useradd

title: useradd(8)

text:
# useradd(8)

## NAME
useradd - create a new user or update default new user information

## SYNOPSIS
useradd [options] LOGIN

useradd -D

useradd -D [options]

## DESCRIPTION
When invoked without the -D option, the useradd command creates a new user account using the values specified on the command line plus the default values from the system. Depending on command line options, the useradd command will update system files and may also create the new user's home directory and copy initial files.

By default, a group will also be created for the new user (see -g, -N, -U, and USERGROUPS_ENAB).

## OPTIONS
The options which apply to the useradd command are:

-b, --base-dir BASE_DIR

The default base directory for the system if -d HOME_DIR is not specified. BASE_DIR is concatenated with the account name to define the home directory. If this option is not specified, useradd will use the base directory specified by the HOME variable in /etc/default/useradd, or /home by default.

-c, --comment COMMENT

Any text string. It is generally a short description of the account, and is currently used as the field for the user's full name.

-d, --home-dir HOME_DIR

The new user will be created using HOME_DIR as the value for the user's login directory. The default is to append the LOGIN name to BASE_DIR and use that as the login directory name. If the directory HOME_DIR does not exist, then it will be created unless the -M option is specified.

-D, --defaults

See below, the subsection "Changing the default values".

-e, --expiredate EXPIRE_DATE

The date on which the user account will be disabled. The date is specified in the format YYYY-MM-DD. If not specified, useradd will use the default expiry date specified by the EXPIRE variable in /etc/default/useradd, or an empty string (no expiry) by default.

-f, --inactive INACTIVE

defines the number of days after the password exceeded its maximum age where the user is expected to replace this password. The value is stored in the shadow password file. An input of 0 will disable an expired password with no delay. An input of -1 will blank the respective field in the shadow password file. See shadow(5)for more information. If not specified, useradd will use the default inactivity period specified by the INACTIVE variable in /etc/default/useradd, or -1 by default.

-F, --add-subids-for-system

Update /etc/subuid and /etc/subgid even when creating a system account with -r option.

-g, --gid GROUP

The name or the number of the user's primary group. The group name must exist. A group number must refer to an already existing group. If not specified, the behavior of useradd will depend on the USERGROUPS_ENAB variable in /etc/login.defs. If this variable is set to yes (or -U/--user-group is specified on the command line), a group will be created for the user, with the same name as the loginname. If the variable is set to no (or -N/--no-user-group is specified on the command line), useradd will set the primary group of the new user to the value specified by the GROUP variable in /etc/default/useradd, or 1000 by default.

-G, --groups GROUP1[,GROUP2,...[,GROUPN]]]

A list of supplementary groups which the user is also a member of. Each group is separated from the next by a comma, with no intervening whitespace. The groups are subject to the same restrictions as the group given with the -g option. The default is for the user to belong only to the initial group. In addition to passing in the -G flag, you can add the option GROUPS to the file /etc/default/useradd which in turn will add all users to those supplementary groups.

-h, --help

Display help message and exit.

-k, --skel SKEL_DIR

The skeleton directory, which contains files and directories to be copied in the user's home directory, when the home directory is created by useradd. This option is only valid if the -m (or --create-home) option is specified.

If this option is not set, the skeleton directory is defined by the SKEL variable in /etc/default/useradd or, by default, /etc/skel.

Absolute symlinks that link back to the skel directory will have the /etc/skel prefix replaced with the user's home directory.

If possible, the ACLs and extended attributes are copied.

-K, --key KEY=VALUE

Overrides /etc/login.defs defaults (UID_MIN, UID_MAX, UMASK, PASS_MAX_DAYS and others). Example: -K PASS_MAX_DAYS =-1 can be used when creating an account to turn off password aging. Multiple -K options can be specified, e.g.: -K UID_MIN =100 -K UID_MAX=499

-l, --no-log-init

Do not add the user to the lastlog and faillog databases. By default, the user's entries in the lastlog and faillog databases are reset to avoid reusing the entry from a previously deleted user.

If this option is not specified, useradd will also consult the variable LOG_INIT in the /etc/default/useradd if set to no the user will not be added to the lastlog and faillog databases.

-m, --create-home

Create the user's home directory if it does not exist. The files and directories contained in the skeleton directory (which can be defined with the -k option) will be copied to the home directory. By default, if this option is not specified and CREATE_HOME is not enabled, no home directories are created.

The directory where the user's home directory is created must exist and have proper SELinux context and permissions. Otherwise the user's home directory cannot be created or accessed.

-M, --no-create-home

Do not create the user's home directory, even if the system wide setting from /etc/login.defs (CREATE_HOME) is set to yes.

-N, --no-user-group

Do not create a group with the same name as the user, but add the user to the group specified by the -g option or by the GROUP variable in /etc/default/useradd. The default behavior (if the -g, -N, and -U options are not specified) is defined by the USERGROUPS_ENAB variable in /etc/login.defs.

-o, --non-unique

allows the creation of an account with an already existing UID. This option is only valid in combination with the -u option. As a user identity serves as key to map between users on one hand and permissions, file ownerships and other aspects that determine the system's behavior on the other hand, more than one login name will access the account of the given UID.

-p, --password PASSWORD

defines an initial password for the account. PASSWORD is expected to be encrypted, as returned by crypt (3). Within a shell script, this option allows to create efficiently batches of users. Without this option, the new account will be locked and with no password defined, i.e. a single exclamation mark in the respective field of /etc/shadow. This is a state where the user won't be able to access the account or to define a password himself.

Note:Avoid this option on the command line because the password (or encrypted password) will be visible by users listing the processes.

You should make sure the password respects the system's password policy.

-r, --system

Create a system account. System users will be created with no aging information in /etc/shadow, and their numeric identifiers are chosen in the SYS_UID_MIN-SYS_UID_MAX range, defined in /etc/login.defs, instead of UID_MIN-UID_MAX (and their GID counterparts for the creation of groups).

Note that useradd will not create a home directory for such a user, regardless of the default setting in /etc/login.defs (CREATE_HOME). You have to specify the -m options if you want a home directory for a system account to be created.

Note that this option will not update /etc/subuid and /etc/subgid. You have to specify the -F options if you want to update the files for a system account to be created.

-R, --root CHROOT_DIR

Apply changes in the CHROOT_DIR directory and use the configuration files from the CHROOT_DIR directory. Only absolute paths are supported.

-P, --prefix PREFIX_DIR

Apply changes to configuration files under the root filesystem found under the directory PREFIX_DIR. This option does not chroot and is intended for preparing a cross-compilation target. Some limitations: NIS and LDAP users/groups are not verified. PAM authentication is using the host files. No SELINUX support.

-s, --shell SHELL

sets the path to the user's login shell. Without this option, the system will use the SHELL variable specified in /etc/default/useradd, or, if that is as well not set, the field for the login shell in /etc/passwd remains empty.

