userdel

title: userdel(8)

summary: delete a user account and related files

text:
# userdel(8)

## NAME
userdel - delete a user account and related files

## SYNOPSIS
userdel [options] LOGIN

## DESCRIPTION
The userdel command modifies the system account files, deleting all entries that refer to the user name LOGIN. The named user must exist.

## OPTIONS
The options which apply to the userdel command are:

-f, --force

This option forces the removal of the user account, even if the user is still logged in. It also forces userdel to remove the user's home directory and mail spool, even if another user uses the same home directory or if the mail spool is not owned by the specified user. If USERGROUPS_ENAB is defined to yes in /etc/login.defs and if a group exists with the same name as the deleted user, then this group will be removed, even if it is still the primary group of another user. Note: This option is dangerous and may leave your system in an inconsistent state.

-h, --help

Display help message and exit.

-r, --remove

Files in the user's home directory will be removed along with the home directory itself and the user's mail spool. Files located in other file systems will have to be searched for and deleted manually. The mail spool is defined by the MAIL_DIR variable in the login.defs file.

-R, --root CHROOT_DIR

Apply changes in the CHROOT_DIR directory and use the configuration files from the CHROOT_DIR directory.

-Z, --selinux-user

Remove any SELinux user mapping for the user's login.

## CONFIGURATION
The following configuration variables in /etc/login.defs change the behavior of this tool:

MAIL_DIR (string)

The mail spool directory. This is needed to manipulate the mailbox when its corresponding user account is modified or deleted. If not specified, a compile-time default is used.

MAIL_FILE (string)

Defines the location of the users mail spool files relatively to their home directory.

The MAIL_DIR and MAIL_FILE variables are used by useradd, usermod, and userdel to create, move, or delete the user's mail spool.

MAX_MEMBERS_PER_GROUP (number)

Maximum members per group entry. When the maximum is reached, a new group entry (line) is started in /etc/group (with the same name, same password, and same GID). The default value is 0, meaning that there are no limits in the number of members in a group.

This feature (split group) permits to limit the length of lines in the group file. This is useful to make sure that lines for NIS groups are not larger than 1024 characters.

If you need to enforce such limit, you can use 25.

Note: split groups may not be supported by all tools (even in the Shadow toolsuite). You should not use this variable unless you really need it.

TCB_SYMLINKS (boolean)

If yes, the location of the user tcb directory to be created will not be automatically set to /etc/tcb/user, but will be computed depending on the UID of the user, according to the following algorithm:

```
if ( UID is less than 1000) {

  use /etc/tcb/user
} else if ( UID is less than 1000000) {

  kilos = UID / 1000

  use /etc/tcb/:kilos/user

  make symlink /etc/tcb/user to the above directory
} else {

  megas = UID / 1000000

  kilos = ( UID / megas * 1000000 ) / 1000

  use /etc/tcb/:megas/:kilos/user

  make symlink /etc/tcb/user to the above directory
}

```

USE_TCB (boolean)

If yes, the tcb(5) password shadowing scheme will be used.

USERDEL_CMD (string)

If defined, this command is run when removing a user. It should remove any at/cron/print jobs etc. owned by the user to be removed (passed as the first argument). The return code of the script is not taken into account.

Here is an example script, which removes the user's cron, at and print jobs:

```
#! /bin/sh
# Check for the required argument.
if [ $# != 1 ]; then
	echo "Usage: $0 username"
	exit 1
fi
# Remove cron jobs.
crontab -r -u $1
# Remove at jobs.
# Note that it will remove any jobs owned by the same UID,
# even if it was shared by a different username.
AT_SPOOL_DIR=/var/spool/cron/atjobs
find $AT_SPOOL_DIR -name "[^.]*" -type f -user $1 -delete \;
# Remove print jobs.
lprm $1
# All done.
exit 0

```

USERGROUPS_ENAB (boolean)

If set to yes, userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user.

## FILES
/etc/group

Group account information.

/etc/login.defs

Shadow password suite configuration.

/etc/passwd

User account information.

/etc/shadow

Secure user account information.

/etc/subgid

Per user subordinate group IDs.

/etc/subuid

Per user subordinate user IDs.

## EXIT VALUES
The userdel command exits with the following values:

0

success

1

can't update password file

2

invalid command syntax

6

specified user doesn't exist

8

user currently logged in

10

can't update group file

12

can't remove home directory

## CAVEATS
userdel will not allow you to remove an account if there are running processes which belong to this account. In that case, you may have to kill those processes or lock the user's password or account and remove the account later. The -f option can force the deletion of this account.

You should manually check all file systems to ensure that no files remain owned by this user.

You may not remove any NIS attributes on a NIS client. This must be performed on the NIS server.

If USERGROUPS_ENAB is defined to yes in /etc/login.defs, userdel will delete the group with the same name as the user. To avoid inconsistencies in the passwd and group databases, userdel will check that this group is not used as a primary group for another user, and will just warn without deleting the group otherwise. The -f option can force the deletion of this group.

## SEE ALSO
chfn(1), chsh(1), passwd(1), login.defs(5), gpasswd(8), groupadd(8), groupdel(8), groupmod(8), subgid(5), subuid(5), useradd(8), usermod(8).


usermod

package: shadow-utils

title: usermod(8)

summary: modify a user account

text:
# usermod(8)

## NAME
usermod - modify a user account

## SYNOPSIS
usermod [options] LOGIN

## DESCRIPTION
The usermod command modifies the system account files to reflect the changes that are specified on the command line.

## OPTIONS
The options which apply to the usermod command are:

-a, --append

Add the user to the supplementary group(s). Use only with the -G option.

-c, --comment COMMENT

The new value of the user's password file comment field. It is normally modified using the chfn(1) utility.

-d, --home HOME_DIR

The user's new login directory. If the -m option is given, the contents of the current home directory will be moved to the new home directory, which is created if it does not already exist.

-e, --expiredate EXPIRE_DATE

The date on which the user account will be disabled. The date is specified in the format YYYY-MM-DD. An empty EXPIRE_DATE argument will disable the expiration of the account.

This option requires a /etc/shadow file. A /etc/shadow entry will be created if there were none.

-f, --inactive INACTIVE

The number of days after a password expires until the account is permanently disabled. A value of 0 disables the account as soon as the password has expired, and a value of -1 disables the feature.

This option requires a /etc/shadow file. A /etc/shadow entry will be created if there were none.

-g, --gid GROUP

The group name or number of the user's new initial login group. The group must exist. Any file from the user's home directory owned by the previous primary group of the user will be owned by this new group.

The group ownership of files outside of the user's home directory must be fixed manually.

-G, --groups GROUP1[,GROUP2,...[,GROUPN]]]

A list of supplementary groups which the user is also a member of. Each group is separated from the next by a comma, with no intervening whitespace. The groups are subject to the same restrictions as the group given with the -g option. If the user is currently a member of a group which is not listed, the user will be removed from the group. This behaviour can be changed via the -a option, which appends the user to the current supplementary group list.

-l, --login NEW_LOGIN

The name of the user will be changed from LOGIN to NEW_LOGIN. Nothing else is changed. In particular, the user's home directory or mail spool should probably be renamed manually to reflect the new login name.

-L, --lock

Lock a user's password. This puts a '!' in front of the encrypted password, effectively disabling the password. You can't use this option with -p or -U. Note: if you wish to lock the account (not only access with a password), you should also set the EXPIRE_DATE to 1.

-m, --move-home

Move the content of the user's home directory to the new location. This option is only valid in combination with the -d (or --home) option.

usermod will try to adapt the ownership of the files and to copy the modes, ACL and extended attributes, but manual changes might be needed afterwards.

-o, --non-unique

When used with the -u option, this option allows to change the user ID to a non-unique value.

-p, --password PASSWORD

The encrypted password, as returned by crypt(3). Note: This option is not recommended because the password (or encrypted password) will be visible by users listing the processes.

The password will be written in the local /etc/passwd or /etc/shadow file. This might differ from the password database configured in your PAM configuration.

You should make sure the password respects the system's password policy.

-R, --root CHROOT_DIR

Apply changes in the CHROOT_DIR directory and use the configuration files from the CHROOT_DIR directory.

-s, --shell SHELL

The name of the user's new login shell. Setting this field to blank causes the system to select the default login shell.

-u, --uid UID

The new numerical value of the user's ID. This value must be unique, unless the -o option is used. The value must be non-negative.

The user's mailbox, and any files which the user owns and which are located in the user's home directory will have the file user ID changed automatically.

The ownership of files outside of the user's home directory must be fixed manually.

No checks will be performed with regard to the UID_MIN, UID_MAX, SYS_UID_MIN, or SYS_UID_MAX from /etc/login.defs.

-U, --unlock

Unlock a user's password. This removes the '!' in front of the encrypted password. You can't use this option with -p or -L. Note: if you wish to unlock the account (not only access with a password), you should also set the EXPIRE_DATE (for example to 99999, or to the EXPIRE value from /etc/default/useradd).

-v, --add-subuids FIRST-LAST

Add a range of subordinate uids to the user's account. This option may be specified multiple times to add multiple ranges to a users account.

No checks will be performed with regard to SUB_UID_MIN, SUB_UID_MAX, or SUB_UID_COUNT from /etc/login.defs.

-V, --del-subuids FIRST-LAST

Remove a range of subordinate uids from the user's account. This option may be specified multiple times to remove multiple ranges to a users account. When both --del-subuids and --add-subuids are specified, the removal of all subordinate uid ranges happens before any subordinate uid range is added.

No checks will be performed with regard to SUB_UID_MIN, SUB_UID_MAX, or SUB_UID_COUNT from /etc/login.defs.

-w, --add-subgids FIRST-LAST

Add a range of subordinate gids to the user's account. This option may be specified multiple times to add multiple ranges to a users account.

No checks will be performed with regard to SUB_GID_MIN, SUB_GID_MAX, or SUB_GID_COUNT from /etc/login.defs.

-W, --del-subgids FIRST-LAST

Remove a range of subordinate gids from the user's account. This option may be specified multiple times to remove multiple ranges to a users account. When both --del-subgids and --add-subgids are specified, the removal of all subordinate gid ranges happens before any subordinate gid range is added.

No checks will be performed with regard to SUB_GID_MIN, SUB_GID_MAX, or SUB_GID_COUNT from /etc/login.defs.

-Z, --selinux-user SEUSER

The new SELinux user for the user's login. A blank SEUSER will remove the SELinux user mapping for user LOGIN (if any).

## CAVEATS
You must make certain that the named user is not executing any processes when this command is being executed if the user's numerical user ID, the user's name, or the user's home directory is being changed. usermod checks this on Linux. On other platforms it only uses utmp to check if the user is logged in.

You must change the owner of any crontab files or at jobs manually.

You must make any changes involving NIS on the NIS server.

## CONFIGURATION
The following configuration variables in /etc/login.defs change the behavior of this tool:

MAIL_DIR (string)

The mail spool directory. This is needed to manipulate the mailbox when its corresponding user account is modified or deleted. If not specified, a compile-time default is used.

MAIL_FILE (string)

Defines the location of the users mail spool files relatively to their home directory.

The MAIL_DIR and MAIL_FILE variables are used by useradd, usermod, and userdel to create, move, or delete the user's mail spool.

