to 'computer', then the computer must already have a preset account in the domain. If not specified and none of the other --login-xxx arguments have been specified, then will try both 'computer' and 'user' authentication.

--os-name=name

Set the operating system name on the computer account. The default depends on where adcli was built, but is usually something like 'linux-gnu'.

--os-service-pack=pack

Set the operating system service pack on the computer account. Not set by default.

--os-version=version

Set the operating system version on the computer account. Not set by default.

--description=description

Set the description attribute on the computer account. Not set by default.

--service-name=service

Additional service name for a Kerberos principal to be created on the computer account. This option may be specified multiple times.

--user-principal=host/name@REALM

Set the userPrincipalName field of the computer account to this Kerberos principal. If you omit the value for this option, then a principal will be set in the form of host/host.example.com@REALM

--one-time-password

Specify a one time password for a preset computer account. This is equivalent to using --login-type=computer and providing a password as input.

--trusted-for-delegation=yes|no|true|false

Set or unset the TRUSTED_FOR_DELEGATION flag in the userAccountControl attribute to allow or not allow that Kerberos tickets can be forwarded to the host.

--dont-expire-password=yes|no|true|false

Set or unset the DONT_EXPIRE_PASSWORD flag in the userAccountControl attribute to indicate if the machine account password should expire or not. By default adcli will set this flag while joining the domain which corresponds to the default behavior of Windows clients. Please note that if the password will expire (--dont-expire-password=false) a renewal mechanism has to be enabled on the client to not loose the connectivity to AD if the password expires.

--add-service-principal=service/hostname

Add a service principal name. In contrast to the --service-name the hostname part can be specified as well in case the service should be accessible with a different host name as well.

--setattr=name=value

Add the LDAP attribute name with the given value to the new LDAP host object. This option can be used multiple times to add multiple different attributes. Multi-value attributes are currently not supported. Please note that the account used to join the domain must have the required privileges to add the given attributes. Some attributes might have constraints with respect to syntax and allowed values which must be met as well. Attributes managed by other adcli options cannot be set with this option.

--show-details

After a successful join print out information about join operation. This is output in a format that should be both human and machine readable.

--show-password

After a successful join print out the computer machine account password. This is output in a format that should be both human and machine readable.

--add-samba-data

After a successful join add the domain SID and the machine account password to the Samba specific databases by calling Samba's net utility. Please note that Samba's net requires some settings in smb.conf to create the database entries correctly. Most important here is currently the workgroup option, see smb.conf(5) for details.

--samba-data-tool=/path/to/net

If Samba's net cannot be found at /usr/bin/net, this option can be used to specific an alternative location with the help of an absolute path.

--ldap-passwd

Use LDAP add/mod operations to set the machine account password instead of Kerberos. This might help in some situations where Kerberos fails or is unreliable. But please note that 'Change password' or 'Reset password' permissions or similar might be needed to make the LDAP operation work. Additionally there will be no read-only domain controller (RODC) support as there is with Kerberos.

If supported on the AD side the msDS-supportedEncryptionTypes attribute will be set as well. Either the current value or the default list of AD's supported encryption types filtered by the permitted encryption types of the client's Kerberos configuration are written.

## UPDATING THE MACHINE ACCOUNT PASSWORD AND OTHER ATTRIBUTES
adcli update updates the password of the computer account on the domain controller for the local machine, write the new keys to the keytab and removes older keys. It keeps the previous key on purpose because AD will need some time to replicate the new key to all DCs hence the previous key might still be used.

```
$ adcli update
```

If used with a credential cache, other attributes of the computer account can be changed as well if the principal has sufficient privileges.

```
$ kinit Administrator
$ adcli update --login-ccache=/tmp/krbcc_123
```

In addition to the global options, you can specify the following options to control how this operation is done.

-N, --computer-name=computer

The short non-dotted name of the computer account that will be created in the domain. If not specified, it will be retrieved from the keytab entries.

-H, --host-fqdn=host

The local machine's fully qualified domain name. If not specified, the local machine's hostname will be retrieved from the keytab entries.

-K, --host-keytab=/path/to/keytab

Specify the path to the host keytab where current host credentials are stored and the new ones will be written to. If not specified, the default location will be used, usually /etc/krb5.keytab.

--os-name=name

Set the operating system name on the computer account. Not set by default.

--os-service-pack=pack

Set the operating system service pack on the computer account. Not set by default.

--os-version=version

Set the operating system version on the computer account. Not set by default.

--description=description

Set the description attribute on the computer account. Not set by default.

--service-name=service

Additional service name for a Kerberos principal to be created on the computer account. This option may be specified multiple times.

--user-principal=host/name@REALM

Set the userPrincipalName field of the computer account to this Kerberos principal.

--computer-password-lifetime=lifetime

Only update the password of the computer account if it is older than the lifetime given in days. By default the password is updated if it is older than 30 days.

--trusted-for-delegation=yes|no|true|false

Set or unset the TRUSTED_FOR_DELEGATION flag in the userAccountControl attribute to allow or not allow that Kerberos tickets can be forwarded to the host.

--dont-expire-password=yes|no|true|false

Set or unset the DONT_EXPIRE_PASSWORD flag in the userAccountControl attribute to indicate if the machine account password should expire or not. By default adcli will set this flag while joining the domain which corresponds to the default behavior of Windows clients. Please note that if the password will expire (--dont-expire-password=false) a renewal mechanism has to be enabled on the client to not loose the connectivity to AD if the password expires.

--account-disable=yes|no|true|false

Set or unset the ACCOUNTDISABLE flag in the userAccountControl attribute to disable or enable the computer account.

--add-service-principal=service/hostname

Add a service principal name. In contrast to the --service-name the hostname part can be specified as well in case the service should be accessible with a different host name as well.

--remove-service-principal=service/hostname

Remove a service principal name from the keytab and the AD host object.

--setattr=name=value

Add the LDAP attribute name with the given value to the LDAP host object. This option can be used multiple times to add multiple different attributes. Multi-value attributes are currently not supported. Please note that the account used to update the host object must have the required privileges to modify the given attributes. Some attributes might have constraints with respect to syntax and allowed values which must be met as well. Attributes managed by other adcli options cannot be set with this option.

--delattr=name

Remove the LDAP attribute name from the LDAP host object. This option can be used multiple times to remove multiple different attributes. Please note that the account used to update the host object must have the required privileges to delete the given attributes. Attributes managed by other adcli options cannot be removed.

--show-details

After a successful join print out information about join operation. This is output in a format that should be both human and machine readable.

--add-samba-data

After a successful join add the domain SID and the machine account password to the Samba specific databases by calling Samba's net utility. Please note that Samba's net requires some settings in smb.conf to create the database entries correctly. Most important here is currently the workgroup option, see smb.conf(5) for details.

Note that if the machine account password is not older than 30 days, you have to pass --computer-password-lifetime=0 to force the update.

--samba-data-tool=/path/to/net

If Samba's net cannot be found at /usr/bin/net, this option can be used to specific an alternative location with the help of an absolute path.

--ldap-passwd

Use LDAP add/mod operations to set the machine account password instead of Kerberos. This might help in some situations where Kerberos fails or is unreliable. But please note that 'Change password' or 'Rest password' permissions or similar might be needed to make the LDAP operation work. Additionally there will be no read-only domain controller (RODC) support as there is with Kerberos.

If supported on the AD side the msDS-supportedEncryptionTypes attribute will be set as well. Either the current value or the default list of AD's supported encryption types filtered by the permitted encryption types of the client's Kerberos configuration are written.

## TESTING IF THE MACHINE ACCOUNT PASSWORD IS VALID
adcli testjoin uses the current credentials in the keytab and tries to authenticate with the machine account to the AD domain. If this works the machine account password and the join are still valid. If it fails the machine account password or the whole machine account have to be refreshed with adcli join or adcli update.

```
$ adcli testjoin
```

Only the global options not related to authentication are available, additionally you can specify the following options to control how this operation is done.

-K, --host-keytab=/path/to/keytab

Specify the path to the host keytab where current host credentials are stored and the new ones will be written to. If not specified, the default location will be used, usually /etc/krb5.keytab.

## CREATING A USER
adcli create-user creates a new user account in the domain.

```
$ adcli create-user Fry --domain=domain.example.com \
	--display-name="Philip J. Fry" --mail=fry@domain.example.com
```

In addition to the global options, you can specify the following options to control how the user is created.

--display-name="Name"

Set the displayName attribute of the new created user account.