-u, --uid UID

The numerical value of the user's ID. This value must be unique, unless the -o option is used. The value must be non-negative. The default is to use the smallest ID value greater than or equal to UID_MIN and greater than every other user. See also the -r option and the UID_MAX description.

-U, --user-group

Create a group with the same name as the user, and add the user to this group. The default behavior (if the -g, -N, and -U options are not specified) is defined by the USERGROUPS_ENAB variable in /etc/login.defs.

-Z, --selinux-user SEUSER

defines the SELinux user for the new account. Without this option, SELinux uses the default user. Note that the shadow system doesn't store the selinux-user, it uses semanage(8) for that.

--selinux-range SERANGE

defines the SELinux MLS range for the new account. Without this option, SELinux uses the default range. Note that the shadow system doesn't store the selinux-range, it uses semanage(8) for that. This option is only valid if the -Z (or --selinux-user) option is specified.

### Changing the default values
When invoked with only the -D option, useradd will display the current default values. When invoked with -D plus other options, useradd will update the default values for the specified options. Valid default-changing options are:

-b, --base-dir BASE_DIR

sets the path prefix for a new user's home directory. The user's name will be affixed to the end of BASE_DIR to form the new user's home directory name, if the -d option is not used when creating a new account. This option sets the HOME variable in /etc/default/useradd.

-e, --expiredate EXPIRE_DATE

sets the date on which newly created user accounts are disabled. This option sets the EXPIRE variable in /etc/default/useradd.

-f, --inactive INACTIVE

defines the number of days after the password exceeded its maximum age where the user is expected to replace this password. See shadow(5)for more information. This option sets the INACTIVE variable in /etc/default/useradd.

-g, --gid GROUP

sets the default primary group for newly created users, accepting group names or a numerical group ID. The named group must exist, and the GID must have an existing entry. This option sets the GROUP variable in /etc/default/useradd.

-s, --shell SHELL

defines the default login shell for new users. This option sets the SHELL variable in /etc/default/useradd.

## NOTES
The system administrator is responsible for placing the default user files in the /etc/skel/ directory (or any other skeleton directory specified in /etc/default/useradd or on the command line).

## CAVEATS
You may not add a user to a NIS or LDAP group. This must be performed on the corresponding server.

Similarly, if the username already exists in an external user database such as NIS or LDAP, useradd will deny the user account creation request.

Usernames must start with a lower case letter or an underscore, followed by lower case letters, digits, underscores, or dashes. They can end with a dollar sign. In regular expression terms: [a-z_][a-z0-9_-]*[$]?

Usernames may only be up to 256 characters long.

## CONFIGURATION
The following configuration variables in /etc/login.defs change the behavior of this tool:

CREATE_HOME (boolean)

Indicate if a home directory should be created by default for new users. This setting does not apply to system users, and can be overridden on the command line.

GID_MAX (number), GID_MIN (number)

Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers. The default value for GID_MIN (resp. GID_MAX) is 1000 (resp. 60000).

HOME_MODE (number)

The mode for new home directories. If not specified, the UMASK is used to create the mode. useradd and newusers use this to set the mode of the home directory they create.

LASTLOG_UID_MAX (number)

Highest user ID number for which the lastlog entries should be updated. As higher user IDs are usually tracked by remote user identity and authentication services there is no need to create a huge sparse lastlog file for them. No LASTLOG_UID_MAX option present in the configuration means that there is no user ID limit for writing lastlog entries.

MAIL_DIR (string)

The mail spool directory. This is needed to manipulate the mailbox when its corresponding user account is modified or deleted. If not specified, a compile-time default is used. The parameter CREATE_MAIL_SPOOL in /etc/default/useradd determines whether the mail spool should be created.

MAIL_FILE (string)

Defines the location of the users mail spool files relatively to their home directory.

The MAIL_DIR and MAIL_FILE variables are used by useradd, usermod, and userdel to create, move, or delete the user's mail spool.

MAX_MEMBERS_PER_GROUP (number)

Maximum members per group entry. When the maximum is reached, a new group entry (line) is started in /etc/group (with the same name, same password, and same GID). The default value is 0, meaning that there are no limits in the number of members in a group.

This feature (split group) permits to limit the length of lines in the group file. This is useful to make sure that lines for NIS groups are not larger than 1024 characters.

If you need to enforce such limit, you can use 25.

Note: split groups may not be supported by all tools (even in the Shadow toolsuite). You should not use this variable unless you really need it.

PASS_MAX_DAYS (number)

The maximum number of days a password may be used. If the password is older than this, a password change will be forced. If not specified, -1 will be assumed (which disables the restriction).

PASS_MIN_DAYS (number)

The minimum number of days allowed between password changes. Any password changes attempted sooner than this will be rejected. If not specified, 0 will be assumed (which disables the restriction).

PASS_WARN_AGE (number)

The number of days warning given before a password expires. A zero means warning is given only upon the day of expiration, a value of -1 means no warning is given. If not specified, no warning will be provided.

SUB_GID_MIN (number), SUB_GID_MAX (number), SUB_GID_COUNT (number)

If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate group IDs) allocate SUB_GID_COUNT unused group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each new user. The default values for SUB_GID_MIN, SUB_GID_MAX, SUB_GID_COUNT are respectively 100000, 600100000 and 65536.

SUB_UID_MIN (number), SUB_UID_MAX (number), SUB_UID_COUNT (number)

If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs) allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. The default values for SUB_UID_MIN, SUB_UID_MAX, SUB_UID_COUNT are respectively 100000, 600100000 and 65536.

SYS_GID_MAX (number), SYS_GID_MIN (number)

Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers. The default value for SYS_GID_MIN (resp. SYS_GID_MAX) is 101 (resp. GID_MIN-1).

SYS_UID_MAX (number), SYS_UID_MIN (number)

Range of user IDs used for the creation of system users by useradd or newusers. The default value for SYS_UID_MIN (resp. SYS_UID_MAX) is 101 (resp. UID_MIN-1).

TCB_AUTH_GROUP (boolean)

If yes, newly created tcb shadow files will be group owned by the auth group.

TCB_SYMLINKS (boolean)

If yes, the location of the user tcb directory to be created will not be automatically set to /etc/tcb/user, but will be computed depending on the UID of the user, according to the following algorithm:

```
if ( UID is less than 1000) {

  use /etc/tcb/user
} else if ( UID is less than 1000000) {

  kilos = UID / 1000

  use /etc/tcb/:kilos/user

  make symlink /etc/tcb/user to the above directory
} else {

  megas = UID / 1000000

  kilos = ( UID / megas * 1000000 ) / 1000

  use /etc/tcb/:megas/:kilos/user

  make symlink /etc/tcb/user to the above directory
}

```

UID_MAX (number), UID_MIN (number)

Range of user IDs used for the creation of regular users by useradd or newusers. The default value for UID_MIN (resp. UID_MAX) is 1000 (resp. 60000).