MAX_MEMBERS_PER_GROUP (number)

Maximum members per group entry. When the maximum is reached, a new group entry (line) is started in /etc/group (with the same name, same password, and same GID). The default value is 0, meaning that there are no limits in the number of members in a group.

This feature (split group) permits to limit the length of lines in the group file. This is useful to make sure that lines for NIS groups are not larger than 1024 characters.

If you need to enforce such limit, you can use 25.

Note: split groups may not be supported by all tools (even in the Shadow toolsuite). You should not use this variable unless you really need it.

SUB_GID_MIN (number), SUB_GID_MAX (number), SUB_GID_COUNT (number)

If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate group IDs) allocate SUB_GID_COUNT unused group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each new user. The default values for SUB_GID_MIN, SUB_GID_MAX, SUB_GID_COUNT are respectively 100000, 600100000 and 10000.

SUB_UID_MIN (number), SUB_UID_MAX (number), SUB_UID_COUNT (number)

If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs) allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. The default values for SUB_UID_MIN, SUB_UID_MAX, SUB_UID_COUNT are respectively 100000, 600100000 and 10000.

TCB_SYMLINKS (boolean)

If yes, the location of the user tcb directory to be created will not be automatically set to /etc/tcb/user, but will be computed depending on the UID of the user, according to the following algorithm:

```
if ( UID is less than 1000) {

  use /etc/tcb/user
} else if ( UID is less than 1000000) {

  kilos = UID / 1000

  use /etc/tcb/:kilos/user

  make symlink /etc/tcb/user to the above directory
} else {

  megas = UID / 1000000

  kilos = ( UID / megas * 1000000 ) / 1000

  use /etc/tcb/:megas/:kilos/user

  make symlink /etc/tcb/user to the above directory
}

```

USE_TCB (boolean)

If yes, the tcb(5) password shadowing scheme will be used.

## FILES
/etc/group

Group account information.

/etc/gshadow

Secure group account information.

/etc/login.defs

Shadow password suite configuration.

/etc/passwd

User account information.

/etc/shadow

Secure user account information.

/etc/subgid

Per user subordinate group IDs.

/etc/subuid

Per user subordinate user IDs.

## SEE ALSO
chfn(1), chsh(1), passwd(1), crypt(3), gpasswd(8), groupadd(8), groupdel(8), groupmod(8), login.defs(5), subgid(5), subuid(5), useradd(8), userdel(8).


shadowsocks-libev

package: shadowsocks-libev

title: shadowsocks-libev(8)

summary: a lightweight and secure socks5 proxy

text:
# shadowsocks-libev(8)

## NAME
shadowsocks-libev - a lightweight and secure socks5 proxy

## SYNOPSIS
ss-local|ss-redir|ss-server|ss-tunnel|ss-manager [-s <server_host>] [-p <server_port>] [-l <local_port>] [-k <password>] [-m <encrypt_method>] [-f <pid_file>] [-t <timeout>] [-c <config_file>]

## DESCRIPTION
Shadowsocks-libev is a lightweight and secure socks5 proxy. It is a port of the original shadowsocks created by clowwindy. Shadowsocks-libev is written in pure C and takes advantage of libev to achieve both high performance and low resource consumption.

Shadowsocks-libev consists of five components. One is ss-server(1) that runs on a remote server to provide secured tunnel service. ss-local(1) and ss-redir(1) are clients on your local machines to proxy traffic(TCP/UDP or both). ss-tunnel(1) is a tool for local port forwarding.

While ss-local(1) works as a standard socks5 proxy, ss-redir(1) works as a transparent proxy and requires netfilter’s NAT module. For more information, check out the EXAMPLE section.

ss-manager(1) is a controller for multi-user management and traffic statistics, using UNIX domain socket to talk with ss-server(1). Also, it provides a UNIX domain socket or IP based API for other software. About the details of this API, please refer to the PROTOCOL section.

## OPTIONS
-s <server_host>

Set the server’s hostname or IP.

-l <local_port>

Set the local port number. Not available in server nor manager mode.

-k <password>, --password <password>

Set the password. The server and the client should use the same password.

--key <key_in_base64>

Set the key directly. The key should be encoded with URL-safe Base64. Not available in manager mode.

-m <encrypt_method>

Set the cipher. Shadowsocks-libev accepts 19 different ciphers:

aes-128-gcm, aes-192-gcm, aes-256-gcm, rc4-md5, aes-128-cfb, aes-192-cfb, aes-256-cfb, aes-128-ctr, aes-192-ctr, aes-256-ctr, bf-cfb, camellia-128-cfb, camellia-192-cfb, camellia-256-cfb, chacha20-ietf-poly1305, xchacha20-ietf-poly1305, salsa20, chacha20 and chacha20-ietf.

The default cipher is chacha20-ietf-poly1305.

If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may not work.

-a <user_name>

Run as a specific user.

-f <pid_file>

Start shadowsocks as a daemon with specific pid file.

-t <timeout>

Set the socket timeout in seconds. The default value is 60.

-c <config_file>

Use a configuration file.

-n <number>

Specify max number of open files. Not available in manager mode.

Only available on Linux.

-i <interface>

Send traffic through specific network interface. For example, there are three interfaces in your device, which is lo (127.0.0.1), eth0 (192.168.0.1) and eth1 (192.168.0.2). Meanwhile, you configure shadowsocks-libev to listen on 0.0.0.0:8388 and bind to eth1. That results the traffic go out through eth1, but not lo nor eth0. This option is useful to control traffic in multi-interface environment.

Not available in redir mode.

-b <local_address>

Specify the local address to bind. For servers: Specify the local address to use while this server is making outbound connections to remote servers on behalf of the clients.

For clients: Specify the local address to use while this client is making outbound connections to the server.

Not available in manager mode.

-u

Enable UDP relay. TPROXY is required in redir mode. You may need root permission.

-U

Enable UDP relay and disable TCP relay. Not available in local mode.

-T

Use tproxy instead of redirect (for tcp). Only available in redir mode.

-L <addr:port>

Specify destination server address and port for local port forwarding. Only available in tunnel mode.

-d <addr>

Setup name servers for internal DNS resolver (libc-ares). The default server is fetched from /etc/resolv.conf. Only available in server and manager mode.

--fast-open

Enable TCP fast open. Not available in redir nor tunnel mode, with Linux kernel > 3.7.0.

--reuse-port

Enable port reuse. Only available with Linux kernel > 3.9.0.

--no-delay

Enable TCP_NODELAY.

--acl <acl_config>

Enable ACL (Access Control List) and specify config file. Not available in redir nor tunnel mode.

--manager-address <path_to_unix_domain>

Specify UNIX domain socket address. Only available in server and manager mode.

--executable <path_to_server_executable>

Specify the executable path of ss-server. Only available in manager mode.

-v

Enable verbose mode.

-h|--help

Print help message.

## CONFIG FILE
The config file is written in JSON and easy to edit.

The config file equivalent of command line options is listed as example below.

Command line

JSON

-s some.server.net

"server": "some.server.net"

-s some.server.net -p 1234 (client)

"server": "some.server.net:1234"

-p 1234

"server_port": "1234"

-b 0.0.0.0

"local_address": "0.0.0.0"

-b 10.0.0.2

"local_ipv4_address": "10.0.0.2"

-b 2620:129:35::33

"local_ipv6_address": "2620:129:35::33"

-l 4321

"local_port": "4321"

-k "PasSworD"

"password": "PasSworD"

-m "aes-256-cfb"

"method": "aes-256-cfb"

-t 60

"timeout": 60

-a nobody

"user": "nobody"

--acl "/path/to/acl"

"acl": "/path/to/acl"

--fast-open

"fast_open": true

--reuse-port

"reuse_port": true

--no-delay

"no_delay": true

--plugin "obfs-server"

"plugin": "obfs-server"

--plugin-opts "obfs=http"

"plugin_opts": "obfs=http"

-6

"ipv6_first": true

-n "/etc/nofile"

"nofile": "/etc/nofile"

-d "8.8.8.8"

"nameserver": "8.8.8.8"

-L "somedns.net:53"

"tunnel_address": "somedns.net:53"

-u

"mode": "tcp_and_udp"

-U

"mode": "udp_only"

no "-u" nor "-U" options (default)

"mode": "tcp_only"

-T

"tcp_tproxy": true

(only in ss-manager’s config)

"port_password": {"1234":"PasSworD"}

## EXAMPLE
ss-redir requires netfilter’s NAT function. Here is an example:

```
# Create new chain
iptables -t nat -N SHADOWSOCKS
iptables -t mangle -N SHADOWSOCKS
# Ignore your shadowsocks server's addresses
# It's very IMPORTANT, just be careful.
iptables -t nat -A SHADOWSOCKS -d 123.123.123.123 -j RETURN
# Ignore LANs and any other addresses you'd like to bypass the proxy
# See Wikipedia and RFC5735 for full list of reserved networks.
# See ashi009/bestroutetb for a highly optimized CHN route list.
iptables -t nat -A SHADOWSOCKS -d 0.0.0.0/8 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 169.254.0.0/16 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 192.168.0.0/16 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 224.0.0.0/4 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 240.0.0.0/4 -j RETURN
# Anything else should be redirected to shadowsocks's local port
iptables -t nat -A SHADOWSOCKS -p tcp -j REDIRECT --to-ports 12345
# Add any UDP rules
ip rule add fwmark 0x01/0x01 table 100
ip route add local 0.0.0.0/0 dev lo table 100
iptables -t mangle -A SHADOWSOCKS -p udp --dport 53 -j TPROXY --on-port 12345 --tproxy-mark 0x01/0x01
# Apply the rules
iptables -t nat -A PREROUTING -p tcp -j SHADOWSOCKS
iptables -t mangle -A PREROUTING -j SHADOWSOCKS
# Start the shadowsocks-redir
ss-redir -u -c /etc/config/shadowsocks.json -f /var/run/shadowsocks.pid
```

## PROTOCOL
ss-manager(1) provides several APIs through UDP protocol

Send UDP commands in the following format to the manager-address provided to ss-manager(1):

command: [JSON data]

To add a port:

add: {"server_port": 8001, "password":"7cd308cc059"}

To remove a port:

remove: {"server_port": 8001}

To receive a pong:

ping

Then ss-manager(1) will send back the traffic statistics:

stat: {"8001":11370}

## SEE ALSO
ss-local(1), ss-server(1), ss-tunnel(1), ss-redir(1), ss-manager(1), iptables(8), /etc/shadowsocks-libev/config.json


shake

package: shake

title: shake(8)

text:
# shake(8)

## NAME
Shake - Rewrite fragmented files, maybe improving performance.

## SYNOPSIS
shake [OPTION]... [FILE|DIRECTORY]...

## DESCRIPTION
Rewrite fragmented or misplaced files, maybe improving performance. Reads file list from standard input if there is no files in the arguments. You have to mount your partition with the user_xattr option.

-c, --max-crumbc

max number of crumbs

-C, --max-fragc

max number of fragments

-d, --max-deviance

max distance between file start and it's ideal position

-h, --help

you're looking at me !