-O, --domain-ou=OU=xxx

The full distinguished name of the OU in which to create the user account. If not specified, then the computer account will be created in a default location.

--mail=email@domain.com

Set the mail attribute of the new created user account. This attribute may be specified multiple times.

--unix-home=/home/user

Set the unixHomeDirectory attribute of the new created user account, which should be an absolute path to the user's home directory.

--unix-gid=111

Set the gidNumber attribute of the new created user account, which should be the user's numeric primary group id.

--unix-shell=/bin/shell

Set the loginShell attribute of the new created user account, which should be a path to a valid shell.

--unix-uid=111

Set the uidNumber attribute of the new created user account, which should be the user's numeric primary user id.

--nis-domain=nis_domain

Set the msSFU30NisDomain attribute of the new created user account, which should be the user's NIS domain is the NIS/YP service of Active Directory's Services for Unix (SFU) are used. This is needed to let the 'UNIX attributes' tab of older Active Directory versions show the set UNIX specific attributes. If not specified adcli will try to determine the NIS domain automatically if needed.

## DELETING A USER
adcli delete-user deletes a user account from the domain.

```
$ adcli delete-user Fry --domain=domain.example.com
```

The various global options can be used.

## (RE)SETTING THE PASSWORD OF A USER WITH AN ADMINISTRATIVE ACCOUNT
adcli passwd-user sets or resets the password of user account. The administrative account used for this operation must have privileges to set a password.

```
$ adcli passwd-user Fry --domain=domain.example.com
```

The various global options can be used.

## CREATING A GROUP
adcli create-group creates a new group in the domain.

```
$ adcli create-group Pilots --domain=domain.example.com \
	--description="Group for all pilots"
```

In addition to the global options, you can specify the following options to control how the group is created.

--description="text"

Set the description attribute of the new created group.

-O, --domain-ou=OU=xxx

The full distinguished name of the OU in which to create the group. If not specified, then the group will be created in a default location.

## DELETING A GROUP
adcli delete-group deletes a group from the domain.

```
$ adcli delete-group Pilots --domain=domain.example.com
```

The various global options can be used.

## ADDING A MEMBER TO A GROUP
adcli add-member adds one or more users to a group in the domain. The group is specified first, and then the various users or computers to be added. You must use dollar sign for computer account (computername$)

```
$ adcli add-member --domain=domain.example.com Pilots Leela Scruffy
$ adcli add-member --domain=domain.example.com servers srv-smb$
```

The various global options can be used.

## REMOVING A MEMBER FROM A GROUP
adcli remove-member removes a user from a group in the domain. The group is specified first, and then the various users to be removed.

```
$ adcli remove-member --domain=domain.example.com Pilots Scruffy
```

The various global options can be used.

## PRESET COMPUTER ACCOUNTS
adcli preset-computer pre-creates one or more computer accounts in the domain for machines to later use when joining the domain. By doing this machines can join using a one time password or automatically without a password.

```
$ adcli preset-computer --domain=domain.example.com \
	host1.example.com host2
Password for Administrator:
```

If the computer names specified contain dots, then they are treated as fully qualified host names, otherwise they are treated as short computer names. The computer accounts must not already exist.

In addition to the global options, you can specify the following options to control how this operation is done.

-O, --domain-ou=OU=xxx

The full distinguished name of the OU in which to create the computer accounts. If not specified, then the computer account will be created in a default location.

--one-time-password

Specify a one time password to use when presetting the computer accounts. If not specified, then a default password will be used, which allows for later automatic joins.

--os-name=name

Set the operating system name on the computer account. The default depends on where adcli was built, but is usually something like 'linux-gnu'.

--os-service-pack=pack

Set the operating system service pack on the computer account. Not set by default.

--os-version=version

Set the operating system version on the computer account. Not set by default.

--service-name=service

Additional service name for a Kerberos principal to be created on the computer account. This option may be specified multiple times.

--user-principal

Set the userPrincipalName field of the computer account to this Kerberos principal in the form of host/host.example.com@REALM

## RESET COMPUTER ACCOUNT
adcli reset-computer resets a computer account in the domain. If the appropriate machine is currently joined to the domain, then its membership will be broken. The account must already exist.

```
$ adcli reset-computer --domain=domain.example.com host2
```

If the computer names specified contain dots, then they are treated as fully qualified host names, otherwise they are treated as short computer names.

In addition to the global options, you can specify the following options to control how this operation is done.

--login-type={computer|user}

Specify the type of authentication that will be performed before creating the machine account in the domain. If set to 'computer', then the computer must already have a preset account in the domain. If not specified and none of the other --login-xxx arguments have been specified, then will try both 'computer' and 'user' authentication.

## DELETE COMPUTER ACCOUNT
adcli delete-computer deletes a computer account in the domain. The account must already exist.

```
$ adcli delete-computer --domain=domain.example.com host2
Password for Administrator:
```

If the computer name contains a dot, then it is treated as fully qualified host name, otherwise it is treated as short computer name.

If no computer name is specified, then the host name of the computer adcli is running on is used, as returned by gethostname().

The various global options can be used.

## SHOW COMPUTER ACCOUNT ATTRIBUTES
adcli show-computer show the computer account attributes stored in AD. The account must already exist.

```
$ adcli show-computer --domain=domain.example.com host2
Password for Administrator:
```

If the computer name contains a dot, then it is treated as fully qualified host name, otherwise it is treated as short computer name.

If no computer name is specified, then the host name of the computer adcli is running on is used, as returned by gethostname().

The various global options can be used.

## CREATE A MANAGED SERVICE ACCOUNT
adcli create-msa creates a managed service account (MSA) in the given Active Directory domain. This is useful if a computer should not fully join the Active Directory domain but LDAP access is needed. A typical use case is that the computer is already joined an Active Directory domain and needs access to another Active Directory domain in the same or a trusted forest where the host credentials from the joined Active Directory domain are not valid, e.g. there is only a one-way trust.

```
$ adcli create-msa --domain=domain.example.com
Password for Administrator:
```

The managed service account, as maintained by adcli, cannot have additional service principals names (SPNs) associated with it. An SPN is defined within the context of a Kerberos service which is tied to a machine account in Active Directory. Since a machine can be joined to a single Active Directory domain, managed service account in a different Active Directory domain will not have the SPNs that otherwise are part of another Active Directory domain's machine.

Since it is expected that a client will most probably join to the Active Directory domain matching its DNS domain the managed service account will be needed for a different Active Directory domain and as a result the Active Directory domain name is a mandatory option. If called with no other options adcli create-msa will use the short hostname with an additional random suffix as computer name to avoid name collisions.

LDAP attribute sAMAccountName has a limit of 20 characters. However, machine account's NetBIOS name must be at most 16 characters long, including a trailing '$' sign. Since it is not expected that the managed service accounts created by adcli will be used on the NetBIOS level the remaining 4 characters can be used to add uniqueness. Managed service account names will have a suffix of 3 random characters from number and upper- and lowercase ASCII ranges appended to the chosen short host name, using '!' as a separator. For a host with the shortname 'myhost', a managed service account will have a common name (CN attribute) 'myhost!A2c' and a NetBIOS name (sAMAccountName attribute) will be 'myhost!A2c$'. A corresponding Kerberos principal in the Active Directory domain where the managed service account was created would be 'myhost!A2c$@DOMAIN.EXAMPLE.COM'.

A keytab for the managed service account is stored into a file specified with -K option. If it is not specified, the file is named after the default keytab file, with lowercase Active Directory domain of the managed service account as a suffix. On most systems it would be /etc/krb5.keytab with a suffix of 'domain.example.com', e.g. /etc/krb5.keytab.domain.example.com.

adcli create-msa can be called multiple times to reset the password of the managed service account. To identify the right account with the random component in the name the corresponding principal is read from the keytab. If the keytab got deleted adcli will try to identify an existing managed service account with the help of the fully-qualified name, if this fails a new managed service account will be created.

The managed service account password can be updated with

```
$ adcli update --domain=domain.example.com --host-keytab=/etc/krb5.keytab.domain.example.com
```

and the managed service account can be deleted with

```
$ adcli delete-computer --domain=domain.example.com 'myhost!A2c'
```

In addition to the global options, you can specify the following options to control how this operation is done.

-N, --computer-name=computer

The short non-dotted name of the managed service account that will be created in the Active Directory domain. The long option name --computer-name is kept to underline the similarity with the same option of the other sub-commands. If not specified, then the first portion of the --host-fqdn or its default is used with a random suffix.

-O, --domain-ou=OU=xxx

The full distinguished name of the OU in which to create the managed service account. If not specified, then the managed service account will be created in a default location.