UMASK (number)

The file mode creation mask is initialized to this value. If not specified, the mask will be initialized to 022. useradd and newusers use this mask to set the mode of the home directory they create if HOME_MODE is not set.

It is also used by pam_umask as the default umask value.

USE_TCB (boolean)

If yes, the tcb(5) password shadowing scheme will be used.

USERGROUPS_ENAB (boolean)

If set to yes, userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user.

## FILES
/etc/passwd

User account information.

/etc/shadow

Secure user account information.

/etc/group

Group account information.

/etc/gshadow

Secure group account information.

/etc/default/useradd

Default values for account creation.

/etc/shadow-maint/useradd-pre.d/*, /etc/shadow-maint/useradd-post.d/*

Run-part files to execute during user addition. The environment variable ACTION will be populated with useradd and SUBJECT with the username. useradd-pre.d will be executed prior to any user addition. useradd-post.d will execute after user addition. If a script exits non-zero then execution will terminate.

/etc/skel/

Directory containing default files.

/etc/subgid

Per user subordinate group IDs.

/etc/subuid

Per user subordinate user IDs.

/etc/login.defs

Shadow password suite configuration.

## EXIT VALUES
The useradd command exits with the following values:

0

success

1

can't update password file

2

invalid command syntax

3

invalid argument to option

4

UID already in use (and no -o)

6

specified group doesn't exist

9

username or group name already in use

10

can't update group file

12

can't create home directory

14

can't update SELinux user mapping

19

invalid user or group name

## SEE ALSO
chfn(1), chsh(1), passwd(1), crypt(3), groupadd(8), groupdel(8), groupmod(8), login.defs(5), newusers(8), subgid(5), subuid(5), userdel(8), usermod(8).


userdel

package: shadow-utils

title: userdel(8)

summary: delete a user account and related files

text:
# userdel(8)

## NAME
userdel - delete a user account and related files

## SYNOPSIS
userdel [options] LOGIN

## DESCRIPTION
The userdel command modifies the system account files, deleting all entries that refer to the user name LOGIN. The named user must exist.

## OPTIONS
The options which apply to the userdel command are:

-f, --force

This option forces the removal of the user account and any other requested actions, skipping any safety checks. Note: This option is dangerous and may leave your system in an inconsistent state.

-h, --help

Display help message and exit.

-r, --remove

Files in the user's home directory will be removed along with the home directory itself and the user's mail spool. Files located in other file systems will have to be searched for and deleted manually. The mail spool is defined by the MAIL_DIR variable in the login.defs file.

-R, --root CHROOT_DIR

Apply changes in the CHROOT_DIR directory and use the configuration files from the CHROOT_DIR directory. Only absolute paths are supported.

-P, --prefix PREFIX_DIR

Apply changes in the PREFIX_DIR directory and use the configuration files from the PREFIX_DIR directory. This option does not chroot and is intended for preparing a cross-compilation target. Some limitations: NIS and LDAP users/groups are not verified. PAM authentication is using the host files. No SELINUX support.

-Z, --selinux-user

Remove any SELinux user mapping for the user's login.

## CONFIGURATION
The following configuration variables in /etc/login.defs change the behavior of this tool:

MAIL_DIR (string)

The mail spool directory. This is needed to manipulate the mailbox when its corresponding user account is modified or deleted. If not specified, a compile-time default is used. The parameter CREATE_MAIL_SPOOL in /etc/default/useradd determines whether the mail spool should be created.

MAIL_FILE (string)

Defines the location of the users mail spool files relatively to their home directory.

The MAIL_DIR and MAIL_FILE variables are used by useradd, usermod, and userdel to create, move, or delete the user's mail spool.

MAX_MEMBERS_PER_GROUP (number)

Maximum members per group entry. When the maximum is reached, a new group entry (line) is started in /etc/group (with the same name, same password, and same GID). The default value is 0, meaning that there are no limits in the number of members in a group.

This feature (split group) permits to limit the length of lines in the group file. This is useful to make sure that lines for NIS groups are not larger than 1024 characters.

If you need to enforce such limit, you can use 25.

Note: split groups may not be supported by all tools (even in the Shadow toolsuite). You should not use this variable unless you really need it.

TCB_SYMLINKS (boolean)

If yes, the location of the user tcb directory to be created will not be automatically set to /etc/tcb/user, but will be computed depending on the UID of the user, according to the following algorithm:

```
if ( UID is less than 1000) {

  use /etc/tcb/user
} else if ( UID is less than 1000000) {

  kilos = UID / 1000

  use /etc/tcb/:kilos/user

  make symlink /etc/tcb/user to the above directory
} else {

  megas = UID / 1000000

  kilos = ( UID / megas * 1000000 ) / 1000

  use /etc/tcb/:megas/:kilos/user

  make symlink /etc/tcb/user to the above directory
}

```

USE_TCB (boolean)

If yes, the tcb(5) password shadowing scheme will be used.

USERDEL_CMD (string)

If defined, this command is run when removing a user. It should remove any at/cron/print jobs etc. owned by the user to be removed (passed as the first argument). The return code of the script is not taken into account.

Here is an example script, which removes the user's cron, at and print jobs:

```
#! /bin/sh
# Check for the required argument.
if [ $# != 1 ]; then
	echo "Usage: $0 username"
	exit 1
fi
# Remove cron jobs.
crontab -r -u $1
# Remove at jobs.
# Note that it will remove any jobs owned by the same UID,
# even if it was shared by a different username.
AT_SPOOL_DIR=/var/spool/cron/atjobs
find $AT_SPOOL_DIR -name "[^.]*" -type f -user $1 -delete \;
# Remove print jobs.
lprm $1
# All done.
exit 0

```

USERGROUPS_ENAB (boolean)

If set to yes, userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user.

## FILES
/etc/group

Group account information.

/etc/login.defs

Shadow password suite configuration.

/etc/passwd

User account information.

/etc/shadow

Secure user account information.

/etc/shadow-maint/userdel-pre.d/*, /etc/shadow-maint/userdel-post.d/*

Run-part files to execute during user deletion. The environment variable ACTION will be populated with userdel and SUBJECT with the username. userdel-pre.d will be executed prior to any user deletion. userdel-post.d will execute after user deletion. If a script exits non-zero then execution will terminate.

/etc/subgid

Per user subordinate group IDs.

/etc/subuid

Per user subordinate user IDs.

## EXIT VALUES
The userdel command exits with the following values:

0

success

1

can't update password file

2

invalid command syntax

6

specified user doesn't exist

8

user currently logged in

10

can't update group file

12

can't remove home directory

## CAVEATS
userdel will not allow you to remove an account if there are running processes which belong to this account. In that case, you may have to kill those processes or lock the user's password or account and remove the account later. The -f option can force the deletion of this account.

You should manually check all file systems to ensure that no files remain owned by this user.

You may not remove any NIS attributes on a NIS client. This must be performed on the NIS server.