-L, --no-locks

don't put a lock on written files

-m, --many-fs

shake subdirectories that are on different filesystems

-n, --new

age of "new" files, which will be shak()ed

-o, --old

age of "old" files, which won't be shak()ed

-p, --pretend

don't alter files

-r, --crumbratio

ratio of the file under which a fragment is a crumb

-s, --smallsize

the size under which a file is considered small

-S, --bigsize

the size under which a file is considered big

-t, --small-tolerance multiply crumbratio and divide maxfnumber of small files

-T, --big-tolerance

multiply crumbratio and divide maxfnumber of big files

-v, --verbose

increase the verbosity level

-V, --version

show version number and copyright

-X, --no-xattr

disable usage of xattr

## USAGE
If there is no FILES shake read from stdin.

Please refer to http://vleu.net/shake/ for detailed instructions.

## EXAMPLES
See fragmention of a file :

shake --pretend --verbose --verbose FILE

Shake all file in a dir, recursively :

shake --old=0 DIR

Shake all mp3 in subdirectory, puting together those close in lexical order :

find -iname '*.mp3' | sort | shake

## REPORTING BUGS
Report bugs to <brice.arnould+shake@gmail.com> or at https://github.com/unbrice/shake/issues

## COPYRIGHT
Copyright (C) 2006-2009 Brice Arnould. Permission is granted to copy, distribute and/or modify documentation under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the file FDL.txt .

Copyright © 2006-2011 Brice Arnould. Shake comes with ABSOLUTELY NO WARRANTY. You may redistribute copies of Shake under the terms of the GNU General Public License version or greater. For more information about these matters, see the file named GPL.txt.


unattr

title: unattr(8)

text:
# unattr(8)

## NAME
Unattr - remove choosen xattr from files, recursively.

## SYNOPSIS
unattr [OPTION]... <FILE|DIRECTORY>...

## DESCRIPTION
Remove choosen xattr from files, recursively.

-a, --attr

specify the name of a new attribute

-h, --help

help

-V, --version

show version number and copyright

## EXAMPLES
Remove shake xattrs :

unattr --attr=shake.ptime FILES

Remove beagle xattrs :

unattr -a Beagle.MTime -a Beagle.AttrTime -a Beagle.Fingerprint -a Beagle.Uid FILES

## REPORTING BUGS
Report bugs to <brice.arnould+shake@gmail.com> or at https://github.com/unbrice/shake/issues

## COPYRIGHT
Copyright (C) 2006-2009 Brice Arnould. Permission is granted to copy, distribute and/or modify documentation under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the file FDL.txt .

Copyright © 2006-2008 Brice Arnould. Unattr comes with ABSOLUTELY NO WARRANTY. You may redistribute copies of Unattr under the terms of the GNU General Public License. For more information about these matters, see the file named GPL.txt.


shapercontrol

package: shapercontrol

title: shapercontrol(8)

text:
# shapercontrol(8)

## NAME
shaperconrol - administration tool for ISP traffic shaper

## SYNOPSIS
shaperconrol [options] command [ip] [rate]

## DESCRIPTION
sc(8) is a command-line tool intended to simplify administration of traffic shaper for Internet service providers.

### Main features

- Fast loading of large rulesets.

- Effective traffic classification with u32 hashing filters.

- Loading of data from any relational database supported by Perl DBI module.

- Synchronization of rules with database.

- Batch command execution mode for scripting purposes.

- Support of different traffic limiting methods: shaping, policing, and hybrid.

## DEPENDENCIES
DBI and corresponding database-dependent module (e.g. DBD::Pg for PostgreSQL, DBD::SQLite for SQLite, etc), AppConfig, Carp, Getopt::Long, Pod::Usage, Sys::Syslog, Term::ANSIColor.

## PREREQUISITES

### Command-line tools
tc(8) from iproute2 suite.

### Linux kernel configuration

- u32 classifier (option CONFIG_NET_CLS_U32=m or y)

- Traffic control actions (CONFIG_NET_CLS_ACT=y and CONFIG_NET_ACT_GACT=m or y)

## COREQUISITES
If you prefer policing as a rate limiting method, you should enable the kernel option CONFIG_NET_ACT_POLICE.

## COMMANDS
add <ip> <rate>

Add rules for specified IP

calc [ip]

Calculate and print internally used variables: classids, hash table numbers and keys.

change | mod <ip> <rate>

Change rate for specified IP

dbadd <ip> <rate>

Add database entry

dbchange | dbmod <ip> <rate>

Change database entry

dbcreate

Create database and table

dbdel | dbrm <ip>

Delete database entry

dblist | dbls [ip]

List database entries. If no IP specified, all entries are listed.

del | rm <ip>

Delete rules

help

Show help for commands, options and list available database drivers. Generate and show manpage if -v 1 option is specified.

init

Initialization of firewall and QoS rules. Should be used only for manual rule editing.

list | ls [ip]

List rules in a short and human-readable form. If no IP specified, all entries are listed.

load | start

Load IPs and rates from database and create ruleset

ratecvt <rate> <unit>

Convert rate from one unit to another

reload | restart

Reset rules and load database

reset | stop

Delete all shaping rules

show [ip]

Show rules explicitly. If no IP specified, all entries are listed.

status

Show status of shaping rules

sync

Synchronize rules with database

version

Output version

## OPTIONS
-f, --config file

Read configuration from specified file

-o, --out_if if_name

Name of output network interface

-i, --in_if if_name

Name of input network interface

-d, --debug mode

Possible values:

0

no debug (default value),

1

print command lines with nonzero return values,

2

print all command lines without execution.

-v, --verbose mode

Possible values:

0

no verbose messages (default)

1

enable verbose messages (i.e. for results of `sync' command)

2

disable usage of tc(8) batch rule loading

3

do 1 + 2

-q, --quiet

Suppress output of error messages from tc(8).

-c, --colored

Colorize the output.

-C, --cid classid

Use the specified classid value in add, change and del commands instead of automatically calculated.

-j, --joint

Joint mode. Add, change and del commands will be applied to rules and database entries simultaneously.

-b, --batch

Batch mode. Commands and options will be read from STDIN.

-N, --network "net/mask ..."

Networks for IP to classid mapping (see sc.conf(5) for details).

--filter_network "net/mask ..."

Networks for hashing filter generation (see sc.conf(5) for details).

--bypass_int "net/mask ..."

Internal networks, whose traffic is transmitted without shaping.

--bypass_ext "net/mask ..."

External networks, whose traffic is transmitted without shaping.

--policer_burst_ratio real number

Ratio between the size of policer buffer size and bandwidth rate.

--quantum size

Amount of bytes a stream is allowed to dequeue before the next queue gets a turn.

-u, --rate_unit unit

Default rate unit

-r, --rate_ratio real number

Ratio between bandwidth rates in rules and in the database. Used only for load and sync commands.

-R, --root_qdisc string

Root qdisc ("htb" or "hfsc").

-L, --leaf_qdisc string

Leaf qdisc and parameters.

--db_driver name

Database driver.

--db_host host:port

Database server address or hostname.

--db_name name

Database name to use.

--db_user name

Database username.

--db_pass password

Database password. Remember that it is insecure to specify a password here.

-S, --syslog_enable

Send errors and warnings to syslog.

## RATE UNITS
All rates should be specified as integer numbers, possibly followed by a unit. Bare number implies the default unit (kibit). You may use another unit by changing "rate_unit" parameter in the configuration file or by setting the similar command line option.

bit

bit per second

kibit, Kibit

kibibit per second (1024)

kbit or Kbit

kilobit per second (1000)

mibit or Mibit

mebibit per second (1 048 576)

mbit or Mbit

megabit per second (10^6)

gibit or Gibit

gibibit per second (1 073 741 824)

gbit or Gbit

gigabit per second (10^9)

bps or Bps

byte per second

kibps or KiBps

kibibyte per second

kbps or KBps

kilobyte per second

mibps or MiBps

mebibyte per second

mbps or MBps

megabyte per second

gibps or GiBps

gibibyte per second

gbps or GBps

gigabyte per second

## USAGE
Load accounts from database and create all rules

"sc load" or "sc start"

Add class for IP 172.16.0.1 with 256kibit/s.

"sc add 172.16.0.1 256kibit"

Change rate to 512kibit/s

"sc change 172.16.0.1 512kibit"

Delete rules for 172.16.0.1

"sc del 172.16.0.1"

Reset all rules

"sc reset"

## CONFIGURATION
By default shaperconrol reads configuration from /etc/sc/sc.conf file and uses SQLite database at /etc/sc/sc.db. See sc.conf(5) for details.

## DIAGNOSTICS
The error messages are printed to standard error. To print the command lines that return nonzero error codes, use -d 1 option. To print all generated command lines without execution, use -d 2 option. To disable the usage of the batch mode of tc(8), use -v 2 option. For more information please read the section OPTIONS.

Program may return one of the following exit codes or the exit code of the failed command line that aborted the execution:

0

correct functioning

1

incorrect parameter

2

IP-to-classid collision

3

parameter is undefined

4

IP already exists

5

IP does not exist

6

incorrect command

7

insufficient privileges

## BUGS
For performance reasons, script does not perform checks that require additional executions of external programs.

## RESTRICTIONS
Due to limited number of classids (from 2 to ffff) you can create only 65534 classes on a single interface. For similar reasons sc(8) only supports networks with masks from /16 to /31.

For simplicity of u32 hash table numbers calculation, the maximum number of entries in "filter_network" parameter is 255, and the number of hashing filters is limited by 0x7ff.

## SEE ALSO
sc.conf(5), tc(8), tc-htb(8), tc-hfsc(8), Getopt::Long(3), AppConfig(3), http://lartc.org/howto/lartc.adv-filter.hashing.html, http://ace-host.stuart.id.au/russell/files/tc/doc/cls_u32.txt.

## AUTHOR
Stanislav Kruchinin <stanislav.kruchinin@gmail.com>

## LICENSE AND COPYRIGHT
Copyright (c) 2008-2014. Stanislav Kruchinin.

License: GNU GPL version 2 or later

This is free software: you are free to change and redistribute it. There is NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.


shorewall-init

package: shorewall

title: shorewall-init(8)

summary: Companion package

text:
# shorewall-init(8)

## NAME
shorewall-init - Companion package

## SYNOPSIS
/etc/init.d/shorewall-init [start|stop]

## DESCRIPTION
Shorewall-init is an optional package (added in Shorewall 4.4.10) that can be installed along with Shorewall, Shorewall6, Shorewall-lite and/or Shorewall6-lite. It provides two key features:

1.It can close (stop) the firewall during boot prior to starting the network. This can prevent unwanted connections from being accepted after the network comes up but before the firewall is started.

2.It can interface with your distribution's ifup/ifdown scripts and/or NetworkManager to allow firewall actions when an interface starts or stops.

These two capabilities can be enabled separately.

After you install the shorewall-init package, you can activate it by modifying the Shorewall-init configuration file:

•On Debian-based system, the file is /etc/default/shorewall-init.

•On other systems, the file is /etc/sysconfig/shorewall-init.

To activate the safe boot feature, edit the configuration file and set PRODUCTS to a space-separated list of Shorewall products that you want to be closed before networking starts.

Example:

PRODUCTS="shorewall shorewall6"

You also must insure that the compiled scripts for the listed products are compiled using Shorewall 4.4.10 or later.

Shorewall

shorewall compile

Shorewall6

shorewall6 compile

Shorewall-lite

On the administrative system, enter the command shorewall export firewall from the firewall's configuration directory.

Shorewall6-lite

On the administrative system, enter the command shorewall6 export firewall from the firewall's configuration directory.