-H, --host-fqdn=host

Override the local machine's fully qualified DNS domain name. If not specified, the local machine's hostname will be retrieved via gethostname(). If gethostname() only returns a short name getaddrinfo() with the AI_CANONNAME hint is called to expand the name to a fully qualified DNS domain name.

-K, --host-keytab=/path/to/keytab

Specify the path to the host keytab where credentials of the managed service account will be written after a successful creation. If not specified, the default location will be used, usually /etc/krb5.keytab with the lower-cased Active Directory domain name added as a suffix e.g. /etc/krb5.keytab.domain.example.com.

--show-details

After a successful creation print out information about the created object. This is output in a format that should be both human and machine readable.

--show-password

After a successful creation print out the managed service account password. This is output in a format that should be both human and machine readable.

## DELEGATED PERMISSIONS
It is common practice in AD to not use an account from the Domain Administrators group to join a machine to a domain but use a dedicated account which only has permissions to join a machine to one or more OUs in the Active Directory tree. Giving the needed permissions to a single account or a group in Active Directory is called Delegation. A typical example on how to configured Delegation can be found in the Delegation section of the blog post Who can add workstation to the domain[1].

When using an account with delegated permissions with adcli basically the same applies as well. However some aspects are explained here in a bit more details to better illustrate different concepts of Active Directory and to make it more easy to debug permissions issues during the join. Please note that the following is not specific to adcli but applies to all applications which would like to modify certain properties or objects in Active Directory with an account with limited permissions.

First, as said in the blog post it is sufficient to have "Create computer object" permissions to join a computer to a domain. But this would only work as expected if the computer object does not exist in Active Directory before the join. Because only when a new object is created Active Directory does not apply additional permission checks on the attributes of the new computer object. This means the delegated user can add any kind of attribute with any value to a new computer object also long as they meet general constraints like e.g. that the attribute must be defined in the schema and is allowed in a objectclass of the object, the value must match the syntax defined in the schema or that the sAMAccountName must be unique in the domain.

If you want to use the account with delegated permission to remove computer objects in Active Directory (adcli delete-computer) you should of course make sure that the account has "Delete computer object" permissions.

If the computer object already exists the "Create computer object" permission does not apply anymore since now an existing object must be modified. Now permissions on the individual attributes are needed. e.g. "Read and write Account Restrictions" or "Reset Password". For some attributes Active Directory has two types of permissions the plain "Read and Write" permissions and the "Validated Write" permissions. For the latter case there are two specific permissions relevant for adcli, namely

•Validated write to DNS host name

•Validated write to service principal name

Details about the validation of the values can be found in the "Validated Writes" section of [MS-ADTS], especially dNSHostName[2] and servicePrincipalName[3]. To cut it short for "Validated write to DNS host name" the domain part of the fully-qualified hostname must either match the domain name of the domain you want to join to or must be listed in the msDS-AllowedDNSSuffixes attribute. And for "Validated write to service principal name" the hostname part of the service principal name must match the name stored in dNSHostName or some other attributes which are not handled by adcli. This also means that dNSHostName cannot be empty or only contain a short name if the service principal name should contain a fully-qualified name.

To summarize, if you only have validated write permissions you should make sure the domain part of the hostname matches the domain you want to join or use the --host-fqdn with a matching name.

The plain read write permissions do not run additional validations but the attribute values must still be in agreement with the general constraints mentioned above. If the computer object already exists adcli might need the following permissions which are also needed by Windows clients to modify existing attributes:

•Reset Password

•Read and write Account Restrictions

•Read and (validated) write to DNS host name

•Read and (validated) write to service principal name

additionally adcli needs

•Read and write msDS-supportedEncryptionTypes

This is added for security reasons to avoid that Active Directory stores Kerberos keys with (potentially weaker) encryption types than the client supports since Active Directory is often configured to still support older (weaker) encryption types for compatibility reasons.

All other attributes are only set or modified on demand, i.e. adcli must be called with an option the would set or modify the given attribute. In the following the attributes adcli can modify together with the required permissions are listed:

•userPrincipalName

•Read/Write userPrincipal Name

•msDS-supportedEncryptionTypes

•Read/Write msDS-SupportedEncryptionTypes

•dNSHostName

•Read/Write dNSHostName

•Read and write DNS host name attributes

•Validated write to DNS host name

•servicePrincipalName

•Read/Write servicePrincipalName

•Validated write to service principal name

•operatingSystem

•Read/Write Operating System

•operatingSystemVersion

•Read/Write Operating System Version

•operatingSystemServicePack

•Read/Write operatingSystemServicePack

•userAccountControl

•Read/Write userAccountControl

•description

•Read/Write Description

For the management of users and groups (adcli create-user, adcli delete-user, adcli create-group, adcli delete-group) the same applies only for different types of objects, i.e. users and groups. Since currently adcli only supports the creation and the removal of user and group objects it is sufficient to have the "Create/Delete User objects" and "Create/Delete Group objects" permissions.

If you want to manage group members as well (adcli add-member, adcli remove-member) "Read/Write Members" permissions are needed as well.

Depending on the version of Active Directory the "Delegation of Control Wizard" might offer some shortcuts for common task like e.g.

•Create, delete and manage user accounts

•Create, delete and manage groups

•Modify the membership of a group

The first 2 shortcuts will provided full access to user and group objects which, as explained above, is more than currently is needed. After using those shortcut it is a good idea to verify in the "Security" tab in the "Properties" of the related Active Directory container that the assigned permissions meet the expectations.

## BUGS
Please send bug reports to either the distribution bug tracker or the upstream bug tracker at https://bugs.freedesktop.org/enter_bug.cgi?product=realmd&component=adcli

## SEE ALSO
realmd(8), net(8), sssd(8)

Further details available in the realmd online documentation at http://www.freedesktop.org/software/realmd/

## NOTES
1.

Who can add workstation to the domain

https://docs.microsoft.com/en-us/archive/blogs/dubaisec/who-can-add-workstation-to-the-domain

2.

dNSHostName

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5c578b15-d619-408d-ba17-380714b89fd1

3.

servicePrincipalName

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/28ca4eca-0e0b-4666-9175-a37ccb8edada


adjtimex

package: adjtimex

title: adjtimex(8)

text:
# adjtimex(8)

## NAME
adjtimex - display or set the kernel time variables

## SYNOPSIS
adjtimex [option]...

## DESCRIPTION
This program gives you raw access to the kernel time variables. Anyone may print out the time variables, but only the superuser may change them.

Your computer has two clocks - the "hardware clock" that runs all the time, and the system clock that runs only while the computer is on. Normally, "hwclock --hctosys" should be run at startup to initialize the system clock. The system clock has much better precision (approximately 1 usec), but the hardware clock probably has better long-term stability. There are three basic strategies for managing these clocks.

For a machine connected to the Internet, or equipped with a precision oscillator or radio clock, the best way is to regulate the system clock with ntpd(8). The kernel will automatically update the hardware clock every eleven minutes.

In addition, hwclock(8) can be used to approximately correct for a constant drift in the hardware clock. In this case, "hwclock --adjust" is run occasionally. hwclock notes how long it has been since the last adjustment, and nudges the hardware clock forward or back by the appropriate amount. The user needs to set the time with "hwclock --set" several times over the course of a few days so hwclock can estimate the drift rate. During that time, ntpd should not be running, or else hwclock will conclude the hardware clock does not drift at all. After you have run "hwclock --set" for the last time, it's okay to start ntpd. Then, "hwclock --systohc" should be run when the machine is shut down. (To see why, suppose the machine runs for a week with ntpd, is shut down for a day, is restarted, and "hwclock --adjust" is run by a startup script. It should only correct for one day's worth of drift. However, it has no way of knowing that ntpd has been adjusting the hardware clock, so it bases its adjustment on the last time hwclock was run.)

For a standalone or intermittently connected machine, where it's not possible to run ntpd, you may use adjtimex instead to correct the system clock for systematic drift.

There are several ways to estimate the drift rate. If your computer can be connected to the net, you might run ntpd for at least several hours and run "adjtimex --print" to learn what values of tick and freq it settled on. Alternately, you could estimate values using as a reference the CMOS clock (see the --compare and --adjust switches), another host (see --host and --review), or some other source of time (see --watch and --review). You could then add a line to rc.local invoking adjtimex, or configure /etc/init.d/adjtimex or /etc/default/adjtimex, to set those parameters each time you reboot.