If USERGROUPS_ENAB is defined to yes in /etc/login.defs, userdel will delete the group with the same name as the user. To avoid inconsistencies in the passwd and group databases, userdel will check that this group is not used as a primary group for another user, and will just warn without deleting the group otherwise. The -f option can force the deletion of this group.

## SEE ALSO
chfn(1), chsh(1), passwd(1), login.defs(5), gpasswd(8), groupadd(8), groupdel(8), groupmod(8), subgid(5), subuid(5), useradd(8), usermod(8).


usermod

title: usermod(8)

summary: modify a user account

text:
# usermod(8)

## NAME
usermod - modify a user account

## SYNOPSIS
usermod [options] LOGIN

## DESCRIPTION
The usermod command modifies the system account files.

## OPTIONS
The options which apply to the usermod command are:

-a, --append

Add the user to the supplementary group(s). Use only with the -G option.

-c, --comment COMMENT

update the comment field of the user in /etc/passwd, which is normally modified using the chfn(1) utility.

-d, --home HOME_DIR

The user's new login directory. If the -m option is given, the contents of the current home directory will be moved to the new home directory, which is created if it does not already exist. If the current home directory does not exist the new home directory will not be created.

-e, --expiredate EXPIRE_DATE

The date on which the user account will be disabled. The date is specified in the format YYYY-MM-DD. Integers as input are interpreted as days after 1970-01-01. An input of -1 or an empty string will blank the account expiration field in the shadow password file. The account will remain available with no date limit.

This option requires a /etc/shadow file. A /etc/shadow entry will be created if there were none.

-f, --inactive INACTIVE

defines the number of days after the password exceeded its maximum age during which the user may still login by immediately replacing the password. This grace period before the account becomes inactive is stored in the shadow password file. An input of 0 will disable an expired password with no delay. An input of -1 will blank the respective field in the shadow password file. See shadow(5) for more information. This option requires a /etc/shadow file. A /etc/shadow entry will be created if there were none.

-g, --gid GROUP

The name or numerical ID of the user's new primary group. The group must exist. Any file from the user's home directory owned by the previous primary group of the user will be owned by this new group.

The group ownership of files outside of the user's home directory must be fixed manually.

The change of the group ownership of files inside of the user's home directory is also not done if the home dir owner uid is different from the current or new user id. This is a safety measure for special home directories such as /.

-G, --groups GROUP1[,GROUP2,...[,GROUPN]]]

A list of supplementary groups which the user is also a member of. Each group is separated from the next by a comma, with no intervening whitespace. The groups must exist. If the user is currently a member of a group which is not listed, the user will be removed from the group. This behaviour can be changed via the -a option, which appends the user to the current supplementary group list.

-l, --login NEW_LOGIN

The name of the user will be changed from LOGIN to NEW_LOGIN. Nothing else is changed. In particular, the user's home directory or mail spool should probably be renamed manually to reflect the new login name.

-L, --lock

Lock a user's password. This puts a '!' in front of the encrypted password, effectively disabling the password. You can't use this option with -p or -U. Note: if you wish to lock the account (not only access with a password), you should also set the EXPIRE_DATE to 1.

-m, --move-home

moves the content of the user's home directory to the new location. If the current home directory does not exist the new home directory will not be created. This option is only valid in combination with the -d (or --home) option.

usermod will try to adapt the ownership of the files and to copy the modes, ACL and extended attributes, but manual changes might be needed afterwards.

-o, --non-unique

allows to change the user ID to a non-unique value. This option is only valid in combination with the -u option. As a user identity serves as key to map between users on one hand and permissions, file ownerships and other aspects that determine the system's behavior on the other hand, more than one login name will access the account of the given UID.

-p, --password PASSWORD

defines a new password for the user. PASSWORD is expected to be encrypted, as returned by crypt (3). Note: Avoid this option on the command line because the password (or encrypted password) will be visible by users listing the processes.

The password will be written in the local /etc/passwd or /etc/shadow file. This might differ from the password database configured in your PAM configuration.

You should make sure the password respects the system's password policy.

-r, --remove

Remove the user from named supplementary group(s). Use only with the -G option.

-R, --root CHROOT_DIR

Apply changes in the CHROOT_DIR directory and use the configuration files from the CHROOT_DIR directory. Only absolute paths are supported.

-P, --prefix PREFIX_DIR

Apply changes within the directory tree starting with PREFIX_DIR and use as well the configuration files located there. This option does not chroot and is intended for preparing a cross-compilation target. Some limitations: NIS and LDAP users/groups are not verified. PAM authentication is using the host files. No SELINUX support.

-s, --shell SHELL

changes the user's login shell. An empty string for SHELL blanks the field in /etc/passwd and logs the user into the system's default shell.

-u, --uid UID

The new value of the user's ID. This value must be unique, unless the -o option is used. The value must be non-negative.

The user's mailbox, and any files which the user owns and which are located in the user's home directory will have the file user ID changed automatically.

The ownership of files outside of the user's home directory must be fixed manually.

The change of the user ownership of files inside of the user's home directory is also not done if the home dir owner uid is different from the current or new user id. This is a safety measure for special home directories such as /.

No checks will be performed with regard to the UID_MIN, UID_MAX, SYS_UID_MIN, or SYS_UID_MAX from /etc/login.defs.

-U, --unlock

Unlock a user's password. This removes the '!' in front of the encrypted password. You can't use this option with -p or -L. Note: if you wish to unlock the account (not only access with a password), you should also set the EXPIRE_DATE (for example to 99999, or to the EXPIRE value from /etc/default/useradd).

-v, --add-subuids FIRST-LAST

Add a range of subordinate uids to the user's account. This option may be specified multiple times to add multiple ranges to a user's account.

No checks will be performed with regard to SUB_UID_MIN, SUB_UID_MAX, or SUB_UID_COUNT from /etc/login.defs.

-V, --del-subuids FIRST-LAST

Remove a range of subordinate uids from the user's account. This option may be specified multiple times to remove multiple ranges to a user's account. When both --del-subuids and --add-subuids are specified, the removal of all subordinate uid ranges happens before any subordinate uid range is added.

No checks will be performed with regard to SUB_UID_MIN, SUB_UID_MAX, or SUB_UID_COUNT from /etc/login.defs.

-w, --add-subgids FIRST-LAST

Add a range of subordinate gids to the user's account. This option may be specified multiple times to add multiple ranges to a user's account.

No checks will be performed with regard to SUB_GID_MIN, SUB_GID_MAX, or SUB_GID_COUNT from /etc/login.defs.

-W, --del-subgids FIRST-LAST

Remove a range of subordinate gids from the user's account. This option may be specified multiple times to remove multiple ranges to a user's account. When both --del-subgids and --add-subgids are specified, the removal of all subordinate gid ranges happens before any subordinate gid range is added.

No checks will be performed with regard to SUB_GID_MIN, SUB_GID_MAX, or SUB_GID_COUNT from /etc/login.defs.