The second feature (ifup/ifdown and NetworkManager integration) should only be activated on systems that do not use a link status monitor line swping or LSM.

•Edit the configuration file and set IFUPDOWN=1

For NetworkManager integration, you will want to disable firewall startup at boot and delay it to when your interface comes up. For this to work correctly, you must set the required or the optional option on at least one interface then:

•On Debian-based systems, edit /etc/default/product for each product listed in the PRODUCTS setting and set startup=0.

•On other systems, use the distribution's service control tool (insserv, chkconfig, etc.) to disable startup of the products listed in the PRODUCTS setting.

On a laptop with both Ethernet and wireless interfaces, you will want to make both interfaces optional and set the REQUIRE_INTERFACE option to Yes in shorewall.conf[1](5) or shorewall6.conf[2] (5). This causes the firewall to remain stopped until at least one of the interfaces comes up.

## FILES
/etc/default/shorewall-init (Debian-based systems) or /etc/sysconfig/shorewall-init (other distributions)

## SEE ALSO
shorewall(8)

## NOTES
1.

shorewall.conf

http://www.shorewall.net/manpages/shorewall.conf.html

2.

shorewall6.conf

http://www.shorewall.net/manpages6/shorewall6.conf.html


shorewall

package: shorewall-core

title: shorewall(8)

text:
# shorewall(8)

## NAME
shorewall - Administration tool for Shoreline Firewall (Shorewall)

## SYNOPSIS
shorewall[6][-lite] [trace|debug [nolock]] [options] add { interface[:host-list]... zone | zone host-list }

shorewall[6][-lite] [trace|debug [nolock]] [options] allow address

shorewall[6][-lite] [trace|debug [nolock]] [options] blacklist address [option ...]

shorewall[6][-lite] [trace|debug [nolock]] [options] call function [parameter ...]

shorewall[6] [trace|debug] [options] [check | ck ] [-e] [-d] [-p] [-r] [-T] [-i] [directory]

shorewall[6][-lite] [trace|debug [nolock]] [options] clear [-f]

shorewall[6][-lite] [trace|debug [nolock]] [options] close { open-number | sourcedest [protocol [ port ]]}

shorewall[6] [trace|debug] [options] [compile | co ] [-e] [-c] [-d] [-p] [-T] [-i] [directory] [pathname]

shorewall[6][-lite] [trace|debug [nolock]] [options] delete { interface[:host-list]... zone | zone host-list }

shorewall[6][-lite] [trace|debug [nolock]] [options] disable { interface | provider }

shorewall[6][-lite] [trace|debug [nolock]] [options] drop address

shorewall[6][-lite] [trace|debug] [options] dump [-x] [-l] [-m] [-c]

shorewall[6][-lite] [trace|debug [nolock]] [options] enable { interface | provider }

shorewall[6] [trace|debug [nolock]] [options] export [directory1] [user@]system[:directory2]

shorewall[6][-lite] [trace|debug [nolock]] [options] forget [filename]

shorewall[6][-lite] [trace|debug] [options] help

shorewall[-lite] [trace|debug] [options] hits [-t]

shorewall[-lite] [trace|debug] [options] ipcalc {address mask | address/vlsm}

shorewall[-lite] [trace|debug] [options] iprange address1-address2

shorewall[6][-lite] [trace|debug] [options] iptrace iptables match expression

shorewall[6][-lite] [trace|debug [nolock]] [options] logdrop address

shorewall[6][-lite] [trace|debug] [options] logwatch [-m] [refresh-interval]

shorewall[6][-lite] [trace|debug [nolock]] [options] logreject address

shorewall[6][-lite] [trace|debug] [options] noiptrace iptables match expression

shorewall[6][-lite] [options] open source dest [ protocol [ port ] ]

shorewall[6][-lite] [trace|debug [nolock]] [options] reenable { interface | provider }

shorewall[6][-lite] [trace|debug [nolock]] [options] reject address

shorewall[6][-lite] [trace|debug [nolock]] [options] reload [-n] [-p [-d]] [-f] [-c] [-T] [-i] [-C] [directory]

shorewall[6] [trace|debug] [options] remote-getcaps [-s] [-R] [-r root-user-name] [-T] [-i] [[-D]directory] [system]

shorewall[6] [trace|debug] [options] remote-getrc [-s] [-c] [-r root-user-name] [-T] [-i] [[-D]directory] [system]

shorewall[6] [trace|debug] [options] remote-start [-s] [-c] [-r root-user-name] [-T] [-i] [[-D]directory] [system]

shorewall[6] [trace|debug] [options] remote-reload [-s] [-c] [-r root-user-name] [-T] [-i] [[-D]directory] [system]

shorewall[6] [trace|debug] [options] remote-restart [-s] [-c] [-r root-user-name] [-T] [-i] [[-D]directory] [system]

shorewall[6][-lite] [trace|debug [nolock]] [options] reset [chain ...]

shorewall[6][-lite] [trace|debug [nolock]] [options] restart [-n] [-p [-d]] [-f] [-c] [-T] [-i] [-C] [directory]

shorewall[6][-lite] [trace|debug [nolock]] [options] restore [-n] [-p] [-C] [filename]

shorewall[6][-lite] [trace|debug [nolock]] [options] run command [parameter ...]

shorewall[6] [trace|debug [nolock]] [options] safe-restart [-d] [-p] [-t timeout] [directory]

shorewall[6] [trace|debug] [options] safe-start [-d] [-p] [-t timeout] [directory]

shorewall[6][-lite] [trace|debug [nolock]] [options] save [-C] [filename]

shorewall[6][-lite] [trace|debug [nolock]] [options] savesets

shorewall[6][-lite] [trace|debug] [options] {show | list | ls } [-x] {bl|blacklists}

shorewall[6][-lite] [trace|debug] [options] {show | list | ls } [-b] [-x] [-l] [-t {filter|mangle|nat|raw}] [chain...]

shorewall[6][-lite] [trace|debug] [options] {show | list | ls } [-f] capabilities

shorewall[6] [options] {show | list | ls } [-f] {actions|macros}

shorewall[6] [trace|debug] [options] {show | list | ls } action action

shorewall[6][-lite] [trace|debug] [options] {show | list | ls } {classifiers|connections|config|events|filters|ip|ipa|ipsec|zones|policies|marks}

shorewall[6][-lite] [trace|debug] [options] {show | list | ls } event event

shorewall[6][-lite] [trace|debug] [options] {show | list | ls } [-c] routing

shorewall[6] [trace|debug] [options] {show | list | ls } macro macro

shorewall[6][-lite] [trace|debug] [options] {show | list | ls } [-x] {mangle|nat|raw}

shorewall[6][-lite] [trace|debug] [options] {show | list | ls } saves

shorewall[6][-lite] [trace|debug] [options] {show | list | ls } [-m] log

shorewall[6][-lite] [trace|debug [nolock]] [options] start [-n] [-f] [-p] [-c] [-T [-i]] [-C] [directory]

shorewall[6][-lite] [trace|debug [nolock]] [options] stop [-f]

shorewall[6][-lite] [trace|debug] [options] status [-i]

shorewall[6] [trace|debug [nolock]] [options] try directory [timeout]

shorewall[6] [trace|debug] [options] update [-b] [-d] [-r] [-T] [-a] [-i] [-A] [directory]

shorewall[6][-lite] [trace|debug] [options] version [-a]

## DESCRIPTION
Beginning with Shorewall 5.1.0, the shorewall utility is used to control the Shoreline Firewall (Shorewall), Shorewall Firewall 6 (Shorewall6), Shorewall Firewall Lite (Shorewall-lite) and Shorewall Firewall 6 Lite (Shorewall6-lite). The utility may be accessed under four different names:

shorewall

Controls the Shorewall configuration when Shorewall is installed. If Shorewall is not installed, the shorewall command controls Shorewall-lite if it is installed. If neither Shorewall nor Shorewall-lite is installed, the shorewall command controls Shorewall6-lite if it is installed.

shorewall6

The shorewall6 command controls Shorewall6 when Shorewall6 is installed.

shorewall-lite

The shorewall-lite command controls Shorewall-lite when Shorewall-lite is installed.

shorewall6-lite

The shorewall6-lite command controls Shorewall6-lite when Shorewall6-lite is installed.

Prior to Shorewall 5.1.0, these four commands were implemented as four separate program, each of which controlled only a single firewall package. This manpage serves to document both the Shorewall 5.1 and Shorewall 5.0 CLI.

## OPTIONS
The trace and debug options are used for debugging. See http://www.shorewall.net/starting_and_stopping_shorewall.htm#Trace[1].

The nolock option prevents the command from attempting to acquire the Shorewall lockfile. It is useful if you need to include shorewall commands in /etc/shorewall/started.

Other options are:

-4

Added in Shorewall 5.1.0. Causes the command to operate on the Shorewall configuration or the Shorewall-lite configuration. It is the default when either of those products is installed and when the command is shorewall or shorewall-lite.

-6

Added in Shorewall 5.1.0. Causes the command to operate on the Shorewall6 or Shorewall6-lite configuration. It is the default when only Shorewall6-lite is installed and when the command is shorewall6 or shorewall6-lite.

-l

Added in Shorewall 5.1.0. Causes the command to operate on either Shorewall-lite or Shorewall-6 lite and is the default when Shorewall is not installed or when the command is shorewall-lite or shorewall6-lite. With all four firewall products (Shorewall, Shorewall6, Shorewall-lite and Shorewall6-lite) installed, the following table shows the correspondence between the name used to invoke the command and the shorewall command with the above three options.

Table 1. All four products installed

The next table shows the correspondence when only Shorewall-lite and Shorewall6-lite are installed.

Table 2. Only Shorewall-lite and Shorewall6-lite installed

-v[verbosity]

Alters the amount of output produced by the command. If neither the -v nor -q option are specified, the amount of output is determined by the VERBOSITY setting in shorewall.conf[2](5) (shorewall6.conf[3](5)). When no verbosity is specified, each instance of this option causes 1 to be added to the effective verbosity. When verbosity (-1,0,1 or 2) is given, the command is executed at the specified VERBOSITY. There may be no white-space between -v and the verbosity.

-q

Alters the amount of output produced by the command. If neither the -v nor -q option are specified, the amount of output is determined by the VERBOSITY setting in shorewall.conf[2](5) (shorewall6.conf[3](5)). Each instance of this option causes 1 to be subtracted from the effective verbosity.

-t

Causes all progress messages to be timestamped.

## COMMANDS
The available commands are listed below.

add { interface[:host-list]... zone | zone host-list }

Adds a list of hosts or subnets to a dynamic zone usually used with VPN's. The interface argument names an interface defined in the shorewall-interfaces[4](5) (shorewall6-interfaces[5](5))file. A host-list is comma-separated list whose elements are host or network addresses..if n .sp

Caution

The add command is not very robust. If there are errors in the host-list, you may see a large number of error messages yet a subsequent shorewall show zones command will indicate that all hosts were added. If this happens, replace add by delete and run the same command again. Then enter the correct command.