## OPTIONS
Options may be introduced by either - or --, and unique abbreviations may be used.

Here is a summary of the options, grouped by type. Explanations follow.

Get/Set Kernel Time Parameters

-p --print -t --tick val -f newfreq --frequency newfreq -o val --offset val -s adjustment --singleshot adjustment -S status --status status -m val -R --reset --maxerror val -e val --esterror val -T val --timeconstant val -a[count] --adjust[=count]

Estimate Systematic Drifts

-c[count] --compare[=count] -i tim --interval tim -l file --log file -h timeserver --host timeserver -w --watch -r[file] --review[=file] -u --utc -d --directisa -n --nointerrupt

Informative Output

--help -v --version -V --verbose

-p, --print

Print the current values of the kernel time variables. NOTE: The time is "raw", and may be off by up to one timer tick (10 msec). "status" gives the value of the time_status variable in the kernel. For Linux 1.0 and 1.2 kernels, the value is as follows:

```
      0   clock is synchronized (so the kernel should

          periodically set the CMOS clock to match the

          system clock)

      1   inserting a leap second at midnight

      2   deleting a leap second at midnight

      3   leap second in progress

      4   leap second has occurred

      5   clock not externally synchronized (so the

          kernel should leave the CMOS clock alone)
```

For Linux kernels 2.0 through 2.6, the value is a sum of these:

```
      1   PLL updates enabled

      2   PPS freq discipline enabled

      4   PPS time discipline enabled

      8   frequency-lock mode enabled

     16   inserting leap second

     32   deleting leap second

     64   clock unsynchronized

    128   holding frequency

    256   PPS signal present

    512   PPS signal jitter exceeded

   1024   PPS signal wander exceeded

   2048   PPS signal calibration error

   4096   clock hardware fault
```

-t val, --tick val

Set the number of microseconds that should be added to the system time for each kernel tick interrupt. For a kernel with USER_HZ=100, there are supposed to be 100 ticks per second, so val should be close to 10000. Increasing val by 1 speeds up the system clock by about 100 ppm, or 8.64 sec/day. tick must be in the range 900000/USER_HZ...1100000/USER_HZ. If val is rejected by the kernel, adjtimex will determine the acceptable range through trial and error and print it. (After completing the search, it will restore the original value.)

-f newfreq, --frequency newfreq

Set the system clock frequency offset to newfreq. newfreq can be negative or positive, and gives a much finer adjustment than the --tick switch. When USER_HZ=100, the value is scaled such that newfreq = 65536 speeds up the system clock by about 1 ppm, or .0864 sec/day. Thus, all of these are about the same:

```
     --tick  9995 --frequency  32768000

     --tick 10000 --frequency   6553600

     --tick 10001 --frequency         0

     --tick 10002 --frequency  -6553600

     --tick 10005 --frequency -32768000
```

To see the acceptable range for newfreq, use --print and look at "tolerance", or try an illegal value (e.g. --tick 0).

-s adj, --singleshot adj

Slew the system clock by adj usec. (Its rate is changed temporarily by about 1 part in 2000.)

-o adj, --offset adj

Add a time offset of adj usec. The kernel code adjusts the time gradually by adj, notes how long it has been since the last time offset, and then adjusts the frequency offset to correct for the apparent drift. adj must be in the range -512000...512000.

-S status, --status status

Set kernel system clock status register to value status. Look here above at the --print switch section for the meaning of status, depending on your kernel.

-R, --reset

Reset clock status after setting a clock parameter. For early Linux kernels, using the adjtimex(2) system call to set any time parameter the kernel think the clock is synchronized with an external time source, so it sets the kernel variable time_status to TIME_OK. Thereafter, at 11 minute intervals, it will adjust the CMOS clock to match. We prevent this "eleven minute mode" by setting the clock, because that has the side effect of resetting time_status to TIME_BAD. We try not to actually change the clock setting. Kernel versions 2.0.40 and later apparently don't need this. If your kernel does require it, use this option with: -t -T -t -e -m -f -s -o -c -r.

-m val, --maxerror val

Set maximum error (usec).

-e val, --esterror val

Set estimated error (usec). The maximum and estimated error are not used by the kernel. They are merely made available to user processes via the adjtimex(2) system call.

-T val, --timeconstant val

Set phase locked loop (PLL) time constant. val determines the bandwidth or "stiffness" of the PLL. The effective PLL time constant will be a multiple of (2^val). For room-temperature quartz oscillators, David Mills recommends the value 2, which corresponds to a PLL time constant of about 900 sec and a maximum update interval of about 64 sec. The maximum update interval scales directly with the time constant, so that at the maximum time constant of 6, the update interval can be as large as 1024 sec. Values of val between zero and 2 give quick convergence; values between 2 and 6 can be used to reduce network load, but at a modest cost in accuracy.

-c[count], --compare[=count]

Periodically compare the system clock with the CMOS clock. After the first two calls, print values for tick and frequency offset that would bring the system clock into approximate agreement with the CMOS clock. CMOS clock readings are adjusted for systematic drift using using the correction in /etc/adjtime — see hwclock(8). The interval between comparisons is 10 seconds, unless changed by the --interval switch. The optional argument is the number of comparisons. (If the argument is supplied, the "=" is required.) If the CMOS clock and the system clock differ by more than six minutes, adjtimex will try shifting the time from the CMOS clock by some multiple of one hour, up to plus or minus 13 hours in all. This should allow correct operation, including logging, if the --utc switch was used when the CMOS clock is set to local time (or vice-versa), or if summer time has started or stopped since the CMOS clock was last set.

-a[count], --adjust[=count]

By itself, same as --compare, except the recommended values are actually installed after every third comparison. With --review, the tick and frequency are set to the least-squares estimates. (In the latter case, any count value is ignored.)

--force-adjust

Override the sanity check that prevents changing the clock rate by more than 500 ppm.

-i tim, --interval tim

Set the interval in seconds between clock comparisons for the --compare and --adjust options.

-u, --utc

The CMOS clock is set to UTC (universal time) rather than local time.

-d, --directisa

To read the CMOS clock accurately, adjtimex usually accesses the clock via the /dev/rtc device driver of the kernel, and makes use of its CMOS update-ended interrupt to detect the beginning of seconds. It will also try /dev/rtc0 (for udev), /dev/misc/rtc (for the obsolete devfs) and possibly others. When the /dev/rtc driver is absent, or when the interrupt is not available, adjtimex can sometimes automatically fallback to a direct access method. This method detects the start of seconds by polling the update-in-progress (UIP) flag of the CMOS clock. You can force this direct access to the CMOS chip with the --directisa switch. Note that the /dev/rtc interrupt method is more accurate, less sensible to perturbations due to system load, cleaner, cheaper, and is generally better than the direct access method. It is advisable to not use the --directisa switch, unless the CMOS chip or the motherboard don't properly provide the necessary interrupt.

-n, --nointerrupt

Force immediate use of busywait access method, without first waiting for the interrupt timeout.

-l[file], --log[=file]

Save the current values of the system and CMOS clocks, and optionally a reference time, to file (default /var/log/clocks.log). The reference time is taken from a network timeserver (see the --host switch) or supplied by the user (see the --watch switch).

-h timeserver, --host timeserver

Use ntpdate to query the given timeserver for the current time. This will fail if timeserver is not running a Network Time Protocol (NTP) server, or if that server is not synchronized. Implies --log.

-w, --watch

Ask for a keypress when the user knows the time, then ask what that time was, and its approximate accuracy. Implies --log.

-r[file], --review[=file]

Review the clock log file (default /var/log/clocks.log) and estimate, if possible, the rates of the CMOS and system clocks. Calculate least-squares rates using all suitable log entries. Suggest corrections to adjust for systematic drift. With --adjust, the frequency and tick are set to the suggested values. (The CMOS clock correction is not changed.)

-V, --verbose

Increase verbosity.

--help

Print the program options.

-v, --version

Print the program version.

## EXAMPLES
If your system clock gained 8 seconds in 24 hours, you could set the tick to 9999, and then it would lose 0.64 seconds a day (that is, 1 tick unit = 8.64 seconds per day). To correct the rest of the error, you could set the frequency offset to (2^16)*0.64/.0864 = 485452. Thus, putting the following in rc.local would approximately correct the system clock:

```
     adjtimex  --tick 9999  --frequency 485452
```

## NOTES
adjtimex adjusts only the system clock — the one that runs while the computer is powered up. To set or regulate the CMOS clock, see hwclock(8).