-Z, --selinux-user SEUSER

defines the SELinux user to be mapped with LOGIN. An empty string ("") will remove the respective entry (if any). Note that the shadow system doesn't store the selinux-user, it uses semanage(8) for that.

--selinux-range SERANGE

defines the SELinux MLS range for the new account. Note that the shadow system doesn't store the selinux-range, it uses semanage(8) for that. This option is only valid if the -Z (or --selinux-user) option is specified.

## CAVEATS
You must make certain that the named user is not executing any processes when this command is being executed if the user's numerical user ID, the user's name, or the user's home directory is being changed. usermod checks this on Linux. On other operating systems it only uses utmp to check if the user is logged in.

You must change the owner of any crontab files or at jobs manually.

You must make any changes involving NIS on the NIS server.

## CONFIGURATION
The following configuration variables in /etc/login.defs change the behavior of this tool:

LASTLOG_UID_MAX (number)

Highest user ID number for which the lastlog entries should be updated. As higher user IDs are usually tracked by remote user identity and authentication services there is no need to create a huge sparse lastlog file for them. No LASTLOG_UID_MAX option present in the configuration means that there is no user ID limit for writing lastlog entries.

MAIL_DIR (string)

The mail spool directory. This is needed to manipulate the mailbox when its corresponding user account is modified or deleted. If not specified, a compile-time default is used. The parameter CREATE_MAIL_SPOOL in /etc/default/useradd determines whether the mail spool should be created.

MAIL_FILE (string)

Defines the location of the users mail spool files relatively to their home directory.

The MAIL_DIR and MAIL_FILE variables are used by useradd, usermod, and userdel to create, move, or delete the user's mail spool.

MAX_MEMBERS_PER_GROUP (number)

Maximum members per group entry. When the maximum is reached, a new group entry (line) is started in /etc/group (with the same name, same password, and same GID). The default value is 0, meaning that there are no limits in the number of members in a group.

This feature (split group) permits to limit the length of lines in the group file. This is useful to make sure that lines for NIS groups are not larger than 1024 characters.

If you need to enforce such limit, you can use 25.

Note: split groups may not be supported by all tools (even in the Shadow toolsuite). You should not use this variable unless you really need it.

SUB_GID_MIN (number), SUB_GID_MAX (number), SUB_GID_COUNT (number)

If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate group IDs) allocate SUB_GID_COUNT unused group IDs from the range SUB_GID_MIN to SUB_GID_MAX for each new user. The default values for SUB_GID_MIN, SUB_GID_MAX, SUB_GID_COUNT are respectively 100000, 600100000 and 65536.

SUB_UID_MIN (number), SUB_UID_MAX (number), SUB_UID_COUNT (number)

If /etc/subuid exists, the commands useradd and newusers (unless the user already have subordinate user IDs) allocate SUB_UID_COUNT unused user IDs from the range SUB_UID_MIN to SUB_UID_MAX for each new user. The default values for SUB_UID_MIN, SUB_UID_MAX, SUB_UID_COUNT are respectively 100000, 600100000 and 65536.

TCB_SYMLINKS (boolean)

If yes, the location of the user tcb directory to be created will not be automatically set to /etc/tcb/user, but will be computed depending on the UID of the user, according to the following algorithm:

```
if ( UID is less than 1000) {

  use /etc/tcb/user
} else if ( UID is less than 1000000) {

  kilos = UID / 1000

  use /etc/tcb/:kilos/user

  make symlink /etc/tcb/user to the above directory
} else {

  megas = UID / 1000000

  kilos = ( UID / megas * 1000000 ) / 1000

  use /etc/tcb/:megas/:kilos/user

  make symlink /etc/tcb/user to the above directory
}

```

USE_TCB (boolean)

If yes, the tcb(5) password shadowing scheme will be used.

## FILES
/etc/group

Group account information

/etc/gshadow

Secure group account information

/etc/login.defs

Shadow password suite configuration

/etc/passwd

User account information

/etc/shadow

Secure user account information

/etc/subgid

Per user subordinate group IDs

/etc/subuid

Per user subordinate user IDs

## SEE ALSO
chfn(1), chsh(1), passwd(1), crypt(3), gpasswd(8), groupadd(8), groupdel(8), groupmod(8), login.defs(5), subgid(5), subuid(5), useradd(8), userdel(8).


shadowsocks-libev

package: shadowsocks-libev

title: shadowsocks-libev(8)

summary: a lightweight and secure socks5 proxy

text:
# shadowsocks-libev(8)

## NAME
shadowsocks-libev - a lightweight and secure socks5 proxy

## SYNOPSIS
ss-local|ss-redir|ss-server|ss-tunnel|ss-manager [-s <server_host>] [-p <server_port>] [-l <local_port>] [-k <password>] [-m <encrypt_method>] [-f <pid_file>] [-t <timeout>] [-c <config_file>]

## DESCRIPTION
Shadowsocks-libev is a lightweight and secure socks5 proxy. It is a port of the original shadowsocks created by clowwindy. Shadowsocks-libev is written in pure C and takes advantage of libev to achieve both high performance and low resource consumption.

Shadowsocks-libev consists of five components. One is ss-server(1) that runs on a remote server to provide secured tunnel service. ss-local(1) and ss-redir(1) are clients on your local machines to proxy traffic(TCP/UDP or both). ss-tunnel(1) is a tool for local port forwarding.

While ss-local(1) works as a standard socks5 proxy, ss-redir(1) works as a transparent proxy and requires netfilter’s NAT module. For more information, check out the EXAMPLE section.

ss-manager(1) is a controller for multi-user management and traffic statistics, using UNIX domain socket to talk with ss-server(1). Also, it provides a UNIX domain socket or IP based API for other software. About the details of this API, please refer to the PROTOCOL section.

## OPTIONS
-s <server_host>

Set the server’s hostname or IP.

-l <local_port>

Set the local port number. Not available in server nor manager mode.

-k <password>, --password <password>

Set the password. The server and the client should use the same password.

--key <key_in_base64>

Set the key directly. The key should be encoded with URL-safe Base64. Not available in manager mode.

-m <encrypt_method>

Set the cipher. Shadowsocks-libev accepts 19 different ciphers:

aes-128-gcm, aes-192-gcm, aes-256-gcm, rc4-md5, aes-128-cfb, aes-192-cfb, aes-256-cfb, aes-128-ctr, aes-192-ctr, aes-256-ctr, bf-cfb, camellia-128-cfb, camellia-192-cfb, camellia-256-cfb, chacha20-ietf-poly1305, xchacha20-ietf-poly1305, salsa20, chacha20 and chacha20-ietf.

The default cipher is chacha20-ietf-poly1305.

If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may not work.

-a <user_name>

Run as a specific user.

-f <pid_file>

Start shadowsocks as a daemon with specific pid file.

-t <timeout>

Set the socket timeout in seconds. The default value is 60.

-c <config_file>

Use a configuration file.

-n <number>

Specify max number of open files. Not available in manager mode.

Only available on Linux.