Beginning with Shorewall 4.5.9, the dynamic_shared zone option (shorewall-zones[6](5),shorewall6-zones[7](5)) allows a single ipset to handle entries for multiple interfaces. When that option is specified for a zone, the add command has the alternative syntax in which the zone name precedes the host-list.

allow address

Re-enables receipt of packets from hosts previously blacklisted by a blacklist, drop, logdrop, reject, or logreject command.

blacklist address [ option ... ]

Added in Shorewall 5.0.8 and requires DYNAMIC_BLACKLIST=ipset.. in shorewall.conf[2](5). Causes packets from the given host or network address to be dropped, based on the setting of BLACKLIST in shorewall.conf[2](5). The address along with any options are passed to the ipset add command. If the disconnect option is specified in the DYNAMIC_BLACKLISTING setting, then the effective VERBOSITY determines the amount of information displayed:

•If the effective verbosity is > 0, then a message giving the number of conntrack flows deleted by the command is displayed.

•If the effective verbosity is > 1, then the conntrack table entries deleted by the command are also displayed.

call function [ parameter ... ]

Added in Shorewall 4.6.10. Allows you to call a function in one of the Shorewall libraries or in your compiled script. function must name the shell function to be called. The listed parameters are passed to the function. The function is first searched for in lib.base, lib.common, lib.cli and lib.cli-std. If it is not found, the call command is passed to the generated script to be executed.

check [-e] [-d] [-p] [-r] [-T] [-i] [directory]

Not available with Shorewall[6]-lite. Compiles the configuration in the specified directory and discards the compiled output script. If no directory is given, then /etc/shorewall is assumed.

The -e option causes the compiler to look for a file named capabilities. This file is produced using the command shorewall-lite show -f capabilities > capabilities on a system with Shorewall Lite installed.

The -d option causes the compiler to be run under control of the Perl debugger.

The -p option causes the compiler to be profiled via the Perl -wd:DProf command-line option.

The -r option was added in Shorewall 4.5.2 and causes the compiler to print the generated ruleset to standard out.

The -T option was added in Shorewall 4.4.20 and causes a Perl stack trace to be included with each compiler-generated error and warning message.

The -i option was added in Shorewall 4.6.0 and causes a warning message to be issued if the current line contains alternative input specifications following a semicolon (";"). Such lines will be handled incorrectly if INLINE_MATCHES is set to Yes in shorewall.conf[2](5) (shorewall6.conf[3](5)).

clear [-f]

Clear will remove all rules and chains installed by Shorewall. The firewall is then wide open and unprotected. Existing connections are untouched. Clear is often used to see if the firewall is causing connection problems. If -f is given, the command will be processed by the compiled script that executed the last successful start, restart or reload command if that script exists.

close { open-number | source dest [ protocol [ port ] ] }

Added in Shorewall 4.5.8. This command closes a temporary open created by the open command. In the first form, an open-number specifies the open to be closed. Open numbers are displayed in the num column of the output of the shorewall show opens command. When the second form of the command is used, the parameters must match those given in the earlier open command.

This command requires that the firewall be in the started state and that DYNAMIC_BLACKLIST=Yes in shorewall.conf (5)[2].

compile [-e] [-c] [-d] [-p] [-T] [-i] [ directory ] [ pathname ]

Not available with shorewall[6]-lite. Compiles the current configuration into the executable file pathname. If a directory is supplied, Shorewall will look in that directory first for configuration files. If the pathname is omitted, the file firewall in the VARDIR (normally /var/lib/shorewall/) is assumed. A pathname of '-' causes the compiler to send the generated script to it's standard output file. Note that '-v-1' is usually specified in this case (e.g., shorewall -v-1 compile -- -) to suppress the 'Compiling...' message normally generated by /sbin/shorewall.

When -e is specified, the compilation is being performed on a system other than where the compiled script will run. This option disables certain configuration options that require the script to be compiled where it is to be run. The use of -e requires the presence of a configuration file named capabilities which may be produced using the command shorewall-lite show -f capabilities > capabilities on a system with Shorewall Lite installed

The -c option was added in Shorewall 4.5.17 and causes conditional compilation of a script. The script specified by pathname (or implied if pathname is omitted) is compiled if it doesn't exist or if there is any file in the directory or in a directory on the CONFIG_PATH that has a modification time later than the file to be compiled. When no compilation is needed, a message is issued and an exit status of zero is returned.

The -d option causes the compiler to be run under control of the Perl debugger.

The -p option causes the compiler to be profiled via the Perl -wd:DProf command-line option.

The -T option was added in Shorewall 4.4.20 and causes a Perl stack trace to be included with each compiler-generated error and warning message.

The -i option was added in Shorewall 4.6.0 and causes a warning message to be issued if the current line contains alternative input specifications following a semicolon (";"). Such lines will be handled incorrectly if INLINE_MATCHES is set to Yes in shorewall.conf[2](5) (shorewall6.conf[3](5)).

delete { interface[:host-list]... zone | zone host-list }

The delete command reverses the effect of an earlier add command. The interface argument names an interface defined in the shorewall-interfaces[4](5) (shorewall6-interfaces[5](5) file. A host-list is comma-separated list whose elements are a host or network address.

Beginning with Shorewall 4.5.9, the dynamic_shared zone option (shorewall-zones[6](5), shorewall6-zones[8](5)) allows a single ipset to handle entries for multiple interfaces. When that option is specified for a zone, the delete command has the alternative syntax in which the zone name precedes the host-list.

disable { interface | provider }

Added in Shorewall 4.4.26. Disables the optional provider associated with the specified interface or provider. Where more than one provider share a single network interface, a provider name must be given. Beginning with Shorewall 4.5.10, this command may be used with any optional network interface. interface may be either the logical or physical name of the interface. The command removes any routes added from shorewall-routes[9](5) (shorewall6-routes[10](5))and any traffic shaping configuration for the interface.

drop address

Causes traffic from the listed addresses to be silently dropped. This command requires that the firewall be in the started state and that DYNAMIC_BLACKLIST=Yes in shorewall.conf (5)[2].

dump [-x] [-l] [-m] [-c]

Produces a verbose report about the firewall configuration for the purpose of problem analysis. The -x option causes actual packet and byte counts to be displayed. Without that option, these counts are abbreviated.

The -m option causes any MAC addresses included in Shorewall log messages to be displayed.

The -l option causes the rule number for each Netfilter rule to be displayed.

The -c option causes the route cache to be dumped in addition to the other routing information.

enable { interface | provider }

Added in Shorewall 4.4.26. Enables the optional provider associated with the specified interface or provider. Where more than one provider share a single network interface, a provider name must be given. Beginning with Shorewall 4.5.10, this command may be used with any optional network interface. interface may be either the logical or physical name of the interface. The command sets /proc entries for the interface, adds any route specified in shorewall-routes[9](5) (shorewall6-routes[10](5)) and installs the interface's traffic shaping configuration, if any.

export [ directory1 ] [ user@]system[:directory2 ]

Not available with Shorewall[6]-lite. If directory1 is omitted, the current working directory is assumed.

Allows a non-root user to compile a shorewall script and stage it on a system (provided that the user has access to the system via ssh). The command is equivalent to:

```
    /sbin/shorewall compile -e directory1 directory1/firewall &&\

    scp directory1/firewall directory1/firewall.conf [user@]system:[directory2]
```

In other words, the configuration in the specified (or defaulted) directory is compiled to a file called firewall in that directory. If compilation succeeds, then firewall and firewall.conf are copied to system using scp.

forget [ filename ]

Deletes /var/lib/shorewall/filename and /var/lib/shorewall/save. If no filename is given then the file specified by RESTOREFILE in shorewall.conf[2](5) (shorewall6.conf[3](5)) is assumed.

help

Displays a syntax summary.

hits [-t]

Generates several reports from Shorewall log messages in the current log file. If the -t option is included, the reports are restricted to log messages generated today. Not available with Shorewall6[-lite].

ipcalc { address mask | address/vlsm }

Ipcalc displays the network address, broadcast address, network in CIDR notation and netmask corresponding to the input[s]. Not available with Shorewall6[-lite].

iprange address1-address2

Iprange decomposes the specified range of IP addresses into the equivalent list of network/host addresses. Not available with Shorewall6[-lite].

iptrace iptables match expression

This is a low-level debugging command that causes iptables TRACE log records to be created. See iptables(8) for details. The iptables match expression must be one or more matches that may appear in both the raw table OUTPUT and raw table PREROUTING chains.

The log message destination is determined by the currently-selected IPv4 or IPv6 logging backend[11].

list

list is a synonym for show -- please see below.

logdrop address

Causes traffic from the listed addresses to be logged then discarded. Logging occurs at the log level specified by the BLACKLIST_LOGLEVEL setting in shorewall.conf[2] (5) (shorewall6.conf[3](5)). This command requires that the firewall be in the started state and that DYNAMIC_BLACKLIST=Yes in shorewall.conf (5)[2].

logwatch [-m] [ refresh-interval ]

Monitors the log file specified by the LOGFILE option in shorewall.conf[2](5) (shorewall6.conf[3](5)) and produces an audible alarm when new Shorewall messages are logged. The -m option causes the MAC address of each packet source to be displayed if that information is available. The refresh-interval specifies the time in seconds between screen refreshes. You can enter a negative number by preceding the number with "--" (e.g., shorewall logwatch -- -30). In this case, when a packet count changes, you will be prompted to hit any key to resume screen refreshes.

logreject address

Causes traffic from the listed addresses to be logged then rejected. Logging occurs at the log level specified by the BLACKLIST_LOGLEVEL setting in shorewall.conf[2] (5), (shorewall6.conf[3](5)). This command requires that the firewall be in the started state and that DYNAMIC_BLACKLIST=Yes in shorewall.conf (5)[2].

ls

ls is a synonym for show -- please see below.

noiptrace iptables match expression

This is a low-level debugging command that cancels a trace started by a preceding iptrace command. The iptables match expression must be one given in the iptrace command being canceled.

open source dest [ protocol [ port ] ]

Added in Shorewall 4.6.8. This command requires that the firewall be in the started state and that DYNAMIC_BLACKLIST=Yes in shorewall.conf (5)[2]. The effect of the command is to temporarily open the firewall for connections matching the parameters. The source and dest parameters may each be specified as all if you don't wish to restrict the connection source or destination respectively. Otherwise, each must contain a host or network address or a valid DNS name.

The protocol may be specified either as a number or as a name listed in /etc/protocols. The port may be specified numerically or as a name listed in /etc/services.

To reverse the effect of a successful open command, use the close command with the same parameters or simply restart the firewall.

Example: To open the firewall for SSH connections to address 192.168.1.1, the command would be:

```
    shorewall open all 192.168.1.1 tcp 22
```

To reverse that command, use:

```
    shorewall close all 192.168.1.1 tcp 22
```

reenable{ interface | provider }

Added in Shorewall 4.6.9. This is equivalent to a disable command followed by an enable command on the specified interface or provider.

reject address

Causes traffic from the listed addresses to be silently rejected. This command requires that the firewall be in the started state and that DYNAMIC_BLACKLIST=Yes in shorewall.conf (5)[2].

reload [-n] [-p] [-d] [-f] [-c] [-T] [-i] [-C] [ directory ]

This command was re-implemented in Shorewall 5.0.0. The pre-5.0.0 reload command is now called remote-restart (see below). Shorewall and Shorewall6

Reload is similar to shorewall start except that it assumes that the firewall is already started. Existing connections are maintained. If a directory is included in the command, Shorewall will look in that directory first for configuration files. The -n option causes Shorewall to avoid updating the routing table(s).