## AUTHORS
Steven S. Dick <ssd at nevets.oau.org>, Jim Van Zandt <jrv at comcast.net>.

## SEE ALSO
date(1L), gettimeofday(2), settimeofday(2), hwclock(8), ntpdate(8), ntpd(8), /usr/src/linux/include/linux/timex.h, /usr/src/linux/include/linux/sched.h, /usr/src/linux/kernel/time.c, /usr/src/linux/kernel/sched.c


agetty

package: agetty

title: agetty(8)

summary: alternative Linux getty

text:
# agetty(8)

## NAME
agetty - alternative Linux getty

## SYNOPSIS
agetty [options] port [baud_rate...] [term]

## DESCRIPTION
agetty opens a tty port, prompts for a login name and invokes the /bin/login command. It is normally invoked by init(8).

agetty has several non-standard features that are useful for hardwired and for dial-in lines:

•Adapts the tty settings to parity bits and to erase, kill, end-of-line and uppercase characters when it reads a login name. The program can handle 7-bit characters with even, odd, none or space parity, and 8-bit characters with no parity. The following special characters are recognized: Control-U (kill); DEL and backspace (erase); carriage return and line feed (end of line). See also the --erase-chars and --kill-chars options.

•Optionally deduces the baud rate from the CONNECT messages produced by Hayes(tm)-compatible modems.

•Optionally does not hang up when it is given an already opened line (useful for call-back applications).

•Optionally does not display the contents of the /etc/issue file.

•Optionally displays an alternative issue files or directories instead of /etc/issue or /etc/issue.d.

•Optionally does not ask for a login name.

•Optionally invokes a non-standard login program instead of /bin/login.

•Optionally turns on hardware flow control.

•Optionally forces the line to be local with no need for carrier detect.

This program does not use the /etc/gettydefs (System V) or /etc/gettytab (SunOS 4) files.

## ARGUMENTS
port

A path name relative to the /dev directory. If a "-" is specified, agetty assumes that its standard input is already connected to a tty port and that a connection to a remote user has already been established. Under System V, a "-" port argument should be preceded by a "--".

baud_rate,...

A comma-separated list of one or more baud rates. Each time agetty receives a BREAK character it advances through the list, which is treated as if it were circular. Baud rates should be specified in descending order, so that the null character (Ctrl-@) can also be used for baud-rate switching.

This argument is optional and unnecessary for virtual terminals.

The default for serial terminals is keep the current baud rate (see --keep-baud) and if unsuccessful then default to '9600'.

term

The value to be used for the TERM environment variable. This overrides whatever init(1) may have set, and is inherited by login and the shell. The default is 'vt100', or 'linux' for Linux on a virtual terminal, or 'hurd' for GNU Hurd on a virtual terminal.

## OPTIONS
-8, --8bits

Assume that the tty is 8-bit clean, hence disable parity detection.

-a, --autologin username

Automatically log in the specified user without asking for a username or password. Using this option causes an -f username option and argument to be added to the /bin/login command line. See --login-options, which can be used to modify this option’s behavior. Note that --autologin may affect the way in which getty initializes the serial line, because on auto-login agetty does not read from the line and it has no opportunity optimize the line setting.

-c, --noreset

Do not reset terminal cflags (control modes). See termios(3) for more details.

-E, --remote

Typically the login(1) command is given a remote hostname when called by something such as telnetd(8). This option allows agetty to pass what it is using for a hostname to login(1) for use in utmp(5). See --host, login(1), and utmp(5). If the --host fakehost option is given, then an -h fakehost option and argument are added to the /bin/login command line.

If the --nohostname option is given, then an -H option is added to the /bin/login command line.

See --login-options.

-f, --issue-file path

Specifies a ":" delimited list of files and directories to be displayed instead of /etc/issue (or other). All specified files and directories are displayed, missing or empty files are silently ignored. If the specified path is a directory then display all files with .issue file extension in version-sort order from the directory. This allows custom messages to be displayed on different terminals. The --noissue option will override this option.

--show-issue

Display the current issue file (or other) on the current terminal and exit. Use this option to review the current setting, it is not designed for any other purpose. Note that output may use some default or incomplete information as proper output depends on terminal and agetty command line.

-h, --flow-control

Enable hardware (RTS/CTS) flow control. It is left up to the application to disable software (XON/XOFF) flow protocol where appropriate.

-H, --host fakehost

Write the specified fakehost into the utmp file. Normally, no login host is given, since agetty is used for local hardwired connections and consoles. However, this option can be useful for identifying terminal concentrators and the like.

-i, --noissue

Do not display the contents of /etc/issue (or other) before writing the login prompt. Terminals or communications hardware may become confused when receiving lots of text at the wrong baud rate; dial-up scripts may fail if the login prompt is preceded by too much text.

-I, --init-string initstring

Set an initial string to be sent to the tty or modem before sending anything else. This may be used to initialize a modem. Non-printable characters may be sent by writing their octal code preceded by a backslash (\). For example, to send a linefeed character (ASCII 10, octal 012), write \12.

-J, --noclear

Do not clear the screen before prompting for the login name. By default the screen is cleared.

-l, --login-program login_program

Invoke the specified login_program instead of /bin/login. This allows the use of a non-standard login program. Such a program could, for example, ask for a dial-up password or use a different password file. See --login-options.

-L, --local-line[=mode]

Control the CLOCAL line flag. The optional mode argument is auto, always or never. If the mode argument is omitted, then the default is always. If the --local-line option is not given at all, then the default is auto. always

Forces the line to be a local line with no need for carrier detect. This can be useful when you have a locally attached terminal where the serial line does not set the carrier-detect signal.

never

Explicitly clears the CLOCAL flag from the line setting and the carrier-detect signal is expected on the line.

auto

The agetty default. Does not modify the CLOCAL setting and follows the setting enabled by the kernel.

-m, --extract-baud

Try to extract the baud rate from the CONNECT status message produced by Hayes(tm)-compatible modems. These status messages are of the form: "<junk><speed><junk>". agetty assumes that the modem emits its status message at the same speed as specified with (the first) baud_rate value on the command line. Since the --extract-baud feature may fail on heavily-loaded systems, you still should enable BREAK processing by enumerating all expected baud rates on the command line.

--list-speeds

Display supported baud rates. These are determined at compilation time.

-n, --skip-login

Do not prompt the user for a login name. This can be used in connection with the --login-program option to invoke a non-standard login process such as a BBS system. Note that with the --skip-login option, agetty gets no input from the user who logs in and therefore will not be able to figure out parity, character size, and newline processing of the connection. It defaults to space parity, 7 bit characters, and ASCII CR (13) end-of-line character. Beware that the program that agetty starts (usually /bin/login) is run as root.

-N, --nonewline

Do not print a newline before writing out /etc/issue.

-o, --login-options login_options

Options and arguments that are passed to login(1). Where \u is replaced by the login name. For example: --login-options '-h darkstar -- \u'

See --autologin, --login-program and --remote.

Please read the SECURITY NOTICE below before using this option.

-p, --login-pause

Wait for any key before dropping to the login prompt. Can be combined with --autologin to save memory by lazily spawning shells.

-r, --chroot directory

Change root to the specified directory.

-R, --hangup

Call vhangup(2) to do a virtual hangup of the specified terminal.

-s, --keep-baud

Try to keep the existing baud rate. The baud rates from the command line are used when agetty receives a BREAK character. If another baud rates specified then the original baud rate is also saved to the end of the wanted baud rates list. This can be used to return to the original baud rate after unexpected BREAKs.

-t, --timeout timeout

Terminate if no user name could be read within timeout seconds. Use of this option with hardwired terminal lines is not recommended.

-U, --detect-case

Turn on support for detecting an uppercase-only terminal. This setting will detect a login name containing only capitals as indicating an uppercase-only terminal and turn on some upper-to-lower case conversions. Note that this has no support for any Unicode characters.

-w, --wait-cr

Wait for the user or the modem to send a carriage-return or a linefeed character before sending the /etc/issue file (or others) and the login prompt. This is useful with the --init-string option.

--nohints

Do not print hints about Num, Caps and Scroll Locks.

--nohostname

By default the hostname will be printed. With this option enabled, no hostname at all will be shown. This setting is also possible to able by LOGIN_PLAIN_PROMPT option in the /etc/login.defs configuration file (see below for more details).

--long-hostname

By default the hostname is only printed until the first dot. With this option enabled, the fully qualified hostname by gethostname(3P) or (if not found) by getaddrinfo(3) is shown.

--erase-chars string

This option specifies additional characters that should be interpreted as a backspace ("ignore the previous character") when the user types the login name. The default additional 'erase' has been '#', but since util-linux 2.23 no additional erase characters are enabled by default.