-i <interface>

Send traffic through specific network interface. For example, there are three interfaces in your device, which is lo (127.0.0.1), eth0 (192.168.0.1) and eth1 (192.168.0.2). Meanwhile, you configure shadowsocks-libev to listen on 0.0.0.0:8388 and bind to eth1. That results the traffic go out through eth1, but not lo nor eth0. This option is useful to control traffic in multi-interface environment.

Not available in redir mode.

-b <local_address>

Specify the local address to bind. For servers: Specify the local address to use while this server is making outbound connections to remote servers on behalf of the clients.

For clients: Specify the local address to use while this client is making outbound connections to the server.

Not available in manager mode.

-u

Enable UDP relay. TPROXY is required in redir mode. You may need root permission.

-U

Enable UDP relay and disable TCP relay. Not available in local mode.

-T

Use tproxy instead of redirect (for tcp). Only available in redir mode.

-L <addr:port>

Specify destination server address and port for local port forwarding. Only available in tunnel mode.

-d <addr>

Setup name servers for internal DNS resolver (libc-ares). The default server is fetched from /etc/resolv.conf. Only available in server and manager mode.

--fast-open

Enable TCP fast open. Not available in redir nor tunnel mode, with Linux kernel > 3.7.0.

--reuse-port

Enable port reuse. Only available with Linux kernel > 3.9.0.

--no-delay

Enable TCP_NODELAY.

--acl <acl_config>

Enable ACL (Access Control List) and specify config file. Not available in redir nor tunnel mode.

--manager-address <path_to_unix_domain>

Specify UNIX domain socket address. Only available in server and manager mode.

--executable <path_to_server_executable>

Specify the executable path of ss-server. Only available in manager mode.

-v

Enable verbose mode.

-h|--help

Print help message.

## CONFIG FILE
The config file is written in JSON and easy to edit.

The config file equivalent of command line options is listed as example below.

Command line

JSON

-s some.server.net

"server": "some.server.net"

-s some.server.net -p 1234 (client)

"server": "some.server.net:1234"

-p 1234

"server_port": "1234"

-b 0.0.0.0

"local_address": "0.0.0.0"

-b 10.0.0.2

"local_ipv4_address": "10.0.0.2"

-b 2620:129:35::33

"local_ipv6_address": "2620:129:35::33"

-l 4321

"local_port": "4321"

-k "PasSworD"

"password": "PasSworD"

-m "aes-256-cfb"

"method": "aes-256-cfb"

-t 60

"timeout": 60

-a nobody

"user": "nobody"

--acl "/path/to/acl"

"acl": "/path/to/acl"

--fast-open

"fast_open": true

--reuse-port

"reuse_port": true

--no-delay

"no_delay": true

--plugin "obfs-server"

"plugin": "obfs-server"

--plugin-opts "obfs=http"

"plugin_opts": "obfs=http"

-6

"ipv6_first": true

-n "/etc/nofile"

"nofile": "/etc/nofile"

-d "8.8.8.8"

"nameserver": "8.8.8.8"

-L "somedns.net:53"

"tunnel_address": "somedns.net:53"

-u

"mode": "tcp_and_udp"

-U

"mode": "udp_only"

no "-u" nor "-U" options (default)

"mode": "tcp_only"

-T

"tcp_tproxy": true

(only in ss-manager’s config)

"port_password": {"1234":"PasSworD"}

## EXAMPLE
ss-redir requires netfilter’s NAT function. Here is an example:

```
# Create new chain
iptables -t nat -N SHADOWSOCKS
iptables -t mangle -N SHADOWSOCKS
# Ignore your shadowsocks server's addresses
# It's very IMPORTANT, just be careful.
iptables -t nat -A SHADOWSOCKS -d 123.123.123.123 -j RETURN
# Ignore LANs and any other addresses you'd like to bypass the proxy
# See Wikipedia and RFC5735 for full list of reserved networks.
# See ashi009/bestroutetb for a highly optimized CHN route list.
iptables -t nat -A SHADOWSOCKS -d 0.0.0.0/8 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 169.254.0.0/16 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 192.168.0.0/16 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 224.0.0.0/4 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 240.0.0.0/4 -j RETURN
# Anything else should be redirected to shadowsocks's local port
iptables -t nat -A SHADOWSOCKS -p tcp -j REDIRECT --to-ports 12345
# Add any UDP rules
ip rule add fwmark 0x01/0x01 table 100
ip route add local 0.0.0.0/0 dev lo table 100
iptables -t mangle -A SHADOWSOCKS -p udp --dport 53 -j TPROXY --on-port 12345 --tproxy-mark 0x01/0x01
# Apply the rules
iptables -t nat -A PREROUTING -p tcp -j SHADOWSOCKS
iptables -t mangle -A PREROUTING -j SHADOWSOCKS
# Start the shadowsocks-redir
ss-redir -u -c /etc/config/shadowsocks.json -f /var/run/shadowsocks.pid
```

## PROTOCOL
ss-manager(1) provides several APIs through UDP protocol

Send UDP commands in the following format to the manager-address provided to ss-manager(1):

command: [JSON data]

To add a port:

add: {"server_port": 8001, "password":"7cd308cc059"}

To remove a port:

remove: {"server_port": 8001}

To receive a pong:

ping

Then ss-manager(1) will send back the traffic statistics:

stat: {"8001":11370}

## SEE ALSO
ss-local(1), ss-server(1), ss-tunnel(1), ss-redir(1), ss-manager(1), iptables(8), /etc/shadowsocks-libev/config.json


shake

package: shake

title: shake(8)

text:
# shake(8)

## NAME
Shake - Rewrite fragmented files, maybe improving performance.

## SYNOPSIS
shake [OPTION]... [FILE|DIRECTORY]...

## DESCRIPTION
Rewrite fragmented or misplaced files, maybe improving performance. Reads file list from standard input if there is no files in the arguments. You have to mount your partition with the user_xattr option.

-c, --max-crumbc

max number of crumbs

-C, --max-fragc

max number of fragments

-d, --max-deviance

max distance between file start and it's ideal position

-h, --help

you're looking at me !

-L, --no-locks

don't put a lock on written files

-m, --many-fs

shake subdirectories that are on different filesystems

-n, --new

age of "new" files, which will be shak()ed

-o, --old

age of "old" files, which won't be shak()ed

-p, --pretend

don't alter files

-r, --crumbratio

ratio of the file under which a fragment is a crumb

-s, --smallsize

the size under which a file is considered small

-S, --bigsize

the size under which a file is considered big

-t, --small-tolerance multiply crumbratio and divide maxfnumber of small files

-T, --big-tolerance

multiply crumbratio and divide maxfnumber of big files

-v, --verbose

increase the verbosity level

-V, --version

show version number and copyright

-X, --no-xattr

disable usage of xattr

## USAGE
If there is no FILES shake read from stdin.

Please refer to http://vleu.net/shake/ for detailed instructions.