The -p option causes the connection tracking table to be flushed; the conntrack utility must be installed to use this option.

The -d option causes the compiler to run under the Perl debugger.

The -f option suppresses the compilation step and simply reused the compiled script which last started/restarted Shorewall, provided that /etc/shorewall and its contents have not been modified since the last start/restart.

The -c option was added in Shorewall 4.4.20 and performs the compilation step unconditionally, overriding the AUTOMAKE setting in shorewall.conf[2](5) (Shorewall and Shorewall6 only). When both -f and -c are present, the result is determined by the option that appears last.

The -T option was added in Shorewall 4.5.3 and causes a Perl stack trace to be included with each compiler-generated error and warning message.

The -i option was added in Shorewall 4.6.0 and causes a warning message to be issued if the current line contains alternative input specifications following a semicolon (";"). Such lines will be handled incorrectly if INLINE_MATCHES is set to Yes in shorewall.conf[2](5) (shorewall6.conf[3](5))..

The -C option was added in Shorewall 4.6.5 and is only meaningful when AUTOMAKE=Yes in shorewall.conf[2](5) (shorewall6.conf[3](5)). If an existing firewall script is used and if that script was the one that generated the current running configuration, then the running netfilter configuration will be reloaded as is so as to preserve the iptables packet and byte counters.

Shorewall-lite and Shorewall6-lite

Reload is similar to shorewall start except that it assumes that the firewall is already started. Existing connections are maintained. The -n option causes Shorewall to avoid updating the routing table(s).

The -p option causes the connection tracking table to be flushed; the conntrack utility must be installed to use this option.

The -C option was added in Shorewall 4.6.5 If the existing firewall script is the one that generated the current running configuration, then the running netfilter configuration will be reloaded as is so as to preserve the iptables packet and byte counters.

remote-getcaps [-R] [-r root-user-name] [ [ -D ] directory ] [ system ]

Added in Shoreall 5.2.0, this command executes shorewall[6]-lite show capabilities -f > /var/lib/shorewall[6]-lite/capabilities on the remote system via ssh then the generated file is copied to directory on the local system. If no directory is given, the current working directory is assumed. if -R is included, the remote shorewallrc file is also copied to directory.

If -r is included, it specifies that the root user on system is named root-user-name rather than "root".

remote-getrc [-c] [-r root-user-name] [ [ -D ] directory ] [ system ]

Added in Shoreall 5.2.0, this command copies the shorewallrc file from the remote system to directory on the local system. If no directory is given, the current working directory is assumed. if -c is included, the remote capabilities are also copied to directory, as is done by the remote-getcaps command.

If -r is included, it specifies that the root user on system is named root-user-name rather than "root".

remote-start [-n] [-s] [-c] [-r root-user-name] [-T] [-i] [ [ -D ] directory ] [ system ]

This command was renamed from load in Shorewall 5.0.0 and is only available in Shorewall and Shoreawall6. If directory is omitted, the current working directory is assumed. Allows a non-root user to compile a shorewall script and install it on a system (provided that the user has root access to the system via ssh). The command is equivalent to:

```
    /sbin/shorewall compile -e directory directory/firewall &&\

    scp directory/firewall directory/firewall.conf root@system:/var/lib/shorewall-lite/ &&\

    ssh root@system '/sbin/shorewall-lite start'
```

In other words, the configuration in the specified (or defaulted) directory is compiled to a file called firewall in that directory. If compilation succeeds, then firewall is copied to system using scp. If the copy succeeds, Shorewall Lite on system is started via ssh. Beginning with Shorewall 5.0.13, if system is omitted, then the FIREWALL option setting in shorewall.conf[12](5) (shorewall6.conf(5)[3]) is assumed. In that case, if you want to specify a directory, then the -D option must be given.

The -n option causes Shorewall to avoid updating the routing table(s).

If -s is specified and the start command succeeds, then the remote Shorewall-lite configuration is saved by executing shorewall-lite save via ssh.

if -c is included, the command shorewall[6]-lite show capabilities -f > /var/lib/shorewall[6]-lite/capabilities is executed via ssh then the generated file is copied to directory using scp. This step is performed before the configuration is compiled.

If -r is included, it specifies that the root user on system is named root-user-name rather than "root".

The -T option was added in Shorewall 4.5.3 and causes a Perl stack trace to be included with each compiler-generated error and warning message.

remote-reload [-s] [-c] [-r root-user-name] [-T] [-i] [ [ -D ] directory ] [ system ]

This command was added in Shorewall 5.0.0 and is only available in Shorewall and Shorewall6. If directory is omitted, the current working directory is assumed. Allows a non-root user to compile a shorewall script and install it on a system (provided that the user has root access to the system via ssh). The command is equivalent to:

```
    /sbin/shorewall compile -e directory directory/firewall &&\

    scp directory/firewall directory/firewall.conf root@system:/var/lib/shorewall-lite/ &&\

    ssh root@system '/sbin/shorewall-lite reload'
```

In other words, the configuration in the specified (or defaulted) directory is compiled to a file called firewall in that directory. If compilation succeeds, then firewall is copied to system using scp. If the copy succeeds, Shorewall Lite on system is restarted via ssh. Beginning with Shorewall 5.0.13, if system is omitted, then the FIREWALL option setting in shorewall6.conf(5)[13] (shorewall6.conf[3](5)) is assumed. In that case, if you want to specify a directory, then the -D option must be given.

If -s is specified and the restart command succeeds, then the remote Shorewall-lite configuration is saved by executing shorewall-lite save via ssh.

if -c is included, the command shorewall-lite show capabilities -f > /var/lib/shorewall-lite/capabilities is executed via ssh then the generated file is copied to directory using scp. This step is performed before the configuration is compiled.

If -r is included, it specifies that the root user on system is named root-user-name rather than "root".

The -T option was added in Shorewall 4.5.3 and causes a Perl stack trace to be included with each compiler-generated error and warning message.

The -i option was added in Shorewall 4.6.0 and causes a warning message to be issued if the current line contains alternative input specifications following a semicolon (";"). Such lines will be handled incorrectly if INLINE_MATCHES is set to Yes in shorewall.conf[2](5) (shorewall6.conf[3](5)).

remote-restart [-s] [-c] [-r root-user-name] [-T] [-i] [ [ -D ] directory ] [ system ]

This command was renamed from reload in Shorewall 5.0.0 and is available in Shorewall and Shorewall6 only. If directory is omitted, the current working directory is assumed. Allows a non-root user to compile a shorewall script and install it on a system (provided that the user has root access to the system via ssh). The command is equivalent to:

```
    /sbin/shorewall compile -e directory directory/firewall &&\

    scp directory/firewall directory/firewall.conf root@system:/var/lib/shorewall-lite/ &&\

    ssh root@system '/sbin/shorewall-lite restart'
```

In other words, the configuration in the specified (or defaulted) directory is compiled to a file called firewall in that directory. If compilation succeeds, then firewall is copied to system using scp. If the copy succeeds, Shorewall Lite on system is restarted via ssh. Beginning with Shorewall 5.0.13, if system is omitted, then the FIREWALL option setting in shorewall6.conf(5)[13] (shorewall6.conf[3](5)) is assumed. In that case, if you want to specify a directory, then the -D option must be given.

If -s is specified and the restart command succeeds, then the remote Shorewall-lite configuration is saved by executing shorewall-lite save via ssh.

if -c is included, the command shorewall-lite show capabilities -f > /var/lib/shorewall-lite/capabilities is executed via ssh then the generated file is copied to directory using scp. This step is performed before the configuration is compiled.

If -r is included, it specifies that the root user on system is named root-user-name rather than "root".

The -T option was added in Shorewall 4.5.3 and causes a Perl stack trace to be included with each compiler-generated error and warning message.

The -i option was added in Shorewall 4.6.0 and causes a warning message to be issued if the current line contains alternative input specifications following a semicolon (";"). Such lines will be handled incorrectly if INLINE_MATCHES is set to Yes in shorewall.conf[2](5) (shorewall6.conf[3](5).

reset [chain, ...]

Resets the packet and byte counters in the specified chain(s). If no chain is specified, all the packet and byte counters in the firewall are reset. Beginning with Shorewall 5.0.0, chain may be composed of both a table name and a chain name separated by a colon (e.g., mangle:PREROUTING). Chain names following that don't include a table name are assumed to be in that same table. If no table name is given in the command, the filter table is assumed.

restart [-n] [-p] [-d] [-f] [-c] [-T] [-i] [-C] [ directory ]

Beginning with Shorewall 5.0.0, this command performs a true restart. The firewall is completely stopped as if a stop command had been issued then it is started again. Shorewall and Shorewall6

If a directory is included in the command, Shorewall will look in that directory first for configuration files. The -n option causes Shorewall to avoid updating the routing table(s).

The -p option causes the connection tracking table to be flushed; the conntrack utility must be installed to use this option.

The -d option causes the compiler to run under the Perl debugger.

The -f option suppresses the compilation step and simply reused the compiled script which last started/restarted Shorewall, provided that /etc/shorewall and its contents have not been modified since the last start/restart.

The -c option was added in Shorewall 4.4.20 and performs the compilation step unconditionally, overriding the AUTOMAKE setting in shorewall.conf[2](5). When both -f and -c are present, the result is determined by the option that appears last.

The -T option was added in Shorewall 4.5.3 and causes a Perl stack trace to be included with each compiler-generated error and warning message.

The -i option was added in Shorewall 4.6.0 and causes a warning message to be issued if the current line contains alternative input specifications following a semicolon (";"). Such lines will be handled incorrectly if INLINE_MATCHES is set to Yes in shorewall.conf[2](5).

The -C option was added in Shorewall 4.6.5 and is only meaningful when AUTOMAKE=Yes in shorewall.conf[2](5). If an existing firewall script is used and if that script was the one that generated the current running configuration, then the running netfilter configuration will be reloaded as is so as to preserve the iptables packet and byte counters.

Shorewall-lite and Shorewall6-lite

The -n option causes Shorewall to avoid updating the routing table(s). The -p option causes the connection tracking table to be flushed; the conntrack utility must be installed to use this option.

The -C option was added in Shorewall 4.6.5 If the existing firewall script is the one that generated the current running configuration, then the running netfilter configuration will be reloaded as is so as to preserve the iptables packet and byte counters.

restore [-n] [-p] [-C] [ filename ]

Restore Shorewall to a state saved using the shorewall save command. Existing connections are maintained. The filename names a restore file in /var/lib/shorewall created using shorewall save; if no filename is given then Shorewall will be restored from the file specified by the RESTOREFILE option in shorewall.conf[2](5) (shorewall6.conf[3](5)).

Caution

If your iptables ruleset depends on variables that are detected at run-time, either in your params file or by Shorewall-generated code, restore will use the values that were current when the ruleset was saved, which may be different from the current values.

The -n option causes Shorewall to avoid updating the routing table(s). The -p option, added in Shorewall 4.6.5, causes the connection tracking table to be flushed; the conntrack utility must be installed to use this option.

The -C option was added in Shorewall 4.6.5. If the -C option was specified during shorewall save, then the counters saved by that operation will be restored.

run command [ parameter ... ]

Added in Shorewall 4.6.3. Executes command in the context of the generated script passing the supplied parameters. Normally, the command will be a function declared in lib.private. Before executing the command, the script will detect the configuration, setting all SW_* variables and will run your init extension script with $COMMAND = 'run'.