--kill-chars string

This option specifies additional characters that should be interpreted as a kill ("ignore all previous characters") when the user types the login name. The default additional 'kill' has been '@', but since util-linux 2.23 no additional kill characters are enabled by default.

--chdir directory

Change directory before the login.

--delay number

Sleep seconds before open tty.

--nice number

Run login with this priority.

--reload

Ask all running agetty instances to reload and update their displayed prompts, if the user has not yet commenced logging in. After doing so the command will exit. This feature might be unsupported on systems without Linux inotify(7).

-h, --help

Display help text and exit.

-V, --version

Print version and exit.

## CONFIG FILE ITEMS
agetty reads the /etc/login.defs configuration file (see login.defs(5)). Note that the configuration file could be distributed with another package (usually shadow-utils). The following configuration items are relevant for agetty:

LOGIN_PLAIN_PROMPT (boolean)

Tell agetty that printing the hostname should be suppressed in the login: prompt. This is an alternative to the --nohostname command line option. The default value is no.

## EXAMPLE
This section shows examples for the process field of an entry in the /etc/inittab file. You’ll have to prepend appropriate values for the other fields. See inittab(5) for more details.

For a hardwired line or a console tty:

/sbin/agetty 9600 ttyS1

For a directly connected terminal without proper carrier-detect wiring (try this if your terminal just sleeps instead of giving you a password: prompt):

/sbin/agetty --local-line 9600 ttyS1 vt100

For an old-style dial-in line with a 9600/2400/1200 baud modem:

/sbin/agetty --extract-baud --timeout 60 ttyS1 9600,2400,1200

For a Hayes modem with a fixed 115200 bps interface to the machine (the example init string turns off modem echo and result codes, makes modem/computer DCD track modem/modem DCD, makes a DTR drop cause a disconnection, and turns on auto-answer after 1 ring):

/sbin/agetty --wait-cr --init-string 'ATE0Q1&D2&C1S0=1\015' 115200 ttyS1

## SECURITY NOTICE
If you use the --login-program and --login-options options, be aware that a malicious user may try to enter lognames with embedded options, which then get passed to the used login program. agetty does check for a leading "-" and makes sure the logname gets passed as one parameter (so embedded spaces will not create yet another parameter), but depending on how the login binary parses the command line that might not be sufficient. Check that the used login program cannot be abused this way.

Some programs use "--" to indicate that the rest of the command line should not be interpreted as options. Use this feature if available by passing "--" before the username gets passed by \u.

## ISSUE FILES
The default issue file is /etc/issue. If the file exists, then agetty also checks for /etc/issue.d directory. The directory is optional extension to the default issue file and content of the directory is printed after /etc/issue content. If the /etc/issue does not exist, then the directory is ignored. All files with .issue extension from the directory are printed in version-sort order. The directory can be used to maintain 3rd-party messages independently on the primary system /etc/issue file.

Since version 2.35 additional locations for issue file and directory are supported. If the default /etc/issue does not exist, then agetty checks for /run/issue and /run/issue.d, thereafter for /usr/lib/issue and /usr/lib/issue.d. The directory /etc is expected for host specific configuration, /run is expected for generated stuff and /usr/lib for static distribution maintained configuration.

The default path maybe overridden by --issue-file option. In this case specified path has to be file or directory and all the default issue file and directory locations are ignored.

The issue file feature can be completely disabled by --noissue option.

It is possible to review the current issue file by agetty --show-issue on the current terminal.

The issue files may contain certain escape codes to display the system name, date, time et cetera. All escape codes consist of a backslash (\) immediately followed by one of the characters listed below.

4 or 4{interface}

Insert the IPv4 address of the specified network interface (for example: \4{eth0}). If the interface argument is not specified, then select the first fully configured (UP, non-LOCALBACK, RUNNING) interface. If no configured interface is found, fall back to the IP address of the machine’s hostname.

6 or 6{interface}

The same as \4 but for IPv6.

b

Insert the baudrate of the current line.

d

Insert the current date.

e or e{name}

Translate the human-readable name to an escape sequence and insert it (for example: \e{red}Alert text.\e{reset}). If the name argument is not specified, then insert \033. The currently supported names are: black, blink, blue, bold, brown, cyan, darkgray, gray, green, halfbright, lightblue, lightcyan, lightgray, lightgreen, lightmagenta, lightred, magenta, red, reset, reverse, yellow and white. All unknown names are silently ignored.

s

Insert the system name (the name of the operating system). Same as 'uname -s'. See also the \S escape code.

S or S{VARIABLE}

Insert the VARIABLE data from /etc/os-release. If this file does not exist then fall back to /usr/lib/os-release. If the VARIABLE argument is not specified, then use PRETTY_NAME from the file or the system name (see \s). This escape code can be used to keep /etc/issue distribution and release independent. Note that \S{ANSI_COLOR} is converted to the real terminal escape sequence.

l

Insert the name of the current tty line.

m

Insert the architecture identifier of the machine. Same as uname -m.

n

Insert the nodename of the machine, also known as the hostname. Same as uname -n.

o

Insert the NIS domainname of the machine. Same as hostname -d.

O

Insert the DNS domainname of the machine.

r

Insert the release number of the OS. Same as uname -r.

t

Insert the current time.

u

Insert the number of current users logged in.

U

Insert the string "1 user" or "<n> users" where <n> is the number of current users logged in.

v

Insert the version of the OS, that is, the build-date and such.

An example. On my system, the following /etc/issue file:

```
This is \n.\o (\s \m \r) \t
```

displays as:

```
This is thingol.orcan.dk (Linux i386 1.1.9) 18:29:30
```

## FILES
/var/run/utmp

the system status file.

/etc/issue

printed before the login prompt.

/etc/os-release /usr/lib/os-release

operating system identification data.

/dev/console

problem reports (if syslog(3) is not used).

/etc/inittab

init(8) configuration file for SysV-style init daemon.

## BUGS
The baud-rate detection feature (the --extract-baud option) requires that agetty be scheduled soon enough after completion of a dial-in call (within 30 ms with modems that talk at 2400 baud). For robustness, always use the --extract-baud option in combination with a multiple baud rate command-line argument, so that BREAK processing is enabled.

The text in the /etc/issue file (or other) and the login prompt are always output with 7-bit characters and space parity.

The baud-rate detection feature (the --extract-baud option) requires that the modem emits its status message after raising the DCD line.

## DIAGNOSTICS
Depending on how the program was configured, all diagnostics are written to the console device or reported via the syslog(3) facility. Error messages are produced if the port argument does not specify a terminal device; if there is no utmp entry for the current process (System V only); and so on.

## AUTHORS
Werner Fink <werner@suse.de>, Karel Zak <kzak@redhat.com>

The original agetty for serial terminals was written by W.Z. Venema <wietse@wzv.win.tue.nl> and ported to Linux by Peter Orbaek <poe@daimi.aau.dk>.

## REPORTING BUGS
For bug reports, use the issue tracker at <https://github.com/util-linux/util-linux/issues>.

## AVAILABILITY
The agetty command is part of the util-linux package which can be downloaded from Linux Kernel Archive <https://www.kernel.org/pub/linux/utils/util-linux/>.


airbase-ng

package: aircrack-ng

title: airbase-ng(8)

text:
# airbase-ng(8)

## NAME
airbase-ng - multi-purpose tool aimed at attacking clients as opposed to the Access Point (AP) itself

## SYNOPSIS
airbase-ng [options] <interface name>

## DESCRIPTION
airbase-ng is multi-purpose tool aimed at attacking clients as opposed to the Access Point (AP) itself. Since it is so versatile and flexible, summarizing it is a challenge. Here are some of the feature highlights:

- Implements the Caffe Latte WEP client attack

- Implements the Hirte WEP client attack

- Ability to cause the WPA/WPA2 handshake to be captured

- Ability to act as an ad-hoc Access Point

- Ability to act as a full Access Point

- Ability to filter by SSID or client MAC addresses

- Ability to manipulate and resend packets

- Ability to encrypt sent packets and decrypt received packets

The main idea is of the implementation is that it should encourage clients to associate with the fake AP, not prevent them from accessing the real AP.

A tap interface (atX) is created when airbase-ng is run. This can be used to receive decrypted packets or to send encrypted packets.

As real clients will most probably send probe requests for common/configured networks, these frames are important for binding a client to our softAP. In this case, the AP will respond to any probe request with a proper probe response, which tells the client to authenticate to the airbase-ng BSSID. That being said, this mode could possibly disrupt the correct functionality of many APs on the same channel.