## EXAMPLES
See fragmention of a file :

shake --pretend --verbose --verbose FILE

Shake all file in a dir, recursively :

shake --old=0 DIR

Shake all mp3 in subdirectory, puting together those close in lexical order :

find -iname '*.mp3' | sort | shake

## REPORTING BUGS
Report bugs to <brice.arnould+shake@gmail.com> or at https://github.com/unbrice/shake/issues

## COPYRIGHT
Copyright (C) 2006-2009 Brice Arnould. Permission is granted to copy, distribute and/or modify documentation under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the file FDL.txt .

Copyright © 2006-2011 Brice Arnould. Shake comes with ABSOLUTELY NO WARRANTY. You may redistribute copies of Shake under the terms of the GNU General Public License version or greater. For more information about these matters, see the file named GPL.txt.


unattr

title: unattr(8)

text:
# unattr(8)

## NAME
Unattr - remove choosen xattr from files, recursively.

## SYNOPSIS
unattr [OPTION]... <FILE|DIRECTORY>...

## DESCRIPTION
Remove choosen xattr from files, recursively.

-a, --attr

specify the name of a new attribute

-h, --help

help

-V, --version

show version number and copyright

## EXAMPLES
Remove shake xattrs :

unattr --attr=shake.ptime FILES

Remove beagle xattrs :

unattr -a Beagle.MTime -a Beagle.AttrTime -a Beagle.Fingerprint -a Beagle.Uid FILES

## REPORTING BUGS
Report bugs to <brice.arnould+shake@gmail.com> or at https://github.com/unbrice/shake/issues

## COPYRIGHT
Copyright (C) 2006-2009 Brice Arnould. Permission is granted to copy, distribute and/or modify documentation under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the file FDL.txt .

Copyright © 2006-2008 Brice Arnould. Unattr comes with ABSOLUTELY NO WARRANTY. You may redistribute copies of Unattr under the terms of the GNU General Public License. For more information about these matters, see the file named GPL.txt.


shapercontrol

package: shapercontrol

title: shapercontrol(8)

text:
# shapercontrol(8)

## NAME
shaperconrol - administration tool for ISP traffic shaper

## SYNOPSIS
shaperconrol [options] command [ip] [rate]

## DESCRIPTION
sc(8) is a command-line tool intended to simplify administration of traffic shaper for Internet service providers.

### Main features

- Fast loading of large rulesets.

- Effective traffic classification with u32 hashing filters.

- Loading of data from any relational database supported by Perl DBI module.

- Synchronization of rules with database.

- Batch command execution mode for scripting purposes.

- Support of different traffic limiting methods: shaping, policing, and hybrid.

## DEPENDENCIES
DBI and corresponding database-dependent module (e.g. DBD::Pg for PostgreSQL, DBD::SQLite for SQLite, etc), AppConfig, Carp, Getopt::Long, Pod::Usage, Sys::Syslog, Term::ANSIColor.

## PREREQUISITES

### Command-line tools
tc(8) from iproute2 suite.

### Linux kernel configuration

- u32 classifier (option CONFIG_NET_CLS_U32=m or y)

- Traffic control actions (CONFIG_NET_CLS_ACT=y and CONFIG_NET_ACT_GACT=m or y)

## COREQUISITES
If you prefer policing as a rate limiting method, you should enable the kernel option CONFIG_NET_ACT_POLICE.

## COMMANDS
add <ip> <rate>

Add rules for specified IP

calc [ip]

Calculate and print internally used variables: classids, hash table numbers and keys.

change | mod <ip> <rate>

Change rate for specified IP

dbadd <ip> <rate>

Add database entry

dbchange | dbmod <ip> <rate>

Change database entry

dbcreate

Create database and table

dbdel | dbrm <ip>

Delete database entry

dblist | dbls [ip]

List database entries. If no IP specified, all entries are listed.

del | rm <ip>

Delete rules

help

Show help for commands, options and list available database drivers. Generate and show manpage if -v 1 option is specified.

init

Initialization of firewall and QoS rules. Should be used only for manual rule editing.

list | ls [ip]

List rules in a short and human-readable form. If no IP specified, all entries are listed.

load | start

Load IPs and rates from database and create ruleset

ratecvt <rate> <unit>

Convert rate from one unit to another

reload | restart

Reset rules and load database

reset | stop

Delete all shaping rules

show [ip]

Show rules explicitly. If no IP specified, all entries are listed.

status

Show status of shaping rules

sync

Synchronize rules with database

version

Output version

## OPTIONS
-f, --config file

Read configuration from specified file

-o, --out_if if_name

Name of output network interface

-i, --in_if if_name

Name of input network interface

-d, --debug mode

Possible values:

0

no debug (default value),

1

print command lines with nonzero return values,

2

print all command lines without execution.

-v, --verbose mode

Possible values:

0

no verbose messages (default)

1

enable verbose messages (i.e. for results of `sync' command)

2

disable usage of tc(8) batch rule loading

3

do 1 + 2

-q, --quiet

Suppress output of error messages from tc(8).

-c, --colored

Colorize the output.

-C, --cid classid

Use the specified classid value in add, change and del commands instead of automatically calculated.

-j, --joint

Joint mode. Add, change and del commands will be applied to rules and database entries simultaneously.

-b, --batch

Batch mode. Commands and options will be read from STDIN.

-N, --network "net/mask ..."

Networks for IP to classid mapping (see sc.conf(5) for details).

--filter_network "net/mask ..."

Networks for hashing filter generation (see sc.conf(5) for details).

--bypass_int "net/mask ..."

Internal networks, whose traffic is transmitted without shaping.

--bypass_ext "net/mask ..."

External networks, whose traffic is transmitted without shaping.

--policer_burst_ratio real number

Ratio between the size of policer buffer size and bandwidth rate.

--quantum size

Amount of bytes a stream is allowed to dequeue before the next queue gets a turn.

-u, --rate_unit unit

Default rate unit

-r, --rate_ratio real number

Ratio between bandwidth rates in rules and in the database. Used only for load and sync commands.

-R, --root_qdisc string

Root qdisc ("htb" or "hfsc").

-L, --leaf_qdisc string

Leaf qdisc and parameters.

--db_driver name

Database driver.

--db_host host:port

Database server address or hostname.

--db_name name

Database name to use.

--db_user name

Database username.

--db_pass password

Database password. Remember that it is insecure to specify a password here.

-S, --syslog_enable

Send errors and warnings to syslog.

## RATE UNITS
All rates should be specified as integer numbers, possibly followed by a unit. Bare number implies the default unit (kibit). You may use another unit by changing "rate_unit" parameter in the configuration file or by setting the similar command line option.

bit

bit per second

kibit, Kibit

kibibit per second (1024)

kbit or Kbit

kilobit per second (1000)

mibit or Mibit

mebibit per second (1 048 576)

mbit or Mbit

megabit per second (10^6)

gibit or Gibit

gibibit per second (1 073 741 824)

gbit or Gbit

gigabit per second (10^9)

bps or Bps

byte per second

kibps or KiBps

kibibyte per second

kbps or KBps

kilobyte per second

mibps or MiBps

mebibyte per second

mbps or MBps

megabyte per second

gibps or GiBps

gibibyte per second

gbps or GBps

gigabyte per second

## USAGE
Load accounts from database and create all rules

"sc load" or "sc start"

Add class for IP 172.16.0.1 with 256kibit/s.