If there are files in the CONFIG_PATH that were modified after the current firewall script was generated, the following warning message is issued:

WARNING: /var/lib/shorewall/firewall is not up to

date

safe-reload [-d] [-p] [-t timeout ] [ directory ]

Added in Shorewall 5.0.0, this command performs the same function as did safe_restart in earlier releases. The command is available in Shorewall and Shorewall6 only. Only allowed if Shorewall is running. The current configuration is saved in /var/lib/shorewall/safe-reload (see the save command below) then a shorewall reload is done. You will then be prompted asking if you want to accept the new configuration or not. If you answer "n" or if you fail to answer within 60 seconds (such as when your new configuration has disabled communication with your terminal), the configuration is restored from the saved configuration. If a directory is given, then Shorewall will look in that directory first when opening configuration files.

Beginning with Shorewall 4.5.0, you may specify a different timeout value using the -t option. The numeric timeout may optionally be followed by an s, m or h suffix (e.g., 5m) to specify seconds, minutes or hours respectively. If the suffix is omitted, seconds is assumed.

safe-restart [-d] [-p] [-t timeout ] [ directory ]

Only allowed if Shorewall[6] is running and is not available in Shorewall-lite and Shorewall6-lite. The current configuration is saved in /var/lib/shorewall/safe-restart (see the save command below) then a shorewall restart is done. You will then be prompted asking if you want to accept the new configuration or not. If you answer "n" or if you fail to answer within 60 seconds (such as when your new configuration has disabled communication with your terminal), the configuration is restored from the saved configuration. If a directory is given, then Shorewall will look in that directory first when opening configuration files. Beginning with Shorewall 4.5.0, you may specify a different timeout value using the -t option. The numeric timeout may optionally be followed by an s, m or h suffix (e.g., 5m) to specify seconds, minutes or hours respectively. If the suffix is omitted, seconds is assumed.

safe-start [-d] [-p] [-ttimeout ] [ directory ]

Shorewall is started normally. You will then be prompted asking if everything went all right. If you answer "n" or if you fail to answer within 60 seconds (such as when your new configuration has disabled communication with your terminal), a shorewall clear is performed for you. If a directory is given, then Shorewall will look in that directory first when opening configuration files. Beginning with Shorewall 4.5.0, you may specify a different timeout value using the -t option. The numeric timeout may optionally be followed by an s, m or h suffix (e.g., 5m) to specify seconds, minutes or hours respectively. If the suffix is omitted, seconds is assumed.

This command is available in Shorewall and Shorewall6 only.

save [-C] [ filename ]

Creates a snapshot of the currently running firewall. The dynamic blacklist is stored in /var/lib/shorewall/save. The state of the firewall is stored in /var/lib/shorewall/filename for use by the shorewall restore command. If filename is not given then the state is saved in the file specified by the RESTOREFILE option in shorewall.conf[2](5) (shorewall6.conf[3](5)). The -C option, added in Shorewall 4.6.5, causes the iptables packet and byte counters to be saved along with the chains and rules.

savesets

Added in shorewall 4.6.8. Performs the same action as the stop command with respect to saving ipsets (see the SAVE_IPSETS option in shorewall.conf[2] (5) (shorewall6.conf[3](5)). This command may be used to proactively save your ipset contents in the event that a system failure occurs prior to issuing a stop command.

show

The show command can have a number of different arguments: action action

Lists the named action file. Available on Shorewall and Shorewall6 only.

actions

Produces a report about the available actions (built-in, standard and user-defined). Available on Shorewall and Shorewall6 only.

bl|blacklists [-x]

Added in Shorewall 4.6.2. Displays the dynamic chain along with any chains produced by entries in shorewall-blrules(5). The -x option is passed directly through to iptables and causes actual packet and byte counts to be displayed. Without this option, those counts are abbreviated.

[-f] capabilities

Displays your kernel/iptables capabilities. The -f option causes the display to be formatted as a capabilities file for use with compile -e.

[-b] [-x] [-l] [-t {filter|mangle|nat|raw}] [ chain... ]

The rules in each chain are displayed using the iptables -L chain -n -v command. If no chain is given, all of the chains in the filter table are displayed. The -x option is passed directly through to iptables and causes actual packet and byte counts to be displayed. Without this option, those counts are abbreviated. The -t option specifies the Netfilter table to display. The default is filter. The -b ('brief') option causes rules which have not been used (i.e. which have zero packet and byte counts) to be omitted from the output. Chains with no rules displayed are also omitted from the output.

The -l option causes the rule number for each Netfilter rule to be displayed.

If the -t option and the chain keyword are both omitted and any of the listed chains do not exist, a usage message is displayed.

classifiers|filters

Displays information about the packet classifiers defined on the system as a result of traffic shaping configuration.

config

Displays distribution-specific defaults.

connections [filter_parameter ...]

Displays the IP connections currently being tracked by the firewall. If the conntrack utility is installed, beginning with Shorewall 4.6.11 the set of connections displayed can be limited by including conntrack filter parameters (-p , -s, --dport, etc). See conntrack(8) for details.

event event

Added in Shorewall 4.5.19. Displays the named event.

events

Added in Shorewall 4.5.19. Displays all events.

ip

Displays the system's IPv4 configuration.

ipa

Added in Shorewall 4.4.17. Displays the per-IP accounting counters (shorewall-accounting[14] (5), shorewall6-accounting[15](5)).

ipsec

Added in Shorewall 5.1.0. Displays the contents of the IPSEC Security Policy Database (SPD) and Security Association Database (SAD). SAD keys are not displayed.

[-m] log

Displays the last 20 Shorewall messages from the log file specified by the LOGFILE option in shorewall.conf[2](5) (shorewall6.conf[3](5)). The -m option causes the MAC address of each packet source to be displayed if that information is available.

macros

Displays information about each macro defined on the firewall system (Shorewall and Shorewall6 only)

macro macro

Added in Shorewall 4.4.6. Displays the file that implements the specified macro (usually /usr/share/shorewall/macro.macro). Available only in Shorewall and Shorewall6.

[-x] mangle

Displays the Netfilter mangle table using the command iptables -t mangle -L -n -v. The -x option is passed directly through to iptables and causes actual packet and byte counts to be displayed. Without this option, those counts are abbreviated.

marks

Added in Shorewall 4.4.26. Displays the various fields in packet marks giving the min and max value (in both decimal and hex) and the applicable mask (in hex).

[-x] nat

Displays the Netfilter nat table using the command iptables -t nat -L -n -v. The -x option is passed directly through to iptables and causes actual packet and byte counts to be displayed. Without this option, those counts are abbreviated.

opens

Added in Shorewall 4.5.8. Displays the iptables rules in the 'dynamic' chain created through use of the open command..

policies

Added in Shorewall 4.4.4. Displays the applicable policy between each pair of zones. Note that implicit intrazone ACCEPT policies are not displayed for zones associated with a single network where that network doesn't specify routeback.

rc

Added in Shorewall 5.2.0. Displays the contents of $SHAREDIR/shorewall/shorewallrc.

[-c] routing

Displays the system's IPv4 routing configuration. The -c option causes the route cache to be displayed along with the other routing information.

[-x] raw

Displays the Netfilter raw table using the command iptables -t raw -L -n -v. The -x option is passed directly through to iptables and causes actual packet and byte counts to be displayed. Without this option, those counts are abbreviated.

saves

Added in Shorewall 5.2.0. Lists snapshots created by the save command. Each snapshot is listed with the date and time when it was taken. If there is a snapshot with the name specified in the RESTOREFILE option in shorewall.conf(5[12]), that snapshot is listed as the default snapshot for the restore command.

tc

Displays information about queuing disciplines, classes and filters.

zones

Displays the current composition of the Shorewall zones on the system.

start [-n] [-p] [-d] [-f] [-c] [-T] [-i] [-C] [ directory ]

Shorewall and Shorewall6

Start shorewall[6]. Existing connections through shorewall managed interfaces are untouched. New connections will be allowed only if they are allowed by the firewall rules or policies. If a directory is included in the command, Shorewall will look in that directory first for configuration files. If -f is specified, the saved configuration specified by the RESTOREFILE option in shorewall.conf[2](5) (shorewall6.conf[3](5)) will be restored if that saved configuration exists and has been modified more recently than the files in /etc/shorewall. When -f is given, a directory may not be specified. Update: In Shorewall 4.4.20, a new LEGACY_FASTSTART option was added to shorewall.conf[2](5) (shorewall6.conf[3](5)). When LEGACY_FASTSTART=No, the modification times of files in /etc/shorewall are compared with that of /var/lib/shorewall/firewall (the compiled script that last started/restarted the firewall).

The -n option causes Shorewall to avoid updating the routing table(s).

The -p option causes the connection tracking table to be flushed; the conntrack utility must be installed to use this option.

The -c option was added in Shorewall 4.4.20 and performs the compilation step unconditionally, overriding the AUTOMAKE setting in shorewall.conf[2](5) (shorewall6.conf[3](5)). When both -f and -care present, the result is determined by the option that appears last.

The -T option was added in Shorewall 4.5.3 and causes a Perl stack trace to be included with each compiler-generated error and warning message.

The -i option was added in Shorewall 4.6.0 and causes a warning message to be issued if the current line contains alternative input specifications following a semicolon (";"). Such lines will be handled incorrectly if INLINE_MATCHES is set to Yes in shorewall.conf(5)[2] (shorewall6.conf[3](5)).

The -C option was added in Shorewall 4.6.5 and is only meaningful when the -f option is also specified. If the previously-saved configuration is restored, and if the -C option was also specified in the save command, then the packet and byte counters will be restored.

Shorewall-lite and Shorewall6-lite

Start Shorewall[6] Lite. Existing connections through shorewall[6]-lite managed interfaces are untouched. New connections will be allowed only if they are allowed by the firewall rules or policies. The -p option causes the connection tracking table to be flushed; the conntrack utility must be installed to use this option.

The -n option prevents the firewall script from modifying the current routing configuration.

The -f option was added in Shorewall 4.6.5. If the RESTOREFILE named in shorewall.conf[12](5) exists, is executable and is not older than the current filewall script, then that saved configuration is restored.

The -C option was added in Shorewall 4.6.5 and is only meaningful when the -f option is also specified. If the previously-saved configuration is restored, and if the -C option was also specified in the save command, then the packet and byte counters will be restored.

stop [-f]

Stops the firewall. All existing connections, except those listed in shorewall-routestopped[16](5) or permitted by the ADMINISABSENTMINDED option in shorewall.conf[2](5), are taken down. The only new traffic permitted through the firewall is from systems listed in shorewall-routestopped[16](5) or by ADMINISABSENTMINDED. If -f is given, the command will be processed by the compiled script that executed the last successful start, restart or reload command if that script exists.

status [-i]

Produces a short report about the state of the Shorewall-configured firewall. The -i option was added in Shorewall 4.6.2 and causes the status of each optional or provider interface to be displayed.

try directory [ timeout ]

This command is available in Shorewall and Shorewall6 only. If Shorewall[6] is started then the firewall state is saved to a temporary saved configuration (/var/lib/shorewall/.try). Next, if Shorewall[6] is currently started then a restart command is issued using the specified configuration directory; otherwise, a start command is performed using the specified configuration directory. if an error occurs during the compilation phase of the restart or start, the command terminates without changing the Shorewall[6] state. If an error occurs during the restart phase, then a shorewall restore is performed using the saved configuration. If an error occurs during the start phase, then Shorewall is cleared. If the start/restart succeeds and a timeout is specified then a clear or restore is performed after timeout seconds.