## OPTIONS
-H, --help

Shows the help screen.

-a <bssid>

If the BSSID is not explicitly specified by using "-a <BSSID>", then the current MAC of the specified interface is used.

-i <iface>

Also capture and process from this interface in addition to the replay interface.

-w <WEP key>

If WEP should be used as encryption, then the parameter "-w <WEP key>" sets the en-/decryption key. This is sufficient to let airbase-ng set all the appropriate flags by itself. If the softAP operates with WEP encryption, the client can choose to use open system authentication or shared key authentication. Both authentication methods are supported by airbase-ng. But to get a keystream, the user can try to force the client to use shared key authentication. "-s" forces a shared key auth and "-S <len>" sets the challenge length.

-h <MAC>

This is the source MAC for the man-in-the-middle attack. The "-M" must also be specified.

-f <disallow>

If this option is not specified, it defaults to "-f allow". This means the various client MAC filters (-d and -D) define which clients to accept. By using the "-f disallow" option, this reverses selection and causes airbase to ignore the clients specified by the filters.

-W <0|1>

This sets the beacon WEP flag. Remember that clients will normally only connect to APs which are the same as themselves. Meaning WEP to WEP, open to open. The "auto" option is to allow airbase-ng to automatically set the flag based on context of the other options specified. For example, if you set a WEP key with -w, then the beacon flag would be set to WEP.

One other use of "auto" is to deal with clients which can automatically adjust their connection type. However, these are few and far between.

In practice, it is best to set the value to the type of clients you are dealing with.

-q

This suppresses printing any statistics or status information.

-v

This prints additional messages and details to assist in debugging.

-M

This option is not implemented yet. It is a man-in-the-middle attack between specified clients and BSSIDs.

-A, --ad-hoc

This causes airbase-ng to act as an ad-hoc client instead of a normal Access Point. In ad-hoc mode airbase-ng also sends beacons, but doesn't need any authentication/association. It can be activated by using "-A". The soft AP will adjust all flags needed to simulate a station in ad-hoc mode automatically and generate a random MAC, which is used as CELL MAC instead of the BSSID. This can be overwritten by the "-a <BSSID>" tag. The interface MAC will then be used as source mac, which can be changed with "-h <sourceMAC>".

-Y <in|out|both>

The parameter "-Y" enables the "external processing" Mode. This creates a second interface "atX", which is used to replay/modify/drop or inject packets at will. This interface must also be brought up with ifconfig and an external tool is needed to create a loop on that interface. The packet structure is rather simple: the ethernet header (14 bytes) is ignored and right after that follows the complete ieee80211 frame the same way it is going to be processed by airbase-ng (for incoming packets) or before the packets will be sent out of the wireless card (outgoing packets). This mode intercepts all data packets and loops them through an external application, which decides what happens with them. The MAC and IP of the second tap interface doesn't matter, as real ethernet frames on this interface are dropped anyway.

There are 3 arguments for "-Y": "in", "out" and "both", which specify the direction of frames to loop through the external application. Obviously "in" redirects only incoming (through the wireless NIC) frames, while outgoing frames aren't touched. "out" does the opposite, it only loops outgoing packets and "both" sends all both directions through the second tap interface.

There is a small and simple example application to replay all frames on the second interface. The tool is called "replay.py" and is located in "./test". It's written in python, but the language doesn't matter. It uses pcapy to read the frames and scapy to possibly alter/show and reinject the frames. The tool as it is, simply replays all frames and prints a short summary of the received frames. The variable "packet" contains the complete ieee80211 packet, which can easily be dissected and modified using scapy.

This can be compared to ettercap filters, but is more powerful, as a real programming language can be used to build complex logic for filtering and packet customization. The downside on using python is, that it adds a delay of around 100ms and the cpu utilizations is rather large on a high speed network, but its perfect for a demonstration with only a few lines of code.

-c <channel>

This is used to specify the channel on which to run the Access Point.

-X, --hidden

This causes the Access Point to hide the SSID and to not broadcast the value.

-s

When specfiied, this forces shared key authentication for all clients. The soft AP will send an "authentication method unsupported" rejection to any open system authentication request if "-s" is specified.

-S

It sets the shared key challenge length, which can be anything from 16 to 1480. The default is 128 bytes. It is the number of bytes used in the random challenge. Since one tag can contain a maximum size of 255 bytes, any value above 255 creates several challenge tags until all specified bytes are written. Many clients ignore values different than 128 bytes so this option may not always work.

-L, --caffe-latte

Airbase-ng also contains the new caffe-latte attack, which is also implemented in aireplay-ng as attack "-6". It can be used with "-L" or "caffe-latte". This attack specifically works against clients, as it waits for a broadcast arp request, which happens to be a gratuitous arp. See this for an explanation of what a gratuitous arp is. It then flips a few bits in the sender MAC and IP, corrects the ICV (crc32) value and sends it back to the client, where it came from. The point why this attack works in practice is, that at least windows sends gratuitous arps after a connection on layer 2 is established and a static ip is set, or dhcp fails and windows assigned an IP out of 169.254.X.X. "-x <pps>" sets the number of packets per second to send when performing the caffe-latte attack. At the moment, this attack doesn't stop, it continuously sends arp requests. Airodump-ng is needed to capture the replies.

-N, --cfrag

This attack listens for an ARP request or IP packet from the client. Once one is received, a small amount of PRGA is extracted and then used to create an ARP request packet targeted to the client. This ARP request is actually made of up of multiple packet fragments such that when received, the client will respond. This attack works especially well against ad-hoc networks. As well it can be used against softAP clients and normal AP clients.

-x <nbpps>

This sets the number of packets per second that packets will be sent (default: 100).

-y

When using this option, the fake AP will not respond to broadcast probes. A broadcast probe is where the specific AP is not identified uniquely. Typically, most APs will respond with probe responses to a broadcast probe. This flag will prevent this happening. It will only respond when the specific AP is uniquely requested.

-0

This enables all WPA/WPA2/WEP Tags to be enabled in the beacons sent. It cannot be specified when also using -z or -Z.

-z <type>

This specifies the WPA beacon tags. The valid values are: 1=WEP40 2=TKIP 3=WRAP 4=CCMP 5=WEP104.

-Z <type>

same as -z, but for WPA2

-V <type>

This specifies the valid EAPOL types. The valid values are: 1=MD5 2=SHA1 3=auto

-F <prefix>

This option causes airbase-ng to write all sent and received packets to a pcap file on disk. This is the file prefix (like airodump-ng -w).

-P

This causes the fake access point to respond to all probes regardless of the ESSIDs specified.

-I <interval>

This sets the time in milliseconds between each beacon.

-C <seconds>

The wildcard ESSIDs will also be beaconed this number of seconds. A good typical value to use is "-C 60" (require -P).

-n <hex>

ANonce (nonce from the AP) to use instead of a randomized one. It must be 64 hexadecimal characters.

Filter options:

--bssid <MAC>, -b <MAC>

BSSID to filter/use.

--bssids <file>, -B <file>

Read a list of BSSIDs out of that file.

--client <MAC>, -d <MAC>

MAC of client to accept.

--clients <file>, -D <file>

Read a list of client's MACs out of that file.

--essid <ESSID>, -e <ESSID>

Specify a single ESSID. For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names

--essids <file>, -E <file>

Read a list of ESSIDs out of that file. It will use the same BSSID for all AP which can generate some interesting output in Airodump-ng like: http://www.chimplabs.com/blog/2015/09/24/unintentional-fun-with-aircrack-ng-at-derbycon-5-0/

## AUTHOR
This manual page was written by Thomas d'Otreppe. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
aireplay-ng(8)

airmon-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

airtun-ng(8)

besside-ng(8)

easside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airventriloquist(8)


aireplay-ng

title: aireplay-ng(8)

text:
# aireplay-ng(8)

## NAME
aireplay-ng - inject packets into a wireless network to generate traffic

## SYNOPSIS
aireplay-ng [options] <replay interface>

## DESCRIPTION
aireplay-ng is used to inject/replay frames. The primary function is to generate traffic for the later use in aircrack-ng for cracking the WEP and WPA-PSK keys. There are different attacks which can cause deauthentications for the purpose of capturing WPA handshake data, fake authentications, Interactive packet replay, hand-crafted ARP request injection and ARP-request reinjection. With the packetforge-ng tool it's possible to create arbitrary frames.

aireplay-ng supports single-NIC injection/monitor.