"sc add 172.16.0.1 256kibit"

Change rate to 512kibit/s

"sc change 172.16.0.1 512kibit"

Delete rules for 172.16.0.1

"sc del 172.16.0.1"

Reset all rules

"sc reset"

## CONFIGURATION
By default shaperconrol reads configuration from /etc/sc/sc.conf file and uses SQLite database at /etc/sc/sc.db. See sc.conf(5) for details.

## DIAGNOSTICS
The error messages are printed to standard error. To print the command lines that return nonzero error codes, use -d 1 option. To print all generated command lines without execution, use -d 2 option. To disable the usage of the batch mode of tc(8), use -v 2 option. For more information please read the section OPTIONS.

Program may return one of the following exit codes or the exit code of the failed command line that aborted the execution:

0

correct functioning

1

incorrect parameter

2

IP-to-classid collision

3

parameter is undefined

4

IP already exists

5

IP does not exist

6

incorrect command

7

insufficient privileges

## BUGS
For performance reasons, script does not perform checks that require additional executions of external programs.

## RESTRICTIONS
Due to limited number of classids (from 2 to ffff) you can create only 65534 classes on a single interface. For similar reasons sc(8) only supports networks with masks from /16 to /31.

For simplicity of u32 hash table numbers calculation, the maximum number of entries in "filter_network" parameter is 255, and the number of hashing filters is limited by 0x7ff.

## SEE ALSO
sc.conf(5), tc(8), tc-htb(8), tc-hfsc(8), Getopt::Long(3), AppConfig(3), http://lartc.org/howto/lartc.adv-filter.hashing.html, http://ace-host.stuart.id.au/russell/files/tc/doc/cls_u32.txt.

## AUTHOR
Stanislav Kruchinin <stanislav.kruchinin@gmail.com>

## LICENSE AND COPYRIGHT
Copyright (c) 2008-2014. Stanislav Kruchinin.

License: GNU GPL version 2 or later

This is free software: you are free to change and redistribute it. There is NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.


halt

package: shepherd

title: halt(8)

summary: manual page for halt 0.10.4

text:
# halt(8)

## NAME
halt - manual page for halt 0.10.4

## DESCRIPTION
halt [OPTIONS...] Halt or power off the system.

-s, --socket=FILE

send commands to FILE

--help

display this help and exit

--usage

display short usage message and exit

--version

display version information and exit

Mandatory or optional arguments to long options are also mandatory or optional to the corresponding short options.

## REPORTING BUGS
Report bugs to: bug-guix@gnu.org .

GNU Shepherd general home page: <https://www.gnu.org/software/shepherd/>

General help using GNU software: <http://www.gnu.org/gethelp/>

## COPYRIGHT
Copyright © 2024 the Shepherd authors License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.

## SEE ALSO
The full documentation for halt is maintained as a Texinfo manual. If the info and halt programs are properly installed at your site, the command

info shepherd

should give you access to the complete manual.


reboot

title: reboot(8)

summary: manual page for reboot 0.10.4

text:
# reboot(8)

## NAME
reboot - manual page for reboot 0.10.4

## DESCRIPTION
reboot [OPTIONS...] Reboot the system.

-s, --socket=FILE

send commands to FILE

--help

display this help and exit

--usage

display short usage message and exit

--version

display version information and exit

Mandatory or optional arguments to long options are also mandatory or optional to the corresponding short options.

## REPORTING BUGS
Report bugs to: bug-guix@gnu.org .

GNU Shepherd general home page: <https://www.gnu.org/software/shepherd/>

General help using GNU software: <http://www.gnu.org/gethelp/>

## COPYRIGHT
Copyright © 2024 the Shepherd authors License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.

## SEE ALSO
The full documentation for reboot is maintained as a Texinfo manual. If the info and reboot programs are properly installed at your site, the command

info shepherd

should give you access to the complete manual.


shorewall-init

package: shorewall

title: shorewall-init(8)

summary: Companion package

text:
# shorewall-init(8)

## NAME
shorewall-init - Companion package

## SYNOPSIS
shorewall-init [start|stop]

## DESCRIPTION
Shorewall-init is an optional package (added in Shorewall 4.4.10) that can be installed along with Shorewall, Shorewall6, Shorewall-lite and/or Shorewall6-lite. It provides two key features:

1.It can close (stop) the firewall during boot prior to starting the network. This can prevent unwanted connections from being accepted after the network comes up but before the firewall is started.

2.It can interface with your distribution's ifup/ifdown scripts and/or NetworkManager to allow firewall actions when an interface starts or stops.

These two capabilities can be enabled separately.

After you install the shorewall-init package, you can activate it by modifying the Shorewall-init configuration file:

•On Debian-based system, the file is /etc/default/shorewall-init.

•On other systems, the file is /etc/sysconfig/shorewall-init.

To activate the safe boot feature, edit the configuration file and set PRODUCTS to a space-separated list of Shorewall products that you want to be closed before networking starts.

Example:

PRODUCTS="shorewall shorewall6"

You also must insure that the compiled scripts for the listed products are compiled using Shorewall 4.4.10 or later.

Shorewall

shorewall compile

Shorewall6

shorewall6 compile

Shorewall-lite

On the administrative system, enter the command shorewall export firewall from the firewall's configuration directory.

Shorewall6-lite

On the administrative system, enter the command shorewall6 export firewall from the firewall's configuration directory.

The second feature (ifup/ifdown and NetworkManager integration) should only be activated on systems that do not use a link status monitor line swping or LSM.

•Edit the configuration file and set IFUPDOWN=1

For NetworkManager integration, you will want to disable firewall startup at boot and delay it to when your interface comes up. For this to work correctly, you must set the required or the optional option on at least one interface then:

•On Debian-based systems, edit /etc/default/product for each product listed in the PRODUCTS setting and set startup=0.

•On other systems, use the distribution's service control tool (insserv, chkconfig, etc.) to disable startup of the products listed in the PRODUCTS setting.

On a laptop with both Ethernet and wireless interfaces, you will want to make both interfaces optional and set the REQUIRE_INTERFACE option to Yes in shorewall.conf[1](5) or shorewall6.conf[1] (5). This causes the firewall to remain stopped until at least one of the interfaces comes up.

## FILES
/etc/default/shorewall-init (Debian-based systems) or /etc/sysconfig/shorewall-init (other distributions)

## SEE ALSO
shorewall(8)

## NOTES
1.

shorewall.conf

https://shorewall.org/manpages/shorewall.conf.html