Beginning with Shorewall 4.5.0, the numeric timeout may optionally be followed by an s, m or h suffix (e.g., 5m) to specify seconds, minutes or hours respectively. If the suffix is omitted, seconds is assumed.

update [-d] [-r] [-T] [-a] [-i] [-A] [ directory ]

This command is available only in Shorewall and Shorewall6. Added in Shorewall 4.4.21 and causes the compiler to update /etc/shorewall/shorewall.conf then validate the configuration. The update will add options not present in the old file with their default values, and will move deprecated options with non-defaults to a deprecated options section at the bottom of the file. Your existing shorewall.conf file is renamed shorewall.conf.bak.

The command was extended over the years with a set of options that caused additional configuration updates.

•Convert an existing blacklist file into an equivalent blrules file.

•Convert an existing routestopped file into an equivalent stoppedrules file.

•Convert existing tcrules and tos files into an equivalent mangle file.

•Convert an existing notrack file into an equivalent conntrack file.

•Convert FORMAT, SECTION and COMMENT entries into ?FORMAT, ?SECTION and ?COMMENT directives.

In each case, the old file is renamed with a .bak suffix.

In Shorewall 5.0.0, the options were eliminated and the update command performs all of the updates described above.

Important

There are some notable restrictions with the update command:

1.Converted rules will be appended to the existing file; if there is no existing file in the CONFIG_PATH, one will be created in the directory specified in the command or in the first entry in the CONFIG_PATH (normally /etc/shorewall) otherwise.

2.Existing comments in the file being converted will not be transferred to the output file.

3.With the exception of the notrack->conntrack conversion, INCLUDEd files will be expanded inline in the output file.

4.Columns in the output file will be separated by a single tab character; there is no attempt made to otherwise align the columns.

5.Prior to Shorewall 5.0.15, shell variables will be expanded in the output file.

6.Prior to Shorewall 5.0.15, lines omitted by compiler directives (?if ...., etc.) will not appear in the output file.

Important

Because the translation of the 'blacklist' and 'routestopped' files is not 1:1, omitted lines and compiler directives are not transferred to the converted files. If either are present, the compiler issues a warning:

```
 WARNING: "Omitted rules and compiler directives were not translated
```

The -a option causes the updated shorewall.conf file to be annotated with documentation. The -i option was added in Shorewall 4.6.0 and causes a warning message to be issued if the current line contains alternative input specifications following a semicolon (";"). Such lines will be handled incorrectly if INLINE_MATCHES is set to Yes in shorewall.conf[2](5).

The -A option is included for compatibility with Shorewall 4.6 and is equivalent to specifying the -i option.

For a description of the other options, see the check command above.

version [-a]

Displays Shorewall's version. The -a option is included for compatibility with earlier Shorewall releases and is ignored.

## EXIT STATUS
In general, when a command succeeds, status 0 is returned; when the command fails, a non-zero status is returned.

The status command returns exit status as follows:

0 - Firewall is started.

3 - Firewall is stopped or cleared

4 - Unknown state; usually means that the firewall has never been started.

## ENVIRONMENT
Two environmental variables are recognized by Shorewall:

SHOREWALL_INIT_SCRIPT

When set to 1, causes Std out to be redirected to the file specified in the STARTUP_LOG option in shorewall.conf(5)[12].

SW_LOGGERTAG

Added in Shorewall 5.0.8. When set to a non-empty value, that value is passed to the logger utility in its -t (--tag) option.

## FILES
/etc/shorewall/*

/etc/shorewall6/*

## SEE ALSO
http://www.shorewall.net/starting_and_stopping_shorewall.htm[17]

- Describes operational aspects of Shorewall.

shorewall-files(5)[18] -

Describes the various configuration files along with features and

conventions common to those files.

shorewall-names(5)[19] -

Describes naming of objects within a Shorewall configuration.

shorewall-addresses(5)[20] -

Describes how to specify addresses within a Shorewall

configuration.

shorewall-exclusion(5)[21] -

Describes how to exclude certain hosts and/or networks from matching a

rule.

shorewall-nesting(5)[22]

- Describes how to nest one Shorewall zone inside another.

## NOTES
1.

http://www.shorewall.net/starting_and_stopping_shorewall.htm#Trace

http://www.shorewall.net/starting_and_stopping_shorewall.htm#Trace

2.

shorewall.conf

http://www.shorewall.net/manpages/shorewall.conf.html

3.

shorewall6.conf

http://www.shorewall.net/manpages6/shorewall6.conf.html

4.

shorewall-interfaces

http://www.shorewall.net/manpages/shorewall-interfaces.html

5.

shorewall6-interfaces

http://www.shorewall.net/manpages6/shorewall6-interfaces.html

6.

shorewall-zones

http://www.shorewall.net/manpages/shorewall-zones.html

7.

shorewall6-zones

http://www.shorewall.net???

8.

shorewall6-zones

http://www.shorewall.net/manpages6/shorewall6-zones.html

9.

shorewall-routes

http://www.shorewall.net/manpages/shorewall-routes.html

10.

shorewall6-routes

http://www.shorewall.net/manpages/shorewall6-routes.html

11.

logging backend

http://www.shorewall.net/shorewall_logging.html#Backends

12.

shorewall.conf

http://www.shorewall.netshorewall.conf.html

13.

shorewall6.conf(5)

http://www.shorewall.netshorewall6.conf.html

14.

shorewall-accounting

http://www.shorewall.net/manpages/shorewall-accounting.html

15.

shorewall6-accounting

http://www.shorewall.net/manpages6/shorewall6-accounting.html

16.

shorewall-routestopped

http://www.shorewall.net/manpages/shorewall-routestopped.html

17.

http://www.shorewall.net/starting_and_stopping_shorewall.htm

http://www.shorewall.net/starting_and_stopping_shorewall.htm

18.

shorewall-files(5)

http://www.shorewall.netshorewall-files.html

19.

shorewall-names(5)

http://www.shorewall.netshorewall-names.html

20.

shorewall-addresses(5)

http://www.shorewall.netshorewall-addresses.html

21.

shorewall-exclusion(5)

http://www.shorewall.netshorewall-exclusion.html

22.

shorewall-nesting(5)

http://www.shorewall.netshorewall-nesting.html


shorewall-lite

package: shorewall-lite

title: shorewall-lite(8)

summary: Administration tool for Shoreline Firewall Lite (Shorewall\-lte)

text:
# shorewall-lite(8)

## NAME
shorewall-lite - Administration tool for Shoreline Firewall Lite (Shorewall-lte)

## SYNOPSIS
shorewall-lite [trace|debug] [-options] command [ command-arguments ]

## DESCRIPTION
The shorewall-lite utility is used to control the Shoreline Firewall Lite (Shorewall-lite).

Beginning with Shorewall 5.1.0, shorewall6-lite is a symbolic link pointing to the shorewall[1](8) executable who executes the command as if its -6 and -l options had been specified.

## NOTES
1.

shorewall

http://www.shorewall.net/manpages/shorewall.html


title: shorewall6(8)

text:
# shorewall6(8)

## NAME
shorewall6 - Administration tool for Shoreline Firewall 6 (Shorewall6)

## SYNOPSIS
shorewall6 [trace|debug] [-options] command [ command-arguments ]

## DESCRIPTION
The shorewall6 utility is used to control the Shoreline Firewall 6 (Shorewall6).

Beginning with Shorewall 5.1.0, shorewall6 is a symbolic link pointing to the shorewall[1](8) executable who executes the command as if its -6 option had been specified.

## NOTES
1.

shorewall

http://www.shorewall.net/manpages/shorewall.html


title: shorewall6-lite(8)

summary: Administration tool for Shoreline Firewall 6 Lite (Shorewall6\-lite)

text:
# shorewall6-lite(8)

## NAME
shorewall6-lite - Administration tool for Shoreline Firewall 6 Lite (Shorewall6-lite)

## SYNOPSIS
shorewall6-lite [trace|debug] [-options] command [ command-arguments ]

## DESCRIPTION
The shorewall6-lite utility is used to control the Shoreline Firewall 6 Lite (Shorewall6-lite).

Beginning with Shorewall 5.1.0, shorewall6-lite is a symbolic link pointing to the shorewall[1](8) executable who executes the command as if its -6 and -l options had been specified.

## NOTES
1.

shorewall

http://www.shorewall.net/manpages/shorewall.html


slick-greeter

package: slick-greeter

title: slick-greeter(8)

summary: distro agnostic LightDM greeter

text:
# slick-greeter(8)

## NAME
slick-greeter - distro agnostic LightDM greeter

## SYNOPSIS
slick-greeter [ OPTIONS ]

## DESCRIPTION
Slick Greeter is a LightDM greeter for all desktops. It is run by the LightDM daemon if configured in lightdm.conf. It is not normally run by a user, but can run in a test mode with the --test-mode option. This allows the interface to be tested without installing an updated version.

## OPTIONS
-v, --version

Show release version.

--test-mode

Run the greeter in a test mode inside the current X session.

-?, --help

Show help options.

## Configuration File-Format
/etc/lightdm/slick-greeter.conf

Available configuration options are listed below.

background=

Background file to use, either an image path or a color (e.g. #772953)

background-color=

Background color (e.g. #772953), set before wallpaper is seen

draw-user-backgrounds=

Whether to draw user backgrounds (true or false)

draw-grid=

Whether to draw an overlay grid (true or false)

show-hostname=

Whether to show the hostname in the menubar (true or false)

show-keyboard=

Whether to show the keyboard indicator in the menubar (true or false)

show-a11y=

Whether to show the accessibility options in the menubar (true or false)

show-power=

Whether to show the power indicator in the menubar (true or false)

show-clock=

Whether to show the clock in the menubar (true or false)

show-quit=

Whether to show the quit menu in the menubar (true or false)

logo=

Logo file to use

other-monitors-logo=

Logo file to use for other monitors

theme-name=

GTK+ theme to use

icon-theme-name=

Icon theme to use

font-name=

Font to use

xft-antialias=

Whether to antialias Xft fonts (true or false)

xft-dpi=

Resolution for Xft in dots per inch

xft-hintstyle=

What degree of hinting to use (hintnone/hintslight/hintmedium/hintfull)

xft-rgba=

Type of subpixel antialiasing (none/rgb/bgr/vrgb/vbgr)

onscreen-keyboard=

Whether to enable the onscreen keyboard (true or false)

high-contrast=

Whether to use a high contrast theme (true or false)

screen-reader=

Whether to enable the screen reader (true or false)

play-ready-sound=

A sound file to play when the greeter is ready

hidden-users=

List of usernames that are hidden until a special key combination is hit

group-filter=

List of groups that users must be part of to be shown (empty list shows all users)

enable-hidpi=

Whether to enable HiDPI support (on/off/auto)

only_on_monitor=

Sets the monitor on which to show the login window, -1 means "follow the mouse"

## SEE ALSO
lightdm