This feature needs driver patching.

## OPTIONS
-H, --help

Shows the help screen.

Filter options:

-b <bssid>

MAC address of access point.

-d <dmac>

MAC address of destination.

-s <smac>

MAC address of source.

-m <len>

Minimum packet length.

-n <len>

Maximum packet length.

-u <type>

Frame control, type field.

-v <subt>

Frame control, subtype field.

-t <tods>

Frame control, "To" DS bit (0 or 1).

-f <fromds>

Frame control, "From" DS bit (0 or 1).

-w <iswep>

Frame control, WEP bit (0 or 1).

-D

Disable AP Detection.

Replay options:

-x <nbpps>

Number of packets per second.

-p <fctrl>

Set frame control word (hex).

-a <bssid>

Set Access Point MAC address.

-c <dmac>

Set destination MAC address.

-h <smac>

Set source MAC address.

-g <nb_packets>

Change ring buffer size (default: 8 packets). The minimum is 1.

-F

Choose first matching packet.

-e <essid>

Fake Authentication attack: Set target SSID (see below). For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names

-o <npackets>

Fake Authentication attack: Set the number of packets for every authentication and association attempt (Default: 1). 0 means auto

-q <seconds>

Fake Authentication attack: Set the time between keep-alive packets in fake authentication mode.

-Q

Fake Authentication attack: Sends reassociation requests instead of performing a complete authentication and association after each delay period.

-y <prga>

Fake Authentication attack: Specifies the keystream file for fake shared key authentication.

-T n

Fake Authentication attack: Exit if fake authentication fails 'n' time(s).

-j

ARP Replay attack : inject FromDS packets (see below).

-k <IP>

Fragmentation attack: Set destination IP in fragments.

-l <IP>

Fragmentation attack: Set source IP in fragments.

-B

Test option: bitrate test.

Source options:

-i <iface>

Capture packets from this interface.

-r <file>

Extract packets from this pcap file.

Miscellaneous options:

-R

disable /dev/rtc usage.

--ignore-negative-one if the interface's channel can't be determined ignore the mismatch, needed for unpatched cfg80211

--deauth-rc <rc>, -Z <rc> Provide a reason code when doing deauthication (between 0 and 255). By default, 7 is used: Class 3 frame received from unassociated STA. 0 is a reserved value. Reason codes explanations can be found in the IEEE802.11 standard or in https://mrncciew.com/2014/10/11/802-11-mgmt-deauth-disassociation-frames/

Attack modes:

-0 <count>, --deauth=<count>

This attack sends deauthentication packets to one or more clients which are currently associated with a particular access point. Deauthenticating clients can be done for a number of reasons: Recovering a hidden ESSID. This is an ESSID which is not being broadcast. Another term for this is "cloaked" or Capturing WPA/WPA2 handshakes by forcing clients to reauthenticate or Generate ARP requests (Windows clients sometimes flush their ARP cache when disconnected). Of course, this attack is totally useless if there are no associated wireless client or on fake authentications.

-1 <delay>, --fakeauth=<delay>

The fake authentication attack allows you to perform the two types of WEP authentication (Open System and Shared Key) plus associate with the access point (AP). This is only useful when you need an associated MAC address in various aireplay-ng attacks and there is currently no associated client. It should be noted that the fake authentication attack does NOT generate any ARP packets. Fake authentication cannot be used to authenticate/associate with WPA/WPA2 Access Points.

-2, --interactive

This attack allows you to choose a specific packet for replaying (injecting). The attack can obtain packets to replay from two sources. The first being a live flow of packets from your wireless card. The second being from a pcap file. Reading from a file is an often overlooked feature of aireplay-ng. This allows you read packets from other capture sessions or quite often, various attacks generate pcap files for easy reuse. A common use of reading a file containing a packet your created with packetforge-ng.

-3, --arpreplay

The classic ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably. The program listens for an ARP packet then retransmits it back to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs which allow you to determine the WEP key.

-4, --chopchop

This attack, when successful, can decrypt a WEP data packet without knowing the key. It can even work against dynamic WEP. This attack does not recover the WEP key itself, but merely reveals the plaintext. However, some access points are not vulnerable to this attack. Some may seem vulnerable at first but actually drop data packets shorter that 60 bytes. If the access point drops packets shorter than 42 bytes, aireplay tries to guess the rest of the missing data, as far as the headers are predictable. If an IP packet is captured, it additionally checks if the checksum of the header is correct after guessing the missing parts of it. This attack requires at least one WEP data packet.

-5, --fragment

This attack, when successful, can obtain 1500 bytes of PRGA (pseudo random generation algorithm). This attack does not recover the WEP key itself, but merely obtains the PRGA. The PRGA can then be used to generate packets with packetforge-ng which are in turn used for various injection attacks. It requires at least one data packet to be received from the access point in order to initiate the attack.

-6, --caffe-latte

In general, for an attack to work, the attacker has to be in the range of an AP and a connected client (fake or real). Caffe Latte attacks allows one to gather enough packets to crack a WEP key without the need of an AP, it just need a client to be in range.

-7, --cfrag

This attack turns IP or ARP packets from a client into ARP request against the client. This attack works especially well against ad-hoc networks. As well it can be used against softAP clients and normal AP clients.

-8, --migmode

This attack works against Cisco Aironet access points configured in WPA Migration Mode, which enables both WPA and WEP clients to associate to an access point using the same Service Set Identifier (SSID). The program listens for a WEP-encapsulated broadcast ARP packet, bitflips it to make it into an ARP coming from the attacker's MAC address and retransmits it to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV and also to forward the ARP reply to the attacker with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IV as does the ARP reply forwarded to the attacker by the access point. It is all these new IVs which allow you to determine the WEP key.

-9, --test

Tests injection and quality.

## FRAGMENTATION VERSUS CHOPCHOP
Fragmentation:

Pros

- Can obtain the full packet length of 1500 bytes XOR. This means you can subsequently pretty well create any size of packet.

- May work where chopchop does not

- Is extremely fast. It yields the XOR stream extremely quickly when successful.

Cons

- Setup to execute the attack is more subject to the device drivers. For example, Atheros does not generate the correct packets unless the wireless card is set to the mac address you are spoofing.

- You need to be physically closer to the access point since if any packets are lost then the attack fails.

Chopchop

Pro

- May work where frag does not work.

Cons

- Cannot be used against every access point.

- The maximum XOR bits is limited to the length of the packet you chopchop against.

- Much slower then the fragmentation attack.

## AUTHOR
This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
airbase-ng(8)

airmon-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

airtun-ng(8)

besside-ng(8)

easside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airventriloquist(8)


airmon-ng

title: airmon-ng(8)

text:
# airmon-ng(8)

## NAME
airmon-ng - POSIX sh script designed to turn wireless cards into monitor mode.

## SYNOPSIS
airmon-ng <start|stop> <interface> [channel] airmon-ng <check> [kill]

## DESCRIPTION
airmon-ng This script can be used to enable monitor mode on wireless interfaces. It may also be used to go back from monitor mode to managed mode. Entering the airmon-ng command without parameters will show the interfaces status. It can also list/kill programs that can interfere with the wireless card operation.

## OPTIONAL PARAMETERS
start <interface> [channel]

Enable monitor mode on an interface (and specify a channel). Note: Madwifi-ng is a special case, 'start' has to be used on wifi interfaces and 'stop' on ath interfaces.

stop <interface>

Disable monitor mode and go back to managed mode (except for madwifi-ng where it kills the ath VAP).

check [kill]

List all possible programs that could interfere with the wireless card. If 'kill' is specified, it will try to kill all of them.

--verbose

This flag must precede start/stop/check and can be combined with other parameters or used alone. This flag will increase the verbosity to provide additional useful information which may not be needed for normal operation.

--debug

This flag must precede start/stop/check and can be combined with other parameters or used alone. This flag will increase the verbosity to debug level to assist in troubleshooting errors in airmon-ng. Use this flag when opening a bug, but only use --verbose when requesting support in irc.

--elite

WARNING: DO NOT USE: This flag must precede start or stop and will prevent airmon-ng from removing interfaces. WARNING: Use of this flag will immediately disqualify receiving any support from the aircrack-ng team, due to the fact that this behavior is known to be broken. WARNING!

## AUTHOR
This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others). And modified to fit airmon-ng by David Francos Cuartero <xayon@xayon.net>. Most recently modified by Zero_Chaos to update for the airmon-zc rewrite. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
airbase-ng(8)

aireplay-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

airtun-ng(8)

besside-ng(8)

easside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)